nucleus-core-ts 0.10.21 → 0.10.23

package/dist/server.js

@@ -108,7 +108,7 @@ end
 redis.call('ZADD', KEYS[1], now, ARGV[4])
 redis.call('PEXPIRE', KEYS[1], windowMs + 1000)
 return {1, count + 1}
-`,hashIdentity=(identity)=>createHash2("sha256").update(identity.trim().toLowerCase()).digest("base64url").slice(0,16),RateLimiterBackendError,DEFAULT_AUTH_LOGIN,DEFAULT_AUTH_REGISTER,DEFAULT_AUTH_PASSWORD_RESET,DEFAULT_AUTH_MAGIC_LINK,DEFAULT_CONFIG3;var init_RateLimiter=__esm(()=>{RateLimiterBackendError=class RateLimiterBackendError extends Error{constructor(message){super(message);this.name="RateLimiterBackendError"}};DEFAULT_AUTH_LOGIN={window:"15m",max:5,blockDuration:"30m"},DEFAULT_AUTH_REGISTER={window:"1h",max:3,blockDuration:"1h"},DEFAULT_AUTH_PASSWORD_RESET={window:"1h",max:3,blockDuration:"1h"},DEFAULT_AUTH_MAGIC_LINK={window:"1h",max:5,blockDuration:"1h"},DEFAULT_CONFIG3={enabled:!0,strategy:"sliding-window",keyPrefix:"rl:",authRoutes:{window:"1m",max:10,login:DEFAULT_AUTH_LOGIN,register:DEFAULT_AUTH_REGISTER,passwordReset:DEFAULT_AUTH_PASSWORD_RESET,magicLink:DEFAULT_AUTH_MAGIC_LINK},publicRoutes:{window:"1m",max:100},privateRoutes:{window:"1m",max:60},byIp:!0,byUserId:!0,byEndpoint:!1,skipSuccessfulRequests:!1,headers:{remaining:"X-RateLimit-Remaining",reset:"X-RateLimit-Reset",limit:"X-RateLimit-Limit"},whitelist:[],blacklist:[]}});import{createCipheriv as createCipheriv2,createDecipheriv as createDecipheriv2,randomBytes as randomBytes4,scryptSync as scryptSync2,timingSafeEqual as timingSafeEqual2}from"crypto";var VERSION="v1",IV_LEN2=12,KEY_LEN=32,SCRYPT_SALT="nucleus-secrets-v1",keyCache,deriveKey2=(masterKey)=>{let cached=keyCache.get(masterKey);if(cached)return cached;let key2=scryptSync2(masterKey,SCRYPT_SALT,KEY_LEN);return keyCache.set(masterKey,key2),key2},encryptSecret=(plaintext,masterKey)=>{if(!masterKey)throw Error("secrets encryption key is empty");let iv=randomBytes4(IV_LEN2),cipher=createCipheriv2("aes-256-gcm",deriveKey2(masterKey),iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return[VERSION,iv.toString("base64"),tag.toString("base64"),ciphertext.toString("base64")].join(":")},decryptSecret=(envelope,masterKey)=>{if(!masterKey)throw Error("secrets encryption key is empty");let parts=envelope.split(":");if(parts.length!==4||parts[0]!==VERSION)throw Error("not an encrypted secret envelope");let[,ivB64,tagB64,ctB64]=parts,decipher=createDecipheriv2("aes-256-gcm",deriveKey2(masterKey),Buffer.from(ivB64,"base64"));return decipher.setAuthTag(Buffer.from(tagB64,"base64")),Buffer.concat([decipher.update(Buffer.from(ctB64,"base64")),decipher.final()]).toString("utf-8")},previewOf=(plaintext)=>{let len=plaintext.length;if(len===0)return"";if(len<12)return`\u2022\u2022\u2022\u2022${len}`;return`\u2022\u2022\u2022\u2022${plaintext.slice(-4)}`};var init_crypto=__esm(()=>{keyCache=new Map});function discoverSlots(config){let slots=new Map,add=(slot)=>{let id=`${slot.scope}.${slot.key}`;if(!slots.has(id))slots.set(id,slot)},valueAt=(scope,key2)=>{let node=config;for(let segment of scope.split(".")){if(!isPlainObject(node))return;node=node[segment]}if(!isPlainObject(node))return;let value=node[key2];if(typeof value==="string")return value;if(Array.isArray(value)&&value.every((entry)=>typeof entry==="string"))return value.length>0?value.join(","):void 0;return};for(let descriptor of SECRET_SLOT_DESCRIPTORS)for(let scope of expandPath(config,descriptor.path,descriptor.always===!0)){let leaf=scope.split(".").pop()??descriptor.group,group=descriptor.path.endsWith("*")?`${descriptor.group}:${leaf}`:descriptor.group;for(let declared of descriptor.keys)add({scope,key:declared.key,kind:declared.kind??kindFor(declared.key),label:declared.label,group,required:declared.required??!1,requiredWhen:declared.requiredWhen,hint:declared.hint,secret:declared.secret??descriptor.secret??!0,configValue:valueAt(scope,declared.key)})}let walk=(node,path,depth)=>{if(depth>6)return;for(let[key2,value]of Object.entries(node)){if(SKIP_SECTIONS.has(key2))continue;let childPath=path?`${path}.${key2}`:key2;if(isPlainObject(value)){walk(value,childPath,depth+1);continue}if(typeof value!=="string"&&value!==void 0&&value!==null)continue;if(!CREDENTIAL_KEY_PATTERN.test(key2))continue;if(NOT_A_CREDENTIAL.has(key2.toLowerCase()))continue;if(BOOT_ONLY_PATHS.has(`${path}.${key2}`))continue;let owner=path.split(".").pop(),label=owner&&owner.toLowerCase()!==key2.toLowerCase()?`${humanize(owner)} \u2014 ${humanize(key2)}`:humanize(key2);add({scope:path,key:key2,kind:kindFor(key2),label,group:path.split(".")[0]??"other",required:!1,secret:!0,configValue:typeof value==="string"?value:void 0})}};return walk(config,"",0),[...slots.values()].sort((a,b)=>a.group.localeCompare(b.group)||a.scope.localeCompare(b.scope)||a.key.localeCompare(b.key))}var CREDENTIAL_KEY_PATTERN,NOT_A_CREDENTIAL,BOOT_ONLY_PATHS,SKIP_SECTIONS,kindFor=(key2)=>{let k=key2.toLowerCase();if(k.includes("json"))return"json";if(k.includes("connection"))return"connection_string";if(k.includes("privatekey")||k.includes("private_key"))return"pem";if(k.includes("clientid")||k.includes("client_id"))return"text";return"password"},humanize=(key2)=>key2.replace(/[_-]+/g," ").replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/\s+/g," ").trim().replace(/\b\w/g,(c)=>c.toUpperCase()),SECRET_SLOT_DESCRIPTORS,isPlainObject=(value)=>typeof value==="object"&&value!==null&&!Array.isArray(value),expandPath=(config,path,always=!1)=>{let segments=path.split("."),scopes2=[{path:"",node:config}];for(let segment of segments){let next=[];for(let current of scopes2){if(!isPlainObject(current.node))continue;if(segment==="*")for(let[childKey,childValue]of Object.entries(current.node))next.push({path:current.path?`${current.path}.${childKey}`:childKey,node:childValue});else if(segment in current.node)next.push({path:current.path?`${current.path}.${segment}`:segment,node:current.node[segment]});else if(always)next.push({path:current.path?`${current.path}.${segment}`:segment,node:{}})}scopes2=next}return scopes2.filter((s)=>isPlainObject(s.node)).map((s)=>s.path)},looksLikeEnvName=(value)=>!!value&&/^[A-Z][A-Z0-9_]{2,}$/.test(value);var init_registry=__esm(()=>{CREDENTIAL_KEY_PATTERN=/(secret|password|passwd|apikey|api_key|accesskey|access_key|privatekey|private_key|token|credential|connection_string|connectionstring|clientid|client_id|encryptionkey|encryption_key|servicekey|service_key|json_file_path|jsonfilepath)$/i,NOT_A_CREDENTIAL=new Set(["preventapikeymanagement","allowapplicationkeys","maxkeysperuser","tokenurl","accesstoken","refreshtoken","sessiontoken"]),BOOT_ONLY_PATHS=new Set(["authorization.godminPassword","authorization.godminEmail","authentication.accessToken.secret","authentication.refreshToken.secret","authentication.sessionToken.secret","backup.encryptionKey","notification.channels.telegram.botToken","notification.channels.webhook.headers","domains.cloudflare.apiToken"]),SKIP_SECTIONS=new Set(["entities","systemTables","system_tables","tables","columns","indexes","routes","cors","swagger","secrets"]),SECRET_SLOT_DESCRIPTORS=[{path:"authentication.oauth.providers.*",group:"oauth",label:"OAuth / SSO",keys:[{key:"clientId",kind:"text",label:"Client ID",required:!0},{key:"clientSecret",kind:"password",label:"Client Secret",required:!0},{key:"tenantId",kind:"text",label:"Tenant ID"},{key:"redirectUri",kind:"text",secret:!1,required:!0,label:"Reply URL (Redirect URI)",hint:"The return address registered with the provider. It must be written identically on the provider side too (e.g. Entra > Authentication > Redirect URIs)."}]},{always:!0,path:"email.gmail",group:"email",label:"Gmail (service account)",keys:[{key:"service_account_json",kind:"json",label:"Service Account JSON",required:!0,requiredWhen:"enabled"}]},{always:!0,path:"email.azure",group:"email",label:"Azure Communication Services",keys:[{key:"connection_string",kind:"connection_string",label:"Connection String",required:!0,requiredWhen:"enabled"}]},{always:!0,path:"email.smtp",group:"email",label:"SMTP (Microsoft 365, Exchange, corporate mail)",keys:[{key:"enabled",kind:"boolean",secret:!1,label:"Send through this provider",hint:"The provider that is switched on carries the mail. If the panel cannot read this flag, the card stays \u201CNot set\u201D even when the details are filled in."},{key:"host",kind:"text",label:"Server",required:!0,requiredWhen:"enabled",hint:"smtp.office365.com for Microsoft 365"},{key:"port",kind:"text",label:"Port",hint:"Left empty this is 587 (STARTTLS). 465 means implicit TLS."},{key:"user",kind:"text",label:"Mailbox",required:!0,requiredWhen:"enabled",hint:"The address the password belongs to. It is also the sender address."},{key:"password",kind:"password",label:"Password / app password",required:!0,requiredWhen:"enabled",hint:"If the account has multi-factor authentication, the app password Microsoft generated. In Exchange Online, SMTP AUTH is off per tenant by default and a correct password is refused too \u2014 ask IT to turn it on for that mailbox."},{key:"sender_address",kind:"text",label:"Sender address (optional)",hint:"Left empty, the mailbox itself is used. If you enter a different address, Exchange requires that mailbox to have been granted \u201CSend As\u201D for it; without that the send is refused."},{key:"from_name",kind:"text",label:"Display name",hint:"The name the recipient reads in their inbox, e.g. the name of the portal."}]},{always:!0,path:"service",group:"service",label:"The server\u2019s own key",keys:[{key:"api_key",kind:"password",label:"Service API key",hint:"Some work the server has to do in its OWN name \u2014 counting how many people answered a survey, for instance. That cannot be done with an employee\u2019s permissions, and should not be. Generate the key in the admin panel and paste it here; it carries its owner\u2019s roles, not godmin\u2019s. Left empty, this work is skipped silently."}]},{always:!0,path:"storage.smb",group:"storage",label:"SMB / CIFS share",keys:[{key:"username",kind:"text",label:"Username",required:!0},{key:"password",kind:"password",label:"Password",required:!0}]},{secret:!1,always:!0,path:"storage",group:"storage",label:"File store",keys:[{key:"provider",kind:"text",label:"Storage kind",hint:"local (the server\u2019s own disk) or smb (a corporate file server). The change takes effect immediately."}]},{secret:!1,always:!0,path:"storage.smb",group:"storage",label:"SMB / CIFS share",keys:[{key:"url",kind:"text",label:"Share address",hint:"Paste it exactly as the customer sent it: smb://server/share \u2014 the server and the share name are read from this."},{key:"domain",kind:"text",label:"Domain",hint:"The domain part when the user is written as DOMAIN\\user. Leave empty if it is not needed."},{key:"base_path",kind:"text",label:"Folder inside the share",hint:"The subfolder uploads are gathered in. Empty means the root of the share."}]},{path:"payment.providers.*",group:"payment",label:"Payment provider",keys:[{key:"apiKey",kind:"password",label:"API Key",required:!0},{key:"secretKey",kind:"password",label:"Secret Key",required:!0},{key:"webhookSecret",kind:"password",label:"Webhook Secret"}]},{path:"captcha",group:"captcha",label:"Captcha",keys:[{key:"secretKey",kind:"password",label:"Secret Key"}]},{secret:!1,path:"authentication",group:"portal",label:"Portal address",keys:[{key:"trustedAppOrigins",kind:"list",label:"Trusted origins",required:!0,hint:"The address(es) the portal is installed at. Password-reset and SSO return links are built from these. Wildcard: *.company.com"}]},{secret:!1,always:!0,path:"email",group:"email",label:"Email provider",keys:[{key:"provider",kind:"text",label:"Provider to use",hint:"azure or gmail. Left empty, whichever provider is switched on is used."}]},{secret:!1,always:!0,path:"email.azure",group:"email",label:"Azure Communication Services",keys:[{key:"enabled",kind:"boolean",label:"Azure email enabled",hint:"Entering the connection string is not enough on its own \u2014 sending is turned on by this switch."},{key:"sender_address",kind:"text",label:"Sender address"},{key:"from_name",kind:"text",label:"Sender name",hint:"The name the recipient sees in their inbox in place of the address. Empty means the address shows."}]},{secret:!1,always:!0,path:"email.gmail",group:"email",label:"Gmail (service account)",keys:[{key:"enabled",kind:"boolean",label:"Gmail email enabled"},{key:"from_email",kind:"text",label:"Sender address"},{key:"from_name",kind:"text",label:"Sender name",hint:"The name the recipient sees in their inbox in place of the address. Empty means the address shows."}]}]});import{and as and9,eq as eq13}from"drizzle-orm";class SecretsStore{db;resolveTable;masterKey;constructor(deps){this.db=deps.db,this.resolveTable=deps.resolveTable,this.masterKey=deps.masterKey}table(schemaName){return this.resolveTable(SECRETS_TABLE,schemaName)}async loadAll(schemaName){let values=new Map,failed=[],table=this.table(schemaName);if(!table)return{values,failed,tableMissing:!0};let rows;try{rows=await this.db.select().from(table).where(eq13(col6(table,"isActive"),!0))}catch(error){if(isMissingTableError(error))return{values,failed,tableMissing:!0};throw error}for(let row of rows)try{values.set(cacheKeyOf(row.scope,row.key),decryptSecret(row.valueEnc,this.masterKey))}catch{failed.push(`${row.scope}.${row.key}`)}return{values,failed}}async list(schemaName){let table=this.table(schemaName);if(!table)return[];try{return(await this.db.select().from(table)).filter((r)=>r.isActive!==!1).map(rowToMeta)}catch(error){if(isMissingTableError(error))return[];throw error}}async get(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return null;return(await this.db.select().from(table).where(and9(eq13(col6(table,"scope"),scope),eq13(col6(table,"key"),key2))).limit(1))[0]??null}async set(params,schemaName){let table=this.table(schemaName);if(!table)return null;let existing=await this.get(params.scope,params.key,schemaName),valueEnc=encryptSecret(params.value,this.masterKey),preview=previewOf(params.value),now=new Date;if(existing)await this.db.update(table).set({valueEnc,previousEnc:existing.valueEnc,preview,kind:params.kind??existing.kind??"text",description:params.description??existing.description,version:(existing.version??1)+1,rotatedAt:now,isActive:!0,updatedAt:now,updatedBy:params.actorId??null}).where(eq13(col6(table,"id"),existing.id));else await this.db.insert(table).values({scope:params.scope,key:params.key,valueEnc,preview,kind:params.kind??"text",description:params.description??null,version:1,isActive:!0,createdBy:params.actorId??null,updatedBy:params.actorId??null});let saved=await this.get(params.scope,params.key,schemaName);return saved?rowToMeta(saved):null}async rollback(scope,key2,actorId,schemaName){let table=this.table(schemaName);if(!table)return null;let existing=await this.get(scope,key2,schemaName);if(!existing?.previousEnc)return null;let plaintext=decryptSecret(existing.previousEnc,this.masterKey),now=new Date;await this.db.update(table).set({valueEnc:existing.previousEnc,previousEnc:existing.valueEnc,preview:previewOf(plaintext),version:(existing.version??1)+1,rotatedAt:now,updatedAt:now,updatedBy:actorId??null}).where(eq13(col6(table,"id"),existing.id));let saved=await this.get(scope,key2,schemaName);return saved?rowToMeta(saved):null}async remove(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return!1;let existing=await this.get(scope,key2,schemaName);if(!existing)return!1;return await this.db.delete(table).where(eq13(col6(table,"id"),existing.id)),!0}async touch(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return;await this.db.update(table).set({lastUsedAt:new Date}).where(and9(eq13(col6(table,"scope"),scope),eq13(col6(table,"key"),key2)))}async reencryptAll(newMasterKey,schemaName){let table=this.table(schemaName);if(!table)return{migrated:0,failed:[]};let rows=await this.db.select().from(table),failed=[],planned=[];for(let row of rows)try{let plaintext=decryptSecret(row.valueEnc,this.masterKey),previous=row.previousEnc?encryptSecret(decryptSecret(row.previousEnc,this.masterKey),newMasterKey):null;planned.push({id:row.id,valueEnc:encryptSecret(plaintext,newMasterKey),previousEnc:previous})}catch{failed.push(`${row.scope}.${row.key}`)}if(failed.length>0)return{migrated:0,failed};return await this.db.transaction(async(tx)=>{for(let row of planned)await tx.update(table).set({valueEnc:row.valueEnc,previousEnc:row.previousEnc}).where(eq13(col6(table,"id"),row.id))}),this.masterKey=newMasterKey,{migrated:planned.length,failed}}}var SECRETS_TABLE="nucleusSecrets",col6=(table,key2)=>table[key2],toIso=(value)=>value?new Date(value).toISOString():null,UNDEFINED_TABLE="42P01",isMissingTableError=(error)=>{let seen=new Set,current=error;while(current&&typeof current==="object"&&!seen.has(current)){seen.add(current);let record=current;if(record.code===UNDEFINED_TABLE)return!0;if(typeof record.message==="string"&&/relation .* does not exist/i.test(record.message))return!0;current=record.cause}return!1},rowToMeta=(row)=>({id:row.id,scope:row.scope,key:row.key,kind:row.kind??"text",preview:row.preview??"",description:row.description,version:row.version??1,canRollback:!!row.previousEnc,rotatedAt:toIso(row.rotatedAt),lastUsedAt:toIso(row.lastUsedAt),updatedAt:toIso(row.updatedAt),updatedBy:row.updatedBy}),cacheKeyOf=(scope,key2)=>`${scope}.${key2}`;var init_store2=__esm(()=>{init_crypto()});class SecretsService{store;logger;getRedis;refreshIntervalMs;schemaName;cache=new Map;timer=null;localRevision=0;loaded=!1;tableMissing=!1;warnedTableMissing=!1;constructor(deps){this.store=deps.store,this.logger=deps.logger,this.getRedis=deps.getRedis,this.refreshIntervalMs=deps.refreshIntervalMs??DEFAULT_REFRESH_MS,this.schemaName=deps.schemaName}async start(){if(await this.refresh(),this.timer)return;this.timer=setInterval(()=>{this.refreshIfStale()},this.refreshIntervalMs),this.timer.unref?.()}stop(){if(this.timer)clearInterval(this.timer);this.timer=null}isReady(){return this.loaded}size(){return this.cache.size}isTableMissing(){return this.tableMissing}async refresh(){try{let{values,failed,tableMissing}=await this.store.loadAll(this.schemaName);if(tableMissing){if(this.tableMissing=!0,!this.warnedTableMissing)this.warnedTableMissing=!0,this.logger.warn("[Secrets] nucleus_secrets does not exist yet \u2014 env and literal values resolve normally; "+"the store activates automatically once the schema sync creates it");return}if(this.tableMissing)this.tableMissing=!1,this.warnedTableMissing=!1,this.logger.info("[Secrets] nucleus_secrets is now available \u2014 credential store active");if(this.cache=values,this.loaded=!0,failed.length>0)this.logger.error("[Secrets] Credentials failed to decrypt and were skipped",{slots:failed,hint:"master key changed without re-encrypting \u2014 POST /secrets/reencrypt with the old key"})}catch(error){this.logger.warn("[Secrets] Refresh failed, keeping cached values",{error:error instanceof Error?error.message:String(error)})}}async refreshIfStale(){let redis=this.getRedis?.();if(!redis)return this.refresh();try{let result=await redis.read(REVISION_KEY),remote=Number(result.data??0);if(Number.isFinite(remote)&&remote===this.localRevision&&this.loaded)return;await this.refresh(),this.localRevision=Number.isFinite(remote)?remote:this.localRevision}catch{await this.refresh()}}async bumpRevision(){let redis=this.getRedis?.();if(!redis)return;try{let next=Date.now();this.localRevision=next,await redis.create(REVISION_KEY,next)}catch{}}get(scope,key2){return this.cache.get(cacheKeyOf(scope,key2))}has(scope,key2){return this.cache.has(cacheKeyOf(scope,key2))}resolve(scope,key2,configValue){let fromDb=this.cache.get(cacheKeyOf(scope,key2));if(fromDb)return{value:fromDb,source:"db"};if(configValue){let fromEnv=process.env[configValue];if(fromEnv)return{value:fromEnv,source:"env"};if(looksLikeEnvName(configValue))return{value:void 0,source:"missing"};return{value:configValue,source:"literal"}}return{value:void 0,source:"missing"}}value(scope,key2,configValue){return this.resolve(scope,key2,configValue).value}listValue(scope,key2,configValue){let fallback=Array.isArray(configValue)?configValue.join(","):configValue,raw=this.value(scope,key2,fallback);if(!raw)return Array.isArray(configValue)?configValue:[];return raw.split(/[,;\n\r]+/).map((entry)=>entry.trim()).filter(Boolean)}flag(scope,key2,configValue){let raw=this.get(scope,key2);if(raw===void 0)return configValue===!0;return raw==="true"||raw==="1"}liveConfig(scope,node,keys){let live={...node};for(let key2 of keys){let declared=node[key2],configValue=typeof declared==="string"?declared:void 0;Object.defineProperty(live,key2,{get:()=>this.resolve(scope,key2,configValue).value,enumerable:!0,configurable:!0})}return live}async describe(config,slots){let discovered=slots??discoverSlots(config),stored=await this.store.list(this.schemaName),byId=new Map(stored.map((s)=>[cacheKeyOf(s.scope,s.key),s]));return discovered.map((slot)=>{let id=cacheKeyOf(slot.scope,slot.key),record=byId.get(id),{value,source}=this.resolve(slot.scope,slot.key,slot.configValue),envName=looksLikeEnvName(slot.configValue)?slot.configValue:void 0,gate=slot.requiredWhen?this.flag(slot.scope,slot.requiredWhen,configFlagAt(config,slot.scope,slot.requiredWhen)):!0;return{...slot,required:slot.required&&gate,configValue:envName,source,value:slot.secret?void 0:value,preview:slot.secret?source==="db"&&record?record.preview:value?previewOf(value):"":value??"",envName,version:record?.version,rotatedAt:record?.rotatedAt??null,canRollback:record?.canRollback??!1}})}async list(){return this.store.list(this.schemaName)}async set(params){let saved=await this.store.set(params,this.schemaName);return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential stored",{scope:params.scope,key:params.key,version:saved?.version,actor:params.actorId}),saved}async rollback(scope,key2,actorId){let saved=await this.store.rollback(scope,key2,actorId,this.schemaName);if(!saved)return null;return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential rolled back",{scope,key:key2,actor:actorId}),saved}async remove(scope,key2,actorId){if(!await this.store.remove(scope,key2,this.schemaName))return!1;return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential removed",{scope,key:key2,actor:actorId}),!0}async reencryptAll(newMasterKey){let result=await this.store.reencryptAll(newMasterKey,this.schemaName);return await this.refresh(),await this.bumpRevision(),result}}var REVISION_KEY="nucleus:secrets:revision",DEFAULT_REFRESH_MS=30000,configFlagAt=(config,scope,key2)=>{let node=config;for(let segment of scope.split(".")){if(typeof node!=="object"||node===null)return;node=node[segment]}if(typeof node!=="object"||node===null)return;let value=node[key2];if(typeof value==="boolean")return value;if(typeof value==="string")return value==="true"||value==="1";return};var init_SecretsService=__esm(()=>{init_crypto();init_registry();init_store2()});var resolveMasterKey=(configured)=>{if(configured){let fromEnv=process.env[configured];if(fromEnv)return fromEnv;if(!/^[A-Z][A-Z0-9_]{2,}$/.test(configured))return configured}return process.env.NUCLEUS_SECRETS_KEY||void 0};var init_Secrets=__esm(()=>{init_crypto();init_registry();init_SecretsService();init_store2()});var exports_schema={};__export(exports_schema,{reasonOf:()=>reasonOf,isAdditiveStatement:()=>isAdditiveStatement,ensureSchemaExists:()=>ensureSchemaExists,applySchemaPush:()=>applySchemaPush});import{sql as sql4}from"drizzle-orm";function reasonOf(error){if(!(error instanceof Error))return String(error);let extra=error;return[error.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}var validateIdentifier=(name)=>{if(!name||name.length>63)throw Error(`Invalid identifier: must be 1-63 characters, got ${name.length}`);if(!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))throw Error(`Invalid identifier: "${name}" contains unsafe characters`);return name},ensureSchemaExists=async(db,schemaName)=>{let safeName=validateIdentifier(schemaName),found=await db.execute(sql4`select 1 from pg_catalog.pg_namespace where nspname = ${safeName} limit 1`);if(rowCountOf(found)>0)return;await db.execute(sql4.raw(`CREATE SCHEMA IF NOT EXISTS "${safeName}"`))},rowCountOf=(result)=>{if(Array.isArray(result))return result.length;let rows=result?.rows;return Array.isArray(rows)?rows.length:0},ADDITIVE_PREFIXES,isAdditiveStatement=(statement)=>{let normalized=statement.trim().toUpperCase();if(/^ALTER TABLE .+ ADD COLUMN/.test(normalized))return!0;if(/^ALTER TABLE .+ ALTER COLUMN .+ SET DEFAULT /.test(normalized))return!0;if(/^ALTER TABLE .+ ADD CONSTRAINT /.test(normalized))return!0;if(/^ALTER TABLE .+ ALTER COLUMN .+ DROP NOT NULL$/.test(normalized))return!0;return ADDITIVE_PREFIXES.some((prefix)=>normalized.startsWith(prefix))},applySchemaPush=async(push,opts)=>{let{schemaName,allowDataLoss,logger:logger2,execute}=opts;if(push.hasDataLoss&&!allowDataLoss){let additive=push.statementsToExecute.filter(isAdditiveStatement),blocked=push.statementsToExecute.filter((s)=>!isAdditiveStatement(s));if(logger2.error(`[Schema] Destructive changes detected for schema "${schemaName}" but database.allowDataLoss is not enabled \u2014 ${blocked.length} statement(s) skipped. Set database.allowDataLoss: true to apply them.`,{warnings:push.warnings,statements:blocked}),additive.length===0||!execute)return!1;let applied=0;for(let statement of additive)try{await execute(statement),applied++}catch(error){logger2.warn(`[Schema] ${schemaName}: ${statement} \u2014 ${reasonOf(error)}`)}return logger2.info(`[Schema] Applied ${applied}/${additive.length} additive statement(s) for "${schemaName}" despite the destructive changes being held back`),applied>0}if(push.hasDataLoss)logger2.warn(`[Schema] Applying destructive changes to schema "${schemaName}" (database.allowDataLoss=true)`,{warnings:push.warnings});try{return await push.apply(),!0}catch(error){let message=error instanceof Error?error.message:String(error);if(!execute)return logger2.error(`[Schema] Could not apply schema changes to "${schemaName}": ${message}. The database does not match this build, so queries against the missing columns will fail.`,{warnings:push.warnings}),!1;logger2.error(`[Schema] The schema push for "${schemaName}" failed as a batch (${message}) \u2014 retrying its ${push.statementsToExecute.length} statement(s) one at a time so one bad statement does not hold back the rest.`);let applied=0,failures=[];for(let statement of push.statementsToExecute)try{await execute(statement),applied++}catch(statementError){failures.push(statement),logger2.error(`[Schema] ${schemaName}: ${statement} \u2014 ${reasonOf(statementError)}`)}if(failures.length>0)logger2.error(`[Schema] ${failures.length} of ${push.statementsToExecute.length} statement(s) could not be applied to "${schemaName}". Any query touching what they would have created will fail until they are.`);return applied>0}};var init_schema=__esm(()=>{ADDITIVE_PREFIXES=["CREATE TABLE IF NOT EXISTS","CREATE TABLE","CREATE SCHEMA IF NOT EXISTS","CREATE SCHEMA","CREATE INDEX IF NOT EXISTS","CREATE INDEX","CREATE UNIQUE INDEX IF NOT EXISTS","CREATE UNIQUE INDEX","CREATE TYPE","DO $$"]});var rowToTenantRecord=(row)=>({id:String(row.id||""),subdomain:String(row.subdomain||""),schemaName:String(row.schemaName||row.schema_name||""),companyId:String(row.companyId||row.company_id||""),companyName:row.companyName!=null?String(row.companyName):row.company_name!=null?String(row.company_name):null,godAdminEmail:String(row.godAdminEmail||row.god_admin_email||""),status:parseStatus(row.status),plan:row.plan!=null?String(row.plan):null,domain:row.domain!=null?String(row.domain):null,settings:parseJsonbToConfig(row.settings),trustedSources:parseTrustedSources(row.trustedSources||row.trusted_sources),maxUsers:row.maxUsers!=null?Number(row.maxUsers):row.max_users!=null?Number(row.max_users):null,provisionedAt:row.provisionedAt!=null?String(row.provisionedAt):row.provisioned_at!=null?String(row.provisioned_at):null,suspendedAt:row.suspendedAt!=null?String(row.suspendedAt):row.suspended_at!=null?String(row.suspended_at):null,suspendedReason:row.suspendedReason!=null?String(row.suspendedReason):row.suspended_reason!=null?String(row.suspended_reason):null}),rowToFeatureRecord=(row,parseConfig)=>({id:String(row.id||""),tenantId:String(row.tenantId||row.tenant_id||""),featureName:String(row.featureName||row.feature_name||""),enabled:Boolean(row.enabled),featureConfig:parseConfig(row.config)}),parseStatus=(value)=>{let valid=["provisioning","active","suspended","archived"],str3=String(value||"provisioning");return valid.includes(str3)?str3:"provisioning"},parseJsonbToConfig=(value)=>{if(!value||typeof value!=="object")return{};let result={};for(let[k,v]of Object.entries(value))if(typeof v==="string"||typeof v==="number"||typeof v==="boolean")result[k]=v;return result},parseTrustedSources=(value)=>{if(!Array.isArray(value))return[];return value.map((item)=>{let entry=item;return{allowHeaderAuth:entry.allowHeaderAuth===!0||entry.allow_header_auth===!0,allowedIps:Array.isArray(entry.allowedIps||entry.allowed_ips)?entry.allowedIps||entry.allowed_ips:void 0,allowedServices:Array.isArray(entry.allowedServices||entry.allowed_services)?entry.allowedServices||entry.allowed_services:void 0}})},normalizeHost=(host)=>{return((host||"").split(":")[0]||"").toLowerCase().replace(/\.$/,"")},extractSubdomain=(host)=>{let hostWithoutPort=host.split(":")[0]||"";if(hostWithoutPort==="localhost"||/^\d+\.\d+\.\d+\.\d+$/.test(hostWithoutPort))return null;let parts=hostWithoutPort.split(".");if(parts.length<3)return null;let subdomain=parts[0]||"";if(!subdomain||subdomain==="www")return null;return subdomain},isIpInCidr=(ip,cidr)=>{let[cidrIp,prefixStr]=cidr.split("/");if(!cidrIp||!prefixStr)return!1;let prefix=Number.parseInt(prefixStr,10);if(Number.isNaN(prefix))return!1;let ipParts=ip.split(".").map(Number),cidrParts=cidrIp.split(".").map(Number);if(ipParts.length!==4||cidrParts.length!==4)return!1;let ipNum=(ipParts[0]||0)<<24|(ipParts[1]||0)<<16|(ipParts[2]||0)<<8|(ipParts[3]||0),cidrNum=(cidrParts[0]||0)<<24|(cidrParts[1]||0)<<16|(cidrParts[2]||0)<<8|(cidrParts[3]||0),mask=~((1<<32-prefix)-1);return(ipNum&mask)===(cidrNum&mask)},isTrustedSource=(tenant,request,authMode,fallbackSources,vettedClientIp)=>{let ownSources=tenant.trustedSources,trustedSources=Array.isArray(ownSources)&&ownSources.length>0?ownSources:fallbackSources;if(!trustedSources||!Array.isArray(trustedSources)||trustedSources.length===0)return!1;let clientIp=vettedClientIp?.trim()||"",serviceId=request.headers.get("x-service-id")||"";for(let source of trustedSources){if(!source.allowHeaderAuth)continue;if(source.allowedIps&&source.allowedIps.length>0){if(source.allowedIps.some((allowedIp)=>{if(allowedIp.includes("/"))return isIpInCidr(clientIp,allowedIp);return clientIp===allowedIp}))return!0}if(source.allowedServices&&source.allowedServices.length>0){if(source.allowedServices.includes(serviceId))return!0}}return!1};function getDatabaseAuthMode(){return process.env.DATABASE_AUTH_MODE||"password"}function getRedisAuthMode(){return process.env.REDIS_AUTH_MODE||"password"}async function acquireToken(scope,label){let{DefaultAzureCredential,ManagedIdentityCredential,ClientSecretCredential}=await import("@azure/identity"),authMode=scope===PG_TOKEN_SCOPE?getDatabaseAuthMode():getRedisAuthMode(),clientId=process.env.AZURE_CLIENT_ID||"",tenantId=process.env.AZURE_TENANT_ID||"",clientSecret=process.env.AZURE_CLIENT_SECRET||"",credential;if(authMode==="managed_identity")credential=clientId?new ManagedIdentityCredential(clientId):new DefaultAzureCredential;else if(authMode==="service_principal"){if(!tenantId||!clientId||!clientSecret)throw Error("[azure-auth] service_principal auth requires AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET");credential=new ClientSecretCredential(tenantId,clientId,clientSecret)}else throw Error(`[azure-auth] Unsupported auth mode: ${authMode}`);let result=await credential.getToken(scope);if(!result)throw Error(`[azure-auth] Failed to acquire token for ${label}`);return logger.scoped("database.connect").info(`[azure-auth] ${label} token acquired`,{expiresAt:new Date(result.expiresOnTimestamp).toISOString(),authMode}),{token:result.token,expiresAt:result.expiresOnTimestamp}}async function getPostgresToken(){let now=Date.now();if(pgCachedToken&&now<pgTokenExpiresAt-REFRESH_BUFFER_MS)return pgCachedToken;let{token,expiresAt}=await acquireToken(PG_TOKEN_SCOPE,"PostgreSQL");return pgCachedToken=token,pgTokenExpiresAt=expiresAt,pgCachedToken}async function getRedisToken(){let now=Date.now();if(redisCachedToken&&now<redisTokenExpiresAt-REFRESH_BUFFER_MS)return redisCachedToken;let{token,expiresAt}=await acquireToken(REDIS_TOKEN_SCOPE,"Redis");return redisCachedToken=token,redisTokenExpiresAt=expiresAt,redisCachedToken}function getRedisTokenExpiresAt(){return redisTokenExpiresAt}var PG_TOKEN_SCOPE="https://ossrdbms-aad.database.windows.net/.default",REDIS_TOKEN_SCOPE="https://redis.azure.com/.default",REFRESH_BUFFER_MS=300000,pgCachedToken=null,pgTokenExpiresAt=0,redisCachedToken=null,redisTokenExpiresAt=0;var init_AzureTokenProvider=__esm(()=>{init_Logger2()});var exports_Azure={};__export(exports_Azure,{getRedisTokenExpiresAt:()=>getRedisTokenExpiresAt,getRedisToken:()=>getRedisToken,getRedisAuthMode:()=>getRedisAuthMode,getPostgresToken:()=>getPostgresToken,getDatabaseAuthMode:()=>getDatabaseAuthMode});var init_Azure=__esm(()=>{init_AzureTokenProvider()});import{access,mkdir as mkdir4}from"fs/promises";import{dirname as dirname3,resolve}from"path";var DEFAULT_CONFIG4,FILE_SIZE_UNITS,resolvePath=(path)=>{if(!path||typeof path!=="string")throw createFileManagerError("INVALID_PATH","Path must be a non-empty string",path,"resolvePath");return resolve(path)},extractDirectoryPath=(filePath)=>{let resolvedPath=resolvePath(filePath);return dirname3(resolvedPath)},ensureDirectoryExists=async(dirPath)=>{let resolvedPath=resolve(dirPath);try{await mkdir4(resolvedPath,{recursive:!0})}catch(error){if(error.code!=="EEXIST")throw createFileManagerError("DIRECTORY_CREATE_FAILED",`Failed to create directory: ${resolvedPath}`,resolvedPath,"ensureDirectory")}},formatFileSize=(bytes)=>{let size=bytes,unitIndex=0;while(size>=1024&&unitIndex<FILE_SIZE_UNITS.length-1)size/=1024,unitIndex++;return`${size.toFixed(2)} ${FILE_SIZE_UNITS[unitIndex]}`},validateFileExtension=(fileName,expectedExtension)=>{return fileName.toLowerCase().endsWith(expectedExtension.toLowerCase())},ensureFileExtension=(fileName,extension)=>{let normalizedExtension=extension.startsWith(".")?extension:`.${extension}`;if(validateFileExtension(fileName,normalizedExtension))return fileName;return`${fileName}${normalizedExtension}`},createFileManagerError=(code,message,path,operation)=>{return{code,message,path,operation:operation||"unknown"}},safeJsonStringify=(data)=>{try{return JSON.stringify(data,null,2)}catch{return"{}"}},executeBulkOperation=async(items,operation,concurrency=DEFAULT_CONFIG4.maxConcurrency)=>{let results=[];for(let i=0;i<items.length;i+=concurrency){let batch=items.slice(i,i+concurrency),batchPromises=[];for(let item of batch)batchPromises.push(operation(item));let batchResults=await Promise.allSettled(batchPromises);results.push(...batchResults)}return results},validateConfig=(config,options={})=>{let errors=[],warnings=[],strict=options.strict??!0;if(config.defaultEncoding!==void 0){if(!["utf-8","utf8","ascii","base64","hex"].includes(config.defaultEncoding))errors.push(`Invalid defaultEncoding: ${config.defaultEncoding}`)}if(config.maxConcurrency!==void 0){if(!Number.isInteger(config.maxConcurrency)||config.maxConcurrency<1)errors.push("maxConcurrency must be a positive integer");if(config.maxConcurrency>50)warnings.push("maxConcurrency > 50 may cause performance issues")}if(config.defaultCreateDir!==void 0&&typeof config.defaultCreateDir!=="boolean")errors.push("defaultCreateDir must be a boolean");if(config.defaultRecursive!==void 0&&typeof config.defaultRecursive!=="boolean")errors.push("defaultRecursive must be a boolean");if(strict&&!options.allowUnknownKeys){let validKeys=["defaultEncoding","defaultCreateDir","defaultRecursive","maxConcurrency"],configKeys=Object.keys(config);for(let key2 of configKeys)if(!validKeys.includes(key2))errors.push(`Unknown configuration key: ${key2}`)}return{isValid:errors.length===0,errors,warnings}},mergeConfig=(partial,base=DEFAULT_CONFIG4)=>{let validation=validateConfig(partial);if(!validation.isValid)throw createFileManagerError("CONFIG_VALIDATION_FAILED",`Configuration validation failed: ${validation.errors.join(", ")}`,void 0,"mergeConfig");return{...base,...partial}},parsePermissions=(mode)=>{let parseOctal=(octal)=>({read:Boolean(octal&4),write:Boolean(octal&2),execute:Boolean(octal&1)}),ownerMode=mode>>6&7,groupMode=mode>>3&7,othersMode=mode&7;return{owner:parseOctal(ownerMode),group:parseOctal(groupMode),others:parseOctal(othersMode)}},validatePermissionMode=(mode)=>{return Number.isInteger(mode)&&mode>=0&&mode<=511};var init_utils4=__esm(()=>{DEFAULT_CONFIG4={defaultEncoding:"utf-8",defaultCreateDir:!0,defaultRecursive:!0,maxConcurrency:5},FILE_SIZE_UNITS=["B","KB","MB","GB","TB"]});import{copyFile,rename as rename2,unlink as unlink4}from"fs/promises";import{basename,dirname as dirname4,extname,join as join5}from"path";var DEFAULT_ATOMIC_CONFIG,generateTempPath=(originalPath,suffix=".tmp")=>{let resolvedPath=resolvePath(originalPath),timestamp=Date.now(),random=Math.random().toString(36).substring(2,8);return`${resolvedPath}${suffix}.${timestamp}.${random}`},generateBackupPath=(originalPath,backupDir,useTimestamp=!0)=>{let resolvedPath=resolvePath(originalPath),dir=backupDir?resolvePath(backupDir):dirname4(resolvedPath),name=basename(resolvedPath),ext=extname(name),nameWithoutExt=basename(name,ext),timestamp=useTimestamp?`.${new Date().toISOString().replace(/[:.]/g,"-")}`:"",backupName=`${nameWithoutExt}.backup${timestamp}${ext}`;return join5(dir,backupName)},atomicWrite=async({path,data,tempSuffix=DEFAULT_ATOMIC_CONFIG.tempSuffix,backup=DEFAULT_ATOMIC_CONFIG.backup,sync=DEFAULT_ATOMIC_CONFIG.sync})=>{let resolvedPath=resolvePath(path),tempPath=generateTempPath(resolvedPath,tempSuffix),backupPath;try{if(await ensureDirectoryExists(extractDirectoryPath(resolvedPath)),backup){if(await Bun.file(resolvedPath).exists())backupPath=generateBackupPath(resolvedPath),await copyFile(resolvedPath,backupPath)}let bytesWritten=await Bun.write(tempPath,data);return await rename2(tempPath,resolvedPath),{success:!0,bytesWritten,tempPath,backupPath}}catch(error){try{await unlink4(tempPath)}catch{}throw createFileManagerError("ATOMIC_WRITE_FAILED",`Atomic write failed: ${error}`,resolvedPath,"atomicWrite")}},atomicJsonWrite=async(path,data,options={})=>{let jsonString=JSON.stringify(data,null,2);return atomicWrite({path,data:jsonString,...options})},createBackup=async({sourcePath,backupDir,keepOriginal=!0,timestamp=DEFAULT_ATOMIC_CONFIG.timestamp})=>{let resolvedSource=resolvePath(sourcePath);if(!await Bun.file(resolvedSource).exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"createBackup");let backupPath=generateBackupPath(resolvedSource,backupDir,timestamp);if(await ensureDirectoryExists(dirname4(backupPath)),keepOriginal)await copyFile(resolvedSource,backupPath);else await rename2(resolvedSource,backupPath);return backupPath},restoreFromBackup=async(backupPath,targetPath,deleteBackup=!1)=>{let resolvedBackup=resolvePath(backupPath),resolvedTarget=resolvePath(targetPath);if(!await Bun.file(resolvedBackup).exists())throw createFileManagerError("BACKUP_NOT_FOUND",`Backup file not found: ${backupPath}`,resolvedBackup,"restoreFromBackup");try{if(await ensureDirectoryExists(extractDirectoryPath(resolvedTarget)),deleteBackup)await rename2(resolvedBackup,resolvedTarget);else await copyFile(resolvedBackup,resolvedTarget);return!0}catch(error){return logger.scoped("storage.fs").error(`Failed to restore from backup ${backupPath}`,error,{backupPath}),!1}},safeUpdate=async(path,updateFunction,options={})=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),backupPath;try{if(await file.exists())backupPath=await createBackup({sourcePath:resolvedPath,keepOriginal:!0,timestamp:!0});let currentData=await file.exists()?await file.text():"",newData=await updateFunction(currentData),result=await atomicWrite({path:resolvedPath,data:newData,backup:!1,...options});return{success:result.success,bytesWritten:result.bytesWritten,tempPath:result.tempPath,backupPath}}catch(error){if(backupPath)try{await restoreFromBackup(backupPath,resolvedPath,!1)}catch(rollbackError){logger.scoped("storage.fs").error("Atomic write rollback failed",rollbackError,{backupPath})}throw error}},batchAtomicWrite=async(operations)=>{let successful=[],failed=[];for(let operation of operations)try{let result=await atomicWrite(operation);successful.push(result)}catch(error){failed.push({operation,error})}return{successful,failed}};var init_atomic=__esm(()=>{init_Logger2();init_utils4();DEFAULT_ATOMIC_CONFIG={tempSuffix:".tmp",backup:!1,sync:!0,timestamp:!0}});import{chmod,stat as stat3}from"fs/promises";var PERMISSION_MODES,setFilePermissions=async(path,mode)=>{let resolvedPath=resolvePath(path);if(!validatePermissionMode(mode))throw createFileManagerError("INVALID_PERMISSION_MODE",`Invalid permission mode: ${mode.toString(8)}`,resolvedPath,"setFilePermissions");try{return await chmod(resolvedPath,mode),!0}catch(error){return logger.scoped("storage.fs").error(`Failed to set permissions for ${path}`,error,{path,mode}),!1}},getFilePermissions=async(path)=>{let resolvedPath=resolvePath(path);try{let mode=(await stat3(resolvedPath)).mode&511,permissions=parsePermissions(mode);return{path:resolvedPath,mode,owner:permissions.owner,group:permissions.group,others:permissions.others}}catch(error){throw createFileManagerError("PERMISSION_READ_FAILED",`Failed to read permissions: ${error}`,resolvedPath,"getFilePermissions")}},hasPermissions=async(path,requiredMode)=>{try{return((await getFilePermissions(path)).mode&requiredMode)===requiredMode}catch{return!1}},makeReadable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|256;return setFilePermissions(path,newMode)},makeWritable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|128;return setFilePermissions(path,newMode)},makeExecutable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|64;return setFilePermissions(path,newMode)},makeReadOnly=async(path)=>{let newMode=(await getFilePermissions(path)).mode&-147;return setFilePermissions(path,newMode)},setCommonPermissions=async(path,pattern)=>{let mode=PERMISSION_MODES[pattern];return setFilePermissions(path,mode)};var init_permissions=__esm(()=>{init_Logger2();init_utils4();PERMISSION_MODES={OWNER_READ_WRITE:384,OWNER_ALL:448,GROUP_READ:416,GROUP_READ_WRITE:432,ALL_READ:420,ALL_READ_WRITE:438,ALL_READ_EXECUTE:493,ALL_FULL:511,READ_ONLY:292,EXECUTABLE:493}});var DEFAULT_STREAM_CONFIG,createFileWriter=async(path,options={})=>{let resolvedPath=resolvePath(path),config={...DEFAULT_STREAM_CONFIG,...options};await ensureDirectoryExists(extractDirectoryPath(resolvedPath));let writer=Bun.file(resolvedPath).writer({highWaterMark:config.highWaterMark}),isClosed=!1;return{write:(chunk)=>{if(isClosed)throw createFileManagerError("WRITER_CLOSED","Cannot write to closed writer",resolvedPath,"streamWrite");try{let result=writer.write(chunk);if(config.autoFlush)writer.flush();return result}catch(error){throw createFileManagerError("WRITE_FAILED",`Failed to write chunk: ${error}`,resolvedPath,"streamWrite")}},flush:()=>{if(isClosed)return 0;try{return writer.flush()}catch(error){throw createFileManagerError("FLUSH_FAILED",`Failed to flush writer: ${error}`,resolvedPath,"streamFlush")}},end:async(error)=>{if(isClosed)return 0;try{let result=await writer.end(error);return isClosed=!0,result}catch(err){throw isClosed=!0,createFileManagerError("END_FAILED",`Failed to end writer: ${err}`,resolvedPath,"streamEnd")}},ref:()=>{if(!isClosed)writer.ref()},unref:()=>{if(!isClosed)writer.unref()}}},writeStream=async(path,chunks,options={})=>{let writer=await createFileWriter(path,options),totalBytes=0;try{for(let chunk of chunks){let bytesWritten=writer.write(chunk);totalBytes+=bytesWritten}return await writer.flush(),await writer.end(),totalBytes}catch(error){try{await writer.end(error)}catch{}throw error}},appendStream=async(path,chunks,options={})=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),existingContent=await file.exists()?await file.arrayBuffer():new ArrayBuffer(0),allChunks=[];if(existingContent.byteLength>0)allChunks.push(existingContent);return allChunks.push(...chunks),writeStream(resolvedPath,allChunks,options)},copyFileStream=async(sourcePath,destinationPath,options={})=>{let resolvedSource=resolvePath(sourcePath),sourceFile=Bun.file(resolvedSource);if(!await sourceFile.exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"copyFileStream");let sourceStream=sourceFile.stream(),writer=await createFileWriter(destinationPath,options),totalBytes=0;try{let reader=sourceStream.getReader();while(!0){let{done,value}=await reader.read();if(done)break;let bytesWritten=writer.write(value);totalBytes+=bytesWritten}return await writer.flush(),await writer.end(),totalBytes}catch(error){try{await writer.end(error)}catch{}throw error}},readFileStream=async(path,chunkProcessor)=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath);if(!await file.exists())throw createFileManagerError("FILE_NOT_FOUND",`File not found: ${path}`,resolvedPath,"readFileStream");let reader=file.stream().getReader();try{while(!0){let{done,value}=await reader.read();if(done)break;await chunkProcessor(value)}}finally{reader.releaseLock()}};var init_streaming=__esm(()=>{init_utils4();DEFAULT_STREAM_CONFIG={highWaterMark:1048576,autoFlush:!0,closeOnEnd:!0}});import{readdir as readdir2,rm,rmdir,stat as stat4}from"fs/promises";import{extname as extname2,join as join6}from"path";class BunFileManager{static instance;config;constructor(){this.config={...DEFAULT_CONFIG4}}static getInstance(){if(!BunFileManager.instance)BunFileManager.instance=new BunFileManager;return BunFileManager.instance}async createFile({dir,name,data,options={}}){let filePath=resolvePath(join6(dir,name));if(options.createDir!==!1)await ensureDirectoryExists(extractDirectoryPath(filePath));let fileData=data instanceof Blob?data:options.type?new Blob([data],{type:options.type}):data;return await Bun.write(filePath,fileData)}async createJsonFile(dir,name,data){let fileName=ensureFileExtension(name,".json"),jsonString=safeJsonStringify(data);return this.createFile({dir,name:fileName,data:jsonString,options:{type:"application/json"}})}async createDirectory({path}){await ensureDirectoryExists(path)}async readFile({path,format="text"}){let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath);if(!await file.exists())throw createFileManagerError("FILE_NOT_FOUND",`File not found: ${path}`,resolvedPath,"readFile");switch(format){case"text":return await file.text();case"json":return await file.json();case"buffer":return await file.arrayBuffer();case"bytes":return await file.bytes();case"stream":return file.stream();default:return await file.text()}}async readJsonFile(path){return this.readFile({path,format:"json"})}async getFileInfo(path){let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),fileName=path.split("/").pop()||path,stats=null;try{stats=await stat4(resolvedPath)}catch{}return{name:fileName,path:resolvedPath,size:file.size,type:file.type,exists:await file.exists(),extension:extname2(fileName),createdAt:stats?.birthtime,modifiedAt:stats?.mtime}}async readDirectory({path,recursive=!1}){let resolvedPath=resolvePath(path);return await readdir2(resolvedPath,{recursive,encoding:"utf8"})}async getFilesByExtension(dir,extension){let files=await this.readDirectory({path:dir}),normalizedExt=extension.startsWith(".")?extension:`.${extension}`;return files.filter((file)=>file.endsWith(normalizedExt))}async updateFile({path,data,mode="overwrite"}){let resolvedPath=resolvePath(path);if(mode==="append"){let combinedData=await this.readFile({path,format:"text"})+data;return await Bun.write(resolvedPath,combinedData)}return await Bun.write(resolvedPath,data)}async updateJsonFile(path,data,merge=!1){let finalData=data;if(merge)try{let existingData=await this.readJsonFile(path);if(typeof existingData==="object"&&existingData!==null&&!Array.isArray(existingData)&&typeof data==="object"&&data!==null&&!Array.isArray(data))finalData={...existingData,...data}}catch{}return this.updateFile({path,data:safeJsonStringify(finalData),mode:"overwrite"})}async appendToFile(path,data){return this.updateFile({path,data,mode:"append"})}async deleteFile(path){try{let resolvedPath=resolvePath(path);return await Bun.file(resolvedPath).delete(),!0}catch(error){return logger.scoped("storage.fs").error(`Failed to delete file ${path}`,error,{path}),!1}}async deleteDirectory({path,recursive=!1}){try{let resolvedPath=resolvePath(path);if(recursive)await rm(resolvedPath,{recursive:!0,force:!0});else await rmdir(resolvedPath);return!0}catch(error){return logger.scoped("storage.fs").error(`Failed to delete directory ${path}`,error,{path}),!1}}async deleteFiles(paths){let results=await executeBulkOperation(paths,async(path)=>{if(!await this.deleteFile(path))throw Error(`Failed to delete: ${path}`);return path}),success=[],failed=[];for(let i=0;i<results.length;i++){let result=results[i],originalPath=paths[i];if(result?.status==="fulfilled")success.push(originalPath||"");else failed.push(originalPath||"")}return{success,failed}}async exists(path){let resolvedPath=resolvePath(path);return await Bun.file(resolvedPath).exists()}async copyFile(sourcePath,destinationPath){let resolvedSource=resolvePath(sourcePath),resolvedDestination=resolvePath(destinationPath),sourceFile=Bun.file(resolvedSource);if(!await sourceFile.exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"copyFile");return await ensureDirectoryExists(extractDirectoryPath(resolvedDestination)),await Bun.write(resolvedDestination,sourceFile)}async moveFile(sourcePath,destinationPath){try{return await this.copyFile(sourcePath,destinationPath),await this.deleteFile(sourcePath),!0}catch(error){return logger.scoped("storage.fs").error("Failed to move file",error,{sourcePath,destinationPath}),!1}}getFormattedFileSize(bytes){return formatFileSize(bytes)}getConfig(){return{...this.config}}updateConfig(newConfig){let validation=validateConfig(newConfig);if(validation.isValid){let mergedConfig=mergeConfig(newConfig,this.config);Object.assign(this.config,mergedConfig)}return validation}validateConfiguration(config){return validateConfig(config)}async createStreamWriter(path,options={}){return createFileWriter(path,options)}async writeStream(path,chunks,options={}){return writeStream(path,chunks,options)}async appendStream(path,chunks,options={}){return appendStream(path,chunks,options)}async copyFileStream(sourcePath,destinationPath,options={}){return copyFileStream(sourcePath,destinationPath,options)}async readFileStream(path,chunkProcessor){return readFileStream(path,chunkProcessor)}async setPermissions(path,mode){return setFilePermissions(path,mode)}async setPermissionsAdvanced(options){return setFilePermissions(options.path,options.mode)}async getPermissions(path){return getFilePermissions(path)}async checkPermissions(path,requiredMode){return hasPermissions(path,requiredMode)}async makeFileReadable(path){return makeReadable(path)}async makeFileWritable(path){return makeWritable(path)}async makeFileExecutable(path){return makeExecutable(path)}async makeFileReadOnly(path){return makeReadOnly(path)}async setCommonPermission(path,pattern){return setCommonPermissions(path,pattern)}async atomicWrite(options){return atomicWrite(options)}async atomicJsonWrite(path,data,options={}){return atomicJsonWrite(path,data,options)}async createFileBackup(options){return createBackup(options)}async restoreFileFromBackup(backupPath,targetPath,deleteBackup=!1){return restoreFromBackup(backupPath,targetPath,deleteBackup)}async safeFileUpdate(path,updateFunction,options={}){return safeUpdate(path,updateFunction,options)}async batchAtomicOperations(operations){return batchAtomicWrite(operations)}}var init_core=__esm(()=>{init_Logger2();init_atomic();init_permissions();init_streaming();init_utils4()});var fileManager;var init_File=__esm(()=>{init_core();init_utils4();init_core();fileManager=BunFileManager.getInstance()});import{Pool}from"pg";var init_Postgre=__esm(()=>{init_Logger2()});var init_Managers=__esm(()=>{init_Azure();init_Dapr();init_File();init_Postgre();init_Redis()});function lifetimeSeconds(value,fallbackSeconds){if(value===null)return null;if(value===void 0)return fallbackSeconds;if(typeof value==="number"){if(!Number.isFinite(value))return null;return value<=0?null:Math.floor(value)}let raw=value.trim().toLowerCase();if(raw==="")return fallbackSeconds;if(NEVER.has(raw))return null;let match=raw.match(/^(\d+(?:\.\d+)?)\s*([smhdwy])$/);if(!match?.[1]||!match[2])return fallbackSeconds;let amount=Number.parseFloat(match[1]),seconds=Math.floor(amount*({s:1,m:60,h:3600,d:86400,w:604800,y:31536000}[match[2]]??1));return seconds<=0?null:seconds}function cookieMaxAge(seconds){return seconds===null?NEVER_COOKIE_MAX_AGE:seconds}function longerLifetime(a,b,fallbackSeconds){let given=[a,b].filter((v)=>v!==void 0&&v!=="");if(given.length===0)return fallbackSeconds;let resolved=given.map((v)=>lifetimeSeconds(v,fallbackSeconds));if(resolved.some((v)=>v===null))return null;return Math.max(...resolved)}function isIdleExpired(params){if(!params.lastActiveAt)return!1;if(!params.inactivityTimeout)return!1;let seconds=lifetimeSeconds(params.inactivityTimeout,DEFAULT_INACTIVITY_SECONDS);if(seconds===null)return!1;let lastActive=new Date(params.lastActiveAt).getTime();if(!Number.isFinite(lastActive))return!1;return(params.now??Date.now())-lastActive>seconds*1000}var NEVER,NEVER_COOKIE_MAX_AGE=315360000,DEFAULT_INACTIVITY_SECONDS=2592000;var init_lifetime=__esm(()=>{NEVER=new Set(["never","none","unlimited","infinite","0","sonsuz","s\xFCresiz"])});var exports_utils={};__export(exports_utils,{warnIfAccessTokenTooLargeForCookie:()=>warnIfAccessTokenTooLargeForCookie,validatePayload:()=>validatePayload,validateEnvVariables:()=>validateEnvVariables,toAudit:()=>toAudit,signNewAccessToken:()=>signNewAccessToken,sanitizePayload:()=>sanitizePayload,resolveDbPoolConfig:()=>resolveDbPoolConfig,resolveConfigCredential:()=>resolveConfigCredential,refreshAccessTokenWithLock:()=>refreshAccessTokenWithLock,redactSensitiveOutput:()=>redactSensitiveOutput,parseTokenValuesFromHeaders:()=>parseTokenValuesFromHeaders,parseTimeToSeconds:()=>parseTimeToSeconds2,parseQueryParams:()=>parseQueryParams,isSensitiveOutputKey:()=>isSensitiveOutputKey,initiateRedisManager:()=>initiateRedisManager,getRedisManager:()=>getRedisManager,ensureDatabaseExists:()=>ensureDatabaseExists,decodeUnverifiedSubject:()=>decodeUnverifiedSubject,createAuditLog:()=>createAuditLog,buildPaginationMeta:()=>buildPaginationMeta,COOKIE_SAFE_TOKEN_BYTES:()=>COOKIE_SAFE_TOKEN_BYTES});function parseTokenValuesFromHeaders(headers,tokenNames){let cookies=(headers.get("cookie")?.split(";")||[]).reduce((acc,cookie)=>{let trimmed=cookie.trim(),eqIndex=trimmed.indexOf("=");if(eqIndex>0)acc[trimmed.slice(0,eqIndex)]=trimmed.slice(eqIndex+1);return acc},{});return{access_token:cookies[tokenNames.access_token]||headers.get("authorization")?.split(" ")[1],refresh_token:cookies[tokenNames.refresh_token],session_token:cookies[tokenNames.session_token]}}async function initiateRedisManager(config){if(!config.redis){logger.info("[Redis] Not configured, skipping");return}let rawWithDapr=config.redis.withDapr,resolvedWithDapr=typeof rawWithDapr==="string"?process.env[rawWithDapr]?.toLowerCase()!=="false":rawWithDapr??!1,resolvedKeyPrefix=config.redis.keyPrefix?process.env[config.redis.keyPrefix]??config.redis.keyPrefix:void 0;if(resolvedWithDapr){redisManagerInstance=new RedisManager({withDapr:!0,stateStoreName:config.redis.stateStoreName,...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}});return}let resolvedUrl=config.redis.url?process.env[config.redis.url]:void 0,resolvedHost=config.redis.host?process.env[config.redis.host]:void 0,resolvedPort=config.redis.port?parseInt(process.env[config.redis.port]||"",10):void 0;if((process.env.REDIS_AUTH_MODE||"password")!=="password"){let{getRedisToken:getRedisToken2,getRedisTokenExpiresAt:getRedisTokenExpiresAt2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure)),clientId=process.env.AZURE_CLIENT_ID||"",initialToken=await getRedisToken2();redisManagerInstance=new RedisManager({host:resolvedHost,port:Number.isNaN(resolvedPort)?void 0:resolvedPort,password:initialToken,username:clientId,tls:!0,...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}});let unref=(t)=>{t.unref?.()},scheduleRedisTokenRefresh=()=>{let expiresAt=getRedisTokenExpiresAt2(),refreshIn=Math.max(expiresAt-Date.now()-300000,30000);unref(setTimeout(async()=>{try{let newToken=await getRedisToken2();if(redisManagerInstance)await redisManagerInstance.reauthenticate(clientId,newToken),logger.info("[Redis] Entra ID token refreshed successfully");scheduleRedisTokenRefresh()}catch(err){logger.error("[Redis] Token refresh failed \u2014 retrying in 30s",err),unref(setTimeout(scheduleRedisTokenRefresh,30000))}},refreshIn))};scheduleRedisTokenRefresh()}else{let resolvedPassword=process.env.REDIS_PASSWORD||void 0;redisManagerInstance=new RedisManager({url:resolvedUrl,host:resolvedHost,port:Number.isNaN(resolvedPort)?void 0:resolvedPort,...resolvedPassword?{password:resolvedPassword}:{},...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}})}}function getRedisManager(){return redisManagerInstance}function parseTimeToSeconds2(timeString){if(typeof timeString==="number")return timeString;if(NEVER_WORDS.has(timeString.trim().toLowerCase()))return NEVER_COOKIE_MAX_AGE;if(!timeString||timeString.trim()==="")throw Error("Time string cannot be empty");let match=timeString.trim().match(/^(\d+(?:\.\d+)?)\s*([smhdwMy])$/);if(!match||!match[1]||!match[2])throw Error(`Invalid time format: "${timeString}". Expected format: "75s", "10m", "2h", "1d", "1w", "2M", "1y"`);let value=parseFloat(match[1]),unit=match[2],multiplier={s:1,m:60,h:3600,d:86400,w:604800,M:2592000,y:31536000}[unit];if(multiplier===void 0)throw Error(`Unknown time unit: "${unit}"`);let seconds=Math.floor(value*multiplier);if(seconds<=0)throw Error(`Time value must be positive: "${timeString}"`);return seconds}function warnIfAccessTokenTooLargeForCookie(token,jwtClaimsMode){let bytes=Buffer.byteLength(token,"utf-8");if(bytes<=COOKIE_SAFE_TOKEN_BYTES)return;let now=Date.now();if(now-lastOversizeWarnAt<60000)return;lastOversizeWarnAt=now,logger.warn(`[Auth] access_token is ${bytes} bytes \u2014 at/over the ~4KB per-cookie browser limit, so the cookie may be `+"silently dropped (symptom: appears logged-in but requests are unauthenticated). Shrink it: set authorization.jwtClaimsMode:'resolve' (token carries only roles; claims resolved from the Redis claims cache), or deliver the token off-cookie via authentication.accessToken.setHeadersEnabled:false. "+(jwtClaimsMode?`Current jwtClaimsMode='${jwtClaimsMode}'.`:""))}function signNewAccessToken({sessionData,options,refreshTokenId,roles,claims,tenant,claimScopes,resolveMode}){let secretEnvName=options.authentication?.accessToken?.secret;if(!secretEnvName)throw Error("Access token secret env name is not configured");let secret=process.env[secretEnvName];if(!secret)throw Error(`Access token secret env "${secretEnvName}" is not set`);let token=signJWT({subject:sessionData.userId,issuer:options.authentication?.accessToken?.issuer,audience:options.authentication?.accessToken?.audience,algorithm:options.authentication?.accessToken?.algorithm,expiresInSeconds:parseTimeToSeconds2(options.authentication?.accessToken?.expiresIn??"15m"),sessionId:sessionData.id,customClaims:{refreshTokenId,...roles&&roles.length>0?{roles}:{},...!resolveMode&&claims&&claims.length>0?{claims}:{},...!resolveMode&&claimScopes&&Object.keys(claimScopes).length>0?{claimScopes}:{},...tenant?{tenant}:{}}},secret);return warnIfAccessTokenTooLargeForCookie(token,resolveMode?"resolve":options.authorization?.jwtClaimsMode),token}function resolveDbPoolConfig(pool){return{max:pool?.max!=null&&pool.max>0?pool.max:10,idleTimeoutMillis:pool?.idleTimeoutMillis??30000,connectionTimeoutMillis:pool?.connectionTimeoutMillis??1e4,...pool?.maxUses!=null&&pool.maxUses>0?{maxUses:pool.maxUses}:{},options:"-c timezone=UTC"}}function toAudit(payload,summary,opts){return payload?{entityName:payload.entity_name,entityId:payload.entity_id===" - "?null:payload.entity_id,operation:payload.operation_type,userId:opts&&"userId"in opts?opts.userId??null:payload.user_id==="unknown"?null:payload.user_id,summary,severity:opts?.severity,category:opts?.category,ipAddress:payload.ip_address,userAgent:payload.user_agent,path:payload.path,query:payload.query}:void 0}function decodeUnverifiedSubject(token){if(!token)return null;try{let parts=token.split(".");if(parts.length<2)return null;let payloadPart=parts[1];if(!payloadPart)return null;let json=Buffer.from(payloadPart,"base64url").toString("utf-8"),decoded=JSON.parse(json);return typeof decoded.sub==="string"&&decoded.sub?decoded.sub:null}catch{return null}}function reconstructBracketParams(query){let result={},arrayGroups={};for(let[key2,value]of Object.entries(query)){let match=key2.match(/^(\w+)\[\d*\]\[(\w+)\]$/),arrayName=match?.[1],prop=match?.[2];if(arrayName&&prop){if(!arrayGroups[arrayName])arrayGroups[arrayName]={};let group=arrayGroups[arrayName];if(!group[prop])group[prop]=[];let arr=group[prop];if(Array.isArray(value))for(let v of value)arr.push(v);else arr.push(value)}else result[key2]=value}for(let[arrayName,props]of Object.entries(arrayGroups)){let propNames=Object.keys(props);if(propNames.length===0)continue;let maxLen=Math.max(...propNames.map((p)=>(props[p]||[]).length)),items=[];for(let i=0;i<maxLen;i++){let item={};for(let p of propNames)item[p]=(props[p]||[])[i];items.push(item)}result[arrayName]=items}return result}function parseQueryParams(query){let q=reconstructBracketParams(query),malformed=[],parseJSONArrayParam=(name,value)=>{if(value===void 0||value===null)return;let parsed=value;if(typeof value==="string"){if(value.trim()==="")return;try{parsed=JSON.parse(value)}catch{malformed.push(name);return}}if(!Array.isArray(parsed)){malformed.push(name);return}if(parsed.some((entry)=>typeof entry!=="object"||entry===null||Array.isArray(entry))){malformed.push(name);return}return parsed},DEFAULT_PAGE_SIZE=20,MAX_PAGE_SIZE=200,rawPage=q.page?parseInt(q.page,10):1,page=Number.isFinite(rawPage)&&rawPage>0?rawPage:1,rawLimit=q.limit?parseInt(q.limit,10):20,limit=Number.isFinite(rawLimit)&&rawLimit>0?Math.min(rawLimit,200):20,rawOffset=q.offset?parseInt(q.offset,10):(page-1)*limit,offset=Number.isFinite(rawOffset)&&rawOffset>=0?rawOffset:0;return{page,limit,offset,search:q.search,searchFields:q.searchFields?q.searchFields.split(","):void 0,filters:parseJSONArrayParam("filters",q.filters),sort:parseJSONArrayParam("sort",q.sort),select:q.select?q.select.split(","):void 0,groupBy:q.groupBy,with:parseJSONArrayParam("with",q.with),distinct:q.distinct==="true",distinctOn:q.distinctOn?q.distinctOn.split(","):void 0,malformed:malformed.length>0?malformed:void 0}}function buildPaginationMeta(page,limit,offset,totalItems){let totalPages=Math.ceil(totalItems/limit),hasNextPage=page<totalPages,hasPrevPage=page>1;return{page,limit,offset,totalItems,totalPages,hasNextPage,hasPrevPage,nextPage:hasNextPage?page+1:null,prevPage:hasPrevPage?page-1:null}}function getBaseTypeValidator(type){let stringTypes=["varchar","char","text","uuid","citext","bit","varbit"],numberTypes=["integer","smallint","bigint","serial","smallserial","bigserial","real","doublePrecision","numeric","decimal"],booleanTypes=["boolean"];if(stringTypes.includes(type))return(v)=>({valid:typeof v==="string",expectedType:"string"});if(numberTypes.includes(type)){if(type==="numeric"||type==="decimal")return(v)=>({valid:typeof v==="number"||typeof v==="string"&&v.trim()!==""&&Number.isFinite(Number(v)),expectedType:"number"});return(v)=>({valid:typeof v==="number",expectedType:"number"})}if(booleanTypes.includes(type))return(v)=>({valid:typeof v==="boolean",expectedType:"boolean"});if(type==="json"||type==="jsonb")return(v)=>({valid:typeof v==="object",expectedType:"object"});return()=>({valid:!0,expectedType:"any"})}function validatePayload(payload,columns,isPartial=!1){let errors=[];for(let col7 of columns){let value=payload[col7.name]??payload[col7.name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())],hasDbDefault=col7.default!==void 0||!!col7.defaultRaw||!!col7.generatedByDefaultAsIdentity||!!col7.generatedAlwaysAsIdentity||!!col7.generatedAlwaysAs,isRequired=col7.notNull&&!col7.nullable&&!hasDbDefault;if(value===void 0||value===null){if(isRequired&&!isPartial)errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} is required`});continue}if(col7.array){let baseValidator=getBaseTypeValidator(col7.type),expectedType=baseValidator(void 0).expectedType;if(!Array.isArray(value)){errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be an array of ${expectedType}`});continue}if(value.some((el)=>el!==null&&!baseValidator(el).valid))errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be an array of ${expectedType}`});continue}let typeCheck=getBaseTypeValidator(col7.type)(value);if(!typeCheck.valid){errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be of type ${typeCheck.expectedType}`});continue}if(typeof value==="string"){let len=value.length;if(col7.length&&len>col7.length)errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} exceeds max length of ${col7.length}`});if(col7.validation?.minLength&&len<col7.validation.minLength)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at least ${col7.validation.minLength} characters`});if(col7.validation?.maxLength&&len>col7.validation.maxLength)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at most ${col7.validation.maxLength} characters`});if(col7.validation?.pattern){if(!new RegExp(col7.validation.pattern).test(value))errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} does not match required pattern`})}if(col7.validation?.format){let formatRegex=FORMAT_PATTERNS[col7.validation.format];if(formatRegex&&!formatRegex.test(value))errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be a valid ${col7.validation.format}`})}}if(typeof value==="number"){if(col7.validation?.min!==void 0&&value<col7.validation.min)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at least ${col7.validation.min}`});if(col7.validation?.max!==void 0&&value>col7.validation.max)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at most ${col7.validation.max}`})}if(col7.enumValues&&col7.enumValues.length>0){if(!col7.enumValues.includes(value))errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be one of: ${col7.enumValues.join(", ")}`})}}return{valid:errors.length===0,errors}}function escapeHtml(str3){return str3.replace(/[&<>"'`=/]/g,(char)=>HTML_ENTITIES[char]||char)}function stripTags(str3){return str3.replace(/<[^>]*>/g,"")}function normalizeEmail(email){let parts=email.split("@"),localPart=parts[0],domain=parts[1];if(!localPart||!domain)return email;let beforePlus=localPart.split("+")[0];if(!beforePlus)return email;return`${beforePlus.replace(/\./g,"")}@${domain.toLowerCase()}`}function slugify(str3){return str3.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function applySanitizer(value,sanitizer){if(value===null||value===void 0)return value;switch(sanitizer){case"trim":return typeof value==="string"?value.trim():value;case"lowercase":return typeof value==="string"?value.toLowerCase():value;case"uppercase":return typeof value==="string"?value.toUpperCase():value;case"escapeHtml":return typeof value==="string"?escapeHtml(value):value;case"stripTags":return typeof value==="string"?stripTags(value):value;case"normalizeEmail":return typeof value==="string"?normalizeEmail(value):value;case"toNumber":if(typeof value==="number")return value;if(typeof value==="string"){let num2=Number(value);return Number.isNaN(num2)?value:num2}return value;case"toBoolean":if(typeof value==="boolean")return value;if(typeof value==="string"){let lower=value.toLowerCase();if(lower==="true"||lower==="1"||lower==="yes")return!0;if(lower==="false"||lower==="0"||lower==="no")return!1}if(typeof value==="number")return value!==0;return value;case"slugify":return typeof value==="string"?slugify(value):value;default:return value}}function isSensitiveOutputKey(key2){return SENSITIVE_OUTPUT_KEYS.has(key2)}function redactSensitiveOutput(row){return scrubSensitive(row)}function scrubSensitive(value){if(value===null||typeof value!=="object")return value;if(Array.isArray(value))return value.map(scrubSensitive);let proto=Object.getPrototypeOf(value);if(proto!==Object.prototype&&proto!==null)return value;let out={};for(let[k,v]of Object.entries(value)){if(SENSITIVE_OUTPUT_KEYS.has(k))continue;out[k]=scrubSensitive(v)}return out}function sanitizePayload(payload,columns,opts){let sanitized={},toCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SERVER_MANAGED=new Set(["id","created_at","updated_at","created_by","updated_by","createdAt","updatedAt","createdBy","updatedBy"]),PROTECTED_SENSITIVE=new Set(["is_god","password","password_hash","email_verified","verified_at","email_verified_at","is_locked","locked_until","failed_login_attempts","login_count","last_login_at","email_verification_token","email_verification_sent_at","email_verification_expires_at","password_reset_token","password_reset_expires_at","password_reset_sent_at","magic_link_token","two_factor_secret"]),STORAGE_MANAGED=opts?.isFormData?new Set(["path","name","original_name","originalName","extension","size","mime_type","mimeType","uploaded_by","uploadedBy"]):null;for(let key2 of Object.keys(payload)){if(SERVER_MANAGED.has(key2))continue;if(STORAGE_MANAGED?.has(key2))continue;let value=payload[key2],snakeKey=key2.replace(/[A-Z]/g,(l)=>`_${l.toLowerCase()}`);if(PROTECTED_SENSITIVE.has(snakeKey))continue;let col7=columns.find((c)=>c.name===key2||c.name===snakeKey);if(col7?.readOnly)continue;if(col7?.sanitize&&col7.sanitize.length>0)for(let sanitizer of col7.sanitize)value=applySanitizer(value,sanitizer);if(col7&&(col7.type==="timestamp"||col7.type==="timestamptz"||col7.type==="date")&&typeof value==="string"){let parsed=new Date(value);if(!Number.isNaN(parsed.getTime()))value=parsed}let normalizedKey=key2.includes("_")?toCamel2(key2):key2;sanitized[normalizedKey]=value}return sanitized}function createAuditLog(db,auditTable,entry){if(!db||!auditTable)return;let logEntry={user_id:entry.user_id,entity_name:entry.entity_name,entity_id:entry.entity_id,operation:entry.operation,old_data:entry.old_data??null,new_data:entry.new_data??null,timestamp:new Date().toISOString()};db.insert(auditTable).values(logEntry).execute().catch((err)=>{logger.error("[Audit] Database audit write failed",err,{entity:logEntry.entity_name,operation:logEntry.operation})})}async function refreshAccessTokenWithLock(userId,sessionId,generateToken){let redis=new RedisManager,lockKey=`${REFRESH_LOCK_PREFIX}${userId}`,cacheKey=`${ACCESS_TOKEN_CACHE_PREFIX}${userId}:${sessionId}`,cachedResult=await redis.read(cacheKey);if(cachedResult.success&&cachedResult.data)return{success:!0,accessToken:cachedResult.data,fromCache:!0};let lockResult=await redis.acquireLock(lockKey,LOCK_TTL_SECONDS);if(!lockResult.success)return{success:!1,error:lockResult.error};if(lockResult.data)try{let newToken=generateToken();return await redis.create(cacheKey,newToken,ACCESS_TOKEN_CACHE_TTL_SECONDS),{success:!0,accessToken:newToken,fromCache:!1}}finally{await redis.releaseLock(lockKey)}let waitResult=await redis.waitForLock(lockKey,LOCK_WAIT_TIMEOUT_MS,50);if(!waitResult.success)return{success:!1,error:waitResult.error};if(!waitResult.data)return{success:!1,error:"Lock wait timeout"};let newCachedResult=await redis.read(cacheKey);if(newCachedResult.success&&newCachedResult.data)return{success:!0,accessToken:newCachedResult.data,fromCache:!0};let fallbackToken=generateToken();return await redis.create(cacheKey,fallbackToken,ACCESS_TOKEN_CACHE_TTL_SECONDS),{success:!0,accessToken:fallbackToken,fromCache:!1}}function resolveConfigCredential(value){if(!value)return;let fromEnv=process.env[value];if(fromEnv)return fromEnv;if(/^[A-Z][A-Z0-9_]{2,}$/.test(value))return;return value}function validateEnvVariables(config){let errors=[],resolved={},databaseAuthMode=process.env.DATABASE_AUTH_MODE||"password",redisAuthMode=process.env.REDIS_AUTH_MODE||"password";resolved.databaseAuthMode=databaseAuthMode,resolved.redisAuthMode=redisAuthMode;let entraIdModes=["managed_identity","service_principal"];if(entraIdModes.includes(databaseAuthMode)||entraIdModes.includes(redisAuthMode)){if(!process.env.AZURE_CLIENT_ID)logger.warn("[Config] AZURE_CLIENT_ID is not set. Required for user-assigned managed identity.");if([databaseAuthMode,redisAuthMode].filter((m)=>m==="service_principal").length>0){if(!process.env.AZURE_TENANT_ID)errors.push({field:"azure.tenantId",envName:"AZURE_TENANT_ID",message:"AZURE_TENANT_ID is required for service_principal auth mode."});if(!process.env.AZURE_CLIENT_SECRET)errors.push({field:"azure.clientSecret",envName:"AZURE_CLIENT_SECRET",message:"AZURE_CLIENT_SECRET is required for service_principal auth mode."})}}if(config.database?.url){let envValue=process.env[config.database.url];if(!envValue)errors.push({field:"database.url",envName:config.database.url,message:`Environment variable "${config.database.url}" is not set. Please set it in your .env file.`});else resolved.databaseUrl=envValue}let validationWithDapr=typeof config.redis?.withDapr==="string"?process.env[config.redis.withDapr]?.toLowerCase()!=="false":config.redis?.withDapr??!1;if(config.redis&&!validationWithDapr){let urlEnvValue=config.redis.url?process.env[config.redis.url]:void 0,hostEnvValue=config.redis.host?process.env[config.redis.host]:void 0,portEnvValue=config.redis.port?process.env[config.redis.port]:void 0;if(urlEnvValue)resolved.redisUrl=urlEnvValue;else if(config.redis.url){if(!(hostEnvValue&&portEnvValue))errors.push({field:"redis.url",envName:config.redis.url,message:`Redis has no usable connection details. Set "${config.redis.url}", or set both "${config.redis.host??"redis.host"}" and "${config.redis.port??"redis.port"}".`})}else{if(config.redis.host&&!hostEnvValue)errors.push({field:"redis.host",envName:config.redis.host,message:`Environment variable "${config.redis.host}" is not set. Please set it in your .env file.`});if(config.redis.port&&!portEnvValue)errors.push({field:"redis.port",envName:config.redis.port,message:`Environment variable "${config.redis.port}" is not set. Please set it in your .env file.`})}}if(config.authentication?.enabled){if(!config.authentication.mode)errors.push({field:"authentication.mode",envName:"",message:'authentication.mode is required when authentication is enabled. Use "full" for IDP/standalone services, "consumer" for resource servers.'});if(config.authentication.accessToken?.secret){let envValue=process.env[config.authentication.accessToken.secret];if(!envValue)errors.push({field:"authentication.accessToken.secret",envName:config.authentication.accessToken.secret,message:`Environment variable "${config.authentication.accessToken.secret}" is not set. Please set it in your .env file.`});else resolved.accessTokenSecret=envValue}else errors.push({field:"authentication.accessToken.secret",envName:"",message:"authentication.accessToken.secret is required when authentication is enabled."});let isConsumerMode=config.authentication.mode==="consumer";if(config.authentication.refreshToken?.secret){let envValue=process.env[config.authentication.refreshToken.secret];if(!envValue)errors.push({field:"authentication.refreshToken.secret",envName:config.authentication.refreshToken.secret,message:`Environment variable "${config.authentication.refreshToken.secret}" is not set. Please set it in your .env file.`});else resolved.refreshTokenSecret=envValue}else if(!isConsumerMode)errors.push({field:"authentication.refreshToken.secret",envName:"",message:"authentication.refreshToken.secret is required when authentication is enabled."});if(config.authentication.sessionToken?.secret){let envValue=process.env[config.authentication.sessionToken.secret];if(!envValue)errors.push({field:"authentication.sessionToken.secret",envName:config.authentication.sessionToken.secret,message:`Environment variable "${config.authentication.sessionToken.secret}" is not set. Please set it in your .env file.`});else resolved.sessionTokenSecret=envValue}else if(!isConsumerMode)errors.push({field:"authentication.sessionToken.secret",envName:"",message:"authentication.sessionToken.secret is required when authentication is enabled."})}if(config.authentication?.oauth?.enabled&&config.authentication.oauth.providers){let resolvedProviders={};for(let[providerName,providerConfig]of Object.entries(config.authentication.oauth.providers)){if(!providerConfig)continue;let{clientId:clientIdEnvName,clientSecret:clientSecretEnvName,redirectUri:redirectUriEnvName,tenantId:tenantIdEnvName}=providerConfig,clientId=resolveConfigCredential(clientIdEnvName),clientSecret=resolveConfigCredential(clientSecretEnvName),redirectUri=resolveConfigCredential(redirectUriEnvName),tenantId=resolveConfigCredential(tenantIdEnvName),credentialsMayComeFromDb=config.secrets?.enabled===!0;if(!clientId&&!credentialsMayComeFromDb)errors.push({field:`authentication.oauth.providers.${providerName}.clientId`,envName:clientIdEnvName,message:`Environment variable "${clientIdEnvName}" is not set (OAuth ${providerName} clientId).`});if(!clientSecret&&!credentialsMayComeFromDb)errors.push({field:`authentication.oauth.providers.${providerName}.clientSecret`,envName:clientSecretEnvName,message:`Environment variable "${clientSecretEnvName}" is not set (OAuth ${providerName} clientSecret).`});if(clientId&&clientSecret||credentialsMayComeFromDb)resolvedProviders[providerName]={clientId:clientId??"",clientSecret:clientSecret??"",redirectUri:redirectUri??"",tenantId,scopes:providerConfig.scopes,authorizationUrl:providerConfig.authorizationUrl,tokenUrl:providerConfig.tokenUrl,userInfoUrl:providerConfig.userInfoUrl,extraAuthParams:providerConfig.extraAuthParams}}if(Object.keys(resolvedProviders).length>0)resolved.oauthProviders=resolvedProviders}return{valid:errors.length===0,errors,resolved}}async function ensureDatabaseExists(databaseUrl,logger2,authMode){let{Pool:Pool2}=await import("pg"),targetDb=new URL(databaseUrl).pathname.replace("/","");if(!targetDb)return;let adminUrl=new URL(databaseUrl);adminUrl.pathname="/postgres";let pool;if(authMode&&authMode!=="password"){let{getPostgresToken:getPostgresToken2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure));pool=new Pool2({connectionString:adminUrl.toString(),password:getPostgresToken2,ssl:{rejectUnauthorized:!0}})}else pool=new Pool2({connectionString:adminUrl.toString()});try{if((await pool.query("SELECT 1 FROM pg_database WHERE datname = $1",[targetDb])).rowCount===0)logger2.info(`[Database] Creating database "${targetDb}"...`),await pool.query(`CREATE DATABASE "${targetDb}" TEMPLATE template0`),logger2.info(`[Database] Database "${targetDb}" created successfully`);else logger2.info(`[Database] Database "${targetDb}" exists`)}catch(err){let message=err instanceof Error?err.message:String(err);logger2.warn(`[Database] Could not auto-create database: ${message}`)}finally{await pool.end()}}var redisManagerInstance=null,NEVER_WORDS,COOKIE_SAFE_TOKEN_BYTES=3500,lastOversizeWarnAt=0,FORMAT_PATTERNS,HTML_ENTITIES,SENSITIVE_OUTPUT_KEYS,ACCESS_TOKEN_CACHE_PREFIX="access_token:",REFRESH_LOCK_PREFIX="refresh_lock:",LOCK_TTL_SECONDS=5,LOCK_WAIT_TIMEOUT_MS=3000,ACCESS_TOKEN_CACHE_TTL_SECONDS=60;var init_utils5=__esm(()=>{init_Managers();init_Services();init_Logger2();init_lifetime();NEVER_WORDS=new Set(["never","none","unlimited","infinite","0","sonsuz","s\xFCresiz"]);FORMAT_PATTERNS={email:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,url:/^https?:\/\/.+/,uuid:/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,date:/^\d{4}-\d{2}-\d{2}$/,datetime:/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/,time:/^\d{2}:\d{2}:\d{2}$/,uri:/^[a-z][a-z0-9+.-]*:/i,ipv4:/^(\d{1,3}\.){3}\d{1,3}$/,ipv6:/^([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$/i};HTML_ENTITIES={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#x27;","/":"&#x2F;","`":"&#96;","=":"&#x3D;"};SENSITIVE_OUTPUT_KEYS=new Set(["password","passwordHash","password_hash","emailVerificationToken","email_verification_token","emailVerificationTokenExpiresAt","email_verification_token_expires_at","passwordResetToken","password_reset_token","refreshTokenHash","refresh_token_hash"])});import{eq as eq14,sql as sql5}from"drizzle-orm";import{pgSchema}from"drizzle-orm/pg-core";class TenantRegistry{db;logger;mainSchemaName;mainSchemaTables;mainSchemaRelations;createAllTablesForSchema;createAllRelationsForSchema;appId;authMode;tenantResolution;tenantHeader;redisCacheTtlSeconds;defaultTrustedSources;idpUrl;allowDataLoss;onTenantProvisioned;tenantsBySubdomain=new Map;tenantsBySchemaName=new Map;tenantsById=new Map;schemaContexts=new Map;tenantFeatures=new Map;tenantsByDomainHostname=new Map;constructor(config){this.db=config.db,this.logger=config.logger,this.mainSchemaName=config.mainSchemaName,this.mainSchemaTables=config.mainSchemaTables,this.mainSchemaRelations=config.mainSchemaRelations,this.createAllTablesForSchema=config.createAllTablesForSchema,this.createAllRelationsForSchema=config.createAllRelationsForSchema,this.appId=config.appId,this.authMode=config.authMode,this.tenantResolution=config.tenantResolution,this.tenantHeader=config.tenantHeader,this.redisCacheTtlSeconds=config.redisCacheTtlSeconds,this.defaultTrustedSources=config.defaultTrustedSources,this.idpUrl=config.idpUrl,this.allowDataLoss=config.allowDataLoss===!0,this.onTenantProvisioned=config.onTenantProvisioned}async initialize(){this.logger.info("[TenantRegistry] Initializing..."),this.schemaContexts.set(this.mainSchemaName,{schemaName:this.mainSchemaName,schemaTables:this.mainSchemaTables,schemaRelations:this.mainSchemaRelations,tenant:null});let tenants=await this.loadTenantsFromDb();this.logger.info(`[TenantRegistry] Loaded ${tenants.length} tenants from database`);let features=await this.loadTenantFeaturesFromDb();this.logger.info(`[TenantRegistry] Loaded ${features.length} tenant feature mappings`);for(let tenant of tenants)this.indexTenant(tenant);for(let feature of features){let existing=this.tenantFeatures.get(feature.tenantId)||[];existing.push(feature),this.tenantFeatures.set(feature.tenantId,existing)}let activeTenants=tenants.filter((t)=>t.status==="active");for(let tenant of activeTenants)await this.buildSchemaContext(tenant);await this.loadDomainHostnames(),this.logger.info(`[TenantRegistry] Initialized with ${activeTenants.length} active tenant schemas + main schema`)}resolveFromRequest(request,vettedClientIp){let url=new URL(request.url),host=request.headers.get("host")||url.host||"",normalizedHost=normalizeHost(host);if(normalizedHost){let byHostname=this.tenantsByDomainHostname.get(normalizedHost);if(byHostname)return this.validateAndReturnTenant(byHostname)}if(this.tenantResolution==="subdomain"||this.tenantResolution==="both"){let subdomain=extractSubdomain(host);if(subdomain){let tenant=this.tenantsBySubdomain.get(subdomain);if(tenant)return this.validateAndReturnTenant(tenant);return{resolved:!1,error:`Tenant not found for subdomain: ${subdomain}`,statusCode:404}}}if(this.tenantResolution==="header"||this.tenantResolution==="both"){let tenantIdOrSubdomain=request.headers.get(this.tenantHeader);if(tenantIdOrSubdomain){let result=this.resolveFromHeader(tenantIdOrSubdomain,request,vettedClientIp);if(result)return result}}let mainContext=this.schemaContexts.get(this.mainSchemaName);if(mainContext)return{resolved:!0,context:mainContext};return{resolved:!1,error:"No tenant could be resolved and main schema is unavailable",statusCode:500}}getSchemaContext(schemaName){return this.schemaContexts.get(schemaName)}getMainContext(){let ctx=this.schemaContexts.get(this.mainSchemaName);if(!ctx)throw Error("[TenantRegistry] Main schema context not initialized");return ctx}getActiveTenants(){return Array.from(this.tenantsById.values()).filter((t)=>t.status==="active")}getTenantById(id){return this.tenantsById.get(id)}getTenantBySchemaName(schemaName){return this.tenantsBySchemaName.get(schemaName)}getTenantFeatures(tenantId){return this.tenantFeatures.get(tenantId)||[]}isTenantFeatureEnabled(tenantId,featureName){return(this.tenantFeatures.get(tenantId)||[]).find((f)=>f.featureName===featureName)?.enabled??!1}getTenantIdsWithFeature(featureName){let result=[];for(let[tenantId,features]of this.tenantFeatures)if(features.find((f)=>f.featureName===featureName&&f.enabled))result.push(tenantId);return result}getSchemaNamesWithFeature(featureName){let tenantIds=this.getTenantIdsWithFeature(featureName),schemaNames=[];for(let tenantId of tenantIds){let tenant=this.tenantsById.get(tenantId);if(tenant&&tenant.status==="active")schemaNames.push(tenant.schemaName)}return schemaNames}getAllSchemaNames(){return Array.from(this.schemaContexts.keys())}async provisionTenant(tenant){this.logger.info(`[TenantRegistry] Provisioning tenant: ${tenant.subdomain} \u2192 ${tenant.schemaName}`),await ensureSchemaExists(this.db,tenant.schemaName);let context=await this.buildSchemaContext(tenant);if(this.indexTenant(tenant),await this.syncSchemaToDb(context),this.onTenantProvisioned)try{await this.onTenantProvisioned(context)}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[TenantRegistry] onTenantProvisioned hook failed for ${tenant.schemaName}: ${msg}`)}return this.logger.info(`[TenantRegistry] Tenant provisioned: ${tenant.subdomain}`),context}async syncSchemaToDb(context){let{pushSchema}=await import("drizzle-kit/api"),{applySchemaPush:applySchemaPush2}=await Promise.resolve().then(() => (init_schema(),exports_schema)),targetSchema=pgSchema(context.schemaName);try{let push=await pushSchema({schema:targetSchema,...context.schemaTables},this.db,[context.schemaName]);if(await applySchemaPush2(push,{schemaName:context.schemaName,allowDataLoss:this.allowDataLoss,logger:this.logger,execute:(statement)=>this.db.execute(sql5.raw(statement))}))this.logger.info(`[TenantRegistry] Schema sync completed for: ${context.schemaName}`)}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error(`[TenantRegistry] Schema sync FAILED for ${context.schemaName}: ${msg}. The database does not match this build; queries against anything it was going to add will fail.`)}}async syncAllSchemas(){for(let[schemaName,context]of this.schemaContexts)this.logger.info(`[TenantRegistry] Syncing schema: ${schemaName}`),await ensureSchemaExists(this.db,schemaName),await this.syncSchemaToDb(context)}async invalidateCache(subdomain){try{let{getRedisManager:getRedisManager2}=await Promise.resolve().then(() => (init_utils5(),exports_utils)),redis=getRedisManager2();if(redis)await redis.remove(`tenant:${subdomain}`),this.logger.info(`[TenantRegistry] Cache invalidated for: ${subdomain}`)}catch{}}async refreshTenant(tenantId){let tenantsTable=this.mainSchemaTables.tenants;if(!tenantsTable)return;let row=(await this.db.select().from(tenantsTable).where(eq14(tenantsTable.id,tenantId)).limit(1))[0];if(!row)return;let tenant=rowToTenantRecord(row),oldTenant=this.tenantsById.get(tenantId);if(oldTenant)this.tenantsBySubdomain.delete(oldTenant.subdomain),this.tenantsBySchemaName.delete(oldTenant.schemaName);if(this.indexTenant(tenant),tenant.status==="active")await this.buildSchemaContext(tenant);else this.schemaContexts.delete(tenant.schemaName);if(oldTenant)await this.invalidateCache(oldTenant.subdomain);await this.invalidateCache(tenant.subdomain)}async initializeFromIdp(){if(!this.idpUrl){this.logger.error("[TenantRegistry] Consumer multi-tenant requires idpUrl (IDP_URL)");return}this.logger.info(`[TenantRegistry] Initializing from IDP: ${this.idpUrl}`),this.schemaContexts.set(this.mainSchemaName,{schemaName:this.mainSchemaName,schemaTables:this.mainSchemaTables,schemaRelations:this.mainSchemaRelations,tenant:null});let tenants=await this.loadTenantsFromIdp();this.logger.info(`[TenantRegistry] Fetched ${tenants.length} tenants from IDP`);for(let tenant of tenants)this.indexTenant(tenant);let activeTenants=tenants.filter((t)=>t.status==="active");for(let tenant of activeTenants)await this.buildSchemaContext(tenant);await this.loadDomainHostnames(),this.logger.info(`[TenantRegistry] Consumer initialized with ${activeTenants.length} active tenant schemas + main schema`)}isConsumerMode(){return this.authMode==="consumer"&&!!this.idpUrl}async syncFromIdp(){if(!this.isConsumerMode())return{added:[],removed:[],total:this.tenantsById.size};let tenants=await this.loadTenantsFromIdp(),added=[],removed=[],seenSchemaNames=new Set;for(let tenant of tenants){seenSchemaNames.add(tenant.schemaName);let known=this.tenantsById.get(tenant.id);if(known)this.tenantsBySubdomain.delete(known.subdomain),this.tenantsBySchemaName.delete(known.schemaName);if(this.indexTenant(tenant),tenant.status==="active"){if(!this.schemaContexts.has(tenant.schemaName)){await ensureSchemaExists(this.db,tenant.schemaName);let ctx=await this.buildSchemaContext(tenant);await this.syncSchemaToDb(ctx),added.push(tenant.schemaName),await this.invalidateCache(tenant.subdomain),this.logger.info(`[TenantRegistry] Synced new tenant from IDP: ${tenant.subdomain}`)}}else if(this.schemaContexts.has(tenant.schemaName))this.schemaContexts.delete(tenant.schemaName),removed.push(tenant.schemaName),await this.invalidateCache(tenant.subdomain),this.logger.info(`[TenantRegistry] Deactivated tenant context: ${tenant.subdomain}`)}for(let[schemaName,ctx]of this.schemaContexts){if(schemaName===this.mainSchemaName)continue;if(!seenSchemaNames.has(schemaName)){if(this.schemaContexts.delete(schemaName),removed.push(schemaName),ctx.tenant)this.tenantsBySubdomain.delete(ctx.tenant.subdomain),this.tenantsById.delete(ctx.tenant.id),this.tenantsBySchemaName.delete(schemaName),await this.invalidateCache(ctx.tenant.subdomain)}}return{added,removed,total:tenants.length}}registerDomainHostname(hostname,tenantId){let tenant=this.tenantsById.get(tenantId);if(!tenant)return;this.tenantsByDomainHostname.set(normalizeHost(hostname),tenant)}unregisterDomainHostname(hostname){this.tenantsByDomainHostname.delete(normalizeHost(hostname))}async loadDomainHostnames(){let table=this.mainSchemaTables.domainHostnames;if(!table)return 0;try{let rows=await this.db.select().from(table),count=0;this.tenantsByDomainHostname.clear();for(let row of rows){let status=String(row.status??""),tenantId=String(row.tenantId??row.tenant_id??""),hostname=String(row.normalizedHostname??row.normalized_hostname??"");if(status!=="active"||!tenantId||!hostname)continue;let tenant=this.tenantsById.get(tenantId);if(!tenant)continue;this.tenantsByDomainHostname.set(normalizeHost(hostname),tenant),count++}if(count>0)this.logger.info(`[TenantRegistry] Indexed ${count} active custom hostnames`);return count}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load custom hostnames: ${msg}`),0}}async loadTenantsFromIdp(){if(!this.idpUrl)return[];try{let response=await fetch(`${this.idpUrl}/tenants`,{method:"GET",headers:{"Content-Type":"application/json"}});if(!response.ok)return this.logger.warn(`[TenantRegistry] IDP tenant fetch failed: ${response.status} ${response.statusText}`),[];return((await response.json())?.data?.items||[]).map((item)=>rowToTenantRecord(item))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to fetch tenants from IDP: ${msg}`),[]}}async loadTenantsFromDb(){let tenantsTable=this.mainSchemaTables.tenants;if(!tenantsTable)return this.logger.warn("[TenantRegistry] No tenants table found in main schema"),[];try{return(await this.db.select().from(tenantsTable)).map((row)=>rowToTenantRecord(row))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load tenants: ${msg}`),[]}}async loadTenantFeaturesFromDb(){let featuresTable=this.mainSchemaTables.tenantFeatures;if(!featuresTable)return this.logger.warn("[TenantRegistry] No tenant_features table found in main schema"),[];try{return(await this.db.select().from(featuresTable)).map((row)=>rowToFeatureRecord(row,parseJsonbToConfig))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load tenant features: ${msg}`),[]}}indexTenant(tenant){if(this.tenantsById.set(tenant.id,tenant),this.tenantsBySubdomain.set(tenant.subdomain,tenant),this.tenantsBySchemaName.set(tenant.schemaName,tenant),tenant.domain)this.tenantsBySubdomain.set(tenant.domain,tenant)}async buildSchemaContext(tenant){let schema=pgSchema(tenant.schemaName),schemaTables=this.createAllTablesForSchema(schema),schemaRelations=this.createAllRelationsForSchema?this.createAllRelationsForSchema(schema):{},context={schemaName:tenant.schemaName,schemaTables,schemaRelations,tenant};return this.schemaContexts.set(tenant.schemaName,context),context}resolveFromHeader(tenantIdOrSubdomain,request,vettedClientIp){let tenant=this.tenantsBySubdomain.get(tenantIdOrSubdomain);if(!tenant)tenant=this.tenantsById.get(tenantIdOrSubdomain);if(!tenant)tenant=this.tenantsBySchemaName.get(tenantIdOrSubdomain);if(!tenant)return{resolved:!1,error:`Tenant not found for header value: ${tenantIdOrSubdomain}`,statusCode:404};if(!isTrustedSource(tenant,request,this.authMode,this.defaultTrustedSources,vettedClientIp))return{resolved:!1,error:`Untrusted source for tenant: ${tenant.subdomain}`,statusCode:403};return this.validateAndReturnTenant(tenant)}validateAndReturnTenant(tenant){if(tenant.status==="suspended")return{resolved:!1,error:`Tenant ${tenant.subdomain} is suspended: ${tenant.suspendedReason||"No reason provided"}`,statusCode:403};if(tenant.status==="provisioning")return{resolved:!1,error:`Tenant ${tenant.subdomain} is still being provisioned`,statusCode:503};if(tenant.status==="archived")return{resolved:!1,error:`Tenant ${tenant.subdomain} has been archived`,statusCode:410};let context=this.schemaContexts.get(tenant.schemaName);if(!context)return{resolved:!1,error:`Schema context not found for tenant: ${tenant.subdomain}`,statusCode:500};return{resolved:!0,context}}}var init_TenantRegistry=__esm(()=>{init_schema()});var init_Tenant=__esm(()=>{init_schema();init_TenantRegistry()});var init_types5=()=>{};import{and as and10,desc as desc2,eq as eq15,inArray as inArray2}from"drizzle-orm";function toCamel2(obj){let result={};for(let[key2,value]of Object.entries(obj)){let camelKey=key2.replace(/_([a-z])/g,(_,c)=>c.toUpperCase());result[camelKey]=value}return result}function fromCamel2(obj){let result={};for(let[key2,value]of Object.entries(obj)){let snakeKey=key2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`);result[snakeKey]=value}return result}class VerificationService{db;schemaTables;config;logger;onNotificationTrigger;constructor(serviceConfig){this.db=serviceConfig.db,this.schemaTables=serviceConfig.schemaTables,this.config=serviceConfig.config,this.logger=serviceConfig.logger}setNotificationHandler(handler){this.onNotificationTrigger=handler}getConnectedNotificationNodeIds(stepNodeId,steps,edges){let result=new Set,getNeighbors=(nid)=>{let neighbors=[];for(let edge of edges){let{sourceNodeId:src,targetNodeId:tgt}=edge;if(src===nid)neighbors.push(tgt);else if(tgt===nid)neighbors.push(src)}return neighbors},directNeighbors=getNeighbors(stepNodeId);for(let neighborId of directNeighbors)if(steps.find((s)=>s.nodeId===neighborId)?.nodeType==="notification")result.add(neighborId);for(let neighborId of directNeighbors)if(steps.find((s)=>s.nodeId===neighborId)?.nodeType==="verifier"){let verifierNeighbors=getNeighbors(neighborId);for(let vNeighborId of verifierNeighbors){if(vNeighborId===stepNodeId)continue;if(steps.find((s)=>s.nodeId===vNeighborId)?.nodeType==="notification")result.add(vNeighborId)}}let ids=[...result];return this.logger.info(`[Verification] Connected notification nodes for step ${stepNodeId}: [${ids.join(", ")}]`),ids}getTable(name){return resolveSchemaTable(this.schemaTables,name,this.logger)}getCol(table,col7){return table[col7]}async listFlows(entityName){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return[];return(await(entityName?this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"entityName"),entityName)):this.db.select().from(flowsTable))).map((r)=>fromCamel2(r))}async getFlow(flowId){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),notifRulesTable=this.getTable("verificationNotificationRules"),notifRecipientsTable=this.getTable("verificationNotificationRecipients"),notifChannelsTable=this.getTable("verificationNotificationChannels");if(!flowsTable)return null;let flowRow=(await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)).limit(1))[0];if(!flowRow)return null;let flow=fromCamel2(flowRow),steps=(stepsTable?await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),edges=(edgesTable?await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),verifierConfigs=(verifierConfigsTable?await this.db.select().from(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),notifRules=(notifRulesTable?await this.db.select().from(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),ruleIds=notifRules.map((r)=>r.id),notifRecipients=(notifRecipientsTable&&ruleIds.length>0?await this.db.select().from(notifRecipientsTable).where(inArray2(this.getCol(notifRecipientsTable,"ruleId"),ruleIds)):[]).map((r)=>fromCamel2(r)),notifChannels=(notifChannelsTable&&ruleIds.length>0?await this.db.select().from(notifChannelsTable).where(inArray2(this.getCol(notifChannelsTable,"ruleId"),ruleIds)):[]).map((r)=>fromCamel2(r));return{flow,graph:{steps,edges,verifier_configs:verifierConfigs,notification_rules:notifRules,notification_recipients:notifRecipients,notification_channels:notifChannels}}}async saveFlow(params){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),notifRulesTable=this.getTable("verificationNotificationRules"),notifRecipientsTable=this.getTable("verificationNotificationRecipients"),notifChannelsTable=this.getTable("verificationNotificationChannels");if(!flowsTable||!stepsTable||!edgesTable)throw Error("Verification tables not configured");let existingFlows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),params.flow_id)).limit(1),flowId=params.flow_id;if(existingFlows.length>0)await this.db.update(flowsTable).set(toCamel2({entity_name:params.entity_name,name:params.name,description:params.description||null,trigger_on:params.trigger_on,trigger_fields:params.trigger_fields||null,is_draft:params.is_draft,viewport:params.viewport||null})).where(eq15(this.getCol(flowsTable,"id"),flowId));else{let[newFlow]=await this.db.insert(flowsTable).values(toCamel2({id:flowId,entity_name:params.entity_name,name:params.name,description:params.description||null,trigger_on:params.trigger_on,trigger_fields:params.trigger_fields||null,is_draft:params.is_draft,viewport:params.viewport||null})).returning();flowId=newFlow.id}if(await this.db.delete(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),flowId)),edgesTable)await this.db.delete(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),flowId));if(verifierConfigsTable)await this.db.delete(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId));if(notifRulesTable){let oldRuleIds=(await this.db.select().from(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId))).map((r)=>r.id);if(oldRuleIds.length>0){if(notifRecipientsTable)for(let rid of oldRuleIds)await this.db.delete(notifRecipientsTable).where(eq15(this.getCol(notifRecipientsTable,"ruleId"),rid));if(notifChannelsTable)for(let rid of oldRuleIds)await this.db.delete(notifChannelsTable).where(eq15(this.getCol(notifChannelsTable,"ruleId"),rid))}await this.db.delete(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId))}let{graph}=params;if(graph.steps.length>0)await this.db.insert(stepsTable).values(graph.steps.map((s)=>toCamel2({flow_id:flowId,entity_name:params.entity_name,node_id:s.node_id,node_type:s.node_type,step_order:s.step_order,name:s.name||null,description:s.description||null,position_x:s.position_x,position_y:s.position_y,width:s.width||null,height:s.height||null,style:s.style||null,data:s.data||null})));if(graph.edges.length>0&&edgesTable)await this.db.insert(edgesTable).values(graph.edges.map((e)=>toCamel2({flow_id:flowId,edge_id:e.edge_id,source_node_id:e.source_node_id,target_node_id:e.target_node_id,source_handle:e.source_handle||null,target_handle:e.target_handle||null,edge_type:e.edge_type,label:e.label||null,condition:e.condition||null,style:e.style||null,animated:e.animated})));if(graph.verifier_configs.length>0&&verifierConfigsTable)await this.db.insert(verifierConfigsTable).values(graph.verifier_configs.map((vc)=>toCamel2({flow_id:flowId,node_id:vc.node_id,verifier_type:vc.verifier_type,verifier_user_id:vc.verifier_user_id||null,verifier_role:vc.verifier_role||null,require_signature:vc.require_signature,all_must_approve:vc.all_must_approve})));if(this.logger.info(`[Verification] Save: ${graph.notification_rules.length} rules, ${graph.notification_recipients.length} recipients, ${graph.notification_channels.length} channels`),graph.notification_rules.length>0&&notifRulesTable)for(let rule of graph.notification_rules){this.logger.info(`[Verification] Saving notification rule: node_id=${rule.node_id}, trigger=${rule.trigger}, title_template=${JSON.stringify(rule.title_template)}, body_template=${JSON.stringify(rule.body_template)}`);let[insertedRule]=await this.db.insert(notifRulesTable).values(toCamel2({flow_id:flowId,node_id:rule.node_id,trigger:rule.trigger,title_template:rule.title_template||null,body_template:rule.body_template||null,starts_at:rule.starts_at||null,expires_at:rule.expires_at||null})).returning(),ruleId=insertedRule.id,ruleRecipients=graph.notification_recipients.filter((r)=>r.rule_id===rule.node_id);if(ruleRecipients.length>0&&notifRecipientsTable)await this.db.insert(notifRecipientsTable).values(ruleRecipients.map((r)=>toCamel2({rule_id:ruleId,recipient_type:r.recipient_type,recipient_user_id:r.recipient_user_id||null,recipient_role:r.recipient_role||null})));let ruleChannels=graph.notification_channels.filter((c)=>c.rule_id===rule.node_id);if(ruleChannels.length>0&&notifChannelsTable)await this.db.insert(notifChannelsTable).values(ruleChannels.map((c)=>toCamel2({rule_id:ruleId,channel:c.channel})))}return this.logger.info(`[Verification] Flow saved: ${flowId} for ${params.entity_name}`),{success:!0,flow_id:flowId}}async publishFlow(flowId){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};return await this.db.update(flowsTable).set(toCamel2({is_draft:!1,published_at:new Date})).where(eq15(this.getCol(flowsTable,"id"),flowId)),this.logger.info(`[Verification] Flow published: ${flowId}`),{success:!0,message:"Flow published"}}async deleteFlow(flowId){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};return await this.db.delete(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)),this.logger.info(`[Verification] Flow deleted: ${flowId}`),{success:!0,message:"Flow deleted"}}async startFlow(params){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),instancesTable=this.getTable("verificationInstances"),requirementsTable=this.getTable("verificationRequirements"),userRolesTable=this.getTable("userRoles");if(!flowsTable||!stepsTable||!edgesTable||!instancesTable||!requirementsTable)return{success:!1,message:"Verification tables not configured"};let flow=(await this.db.select().from(flowsTable).where(and10(eq15(this.getCol(flowsTable,"id"),params.flow_id),eq15(this.getCol(flowsTable,"isDraft"),!1))).limit(1))[0];if(!flow)return{success:!1,message:"Published flow not found"};if((await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"entityName"),params.entity_name),eq15(this.getCol(instancesTable,"entityId"),params.entity_id),eq15(this.getCol(instancesTable,"status"),"active"))).limit(1)).length>0)return{success:!1,message:"An active verification instance already exists for this entity"};let steps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),params.flow_id)),edges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),params.flow_id)),stepNodes=steps.filter((s)=>s.nodeType==="step");if(stepNodes.sort((a,b)=>a.stepOrder-b.stepOrder),stepNodes.length===0)return{success:!1,message:"Flow has no step nodes"};let[instance]=await this.db.insert(instancesTable).values(toCamel2({flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,started_by:params.started_by||null,status:"active",current_step_order:1,started_at:new Date})).returning(),instanceId=instance.id;if(await this.materializeRequirementsForStep(instanceId,params.flow_id,params.entity_name,params.entity_id,1,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable),this.onNotificationTrigger){let firstStep=stepNodes[0],firstStepNodeId=firstStep?.nodeId,connectedNotifIds=firstStepNodeId?this.getConnectedNotificationNodeIds(firstStepNodeId,steps,edges):[],ctx={flow_name:flow.name,step_name:firstStep?.name||"Step 1",step_order:1,total_steps:stepNodes.length};if(connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)await this.onNotificationTrigger({trigger:"on_flow_started",flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:notifNodeId,context:ctx});else await this.onNotificationTrigger({trigger:"on_flow_started",flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,context:ctx})}return this.logger.info(`[Verification] Flow started: instance ${instanceId} for ${params.entity_name}:${params.entity_id}`),{success:!0,instance_id:instanceId,message:"Flow started"}}async materializeRequirementsForStep(instanceId,flowId,entityName,entityId,stepOrder,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable){if(!requirementsTable)return;let stepNode=steps.find((s)=>s.nodeType==="step"&&s.stepOrder===stepOrder);if(!stepNode)return;let stepNodeId=stepNode.nodeId,verifierNodeIds=edges.filter((e)=>e.targetNodeId===stepNodeId).map((e)=>e.sourceNodeId),verifierNodes=steps.filter((s)=>s.nodeType==="verifier"&&verifierNodeIds.includes(s.nodeId));if(verifierNodes.length===0)return;let verifierConfigs=[];if(verifierConfigsTable)verifierConfigs=await this.db.select().from(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId));for(let verifierNode of verifierNodes){let nodeId=verifierNode.nodeId,config=verifierConfigs.find((vc)=>vc.nodeId===nodeId);if(!config)continue;let{verifierType,allMustApprove}=config;if(verifierType==="role"&&allMustApprove&&userRolesTable){let rolesTable=this.getTable("roles");if(rolesTable){let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await this.db.select().from(rolesTable).where(eq15(rolesCols.name,config.verifierRole)).limit(1))[0];if(role){let usersWithRole=await this.db.select({user_id:userRolesCols.userId}).from(userRolesTable).where(eq15(userRolesCols.roleId,role.id));for(let userRole of usersWithRole)await this.db.insert(requirementsTable).values(toCamel2({instance_id:instanceId,step_node_id:stepNodeId,verifier_node_id:nodeId,entity_name:entityName,entity_id:entityId,verifier_type:"user",verifier_user_id:userRole.user_id,verifier_role:config.verifierRole||null,require_signature:config.requireSignature,all_must_approve:!0,step_order:stepOrder,status:"pending"}))}}}else await this.db.insert(requirementsTable).values(toCamel2({instance_id:instanceId,step_node_id:stepNodeId,verifier_node_id:nodeId,entity_name:entityName,entity_id:entityId,verifier_type:verifierType,verifier_user_id:config.verifierUserId||null,verifier_role:config.verifierRole||null,require_signature:config.requireSignature,all_must_approve:allMustApprove,step_order:stepOrder,status:"pending"}))}if(this.onNotificationTrigger){let connectedNotifIds=this.getConnectedNotificationNodeIds(stepNodeId,steps,edges);if(this.logger.info(`[Verification] on_step_reached: stepNodeId=${stepNodeId}, connectedNotifIds=[${connectedNotifIds.join(", ")}]`),connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)this.logger.info(`[Verification] Triggering on_step_reached for notifNodeId=${notifNodeId}`),await this.onNotificationTrigger({trigger:"on_step_reached",flow_id:flowId,entity_name:entityName,entity_id:entityId,node_id:notifNodeId,context:{step_name:stepNode.name||`Step ${stepOrder}`,step_order:stepOrder}});else await this.onNotificationTrigger({trigger:"on_step_reached",flow_id:flowId,entity_name:entityName,entity_id:entityId,context:{step_name:stepNode.name||`Step ${stepOrder}`,step_order:stepOrder}})}}async getStatus(entityName,entityId){let instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),verificationsTable=this.getTable("verifications"),requirementsTable=this.getTable("verificationRequirements"),emptyStatus={entity_name:entityName,entity_id:entityId,instance:null,flow:null,current_step:0,total_steps:0,is_completed:!1,is_rejected:!1,verifications:[],pending_requirements:[]};if(!instancesTable||!flowsTable||!verificationsTable||!requirementsTable)return this.logger.error("[Verification] Required tables not found"),emptyStatus;let instanceRow=(await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"entityName"),entityName),eq15(this.getCol(instancesTable,"entityId"),entityId))).orderBy(desc2(this.getCol(instancesTable,"createdAt"))).limit(1))[0];if(!instanceRow)return emptyStatus;let instance=fromCamel2(instanceRow),flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),instance.flow_id)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0,totalSteps=(stepsTable?await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),instance.flow_id),eq15(this.getCol(stepsTable,"nodeType"),"step"))):[]).length,verifications=(await this.db.select().from(verificationsTable).where(eq15(this.getCol(verificationsTable,"instanceId"),instance.id)).orderBy(desc2(this.getCol(verificationsTable,"createdAt")))).map((r)=>fromCamel2(r)),pendingRequirements=(await this.db.select().from(requirementsTable).where(and10(eq15(this.getCol(requirementsTable,"instanceId"),instance.id),eq15(this.getCol(requirementsTable,"status"),"pending")))).map((r)=>fromCamel2(r));return{entity_name:entityName,entity_id:entityId,instance,flow:flow||null,current_step:instance.current_step_order,total_steps:totalSteps,is_completed:instance.status==="completed",is_rejected:instance.status==="rejected",verifications,pending_requirements:pendingRequirements}}async decide(params){let{entity_name,entity_id,user_id,decision,reason,signature_id,diff}=params,verificationsTable=this.getTable("verifications"),requirementsTable=this.getTable("verificationRequirements"),instancesTable=this.getTable("verificationInstances"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),userRolesTable=this.getTable("userRoles"),rolesTable=this.getTable("roles");if(!verificationsTable||!requirementsTable||!instancesTable)return{success:!1,message:"Verification tables not configured"};let status=await this.getStatus(entity_name,entity_id);if(!status.instance||status.instance.status!=="active")return{success:!1,message:"No active verification instance"};let currentPending=status.pending_requirements.filter((r)=>r.step_order===status.current_step);if(currentPending.length===0)return{success:!1,message:"No pending requirements for current step"};let matchedReq=null;for(let req of currentPending){if(req.verifier_type==="user"&&req.verifier_user_id===user_id){matchedReq=req;break}if(req.verifier_type==="role"&&req.verifier_role&&userRolesTable&&rolesTable){let userRolesCols=userRolesTable,rolesCols=rolesTable;if((await this.db.select({role_name:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq15(userRolesCols.roleId,rolesCols.id)).where(eq15(userRolesCols.userId,user_id))).some((ur)=>ur.role_name===req.verifier_role)){matchedReq=req;break}}}if(!matchedReq)return{success:!1,message:"User is not authorized to verify at this step"};if(matchedReq.require_signature){if(!signature_id)return{success:!1,message:"Signature is required for this verification step"};let filesTable=resolveSchemaTable(this.schemaTables,"files",this.logger);if(filesTable){if((await this.db.select().from(filesTable).where(and10(eq15(this.getCol(filesTable,"id"),signature_id),eq15(this.getCol(filesTable,"uploadedBy"),user_id))).limit(1)).length===0)return{success:!1,message:"Signature file not found or not owned by the verifier"}}}if((await this.db.update(requirementsTable).set({status:decision}).where(and10(eq15(this.getCol(requirementsTable,"id"),matchedReq.id),eq15(this.getCol(requirementsTable,"status"),"pending"))).returning()).length===0)return{success:!1,message:"This requirement has already been decided"};let[newVerification]=await this.db.insert(verificationsTable).values(toCamel2({instance_id:status.instance.id,requirement_id:matchedReq.id,verifier_id:user_id,signature_id:signature_id||null,entity_name,entity_id,step_order:status.current_step,decision,reason:reason||null,diff:diff||null})).returning();if(this.onNotificationTrigger&&status.instance){let stepName=`Step ${status.current_step}`,allSteps=[],allEdges=[];if(stepsTable){allSteps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id));let stepRow=allSteps.find((s)=>s.nodeId===matchedReq.step_node_id);if(stepRow?.name)stepName=stepRow.name}if(edgesTable)allEdges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));let triggerName=decision==="approved"?"on_approved":"on_rejected",ctx={flow_name:status.flow?.name||"",step_name:stepName,step_order:status.current_step,total_steps:status.total_steps,decision},connectedNotifIds=this.getConnectedNotificationNodeIds(matchedReq.step_node_id,allSteps,allEdges);if(connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)await this.onNotificationTrigger({trigger:triggerName,flow_id:status.instance.flow_id,entity_name,entity_id,node_id:notifNodeId,verifier_id:user_id,decision,context:ctx});else await this.onNotificationTrigger({trigger:triggerName,flow_id:status.instance.flow_id,entity_name,entity_id,verifier_id:user_id,decision,context:ctx})}if(decision==="rejected"){await this.db.update(instancesTable).set(toCamel2({status:"rejected",completed_at:new Date})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id));let newInstanceId;if(this.config.autoResetOnRejection){this.logger.info(`[Verification] Flow rejected for ${entity_name}:${entity_id}, auto-restarting from step 1`);let restartResult=await this.startFlow({flow_id:status.instance.flow_id,entity_name,entity_id,started_by:status.instance.started_by});if(restartResult.success)newInstanceId=restartResult.instance_id}return{success:!0,message:this.config.autoResetOnRejection?"Verification rejected \u2014 flow restarted from step 1":"Verification rejected",verification:newVerification,flow_completed:!1,new_instance_id:newInstanceId}}let matchedReqId=matchedReq.id,remainingPending=currentPending.filter((r)=>r.id!==matchedReqId);if(remainingPending.length>0)return{success:!0,message:`Step ${status.current_step} partially approved, ${remainingPending.length} verifier(s) remaining`,verification:newVerification,flow_completed:!1};let nextStep=status.current_step+1;if(nextStep>status.total_steps){if(await this.db.update(instancesTable).set(toCamel2({status:"completed",completed_at:new Date})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id)),this.onNotificationTrigger){let completedSteps=[],completedEdges=[];if(stepsTable)completedSteps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id));if(edgesTable)completedEdges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));let lastStepNodeId=matchedReq.step_node_id,completedNotifIds=this.getConnectedNotificationNodeIds(lastStepNodeId,completedSteps,completedEdges),completedCtx={flow_name:status.flow?.name||"",step_order:status.current_step,total_steps:status.total_steps};if(completedNotifIds.length>0)for(let notifNodeId of completedNotifIds)await this.onNotificationTrigger({trigger:"on_flow_completed",flow_id:status.instance.flow_id,entity_name,entity_id,node_id:notifNodeId,context:completedCtx});else await this.onNotificationTrigger({trigger:"on_flow_completed",flow_id:status.instance.flow_id,entity_name,entity_id,context:completedCtx})}return{success:!0,message:"Verification flow completed",verification:newVerification,flow_completed:!0}}if(await this.db.update(instancesTable).set(toCamel2({current_step_order:nextStep})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id)),stepsTable&&edgesTable){let steps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id)),edges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));await this.materializeRequirementsForStep(status.instance.id,status.instance.flow_id,entity_name,entity_id,nextStep,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable)}return{success:!0,message:`Step ${status.current_step} approved, moving to step ${nextStep}`,verification:newVerification,flow_completed:!1,next_step:nextStep}}async startFlowForEntity(params){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};let flow=(await this.db.select().from(flowsTable).where(and10(eq15(this.getCol(flowsTable,"entityName"),params.entity_name),eq15(this.getCol(flowsTable,"isDraft"),!1))).limit(1))[0];if(!flow)return{success:!1,message:`No published flow found for entity '${params.entity_name}'`};return this.startFlow({flow_id:flow.id,entity_name:params.entity_name,entity_id:params.entity_id,started_by:params.started_by})}async listEntityStatuses(params){let instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),emptyResult={items:[],total:0,page:1,limit:20};if(!instancesTable||!flowsTable)return emptyResult;let page=params.page||1,limit=params.limit||20,offset=(page-1)*limit,conditions=[eq15(this.getCol(instancesTable,"entityName"),params.entity_name)];if(params.status)conditions.push(eq15(this.getCol(instancesTable,"status"),params.status));let whereClause=conditions.length===1?conditions[0]:and10(...conditions),allInstances=(await this.db.select().from(instancesTable).where(whereClause).orderBy(desc2(this.getCol(instancesTable,"createdAt")))).map((r)=>fromCamel2(r)),total=allInstances.length,paged=allInstances.slice(offset,offset+limit),items=[];for(let inst of paged){let flowId=inst.flow_id,flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0,totalSteps=0;if(stepsTable)totalSteps=(await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),flowId),eq15(this.getCol(stepsTable,"nodeType"),"step")))).length;items.push({instance_id:inst.id,entity_name:inst.entity_name,entity_id:inst.entity_id,flow_id:flowId,flow_name:flow?.name||"Unknown",status:inst.status,current_step_order:inst.current_step_order,total_steps:totalSteps,started_by:inst.started_by,started_at:inst.started_at,completed_at:inst.completed_at})}return{items,total,page,limit}}async getPending(userId){let requirementsTable=this.getTable("verificationRequirements"),instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),userRolesTable=this.getTable("userRoles"),rolesTable=this.getTable("roles");if(this.logger.info(`[Verification.getPending] userId=${userId}, tables: req=${!!requirementsTable} inst=${!!instancesTable} flow=${!!flowsTable} steps=${!!stepsTable} roles=${!!rolesTable} userRoles=${!!userRolesTable}`),!requirementsTable||!instancesTable||!flowsTable)return this.logger.warn("[Verification.getPending] Missing required tables, returning empty"),[];let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoleNames=(userRolesTable&&rolesTable?await this.db.select({role_name:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq15(userRolesCols.roleId,rolesCols.id)).where(eq15(userRolesCols.userId,userId)):[]).map((ur)=>ur.role_name),pendingReqs=(await this.db.select().from(requirementsTable).where(eq15(this.getCol(requirementsTable,"status"),"pending"))).map((r)=>fromCamel2(r));this.logger.info(`[Verification.getPending] Found ${pendingReqs.length} pending requirements, userRoles=${JSON.stringify(userRoleNames)}`);for(let req of pendingReqs)this.logger.info(`[Verification.getPending] Req: verifier_type=${req.verifier_type} verifier_user_id=${req.verifier_user_id} verifier_role=${req.verifier_role} step_order=${req.step_order} entity=${req.entity_name}/${req.entity_id}`);let pendingItems=[];for(let req of pendingReqs){if(!(req.verifier_type==="user"&&req.verifier_user_id===userId||req.verifier_type==="role"&&userRoleNames.includes(req.verifier_role))){this.logger.info(`[Verification.getPending] Skipping req: canVerify=false (type=${req.verifier_type}, reqUserId=${req.verifier_user_id}, loggedInUserId=${userId})`);continue}let instances=await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"id"),req.instance_id),eq15(this.getCol(instancesTable,"status"),"active"))).limit(1),instance=instances[0]?fromCamel2(instances[0]):void 0;if(!instance)continue;if(instance.current_step_order!==req.step_order)continue;let flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),instance.flow_id)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0;if(!flow)continue;let stepName;if(stepsTable&&req.step_node_id){let stepRow=(await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),instance.flow_id),eq15(this.getCol(stepsTable,"nodeId"),req.step_node_id))).limit(1))[0];if(stepRow?.name)stepName=stepRow.name}pendingItems.push({instance_id:instance.id,entity_name:req.entity_name,entity_id:req.entity_id,flow_name:flow.name,step_order:req.step_order,step_name:stepName,require_signature:req.require_signature,created_at:req.created_at})}return pendingItems}}var init_Verification=__esm(()=>{init_types5()});var genLookup=(target)=>{let lookupTemp=typeof Uint8Array>"u"?[]:new Uint8Array(256),len=64;for(let i=0;i<64;i++)lookupTemp[target.charCodeAt(i)]=i;return lookupTemp},lookup,lookupUrl,base64UrlPattern,base64Pattern,base64,base64_default;var init_base64=__esm(()=>{lookup=genLookup("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),lookupUrl=genLookup("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),base64UrlPattern=/^[-A-Za-z0-9\-_]*$/,base64Pattern=/^[-A-Za-z0-9+/]*={0,3}$/,base64={};base64.toArrayBuffer=(data,urlMode)=>{let len=data.length,bufferLength=data.length*0.75,i,p=0,encoded1,encoded2,encoded3,encoded4;if(data[data.length-1]==="="){if(bufferLength--,data[data.length-2]==="=")bufferLength--}let arraybuffer=new ArrayBuffer(bufferLength),bytes=new Uint8Array(arraybuffer),target=urlMode?lookupUrl:lookup;for(i=0;i<len;i+=4)encoded1=target[data.charCodeAt(i)],encoded2=target[data.charCodeAt(i+1)],encoded3=target[data.charCodeAt(i+2)],encoded4=target[data.charCodeAt(i+3)],bytes[p++]=encoded1<<2|encoded2>>4,bytes[p++]=(encoded2&15)<<4|encoded3>>2,bytes[p++]=(encoded3&3)<<6|encoded4&63;return arraybuffer};base64.fromArrayBuffer=(arrBuf,urlMode)=>{let bytes=new Uint8Array(arrBuf),i,result="",len=bytes.length,target=urlMode?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";for(i=0;i<len;i+=3)result+=target[bytes[i]>>2],result+=target[(bytes[i]&3)<<4|bytes[i+1]>>4],result+=target[(bytes[i+1]&15)<<2|bytes[i+2]>>6],result+=target[bytes[i+2]&63];let remainder=len%3;if(remainder===2)result=result.substring(0,result.length-1)+(urlMode?"":"=");else if(remainder===1)result=result.substring(0,result.length-2)+(urlMode?"":"==");return result};base64.toString=(str3,urlMode)=>{return new TextDecoder().decode(base64.toArrayBuffer(str3,urlMode))};base64.fromString=(str3,urlMode)=>{return base64.fromArrayBuffer(new TextEncoder().encode(str3),urlMode)};base64.validate=(encoded,urlMode)=>{if(!(typeof encoded==="string"||encoded instanceof String))return!1;try{return urlMode?base64UrlPattern.test(encoded):base64Pattern.test(encoded)}catch(_e){return!1}};base64.base64=base64;base64_default=base64});var exports_isoBase64URL={};__export(exports_isoBase64URL,{trimPadding:()=>trimPadding,toUTF8String:()=>toUTF8String,toBuffer:()=>toBuffer,toBase64:()=>toBase64,isBase64URL:()=>isBase64URL,isBase64:()=>isBase64,fromUTF8String:()=>fromUTF8String,fromBuffer:()=>fromBuffer});function toBuffer(base64urlString,from="base64url"){let _buffer=base64_default.toArrayBuffer(base64urlString,from==="base64url");return new Uint8Array(_buffer)}function fromBuffer(buffer,to="base64url"){let _normalized=new Uint8Array(buffer);return base64_default.fromArrayBuffer(_normalized.buffer,to==="base64url")}function toBase64(base64urlString){let fromBase64Url=base64_default.toArrayBuffer(base64urlString,!0);return base64_default.fromArrayBuffer(fromBase64Url)}function fromUTF8String(utf8String){return base64_default.fromString(utf8String,!0)}function toUTF8String(base64urlString){return base64_default.toString(base64urlString,!0)}function isBase64(input){return base64_default.validate(input,!1)}function isBase64URL(input){return input=trimPadding(input),base64_default.validate(input,!0)}function trimPadding(input){return input.replace(/=/g,"")}var init_isoBase64URL=__esm(()=>{init_base64()});function decodeLength(data,argument,index){if(argument<24)return[argument,1];let remainingDataLength=data.byteLength-index-1,view=new DataView(data.buffer,index+1),output,bytes=0;switch(argument){case 24:{if(remainingDataLength>0)output=view.getUint8(0),bytes=2;break}case 25:{if(remainingDataLength>1)output=view.getUint16(0,!1),bytes=3;break}case 26:{if(remainingDataLength>3)output=view.getUint32(0,!1),bytes=5;break}case 27:{if(remainingDataLength>7){let bigOutput=view.getBigUint64(0,!1);if(bigOutput>=24n&&bigOutput<=Number.MAX_SAFE_INTEGER)return[Number(bigOutput),9]}break}}if(output&&output>=24)return[output,bytes];throw Error("Length not supported or not well formed")}function encodeLength(major,argument){let majorEncoded=major<<5;if(argument<0)throw Error("CBOR Data Item argument must not be negative");let bigintArgument;if(typeof argument=="number"){if(!Number.isInteger(argument))throw Error("CBOR Data Item argument must be an integer");bigintArgument=BigInt(argument)}else bigintArgument=argument;if(major==MAJOR_TYPE_NEGATIVE_INTEGER){if(bigintArgument==0n)throw Error("CBOR Data Item argument cannot be zero when negative");bigintArgument=bigintArgument-1n}if(bigintArgument>18446744073709551615n)throw Error("CBOR number out of range");let buffer=new Uint8Array(8);if(new DataView(buffer.buffer).setBigUint64(0,bigintArgument,!1),bigintArgument<=23)return[majorEncoded|buffer[7]];else if(bigintArgument<=255)return[majorEncoded|24,buffer[7]];else if(bigintArgument<=65535)return[majorEncoded|25,...buffer.slice(6)];else if(bigintArgument<=4294967295)return[majorEncoded|26,...buffer.slice(4)];else return[majorEncoded|27,...buffer]}var MAJOR_TYPE_UNSIGNED_INTEGER=0,MAJOR_TYPE_NEGATIVE_INTEGER=1,MAJOR_TYPE_BYTE_STRING=2,MAJOR_TYPE_TEXT_STRING=3,MAJOR_TYPE_ARRAY=4,MAJOR_TYPE_MAP=5,MAJOR_TYPE_TAG=6,MAJOR_TYPE_SIMPLE_OR_FLOAT=7;class CBORTag{constructor(tag,value){Object.defineProperty(this,"tagId",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"tagValue",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.tagId=tag,this.tagValue=value}get tag(){return this.tagId}get value(){return this.tagValue}}function decodeUnsignedInteger(data,argument,index){return decodeLength(data,argument,index)}function decodeNegativeInteger(data,argument,index){let[value,length]=decodeUnsignedInteger(data,argument,index);return[-value-1,length]}function decodeByteString(data,argument,index){let[lengthValue,lengthConsumed]=decodeLength(data,argument,index),dataStartIndex=index+lengthConsumed;return[new Uint8Array(data.buffer.slice(dataStartIndex,dataStartIndex+lengthValue)),lengthConsumed+lengthValue]}function decodeString(data,argument,index){let[value,length]=decodeByteString(data,argument,index);return[TEXT_DECODER.decode(value),length]}function decodeArray(data,argument,index){if(argument===0)return[[],1];let[length,lengthConsumed]=decodeLength(data,argument,index),consumedLength=lengthConsumed,value=[];for(let i=0;i<length;i++){if(data.byteLength-index-consumedLength<=0)throw Error("array is not supported or well formed");let[decodedValue,consumed]=decodeNext(data,index+consumedLength);value.push(decodedValue),consumedLength+=consumed}return[value,consumedLength]}function decodeMap(data,argument,index){if(argument===0)return[new Map,1];let[length,lengthConsumed]=decodeLength(data,argument,index),consumedLength=lengthConsumed,result=new Map;for(let i=0;i<length;i++){let remainingDataLength=data.byteLength-index-consumedLength;if(remainingDataLength<=0)throw Error(MAP_ERROR);let[key2,keyConsumed]=decodeNext(data,index+consumedLength);if(consumedLength+=keyConsumed,remainingDataLength-=keyConsumed,remainingDataLength<=0)throw Error(MAP_ERROR);if(typeof key2!=="string"&&typeof key2!=="number")throw Error(MAP_ERROR);if(result.has(key2))throw Error(MAP_ERROR);let[value,valueConsumed]=decodeNext(data,index+consumedLength);consumedLength+=valueConsumed,result.set(key2,value)}return[result,consumedLength]}function decodeFloat16(data,index){if(index+3>data.byteLength)throw Error("CBOR stream ended before end of Float 16");let result=data.getUint16(index+1,!1);if(result==31744)return[1/0,3];else if(result==32256)return[NaN,3];else if(result==64512)return[-1/0,3];throw Error("Float16 data is unsupported")}function decodeFloat32(data,index){if(index+5>data.byteLength)throw Error("CBOR stream ended before end of Float 32");return[data.getFloat32(index+1,!1),5]}function decodeFloat64(data,index){if(index+9>data.byteLength)throw Error("CBOR stream ended before end of Float 64");return[data.getFloat64(index+1,!1),9]}function decodeTag(data,argument,index){let[tag,tagBytes]=decodeLength(data,argument,index),[value,valueBytes]=decodeNext(data,index+tagBytes);return[new CBORTag(tag,value),tagBytes+valueBytes]}function decodeNext(data,index){if(index>=data.byteLength)throw Error("CBOR stream ended before tag value");let byte=data.getUint8(index),majorType=byte>>5,argument=byte&31;switch(majorType){case MAJOR_TYPE_UNSIGNED_INTEGER:return decodeUnsignedInteger(data,argument,index);case MAJOR_TYPE_NEGATIVE_INTEGER:return decodeNegativeInteger(data,argument,index);case MAJOR_TYPE_BYTE_STRING:return decodeByteString(data,argument,index);case MAJOR_TYPE_TEXT_STRING:return decodeString(data,argument,index);case MAJOR_TYPE_ARRAY:return decodeArray(data,argument,index);case MAJOR_TYPE_MAP:return decodeMap(data,argument,index);case MAJOR_TYPE_TAG:return decodeTag(data,argument,index);case MAJOR_TYPE_SIMPLE_OR_FLOAT:switch(argument){case 20:return[!1,1];case 21:return[!0,1];case 22:return[null,1];case 23:return[void 0,1];case 25:return decodeFloat16(data,index);case 26:return decodeFloat32(data,index);case 27:return decodeFloat64(data,index)}}throw Error(`Unsupported or not well formed at ${index}`)}function encodeSimple(data){if(data===!0)return 245;else if(data===!1)return 244;else if(data===null)return 246;return 247}function encodeFloat(data){if(Math.fround(data)==data||!Number.isFinite(data)||Number.isNaN(data)){let output=new Uint8Array(5);return output[0]=250,new DataView(output.buffer).setFloat32(1,data,!1),output}else{let output=new Uint8Array(9);return output[0]=251,new DataView(output.buffer).setFloat64(1,data,!1),output}}function encodeNumber(data){if(typeof data=="number"){if(Number.isSafeInteger(data))if(data<0)return encodeLength(MAJOR_TYPE_NEGATIVE_INTEGER,Math.abs(data));else return encodeLength(MAJOR_TYPE_UNSIGNED_INTEGER,data);return[encodeFloat(data)]}else if(data<0n)return encodeLength(MAJOR_TYPE_NEGATIVE_INTEGER,data*-1n);else return encodeLength(MAJOR_TYPE_UNSIGNED_INTEGER,data)}function encodeString(data,output){output.push(...encodeLength(MAJOR_TYPE_TEXT_STRING,data.length)),output.push(ENCODER.encode(data))}function encodeBytes(data,output){output.push(...encodeLength(MAJOR_TYPE_BYTE_STRING,data.length)),output.push(data)}function encodeArray(data,output){output.push(...encodeLength(MAJOR_TYPE_ARRAY,data.length));for(let element of data)encodePartialCBOR(element,output)}function encodeMap(data,output){output.push(new Uint8Array(encodeLength(MAJOR_TYPE_MAP,data.size)));for(let[key2,value]of data.entries())encodePartialCBOR(key2,output),encodePartialCBOR(value,output)}function encodeTag(tag,output){output.push(...encodeLength(MAJOR_TYPE_TAG,tag.tag)),encodePartialCBOR(tag.value,output)}function encodePartialCBOR(data,output){if(typeof data=="boolean"||data===null||data==null){output.push(encodeSimple(data));return}if(typeof data=="number"||typeof data=="bigint"){output.push(...encodeNumber(data));return}if(typeof data=="string"){encodeString(data,output);return}if(data instanceof Uint8Array){encodeBytes(data,output);return}if(Array.isArray(data)){encodeArray(data,output);return}if(data instanceof Map){encodeMap(data,output);return}if(data instanceof CBORTag){encodeTag(data,output);return}throw Error("Not implemented")}function decodePartialCBOR(data,index){if(data.byteLength===0||data.byteLength<=index||index<0)throw Error("No data");if(data instanceof Uint8Array)return decodeNext(new DataView(data.buffer),index);else if(data instanceof ArrayBuffer)return decodeNext(new DataView(data),index);return decodeNext(data,index)}function encodeCBOR(data){let results=[];encodePartialCBOR(data,results);let length=0;for(let result of results)if(typeof result=="number")length+=1;else length+=result.length;let output=new Uint8Array(length),index=0;for(let result of results)if(typeof result=="number")output[index]=result,index+=1;else output.set(result,index),index+=result.length;return output}var TEXT_DECODER,MAP_ERROR="Map is not supported or well formed",ENCODER;var init_cbor=__esm(()=>{TEXT_DECODER=new TextDecoder;ENCODER=new TextEncoder});var init_esm=__esm(()=>{init_cbor()});var exports_isoCBOR={};__export(exports_isoCBOR,{encode:()=>encode,decodeFirst:()=>decodeFirst});function decodeFirst(input){let _input=new Uint8Array(input),decoded=decodePartialCBOR(_input,0),[first]=decoded;return first}function encode(input){return encodeCBOR(input)}var init_isoCBOR=__esm(()=>{init_esm()});function isCOSEPublicKeyOKP(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.OKP}function isCOSEPublicKeyEC2(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.EC2}function isCOSEPublicKeyRSA(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.RSA}function isCOSEKty(kty){return Object.values(COSEKTY).indexOf(kty)>=0}function isCOSECrv(crv){return Object.values(COSECRV).indexOf(crv)>=0}function isCOSEAlg(alg){return Object.values(COSEALG).indexOf(alg)>=0}var COSEKEYS,COSEKTY,COSECRV,COSEALG;var init_cose=__esm(()=>{(function(COSEKEYS2){COSEKEYS2[COSEKEYS2.kty=1]="kty",COSEKEYS2[COSEKEYS2.alg=3]="alg",COSEKEYS2[COSEKEYS2.crv=-1]="crv",COSEKEYS2[COSEKEYS2.x=-2]="x",COSEKEYS2[COSEKEYS2.y=-3]="y",COSEKEYS2[COSEKEYS2.n=-1]="n",COSEKEYS2[COSEKEYS2.e=-2]="e"})(COSEKEYS||(COSEKEYS={}));(function(COSEKTY2){COSEKTY2[COSEKTY2.OKP=1]="OKP",COSEKTY2[COSEKTY2.EC2=2]="EC2",COSEKTY2[COSEKTY2.RSA=3]="RSA"})(COSEKTY||(COSEKTY={}));(function(COSECRV2){COSECRV2[COSECRV2.P256=1]="P256",COSECRV2[COSECRV2.P384=2]="P384",COSECRV2[COSECRV2.P521=3]="P521",COSECRV2[COSECRV2.ED25519=6]="ED25519",COSECRV2[COSECRV2.SECP256K1=8]="SECP256K1"})(COSECRV||(COSECRV={}));(function(COSEALG2){COSEALG2[COSEALG2.ES256=-7]="ES256",COSEALG2[COSEALG2.EdDSA=-8]="EdDSA",COSEALG2[COSEALG2.ES384=-35]="ES384",COSEALG2[COSEALG2.ES512=-36]="ES512",COSEALG2[COSEALG2.PS256=-37]="PS256",COSEALG2[COSEALG2.PS384=-38]="PS384",COSEALG2[COSEALG2.PS512=-39]="PS512",COSEALG2[COSEALG2.ES256K=-47]="ES256K",COSEALG2[COSEALG2.RS256=-257]="RS256",COSEALG2[COSEALG2.RS384=-258]="RS384",COSEALG2[COSEALG2.RS512=-259]="RS512",COSEALG2[COSEALG2.RS1=-65535]="RS1"})(COSEALG||(COSEALG={}))});function mapCoseAlgToWebCryptoAlg(alg){if([COSEALG.RS1].indexOf(alg)>=0)return"SHA-1";else if([COSEALG.ES256,COSEALG.PS256,COSEALG.RS256].indexOf(alg)>=0)return"SHA-256";else if([COSEALG.ES384,COSEALG.PS384,COSEALG.RS384].indexOf(alg)>=0)return"SHA-384";else if([COSEALG.ES512,COSEALG.PS512,COSEALG.RS512,COSEALG.EdDSA].indexOf(alg)>=0)return"SHA-512";throw Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`)}var init_mapCoseAlgToWebCryptoAlg=__esm(()=>{init_cose()});function getWebCrypto(){return new Promise((resolve2,reject)=>{if(webCrypto)return resolve2(webCrypto);let _globalThisCrypto=_getWebCryptoInternals.stubThisGlobalThisCrypto();if(_globalThisCrypto)return webCrypto=_globalThisCrypto,resolve2(webCrypto);return reject(new MissingWebCrypto)})}var webCrypto=void 0,MissingWebCrypto,_getWebCryptoInternals;var init_getWebCrypto=__esm(()=>{MissingWebCrypto=class MissingWebCrypto extends Error{constructor(){super("An instance of the Crypto API could not be located");this.name="MissingWebCrypto"}};_getWebCryptoInternals={stubThisGlobalThisCrypto:()=>globalThis.crypto,setCachedCrypto:(newCrypto)=>{webCrypto=newCrypto}}});async function digest(data,algorithm){let WebCrypto=await getWebCrypto(),subtleAlgorithm=mapCoseAlgToWebCryptoAlg(algorithm),hashed=await WebCrypto.subtle.digest(subtleAlgorithm,data);return new Uint8Array(hashed)}var init_digest=__esm(()=>{init_mapCoseAlgToWebCryptoAlg();init_getWebCrypto()});async function getRandomValues(array){return(await getWebCrypto()).getRandomValues(array),array}var init_getRandomValues=__esm(()=>{init_getWebCrypto()});async function importKey(opts){let WebCrypto=await getWebCrypto(),{keyData,algorithm}=opts;return WebCrypto.subtle.importKey("jwk",keyData,algorithm,!1,["verify"])}var init_importKey=__esm(()=>{init_getWebCrypto()});async function verifyEC2(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!alg)throw Error("Public key was missing alg (EC2)");if(!crv)throw Error("Public key was missing crv (EC2)");if(!x)throw Error("Public key was missing x (EC2)");if(!y)throw Error("Public key was missing y (EC2)");let _crv;if(crv===COSECRV.P256)_crv="P-256";else if(crv===COSECRV.P384)_crv="P-384";else if(crv===COSECRV.P521)_crv="P-521";else throw Error(`Unexpected COSE crv value of ${crv} (EC2)`);let keyData={kty:"EC",crv:_crv,x:exports_isoBase64URL.fromBuffer(x),y:exports_isoBase64URL.fromBuffer(y),ext:!1},key2=await importKey({keyData,algorithm:{name:"ECDSA",namedCurve:_crv}}),subtleAlg=mapCoseAlgToWebCryptoAlg(alg);if(shaHashOverride)subtleAlg=mapCoseAlgToWebCryptoAlg(shaHashOverride);let verifyAlgorithm={name:"ECDSA",hash:{name:subtleAlg}};return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyEC2=__esm(()=>{init_cose();init_mapCoseAlgToWebCryptoAlg();init_importKey();init_iso();init_getWebCrypto()});function mapCoseAlgToWebCryptoKeyAlgName(alg){if([COSEALG.EdDSA].indexOf(alg)>=0)return"Ed25519";else if([COSEALG.ES256,COSEALG.ES384,COSEALG.ES512,COSEALG.ES256K].indexOf(alg)>=0)return"ECDSA";else if([COSEALG.RS256,COSEALG.RS384,COSEALG.RS512,COSEALG.RS1].indexOf(alg)>=0)return"RSASSA-PKCS1-v1_5";else if([COSEALG.PS256,COSEALG.PS384,COSEALG.PS512].indexOf(alg)>=0)return"RSA-PSS";throw Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`)}var init_mapCoseAlgToWebCryptoKeyAlgName=__esm(()=>{init_cose()});async function verifyRSA(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!alg)throw Error("Public key was missing alg (RSA)");if(!isCOSEAlg(alg))throw Error(`Public key had invalid alg ${alg} (RSA)`);if(!n)throw Error("Public key was missing n (RSA)");if(!e)throw Error("Public key was missing e (RSA)");let keyData={kty:"RSA",alg:"",n:exports_isoBase64URL.fromBuffer(n),e:exports_isoBase64URL.fromBuffer(e),ext:!1},keyAlgorithm={name:mapCoseAlgToWebCryptoKeyAlgName(alg),hash:{name:mapCoseAlgToWebCryptoAlg(alg)}},verifyAlgorithm={name:mapCoseAlgToWebCryptoKeyAlgName(alg)};if(shaHashOverride)keyAlgorithm.hash.name=mapCoseAlgToWebCryptoAlg(shaHashOverride);if(keyAlgorithm.name==="RSASSA-PKCS1-v1_5"){if(keyAlgorithm.hash.name==="SHA-256")keyData.alg="RS256";else if(keyAlgorithm.hash.name==="SHA-384")keyData.alg="RS384";else if(keyAlgorithm.hash.name==="SHA-512")keyData.alg="RS512";else if(keyAlgorithm.hash.name==="SHA-1")keyData.alg="RS1"}else if(keyAlgorithm.name==="RSA-PSS"){let saltLength=0;if(keyAlgorithm.hash.name==="SHA-256")keyData.alg="PS256",saltLength=32;else if(keyAlgorithm.hash.name==="SHA-384")keyData.alg="PS384",saltLength=48;else if(keyAlgorithm.hash.name==="SHA-512")keyData.alg="PS512",saltLength=64;verifyAlgorithm.saltLength=saltLength}else throw Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);let key2=await importKey({keyData,algorithm:keyAlgorithm});return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyRSA=__esm(()=>{init_cose();init_mapCoseAlgToWebCryptoAlg();init_importKey();init_iso();init_mapCoseAlgToWebCryptoKeyAlgName();init_getWebCrypto()});function convertAAGUIDToString(aaguid){let hex=exports_isoUint8Array.toHex(aaguid);return[hex.slice(0,8),hex.slice(8,12),hex.slice(12,16),hex.slice(16,20),hex.slice(20,32)].join("-")}var init_convertAAGUIDToString=__esm(()=>{init_iso()});function convertCertBufferToPEM(certBuffer){let b64cert;if(typeof certBuffer==="string")if(exports_isoBase64URL.isBase64URL(certBuffer))b64cert=exports_isoBase64URL.toBase64(certBuffer);else if(exports_isoBase64URL.isBase64(certBuffer))b64cert=certBuffer;else throw Error("Certificate is not a valid base64 or base64url string");else b64cert=exports_isoBase64URL.fromBuffer(certBuffer,"base64");let PEMKey="";for(let i=0;i<Math.ceil(b64cert.length/64);i+=1){let start=64*i;PEMKey+=`${b64cert.substr(start,64)}
+`,hashIdentity=(identity)=>createHash2("sha256").update(identity.trim().toLowerCase()).digest("base64url").slice(0,16),RateLimiterBackendError,DEFAULT_AUTH_LOGIN,DEFAULT_AUTH_REGISTER,DEFAULT_AUTH_PASSWORD_RESET,DEFAULT_AUTH_MAGIC_LINK,DEFAULT_CONFIG3;var init_RateLimiter=__esm(()=>{RateLimiterBackendError=class RateLimiterBackendError extends Error{constructor(message){super(message);this.name="RateLimiterBackendError"}};DEFAULT_AUTH_LOGIN={window:"15m",max:5,blockDuration:"30m"},DEFAULT_AUTH_REGISTER={window:"1h",max:3,blockDuration:"1h"},DEFAULT_AUTH_PASSWORD_RESET={window:"1h",max:3,blockDuration:"1h"},DEFAULT_AUTH_MAGIC_LINK={window:"1h",max:5,blockDuration:"1h"},DEFAULT_CONFIG3={enabled:!0,strategy:"sliding-window",keyPrefix:"rl:",authRoutes:{window:"1m",max:10,login:DEFAULT_AUTH_LOGIN,register:DEFAULT_AUTH_REGISTER,passwordReset:DEFAULT_AUTH_PASSWORD_RESET,magicLink:DEFAULT_AUTH_MAGIC_LINK},publicRoutes:{window:"1m",max:3000},privateRoutes:{window:"1m",max:3000},byIp:!0,byUserId:!0,byEndpoint:!1,skipSuccessfulRequests:!1,headers:{remaining:"X-RateLimit-Remaining",reset:"X-RateLimit-Reset",limit:"X-RateLimit-Limit"},whitelist:[],blacklist:[]}});import{createCipheriv as createCipheriv2,createDecipheriv as createDecipheriv2,randomBytes as randomBytes4,scryptSync as scryptSync2,timingSafeEqual as timingSafeEqual2}from"crypto";var VERSION="v1",IV_LEN2=12,KEY_LEN=32,SCRYPT_SALT="nucleus-secrets-v1",keyCache,deriveKey2=(masterKey)=>{let cached=keyCache.get(masterKey);if(cached)return cached;let key2=scryptSync2(masterKey,SCRYPT_SALT,KEY_LEN);return keyCache.set(masterKey,key2),key2},encryptSecret=(plaintext,masterKey)=>{if(!masterKey)throw Error("secrets encryption key is empty");let iv=randomBytes4(IV_LEN2),cipher=createCipheriv2("aes-256-gcm",deriveKey2(masterKey),iv),ciphertext=Buffer.concat([cipher.update(plaintext,"utf-8"),cipher.final()]),tag=cipher.getAuthTag();return[VERSION,iv.toString("base64"),tag.toString("base64"),ciphertext.toString("base64")].join(":")},decryptSecret=(envelope,masterKey)=>{if(!masterKey)throw Error("secrets encryption key is empty");let parts=envelope.split(":");if(parts.length!==4||parts[0]!==VERSION)throw Error("not an encrypted secret envelope");let[,ivB64,tagB64,ctB64]=parts,decipher=createDecipheriv2("aes-256-gcm",deriveKey2(masterKey),Buffer.from(ivB64,"base64"));return decipher.setAuthTag(Buffer.from(tagB64,"base64")),Buffer.concat([decipher.update(Buffer.from(ctB64,"base64")),decipher.final()]).toString("utf-8")},previewOf=(plaintext)=>{let len=plaintext.length;if(len===0)return"";if(len<12)return`\u2022\u2022\u2022\u2022${len}`;return`\u2022\u2022\u2022\u2022${plaintext.slice(-4)}`};var init_crypto=__esm(()=>{keyCache=new Map});function discoverSlots(config){let slots=new Map,add=(slot)=>{let id=`${slot.scope}.${slot.key}`;if(!slots.has(id))slots.set(id,slot)},valueAt=(scope,key2)=>{let node=config;for(let segment of scope.split(".")){if(!isPlainObject(node))return;node=node[segment]}if(!isPlainObject(node))return;let value=node[key2];if(typeof value==="string")return value;if(Array.isArray(value)&&value.every((entry)=>typeof entry==="string"))return value.length>0?value.join(","):void 0;return};for(let descriptor of SECRET_SLOT_DESCRIPTORS)for(let scope of expandPath(config,descriptor.path,descriptor.always===!0)){let leaf=scope.split(".").pop()??descriptor.group,group=descriptor.path.endsWith("*")?`${descriptor.group}:${leaf}`:descriptor.group;for(let declared of descriptor.keys)add({scope,key:declared.key,kind:declared.kind??kindFor(declared.key),label:declared.label,group,required:declared.required??!1,requiredWhen:declared.requiredWhen,hint:declared.hint,secret:declared.secret??descriptor.secret??!0,configValue:valueAt(scope,declared.key)})}let walk=(node,path,depth)=>{if(depth>6)return;for(let[key2,value]of Object.entries(node)){if(SKIP_SECTIONS.has(key2))continue;let childPath=path?`${path}.${key2}`:key2;if(isPlainObject(value)){walk(value,childPath,depth+1);continue}if(typeof value!=="string"&&value!==void 0&&value!==null)continue;if(!CREDENTIAL_KEY_PATTERN.test(key2))continue;if(NOT_A_CREDENTIAL.has(key2.toLowerCase()))continue;if(BOOT_ONLY_PATHS.has(`${path}.${key2}`))continue;let owner=path.split(".").pop(),label=owner&&owner.toLowerCase()!==key2.toLowerCase()?`${humanize(owner)} \u2014 ${humanize(key2)}`:humanize(key2);add({scope:path,key:key2,kind:kindFor(key2),label,group:path.split(".")[0]??"other",required:!1,secret:!0,configValue:typeof value==="string"?value:void 0})}};return walk(config,"",0),[...slots.values()].sort((a,b)=>a.group.localeCompare(b.group)||a.scope.localeCompare(b.scope)||a.key.localeCompare(b.key))}var CREDENTIAL_KEY_PATTERN,NOT_A_CREDENTIAL,BOOT_ONLY_PATHS,SKIP_SECTIONS,kindFor=(key2)=>{let k=key2.toLowerCase();if(k.includes("json"))return"json";if(k.includes("connection"))return"connection_string";if(k.includes("privatekey")||k.includes("private_key"))return"pem";if(k.includes("clientid")||k.includes("client_id"))return"text";return"password"},humanize=(key2)=>key2.replace(/[_-]+/g," ").replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/\s+/g," ").trim().replace(/\b\w/g,(c)=>c.toUpperCase()),SECRET_SLOT_DESCRIPTORS,isPlainObject=(value)=>typeof value==="object"&&value!==null&&!Array.isArray(value),expandPath=(config,path,always=!1)=>{let segments=path.split("."),scopes2=[{path:"",node:config}];for(let segment of segments){let next=[];for(let current of scopes2){if(!isPlainObject(current.node))continue;if(segment==="*")for(let[childKey,childValue]of Object.entries(current.node))next.push({path:current.path?`${current.path}.${childKey}`:childKey,node:childValue});else if(segment in current.node)next.push({path:current.path?`${current.path}.${segment}`:segment,node:current.node[segment]});else if(always)next.push({path:current.path?`${current.path}.${segment}`:segment,node:{}})}scopes2=next}return scopes2.filter((s)=>isPlainObject(s.node)).map((s)=>s.path)},looksLikeEnvName=(value)=>!!value&&/^[A-Z][A-Z0-9_]{2,}$/.test(value);var init_registry=__esm(()=>{CREDENTIAL_KEY_PATTERN=/(secret|password|passwd|apikey|api_key|accesskey|access_key|privatekey|private_key|token|credential|connection_string|connectionstring|clientid|client_id|encryptionkey|encryption_key|servicekey|service_key|json_file_path|jsonfilepath)$/i,NOT_A_CREDENTIAL=new Set(["preventapikeymanagement","allowapplicationkeys","maxkeysperuser","tokenurl","accesstoken","refreshtoken","sessiontoken"]),BOOT_ONLY_PATHS=new Set(["authorization.godminPassword","authorization.godminEmail","authentication.accessToken.secret","authentication.refreshToken.secret","authentication.sessionToken.secret","backup.encryptionKey","notification.channels.telegram.botToken","notification.channels.webhook.headers","domains.cloudflare.apiToken"]),SKIP_SECTIONS=new Set(["entities","systemTables","system_tables","tables","columns","indexes","routes","cors","swagger","secrets"]),SECRET_SLOT_DESCRIPTORS=[{path:"authentication.oauth.providers.*",group:"oauth",label:"OAuth / SSO",keys:[{key:"clientId",kind:"text",label:"Client ID",required:!0},{key:"clientSecret",kind:"password",label:"Client Secret",required:!0},{key:"tenantId",kind:"text",label:"Tenant ID"},{key:"redirectUri",kind:"text",secret:!1,required:!0,label:"Reply URL (Redirect URI)",hint:"The return address registered with the provider. It must be written identically on the provider side too (e.g. Entra > Authentication > Redirect URIs)."}]},{always:!0,path:"email.gmail",group:"email",label:"Gmail (service account)",keys:[{key:"service_account_json",kind:"json",label:"Service Account JSON",required:!0,requiredWhen:"enabled"}]},{always:!0,path:"email.azure",group:"email",label:"Azure Communication Services",keys:[{key:"connection_string",kind:"connection_string",label:"Connection String",required:!0,requiredWhen:"enabled"}]},{always:!0,path:"email.smtp",group:"email",label:"SMTP (Microsoft 365, Exchange, corporate mail)",keys:[{key:"enabled",kind:"boolean",secret:!1,label:"Send through this provider",hint:"The provider that is switched on carries the mail. If the panel cannot read this flag, the card stays \u201CNot set\u201D even when the details are filled in."},{key:"host",kind:"text",label:"Server",required:!0,requiredWhen:"enabled",hint:"smtp.office365.com for Microsoft 365"},{key:"port",kind:"text",label:"Port",hint:"Left empty this is 587 (STARTTLS). 465 means implicit TLS."},{key:"user",kind:"text",label:"Mailbox",required:!0,requiredWhen:"enabled",hint:"The address the password belongs to. It is also the sender address."},{key:"password",kind:"password",label:"Password / app password",required:!0,requiredWhen:"enabled",hint:"If the account has multi-factor authentication, the app password Microsoft generated. In Exchange Online, SMTP AUTH is off per tenant by default and a correct password is refused too \u2014 ask IT to turn it on for that mailbox."},{key:"sender_address",kind:"text",label:"Sender address (optional)",hint:"Left empty, the mailbox itself is used. If you enter a different address, Exchange requires that mailbox to have been granted \u201CSend As\u201D for it; without that the send is refused."},{key:"from_name",kind:"text",label:"Display name",hint:"The name the recipient reads in their inbox, e.g. the name of the portal."}]},{always:!0,path:"service",group:"service",label:"The server\u2019s own key",keys:[{key:"api_key",kind:"password",label:"Service API key",hint:"Some work the server has to do in its OWN name \u2014 counting how many people answered a survey, for instance. That cannot be done with an employee\u2019s permissions, and should not be. Generate the key in the admin panel and paste it here; it carries its owner\u2019s roles, not godmin\u2019s. Left empty, this work is skipped silently."}]},{always:!0,path:"storage.smb",group:"storage",label:"SMB / CIFS share",keys:[{key:"username",kind:"text",label:"Username",required:!0},{key:"password",kind:"password",label:"Password",required:!0}]},{secret:!1,always:!0,path:"storage",group:"storage",label:"File store",keys:[{key:"provider",kind:"text",label:"Storage kind",hint:"local (the server\u2019s own disk) or smb (a corporate file server). The change takes effect immediately."}]},{secret:!1,always:!0,path:"storage.smb",group:"storage",label:"SMB / CIFS share",keys:[{key:"url",kind:"text",label:"Share address",hint:"Paste it exactly as the customer sent it: smb://server/share \u2014 the server and the share name are read from this."},{key:"domain",kind:"text",label:"Domain",hint:"The domain part when the user is written as DOMAIN\\user. Leave empty if it is not needed."},{key:"base_path",kind:"text",label:"Folder inside the share",hint:"The subfolder uploads are gathered in. Empty means the root of the share."}]},{path:"payment.providers.*",group:"payment",label:"Payment provider",keys:[{key:"apiKey",kind:"password",label:"API Key",required:!0},{key:"secretKey",kind:"password",label:"Secret Key",required:!0},{key:"webhookSecret",kind:"password",label:"Webhook Secret"}]},{path:"captcha",group:"captcha",label:"Captcha",keys:[{key:"secretKey",kind:"password",label:"Secret Key"}]},{secret:!1,path:"authentication",group:"portal",label:"Portal address",keys:[{key:"trustedAppOrigins",kind:"list",label:"Trusted origins",required:!0,hint:"The address(es) the portal is installed at. Password-reset and SSO return links are built from these. Wildcard: *.company.com"}]},{secret:!1,always:!0,path:"email",group:"email",label:"Email provider",keys:[{key:"provider",kind:"text",label:"Provider to use",hint:"azure or gmail. Left empty, whichever provider is switched on is used."}]},{secret:!1,always:!0,path:"email.azure",group:"email",label:"Azure Communication Services",keys:[{key:"enabled",kind:"boolean",label:"Azure email enabled",hint:"Entering the connection string is not enough on its own \u2014 sending is turned on by this switch."},{key:"sender_address",kind:"text",label:"Sender address"},{key:"from_name",kind:"text",label:"Sender name",hint:"The name the recipient sees in their inbox in place of the address. Empty means the address shows."}]},{secret:!1,always:!0,path:"email.gmail",group:"email",label:"Gmail (service account)",keys:[{key:"enabled",kind:"boolean",label:"Gmail email enabled"},{key:"from_email",kind:"text",label:"Sender address"},{key:"from_name",kind:"text",label:"Sender name",hint:"The name the recipient sees in their inbox in place of the address. Empty means the address shows."}]}]});import{and as and9,eq as eq13}from"drizzle-orm";class SecretsStore{db;resolveTable;masterKey;constructor(deps){this.db=deps.db,this.resolveTable=deps.resolveTable,this.masterKey=deps.masterKey}table(schemaName){return this.resolveTable(SECRETS_TABLE,schemaName)}async loadAll(schemaName){let values=new Map,failed=[],table=this.table(schemaName);if(!table)return{values,failed,tableMissing:!0};let rows;try{rows=await this.db.select().from(table).where(eq13(col6(table,"isActive"),!0))}catch(error){if(isMissingTableError(error))return{values,failed,tableMissing:!0};throw error}for(let row of rows)try{values.set(cacheKeyOf(row.scope,row.key),decryptSecret(row.valueEnc,this.masterKey))}catch{failed.push(`${row.scope}.${row.key}`)}return{values,failed}}async list(schemaName){let table=this.table(schemaName);if(!table)return[];try{return(await this.db.select().from(table)).filter((r)=>r.isActive!==!1).map(rowToMeta)}catch(error){if(isMissingTableError(error))return[];throw error}}async get(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return null;return(await this.db.select().from(table).where(and9(eq13(col6(table,"scope"),scope),eq13(col6(table,"key"),key2))).limit(1))[0]??null}async set(params,schemaName){let table=this.table(schemaName);if(!table)return null;let existing=await this.get(params.scope,params.key,schemaName),valueEnc=encryptSecret(params.value,this.masterKey),preview=previewOf(params.value),now=new Date;if(existing)await this.db.update(table).set({valueEnc,previousEnc:existing.valueEnc,preview,kind:params.kind??existing.kind??"text",description:params.description??existing.description,version:(existing.version??1)+1,rotatedAt:now,isActive:!0,updatedAt:now,updatedBy:params.actorId??null}).where(eq13(col6(table,"id"),existing.id));else await this.db.insert(table).values({scope:params.scope,key:params.key,valueEnc,preview,kind:params.kind??"text",description:params.description??null,version:1,isActive:!0,createdBy:params.actorId??null,updatedBy:params.actorId??null});let saved=await this.get(params.scope,params.key,schemaName);return saved?rowToMeta(saved):null}async rollback(scope,key2,actorId,schemaName){let table=this.table(schemaName);if(!table)return null;let existing=await this.get(scope,key2,schemaName);if(!existing?.previousEnc)return null;let plaintext=decryptSecret(existing.previousEnc,this.masterKey),now=new Date;await this.db.update(table).set({valueEnc:existing.previousEnc,previousEnc:existing.valueEnc,preview:previewOf(plaintext),version:(existing.version??1)+1,rotatedAt:now,updatedAt:now,updatedBy:actorId??null}).where(eq13(col6(table,"id"),existing.id));let saved=await this.get(scope,key2,schemaName);return saved?rowToMeta(saved):null}async remove(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return!1;let existing=await this.get(scope,key2,schemaName);if(!existing)return!1;return await this.db.delete(table).where(eq13(col6(table,"id"),existing.id)),!0}async touch(scope,key2,schemaName){let table=this.table(schemaName);if(!table)return;await this.db.update(table).set({lastUsedAt:new Date}).where(and9(eq13(col6(table,"scope"),scope),eq13(col6(table,"key"),key2)))}async reencryptAll(newMasterKey,schemaName){let table=this.table(schemaName);if(!table)return{migrated:0,failed:[]};let rows=await this.db.select().from(table),failed=[],planned=[];for(let row of rows)try{let plaintext=decryptSecret(row.valueEnc,this.masterKey),previous=row.previousEnc?encryptSecret(decryptSecret(row.previousEnc,this.masterKey),newMasterKey):null;planned.push({id:row.id,valueEnc:encryptSecret(plaintext,newMasterKey),previousEnc:previous})}catch{failed.push(`${row.scope}.${row.key}`)}if(failed.length>0)return{migrated:0,failed};return await this.db.transaction(async(tx)=>{for(let row of planned)await tx.update(table).set({valueEnc:row.valueEnc,previousEnc:row.previousEnc}).where(eq13(col6(table,"id"),row.id))}),this.masterKey=newMasterKey,{migrated:planned.length,failed}}}var SECRETS_TABLE="nucleusSecrets",col6=(table,key2)=>table[key2],toIso=(value)=>value?new Date(value).toISOString():null,UNDEFINED_TABLE="42P01",isMissingTableError=(error)=>{let seen=new Set,current=error;while(current&&typeof current==="object"&&!seen.has(current)){seen.add(current);let record=current;if(record.code===UNDEFINED_TABLE)return!0;if(typeof record.message==="string"&&/relation .* does not exist/i.test(record.message))return!0;current=record.cause}return!1},rowToMeta=(row)=>({id:row.id,scope:row.scope,key:row.key,kind:row.kind??"text",preview:row.preview??"",description:row.description,version:row.version??1,canRollback:!!row.previousEnc,rotatedAt:toIso(row.rotatedAt),lastUsedAt:toIso(row.lastUsedAt),updatedAt:toIso(row.updatedAt),updatedBy:row.updatedBy}),cacheKeyOf=(scope,key2)=>`${scope}.${key2}`;var init_store2=__esm(()=>{init_crypto()});class SecretsService{store;logger;getRedis;refreshIntervalMs;schemaName;cache=new Map;timer=null;localRevision=0;loaded=!1;tableMissing=!1;warnedTableMissing=!1;constructor(deps){this.store=deps.store,this.logger=deps.logger,this.getRedis=deps.getRedis,this.refreshIntervalMs=deps.refreshIntervalMs??DEFAULT_REFRESH_MS,this.schemaName=deps.schemaName}async start(){if(await this.refresh(),this.timer)return;this.timer=setInterval(()=>{this.refreshIfStale()},this.refreshIntervalMs),this.timer.unref?.()}stop(){if(this.timer)clearInterval(this.timer);this.timer=null}isReady(){return this.loaded}size(){return this.cache.size}isTableMissing(){return this.tableMissing}async refresh(){try{let{values,failed,tableMissing}=await this.store.loadAll(this.schemaName);if(tableMissing){if(this.tableMissing=!0,!this.warnedTableMissing)this.warnedTableMissing=!0,this.logger.warn("[Secrets] nucleus_secrets does not exist yet \u2014 env and literal values resolve normally; "+"the store activates automatically once the schema sync creates it");return}if(this.tableMissing)this.tableMissing=!1,this.warnedTableMissing=!1,this.logger.info("[Secrets] nucleus_secrets is now available \u2014 credential store active");if(this.cache=values,this.loaded=!0,failed.length>0)this.logger.error("[Secrets] Credentials failed to decrypt and were skipped",{slots:failed,hint:"master key changed without re-encrypting \u2014 POST /secrets/reencrypt with the old key"})}catch(error){this.logger.warn("[Secrets] Refresh failed, keeping cached values",{error:error instanceof Error?error.message:String(error)})}}async refreshIfStale(){let redis=this.getRedis?.();if(!redis)return this.refresh();try{let result=await redis.read(REVISION_KEY),remote=Number(result.data??0);if(Number.isFinite(remote)&&remote===this.localRevision&&this.loaded)return;await this.refresh(),this.localRevision=Number.isFinite(remote)?remote:this.localRevision}catch{await this.refresh()}}async bumpRevision(){let redis=this.getRedis?.();if(!redis)return;try{let next=Date.now();this.localRevision=next,await redis.create(REVISION_KEY,next)}catch{}}get(scope,key2){return this.cache.get(cacheKeyOf(scope,key2))}has(scope,key2){return this.cache.has(cacheKeyOf(scope,key2))}resolve(scope,key2,configValue){let fromDb=this.cache.get(cacheKeyOf(scope,key2));if(fromDb)return{value:fromDb,source:"db"};if(configValue){let fromEnv=process.env[configValue];if(fromEnv)return{value:fromEnv,source:"env"};if(looksLikeEnvName(configValue))return{value:void 0,source:"missing"};return{value:configValue,source:"literal"}}return{value:void 0,source:"missing"}}value(scope,key2,configValue){return this.resolve(scope,key2,configValue).value}listValue(scope,key2,configValue){let fallback=Array.isArray(configValue)?configValue.join(","):configValue,raw=this.value(scope,key2,fallback);if(!raw)return Array.isArray(configValue)?configValue:[];return raw.split(/[,;\n\r]+/).map((entry)=>entry.trim()).filter(Boolean)}flag(scope,key2,configValue){let raw=this.get(scope,key2);if(raw===void 0)return configValue===!0;return raw==="true"||raw==="1"}liveConfig(scope,node,keys){let live={...node};for(let key2 of keys){let declared=node[key2],configValue=typeof declared==="string"?declared:void 0;Object.defineProperty(live,key2,{get:()=>this.resolve(scope,key2,configValue).value,enumerable:!0,configurable:!0})}return live}async describe(config,slots){let discovered=slots??discoverSlots(config),stored=await this.store.list(this.schemaName),byId=new Map(stored.map((s)=>[cacheKeyOf(s.scope,s.key),s]));return discovered.map((slot)=>{let id=cacheKeyOf(slot.scope,slot.key),record=byId.get(id),{value,source}=this.resolve(slot.scope,slot.key,slot.configValue),envName=looksLikeEnvName(slot.configValue)?slot.configValue:void 0,gate=slot.requiredWhen?this.flag(slot.scope,slot.requiredWhen,configFlagAt(config,slot.scope,slot.requiredWhen)):!0;return{...slot,required:slot.required&&gate,configValue:envName,source,value:slot.secret?void 0:value,preview:slot.secret?source==="db"&&record?record.preview:value?previewOf(value):"":value??"",envName,version:record?.version,rotatedAt:record?.rotatedAt??null,canRollback:record?.canRollback??!1}})}async list(){return this.store.list(this.schemaName)}async set(params){let saved=await this.store.set(params,this.schemaName);return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential stored",{scope:params.scope,key:params.key,version:saved?.version,actor:params.actorId}),saved}async rollback(scope,key2,actorId){let saved=await this.store.rollback(scope,key2,actorId,this.schemaName);if(!saved)return null;return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential rolled back",{scope,key:key2,actor:actorId}),saved}async remove(scope,key2,actorId){if(!await this.store.remove(scope,key2,this.schemaName))return!1;return await this.refresh(),await this.bumpRevision(),this.logger.info("[Secrets] Credential removed",{scope,key:key2,actor:actorId}),!0}async reencryptAll(newMasterKey){let result=await this.store.reencryptAll(newMasterKey,this.schemaName);return await this.refresh(),await this.bumpRevision(),result}}var REVISION_KEY="nucleus:secrets:revision",DEFAULT_REFRESH_MS=30000,configFlagAt=(config,scope,key2)=>{let node=config;for(let segment of scope.split(".")){if(typeof node!=="object"||node===null)return;node=node[segment]}if(typeof node!=="object"||node===null)return;let value=node[key2];if(typeof value==="boolean")return value;if(typeof value==="string")return value==="true"||value==="1";return};var init_SecretsService=__esm(()=>{init_crypto();init_registry();init_store2()});var resolveMasterKey=(configured)=>{if(configured){let fromEnv=process.env[configured];if(fromEnv)return fromEnv;if(!/^[A-Z][A-Z0-9_]{2,}$/.test(configured))return configured}return process.env.NUCLEUS_SECRETS_KEY||void 0};var init_Secrets=__esm(()=>{init_crypto();init_registry();init_SecretsService();init_store2()});var exports_schema={};__export(exports_schema,{reasonOf:()=>reasonOf,isAdditiveStatement:()=>isAdditiveStatement,ensureSchemaExists:()=>ensureSchemaExists,applySchemaPush:()=>applySchemaPush});import{sql as sql4}from"drizzle-orm";function reasonOf(error){if(!(error instanceof Error))return String(error);let extra=error;return[error.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}var validateIdentifier=(name)=>{if(!name||name.length>63)throw Error(`Invalid identifier: must be 1-63 characters, got ${name.length}`);if(!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name))throw Error(`Invalid identifier: "${name}" contains unsafe characters`);return name},ensureSchemaExists=async(db,schemaName)=>{let safeName=validateIdentifier(schemaName),found=await db.execute(sql4`select 1 from pg_catalog.pg_namespace where nspname = ${safeName} limit 1`);if(rowCountOf(found)>0)return;await db.execute(sql4.raw(`CREATE SCHEMA IF NOT EXISTS "${safeName}"`))},rowCountOf=(result)=>{if(Array.isArray(result))return result.length;let rows=result?.rows;return Array.isArray(rows)?rows.length:0},ADDITIVE_PREFIXES,isAdditiveStatement=(statement)=>{let normalized=statement.trim().toUpperCase();if(/^ALTER TABLE .+ ADD COLUMN/.test(normalized))return!0;if(/^ALTER TABLE .+ ALTER COLUMN .+ SET DEFAULT /.test(normalized))return!0;if(/^ALTER TABLE .+ ADD CONSTRAINT /.test(normalized))return!0;if(/^ALTER TABLE .+ ALTER COLUMN .+ DROP NOT NULL$/.test(normalized))return!0;return ADDITIVE_PREFIXES.some((prefix)=>normalized.startsWith(prefix))},applySchemaPush=async(push,opts)=>{let{schemaName,allowDataLoss,logger:logger2,execute}=opts;if(push.hasDataLoss&&!allowDataLoss){let additive=push.statementsToExecute.filter(isAdditiveStatement),blocked=push.statementsToExecute.filter((s)=>!isAdditiveStatement(s));if(logger2.error(`[Schema] Destructive changes detected for schema "${schemaName}" but database.allowDataLoss is not enabled \u2014 ${blocked.length} statement(s) skipped. Set database.allowDataLoss: true to apply them.`,{warnings:push.warnings,statements:blocked}),additive.length===0||!execute)return!1;let applied=0;for(let statement of additive)try{await execute(statement),applied++}catch(error){logger2.warn(`[Schema] ${schemaName}: ${statement} \u2014 ${reasonOf(error)}`)}return logger2.info(`[Schema] Applied ${applied}/${additive.length} additive statement(s) for "${schemaName}" despite the destructive changes being held back`),applied>0}if(push.hasDataLoss)logger2.warn(`[Schema] Applying destructive changes to schema "${schemaName}" (database.allowDataLoss=true)`,{warnings:push.warnings});try{return await push.apply(),!0}catch(error){let message=error instanceof Error?error.message:String(error);if(!execute)return logger2.error(`[Schema] Could not apply schema changes to "${schemaName}": ${message}. The database does not match this build, so queries against the missing columns will fail.`,{warnings:push.warnings}),!1;logger2.error(`[Schema] The schema push for "${schemaName}" failed as a batch (${message}) \u2014 retrying its ${push.statementsToExecute.length} statement(s) one at a time so one bad statement does not hold back the rest.`);let applied=0,failures=[];for(let statement of push.statementsToExecute)try{await execute(statement),applied++}catch(statementError){failures.push(statement),logger2.error(`[Schema] ${schemaName}: ${statement} \u2014 ${reasonOf(statementError)}`)}if(failures.length>0)logger2.error(`[Schema] ${failures.length} of ${push.statementsToExecute.length} statement(s) could not be applied to "${schemaName}". Any query touching what they would have created will fail until they are.`);return applied>0}};var init_schema=__esm(()=>{ADDITIVE_PREFIXES=["CREATE TABLE IF NOT EXISTS","CREATE TABLE","CREATE SCHEMA IF NOT EXISTS","CREATE SCHEMA","CREATE INDEX IF NOT EXISTS","CREATE INDEX","CREATE UNIQUE INDEX IF NOT EXISTS","CREATE UNIQUE INDEX","CREATE TYPE","DO $$"]});var rowToTenantRecord=(row)=>({id:String(row.id||""),subdomain:String(row.subdomain||""),schemaName:String(row.schemaName||row.schema_name||""),companyId:String(row.companyId||row.company_id||""),companyName:row.companyName!=null?String(row.companyName):row.company_name!=null?String(row.company_name):null,godAdminEmail:String(row.godAdminEmail||row.god_admin_email||""),status:parseStatus(row.status),plan:row.plan!=null?String(row.plan):null,domain:row.domain!=null?String(row.domain):null,settings:parseJsonbToConfig(row.settings),trustedSources:parseTrustedSources(row.trustedSources||row.trusted_sources),maxUsers:row.maxUsers!=null?Number(row.maxUsers):row.max_users!=null?Number(row.max_users):null,provisionedAt:row.provisionedAt!=null?String(row.provisionedAt):row.provisioned_at!=null?String(row.provisioned_at):null,suspendedAt:row.suspendedAt!=null?String(row.suspendedAt):row.suspended_at!=null?String(row.suspended_at):null,suspendedReason:row.suspendedReason!=null?String(row.suspendedReason):row.suspended_reason!=null?String(row.suspended_reason):null}),rowToFeatureRecord=(row,parseConfig)=>({id:String(row.id||""),tenantId:String(row.tenantId||row.tenant_id||""),featureName:String(row.featureName||row.feature_name||""),enabled:Boolean(row.enabled),featureConfig:parseConfig(row.config)}),parseStatus=(value)=>{let valid=["provisioning","active","suspended","archived"],str3=String(value||"provisioning");return valid.includes(str3)?str3:"provisioning"},parseJsonbToConfig=(value)=>{if(!value||typeof value!=="object")return{};let result={};for(let[k,v]of Object.entries(value))if(typeof v==="string"||typeof v==="number"||typeof v==="boolean")result[k]=v;return result},parseTrustedSources=(value)=>{if(!Array.isArray(value))return[];return value.map((item)=>{let entry=item;return{allowHeaderAuth:entry.allowHeaderAuth===!0||entry.allow_header_auth===!0,allowedIps:Array.isArray(entry.allowedIps||entry.allowed_ips)?entry.allowedIps||entry.allowed_ips:void 0,allowedServices:Array.isArray(entry.allowedServices||entry.allowed_services)?entry.allowedServices||entry.allowed_services:void 0}})},normalizeHost=(host)=>{return((host||"").split(":")[0]||"").toLowerCase().replace(/\.$/,"")},extractSubdomain=(host)=>{let hostWithoutPort=host.split(":")[0]||"";if(hostWithoutPort==="localhost"||/^\d+\.\d+\.\d+\.\d+$/.test(hostWithoutPort))return null;let parts=hostWithoutPort.split(".");if(parts.length<3)return null;let subdomain=parts[0]||"";if(!subdomain||subdomain==="www")return null;return subdomain},isIpInCidr=(ip,cidr)=>{let[cidrIp,prefixStr]=cidr.split("/");if(!cidrIp||!prefixStr)return!1;let prefix=Number.parseInt(prefixStr,10);if(Number.isNaN(prefix))return!1;let ipParts=ip.split(".").map(Number),cidrParts=cidrIp.split(".").map(Number);if(ipParts.length!==4||cidrParts.length!==4)return!1;let ipNum=(ipParts[0]||0)<<24|(ipParts[1]||0)<<16|(ipParts[2]||0)<<8|(ipParts[3]||0),cidrNum=(cidrParts[0]||0)<<24|(cidrParts[1]||0)<<16|(cidrParts[2]||0)<<8|(cidrParts[3]||0),mask=~((1<<32-prefix)-1);return(ipNum&mask)===(cidrNum&mask)},isTrustedSource=(tenant,request,authMode,fallbackSources,vettedClientIp)=>{let ownSources=tenant.trustedSources,trustedSources=Array.isArray(ownSources)&&ownSources.length>0?ownSources:fallbackSources;if(!trustedSources||!Array.isArray(trustedSources)||trustedSources.length===0)return!1;let clientIp=vettedClientIp?.trim()||"",serviceId=request.headers.get("x-service-id")||"";for(let source of trustedSources){if(!source.allowHeaderAuth)continue;if(source.allowedIps&&source.allowedIps.length>0){if(source.allowedIps.some((allowedIp)=>{if(allowedIp.includes("/"))return isIpInCidr(clientIp,allowedIp);return clientIp===allowedIp}))return!0}if(source.allowedServices&&source.allowedServices.length>0){if(source.allowedServices.includes(serviceId))return!0}}return!1};function getDatabaseAuthMode(){return process.env.DATABASE_AUTH_MODE||"password"}function getRedisAuthMode(){return process.env.REDIS_AUTH_MODE||"password"}async function acquireToken(scope,label){let{DefaultAzureCredential,ManagedIdentityCredential,ClientSecretCredential}=await import("@azure/identity"),authMode=scope===PG_TOKEN_SCOPE?getDatabaseAuthMode():getRedisAuthMode(),clientId=process.env.AZURE_CLIENT_ID||"",tenantId=process.env.AZURE_TENANT_ID||"",clientSecret=process.env.AZURE_CLIENT_SECRET||"",credential;if(authMode==="managed_identity")credential=clientId?new ManagedIdentityCredential(clientId):new DefaultAzureCredential;else if(authMode==="service_principal"){if(!tenantId||!clientId||!clientSecret)throw Error("[azure-auth] service_principal auth requires AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET");credential=new ClientSecretCredential(tenantId,clientId,clientSecret)}else throw Error(`[azure-auth] Unsupported auth mode: ${authMode}`);let result=await credential.getToken(scope);if(!result)throw Error(`[azure-auth] Failed to acquire token for ${label}`);return logger.scoped("database.connect").info(`[azure-auth] ${label} token acquired`,{expiresAt:new Date(result.expiresOnTimestamp).toISOString(),authMode}),{token:result.token,expiresAt:result.expiresOnTimestamp}}async function getPostgresToken(){let now=Date.now();if(pgCachedToken&&now<pgTokenExpiresAt-REFRESH_BUFFER_MS)return pgCachedToken;let{token,expiresAt}=await acquireToken(PG_TOKEN_SCOPE,"PostgreSQL");return pgCachedToken=token,pgTokenExpiresAt=expiresAt,pgCachedToken}async function getRedisToken(){let now=Date.now();if(redisCachedToken&&now<redisTokenExpiresAt-REFRESH_BUFFER_MS)return redisCachedToken;let{token,expiresAt}=await acquireToken(REDIS_TOKEN_SCOPE,"Redis");return redisCachedToken=token,redisTokenExpiresAt=expiresAt,redisCachedToken}function getRedisTokenExpiresAt(){return redisTokenExpiresAt}var PG_TOKEN_SCOPE="https://ossrdbms-aad.database.windows.net/.default",REDIS_TOKEN_SCOPE="https://redis.azure.com/.default",REFRESH_BUFFER_MS=300000,pgCachedToken=null,pgTokenExpiresAt=0,redisCachedToken=null,redisTokenExpiresAt=0;var init_AzureTokenProvider=__esm(()=>{init_Logger2()});var exports_Azure={};__export(exports_Azure,{getRedisTokenExpiresAt:()=>getRedisTokenExpiresAt,getRedisToken:()=>getRedisToken,getRedisAuthMode:()=>getRedisAuthMode,getPostgresToken:()=>getPostgresToken,getDatabaseAuthMode:()=>getDatabaseAuthMode});var init_Azure=__esm(()=>{init_AzureTokenProvider()});import{access,mkdir as mkdir4}from"fs/promises";import{dirname as dirname3,resolve}from"path";var DEFAULT_CONFIG4,FILE_SIZE_UNITS,resolvePath=(path)=>{if(!path||typeof path!=="string")throw createFileManagerError("INVALID_PATH","Path must be a non-empty string",path,"resolvePath");return resolve(path)},extractDirectoryPath=(filePath)=>{let resolvedPath=resolvePath(filePath);return dirname3(resolvedPath)},ensureDirectoryExists=async(dirPath)=>{let resolvedPath=resolve(dirPath);try{await mkdir4(resolvedPath,{recursive:!0})}catch(error){if(error.code!=="EEXIST")throw createFileManagerError("DIRECTORY_CREATE_FAILED",`Failed to create directory: ${resolvedPath}`,resolvedPath,"ensureDirectory")}},formatFileSize=(bytes)=>{let size=bytes,unitIndex=0;while(size>=1024&&unitIndex<FILE_SIZE_UNITS.length-1)size/=1024,unitIndex++;return`${size.toFixed(2)} ${FILE_SIZE_UNITS[unitIndex]}`},validateFileExtension=(fileName,expectedExtension)=>{return fileName.toLowerCase().endsWith(expectedExtension.toLowerCase())},ensureFileExtension=(fileName,extension)=>{let normalizedExtension=extension.startsWith(".")?extension:`.${extension}`;if(validateFileExtension(fileName,normalizedExtension))return fileName;return`${fileName}${normalizedExtension}`},createFileManagerError=(code,message,path,operation)=>{return{code,message,path,operation:operation||"unknown"}},safeJsonStringify=(data)=>{try{return JSON.stringify(data,null,2)}catch{return"{}"}},executeBulkOperation=async(items,operation,concurrency=DEFAULT_CONFIG4.maxConcurrency)=>{let results=[];for(let i=0;i<items.length;i+=concurrency){let batch=items.slice(i,i+concurrency),batchPromises=[];for(let item of batch)batchPromises.push(operation(item));let batchResults=await Promise.allSettled(batchPromises);results.push(...batchResults)}return results},validateConfig=(config,options={})=>{let errors=[],warnings=[],strict=options.strict??!0;if(config.defaultEncoding!==void 0){if(!["utf-8","utf8","ascii","base64","hex"].includes(config.defaultEncoding))errors.push(`Invalid defaultEncoding: ${config.defaultEncoding}`)}if(config.maxConcurrency!==void 0){if(!Number.isInteger(config.maxConcurrency)||config.maxConcurrency<1)errors.push("maxConcurrency must be a positive integer");if(config.maxConcurrency>50)warnings.push("maxConcurrency > 50 may cause performance issues")}if(config.defaultCreateDir!==void 0&&typeof config.defaultCreateDir!=="boolean")errors.push("defaultCreateDir must be a boolean");if(config.defaultRecursive!==void 0&&typeof config.defaultRecursive!=="boolean")errors.push("defaultRecursive must be a boolean");if(strict&&!options.allowUnknownKeys){let validKeys=["defaultEncoding","defaultCreateDir","defaultRecursive","maxConcurrency"],configKeys=Object.keys(config);for(let key2 of configKeys)if(!validKeys.includes(key2))errors.push(`Unknown configuration key: ${key2}`)}return{isValid:errors.length===0,errors,warnings}},mergeConfig=(partial,base=DEFAULT_CONFIG4)=>{let validation=validateConfig(partial);if(!validation.isValid)throw createFileManagerError("CONFIG_VALIDATION_FAILED",`Configuration validation failed: ${validation.errors.join(", ")}`,void 0,"mergeConfig");return{...base,...partial}},parsePermissions=(mode)=>{let parseOctal=(octal)=>({read:Boolean(octal&4),write:Boolean(octal&2),execute:Boolean(octal&1)}),ownerMode=mode>>6&7,groupMode=mode>>3&7,othersMode=mode&7;return{owner:parseOctal(ownerMode),group:parseOctal(groupMode),others:parseOctal(othersMode)}},validatePermissionMode=(mode)=>{return Number.isInteger(mode)&&mode>=0&&mode<=511};var init_utils4=__esm(()=>{DEFAULT_CONFIG4={defaultEncoding:"utf-8",defaultCreateDir:!0,defaultRecursive:!0,maxConcurrency:5},FILE_SIZE_UNITS=["B","KB","MB","GB","TB"]});import{copyFile,rename as rename2,unlink as unlink4}from"fs/promises";import{basename,dirname as dirname4,extname,join as join5}from"path";var DEFAULT_ATOMIC_CONFIG,generateTempPath=(originalPath,suffix=".tmp")=>{let resolvedPath=resolvePath(originalPath),timestamp=Date.now(),random=Math.random().toString(36).substring(2,8);return`${resolvedPath}${suffix}.${timestamp}.${random}`},generateBackupPath=(originalPath,backupDir,useTimestamp=!0)=>{let resolvedPath=resolvePath(originalPath),dir=backupDir?resolvePath(backupDir):dirname4(resolvedPath),name=basename(resolvedPath),ext=extname(name),nameWithoutExt=basename(name,ext),timestamp=useTimestamp?`.${new Date().toISOString().replace(/[:.]/g,"-")}`:"",backupName=`${nameWithoutExt}.backup${timestamp}${ext}`;return join5(dir,backupName)},atomicWrite=async({path,data,tempSuffix=DEFAULT_ATOMIC_CONFIG.tempSuffix,backup=DEFAULT_ATOMIC_CONFIG.backup,sync=DEFAULT_ATOMIC_CONFIG.sync})=>{let resolvedPath=resolvePath(path),tempPath=generateTempPath(resolvedPath,tempSuffix),backupPath;try{if(await ensureDirectoryExists(extractDirectoryPath(resolvedPath)),backup){if(await Bun.file(resolvedPath).exists())backupPath=generateBackupPath(resolvedPath),await copyFile(resolvedPath,backupPath)}let bytesWritten=await Bun.write(tempPath,data);return await rename2(tempPath,resolvedPath),{success:!0,bytesWritten,tempPath,backupPath}}catch(error){try{await unlink4(tempPath)}catch{}throw createFileManagerError("ATOMIC_WRITE_FAILED",`Atomic write failed: ${error}`,resolvedPath,"atomicWrite")}},atomicJsonWrite=async(path,data,options={})=>{let jsonString=JSON.stringify(data,null,2);return atomicWrite({path,data:jsonString,...options})},createBackup=async({sourcePath,backupDir,keepOriginal=!0,timestamp=DEFAULT_ATOMIC_CONFIG.timestamp})=>{let resolvedSource=resolvePath(sourcePath);if(!await Bun.file(resolvedSource).exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"createBackup");let backupPath=generateBackupPath(resolvedSource,backupDir,timestamp);if(await ensureDirectoryExists(dirname4(backupPath)),keepOriginal)await copyFile(resolvedSource,backupPath);else await rename2(resolvedSource,backupPath);return backupPath},restoreFromBackup=async(backupPath,targetPath,deleteBackup=!1)=>{let resolvedBackup=resolvePath(backupPath),resolvedTarget=resolvePath(targetPath);if(!await Bun.file(resolvedBackup).exists())throw createFileManagerError("BACKUP_NOT_FOUND",`Backup file not found: ${backupPath}`,resolvedBackup,"restoreFromBackup");try{if(await ensureDirectoryExists(extractDirectoryPath(resolvedTarget)),deleteBackup)await rename2(resolvedBackup,resolvedTarget);else await copyFile(resolvedBackup,resolvedTarget);return!0}catch(error){return logger.scoped("storage.fs").error(`Failed to restore from backup ${backupPath}`,error,{backupPath}),!1}},safeUpdate=async(path,updateFunction,options={})=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),backupPath;try{if(await file.exists())backupPath=await createBackup({sourcePath:resolvedPath,keepOriginal:!0,timestamp:!0});let currentData=await file.exists()?await file.text():"",newData=await updateFunction(currentData),result=await atomicWrite({path:resolvedPath,data:newData,backup:!1,...options});return{success:result.success,bytesWritten:result.bytesWritten,tempPath:result.tempPath,backupPath}}catch(error){if(backupPath)try{await restoreFromBackup(backupPath,resolvedPath,!1)}catch(rollbackError){logger.scoped("storage.fs").error("Atomic write rollback failed",rollbackError,{backupPath})}throw error}},batchAtomicWrite=async(operations)=>{let successful=[],failed=[];for(let operation of operations)try{let result=await atomicWrite(operation);successful.push(result)}catch(error){failed.push({operation,error})}return{successful,failed}};var init_atomic=__esm(()=>{init_Logger2();init_utils4();DEFAULT_ATOMIC_CONFIG={tempSuffix:".tmp",backup:!1,sync:!0,timestamp:!0}});import{chmod,stat as stat3}from"fs/promises";var PERMISSION_MODES,setFilePermissions=async(path,mode)=>{let resolvedPath=resolvePath(path);if(!validatePermissionMode(mode))throw createFileManagerError("INVALID_PERMISSION_MODE",`Invalid permission mode: ${mode.toString(8)}`,resolvedPath,"setFilePermissions");try{return await chmod(resolvedPath,mode),!0}catch(error){return logger.scoped("storage.fs").error(`Failed to set permissions for ${path}`,error,{path,mode}),!1}},getFilePermissions=async(path)=>{let resolvedPath=resolvePath(path);try{let mode=(await stat3(resolvedPath)).mode&511,permissions=parsePermissions(mode);return{path:resolvedPath,mode,owner:permissions.owner,group:permissions.group,others:permissions.others}}catch(error){throw createFileManagerError("PERMISSION_READ_FAILED",`Failed to read permissions: ${error}`,resolvedPath,"getFilePermissions")}},hasPermissions=async(path,requiredMode)=>{try{return((await getFilePermissions(path)).mode&requiredMode)===requiredMode}catch{return!1}},makeReadable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|256;return setFilePermissions(path,newMode)},makeWritable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|128;return setFilePermissions(path,newMode)},makeExecutable=async(path)=>{let newMode=(await getFilePermissions(path)).mode|64;return setFilePermissions(path,newMode)},makeReadOnly=async(path)=>{let newMode=(await getFilePermissions(path)).mode&-147;return setFilePermissions(path,newMode)},setCommonPermissions=async(path,pattern)=>{let mode=PERMISSION_MODES[pattern];return setFilePermissions(path,mode)};var init_permissions=__esm(()=>{init_Logger2();init_utils4();PERMISSION_MODES={OWNER_READ_WRITE:384,OWNER_ALL:448,GROUP_READ:416,GROUP_READ_WRITE:432,ALL_READ:420,ALL_READ_WRITE:438,ALL_READ_EXECUTE:493,ALL_FULL:511,READ_ONLY:292,EXECUTABLE:493}});var DEFAULT_STREAM_CONFIG,createFileWriter=async(path,options={})=>{let resolvedPath=resolvePath(path),config={...DEFAULT_STREAM_CONFIG,...options};await ensureDirectoryExists(extractDirectoryPath(resolvedPath));let writer=Bun.file(resolvedPath).writer({highWaterMark:config.highWaterMark}),isClosed=!1;return{write:(chunk)=>{if(isClosed)throw createFileManagerError("WRITER_CLOSED","Cannot write to closed writer",resolvedPath,"streamWrite");try{let result=writer.write(chunk);if(config.autoFlush)writer.flush();return result}catch(error){throw createFileManagerError("WRITE_FAILED",`Failed to write chunk: ${error}`,resolvedPath,"streamWrite")}},flush:()=>{if(isClosed)return 0;try{return writer.flush()}catch(error){throw createFileManagerError("FLUSH_FAILED",`Failed to flush writer: ${error}`,resolvedPath,"streamFlush")}},end:async(error)=>{if(isClosed)return 0;try{let result=await writer.end(error);return isClosed=!0,result}catch(err){throw isClosed=!0,createFileManagerError("END_FAILED",`Failed to end writer: ${err}`,resolvedPath,"streamEnd")}},ref:()=>{if(!isClosed)writer.ref()},unref:()=>{if(!isClosed)writer.unref()}}},writeStream=async(path,chunks,options={})=>{let writer=await createFileWriter(path,options),totalBytes=0;try{for(let chunk of chunks){let bytesWritten=writer.write(chunk);totalBytes+=bytesWritten}return await writer.flush(),await writer.end(),totalBytes}catch(error){try{await writer.end(error)}catch{}throw error}},appendStream=async(path,chunks,options={})=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),existingContent=await file.exists()?await file.arrayBuffer():new ArrayBuffer(0),allChunks=[];if(existingContent.byteLength>0)allChunks.push(existingContent);return allChunks.push(...chunks),writeStream(resolvedPath,allChunks,options)},copyFileStream=async(sourcePath,destinationPath,options={})=>{let resolvedSource=resolvePath(sourcePath),sourceFile=Bun.file(resolvedSource);if(!await sourceFile.exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"copyFileStream");let sourceStream=sourceFile.stream(),writer=await createFileWriter(destinationPath,options),totalBytes=0;try{let reader=sourceStream.getReader();while(!0){let{done,value}=await reader.read();if(done)break;let bytesWritten=writer.write(value);totalBytes+=bytesWritten}return await writer.flush(),await writer.end(),totalBytes}catch(error){try{await writer.end(error)}catch{}throw error}},readFileStream=async(path,chunkProcessor)=>{let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath);if(!await file.exists())throw createFileManagerError("FILE_NOT_FOUND",`File not found: ${path}`,resolvedPath,"readFileStream");let reader=file.stream().getReader();try{while(!0){let{done,value}=await reader.read();if(done)break;await chunkProcessor(value)}}finally{reader.releaseLock()}};var init_streaming=__esm(()=>{init_utils4();DEFAULT_STREAM_CONFIG={highWaterMark:1048576,autoFlush:!0,closeOnEnd:!0}});import{readdir as readdir2,rm,rmdir,stat as stat4}from"fs/promises";import{extname as extname2,join as join6}from"path";class BunFileManager{static instance;config;constructor(){this.config={...DEFAULT_CONFIG4}}static getInstance(){if(!BunFileManager.instance)BunFileManager.instance=new BunFileManager;return BunFileManager.instance}async createFile({dir,name,data,options={}}){let filePath=resolvePath(join6(dir,name));if(options.createDir!==!1)await ensureDirectoryExists(extractDirectoryPath(filePath));let fileData=data instanceof Blob?data:options.type?new Blob([data],{type:options.type}):data;return await Bun.write(filePath,fileData)}async createJsonFile(dir,name,data){let fileName=ensureFileExtension(name,".json"),jsonString=safeJsonStringify(data);return this.createFile({dir,name:fileName,data:jsonString,options:{type:"application/json"}})}async createDirectory({path}){await ensureDirectoryExists(path)}async readFile({path,format="text"}){let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath);if(!await file.exists())throw createFileManagerError("FILE_NOT_FOUND",`File not found: ${path}`,resolvedPath,"readFile");switch(format){case"text":return await file.text();case"json":return await file.json();case"buffer":return await file.arrayBuffer();case"bytes":return await file.bytes();case"stream":return file.stream();default:return await file.text()}}async readJsonFile(path){return this.readFile({path,format:"json"})}async getFileInfo(path){let resolvedPath=resolvePath(path),file=Bun.file(resolvedPath),fileName=path.split("/").pop()||path,stats=null;try{stats=await stat4(resolvedPath)}catch{}return{name:fileName,path:resolvedPath,size:file.size,type:file.type,exists:await file.exists(),extension:extname2(fileName),createdAt:stats?.birthtime,modifiedAt:stats?.mtime}}async readDirectory({path,recursive=!1}){let resolvedPath=resolvePath(path);return await readdir2(resolvedPath,{recursive,encoding:"utf8"})}async getFilesByExtension(dir,extension){let files=await this.readDirectory({path:dir}),normalizedExt=extension.startsWith(".")?extension:`.${extension}`;return files.filter((file)=>file.endsWith(normalizedExt))}async updateFile({path,data,mode="overwrite"}){let resolvedPath=resolvePath(path);if(mode==="append"){let combinedData=await this.readFile({path,format:"text"})+data;return await Bun.write(resolvedPath,combinedData)}return await Bun.write(resolvedPath,data)}async updateJsonFile(path,data,merge=!1){let finalData=data;if(merge)try{let existingData=await this.readJsonFile(path);if(typeof existingData==="object"&&existingData!==null&&!Array.isArray(existingData)&&typeof data==="object"&&data!==null&&!Array.isArray(data))finalData={...existingData,...data}}catch{}return this.updateFile({path,data:safeJsonStringify(finalData),mode:"overwrite"})}async appendToFile(path,data){return this.updateFile({path,data,mode:"append"})}async deleteFile(path){try{let resolvedPath=resolvePath(path);return await Bun.file(resolvedPath).delete(),!0}catch(error){return logger.scoped("storage.fs").error(`Failed to delete file ${path}`,error,{path}),!1}}async deleteDirectory({path,recursive=!1}){try{let resolvedPath=resolvePath(path);if(recursive)await rm(resolvedPath,{recursive:!0,force:!0});else await rmdir(resolvedPath);return!0}catch(error){return logger.scoped("storage.fs").error(`Failed to delete directory ${path}`,error,{path}),!1}}async deleteFiles(paths){let results=await executeBulkOperation(paths,async(path)=>{if(!await this.deleteFile(path))throw Error(`Failed to delete: ${path}`);return path}),success=[],failed=[];for(let i=0;i<results.length;i++){let result=results[i],originalPath=paths[i];if(result?.status==="fulfilled")success.push(originalPath||"");else failed.push(originalPath||"")}return{success,failed}}async exists(path){let resolvedPath=resolvePath(path);return await Bun.file(resolvedPath).exists()}async copyFile(sourcePath,destinationPath){let resolvedSource=resolvePath(sourcePath),resolvedDestination=resolvePath(destinationPath),sourceFile=Bun.file(resolvedSource);if(!await sourceFile.exists())throw createFileManagerError("SOURCE_NOT_FOUND",`Source file not found: ${sourcePath}`,resolvedSource,"copyFile");return await ensureDirectoryExists(extractDirectoryPath(resolvedDestination)),await Bun.write(resolvedDestination,sourceFile)}async moveFile(sourcePath,destinationPath){try{return await this.copyFile(sourcePath,destinationPath),await this.deleteFile(sourcePath),!0}catch(error){return logger.scoped("storage.fs").error("Failed to move file",error,{sourcePath,destinationPath}),!1}}getFormattedFileSize(bytes){return formatFileSize(bytes)}getConfig(){return{...this.config}}updateConfig(newConfig){let validation=validateConfig(newConfig);if(validation.isValid){let mergedConfig=mergeConfig(newConfig,this.config);Object.assign(this.config,mergedConfig)}return validation}validateConfiguration(config){return validateConfig(config)}async createStreamWriter(path,options={}){return createFileWriter(path,options)}async writeStream(path,chunks,options={}){return writeStream(path,chunks,options)}async appendStream(path,chunks,options={}){return appendStream(path,chunks,options)}async copyFileStream(sourcePath,destinationPath,options={}){return copyFileStream(sourcePath,destinationPath,options)}async readFileStream(path,chunkProcessor){return readFileStream(path,chunkProcessor)}async setPermissions(path,mode){return setFilePermissions(path,mode)}async setPermissionsAdvanced(options){return setFilePermissions(options.path,options.mode)}async getPermissions(path){return getFilePermissions(path)}async checkPermissions(path,requiredMode){return hasPermissions(path,requiredMode)}async makeFileReadable(path){return makeReadable(path)}async makeFileWritable(path){return makeWritable(path)}async makeFileExecutable(path){return makeExecutable(path)}async makeFileReadOnly(path){return makeReadOnly(path)}async setCommonPermission(path,pattern){return setCommonPermissions(path,pattern)}async atomicWrite(options){return atomicWrite(options)}async atomicJsonWrite(path,data,options={}){return atomicJsonWrite(path,data,options)}async createFileBackup(options){return createBackup(options)}async restoreFileFromBackup(backupPath,targetPath,deleteBackup=!1){return restoreFromBackup(backupPath,targetPath,deleteBackup)}async safeFileUpdate(path,updateFunction,options={}){return safeUpdate(path,updateFunction,options)}async batchAtomicOperations(operations){return batchAtomicWrite(operations)}}var init_core=__esm(()=>{init_Logger2();init_atomic();init_permissions();init_streaming();init_utils4()});var fileManager;var init_File=__esm(()=>{init_core();init_utils4();init_core();fileManager=BunFileManager.getInstance()});import{Pool}from"pg";var init_Postgre=__esm(()=>{init_Logger2()});var init_Managers=__esm(()=>{init_Azure();init_Dapr();init_File();init_Postgre();init_Redis()});function lifetimeSeconds(value,fallbackSeconds){if(value===null)return null;if(value===void 0)return fallbackSeconds;if(typeof value==="number"){if(!Number.isFinite(value))return null;return value<=0?null:Math.floor(value)}let raw=value.trim().toLowerCase();if(raw==="")return fallbackSeconds;if(NEVER.has(raw))return null;let match=raw.match(/^(\d+(?:\.\d+)?)\s*([smhdwy])$/);if(!match?.[1]||!match[2])return fallbackSeconds;let amount=Number.parseFloat(match[1]),seconds=Math.floor(amount*({s:1,m:60,h:3600,d:86400,w:604800,y:31536000}[match[2]]??1));return seconds<=0?null:seconds}function cookieMaxAge(seconds){return seconds===null?NEVER_COOKIE_MAX_AGE:seconds}function longerLifetime(a,b,fallbackSeconds){let given=[a,b].filter((v)=>v!==void 0&&v!=="");if(given.length===0)return fallbackSeconds;let resolved=given.map((v)=>lifetimeSeconds(v,fallbackSeconds));if(resolved.some((v)=>v===null))return null;return Math.max(...resolved)}function isIdleExpired(params){if(!params.lastActiveAt)return!1;if(!params.inactivityTimeout)return!1;let seconds=lifetimeSeconds(params.inactivityTimeout,DEFAULT_INACTIVITY_SECONDS);if(seconds===null)return!1;let lastActive=new Date(params.lastActiveAt).getTime();if(!Number.isFinite(lastActive))return!1;return(params.now??Date.now())-lastActive>seconds*1000}var NEVER,NEVER_COOKIE_MAX_AGE=315360000,DEFAULT_INACTIVITY_SECONDS=2592000;var init_lifetime=__esm(()=>{NEVER=new Set(["never","none","unlimited","infinite","0","sonsuz","s\xFCresiz"])});var exports_utils={};__export(exports_utils,{warnIfAccessTokenTooLargeForCookie:()=>warnIfAccessTokenTooLargeForCookie,validatePayload:()=>validatePayload,validateEnvVariables:()=>validateEnvVariables,toAudit:()=>toAudit,signNewAccessToken:()=>signNewAccessToken,sanitizePayload:()=>sanitizePayload,resolveDbPoolConfig:()=>resolveDbPoolConfig,resolveConfigCredential:()=>resolveConfigCredential,refreshAccessTokenWithLock:()=>refreshAccessTokenWithLock,redactSensitiveOutput:()=>redactSensitiveOutput,parseTokenValuesFromHeaders:()=>parseTokenValuesFromHeaders,parseTimeToSeconds:()=>parseTimeToSeconds2,parseQueryParams:()=>parseQueryParams,isSensitiveOutputKey:()=>isSensitiveOutputKey,initiateRedisManager:()=>initiateRedisManager,getRedisManager:()=>getRedisManager,ensureDatabaseExists:()=>ensureDatabaseExists,decodeUnverifiedSubject:()=>decodeUnverifiedSubject,createAuditLog:()=>createAuditLog,buildPaginationMeta:()=>buildPaginationMeta,COOKIE_SAFE_TOKEN_BYTES:()=>COOKIE_SAFE_TOKEN_BYTES});function parseTokenValuesFromHeaders(headers,tokenNames){let cookies=(headers.get("cookie")?.split(";")||[]).reduce((acc,cookie)=>{let trimmed=cookie.trim(),eqIndex=trimmed.indexOf("=");if(eqIndex>0)acc[trimmed.slice(0,eqIndex)]=trimmed.slice(eqIndex+1);return acc},{});return{access_token:cookies[tokenNames.access_token]||headers.get("authorization")?.split(" ")[1],refresh_token:cookies[tokenNames.refresh_token],session_token:cookies[tokenNames.session_token]}}async function initiateRedisManager(config){if(!config.redis){logger.info("[Redis] Not configured, skipping");return}let rawWithDapr=config.redis.withDapr,resolvedWithDapr=typeof rawWithDapr==="string"?process.env[rawWithDapr]?.toLowerCase()!=="false":rawWithDapr??!1,resolvedKeyPrefix=config.redis.keyPrefix?process.env[config.redis.keyPrefix]??config.redis.keyPrefix:void 0;if(resolvedWithDapr){redisManagerInstance=new RedisManager({withDapr:!0,stateStoreName:config.redis.stateStoreName,...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}});return}let resolvedUrl=config.redis.url?process.env[config.redis.url]:void 0,resolvedHost=config.redis.host?process.env[config.redis.host]:void 0,resolvedPort=config.redis.port?parseInt(process.env[config.redis.port]||"",10):void 0;if((process.env.REDIS_AUTH_MODE||"password")!=="password"){let{getRedisToken:getRedisToken2,getRedisTokenExpiresAt:getRedisTokenExpiresAt2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure)),clientId=process.env.AZURE_CLIENT_ID||"",initialToken=await getRedisToken2();redisManagerInstance=new RedisManager({host:resolvedHost,port:Number.isNaN(resolvedPort)?void 0:resolvedPort,password:initialToken,username:clientId,tls:!0,...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}});let unref=(t)=>{t.unref?.()},scheduleRedisTokenRefresh=()=>{let expiresAt=getRedisTokenExpiresAt2(),refreshIn=Math.max(expiresAt-Date.now()-300000,30000);unref(setTimeout(async()=>{try{let newToken=await getRedisToken2();if(redisManagerInstance)await redisManagerInstance.reauthenticate(clientId,newToken),logger.info("[Redis] Entra ID token refreshed successfully");scheduleRedisTokenRefresh()}catch(err){logger.error("[Redis] Token refresh failed \u2014 retrying in 30s",err),unref(setTimeout(scheduleRedisTokenRefresh,30000))}},refreshIn))};scheduleRedisTokenRefresh()}else{let resolvedPassword=process.env.REDIS_PASSWORD||void 0;redisManagerInstance=new RedisManager({url:resolvedUrl,host:resolvedHost,port:Number.isNaN(resolvedPort)?void 0:resolvedPort,...resolvedPassword?{password:resolvedPassword}:{},...resolvedKeyPrefix?{keyPrefix:resolvedKeyPrefix}:{}})}}function getRedisManager(){return redisManagerInstance}function parseTimeToSeconds2(timeString){if(typeof timeString==="number")return timeString;if(NEVER_WORDS.has(timeString.trim().toLowerCase()))return NEVER_COOKIE_MAX_AGE;if(!timeString||timeString.trim()==="")throw Error("Time string cannot be empty");let match=timeString.trim().match(/^(\d+(?:\.\d+)?)\s*([smhdwMy])$/);if(!match||!match[1]||!match[2])throw Error(`Invalid time format: "${timeString}". Expected format: "75s", "10m", "2h", "1d", "1w", "2M", "1y"`);let value=parseFloat(match[1]),unit=match[2],multiplier={s:1,m:60,h:3600,d:86400,w:604800,M:2592000,y:31536000}[unit];if(multiplier===void 0)throw Error(`Unknown time unit: "${unit}"`);let seconds=Math.floor(value*multiplier);if(seconds<=0)throw Error(`Time value must be positive: "${timeString}"`);return seconds}function warnIfAccessTokenTooLargeForCookie(token,jwtClaimsMode){let bytes=Buffer.byteLength(token,"utf-8");if(bytes<=COOKIE_SAFE_TOKEN_BYTES)return;let now=Date.now();if(now-lastOversizeWarnAt<60000)return;lastOversizeWarnAt=now,logger.warn(`[Auth] access_token is ${bytes} bytes \u2014 at/over the ~4KB per-cookie browser limit, so the cookie may be `+"silently dropped (symptom: appears logged-in but requests are unauthenticated). Shrink it: set authorization.jwtClaimsMode:'resolve' (token carries only roles; claims resolved from the Redis claims cache), or deliver the token off-cookie via authentication.accessToken.setHeadersEnabled:false. "+(jwtClaimsMode?`Current jwtClaimsMode='${jwtClaimsMode}'.`:""))}function signNewAccessToken({sessionData,options,refreshTokenId,roles,claims,tenant,claimScopes,resolveMode}){let secretEnvName=options.authentication?.accessToken?.secret;if(!secretEnvName)throw Error("Access token secret env name is not configured");let secret=process.env[secretEnvName];if(!secret)throw Error(`Access token secret env "${secretEnvName}" is not set`);let token=signJWT({subject:sessionData.userId,issuer:options.authentication?.accessToken?.issuer,audience:options.authentication?.accessToken?.audience,algorithm:options.authentication?.accessToken?.algorithm,expiresInSeconds:parseTimeToSeconds2(options.authentication?.accessToken?.expiresIn??"15m"),sessionId:sessionData.id,customClaims:{refreshTokenId,...roles&&roles.length>0?{roles}:{},...!resolveMode&&claims&&claims.length>0?{claims}:{},...!resolveMode&&claimScopes&&Object.keys(claimScopes).length>0?{claimScopes}:{},...tenant?{tenant}:{}}},secret);return warnIfAccessTokenTooLargeForCookie(token,resolveMode?"resolve":options.authorization?.jwtClaimsMode),token}function resolveDbPoolConfig(pool){return{max:pool?.max!=null&&pool.max>0?pool.max:10,idleTimeoutMillis:pool?.idleTimeoutMillis??30000,connectionTimeoutMillis:pool?.connectionTimeoutMillis??1e4,...pool?.maxUses!=null&&pool.maxUses>0?{maxUses:pool.maxUses}:{},options:"-c timezone=UTC"}}function toAudit(payload,summary,opts){return payload?{entityName:payload.entity_name,entityId:payload.entity_id===" - "?null:payload.entity_id,operation:payload.operation_type,userId:opts&&"userId"in opts?opts.userId??null:payload.user_id==="unknown"?null:payload.user_id,summary,severity:opts?.severity,category:opts?.category,ipAddress:payload.ip_address,userAgent:payload.user_agent,path:payload.path,query:payload.query}:void 0}function decodeUnverifiedSubject(token){if(!token)return null;try{let parts=token.split(".");if(parts.length<2)return null;let payloadPart=parts[1];if(!payloadPart)return null;let json=Buffer.from(payloadPart,"base64url").toString("utf-8"),decoded=JSON.parse(json);return typeof decoded.sub==="string"&&decoded.sub?decoded.sub:null}catch{return null}}function reconstructBracketParams(query){let result={},arrayGroups={};for(let[key2,value]of Object.entries(query)){let match=key2.match(/^(\w+)\[\d*\]\[(\w+)\]$/),arrayName=match?.[1],prop=match?.[2];if(arrayName&&prop){if(!arrayGroups[arrayName])arrayGroups[arrayName]={};let group=arrayGroups[arrayName];if(!group[prop])group[prop]=[];let arr=group[prop];if(Array.isArray(value))for(let v of value)arr.push(v);else arr.push(value)}else result[key2]=value}for(let[arrayName,props]of Object.entries(arrayGroups)){let propNames=Object.keys(props);if(propNames.length===0)continue;let maxLen=Math.max(...propNames.map((p)=>(props[p]||[]).length)),items=[];for(let i=0;i<maxLen;i++){let item={};for(let p of propNames)item[p]=(props[p]||[])[i];items.push(item)}result[arrayName]=items}return result}function parseQueryParams(query){let q=reconstructBracketParams(query),malformed=[],parseJSONArrayParam=(name,value)=>{if(value===void 0||value===null)return;let parsed=value;if(typeof value==="string"){if(value.trim()==="")return;try{parsed=JSON.parse(value)}catch{malformed.push(name);return}}if(!Array.isArray(parsed)){malformed.push(name);return}if(parsed.some((entry)=>typeof entry!=="object"||entry===null||Array.isArray(entry))){malformed.push(name);return}return parsed},DEFAULT_PAGE_SIZE=20,MAX_PAGE_SIZE=200,rawPage=q.page?parseInt(q.page,10):1,page=Number.isFinite(rawPage)&&rawPage>0?rawPage:1,rawLimit=q.limit?parseInt(q.limit,10):20,limit=Number.isFinite(rawLimit)&&rawLimit>0?Math.min(rawLimit,200):20,rawOffset=q.offset?parseInt(q.offset,10):(page-1)*limit,offset=Number.isFinite(rawOffset)&&rawOffset>=0?rawOffset:0;return{page,limit,offset,search:q.search,searchFields:q.searchFields?q.searchFields.split(","):void 0,filters:parseJSONArrayParam("filters",q.filters),sort:parseJSONArrayParam("sort",q.sort),select:q.select?q.select.split(","):void 0,groupBy:q.groupBy,with:parseJSONArrayParam("with",q.with),distinct:q.distinct==="true",distinctOn:q.distinctOn?q.distinctOn.split(","):void 0,malformed:malformed.length>0?malformed:void 0}}function buildPaginationMeta(page,limit,offset,totalItems){let totalPages=Math.ceil(totalItems/limit),hasNextPage=page<totalPages,hasPrevPage=page>1;return{page,limit,offset,totalItems,totalPages,hasNextPage,hasPrevPage,nextPage:hasNextPage?page+1:null,prevPage:hasPrevPage?page-1:null}}function getBaseTypeValidator(type){let stringTypes=["varchar","char","text","uuid","citext","bit","varbit"],numberTypes=["integer","smallint","bigint","serial","smallserial","bigserial","real","doublePrecision","numeric","decimal"],booleanTypes=["boolean"];if(stringTypes.includes(type))return(v)=>({valid:typeof v==="string",expectedType:"string"});if(numberTypes.includes(type)){if(type==="numeric"||type==="decimal")return(v)=>({valid:typeof v==="number"||typeof v==="string"&&v.trim()!==""&&Number.isFinite(Number(v)),expectedType:"number"});return(v)=>({valid:typeof v==="number",expectedType:"number"})}if(booleanTypes.includes(type))return(v)=>({valid:typeof v==="boolean",expectedType:"boolean"});if(type==="json"||type==="jsonb")return(v)=>({valid:typeof v==="object",expectedType:"object"});return()=>({valid:!0,expectedType:"any"})}function validatePayload(payload,columns,isPartial=!1){let errors=[];for(let col7 of columns){let value=payload[col7.name]??payload[col7.name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())],hasDbDefault=col7.default!==void 0||!!col7.defaultRaw||!!col7.generatedByDefaultAsIdentity||!!col7.generatedAlwaysAsIdentity||!!col7.generatedAlwaysAs,isRequired=col7.notNull&&!col7.nullable&&!hasDbDefault;if(value===void 0||value===null){if(isRequired&&!isPartial)errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} is required`});continue}if(col7.array){let baseValidator=getBaseTypeValidator(col7.type),expectedType=baseValidator(void 0).expectedType;if(!Array.isArray(value)){errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be an array of ${expectedType}`});continue}if(value.some((el)=>el!==null&&!baseValidator(el).valid))errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be an array of ${expectedType}`});continue}let typeCheck=getBaseTypeValidator(col7.type)(value);if(!typeCheck.valid){errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be of type ${typeCheck.expectedType}`});continue}if(typeof value==="string"){let len=value.length;if(col7.length&&len>col7.length)errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} exceeds max length of ${col7.length}`});if(col7.validation?.minLength&&len<col7.validation.minLength)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at least ${col7.validation.minLength} characters`});if(col7.validation?.maxLength&&len>col7.validation.maxLength)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at most ${col7.validation.maxLength} characters`});if(col7.validation?.pattern){if(!new RegExp(col7.validation.pattern).test(value))errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} does not match required pattern`})}if(col7.validation?.format){let formatRegex=FORMAT_PATTERNS[col7.validation.format];if(formatRegex&&!formatRegex.test(value))errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be a valid ${col7.validation.format}`})}}if(typeof value==="number"){if(col7.validation?.min!==void 0&&value<col7.validation.min)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at least ${col7.validation.min}`});if(col7.validation?.max!==void 0&&value>col7.validation.max)errors.push({field:col7.name,message:col7.validation.customMessage||`${col7.name} must be at most ${col7.validation.max}`})}if(col7.enumValues&&col7.enumValues.length>0){if(!col7.enumValues.includes(value))errors.push({field:col7.name,message:col7.validation?.customMessage||`${col7.name} must be one of: ${col7.enumValues.join(", ")}`})}}return{valid:errors.length===0,errors}}function escapeHtml(str3){return str3.replace(/[&<>"'`=/]/g,(char)=>HTML_ENTITIES[char]||char)}function stripTags(str3){return str3.replace(/<[^>]*>/g,"")}function normalizeEmail(email){let parts=email.split("@"),localPart=parts[0],domain=parts[1];if(!localPart||!domain)return email;let beforePlus=localPart.split("+")[0];if(!beforePlus)return email;return`${beforePlus.replace(/\./g,"")}@${domain.toLowerCase()}`}function slugify(str3){return str3.toLowerCase().trim().replace(/[^\w\s-]/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function applySanitizer(value,sanitizer){if(value===null||value===void 0)return value;switch(sanitizer){case"trim":return typeof value==="string"?value.trim():value;case"lowercase":return typeof value==="string"?value.toLowerCase():value;case"uppercase":return typeof value==="string"?value.toUpperCase():value;case"escapeHtml":return typeof value==="string"?escapeHtml(value):value;case"stripTags":return typeof value==="string"?stripTags(value):value;case"normalizeEmail":return typeof value==="string"?normalizeEmail(value):value;case"toNumber":if(typeof value==="number")return value;if(typeof value==="string"){let num2=Number(value);return Number.isNaN(num2)?value:num2}return value;case"toBoolean":if(typeof value==="boolean")return value;if(typeof value==="string"){let lower=value.toLowerCase();if(lower==="true"||lower==="1"||lower==="yes")return!0;if(lower==="false"||lower==="0"||lower==="no")return!1}if(typeof value==="number")return value!==0;return value;case"slugify":return typeof value==="string"?slugify(value):value;default:return value}}function isSensitiveOutputKey(key2){return SENSITIVE_OUTPUT_KEYS.has(key2)}function redactSensitiveOutput(row){return scrubSensitive(row)}function scrubSensitive(value){if(value===null||typeof value!=="object")return value;if(Array.isArray(value))return value.map(scrubSensitive);let proto=Object.getPrototypeOf(value);if(proto!==Object.prototype&&proto!==null)return value;let out={};for(let[k,v]of Object.entries(value)){if(SENSITIVE_OUTPUT_KEYS.has(k))continue;out[k]=scrubSensitive(v)}return out}function sanitizePayload(payload,columns,opts){let sanitized={},toCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SERVER_MANAGED=new Set(["id","created_at","updated_at","created_by","updated_by","createdAt","updatedAt","createdBy","updatedBy"]),PROTECTED_SENSITIVE=new Set(["is_god","password","password_hash","email_verified","verified_at","email_verified_at","is_locked","locked_until","failed_login_attempts","login_count","last_login_at","email_verification_token","email_verification_sent_at","email_verification_expires_at","password_reset_token","password_reset_expires_at","password_reset_sent_at","magic_link_token","two_factor_secret"]),STORAGE_MANAGED=opts?.isFormData?new Set(["path","name","original_name","originalName","extension","size","mime_type","mimeType","uploaded_by","uploadedBy"]):null;for(let key2 of Object.keys(payload)){if(SERVER_MANAGED.has(key2))continue;if(STORAGE_MANAGED?.has(key2))continue;let value=payload[key2],snakeKey=key2.replace(/[A-Z]/g,(l)=>`_${l.toLowerCase()}`);if(PROTECTED_SENSITIVE.has(snakeKey))continue;let col7=columns.find((c)=>c.name===key2||c.name===snakeKey);if(col7?.readOnly)continue;if(col7?.sanitize&&col7.sanitize.length>0)for(let sanitizer of col7.sanitize)value=applySanitizer(value,sanitizer);if(col7&&(col7.type==="timestamp"||col7.type==="timestamptz"||col7.type==="date")&&typeof value==="string"){let parsed=new Date(value);if(!Number.isNaN(parsed.getTime()))value=parsed}let normalizedKey=key2.includes("_")?toCamel2(key2):key2;sanitized[normalizedKey]=value}return sanitized}function createAuditLog(db,auditTable,entry){if(!db||!auditTable)return;let logEntry={user_id:entry.user_id,entity_name:entry.entity_name,entity_id:entry.entity_id,operation:entry.operation,old_data:entry.old_data??null,new_data:entry.new_data??null,timestamp:new Date().toISOString()};db.insert(auditTable).values(logEntry).execute().catch((err)=>{logger.error("[Audit] Database audit write failed",err,{entity:logEntry.entity_name,operation:logEntry.operation})})}async function refreshAccessTokenWithLock(userId,sessionId,generateToken){let redis=new RedisManager,lockKey=`${REFRESH_LOCK_PREFIX}${userId}`,cacheKey=`${ACCESS_TOKEN_CACHE_PREFIX}${userId}:${sessionId}`,cachedResult=await redis.read(cacheKey);if(cachedResult.success&&cachedResult.data)return{success:!0,accessToken:cachedResult.data,fromCache:!0};let lockResult=await redis.acquireLock(lockKey,LOCK_TTL_SECONDS);if(!lockResult.success)return{success:!1,error:lockResult.error};if(lockResult.data)try{let newToken=generateToken();return await redis.create(cacheKey,newToken,ACCESS_TOKEN_CACHE_TTL_SECONDS),{success:!0,accessToken:newToken,fromCache:!1}}finally{await redis.releaseLock(lockKey)}let waitResult=await redis.waitForLock(lockKey,LOCK_WAIT_TIMEOUT_MS,50);if(!waitResult.success)return{success:!1,error:waitResult.error};if(!waitResult.data)return{success:!1,error:"Lock wait timeout"};let newCachedResult=await redis.read(cacheKey);if(newCachedResult.success&&newCachedResult.data)return{success:!0,accessToken:newCachedResult.data,fromCache:!0};let fallbackToken=generateToken();return await redis.create(cacheKey,fallbackToken,ACCESS_TOKEN_CACHE_TTL_SECONDS),{success:!0,accessToken:fallbackToken,fromCache:!1}}function resolveConfigCredential(value){if(!value)return;let fromEnv=process.env[value];if(fromEnv)return fromEnv;if(/^[A-Z][A-Z0-9_]{2,}$/.test(value))return;return value}function validateEnvVariables(config){let errors=[],resolved={},databaseAuthMode=process.env.DATABASE_AUTH_MODE||"password",redisAuthMode=process.env.REDIS_AUTH_MODE||"password";resolved.databaseAuthMode=databaseAuthMode,resolved.redisAuthMode=redisAuthMode;let entraIdModes=["managed_identity","service_principal"];if(entraIdModes.includes(databaseAuthMode)||entraIdModes.includes(redisAuthMode)){if(!process.env.AZURE_CLIENT_ID)logger.warn("[Config] AZURE_CLIENT_ID is not set. Required for user-assigned managed identity.");if([databaseAuthMode,redisAuthMode].filter((m)=>m==="service_principal").length>0){if(!process.env.AZURE_TENANT_ID)errors.push({field:"azure.tenantId",envName:"AZURE_TENANT_ID",message:"AZURE_TENANT_ID is required for service_principal auth mode."});if(!process.env.AZURE_CLIENT_SECRET)errors.push({field:"azure.clientSecret",envName:"AZURE_CLIENT_SECRET",message:"AZURE_CLIENT_SECRET is required for service_principal auth mode."})}}if(config.database?.url){let envValue=process.env[config.database.url];if(!envValue)errors.push({field:"database.url",envName:config.database.url,message:`Environment variable "${config.database.url}" is not set. Please set it in your .env file.`});else resolved.databaseUrl=envValue}let validationWithDapr=typeof config.redis?.withDapr==="string"?process.env[config.redis.withDapr]?.toLowerCase()!=="false":config.redis?.withDapr??!1;if(config.redis&&!validationWithDapr){let urlEnvValue=config.redis.url?process.env[config.redis.url]:void 0,hostEnvValue=config.redis.host?process.env[config.redis.host]:void 0,portEnvValue=config.redis.port?process.env[config.redis.port]:void 0;if(urlEnvValue)resolved.redisUrl=urlEnvValue;else if(config.redis.url){if(!(hostEnvValue&&portEnvValue))errors.push({field:"redis.url",envName:config.redis.url,message:`Redis has no usable connection details. Set "${config.redis.url}", or set both "${config.redis.host??"redis.host"}" and "${config.redis.port??"redis.port"}".`})}else{if(config.redis.host&&!hostEnvValue)errors.push({field:"redis.host",envName:config.redis.host,message:`Environment variable "${config.redis.host}" is not set. Please set it in your .env file.`});if(config.redis.port&&!portEnvValue)errors.push({field:"redis.port",envName:config.redis.port,message:`Environment variable "${config.redis.port}" is not set. Please set it in your .env file.`})}}if(config.authentication?.enabled){if(!config.authentication.mode)errors.push({field:"authentication.mode",envName:"",message:'authentication.mode is required when authentication is enabled. Use "full" for IDP/standalone services, "consumer" for resource servers.'});if(config.authentication.accessToken?.secret){let envValue=process.env[config.authentication.accessToken.secret];if(!envValue)errors.push({field:"authentication.accessToken.secret",envName:config.authentication.accessToken.secret,message:`Environment variable "${config.authentication.accessToken.secret}" is not set. Please set it in your .env file.`});else resolved.accessTokenSecret=envValue}else errors.push({field:"authentication.accessToken.secret",envName:"",message:"authentication.accessToken.secret is required when authentication is enabled."});let isConsumerMode=config.authentication.mode==="consumer";if(config.authentication.refreshToken?.secret){let envValue=process.env[config.authentication.refreshToken.secret];if(!envValue)errors.push({field:"authentication.refreshToken.secret",envName:config.authentication.refreshToken.secret,message:`Environment variable "${config.authentication.refreshToken.secret}" is not set. Please set it in your .env file.`});else resolved.refreshTokenSecret=envValue}else if(!isConsumerMode)errors.push({field:"authentication.refreshToken.secret",envName:"",message:"authentication.refreshToken.secret is required when authentication is enabled."});if(config.authentication.sessionToken?.secret){let envValue=process.env[config.authentication.sessionToken.secret];if(!envValue)errors.push({field:"authentication.sessionToken.secret",envName:config.authentication.sessionToken.secret,message:`Environment variable "${config.authentication.sessionToken.secret}" is not set. Please set it in your .env file.`});else resolved.sessionTokenSecret=envValue}else if(!isConsumerMode)errors.push({field:"authentication.sessionToken.secret",envName:"",message:"authentication.sessionToken.secret is required when authentication is enabled."})}if(config.authentication?.oauth?.enabled&&config.authentication.oauth.providers){let resolvedProviders={};for(let[providerName,providerConfig]of Object.entries(config.authentication.oauth.providers)){if(!providerConfig)continue;let{clientId:clientIdEnvName,clientSecret:clientSecretEnvName,redirectUri:redirectUriEnvName,tenantId:tenantIdEnvName}=providerConfig,clientId=resolveConfigCredential(clientIdEnvName),clientSecret=resolveConfigCredential(clientSecretEnvName),redirectUri=resolveConfigCredential(redirectUriEnvName),tenantId=resolveConfigCredential(tenantIdEnvName),credentialsMayComeFromDb=config.secrets?.enabled===!0;if(!clientId&&!credentialsMayComeFromDb)errors.push({field:`authentication.oauth.providers.${providerName}.clientId`,envName:clientIdEnvName,message:`Environment variable "${clientIdEnvName}" is not set (OAuth ${providerName} clientId).`});if(!clientSecret&&!credentialsMayComeFromDb)errors.push({field:`authentication.oauth.providers.${providerName}.clientSecret`,envName:clientSecretEnvName,message:`Environment variable "${clientSecretEnvName}" is not set (OAuth ${providerName} clientSecret).`});if(clientId&&clientSecret||credentialsMayComeFromDb)resolvedProviders[providerName]={clientId:clientId??"",clientSecret:clientSecret??"",redirectUri:redirectUri??"",tenantId,scopes:providerConfig.scopes,authorizationUrl:providerConfig.authorizationUrl,tokenUrl:providerConfig.tokenUrl,userInfoUrl:providerConfig.userInfoUrl,extraAuthParams:providerConfig.extraAuthParams}}if(Object.keys(resolvedProviders).length>0)resolved.oauthProviders=resolvedProviders}return{valid:errors.length===0,errors,resolved}}async function ensureDatabaseExists(databaseUrl,logger2,authMode){let{Pool:Pool2}=await import("pg"),targetDb=new URL(databaseUrl).pathname.replace("/","");if(!targetDb)return;let adminUrl=new URL(databaseUrl);adminUrl.pathname="/postgres";let pool;if(authMode&&authMode!=="password"){let{getPostgresToken:getPostgresToken2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure));pool=new Pool2({connectionString:adminUrl.toString(),password:getPostgresToken2,ssl:{rejectUnauthorized:!0}})}else pool=new Pool2({connectionString:adminUrl.toString()});try{if((await pool.query("SELECT 1 FROM pg_database WHERE datname = $1",[targetDb])).rowCount===0)logger2.info(`[Database] Creating database "${targetDb}"...`),await pool.query(`CREATE DATABASE "${targetDb}" TEMPLATE template0`),logger2.info(`[Database] Database "${targetDb}" created successfully`);else logger2.info(`[Database] Database "${targetDb}" exists`)}catch(err){let message=err instanceof Error?err.message:String(err);logger2.warn(`[Database] Could not auto-create database: ${message}`)}finally{await pool.end()}}var redisManagerInstance=null,NEVER_WORDS,COOKIE_SAFE_TOKEN_BYTES=3500,lastOversizeWarnAt=0,FORMAT_PATTERNS,HTML_ENTITIES,SENSITIVE_OUTPUT_KEYS,ACCESS_TOKEN_CACHE_PREFIX="access_token:",REFRESH_LOCK_PREFIX="refresh_lock:",LOCK_TTL_SECONDS=5,LOCK_WAIT_TIMEOUT_MS=3000,ACCESS_TOKEN_CACHE_TTL_SECONDS=60;var init_utils5=__esm(()=>{init_Managers();init_Services();init_Logger2();init_lifetime();NEVER_WORDS=new Set(["never","none","unlimited","infinite","0","sonsuz","s\xFCresiz"]);FORMAT_PATTERNS={email:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,url:/^https?:\/\/.+/,uuid:/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,date:/^\d{4}-\d{2}-\d{2}$/,datetime:/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/,time:/^\d{2}:\d{2}:\d{2}$/,uri:/^[a-z][a-z0-9+.-]*:/i,ipv4:/^(\d{1,3}\.){3}\d{1,3}$/,ipv6:/^([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$/i};HTML_ENTITIES={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#x27;","/":"&#x2F;","`":"&#96;","=":"&#x3D;"};SENSITIVE_OUTPUT_KEYS=new Set(["password","passwordHash","password_hash","emailVerificationToken","email_verification_token","emailVerificationTokenExpiresAt","email_verification_token_expires_at","passwordResetToken","password_reset_token","refreshTokenHash","refresh_token_hash"])});import{eq as eq14,sql as sql5}from"drizzle-orm";import{pgSchema}from"drizzle-orm/pg-core";class TenantRegistry{db;logger;mainSchemaName;mainSchemaTables;mainSchemaRelations;createAllTablesForSchema;createAllRelationsForSchema;appId;authMode;tenantResolution;tenantHeader;redisCacheTtlSeconds;defaultTrustedSources;idpUrl;allowDataLoss;onTenantProvisioned;tenantsBySubdomain=new Map;tenantsBySchemaName=new Map;tenantsById=new Map;schemaContexts=new Map;tenantFeatures=new Map;tenantsByDomainHostname=new Map;constructor(config){this.db=config.db,this.logger=config.logger,this.mainSchemaName=config.mainSchemaName,this.mainSchemaTables=config.mainSchemaTables,this.mainSchemaRelations=config.mainSchemaRelations,this.createAllTablesForSchema=config.createAllTablesForSchema,this.createAllRelationsForSchema=config.createAllRelationsForSchema,this.appId=config.appId,this.authMode=config.authMode,this.tenantResolution=config.tenantResolution,this.tenantHeader=config.tenantHeader,this.redisCacheTtlSeconds=config.redisCacheTtlSeconds,this.defaultTrustedSources=config.defaultTrustedSources,this.idpUrl=config.idpUrl,this.allowDataLoss=config.allowDataLoss===!0,this.onTenantProvisioned=config.onTenantProvisioned}async initialize(){this.logger.info("[TenantRegistry] Initializing..."),this.schemaContexts.set(this.mainSchemaName,{schemaName:this.mainSchemaName,schemaTables:this.mainSchemaTables,schemaRelations:this.mainSchemaRelations,tenant:null});let tenants=await this.loadTenantsFromDb();this.logger.info(`[TenantRegistry] Loaded ${tenants.length} tenants from database`);let features=await this.loadTenantFeaturesFromDb();this.logger.info(`[TenantRegistry] Loaded ${features.length} tenant feature mappings`);for(let tenant of tenants)this.indexTenant(tenant);for(let feature of features){let existing=this.tenantFeatures.get(feature.tenantId)||[];existing.push(feature),this.tenantFeatures.set(feature.tenantId,existing)}let activeTenants=tenants.filter((t)=>t.status==="active");for(let tenant of activeTenants)await this.buildSchemaContext(tenant);await this.loadDomainHostnames(),this.logger.info(`[TenantRegistry] Initialized with ${activeTenants.length} active tenant schemas + main schema`)}resolveFromRequest(request,vettedClientIp){let url=new URL(request.url),host=request.headers.get("host")||url.host||"",normalizedHost=normalizeHost(host);if(normalizedHost){let byHostname=this.tenantsByDomainHostname.get(normalizedHost);if(byHostname)return this.validateAndReturnTenant(byHostname)}if(this.tenantResolution==="subdomain"||this.tenantResolution==="both"){let subdomain=extractSubdomain(host);if(subdomain){let tenant=this.tenantsBySubdomain.get(subdomain);if(tenant)return this.validateAndReturnTenant(tenant);return{resolved:!1,error:`Tenant not found for subdomain: ${subdomain}`,statusCode:404}}}if(this.tenantResolution==="header"||this.tenantResolution==="both"){let tenantIdOrSubdomain=request.headers.get(this.tenantHeader);if(tenantIdOrSubdomain){let result=this.resolveFromHeader(tenantIdOrSubdomain,request,vettedClientIp);if(result)return result}}let mainContext=this.schemaContexts.get(this.mainSchemaName);if(mainContext)return{resolved:!0,context:mainContext};return{resolved:!1,error:"No tenant could be resolved and main schema is unavailable",statusCode:500}}getSchemaContext(schemaName){return this.schemaContexts.get(schemaName)}getMainContext(){let ctx=this.schemaContexts.get(this.mainSchemaName);if(!ctx)throw Error("[TenantRegistry] Main schema context not initialized");return ctx}getActiveTenants(){return Array.from(this.tenantsById.values()).filter((t)=>t.status==="active")}getTenantById(id){return this.tenantsById.get(id)}getTenantBySchemaName(schemaName){return this.tenantsBySchemaName.get(schemaName)}getTenantFeatures(tenantId){return this.tenantFeatures.get(tenantId)||[]}isTenantFeatureEnabled(tenantId,featureName){return(this.tenantFeatures.get(tenantId)||[]).find((f)=>f.featureName===featureName)?.enabled??!1}getTenantIdsWithFeature(featureName){let result=[];for(let[tenantId,features]of this.tenantFeatures)if(features.find((f)=>f.featureName===featureName&&f.enabled))result.push(tenantId);return result}getSchemaNamesWithFeature(featureName){let tenantIds=this.getTenantIdsWithFeature(featureName),schemaNames=[];for(let tenantId of tenantIds){let tenant=this.tenantsById.get(tenantId);if(tenant&&tenant.status==="active")schemaNames.push(tenant.schemaName)}return schemaNames}getAllSchemaNames(){return Array.from(this.schemaContexts.keys())}async provisionTenant(tenant){this.logger.info(`[TenantRegistry] Provisioning tenant: ${tenant.subdomain} \u2192 ${tenant.schemaName}`),await ensureSchemaExists(this.db,tenant.schemaName);let context=await this.buildSchemaContext(tenant);if(this.indexTenant(tenant),await this.syncSchemaToDb(context),this.onTenantProvisioned)try{await this.onTenantProvisioned(context)}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.warn(`[TenantRegistry] onTenantProvisioned hook failed for ${tenant.schemaName}: ${msg}`)}return this.logger.info(`[TenantRegistry] Tenant provisioned: ${tenant.subdomain}`),context}async syncSchemaToDb(context){let{pushSchema}=await import("drizzle-kit/api"),{applySchemaPush:applySchemaPush2}=await Promise.resolve().then(() => (init_schema(),exports_schema)),targetSchema=pgSchema(context.schemaName);try{let push=await pushSchema({schema:targetSchema,...context.schemaTables},this.db,[context.schemaName]);if(await applySchemaPush2(push,{schemaName:context.schemaName,allowDataLoss:this.allowDataLoss,logger:this.logger,execute:(statement)=>this.db.execute(sql5.raw(statement))}))this.logger.info(`[TenantRegistry] Schema sync completed for: ${context.schemaName}`)}catch(err){let msg=err instanceof Error?err.message:String(err);this.logger.error(`[TenantRegistry] Schema sync FAILED for ${context.schemaName}: ${msg}. The database does not match this build; queries against anything it was going to add will fail.`)}}async syncAllSchemas(){for(let[schemaName,context]of this.schemaContexts)this.logger.info(`[TenantRegistry] Syncing schema: ${schemaName}`),await ensureSchemaExists(this.db,schemaName),await this.syncSchemaToDb(context)}async invalidateCache(subdomain){try{let{getRedisManager:getRedisManager2}=await Promise.resolve().then(() => (init_utils5(),exports_utils)),redis=getRedisManager2();if(redis)await redis.remove(`tenant:${subdomain}`),this.logger.info(`[TenantRegistry] Cache invalidated for: ${subdomain}`)}catch{}}async refreshTenant(tenantId){let tenantsTable=this.mainSchemaTables.tenants;if(!tenantsTable)return;let row=(await this.db.select().from(tenantsTable).where(eq14(tenantsTable.id,tenantId)).limit(1))[0];if(!row)return;let tenant=rowToTenantRecord(row),oldTenant=this.tenantsById.get(tenantId);if(oldTenant)this.tenantsBySubdomain.delete(oldTenant.subdomain),this.tenantsBySchemaName.delete(oldTenant.schemaName);if(this.indexTenant(tenant),tenant.status==="active")await this.buildSchemaContext(tenant);else this.schemaContexts.delete(tenant.schemaName);if(oldTenant)await this.invalidateCache(oldTenant.subdomain);await this.invalidateCache(tenant.subdomain)}async initializeFromIdp(){if(!this.idpUrl){this.logger.error("[TenantRegistry] Consumer multi-tenant requires idpUrl (IDP_URL)");return}this.logger.info(`[TenantRegistry] Initializing from IDP: ${this.idpUrl}`),this.schemaContexts.set(this.mainSchemaName,{schemaName:this.mainSchemaName,schemaTables:this.mainSchemaTables,schemaRelations:this.mainSchemaRelations,tenant:null});let tenants=await this.loadTenantsFromIdp();this.logger.info(`[TenantRegistry] Fetched ${tenants.length} tenants from IDP`);for(let tenant of tenants)this.indexTenant(tenant);let activeTenants=tenants.filter((t)=>t.status==="active");for(let tenant of activeTenants)await this.buildSchemaContext(tenant);await this.loadDomainHostnames(),this.logger.info(`[TenantRegistry] Consumer initialized with ${activeTenants.length} active tenant schemas + main schema`)}isConsumerMode(){return this.authMode==="consumer"&&!!this.idpUrl}async syncFromIdp(){if(!this.isConsumerMode())return{added:[],removed:[],total:this.tenantsById.size};let tenants=await this.loadTenantsFromIdp(),added=[],removed=[],seenSchemaNames=new Set;for(let tenant of tenants){seenSchemaNames.add(tenant.schemaName);let known=this.tenantsById.get(tenant.id);if(known)this.tenantsBySubdomain.delete(known.subdomain),this.tenantsBySchemaName.delete(known.schemaName);if(this.indexTenant(tenant),tenant.status==="active"){if(!this.schemaContexts.has(tenant.schemaName)){await ensureSchemaExists(this.db,tenant.schemaName);let ctx=await this.buildSchemaContext(tenant);await this.syncSchemaToDb(ctx),added.push(tenant.schemaName),await this.invalidateCache(tenant.subdomain),this.logger.info(`[TenantRegistry] Synced new tenant from IDP: ${tenant.subdomain}`)}}else if(this.schemaContexts.has(tenant.schemaName))this.schemaContexts.delete(tenant.schemaName),removed.push(tenant.schemaName),await this.invalidateCache(tenant.subdomain),this.logger.info(`[TenantRegistry] Deactivated tenant context: ${tenant.subdomain}`)}for(let[schemaName,ctx]of this.schemaContexts){if(schemaName===this.mainSchemaName)continue;if(!seenSchemaNames.has(schemaName)){if(this.schemaContexts.delete(schemaName),removed.push(schemaName),ctx.tenant)this.tenantsBySubdomain.delete(ctx.tenant.subdomain),this.tenantsById.delete(ctx.tenant.id),this.tenantsBySchemaName.delete(schemaName),await this.invalidateCache(ctx.tenant.subdomain)}}return{added,removed,total:tenants.length}}registerDomainHostname(hostname,tenantId){let tenant=this.tenantsById.get(tenantId);if(!tenant)return;this.tenantsByDomainHostname.set(normalizeHost(hostname),tenant)}unregisterDomainHostname(hostname){this.tenantsByDomainHostname.delete(normalizeHost(hostname))}async loadDomainHostnames(){let table=this.mainSchemaTables.domainHostnames;if(!table)return 0;try{let rows=await this.db.select().from(table),count=0;this.tenantsByDomainHostname.clear();for(let row of rows){let status=String(row.status??""),tenantId=String(row.tenantId??row.tenant_id??""),hostname=String(row.normalizedHostname??row.normalized_hostname??"");if(status!=="active"||!tenantId||!hostname)continue;let tenant=this.tenantsById.get(tenantId);if(!tenant)continue;this.tenantsByDomainHostname.set(normalizeHost(hostname),tenant),count++}if(count>0)this.logger.info(`[TenantRegistry] Indexed ${count} active custom hostnames`);return count}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load custom hostnames: ${msg}`),0}}async loadTenantsFromIdp(){if(!this.idpUrl)return[];try{let response=await fetch(`${this.idpUrl}/tenants`,{method:"GET",headers:{"Content-Type":"application/json"}});if(!response.ok)return this.logger.warn(`[TenantRegistry] IDP tenant fetch failed: ${response.status} ${response.statusText}`),[];return((await response.json())?.data?.items||[]).map((item)=>rowToTenantRecord(item))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to fetch tenants from IDP: ${msg}`),[]}}async loadTenantsFromDb(){let tenantsTable=this.mainSchemaTables.tenants;if(!tenantsTable)return this.logger.warn("[TenantRegistry] No tenants table found in main schema"),[];try{return(await this.db.select().from(tenantsTable)).map((row)=>rowToTenantRecord(row))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load tenants: ${msg}`),[]}}async loadTenantFeaturesFromDb(){let featuresTable=this.mainSchemaTables.tenantFeatures;if(!featuresTable)return this.logger.warn("[TenantRegistry] No tenant_features table found in main schema"),[];try{return(await this.db.select().from(featuresTable)).map((row)=>rowToFeatureRecord(row,parseJsonbToConfig))}catch(err){let msg=err instanceof Error?err.message:String(err);return this.logger.warn(`[TenantRegistry] Failed to load tenant features: ${msg}`),[]}}indexTenant(tenant){if(this.tenantsById.set(tenant.id,tenant),this.tenantsBySubdomain.set(tenant.subdomain,tenant),this.tenantsBySchemaName.set(tenant.schemaName,tenant),tenant.domain)this.tenantsBySubdomain.set(tenant.domain,tenant)}async buildSchemaContext(tenant){let schema=pgSchema(tenant.schemaName),schemaTables=this.createAllTablesForSchema(schema),schemaRelations=this.createAllRelationsForSchema?this.createAllRelationsForSchema(schema):{},context={schemaName:tenant.schemaName,schemaTables,schemaRelations,tenant};return this.schemaContexts.set(tenant.schemaName,context),context}resolveFromHeader(tenantIdOrSubdomain,request,vettedClientIp){let tenant=this.tenantsBySubdomain.get(tenantIdOrSubdomain);if(!tenant)tenant=this.tenantsById.get(tenantIdOrSubdomain);if(!tenant)tenant=this.tenantsBySchemaName.get(tenantIdOrSubdomain);if(!tenant)return{resolved:!1,error:`Tenant not found for header value: ${tenantIdOrSubdomain}`,statusCode:404};if(!isTrustedSource(tenant,request,this.authMode,this.defaultTrustedSources,vettedClientIp))return{resolved:!1,error:`Untrusted source for tenant: ${tenant.subdomain}`,statusCode:403};return this.validateAndReturnTenant(tenant)}validateAndReturnTenant(tenant){if(tenant.status==="suspended")return{resolved:!1,error:`Tenant ${tenant.subdomain} is suspended: ${tenant.suspendedReason||"No reason provided"}`,statusCode:403};if(tenant.status==="provisioning")return{resolved:!1,error:`Tenant ${tenant.subdomain} is still being provisioned`,statusCode:503};if(tenant.status==="archived")return{resolved:!1,error:`Tenant ${tenant.subdomain} has been archived`,statusCode:410};let context=this.schemaContexts.get(tenant.schemaName);if(!context)return{resolved:!1,error:`Schema context not found for tenant: ${tenant.subdomain}`,statusCode:500};return{resolved:!0,context}}}var init_TenantRegistry=__esm(()=>{init_schema()});var init_Tenant=__esm(()=>{init_schema();init_TenantRegistry()});var init_types5=()=>{};import{and as and10,desc as desc2,eq as eq15,inArray as inArray2}from"drizzle-orm";function toCamel2(obj){let result={};for(let[key2,value]of Object.entries(obj)){let camelKey=key2.replace(/_([a-z])/g,(_,c)=>c.toUpperCase());result[camelKey]=value}return result}function fromCamel2(obj){let result={};for(let[key2,value]of Object.entries(obj)){let snakeKey=key2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`);result[snakeKey]=value}return result}class VerificationService{db;schemaTables;config;logger;onNotificationTrigger;constructor(serviceConfig){this.db=serviceConfig.db,this.schemaTables=serviceConfig.schemaTables,this.config=serviceConfig.config,this.logger=serviceConfig.logger}setNotificationHandler(handler){this.onNotificationTrigger=handler}getConnectedNotificationNodeIds(stepNodeId,steps,edges){let result=new Set,getNeighbors=(nid)=>{let neighbors=[];for(let edge of edges){let{sourceNodeId:src,targetNodeId:tgt}=edge;if(src===nid)neighbors.push(tgt);else if(tgt===nid)neighbors.push(src)}return neighbors},directNeighbors=getNeighbors(stepNodeId);for(let neighborId of directNeighbors)if(steps.find((s)=>s.nodeId===neighborId)?.nodeType==="notification")result.add(neighborId);for(let neighborId of directNeighbors)if(steps.find((s)=>s.nodeId===neighborId)?.nodeType==="verifier"){let verifierNeighbors=getNeighbors(neighborId);for(let vNeighborId of verifierNeighbors){if(vNeighborId===stepNodeId)continue;if(steps.find((s)=>s.nodeId===vNeighborId)?.nodeType==="notification")result.add(vNeighborId)}}let ids=[...result];return this.logger.info(`[Verification] Connected notification nodes for step ${stepNodeId}: [${ids.join(", ")}]`),ids}getTable(name){return resolveSchemaTable(this.schemaTables,name,this.logger)}getCol(table,col7){return table[col7]}async listFlows(entityName){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return[];return(await(entityName?this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"entityName"),entityName)):this.db.select().from(flowsTable))).map((r)=>fromCamel2(r))}async getFlow(flowId){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),notifRulesTable=this.getTable("verificationNotificationRules"),notifRecipientsTable=this.getTable("verificationNotificationRecipients"),notifChannelsTable=this.getTable("verificationNotificationChannels");if(!flowsTable)return null;let flowRow=(await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)).limit(1))[0];if(!flowRow)return null;let flow=fromCamel2(flowRow),steps=(stepsTable?await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),edges=(edgesTable?await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),verifierConfigs=(verifierConfigsTable?await this.db.select().from(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),notifRules=(notifRulesTable?await this.db.select().from(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId)):[]).map((r)=>fromCamel2(r)),ruleIds=notifRules.map((r)=>r.id),notifRecipients=(notifRecipientsTable&&ruleIds.length>0?await this.db.select().from(notifRecipientsTable).where(inArray2(this.getCol(notifRecipientsTable,"ruleId"),ruleIds)):[]).map((r)=>fromCamel2(r)),notifChannels=(notifChannelsTable&&ruleIds.length>0?await this.db.select().from(notifChannelsTable).where(inArray2(this.getCol(notifChannelsTable,"ruleId"),ruleIds)):[]).map((r)=>fromCamel2(r));return{flow,graph:{steps,edges,verifier_configs:verifierConfigs,notification_rules:notifRules,notification_recipients:notifRecipients,notification_channels:notifChannels}}}async saveFlow(params){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),notifRulesTable=this.getTable("verificationNotificationRules"),notifRecipientsTable=this.getTable("verificationNotificationRecipients"),notifChannelsTable=this.getTable("verificationNotificationChannels");if(!flowsTable||!stepsTable||!edgesTable)throw Error("Verification tables not configured");let existingFlows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),params.flow_id)).limit(1),flowId=params.flow_id;if(existingFlows.length>0)await this.db.update(flowsTable).set(toCamel2({entity_name:params.entity_name,name:params.name,description:params.description||null,trigger_on:params.trigger_on,trigger_fields:params.trigger_fields||null,is_draft:params.is_draft,viewport:params.viewport||null})).where(eq15(this.getCol(flowsTable,"id"),flowId));else{let[newFlow]=await this.db.insert(flowsTable).values(toCamel2({id:flowId,entity_name:params.entity_name,name:params.name,description:params.description||null,trigger_on:params.trigger_on,trigger_fields:params.trigger_fields||null,is_draft:params.is_draft,viewport:params.viewport||null})).returning();flowId=newFlow.id}if(await this.db.delete(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),flowId)),edgesTable)await this.db.delete(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),flowId));if(verifierConfigsTable)await this.db.delete(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId));if(notifRulesTable){let oldRuleIds=(await this.db.select().from(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId))).map((r)=>r.id);if(oldRuleIds.length>0){if(notifRecipientsTable)for(let rid of oldRuleIds)await this.db.delete(notifRecipientsTable).where(eq15(this.getCol(notifRecipientsTable,"ruleId"),rid));if(notifChannelsTable)for(let rid of oldRuleIds)await this.db.delete(notifChannelsTable).where(eq15(this.getCol(notifChannelsTable,"ruleId"),rid))}await this.db.delete(notifRulesTable).where(eq15(this.getCol(notifRulesTable,"flowId"),flowId))}let{graph}=params;if(graph.steps.length>0)await this.db.insert(stepsTable).values(graph.steps.map((s)=>toCamel2({flow_id:flowId,entity_name:params.entity_name,node_id:s.node_id,node_type:s.node_type,step_order:s.step_order,name:s.name||null,description:s.description||null,position_x:s.position_x,position_y:s.position_y,width:s.width||null,height:s.height||null,style:s.style||null,data:s.data||null})));if(graph.edges.length>0&&edgesTable)await this.db.insert(edgesTable).values(graph.edges.map((e)=>toCamel2({flow_id:flowId,edge_id:e.edge_id,source_node_id:e.source_node_id,target_node_id:e.target_node_id,source_handle:e.source_handle||null,target_handle:e.target_handle||null,edge_type:e.edge_type,label:e.label||null,condition:e.condition||null,style:e.style||null,animated:e.animated})));if(graph.verifier_configs.length>0&&verifierConfigsTable)await this.db.insert(verifierConfigsTable).values(graph.verifier_configs.map((vc)=>toCamel2({flow_id:flowId,node_id:vc.node_id,verifier_type:vc.verifier_type,verifier_user_id:vc.verifier_user_id||null,verifier_role:vc.verifier_role||null,require_signature:vc.require_signature,all_must_approve:vc.all_must_approve})));if(this.logger.info(`[Verification] Save: ${graph.notification_rules.length} rules, ${graph.notification_recipients.length} recipients, ${graph.notification_channels.length} channels`),graph.notification_rules.length>0&&notifRulesTable)for(let rule of graph.notification_rules){this.logger.info(`[Verification] Saving notification rule: node_id=${rule.node_id}, trigger=${rule.trigger}, title_template=${JSON.stringify(rule.title_template)}, body_template=${JSON.stringify(rule.body_template)}`);let[insertedRule]=await this.db.insert(notifRulesTable).values(toCamel2({flow_id:flowId,node_id:rule.node_id,trigger:rule.trigger,title_template:rule.title_template||null,body_template:rule.body_template||null,starts_at:rule.starts_at||null,expires_at:rule.expires_at||null})).returning(),ruleId=insertedRule.id,ruleRecipients=graph.notification_recipients.filter((r)=>r.rule_id===rule.node_id);if(ruleRecipients.length>0&&notifRecipientsTable)await this.db.insert(notifRecipientsTable).values(ruleRecipients.map((r)=>toCamel2({rule_id:ruleId,recipient_type:r.recipient_type,recipient_user_id:r.recipient_user_id||null,recipient_role:r.recipient_role||null})));let ruleChannels=graph.notification_channels.filter((c)=>c.rule_id===rule.node_id);if(ruleChannels.length>0&&notifChannelsTable)await this.db.insert(notifChannelsTable).values(ruleChannels.map((c)=>toCamel2({rule_id:ruleId,channel:c.channel})))}return this.logger.info(`[Verification] Flow saved: ${flowId} for ${params.entity_name}`),{success:!0,flow_id:flowId}}async publishFlow(flowId){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};return await this.db.update(flowsTable).set(toCamel2({is_draft:!1,published_at:new Date})).where(eq15(this.getCol(flowsTable,"id"),flowId)),this.logger.info(`[Verification] Flow published: ${flowId}`),{success:!0,message:"Flow published"}}async deleteFlow(flowId){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};return await this.db.delete(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)),this.logger.info(`[Verification] Flow deleted: ${flowId}`),{success:!0,message:"Flow deleted"}}async startFlow(params){let flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),instancesTable=this.getTable("verificationInstances"),requirementsTable=this.getTable("verificationRequirements"),userRolesTable=this.getTable("userRoles");if(!flowsTable||!stepsTable||!edgesTable||!instancesTable||!requirementsTable)return{success:!1,message:"Verification tables not configured"};let flow=(await this.db.select().from(flowsTable).where(and10(eq15(this.getCol(flowsTable,"id"),params.flow_id),eq15(this.getCol(flowsTable,"isDraft"),!1))).limit(1))[0];if(!flow)return{success:!1,message:"Published flow not found"};if((await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"entityName"),params.entity_name),eq15(this.getCol(instancesTable,"entityId"),params.entity_id),eq15(this.getCol(instancesTable,"status"),"active"))).limit(1)).length>0)return{success:!1,message:"An active verification instance already exists for this entity"};let steps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),params.flow_id)),edges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),params.flow_id)),stepNodes=steps.filter((s)=>s.nodeType==="step");if(stepNodes.sort((a,b)=>a.stepOrder-b.stepOrder),stepNodes.length===0)return{success:!1,message:"Flow has no step nodes"};let[instance]=await this.db.insert(instancesTable).values(toCamel2({flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,started_by:params.started_by||null,status:"active",current_step_order:1,started_at:new Date})).returning(),instanceId=instance.id;if(await this.materializeRequirementsForStep(instanceId,params.flow_id,params.entity_name,params.entity_id,1,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable),this.onNotificationTrigger){let firstStep=stepNodes[0],firstStepNodeId=firstStep?.nodeId,connectedNotifIds=firstStepNodeId?this.getConnectedNotificationNodeIds(firstStepNodeId,steps,edges):[],ctx={flow_name:flow.name,step_name:firstStep?.name||"Step 1",step_order:1,total_steps:stepNodes.length};if(connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)await this.onNotificationTrigger({trigger:"on_flow_started",flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:notifNodeId,context:ctx});else await this.onNotificationTrigger({trigger:"on_flow_started",flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,context:ctx})}return this.logger.info(`[Verification] Flow started: instance ${instanceId} for ${params.entity_name}:${params.entity_id}`),{success:!0,instance_id:instanceId,message:"Flow started"}}async materializeRequirementsForStep(instanceId,flowId,entityName,entityId,stepOrder,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable){if(!requirementsTable)return;let stepNode=steps.find((s)=>s.nodeType==="step"&&s.stepOrder===stepOrder);if(!stepNode)return;let stepNodeId=stepNode.nodeId,verifierNodeIds=edges.filter((e)=>e.targetNodeId===stepNodeId).map((e)=>e.sourceNodeId),verifierNodes=steps.filter((s)=>s.nodeType==="verifier"&&verifierNodeIds.includes(s.nodeId));if(verifierNodes.length===0)return;let verifierConfigs=[];if(verifierConfigsTable)verifierConfigs=await this.db.select().from(verifierConfigsTable).where(eq15(this.getCol(verifierConfigsTable,"flowId"),flowId));for(let verifierNode of verifierNodes){let nodeId=verifierNode.nodeId,config=verifierConfigs.find((vc)=>vc.nodeId===nodeId);if(!config)continue;let{verifierType,allMustApprove}=config;if(verifierType==="role"&&allMustApprove&&userRolesTable){let rolesTable=this.getTable("roles");if(rolesTable){let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await this.db.select().from(rolesTable).where(eq15(rolesCols.name,config.verifierRole)).limit(1))[0];if(role){let usersWithRole=await this.db.select({user_id:userRolesCols.userId}).from(userRolesTable).where(eq15(userRolesCols.roleId,role.id));for(let userRole of usersWithRole)await this.db.insert(requirementsTable).values(toCamel2({instance_id:instanceId,step_node_id:stepNodeId,verifier_node_id:nodeId,entity_name:entityName,entity_id:entityId,verifier_type:"user",verifier_user_id:userRole.user_id,verifier_role:config.verifierRole||null,require_signature:config.requireSignature,all_must_approve:!0,step_order:stepOrder,status:"pending"}))}}}else await this.db.insert(requirementsTable).values(toCamel2({instance_id:instanceId,step_node_id:stepNodeId,verifier_node_id:nodeId,entity_name:entityName,entity_id:entityId,verifier_type:verifierType,verifier_user_id:config.verifierUserId||null,verifier_role:config.verifierRole||null,require_signature:config.requireSignature,all_must_approve:allMustApprove,step_order:stepOrder,status:"pending"}))}if(this.onNotificationTrigger){let connectedNotifIds=this.getConnectedNotificationNodeIds(stepNodeId,steps,edges);if(this.logger.info(`[Verification] on_step_reached: stepNodeId=${stepNodeId}, connectedNotifIds=[${connectedNotifIds.join(", ")}]`),connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)this.logger.info(`[Verification] Triggering on_step_reached for notifNodeId=${notifNodeId}`),await this.onNotificationTrigger({trigger:"on_step_reached",flow_id:flowId,entity_name:entityName,entity_id:entityId,node_id:notifNodeId,context:{step_name:stepNode.name||`Step ${stepOrder}`,step_order:stepOrder}});else await this.onNotificationTrigger({trigger:"on_step_reached",flow_id:flowId,entity_name:entityName,entity_id:entityId,context:{step_name:stepNode.name||`Step ${stepOrder}`,step_order:stepOrder}})}}async getStatus(entityName,entityId){let instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),verificationsTable=this.getTable("verifications"),requirementsTable=this.getTable("verificationRequirements"),emptyStatus={entity_name:entityName,entity_id:entityId,instance:null,flow:null,current_step:0,total_steps:0,is_completed:!1,is_rejected:!1,verifications:[],pending_requirements:[]};if(!instancesTable||!flowsTable||!verificationsTable||!requirementsTable)return this.logger.error("[Verification] Required tables not found"),emptyStatus;let instanceRow=(await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"entityName"),entityName),eq15(this.getCol(instancesTable,"entityId"),entityId))).orderBy(desc2(this.getCol(instancesTable,"createdAt"))).limit(1))[0];if(!instanceRow)return emptyStatus;let instance=fromCamel2(instanceRow),flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),instance.flow_id)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0,totalSteps=(stepsTable?await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),instance.flow_id),eq15(this.getCol(stepsTable,"nodeType"),"step"))):[]).length,verifications=(await this.db.select().from(verificationsTable).where(eq15(this.getCol(verificationsTable,"instanceId"),instance.id)).orderBy(desc2(this.getCol(verificationsTable,"createdAt")))).map((r)=>fromCamel2(r)),pendingRequirements=(await this.db.select().from(requirementsTable).where(and10(eq15(this.getCol(requirementsTable,"instanceId"),instance.id),eq15(this.getCol(requirementsTable,"status"),"pending")))).map((r)=>fromCamel2(r));return{entity_name:entityName,entity_id:entityId,instance,flow:flow||null,current_step:instance.current_step_order,total_steps:totalSteps,is_completed:instance.status==="completed",is_rejected:instance.status==="rejected",verifications,pending_requirements:pendingRequirements}}async decide(params){let{entity_name,entity_id,user_id,decision,reason,signature_id,diff}=params,verificationsTable=this.getTable("verifications"),requirementsTable=this.getTable("verificationRequirements"),instancesTable=this.getTable("verificationInstances"),stepsTable=this.getTable("verificationSteps"),edgesTable=this.getTable("verificationEdges"),verifierConfigsTable=this.getTable("verificationVerifierConfigs"),userRolesTable=this.getTable("userRoles"),rolesTable=this.getTable("roles");if(!verificationsTable||!requirementsTable||!instancesTable)return{success:!1,message:"Verification tables not configured"};let status=await this.getStatus(entity_name,entity_id);if(!status.instance||status.instance.status!=="active")return{success:!1,message:"No active verification instance"};let currentPending=status.pending_requirements.filter((r)=>r.step_order===status.current_step);if(currentPending.length===0)return{success:!1,message:"No pending requirements for current step"};let matchedReq=null;for(let req of currentPending){if(req.verifier_type==="user"&&req.verifier_user_id===user_id){matchedReq=req;break}if(req.verifier_type==="role"&&req.verifier_role&&userRolesTable&&rolesTable){let userRolesCols=userRolesTable,rolesCols=rolesTable;if((await this.db.select({role_name:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq15(userRolesCols.roleId,rolesCols.id)).where(eq15(userRolesCols.userId,user_id))).some((ur)=>ur.role_name===req.verifier_role)){matchedReq=req;break}}}if(!matchedReq)return{success:!1,message:"User is not authorized to verify at this step"};if(matchedReq.require_signature){if(!signature_id)return{success:!1,message:"Signature is required for this verification step"};let filesTable=resolveSchemaTable(this.schemaTables,"files",this.logger);if(filesTable){if((await this.db.select().from(filesTable).where(and10(eq15(this.getCol(filesTable,"id"),signature_id),eq15(this.getCol(filesTable,"uploadedBy"),user_id))).limit(1)).length===0)return{success:!1,message:"Signature file not found or not owned by the verifier"}}}if((await this.db.update(requirementsTable).set({status:decision}).where(and10(eq15(this.getCol(requirementsTable,"id"),matchedReq.id),eq15(this.getCol(requirementsTable,"status"),"pending"))).returning()).length===0)return{success:!1,message:"This requirement has already been decided"};let[newVerification]=await this.db.insert(verificationsTable).values(toCamel2({instance_id:status.instance.id,requirement_id:matchedReq.id,verifier_id:user_id,signature_id:signature_id||null,entity_name,entity_id,step_order:status.current_step,decision,reason:reason||null,diff:diff||null})).returning();if(this.onNotificationTrigger&&status.instance){let stepName=`Step ${status.current_step}`,allSteps=[],allEdges=[];if(stepsTable){allSteps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id));let stepRow=allSteps.find((s)=>s.nodeId===matchedReq.step_node_id);if(stepRow?.name)stepName=stepRow.name}if(edgesTable)allEdges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));let triggerName=decision==="approved"?"on_approved":"on_rejected",ctx={flow_name:status.flow?.name||"",step_name:stepName,step_order:status.current_step,total_steps:status.total_steps,decision},connectedNotifIds=this.getConnectedNotificationNodeIds(matchedReq.step_node_id,allSteps,allEdges);if(connectedNotifIds.length>0)for(let notifNodeId of connectedNotifIds)await this.onNotificationTrigger({trigger:triggerName,flow_id:status.instance.flow_id,entity_name,entity_id,node_id:notifNodeId,verifier_id:user_id,decision,context:ctx});else await this.onNotificationTrigger({trigger:triggerName,flow_id:status.instance.flow_id,entity_name,entity_id,verifier_id:user_id,decision,context:ctx})}if(decision==="rejected"){await this.db.update(instancesTable).set(toCamel2({status:"rejected",completed_at:new Date})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id));let newInstanceId;if(this.config.autoResetOnRejection){this.logger.info(`[Verification] Flow rejected for ${entity_name}:${entity_id}, auto-restarting from step 1`);let restartResult=await this.startFlow({flow_id:status.instance.flow_id,entity_name,entity_id,started_by:status.instance.started_by});if(restartResult.success)newInstanceId=restartResult.instance_id}return{success:!0,message:this.config.autoResetOnRejection?"Verification rejected \u2014 flow restarted from step 1":"Verification rejected",verification:newVerification,flow_completed:!1,new_instance_id:newInstanceId}}let matchedReqId=matchedReq.id,remainingPending=currentPending.filter((r)=>r.id!==matchedReqId);if(remainingPending.length>0)return{success:!0,message:`Step ${status.current_step} partially approved, ${remainingPending.length} verifier(s) remaining`,verification:newVerification,flow_completed:!1};let nextStep=status.current_step+1;if(nextStep>status.total_steps){if(await this.db.update(instancesTable).set(toCamel2({status:"completed",completed_at:new Date})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id)),this.onNotificationTrigger){let completedSteps=[],completedEdges=[];if(stepsTable)completedSteps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id));if(edgesTable)completedEdges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));let lastStepNodeId=matchedReq.step_node_id,completedNotifIds=this.getConnectedNotificationNodeIds(lastStepNodeId,completedSteps,completedEdges),completedCtx={flow_name:status.flow?.name||"",step_order:status.current_step,total_steps:status.total_steps};if(completedNotifIds.length>0)for(let notifNodeId of completedNotifIds)await this.onNotificationTrigger({trigger:"on_flow_completed",flow_id:status.instance.flow_id,entity_name,entity_id,node_id:notifNodeId,context:completedCtx});else await this.onNotificationTrigger({trigger:"on_flow_completed",flow_id:status.instance.flow_id,entity_name,entity_id,context:completedCtx})}return{success:!0,message:"Verification flow completed",verification:newVerification,flow_completed:!0}}if(await this.db.update(instancesTable).set(toCamel2({current_step_order:nextStep})).where(eq15(this.getCol(instancesTable,"id"),status.instance.id)),stepsTable&&edgesTable){let steps=await this.db.select().from(stepsTable).where(eq15(this.getCol(stepsTable,"flowId"),status.instance.flow_id)),edges=await this.db.select().from(edgesTable).where(eq15(this.getCol(edgesTable,"flowId"),status.instance.flow_id));await this.materializeRequirementsForStep(status.instance.id,status.instance.flow_id,entity_name,entity_id,nextStep,steps,edges,verifierConfigsTable,requirementsTable,userRolesTable)}return{success:!0,message:`Step ${status.current_step} approved, moving to step ${nextStep}`,verification:newVerification,flow_completed:!1,next_step:nextStep}}async startFlowForEntity(params){let flowsTable=this.getTable("verificationFlows");if(!flowsTable)return{success:!1,message:"Flow table not configured"};let flow=(await this.db.select().from(flowsTable).where(and10(eq15(this.getCol(flowsTable,"entityName"),params.entity_name),eq15(this.getCol(flowsTable,"isDraft"),!1))).limit(1))[0];if(!flow)return{success:!1,message:`No published flow found for entity '${params.entity_name}'`};return this.startFlow({flow_id:flow.id,entity_name:params.entity_name,entity_id:params.entity_id,started_by:params.started_by})}async listEntityStatuses(params){let instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),emptyResult={items:[],total:0,page:1,limit:20};if(!instancesTable||!flowsTable)return emptyResult;let page=params.page||1,limit=params.limit||20,offset=(page-1)*limit,conditions=[eq15(this.getCol(instancesTable,"entityName"),params.entity_name)];if(params.status)conditions.push(eq15(this.getCol(instancesTable,"status"),params.status));let whereClause=conditions.length===1?conditions[0]:and10(...conditions),allInstances=(await this.db.select().from(instancesTable).where(whereClause).orderBy(desc2(this.getCol(instancesTable,"createdAt")))).map((r)=>fromCamel2(r)),total=allInstances.length,paged=allInstances.slice(offset,offset+limit),items=[];for(let inst of paged){let flowId=inst.flow_id,flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),flowId)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0,totalSteps=0;if(stepsTable)totalSteps=(await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),flowId),eq15(this.getCol(stepsTable,"nodeType"),"step")))).length;items.push({instance_id:inst.id,entity_name:inst.entity_name,entity_id:inst.entity_id,flow_id:flowId,flow_name:flow?.name||"Unknown",status:inst.status,current_step_order:inst.current_step_order,total_steps:totalSteps,started_by:inst.started_by,started_at:inst.started_at,completed_at:inst.completed_at})}return{items,total,page,limit}}async getPending(userId){let requirementsTable=this.getTable("verificationRequirements"),instancesTable=this.getTable("verificationInstances"),flowsTable=this.getTable("verificationFlows"),stepsTable=this.getTable("verificationSteps"),userRolesTable=this.getTable("userRoles"),rolesTable=this.getTable("roles");if(this.logger.info(`[Verification.getPending] userId=${userId}, tables: req=${!!requirementsTable} inst=${!!instancesTable} flow=${!!flowsTable} steps=${!!stepsTable} roles=${!!rolesTable} userRoles=${!!userRolesTable}`),!requirementsTable||!instancesTable||!flowsTable)return this.logger.warn("[Verification.getPending] Missing required tables, returning empty"),[];let userRolesCols=userRolesTable,rolesCols=rolesTable,userRoleNames=(userRolesTable&&rolesTable?await this.db.select({role_name:rolesCols.name}).from(userRolesTable).innerJoin(rolesTable,eq15(userRolesCols.roleId,rolesCols.id)).where(eq15(userRolesCols.userId,userId)):[]).map((ur)=>ur.role_name),pendingReqs=(await this.db.select().from(requirementsTable).where(eq15(this.getCol(requirementsTable,"status"),"pending"))).map((r)=>fromCamel2(r));this.logger.info(`[Verification.getPending] Found ${pendingReqs.length} pending requirements, userRoles=${JSON.stringify(userRoleNames)}`);for(let req of pendingReqs)this.logger.info(`[Verification.getPending] Req: verifier_type=${req.verifier_type} verifier_user_id=${req.verifier_user_id} verifier_role=${req.verifier_role} step_order=${req.step_order} entity=${req.entity_name}/${req.entity_id}`);let pendingItems=[];for(let req of pendingReqs){if(!(req.verifier_type==="user"&&req.verifier_user_id===userId||req.verifier_type==="role"&&userRoleNames.includes(req.verifier_role))){this.logger.info(`[Verification.getPending] Skipping req: canVerify=false (type=${req.verifier_type}, reqUserId=${req.verifier_user_id}, loggedInUserId=${userId})`);continue}let instances=await this.db.select().from(instancesTable).where(and10(eq15(this.getCol(instancesTable,"id"),req.instance_id),eq15(this.getCol(instancesTable,"status"),"active"))).limit(1),instance=instances[0]?fromCamel2(instances[0]):void 0;if(!instance)continue;if(instance.current_step_order!==req.step_order)continue;let flows=await this.db.select().from(flowsTable).where(eq15(this.getCol(flowsTable,"id"),instance.flow_id)).limit(1),flow=flows[0]?fromCamel2(flows[0]):void 0;if(!flow)continue;let stepName;if(stepsTable&&req.step_node_id){let stepRow=(await this.db.select().from(stepsTable).where(and10(eq15(this.getCol(stepsTable,"flowId"),instance.flow_id),eq15(this.getCol(stepsTable,"nodeId"),req.step_node_id))).limit(1))[0];if(stepRow?.name)stepName=stepRow.name}pendingItems.push({instance_id:instance.id,entity_name:req.entity_name,entity_id:req.entity_id,flow_name:flow.name,step_order:req.step_order,step_name:stepName,require_signature:req.require_signature,created_at:req.created_at})}return pendingItems}}var init_Verification=__esm(()=>{init_types5()});var genLookup=(target)=>{let lookupTemp=typeof Uint8Array>"u"?[]:new Uint8Array(256),len=64;for(let i=0;i<64;i++)lookupTemp[target.charCodeAt(i)]=i;return lookupTemp},lookup,lookupUrl,base64UrlPattern,base64Pattern,base64,base64_default;var init_base64=__esm(()=>{lookup=genLookup("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"),lookupUrl=genLookup("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"),base64UrlPattern=/^[-A-Za-z0-9\-_]*$/,base64Pattern=/^[-A-Za-z0-9+/]*={0,3}$/,base64={};base64.toArrayBuffer=(data,urlMode)=>{let len=data.length,bufferLength=data.length*0.75,i,p=0,encoded1,encoded2,encoded3,encoded4;if(data[data.length-1]==="="){if(bufferLength--,data[data.length-2]==="=")bufferLength--}let arraybuffer=new ArrayBuffer(bufferLength),bytes=new Uint8Array(arraybuffer),target=urlMode?lookupUrl:lookup;for(i=0;i<len;i+=4)encoded1=target[data.charCodeAt(i)],encoded2=target[data.charCodeAt(i+1)],encoded3=target[data.charCodeAt(i+2)],encoded4=target[data.charCodeAt(i+3)],bytes[p++]=encoded1<<2|encoded2>>4,bytes[p++]=(encoded2&15)<<4|encoded3>>2,bytes[p++]=(encoded3&3)<<6|encoded4&63;return arraybuffer};base64.fromArrayBuffer=(arrBuf,urlMode)=>{let bytes=new Uint8Array(arrBuf),i,result="",len=bytes.length,target=urlMode?"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_":"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";for(i=0;i<len;i+=3)result+=target[bytes[i]>>2],result+=target[(bytes[i]&3)<<4|bytes[i+1]>>4],result+=target[(bytes[i+1]&15)<<2|bytes[i+2]>>6],result+=target[bytes[i+2]&63];let remainder=len%3;if(remainder===2)result=result.substring(0,result.length-1)+(urlMode?"":"=");else if(remainder===1)result=result.substring(0,result.length-2)+(urlMode?"":"==");return result};base64.toString=(str3,urlMode)=>{return new TextDecoder().decode(base64.toArrayBuffer(str3,urlMode))};base64.fromString=(str3,urlMode)=>{return base64.fromArrayBuffer(new TextEncoder().encode(str3),urlMode)};base64.validate=(encoded,urlMode)=>{if(!(typeof encoded==="string"||encoded instanceof String))return!1;try{return urlMode?base64UrlPattern.test(encoded):base64Pattern.test(encoded)}catch(_e){return!1}};base64.base64=base64;base64_default=base64});var exports_isoBase64URL={};__export(exports_isoBase64URL,{trimPadding:()=>trimPadding,toUTF8String:()=>toUTF8String,toBuffer:()=>toBuffer,toBase64:()=>toBase64,isBase64URL:()=>isBase64URL,isBase64:()=>isBase64,fromUTF8String:()=>fromUTF8String,fromBuffer:()=>fromBuffer});function toBuffer(base64urlString,from="base64url"){let _buffer=base64_default.toArrayBuffer(base64urlString,from==="base64url");return new Uint8Array(_buffer)}function fromBuffer(buffer,to="base64url"){let _normalized=new Uint8Array(buffer);return base64_default.fromArrayBuffer(_normalized.buffer,to==="base64url")}function toBase64(base64urlString){let fromBase64Url=base64_default.toArrayBuffer(base64urlString,!0);return base64_default.fromArrayBuffer(fromBase64Url)}function fromUTF8String(utf8String){return base64_default.fromString(utf8String,!0)}function toUTF8String(base64urlString){return base64_default.toString(base64urlString,!0)}function isBase64(input){return base64_default.validate(input,!1)}function isBase64URL(input){return input=trimPadding(input),base64_default.validate(input,!0)}function trimPadding(input){return input.replace(/=/g,"")}var init_isoBase64URL=__esm(()=>{init_base64()});function decodeLength(data,argument,index){if(argument<24)return[argument,1];let remainingDataLength=data.byteLength-index-1,view=new DataView(data.buffer,index+1),output,bytes=0;switch(argument){case 24:{if(remainingDataLength>0)output=view.getUint8(0),bytes=2;break}case 25:{if(remainingDataLength>1)output=view.getUint16(0,!1),bytes=3;break}case 26:{if(remainingDataLength>3)output=view.getUint32(0,!1),bytes=5;break}case 27:{if(remainingDataLength>7){let bigOutput=view.getBigUint64(0,!1);if(bigOutput>=24n&&bigOutput<=Number.MAX_SAFE_INTEGER)return[Number(bigOutput),9]}break}}if(output&&output>=24)return[output,bytes];throw Error("Length not supported or not well formed")}function encodeLength(major,argument){let majorEncoded=major<<5;if(argument<0)throw Error("CBOR Data Item argument must not be negative");let bigintArgument;if(typeof argument=="number"){if(!Number.isInteger(argument))throw Error("CBOR Data Item argument must be an integer");bigintArgument=BigInt(argument)}else bigintArgument=argument;if(major==MAJOR_TYPE_NEGATIVE_INTEGER){if(bigintArgument==0n)throw Error("CBOR Data Item argument cannot be zero when negative");bigintArgument=bigintArgument-1n}if(bigintArgument>18446744073709551615n)throw Error("CBOR number out of range");let buffer=new Uint8Array(8);if(new DataView(buffer.buffer).setBigUint64(0,bigintArgument,!1),bigintArgument<=23)return[majorEncoded|buffer[7]];else if(bigintArgument<=255)return[majorEncoded|24,buffer[7]];else if(bigintArgument<=65535)return[majorEncoded|25,...buffer.slice(6)];else if(bigintArgument<=4294967295)return[majorEncoded|26,...buffer.slice(4)];else return[majorEncoded|27,...buffer]}var MAJOR_TYPE_UNSIGNED_INTEGER=0,MAJOR_TYPE_NEGATIVE_INTEGER=1,MAJOR_TYPE_BYTE_STRING=2,MAJOR_TYPE_TEXT_STRING=3,MAJOR_TYPE_ARRAY=4,MAJOR_TYPE_MAP=5,MAJOR_TYPE_TAG=6,MAJOR_TYPE_SIMPLE_OR_FLOAT=7;class CBORTag{constructor(tag,value){Object.defineProperty(this,"tagId",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),Object.defineProperty(this,"tagValue",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.tagId=tag,this.tagValue=value}get tag(){return this.tagId}get value(){return this.tagValue}}function decodeUnsignedInteger(data,argument,index){return decodeLength(data,argument,index)}function decodeNegativeInteger(data,argument,index){let[value,length]=decodeUnsignedInteger(data,argument,index);return[-value-1,length]}function decodeByteString(data,argument,index){let[lengthValue,lengthConsumed]=decodeLength(data,argument,index),dataStartIndex=index+lengthConsumed;return[new Uint8Array(data.buffer.slice(dataStartIndex,dataStartIndex+lengthValue)),lengthConsumed+lengthValue]}function decodeString(data,argument,index){let[value,length]=decodeByteString(data,argument,index);return[TEXT_DECODER.decode(value),length]}function decodeArray(data,argument,index){if(argument===0)return[[],1];let[length,lengthConsumed]=decodeLength(data,argument,index),consumedLength=lengthConsumed,value=[];for(let i=0;i<length;i++){if(data.byteLength-index-consumedLength<=0)throw Error("array is not supported or well formed");let[decodedValue,consumed]=decodeNext(data,index+consumedLength);value.push(decodedValue),consumedLength+=consumed}return[value,consumedLength]}function decodeMap(data,argument,index){if(argument===0)return[new Map,1];let[length,lengthConsumed]=decodeLength(data,argument,index),consumedLength=lengthConsumed,result=new Map;for(let i=0;i<length;i++){let remainingDataLength=data.byteLength-index-consumedLength;if(remainingDataLength<=0)throw Error(MAP_ERROR);let[key2,keyConsumed]=decodeNext(data,index+consumedLength);if(consumedLength+=keyConsumed,remainingDataLength-=keyConsumed,remainingDataLength<=0)throw Error(MAP_ERROR);if(typeof key2!=="string"&&typeof key2!=="number")throw Error(MAP_ERROR);if(result.has(key2))throw Error(MAP_ERROR);let[value,valueConsumed]=decodeNext(data,index+consumedLength);consumedLength+=valueConsumed,result.set(key2,value)}return[result,consumedLength]}function decodeFloat16(data,index){if(index+3>data.byteLength)throw Error("CBOR stream ended before end of Float 16");let result=data.getUint16(index+1,!1);if(result==31744)return[1/0,3];else if(result==32256)return[NaN,3];else if(result==64512)return[-1/0,3];throw Error("Float16 data is unsupported")}function decodeFloat32(data,index){if(index+5>data.byteLength)throw Error("CBOR stream ended before end of Float 32");return[data.getFloat32(index+1,!1),5]}function decodeFloat64(data,index){if(index+9>data.byteLength)throw Error("CBOR stream ended before end of Float 64");return[data.getFloat64(index+1,!1),9]}function decodeTag(data,argument,index){let[tag,tagBytes]=decodeLength(data,argument,index),[value,valueBytes]=decodeNext(data,index+tagBytes);return[new CBORTag(tag,value),tagBytes+valueBytes]}function decodeNext(data,index){if(index>=data.byteLength)throw Error("CBOR stream ended before tag value");let byte=data.getUint8(index),majorType=byte>>5,argument=byte&31;switch(majorType){case MAJOR_TYPE_UNSIGNED_INTEGER:return decodeUnsignedInteger(data,argument,index);case MAJOR_TYPE_NEGATIVE_INTEGER:return decodeNegativeInteger(data,argument,index);case MAJOR_TYPE_BYTE_STRING:return decodeByteString(data,argument,index);case MAJOR_TYPE_TEXT_STRING:return decodeString(data,argument,index);case MAJOR_TYPE_ARRAY:return decodeArray(data,argument,index);case MAJOR_TYPE_MAP:return decodeMap(data,argument,index);case MAJOR_TYPE_TAG:return decodeTag(data,argument,index);case MAJOR_TYPE_SIMPLE_OR_FLOAT:switch(argument){case 20:return[!1,1];case 21:return[!0,1];case 22:return[null,1];case 23:return[void 0,1];case 25:return decodeFloat16(data,index);case 26:return decodeFloat32(data,index);case 27:return decodeFloat64(data,index)}}throw Error(`Unsupported or not well formed at ${index}`)}function encodeSimple(data){if(data===!0)return 245;else if(data===!1)return 244;else if(data===null)return 246;return 247}function encodeFloat(data){if(Math.fround(data)==data||!Number.isFinite(data)||Number.isNaN(data)){let output=new Uint8Array(5);return output[0]=250,new DataView(output.buffer).setFloat32(1,data,!1),output}else{let output=new Uint8Array(9);return output[0]=251,new DataView(output.buffer).setFloat64(1,data,!1),output}}function encodeNumber(data){if(typeof data=="number"){if(Number.isSafeInteger(data))if(data<0)return encodeLength(MAJOR_TYPE_NEGATIVE_INTEGER,Math.abs(data));else return encodeLength(MAJOR_TYPE_UNSIGNED_INTEGER,data);return[encodeFloat(data)]}else if(data<0n)return encodeLength(MAJOR_TYPE_NEGATIVE_INTEGER,data*-1n);else return encodeLength(MAJOR_TYPE_UNSIGNED_INTEGER,data)}function encodeString(data,output){output.push(...encodeLength(MAJOR_TYPE_TEXT_STRING,data.length)),output.push(ENCODER.encode(data))}function encodeBytes(data,output){output.push(...encodeLength(MAJOR_TYPE_BYTE_STRING,data.length)),output.push(data)}function encodeArray(data,output){output.push(...encodeLength(MAJOR_TYPE_ARRAY,data.length));for(let element of data)encodePartialCBOR(element,output)}function encodeMap(data,output){output.push(new Uint8Array(encodeLength(MAJOR_TYPE_MAP,data.size)));for(let[key2,value]of data.entries())encodePartialCBOR(key2,output),encodePartialCBOR(value,output)}function encodeTag(tag,output){output.push(...encodeLength(MAJOR_TYPE_TAG,tag.tag)),encodePartialCBOR(tag.value,output)}function encodePartialCBOR(data,output){if(typeof data=="boolean"||data===null||data==null){output.push(encodeSimple(data));return}if(typeof data=="number"||typeof data=="bigint"){output.push(...encodeNumber(data));return}if(typeof data=="string"){encodeString(data,output);return}if(data instanceof Uint8Array){encodeBytes(data,output);return}if(Array.isArray(data)){encodeArray(data,output);return}if(data instanceof Map){encodeMap(data,output);return}if(data instanceof CBORTag){encodeTag(data,output);return}throw Error("Not implemented")}function decodePartialCBOR(data,index){if(data.byteLength===0||data.byteLength<=index||index<0)throw Error("No data");if(data instanceof Uint8Array)return decodeNext(new DataView(data.buffer),index);else if(data instanceof ArrayBuffer)return decodeNext(new DataView(data),index);return decodeNext(data,index)}function encodeCBOR(data){let results=[];encodePartialCBOR(data,results);let length=0;for(let result of results)if(typeof result=="number")length+=1;else length+=result.length;let output=new Uint8Array(length),index=0;for(let result of results)if(typeof result=="number")output[index]=result,index+=1;else output.set(result,index),index+=result.length;return output}var TEXT_DECODER,MAP_ERROR="Map is not supported or well formed",ENCODER;var init_cbor=__esm(()=>{TEXT_DECODER=new TextDecoder;ENCODER=new TextEncoder});var init_esm=__esm(()=>{init_cbor()});var exports_isoCBOR={};__export(exports_isoCBOR,{encode:()=>encode,decodeFirst:()=>decodeFirst});function decodeFirst(input){let _input=new Uint8Array(input),decoded=decodePartialCBOR(_input,0),[first]=decoded;return first}function encode(input){return encodeCBOR(input)}var init_isoCBOR=__esm(()=>{init_esm()});function isCOSEPublicKeyOKP(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.OKP}function isCOSEPublicKeyEC2(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.EC2}function isCOSEPublicKeyRSA(cosePublicKey){let kty=cosePublicKey.get(COSEKEYS.kty);return isCOSEKty(kty)&&kty===COSEKTY.RSA}function isCOSEKty(kty){return Object.values(COSEKTY).indexOf(kty)>=0}function isCOSECrv(crv){return Object.values(COSECRV).indexOf(crv)>=0}function isCOSEAlg(alg){return Object.values(COSEALG).indexOf(alg)>=0}var COSEKEYS,COSEKTY,COSECRV,COSEALG;var init_cose=__esm(()=>{(function(COSEKEYS2){COSEKEYS2[COSEKEYS2.kty=1]="kty",COSEKEYS2[COSEKEYS2.alg=3]="alg",COSEKEYS2[COSEKEYS2.crv=-1]="crv",COSEKEYS2[COSEKEYS2.x=-2]="x",COSEKEYS2[COSEKEYS2.y=-3]="y",COSEKEYS2[COSEKEYS2.n=-1]="n",COSEKEYS2[COSEKEYS2.e=-2]="e"})(COSEKEYS||(COSEKEYS={}));(function(COSEKTY2){COSEKTY2[COSEKTY2.OKP=1]="OKP",COSEKTY2[COSEKTY2.EC2=2]="EC2",COSEKTY2[COSEKTY2.RSA=3]="RSA"})(COSEKTY||(COSEKTY={}));(function(COSECRV2){COSECRV2[COSECRV2.P256=1]="P256",COSECRV2[COSECRV2.P384=2]="P384",COSECRV2[COSECRV2.P521=3]="P521",COSECRV2[COSECRV2.ED25519=6]="ED25519",COSECRV2[COSECRV2.SECP256K1=8]="SECP256K1"})(COSECRV||(COSECRV={}));(function(COSEALG2){COSEALG2[COSEALG2.ES256=-7]="ES256",COSEALG2[COSEALG2.EdDSA=-8]="EdDSA",COSEALG2[COSEALG2.ES384=-35]="ES384",COSEALG2[COSEALG2.ES512=-36]="ES512",COSEALG2[COSEALG2.PS256=-37]="PS256",COSEALG2[COSEALG2.PS384=-38]="PS384",COSEALG2[COSEALG2.PS512=-39]="PS512",COSEALG2[COSEALG2.ES256K=-47]="ES256K",COSEALG2[COSEALG2.RS256=-257]="RS256",COSEALG2[COSEALG2.RS384=-258]="RS384",COSEALG2[COSEALG2.RS512=-259]="RS512",COSEALG2[COSEALG2.RS1=-65535]="RS1"})(COSEALG||(COSEALG={}))});function mapCoseAlgToWebCryptoAlg(alg){if([COSEALG.RS1].indexOf(alg)>=0)return"SHA-1";else if([COSEALG.ES256,COSEALG.PS256,COSEALG.RS256].indexOf(alg)>=0)return"SHA-256";else if([COSEALG.ES384,COSEALG.PS384,COSEALG.RS384].indexOf(alg)>=0)return"SHA-384";else if([COSEALG.ES512,COSEALG.PS512,COSEALG.RS512,COSEALG.EdDSA].indexOf(alg)>=0)return"SHA-512";throw Error(`Could not map COSE alg value of ${alg} to a WebCrypto alg`)}var init_mapCoseAlgToWebCryptoAlg=__esm(()=>{init_cose()});function getWebCrypto(){return new Promise((resolve2,reject)=>{if(webCrypto)return resolve2(webCrypto);let _globalThisCrypto=_getWebCryptoInternals.stubThisGlobalThisCrypto();if(_globalThisCrypto)return webCrypto=_globalThisCrypto,resolve2(webCrypto);return reject(new MissingWebCrypto)})}var webCrypto=void 0,MissingWebCrypto,_getWebCryptoInternals;var init_getWebCrypto=__esm(()=>{MissingWebCrypto=class MissingWebCrypto extends Error{constructor(){super("An instance of the Crypto API could not be located");this.name="MissingWebCrypto"}};_getWebCryptoInternals={stubThisGlobalThisCrypto:()=>globalThis.crypto,setCachedCrypto:(newCrypto)=>{webCrypto=newCrypto}}});async function digest(data,algorithm){let WebCrypto=await getWebCrypto(),subtleAlgorithm=mapCoseAlgToWebCryptoAlg(algorithm),hashed=await WebCrypto.subtle.digest(subtleAlgorithm,data);return new Uint8Array(hashed)}var init_digest=__esm(()=>{init_mapCoseAlgToWebCryptoAlg();init_getWebCrypto()});async function getRandomValues(array){return(await getWebCrypto()).getRandomValues(array),array}var init_getRandomValues=__esm(()=>{init_getWebCrypto()});async function importKey(opts){let WebCrypto=await getWebCrypto(),{keyData,algorithm}=opts;return WebCrypto.subtle.importKey("jwk",keyData,algorithm,!1,["verify"])}var init_importKey=__esm(()=>{init_getWebCrypto()});async function verifyEC2(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!alg)throw Error("Public key was missing alg (EC2)");if(!crv)throw Error("Public key was missing crv (EC2)");if(!x)throw Error("Public key was missing x (EC2)");if(!y)throw Error("Public key was missing y (EC2)");let _crv;if(crv===COSECRV.P256)_crv="P-256";else if(crv===COSECRV.P384)_crv="P-384";else if(crv===COSECRV.P521)_crv="P-521";else throw Error(`Unexpected COSE crv value of ${crv} (EC2)`);let keyData={kty:"EC",crv:_crv,x:exports_isoBase64URL.fromBuffer(x),y:exports_isoBase64URL.fromBuffer(y),ext:!1},key2=await importKey({keyData,algorithm:{name:"ECDSA",namedCurve:_crv}}),subtleAlg=mapCoseAlgToWebCryptoAlg(alg);if(shaHashOverride)subtleAlg=mapCoseAlgToWebCryptoAlg(shaHashOverride);let verifyAlgorithm={name:"ECDSA",hash:{name:subtleAlg}};return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyEC2=__esm(()=>{init_cose();init_mapCoseAlgToWebCryptoAlg();init_importKey();init_iso();init_getWebCrypto()});function mapCoseAlgToWebCryptoKeyAlgName(alg){if([COSEALG.EdDSA].indexOf(alg)>=0)return"Ed25519";else if([COSEALG.ES256,COSEALG.ES384,COSEALG.ES512,COSEALG.ES256K].indexOf(alg)>=0)return"ECDSA";else if([COSEALG.RS256,COSEALG.RS384,COSEALG.RS512,COSEALG.RS1].indexOf(alg)>=0)return"RSASSA-PKCS1-v1_5";else if([COSEALG.PS256,COSEALG.PS384,COSEALG.PS512].indexOf(alg)>=0)return"RSA-PSS";throw Error(`Could not map COSE alg value of ${alg} to a WebCrypto key alg name`)}var init_mapCoseAlgToWebCryptoKeyAlgName=__esm(()=>{init_cose()});async function verifyRSA(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!alg)throw Error("Public key was missing alg (RSA)");if(!isCOSEAlg(alg))throw Error(`Public key had invalid alg ${alg} (RSA)`);if(!n)throw Error("Public key was missing n (RSA)");if(!e)throw Error("Public key was missing e (RSA)");let keyData={kty:"RSA",alg:"",n:exports_isoBase64URL.fromBuffer(n),e:exports_isoBase64URL.fromBuffer(e),ext:!1},keyAlgorithm={name:mapCoseAlgToWebCryptoKeyAlgName(alg),hash:{name:mapCoseAlgToWebCryptoAlg(alg)}},verifyAlgorithm={name:mapCoseAlgToWebCryptoKeyAlgName(alg)};if(shaHashOverride)keyAlgorithm.hash.name=mapCoseAlgToWebCryptoAlg(shaHashOverride);if(keyAlgorithm.name==="RSASSA-PKCS1-v1_5"){if(keyAlgorithm.hash.name==="SHA-256")keyData.alg="RS256";else if(keyAlgorithm.hash.name==="SHA-384")keyData.alg="RS384";else if(keyAlgorithm.hash.name==="SHA-512")keyData.alg="RS512";else if(keyAlgorithm.hash.name==="SHA-1")keyData.alg="RS1"}else if(keyAlgorithm.name==="RSA-PSS"){let saltLength=0;if(keyAlgorithm.hash.name==="SHA-256")keyData.alg="PS256",saltLength=32;else if(keyAlgorithm.hash.name==="SHA-384")keyData.alg="PS384",saltLength=48;else if(keyAlgorithm.hash.name==="SHA-512")keyData.alg="PS512",saltLength=64;verifyAlgorithm.saltLength=saltLength}else throw Error(`Unexpected RSA key algorithm ${alg} (${keyAlgorithm.name})`);let key2=await importKey({keyData,algorithm:keyAlgorithm});return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyRSA=__esm(()=>{init_cose();init_mapCoseAlgToWebCryptoAlg();init_importKey();init_iso();init_mapCoseAlgToWebCryptoKeyAlgName();init_getWebCrypto()});function convertAAGUIDToString(aaguid){let hex=exports_isoUint8Array.toHex(aaguid);return[hex.slice(0,8),hex.slice(8,12),hex.slice(12,16),hex.slice(16,20),hex.slice(20,32)].join("-")}var init_convertAAGUIDToString=__esm(()=>{init_iso()});function convertCertBufferToPEM(certBuffer){let b64cert;if(typeof certBuffer==="string")if(exports_isoBase64URL.isBase64URL(certBuffer))b64cert=exports_isoBase64URL.toBase64(certBuffer);else if(exports_isoBase64URL.isBase64(certBuffer))b64cert=certBuffer;else throw Error("Certificate is not a valid base64 or base64url string");else b64cert=exports_isoBase64URL.fromBuffer(certBuffer,"base64");let PEMKey="";for(let i=0;i<Math.ceil(b64cert.length/64);i+=1){let start=64*i;PEMKey+=`${b64cert.substr(start,64)}
 `}return PEMKey=`-----BEGIN CERTIFICATE-----
 ${PEMKey}-----END CERTIFICATE-----
 `,PEMKey}var init_convertCertBufferToPEM=__esm(()=>{init_iso()});function convertCOSEtoPKCS(cosePublicKey){let struct=exports_isoCBOR.decodeFirst(cosePublicKey),tag=Uint8Array.from([4]),x=struct.get(COSEKEYS.x),y=struct.get(COSEKEYS.y);if(!x)throw Error("COSE public key was missing x");if(y)return exports_isoUint8Array.concat([tag,x,y]);return exports_isoUint8Array.concat([tag,x])}var init_convertCOSEtoPKCS=__esm(()=>{init_iso();init_cose()});function decodeAttestationObject(attestationObject){return _decodeAttestationObjectInternals.stubThis(exports_isoCBOR.decodeFirst(attestationObject))}var _decodeAttestationObjectInternals;var init_decodeAttestationObject=__esm(()=>{init_iso();_decodeAttestationObjectInternals={stubThis:(value)=>value}});function decodeClientDataJSON(data){let toString=exports_isoBase64URL.toUTF8String(data),clientData=JSON.parse(toString);return _decodeClientDataJSONInternals.stubThis(clientData)}var _decodeClientDataJSONInternals;var init_decodeClientDataJSON=__esm(()=>{init_iso();_decodeClientDataJSONInternals={stubThis:(value)=>value}});function decodeCredentialPublicKey(publicKey){return _decodeCredentialPublicKeyInternals.stubThis(exports_isoCBOR.decodeFirst(publicKey))}var _decodeCredentialPublicKeyInternals;var init_decodeCredentialPublicKey=__esm(()=>{init_iso();_decodeCredentialPublicKeyInternals={stubThis:(value)=>value}});async function generateUserID(){let newUserID=new Uint8Array(32);return await exports_isoCrypto.getRandomValues(newUserID),_generateUserIDInternals.stubThis(newUserID)}var _generateUserIDInternals;var init_generateUserID=__esm(()=>{init_iso();_generateUserIDInternals={stubThis:(value)=>value}});class BufferSourceConverter{static isArrayBuffer(data){return Object.prototype.toString.call(data)==="[object ArrayBuffer]"}static toArrayBuffer(data){if(this.isArrayBuffer(data))return data;if(data.byteLength===data.buffer.byteLength)return data.buffer;if(data.byteOffset===0&&data.byteLength===data.buffer.byteLength)return data.buffer;return this.toUint8Array(data.buffer).slice(data.byteOffset,data.byteOffset+data.byteLength).buffer}static toUint8Array(data){return this.toView(data,Uint8Array)}static toView(data,type){if(data.constructor===type)return data;if(this.isArrayBuffer(data))return new type(data);if(this.isArrayBufferView(data))return new type(data.buffer,data.byteOffset,data.byteLength);throw TypeError("The provided value is not of type '(ArrayBuffer or ArrayBufferView)'")}static isBufferSource(data){return this.isArrayBufferView(data)||this.isArrayBuffer(data)}static isArrayBufferView(data){return ArrayBuffer.isView(data)||data&&this.isArrayBuffer(data.buffer)}static isEqual(a,b){let aView=BufferSourceConverter.toUint8Array(a),bView=BufferSourceConverter.toUint8Array(b);if(aView.length!==bView.byteLength)return!1;for(let i=0;i<aView.length;i++)if(aView[i]!==bView[i])return!1;return!0}static concat(...args){let buffers;if(Array.isArray(args[0])&&!(args[1]instanceof Function))buffers=args[0];else if(Array.isArray(args[0])&&args[1]instanceof Function)buffers=args[0];else if(args[args.length-1]instanceof Function)buffers=args.slice(0,args.length-1);else buffers=args;let size=0;for(let buffer of buffers)size+=buffer.byteLength;let res=new Uint8Array(size),offset=0;for(let buffer of buffers){let view=this.toUint8Array(buffer);res.set(view,offset),offset+=view.length}if(args[args.length-1]instanceof Function)return this.toView(res,args[args.length-1]);return res.buffer}}class Utf8Converter{static fromString(text){let s=unescape(encodeURIComponent(text)),uintArray=new Uint8Array(s.length);for(let i=0;i<s.length;i++)uintArray[i]=s.charCodeAt(i);return uintArray.buffer}static toString(buffer){let buf=BufferSourceConverter.toUint8Array(buffer),encodedString="";for(let i=0;i<buf.length;i++)encodedString+=String.fromCharCode(buf[i]);return decodeURIComponent(escape(encodedString))}}class Utf16Converter{static toString(buffer,littleEndian=!1){let arrayBuffer=BufferSourceConverter.toArrayBuffer(buffer),dataView=new DataView(arrayBuffer),res="";for(let i=0;i<arrayBuffer.byteLength;i+=2){let code=dataView.getUint16(i,littleEndian);res+=String.fromCharCode(code)}return res}static fromString(text,littleEndian=!1){let res=new ArrayBuffer(text.length*2),dataView=new DataView(res);for(let i=0;i<text.length;i++)dataView.setUint16(i*2,text.charCodeAt(i),littleEndian);return res}}class Convert{static isHex(data){return typeof data===STRING_TYPE&&HEX_REGEX.test(data)}static isBase64(data){return typeof data===STRING_TYPE&&BASE64_REGEX.test(data)}static isBase64Url(data){return typeof data===STRING_TYPE&&BASE64URL_REGEX.test(data)}static ToString(buffer,enc="utf8"){let buf=BufferSourceConverter.toUint8Array(buffer);switch(enc.toLowerCase()){case"utf8":return this.ToUtf8String(buf);case"binary":return this.ToBinary(buf);case"hex":return this.ToHex(buf);case"base64":return this.ToBase64(buf);case"base64url":return this.ToBase64Url(buf);case"utf16le":return Utf16Converter.toString(buf,!0);case"utf16":case"utf16be":return Utf16Converter.toString(buf);default:throw Error(`Unknown type of encoding '${enc}'`)}}static FromString(str3,enc="utf8"){if(!str3)return new ArrayBuffer(0);switch(enc.toLowerCase()){case"utf8":return this.FromUtf8String(str3);case"binary":return this.FromBinary(str3);case"hex":return this.FromHex(str3);case"base64":return this.FromBase64(str3);case"base64url":return this.FromBase64Url(str3);case"utf16le":return Utf16Converter.fromString(str3,!0);case"utf16":case"utf16be":return Utf16Converter.fromString(str3);default:throw Error(`Unknown type of encoding '${enc}'`)}}static ToBase64(buffer){let buf=BufferSourceConverter.toUint8Array(buffer);if(typeof btoa<"u"){let binary=this.ToString(buf,"binary");return btoa(binary)}else return Buffer.from(buf).toString("base64")}static FromBase64(base642){let formatted=this.formatString(base642);if(!formatted)return new ArrayBuffer(0);if(!Convert.isBase64(formatted))throw TypeError("Argument 'base64Text' is not Base64 encoded");if(typeof atob<"u")return this.FromBinary(atob(formatted));else return new Uint8Array(Buffer.from(formatted,"base64")).buffer}static FromBase64Url(base64url){let formatted=this.formatString(base64url);if(!formatted)return new ArrayBuffer(0);if(!Convert.isBase64Url(formatted))throw TypeError("Argument 'base64url' is not Base64Url encoded");return this.FromBase64(this.Base64Padding(formatted.replace(/\-/g,"+").replace(/\_/g,"/")))}static ToBase64Url(data){return this.ToBase64(data).replace(/\+/g,"-").replace(/\//g,"_").replace(/\=/g,"")}static FromUtf8String(text,encoding=Convert.DEFAULT_UTF8_ENCODING){switch(encoding){case"ascii":return this.FromBinary(text);case"utf8":return Utf8Converter.fromString(text);case"utf16":case"utf16be":return Utf16Converter.fromString(text);case"utf16le":case"usc2":return Utf16Converter.fromString(text,!0);default:throw Error(`Unknown type of encoding '${encoding}'`)}}static ToUtf8String(buffer,encoding=Convert.DEFAULT_UTF8_ENCODING){switch(encoding){case"ascii":return this.ToBinary(buffer);case"utf8":return Utf8Converter.toString(buffer);case"utf16":case"utf16be":return Utf16Converter.toString(buffer);case"utf16le":case"usc2":return Utf16Converter.toString(buffer,!0);default:throw Error(`Unknown type of encoding '${encoding}'`)}}static FromBinary(text){let stringLength=text.length,resultView=new Uint8Array(stringLength);for(let i=0;i<stringLength;i++)resultView[i]=text.charCodeAt(i);return resultView.buffer}static ToBinary(buffer){let buf=BufferSourceConverter.toUint8Array(buffer),res="";for(let i=0;i<buf.length;i++)res+=String.fromCharCode(buf[i]);return res}static ToHex(buffer){let buf=BufferSourceConverter.toUint8Array(buffer),result="",len=buf.length;for(let i=0;i<len;i++){let byte=buf[i];if(byte<16)result+="0";result+=byte.toString(16)}return result}static FromHex(hexString){let formatted=this.formatString(hexString);if(!formatted)return new ArrayBuffer(0);if(!Convert.isHex(formatted))throw TypeError("Argument 'hexString' is not HEX encoded");if(formatted.length%2)formatted=`0${formatted}`;let res=new Uint8Array(formatted.length/2);for(let i=0;i<formatted.length;i=i+2){let c=formatted.slice(i,i+2);res[i/2]=parseInt(c,16)}return res.buffer}static ToUtf16String(buffer,littleEndian=!1){return Utf16Converter.toString(buffer,littleEndian)}static FromUtf16String(text,littleEndian=!1){return Utf16Converter.fromString(text,littleEndian)}static Base64Padding(base642){let padCount=4-base642.length%4;if(padCount<4)for(let i=0;i<padCount;i++)base642+="=";return base642}static formatString(data){return(data===null||data===void 0?void 0:data.replace(/[\n\r\t ]/g,""))||""}}function combine(...buf){let totalByteLength=buf.map((item)=>item.byteLength).reduce((prev,cur)=>prev+cur),res=new Uint8Array(totalByteLength),currentPos=0;return buf.map((item)=>new Uint8Array(item)).forEach((arr)=>{for(let item2 of arr)res[currentPos++]=item2}),res.buffer}function isEqual(bytes1,bytes2){if(!(bytes1&&bytes2))return!1;if(bytes1.byteLength!==bytes2.byteLength)return!1;let b1=new Uint8Array(bytes1),b2=new Uint8Array(bytes2);for(let i=0;i<bytes1.byteLength;i++)if(b1[i]!==b2[i])return!1;return!0}var STRING_TYPE="string",HEX_REGEX,BASE64_REGEX,BASE64URL_REGEX;var init_index_es=__esm(()=>{/*!
@@ -402,7 +402,7 @@ Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
 WD9f
 -----END CERTIFICATE-----
  `;class BaseSettingsService{constructor(){Object.defineProperty(this,"pemCertificates",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.pemCertificates=new Map}setRootCertificates(opts){let{identifier,certificates}=opts,newCertificates=[];for(let cert of certificates)if(cert instanceof Uint8Array)newCertificates.push(convertCertBufferToPEM(cert));else newCertificates.push(cert);this.pemCertificates.set(identifier,newCertificates)}getRootCertificates(opts){let{identifier}=opts;return this.pemCertificates.get(identifier)??[]}}var SettingsService;var init_settingsService=__esm(()=>{init_convertCertBufferToPEM();SettingsService=new BaseSettingsService;SettingsService.setRootCertificates({identifier:"android-key",certificates:[Google_Hardware_Attestation_Root_1,Google_Hardware_Attestation_Root_2,Google_Hardware_Attestation_Root_3,Google_Hardware_Attestation_Root_4]});SettingsService.setRootCertificates({identifier:"android-safetynet",certificates:[GlobalSign_Root_CA]});SettingsService.setRootCertificates({identifier:"apple",certificates:[Apple_WebAuthn_Root_CA]});SettingsService.setRootCertificates({identifier:"mds",certificates:[GlobalSign_Root_CA_R3]})});async function verifyMDSBlob(blob){let parsedJWT=parseJWT(blob),header=parsedJWT[0],payload=parsedJWT[1],headerCertsPEM=header.x5c.map(convertCertBufferToPEM);try{let rootCerts=SettingsService.getRootCertificates({identifier:"mds"});await validateCertificatePath(headerCertsPEM,rootCerts)}catch(error){throw Error("BLOB certificate path could not be validated",{cause:error})}let leafCert=headerCertsPEM[0];if(!await verifyJWT2(blob,convertPEMToBytes(leafCert)))throw Error("BLOB signature could not be verified");let statements=[];for(let entry of payload.entries)if(entry.aaguid&&entry.metadataStatement)statements.push(entry.metadataStatement);let[year,month,day]=payload.nextUpdate.split("-"),parsedNextUpdate=new Date(parseInt(year,10),parseInt(month,10)-1,parseInt(day,10));return{statements,parsedNextUpdate,payload}}var init_verifyMDSBlob=__esm(()=>{init_parseJWT();init_verifyJWT();init_validateCertificatePath();init_convertCertBufferToPEM();init_convertPEMToBytes();init_settingsService()});var init_helpers=__esm(()=>{init_cose();init_convertAAGUIDToString();init_convertCertBufferToPEM();init_convertCOSEtoPKCS();init_decodeAttestationObject();init_decodeClientDataJSON();init_decodeCredentialPublicKey();init_generateChallenge();init_generateUserID();init_getCertificateInfo();init_isCertRevoked();init_parseAuthenticatorData();init_toHash();init_validateCertificatePath();init_verifySignature();init_iso();init_verifyMDSBlob()});async function verifyOKP(opts){let{cosePublicKey,signature,data}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x);if(!alg)throw Error("Public key was missing alg (OKP)");if(!isCOSEAlg(alg))throw Error(`Public key had invalid alg ${alg} (OKP)`);if(!crv)throw Error("Public key was missing crv (OKP)");if(!x)throw Error("Public key was missing x (OKP)");let _crv;if(crv===COSECRV.ED25519)_crv="Ed25519";else throw Error(`Unexpected COSE crv value of ${crv} (OKP)`);let keyData={kty:"OKP",crv:_crv,alg:"EdDSA",x:exports_isoBase64URL.fromBuffer(x),ext:!1},key2=await importKey({keyData,algorithm:{name:_crv,namedCurve:_crv}}),verifyAlgorithm={name:_crv};return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyOKP=__esm(()=>{init_cose();init_helpers();init_importKey();init_getWebCrypto()});function unwrapEC2Signature(signature,crv){let parsedSignature=AsnParser.parse(signature,ECDSASigValue),rBytes=new Uint8Array(parsedSignature.r),sBytes=new Uint8Array(parsedSignature.s),componentLength=getSignatureComponentLength(crv),rNormalizedBytes=toNormalizedBytes(rBytes,componentLength),sNormalizedBytes=toNormalizedBytes(sBytes,componentLength);return exports_isoUint8Array.concat([rNormalizedBytes,sNormalizedBytes])}function getSignatureComponentLength(crv){switch(crv){case COSECRV.P256:return 32;case COSECRV.P384:return 48;case COSECRV.P521:return 66;default:throw Error(`Unexpected COSE crv value of ${crv} (EC2)`)}}function toNormalizedBytes(bytes,componentLength){let normalizedBytes;if(bytes.length<componentLength)normalizedBytes=new Uint8Array(componentLength),normalizedBytes.set(bytes,componentLength-bytes.length);else if(bytes.length===componentLength)normalizedBytes=bytes;else if(bytes.length===componentLength+1&&bytes[0]===0&&(bytes[1]&128)===128)normalizedBytes=bytes.subarray(1);else throw Error(`Invalid signature component length ${bytes.length}, expected ${componentLength}`);return normalizedBytes}var init_unwrapEC2Signature=__esm(()=>{init_es2015();init_es20155();init_cose();init_iso()});function verify(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts;if(isCOSEPublicKeyEC2(cosePublicKey)){let crv=cosePublicKey.get(COSEKEYS.crv);if(!isCOSECrv(crv))throw Error(`unknown COSE curve ${crv}`);let unwrappedSignature=unwrapEC2Signature(signature,crv);return verifyEC2({cosePublicKey,signature:unwrappedSignature,data,shaHashOverride})}else if(isCOSEPublicKeyRSA(cosePublicKey))return verifyRSA({cosePublicKey,signature,data,shaHashOverride});else if(isCOSEPublicKeyOKP(cosePublicKey))return verifyOKP({cosePublicKey,signature,data});let kty=cosePublicKey.get(COSEKEYS.kty);throw Error(`Signature verification with public key of kty ${kty} is not supported by this method`)}var init_verify=__esm(()=>{init_cose();init_verifyEC2();init_verifyRSA();init_verifyOKP();init_unwrapEC2Signature()});var exports_isoCrypto={};__export(exports_isoCrypto,{verify:()=>verify,getRandomValues:()=>getRandomValues,digest:()=>digest});var init_isoCrypto=__esm(()=>{init_digest();init_getRandomValues();init_verify()});var exports_isoUint8Array={};__export(exports_isoUint8Array,{toUTF8String:()=>toUTF8String2,toHex:()=>toHex,toDataView:()=>toDataView,fromUTF8String:()=>fromUTF8String2,fromHex:()=>fromHex,fromASCIIString:()=>fromASCIIString,concat:()=>concat3,areEqual:()=>areEqual});function areEqual(array1,array2){if(array1.length!=array2.length)return!1;return array1.every((val,i)=>val===array2[i])}function toHex(array){return Array.from(array,(i)=>i.toString(16).padStart(2,"0")).join("")}function fromHex(hex2){if(!hex2)return Uint8Array.from([]);if(!(hex2.length!==0&&hex2.length%2===0&&!/[^a-fA-F0-9]/u.test(hex2)))throw Error("Invalid hex string");let byteStrings=hex2.match(/.{1,2}/g)??[];return Uint8Array.from(byteStrings.map((byte)=>parseInt(byte,16)))}function concat3(arrays){let pointer=0,totalLength=arrays.reduce((prev,curr)=>prev+curr.length,0),toReturn=new Uint8Array(totalLength);return arrays.forEach((arr)=>{toReturn.set(arr,pointer),pointer+=arr.length}),toReturn}function toUTF8String2(array){return new globalThis.TextDecoder("utf-8").decode(array)}function fromUTF8String2(utf8String){return new globalThis.TextEncoder().encode(utf8String)}function fromASCIIString(value){return Uint8Array.from(value.split("").map((x)=>x.charCodeAt(0)))}function toDataView(array){return new DataView(array.buffer,array.byteOffset,array.length)}var init_iso=__esm(()=>{init_isoBase64URL();init_isoCBOR();init_isoCrypto()});async function generateChallenge2(){let challenge=new Uint8Array(32);return await exports_isoCrypto.getRandomValues(challenge),_generateChallengeInternals.stubThis(challenge)}var _generateChallengeInternals;var init_generateChallenge=__esm(()=>{init_iso();_generateChallengeInternals={stubThis:(value)=>value}});async function generateRegistrationOptions(options){let{rpName,rpID,userName,userID,challenge=await generateChallenge2(),userDisplayName="",timeout=60000,attestationType="none",excludeCredentials=[],authenticatorSelection=defaultAuthenticatorSelection,extensions:extensions2,supportedAlgorithmIDs=defaultSupportedAlgorithmIDs,preferredAuthenticatorType}=options,pubKeyCredParams=supportedAlgorithmIDs.map((id)=>({alg:id,type:"public-key"}));if(authenticatorSelection.residentKey===void 0){if(authenticatorSelection.requireResidentKey)authenticatorSelection.residentKey="required"}else authenticatorSelection.requireResidentKey=authenticatorSelection.residentKey==="required";let _challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);if(typeof userID==="string")throw Error("String values for `userID` are no longer supported. See https://simplewebauthn.dev/docs/advanced/server/custom-user-ids");let _userID=userID;if(!_userID)_userID=await generateUserID();let hints=[];if(preferredAuthenticatorType){if(preferredAuthenticatorType==="securityKey")hints.push("security-key"),authenticatorSelection.authenticatorAttachment="cross-platform";else if(preferredAuthenticatorType==="localDevice")hints.push("client-device"),authenticatorSelection.authenticatorAttachment="platform";else if(preferredAuthenticatorType==="remoteDevice")hints.push("hybrid"),authenticatorSelection.authenticatorAttachment="cross-platform"}return{challenge:exports_isoBase64URL.fromBuffer(_challenge),rp:{name:rpName,id:rpID},user:{id:exports_isoBase64URL.fromBuffer(_userID),name:userName,displayName:userDisplayName},pubKeyCredParams,timeout,attestation:attestationType,excludeCredentials:excludeCredentials.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`excludeCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),authenticatorSelection,extensions:{...extensions2,credProps:!0},hints}}var supportedCOSEAlgorithmIdentifiers,defaultAuthenticatorSelection,defaultSupportedAlgorithmIDs;var init_generateRegistrationOptions=__esm(()=>{init_generateChallenge();init_generateUserID();init_iso();supportedCOSEAlgorithmIdentifiers=[-8,-7,-36,-37,-38,-39,-257,-258,-259,-65535],defaultAuthenticatorSelection={residentKey:"preferred",userVerification:"preferred"},defaultSupportedAlgorithmIDs=[-8,-7,-257]});function parseBackupFlags({be,bs}){let credentialBackedUp=bs,credentialDeviceType="singleDevice";if(be)credentialDeviceType="multiDevice";if(credentialDeviceType==="singleDevice"&&credentialBackedUp)throw new InvalidBackupFlags("Single-device credential indicated that it was backed up, which should be impossible.");return{credentialDeviceType,credentialBackedUp}}var InvalidBackupFlags;var init_parseBackupFlags=__esm(()=>{InvalidBackupFlags=class InvalidBackupFlags extends Error{constructor(message){super(message);this.name="InvalidBackupFlags"}}});async function matchExpectedRPID(rpIDHash,expectedRPIDs){try{return await Promise.any(expectedRPIDs.map((expected)=>{return new Promise((resolve2,reject)=>{toHash(exports_isoUint8Array.fromASCIIString(expected)).then((expectedRPIDHash)=>{if(exports_isoUint8Array.areEqual(rpIDHash,expectedRPIDHash))resolve2(expected);else reject()})})}))}catch(err){if(err.name==="AggregateError")throw new UnexpectedRPIDHash;throw err}}var UnexpectedRPIDHash;var init_matchExpectedRPID=__esm(()=>{init_toHash();init_iso();UnexpectedRPIDHash=class UnexpectedRPIDHash extends Error{constructor(){super("Unexpected RP ID hash");this.name="UnexpectedRPIDHash"}}});async function verifyAttestationFIDOU2F(options){let{attStmt,clientDataHash,rpIdHash,credentialID,credentialPublicKey,aaguid,rootCertificates}=options,reservedByte=Uint8Array.from([0]),publicKey=convertCOSEtoPKCS(credentialPublicKey),signatureBase=exports_isoUint8Array.concat([reservedByte,rpIdHash,clientDataHash,credentialID,publicKey]),sig=attStmt.get("sig"),x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (FIDOU2F)");if(!sig)throw Error("No attestation signature provided in attestation statement (FIDOU2F)");let aaguidToHex=Number.parseInt(exports_isoUint8Array.toHex(aaguid),16);if(aaguidToHex!==0)throw Error(`AAGUID "${aaguidToHex}" was not expected value`);try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (FIDOU2F)`)}return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:COSEALG.ES256})}var init_verifyAttestationFIDOU2F=__esm(()=>{init_convertCOSEtoPKCS();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_iso();init_cose()});function validateExtFIDOGenCEAAGUID(certExtensions,aaguid){if(!certExtensions)return!0;let extFIDOGenCEAAGUID=certExtensions.find((ext)=>ext.extnID===id_fido_gen_ce_aaguid);if(!extFIDOGenCEAAGUID)return!0;let parsedExtFIDOGenCEAAGUID=AsnParser.parse(extFIDOGenCEAAGUID.extnValue,OctetString2),extValue=new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);if(!exports_isoUint8Array.areEqual(aaguid,extValue)){let _debugExtHex=exports_isoUint8Array.toHex(extValue),_debugAAGUIDHex=exports_isoUint8Array.toHex(aaguid);throw Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`)}return!0}var id_fido_gen_ce_aaguid="1.3.6.1.4.1.45724.1.1.4";var init_validateExtFIDOGenCEAAGUID=__esm(()=>{init_es2015();init_iso()});function getLogger(_name){return(_message,..._rest)=>{}}class BaseMetadataService{constructor(){Object.defineProperty(this,"mdsCache",{enumerable:!0,configurable:!0,writable:!0,value:{}}),Object.defineProperty(this,"statementCache",{enumerable:!0,configurable:!0,writable:!0,value:{}}),Object.defineProperty(this,"state",{enumerable:!0,configurable:!0,writable:!0,value:SERVICE_STATE.DISABLED}),Object.defineProperty(this,"verificationMode",{enumerable:!0,configurable:!0,writable:!0,value:"strict"})}async initialize(opts={}){this.statementCache={};let{mdsServers=[defaultURLMDS],statements,verificationMode}=opts;if(this.setState(SERVICE_STATE.REFRESHING),statements?.length){let statementsAdded=0;statements.forEach((statement)=>{if(statement.aaguid)this.statementCache[statement.aaguid]={entry:{metadataStatement:statement,statusReports:[],timeOfLastStatusChange:"1970-01-01"},url:NonRefreshingMDS.url},statementsAdded+=1}),log(`Cached ${statementsAdded} local statements`)}if(mdsServers?.length){let currentCacheCount=Object.keys(this.statementCache).length,numServers=mdsServers.length;for(let url of mdsServers)try{let cachedMDS={url,no:0,nextUpdate:new Date(0)},blob=await this.downloadBlob(cachedMDS);await this.verifyBlob(blob,cachedMDS)}catch(err){log(`Could not download BLOB from ${url}:`,err),numServers-=1}let cacheDiff=Object.keys(this.statementCache).length-currentCacheCount;log(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`)}if(verificationMode)this.verificationMode=verificationMode;this.setState(SERVICE_STATE.READY)}async getStatement(aaguid){if(this.state===SERVICE_STATE.DISABLED)return;if(!aaguid)return;if(aaguid instanceof Uint8Array)aaguid=convertAAGUIDToString(aaguid);await this.pauseUntilReady();let cachedStatement=this.statementCache[aaguid];if(!cachedStatement){if(this.verificationMode==="strict")throw Error(`No metadata statement found for aaguid "${aaguid}"`);return}if(cachedStatement.url){let mds=this.mdsCache[cachedStatement.url];if(new Date>mds.nextUpdate)try{this.setState(SERVICE_STATE.REFRESHING);let blob=await this.downloadBlob(mds);await this.verifyBlob(blob,mds)}finally{this.setState(SERVICE_STATE.READY)}}let{entry}=cachedStatement;for(let report of entry.statusReports){let{status}=report;if(status==="USER_VERIFICATION_BYPASS"||status==="ATTESTATION_KEY_COMPROMISE"||status==="USER_KEY_REMOTE_COMPROMISE"||status==="USER_KEY_PHYSICAL_COMPROMISE")throw Error(`Detected compromised aaguid "${aaguid}"`)}return entry.metadataStatement}async downloadBlob(cachedMDS){let{url}=cachedMDS;return await(await fetch2(url)).text()}async verifyBlob(blob,cachedMDS){let{url,no}=cachedMDS,{payload,parsedNextUpdate}=await verifyMDSBlob(blob);if(payload.no<=no)throw Error(`Latest BLOB no. ${payload.no} is not greater than previous no. ${no}`);for(let entry of payload.entries)if(entry.aaguid)this.statementCache[entry.aaguid]={entry,url};if(url)this.mdsCache[url]={...cachedMDS,no:payload.no,nextUpdate:parsedNextUpdate};else if(parsedNextUpdate<new Date)log(`\u26A0\uFE0F This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`)}pauseUntilReady(){if(this.state===SERVICE_STATE.READY)return new Promise((resolve2)=>{resolve2()});return new Promise((resolve2,reject)=>{let iterations=700,intervalID=globalThis.setInterval(()=>{if(iterations<1)clearInterval(intervalID),reject("State did not become ready in 70 seconds");else if(this.state===SERVICE_STATE.READY)clearInterval(intervalID),resolve2();iterations-=1},100)})}setState(newState){if(this.state=newState,newState===SERVICE_STATE.DISABLED)log("MetadataService is DISABLED");else if(newState===SERVICE_STATE.REFRESHING)log("MetadataService is REFRESHING");else if(newState===SERVICE_STATE.READY)log("MetadataService is READY")}}var NonRefreshingMDS,defaultURLMDS="https://mds.fidoalliance.org/",SERVICE_STATE,log,MetadataService;var init_metadataService=__esm(()=>{init_convertAAGUIDToString();init_verifyMDSBlob();init_fetch();NonRefreshingMDS={url:"",no:0,nextUpdate:new Date(0)};(function(SERVICE_STATE2){SERVICE_STATE2[SERVICE_STATE2.DISABLED=0]="DISABLED",SERVICE_STATE2[SERVICE_STATE2.REFRESHING=1]="REFRESHING",SERVICE_STATE2[SERVICE_STATE2.READY=2]="READY"})(SERVICE_STATE||(SERVICE_STATE={}));log=getLogger("MetadataService");MetadataService=new BaseMetadataService});async function verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg}){let{authenticationAlgorithms,authenticatorGetInfo,attestationRootCertificates}=statement,keypairCOSEAlgs=new Set;authenticationAlgorithms.forEach((algSign)=>{let algSignCOSEINFO=algSignToCOSEInfoMap[algSign];if(algSignCOSEINFO)keypairCOSEAlgs.add(algSignCOSEINFO)});let decodedPublicKey=decodeCredentialPublicKey(credentialPublicKey),kty=decodedPublicKey.get(COSEKEYS.kty),alg=decodedPublicKey.get(COSEKEYS.alg);if(!kty)throw Error("Credential public key was missing kty");if(!alg)throw Error("Credential public key was missing alg");if(!kty)throw Error("Credential public key was missing kty");let publicKeyCOSEInfo={kty,alg};if(isCOSEPublicKeyEC2(decodedPublicKey)){let crv=decodedPublicKey.get(COSEKEYS.crv);publicKeyCOSEInfo.crv=crv}let foundMatch=!1;for(let keypairAlg of keypairCOSEAlgs){if(keypairAlg.alg===publicKeyCOSEInfo.alg&&keypairAlg.kty===publicKeyCOSEInfo.kty)if((keypairAlg.kty===COSEKTY.EC2||keypairAlg.kty===COSEKTY.OKP)&&keypairAlg.crv===publicKeyCOSEInfo.crv)foundMatch=!0;else foundMatch=!0;if(foundMatch)break}if(!foundMatch){let debugMDSAlgs=authenticationAlgorithms.map((algSign)=>`'${algSign}' (COSE info: ${stringifyCOSEInfo(algSignToCOSEInfoMap[algSign])})`),strMDSAlgs=JSON.stringify(debugMDSAlgs,null,2).replace(/"/g,""),strPubKeyAlg=stringifyCOSEInfo(publicKeyCOSEInfo);throw Error(`Public key parameters ${strPubKeyAlg} did not match any of the following metadata algorithms:
-${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algorithms!==void 0){let getInfoAlgs=authenticatorGetInfo.algorithms.map((_alg)=>_alg.alg);if(getInfoAlgs.indexOf(attestationStatementAlg)<0)throw Error(`Attestation statement alg ${attestationStatementAlg} did not match one of ${getInfoAlgs}`)}let authenticatorCerts=x5c.map(convertCertBufferToPEM),statementRootCerts=attestationRootCertificates.map(convertCertBufferToPEM),authenticatorIsSelfReferencing=!1;if(authenticatorCerts.length===1&&statementRootCerts.indexOf(authenticatorCerts[0])>=0)authenticatorIsSelfReferencing=!0;if(!authenticatorIsSelfReferencing)try{await validateCertificatePath(authenticatorCerts,statementRootCerts)}catch(err){throw Error(`Could not validate certificate path with any metadata root certificates: ${err.message}`)}return!0}function stringifyCOSEInfo(info){let{kty,alg,crv}=info,toReturn="";if(kty!==COSEKTY.RSA)toReturn=`{ kty: ${kty}, alg: ${alg}, crv: ${crv} }`;else toReturn=`{ kty: ${kty}, alg: ${alg} }`;return toReturn}var algSignToCOSEInfoMap;var init_verifyAttestationWithMetadata=__esm(()=>{init_convertCertBufferToPEM();init_validateCertificatePath();init_decodeCredentialPublicKey();init_cose();algSignToCOSEInfoMap={secp256r1_ecdsa_sha256_raw:{kty:2,alg:-7,crv:1},secp256r1_ecdsa_sha256_der:{kty:2,alg:-7,crv:1},rsassa_pss_sha256_raw:{kty:3,alg:-37},rsassa_pss_sha256_der:{kty:3,alg:-37},secp256k1_ecdsa_sha256_raw:{kty:2,alg:-47,crv:8},secp256k1_ecdsa_sha256_der:{kty:2,alg:-47,crv:8},rsassa_pss_sha384_raw:{kty:3,alg:-38},rsassa_pkcsv15_sha256_raw:{kty:3,alg:-257},rsassa_pkcsv15_sha384_raw:{kty:3,alg:-258},rsassa_pkcsv15_sha512_raw:{kty:3,alg:-259},rsassa_pkcsv15_sha1_raw:{kty:3,alg:-65535},secp384r1_ecdsa_sha384_raw:{kty:2,alg:-35,crv:2},secp512r1_ecdsa_sha256_raw:{kty:2,alg:-36,crv:3},ed25519_eddsa_sha512_raw:{kty:1,alg:-8,crv:6}}});async function verifyAttestationPacked(options){let{attStmt,clientDataHash,authData,credentialPublicKey,aaguid,rootCertificates}=options,sig=attStmt.get("sig"),x5c=attStmt.get("x5c"),alg=attStmt.get("alg");if(!sig)throw Error("No attestation signature provided in attestation statement (Packed)");if(!alg)throw Error("Attestation statement did not contain alg (Packed)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Packed)`);let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]),verified=!1;if(x5c){let{subject,basicConstraintsCA,version,notBefore,notAfter,parsedCertificate}=getCertificateInfo(x5c[0]),{OU,CN,O,C}=subject;if(OU!=="Authenticator Attestation")throw Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');if(!CN)throw Error("Certificate CN was empty (Packed|Full)");if(!O)throw Error("Certificate O was empty (Packed|Full)");if(!C||C.length!==2)throw Error("Certificate C was not two-character ISO 3166 code (Packed|Full)");if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (Packed|Full)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (Packed|Full)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (Packed|Full)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);try{await validateExtFIDOGenCEAAGUID(parsedCertificate.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (Packed|Full)`)}let statement=await MetadataService.getStatement(aaguid);if(statement){if(statement.attestationTypes.indexOf("basic_full")<0)throw Error("Metadata does not indicate support for full attestations (Packed|Full)");try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (Packed|Full)`)}}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Packed|Full)`)}verified=await verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0]})}else verified=await verifySignature2({signature:sig,data:signatureBase,credentialPublicKey,hashAlgorithm:alg});return verified}var init_verifyAttestationPacked=__esm(()=>{init_cose();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationAndroidSafetyNet(options){let{attStmt,clientDataHash,authData,aaguid,rootCertificates,verifyTimestampMS=!0,credentialPublicKey,attestationSafetyNetEnforceCTSCheck}=options,alg=attStmt.get("alg"),response=attStmt.get("response");if(!attStmt.get("ver"))throw Error("No ver value in attestation (SafetyNet)");if(!response)throw Error("No response was included in attStmt by authenticator (SafetyNet)");let jwtParts=exports_isoUint8Array.toUTF8String(response).split("."),HEADER=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[0])),PAYLOAD=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[1])),SIGNATURE=jwtParts[2],{nonce,ctsProfileMatch,timestampMs}=PAYLOAD;if(verifyTimestampMS){let now=Date.now();if(timestampMs>Date.now())throw Error(`Payload timestamp "${timestampMs}" was later than "${now}" (SafetyNet)`);let timestampPlusDelay=timestampMs+60000;if(now=Date.now(),timestampPlusDelay<now)throw Error(`Payload timestamp "${timestampPlusDelay}" has expired (SafetyNet)`)}let nonceBase=exports_isoUint8Array.concat([authData,clientDataHash]),nonceBuffer=await toHash(nonceBase),expectedNonce=exports_isoBase64URL.fromBuffer(nonceBuffer,"base64");if(nonce!==expectedNonce)throw Error("Could not verify payload nonce (SafetyNet)");if(attestationSafetyNetEnforceCTSCheck&&!ctsProfileMatch)throw Error("Could not verify device integrity (SafetyNet)");let leafCertBuffer=exports_isoBase64URL.toBuffer(HEADER.x5c[0],"base64"),leafCertInfo=getCertificateInfo(leafCertBuffer),{subject}=leafCertInfo;if(subject.CN!=="attest.android.com")throw Error('Certificate common name was not "attest.android.com" (SafetyNet)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c:HEADER.x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (SafetyNet)`)}else try{await validateCertificatePath(HEADER.x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (SafetyNet)`)}let signatureBaseBuffer=exports_isoUint8Array.fromUTF8String(`${jwtParts[0]}.${jwtParts[1]}`),signatureBuffer=exports_isoBase64URL.toBuffer(SIGNATURE);return await verifySignature2({signature:signatureBuffer,data:signatureBaseBuffer,x509Certificate:leafCertBuffer})}var init_verifyAttestationAndroidSafetyNet=__esm(()=>{init_toHash();init_verifySignature();init_getCertificateInfo();init_validateCertificatePath();init_convertCertBufferToPEM();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});var TPM_ST,TPM_ALG,TPM_ECC_CURVE,TPM_MANUFACTURERS,TPM_ECC_CURVE_COSE_CRV_MAP;var init_constants2=__esm(()=>{TPM_ST={196:"TPM_ST_RSP_COMMAND",32768:"TPM_ST_NULL",32769:"TPM_ST_NO_SESSIONS",32770:"TPM_ST_SESSIONS",32788:"TPM_ST_ATTEST_NV",32789:"TPM_ST_ATTEST_COMMAND_AUDIT",32790:"TPM_ST_ATTEST_SESSION_AUDIT",32791:"TPM_ST_ATTEST_CERTIFY",32792:"TPM_ST_ATTEST_QUOTE",32793:"TPM_ST_ATTEST_TIME",32794:"TPM_ST_ATTEST_CREATION",32801:"TPM_ST_CREATION",32802:"TPM_ST_VERIFIED",32803:"TPM_ST_AUTH_SECRET",32804:"TPM_ST_HASHCHECK",32805:"TPM_ST_AUTH_SIGNED",32809:"TPM_ST_FU_MANIFEST"},TPM_ALG={0:"TPM_ALG_ERROR",1:"TPM_ALG_RSA",4:"TPM_ALG_SHA",4:"TPM_ALG_SHA1",5:"TPM_ALG_HMAC",6:"TPM_ALG_AES",7:"TPM_ALG_MGF1",8:"TPM_ALG_KEYEDHASH",10:"TPM_ALG_XOR",11:"TPM_ALG_SHA256",12:"TPM_ALG_SHA384",13:"TPM_ALG_SHA512",16:"TPM_ALG_NULL",18:"TPM_ALG_SM3_256",19:"TPM_ALG_SM4",20:"TPM_ALG_RSASSA",21:"TPM_ALG_RSAES",22:"TPM_ALG_RSAPSS",23:"TPM_ALG_OAEP",24:"TPM_ALG_ECDSA",25:"TPM_ALG_ECDH",26:"TPM_ALG_ECDAA",27:"TPM_ALG_SM2",28:"TPM_ALG_ECSCHNORR",29:"TPM_ALG_ECMQV",32:"TPM_ALG_KDF1_SP800_56A",33:"TPM_ALG_KDF2",34:"TPM_ALG_KDF1_SP800_108",35:"TPM_ALG_ECC",37:"TPM_ALG_SYMCIPHER",38:"TPM_ALG_CAMELLIA",64:"TPM_ALG_CTR",65:"TPM_ALG_OFB",66:"TPM_ALG_CBC",67:"TPM_ALG_CFB",68:"TPM_ALG_ECB"},TPM_ECC_CURVE={0:"TPM_ECC_NONE",1:"TPM_ECC_NIST_P192",2:"TPM_ECC_NIST_P224",3:"TPM_ECC_NIST_P256",4:"TPM_ECC_NIST_P384",5:"TPM_ECC_NIST_P521",16:"TPM_ECC_BN_P256",17:"TPM_ECC_BN_P638",32:"TPM_ECC_SM2_P256"},TPM_MANUFACTURERS={"id:414D4400":{name:"AMD",id:"AMD"},"id:414E5400":{name:"Ant Group",id:"ANT"},"id:41544D4C":{name:"Atmel",id:"ATML"},"id:4252434D":{name:"Broadcom",id:"BRCM"},"id:4353434F":{name:"Cisco",id:"CSCO"},"id:464C5953":{name:"Flyslice Technologies",id:"FLYS"},"id:524F4343":{name:"Fuzhou Rockchip",id:"ROCC"},"id:474F4F47":{name:"Google",id:"GOOG"},"id:48504900":{name:"HPI",id:"HPI"},"id:48504500":{name:"HPE",id:"HPE"},"id:48495349":{name:"Huawei",id:"HISI"},"id:49424d00":{name:"IBM",id:"IBM"},"id:49424D00":{name:"IBM",id:"IBM"},"id:49465800":{name:"Infineon",id:"IFX"},"id:494E5443":{name:"Intel",id:"INTC"},"id:4C454E00":{name:"Lenovo",id:"LEN"},"id:4D534654":{name:"Microsoft",id:"MSFT"},"id:4E534D20":{name:"National Semiconductor",id:"NSM"},"id:4E545A00":{name:"Nationz",id:"NTZ"},"id:4E534700":{name:"NSING",id:"NSG"},"id:4E544300":{name:"Nuvoton Technology",id:"NTC"},"id:51434F4D":{name:"Qualcomm",id:"QCOM"},"id:534D534E":{name:"Samsung",id:"SMSN"},"id:53454345":{name:"SecEdge",id:"SECE"},"id:534E5300":{name:"Sinosun",id:"SNS"},"id:534D5343":{name:"SMSC",id:"SMSC"},"id:53544D20":{name:"STMicroelectronics",id:"STM"},"id:54584E00":{name:"Texas Instruments",id:"TXN"},"id:57454300":{name:"Winbond",id:"WEC"},"id:5345414C":{name:"Wisekey",id:"SEAL"},"id:FFFFF1D0":{name:"FIDO Alliance",id:"FIDO"}},TPM_ECC_CURVE_COSE_CRV_MAP={TPM_ECC_NIST_P256:1,TPM_ECC_NIST_P384:2,TPM_ECC_NIST_P521:3,TPM_ECC_BN_P256:1,TPM_ECC_SM2_P256:1}});function parseCertInfo(certInfo){let pointer=0,dataView=exports_isoUint8Array.toDataView(certInfo),magic=dataView.getUint32(pointer);pointer+=4;let typeBuffer=dataView.getUint16(pointer);pointer+=2;let type=TPM_ST[typeBuffer],qualifiedSignerLength=dataView.getUint16(pointer);pointer+=2;let qualifiedSigner=certInfo.slice(pointer,pointer+=qualifiedSignerLength),extraDataLength=dataView.getUint16(pointer);pointer+=2;let extraData=certInfo.slice(pointer,pointer+=extraDataLength),clock=certInfo.slice(pointer,pointer+=8),resetCount=dataView.getUint32(pointer);pointer+=4;let restartCount=dataView.getUint32(pointer);pointer+=4;let safe=!!certInfo.slice(pointer,pointer+=1),clockInfo={clock,resetCount,restartCount,safe},firmwareVersion=certInfo.slice(pointer,pointer+=8),attestedNameLength=dataView.getUint16(pointer);pointer+=2;let attestedName=certInfo.slice(pointer,pointer+=attestedNameLength),attestedNameDataView=exports_isoUint8Array.toDataView(attestedName),qualifiedNameLength=dataView.getUint16(pointer);pointer+=2;let qualifiedName=certInfo.slice(pointer,pointer+=qualifiedNameLength),attested={nameAlg:TPM_ALG[attestedNameDataView.getUint16(0)],nameAlgBuffer:attestedName.slice(0,2),name:attestedName,qualifiedName};return{magic,type,qualifiedSigner,extraData,clockInfo,firmwareVersion,attested}}var init_parseCertInfo=__esm(()=>{init_constants2();init_iso()});function parsePubArea(pubArea){let pointer=0,dataView=exports_isoUint8Array.toDataView(pubArea),type=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let nameAlg=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let objectAttributesInt=dataView.getUint32(pointer);pointer+=4;let objectAttributes={fixedTPM:!!(objectAttributesInt&1),stClear:!!(objectAttributesInt&2),fixedParent:!!(objectAttributesInt&8),sensitiveDataOrigin:!!(objectAttributesInt&16),userWithAuth:!!(objectAttributesInt&32),adminWithPolicy:!!(objectAttributesInt&64),noDA:!!(objectAttributesInt&512),encryptedDuplication:!!(objectAttributesInt&1024),restricted:!!(objectAttributesInt&32768),decrypt:!!(objectAttributesInt&65536),signOrEncrypt:!!(objectAttributesInt&131072)},authPolicyLength=dataView.getUint16(pointer);pointer+=2;let authPolicy=pubArea.slice(pointer,pointer+=authPolicyLength),parameters2={},unique=Uint8Array.from([]);if(type==="TPM_ALG_RSA"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let keyBits=dataView.getUint16(pointer);pointer+=2;let exponent=dataView.getUint32(pointer);pointer+=4,parameters2.rsa={symmetric,scheme,keyBits,exponent};let uniqueLength=dataView.getUint16(pointer);pointer+=2,unique=pubArea.slice(pointer,pointer+=uniqueLength)}else if(type==="TPM_ALG_ECC"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let curveID=TPM_ECC_CURVE[dataView.getUint16(pointer)];pointer+=2;let kdf=TPM_ALG[dataView.getUint16(pointer)];pointer+=2,parameters2.ecc={symmetric,scheme,curveID,kdf};let uniqueXLength=dataView.getUint16(pointer);pointer+=2;let uniqueX=pubArea.slice(pointer,pointer+=uniqueXLength),uniqueYLength=dataView.getUint16(pointer);pointer+=2;let uniqueY=pubArea.slice(pointer,pointer+=uniqueYLength);unique=exports_isoUint8Array.concat([uniqueX,uniqueY])}else throw Error(`Unexpected type "${type}" (TPM)`);return{type,nameAlg,objectAttributes,authPolicy,parameters:parameters2,unique}}var init_parsePubArea=__esm(()=>{init_constants2();init_iso()});async function verifyAttestationTPM(options){let{aaguid,attStmt,authData,credentialPublicKey,clientDataHash,rootCertificates}=options,ver=attStmt.get("ver"),sig=attStmt.get("sig"),alg=attStmt.get("alg"),x5c=attStmt.get("x5c"),pubArea=attStmt.get("pubArea"),certInfo=attStmt.get("certInfo");if(ver!=="2.0")throw Error(`Unexpected ver "${ver}", expected "2.0" (TPM)`);if(!sig)throw Error("No attestation signature provided in attestation statement (TPM)");if(!alg)throw Error("Attestation statement did not contain alg (TPM)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (TPM)`);if(!x5c)throw Error("No attestation certificate provided in attestation statement (TPM)");if(!pubArea)throw Error("Attestation statement did not contain pubArea (TPM)");if(!certInfo)throw Error("Attestation statement did not contain certInfo (TPM)");let parsedPubArea=parsePubArea(pubArea),{unique,type:pubType,parameters:parameters2}=parsedPubArea,cosePublicKey=decodeCredentialPublicKey(credentialPublicKey);if(pubType==="TPM_ALG_RSA"){if(!isCOSEPublicKeyRSA(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!n)throw Error("COSE public key missing n (TPM|RSA)");if(!e)throw Error("COSE public key missing e (TPM|RSA)");if(!exports_isoUint8Array.areEqual(unique,n))throw Error("PubArea unique is not same as credentialPublicKey (TPM|RSA)");if(!parameters2.rsa)throw Error("Parsed pubArea type is RSA, but missing parameters.rsa (TPM|RSA)");let eBuffer=e,pubAreaExponent=parameters2.rsa.exponent||65537,eSum=eBuffer[0]+(eBuffer[1]<<8)+(eBuffer[2]<<16);if(pubAreaExponent!==eSum)throw Error(`Unexpected public key exp ${eSum}, expected ${pubAreaExponent} (TPM|RSA)`)}else if(pubType==="TPM_ALG_ECC"){if(!isCOSEPublicKeyEC2(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!crv)throw Error("COSE public key missing crv (TPM|ECC)");if(!x)throw Error("COSE public key missing x (TPM|ECC)");if(!y)throw Error("COSE public key missing y (TPM|ECC)");if(!exports_isoUint8Array.areEqual(unique,exports_isoUint8Array.concat([x,y])))throw Error("PubArea unique is not same as public key x and y (TPM|ECC)");if(!parameters2.ecc)throw Error("Parsed pubArea type is ECC, but missing parameters.ecc (TPM|ECC)");let pubAreaCurveID=parameters2.ecc.curveID,pubAreaCurveIDMapToCOSECRV=TPM_ECC_CURVE_COSE_CRV_MAP[pubAreaCurveID];if(pubAreaCurveIDMapToCOSECRV!==crv)throw Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${crv}" (TPM|ECC)`)}else throw Error(`Unsupported pubArea.type "${pubType}"`);let parsedCertInfo=parseCertInfo(certInfo),{magic,type:certType,attested,extraData}=parsedCertInfo;if(magic!==4283712327)throw Error(`Unexpected magic value "${magic}", expected "0xff544347" (TPM)`);if(certType!=="TPM_ST_ATTEST_CERTIFY")throw Error(`Unexpected type "${certType}", expected "TPM_ST_ATTEST_CERTIFY" (TPM)`);let pubAreaHash=await toHash(pubArea,attestedNameAlgToCOSEAlg(attested.nameAlg)),attestedName=exports_isoUint8Array.concat([attested.nameAlgBuffer,pubAreaHash]);if(!exports_isoUint8Array.areEqual(attested.name,attestedName))throw Error("Attested name comparison failed (TPM)");let attToBeSigned=exports_isoUint8Array.concat([authData,clientDataHash]),attToBeSignedHash=await toHash(attToBeSigned,alg);if(!exports_isoUint8Array.areEqual(extraData,attToBeSignedHash))throw Error("CertInfo extra data did not equal hashed attestation (TPM)");if(x5c.length<1)throw Error("No certificates present in x5c array (TPM)");let leafCertInfo=getCertificateInfo(x5c[0]),{basicConstraintsCA,version,subject,notAfter,notBefore}=leafCertInfo;if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (TPM)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (TPM)");if(subject.combined.length>0)throw Error("Certificate subject was not empty (TPM)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (TPM)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (TPM)`);let parsedCert=AsnParser.parse(x5c[0],Certificate);if(!parsedCert.tbsCertificate.extensions)throw Error("Certificate was missing extensions (TPM)");let subjectAltNamePresent,extKeyUsage;if(parsedCert.tbsCertificate.extensions.forEach((ext)=>{if(ext.extnID===id_ce_subjectAltName)subjectAltNamePresent=AsnParser.parse(ext.extnValue,SubjectAlternativeName);else if(ext.extnID===id_ce_extKeyUsage)extKeyUsage=AsnParser.parse(ext.extnValue,ExtendedKeyUsage)}),!subjectAltNamePresent)throw Error("Certificate did not contain subjectAltName extension (TPM)");if(!subjectAltNamePresent[0].directoryName?.[0].length)throw Error("Certificate subjectAltName extension directoryName was empty (TPM)");let{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}=getTcgAtTpmValues(subjectAltNamePresent[0].directoryName);if(!tcgAtTpmManufacturer||!tcgAtTpmModel||!tcgAtTpmVersion)throw Error("Certificate contained incomplete subjectAltName data (TPM)");if(!extKeyUsage)throw Error("Certificate did not contain ExtendedKeyUsage extension (TPM)");if(!TPM_MANUFACTURERS[tcgAtTpmManufacturer])throw Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);if(extKeyUsage[0]!=="2.23.133.8.3")throw Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);try{await validateExtFIDOGenCEAAGUID(parsedCert.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (TPM)`)}let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (TPM)`)}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (TPM)`)}return verifySignature2({signature:sig,data:certInfo,x509Certificate:x5c[0],hashAlgorithm:alg})}function getTcgAtTpmValues(root){let tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion;return root.forEach((relName)=>{relName.forEach((attr)=>{if(attr.type==="2.23.133.2.1")tcgAtTpmManufacturer=attr.value.toString();else if(attr.type==="2.23.133.2.2")tcgAtTpmModel=attr.value.toString();else if(attr.type==="2.23.133.2.3")tcgAtTpmVersion=attr.value.toString()})}),{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}}function attestedNameAlgToCOSEAlg(alg){if(alg==="TPM_ALG_SHA256")return COSEALG.ES256;else if(alg==="TPM_ALG_SHA384")return COSEALG.ES384;else if(alg==="TPM_ALG_SHA512")return COSEALG.ES512;throw Error(`Unexpected TPM attested name alg ${alg}`)}var init_verifyAttestationTPM=__esm(()=>{init_es2015();init_es20152();init_decodeCredentialPublicKey();init_cose();init_toHash();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata();init_constants2();init_parseCertInfo();init_parsePubArea()});class RootOfTrust{verifiedBootKey=new OctetString2;deviceLocked=!1;verifiedBootState=VerifiedBootState.verified;verifiedBootHash;constructor(params={}){Object.assign(this,params)}}class AuthorizationList{purpose;algorithm;keySize;digest;padding;ecCurve;rsaPublicExponent;mgfDigest;rollbackResistance;earlyBootOnly;activeDateTime;originationExpireDateTime;usageExpireDateTime;usageCountLimit;noAuthRequired;userAuthType;authTimeout;allowWhileOnBody;trustedUserPresenceRequired;trustedConfirmationRequired;unlockedDeviceRequired;allApplications;applicationId;creationDateTime;origin;rollbackResistant;rootOfTrust;osVersion;osPatchLevel;attestationApplicationId;attestationIdBrand;attestationIdDevice;attestationIdProduct;attestationIdSerial;attestationIdImei;attestationIdMeid;attestationIdManufacturer;attestationIdModel;vendorPatchLevel;bootPatchLevel;deviceUniqueAttestation;attestationIdSecondImei;moduleHash;constructor(params={}){Object.assign(this,params)}}class KeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;teeEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}}class KeyMintKeyDescription{attestationVersion=Version3.keyMint4;attestationSecurityLevel=SecurityLevel.software;keyMintVersion=0;keyMintSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;hardwareEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}toLegacyKeyDescription(){return new KeyDescription({attestationVersion:this.attestationVersion,attestationSecurityLevel:this.attestationSecurityLevel,keymasterVersion:this.keyMintVersion,keymasterSecurityLevel:this.keyMintSecurityLevel,attestationChallenge:this.attestationChallenge,uniqueId:this.uniqueId,softwareEnforced:this.softwareEnforced,teeEnforced:this.hardwareEnforced})}static fromLegacyKeyDescription(keyDesc){return new KeyMintKeyDescription({attestationVersion:keyDesc.attestationVersion,attestationSecurityLevel:keyDesc.attestationSecurityLevel,keyMintVersion:keyDesc.keymasterVersion,keyMintSecurityLevel:keyDesc.keymasterSecurityLevel,attestationChallenge:keyDesc.attestationChallenge,uniqueId:keyDesc.uniqueId,softwareEnforced:keyDesc.softwareEnforced,hardwareEnforced:keyDesc.teeEnforced})}}var IntegerSet_1,id_ce_keyDescription="1.3.6.1.4.1.11129.2.1.17",VerifiedBootState,IntegerSet,SecurityLevel,Version3;var init_key_description=__esm(()=>{init_modules();init_es2015();(function(VerifiedBootState2){VerifiedBootState2[VerifiedBootState2.verified=0]="verified",VerifiedBootState2[VerifiedBootState2.selfSigned=1]="selfSigned",VerifiedBootState2[VerifiedBootState2.unverified=2]="unverified",VerifiedBootState2[VerifiedBootState2.failed=3]="failed"})(VerifiedBootState||(VerifiedBootState={}));__decorate([AsnProp({type:OctetString2})],RootOfTrust.prototype,"verifiedBootKey",void 0);__decorate([AsnProp({type:AsnPropTypes.Boolean})],RootOfTrust.prototype,"deviceLocked",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],RootOfTrust.prototype,"verifiedBootState",void 0);__decorate([AsnProp({type:OctetString2,optional:!0})],RootOfTrust.prototype,"verifiedBootHash",void 0);IntegerSet=IntegerSet_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,IntegerSet_1.prototype)}};IntegerSet=IntegerSet_1=__decorate([AsnType({type:AsnTypeTypes.Set,itemType:AsnPropTypes.Integer})],IntegerSet);__decorate([AsnProp({context:1,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"purpose",void 0);__decorate([AsnProp({context:2,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"algorithm",void 0);__decorate([AsnProp({context:3,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"keySize",void 0);__decorate([AsnProp({context:5,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"digest",void 0);__decorate([AsnProp({context:6,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"padding",void 0);__decorate([AsnProp({context:10,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"ecCurve",void 0);__decorate([AsnProp({context:200,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"rsaPublicExponent",void 0);__decorate([AsnProp({context:203,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"mgfDigest",void 0);__decorate([AsnProp({context:303,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistance",void 0);__decorate([AsnProp({context:305,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"earlyBootOnly",void 0);__decorate([AsnProp({context:400,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"activeDateTime",void 0);__decorate([AsnProp({context:401,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"originationExpireDateTime",void 0);__decorate([AsnProp({context:402,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageExpireDateTime",void 0);__decorate([AsnProp({context:405,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageCountLimit",void 0);__decorate([AsnProp({context:503,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"noAuthRequired",void 0);__decorate([AsnProp({context:504,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"userAuthType",void 0);__decorate([AsnProp({context:505,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"authTimeout",void 0);__decorate([AsnProp({context:506,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allowWhileOnBody",void 0);__decorate([AsnProp({context:507,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedUserPresenceRequired",void 0);__decorate([AsnProp({context:508,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedConfirmationRequired",void 0);__decorate([AsnProp({context:509,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"unlockedDeviceRequired",void 0);__decorate([AsnProp({context:600,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allApplications",void 0);__decorate([AsnProp({context:601,type:OctetString2,optional:!0})],AuthorizationList.prototype,"applicationId",void 0);__decorate([AsnProp({context:701,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"creationDateTime",void 0);__decorate([AsnProp({context:702,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"origin",void 0);__decorate([AsnProp({context:703,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistant",void 0);__decorate([AsnProp({context:704,type:RootOfTrust,optional:!0})],AuthorizationList.prototype,"rootOfTrust",void 0);__decorate([AsnProp({context:705,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osVersion",void 0);__decorate([AsnProp({context:706,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osPatchLevel",void 0);__decorate([AsnProp({context:709,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationApplicationId",void 0);__decorate([AsnProp({context:710,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdBrand",void 0);__decorate([AsnProp({context:711,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdDevice",void 0);__decorate([AsnProp({context:712,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdProduct",void 0);__decorate([AsnProp({context:713,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSerial",void 0);__decorate([AsnProp({context:714,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdImei",void 0);__decorate([AsnProp({context:715,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdMeid",void 0);__decorate([AsnProp({context:716,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdManufacturer",void 0);__decorate([AsnProp({context:717,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdModel",void 0);__decorate([AsnProp({context:718,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"vendorPatchLevel",void 0);__decorate([AsnProp({context:719,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"bootPatchLevel",void 0);__decorate([AsnProp({context:720,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"deviceUniqueAttestation",void 0);__decorate([AsnProp({context:723,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSecondImei",void 0);__decorate([AsnProp({context:724,type:OctetString2,optional:!0})],AuthorizationList.prototype,"moduleHash",void 0);(function(SecurityLevel2){SecurityLevel2[SecurityLevel2.software=0]="software",SecurityLevel2[SecurityLevel2.trustedEnvironment=1]="trustedEnvironment",SecurityLevel2[SecurityLevel2.strongBox=2]="strongBox"})(SecurityLevel||(SecurityLevel={}));(function(Version4){Version4[Version4.KM2=1]="KM2",Version4[Version4.KM3=2]="KM3",Version4[Version4.KM4=3]="KM4",Version4[Version4.KM4_1=4]="KM4_1",Version4[Version4.keyMint1=100]="keyMint1",Version4[Version4.keyMint2=200]="keyMint2",Version4[Version4.keyMint3=300]="keyMint3",Version4[Version4.keyMint4=400]="keyMint4"})(Version3||(Version3={}));__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"teeEnforced",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"keyMintVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"keyMintSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"hardwareEnforced",void 0)});class NonStandardKeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new NonStandardAuthorizationList;teeEnforced=new NonStandardAuthorizationList;get keyMintVersion(){return this.keymasterVersion}set keyMintVersion(value){this.keymasterVersion=value}get keyMintSecurityLevel(){return this.keymasterSecurityLevel}set keyMintSecurityLevel(value){this.keymasterSecurityLevel=value}get hardwareEnforced(){return this.teeEnforced}set hardwareEnforced(value){this.teeEnforced=value}constructor(params={}){Object.assign(this,params)}}var NonStandardAuthorizationList_1,NonStandardAuthorization,NonStandardAuthorizationList,NonStandardKeyMintKeyDescription;var init_nonstandard=__esm(()=>{init_modules();init_es2015();init_key_description();NonStandardAuthorization=class extends AuthorizationList{};NonStandardAuthorization=__decorate([AsnType({type:AsnTypeTypes.Choice})],NonStandardAuthorization);NonStandardAuthorizationList=NonStandardAuthorizationList_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,NonStandardAuthorizationList_1.prototype)}findProperty(key2){let prop=this.find((o)=>o[key2]!==void 0);if(prop)return prop[key2];return}};NonStandardAuthorizationList=NonStandardAuthorizationList_1=__decorate([AsnType({type:AsnTypeTypes.Sequence,itemType:NonStandardAuthorization})],NonStandardAuthorizationList);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"teeEnforced",void 0);NonStandardKeyMintKeyDescription=class extends NonStandardKeyDescription{constructor(params={}){if("keymasterVersion"in params&&!("keyMintVersion"in params))params.keyMintVersion=params.keymasterVersion;if("keymasterSecurityLevel"in params&&!("keyMintSecurityLevel"in params))params.keyMintSecurityLevel=params.keymasterSecurityLevel;if("teeEnforced"in params&&!("hardwareEnforced"in params))params.hardwareEnforced=params.teeEnforced;super(params)}};NonStandardKeyMintKeyDescription=__decorate([AsnType({type:AsnTypeTypes.Sequence})],NonStandardKeyMintKeyDescription)});class AttestationPackageInfo{packageName;version;constructor(params={}){Object.assign(this,params)}}class AttestationApplicationId{packageInfos;signatureDigests;constructor(params={}){Object.assign(this,params)}}var init_attestation=__esm(()=>{init_modules();init_es2015();__decorate([AsnProp({type:AsnPropTypes.OctetString})],AttestationPackageInfo.prototype,"packageName",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],AttestationPackageInfo.prototype,"version",void 0);__decorate([AsnProp({type:AttestationPackageInfo,repeated:"set"})],AttestationApplicationId.prototype,"packageInfos",void 0);__decorate([AsnProp({type:AsnPropTypes.OctetString,repeated:"set"})],AttestationApplicationId.prototype,"signatureDigests",void 0)});var init_es201511=__esm(()=>{init_key_description();init_nonstandard();init_attestation()});async function verifyAttestationAndroidKey(options){let{authData,clientDataHash,attStmt,credentialPublicKey,aaguid,rootCertificates}=options,x5c=attStmt.get("x5c"),sig=attStmt.get("sig"),alg=attStmt.get("alg");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Android Key)");if(!sig)throw Error("No attestation signature provided in attestation statement (Android Key)");if(!alg)throw Error("Attestation statement did not contain alg (Android Key)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Android Key)`);let parsedCert=AsnParser.parse(x5c[0],Certificate),parsedCertPubKey=new Uint8Array(parsedCert.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey),credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,parsedCertPubKey))throw Error("Credential public key does not equal leaf cert public key (Android Key)");let extKeyStore=parsedCert.tbsCertificate.extensions?.find((ext)=>ext.extnID===id_ce_keyDescription);if(!extKeyStore)throw Error("Certificate did not contain extKeyStore (Android Key)");let parsedExtKeyStore=AsnParser.parse(extKeyStore.extnValue,KeyDescription),{attestationChallenge,teeEnforced,softwareEnforced}=parsedExtKeyStore;if(!exports_isoUint8Array.areEqual(new Uint8Array(attestationChallenge.buffer),clientDataHash))throw Error("Attestation challenge was not equal to client data hash (Android Key)");if(teeEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');if(softwareEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}else{let x5cNoRootPEM=x5c.slice(0,-1).map(convertCertBufferToPEM),x5cRootPEM=x5c.slice(-1).map(convertCertBufferToPEM);try{await validateCertificatePath(x5cNoRootPEM,x5cRootPEM)}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}if(rootCertificates.length>0&&rootCertificates.indexOf(x5cRootPEM[0])<0)throw Error("x5c root certificate was not a known root certificate (Android Key)")}let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]);return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:alg})}var init_verifyAttestationAndroidKey=__esm(()=>{init_es2015();init_es20152();init_es201511();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_convertCOSEtoPKCS();init_cose();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationApple(options){let{attStmt,authData,clientDataHash,credentialPublicKey,rootCertificates}=options,x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Apple)");try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Apple)`)}let parsedCredCert=AsnParser.parse(x5c[0],Certificate),{extensions:extensions2,subjectPublicKeyInfo}=parsedCredCert.tbsCertificate;if(!extensions2)throw Error("credCert missing extensions (Apple)");let extCertNonce=extensions2.find((ext)=>ext.extnID==="1.2.840.113635.100.8.2");if(!extCertNonce)throw Error('credCert missing "1.2.840.113635.100.8.2" extension (Apple)');let nonceToHash=exports_isoUint8Array.concat([authData,clientDataHash]),nonce=await toHash(nonceToHash),extNonce=new Uint8Array(extCertNonce.extnValue.buffer).slice(6);if(!exports_isoUint8Array.areEqual(nonce,extNonce))throw Error("credCert nonce was not expected value (Apple)");let credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey),credCertSubjectPublicKey=new Uint8Array(subjectPublicKeyInfo.subjectPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,credCertSubjectPublicKey))throw Error("Credential public key does not equal credCert public key (Apple)");return!0}var init_verifyAttestationApple=__esm(()=>{init_es2015();init_es20152();init_validateCertificatePath();init_convertCertBufferToPEM();init_toHash();init_convertCOSEtoPKCS();init_iso()});async function verifyRegistrationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,requireUserPresence=!0,requireUserVerification=!0,supportedAlgorithmIDs=supportedCOSEAlgorithmIdentifiers,attestationSafetyNetEnforceCTSCheck=!0}=options,{id,rawId,type:credentialType,response:attestationResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);let clientDataJSON=decodeClientDataJSON(attestationResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected registration response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected registration response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.create")throw Error(`Unexpected registration response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin))throw Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`)}else if(origin!==expectedOrigin)throw Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);if(tokenBinding){if(typeof tokenBinding!=="object")throw Error(`Unexpected value for TokenBinding "${tokenBinding}"`);if(["present","supported","not-supported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`)}let attestationObject=exports_isoBase64URL.toBuffer(attestationResponse.attestationObject),decodedAttestationObject=decodeAttestationObject(attestationObject),fmt=decodedAttestationObject.get("fmt"),authData=decodedAttestationObject.get("authData"),attStmt=decodedAttestationObject.get("attStmt"),parsedAuthData=parseAuthenticatorData(authData),{aaguid,rpIdHash,flags,credentialID,counter,credentialPublicKey,extensionsData}=parsedAuthData,matchedRPID;if(expectedRPID){let expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs)}if(requireUserPresence&&!flags.up)throw Error("User presence was required, but user was not present");if(requireUserVerification&&!flags.uv)throw Error("User verification was required, but user could not be verified");if(!credentialID)throw Error("No credential ID was provided by authenticator");if(!credentialPublicKey)throw Error("No public key was provided by authenticator");if(!aaguid)throw Error("No AAGUID was present during registration");let alg=decodeCredentialPublicKey(credentialPublicKey).get(COSEKEYS.alg);if(typeof alg!=="number")throw Error("Credential public key was missing numeric alg");if(!supportedAlgorithmIDs.includes(alg)){let supported=supportedAlgorithmIDs.join(", ");throw Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`)}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(attestationResponse.clientDataJSON)),rootCertificates=SettingsService.getRootCertificates({identifier:fmt}),verifierOpts={aaguid,attStmt,authData,clientDataHash,credentialID,credentialPublicKey,rootCertificates,rpIdHash,attestationSafetyNetEnforceCTSCheck},verified=!1;if(fmt==="fido-u2f")verified=await verifyAttestationFIDOU2F(verifierOpts);else if(fmt==="packed")verified=await verifyAttestationPacked(verifierOpts);else if(fmt==="android-safetynet")verified=await verifyAttestationAndroidSafetyNet(verifierOpts);else if(fmt==="android-key")verified=await verifyAttestationAndroidKey(verifierOpts);else if(fmt==="tpm")verified=await verifyAttestationTPM(verifierOpts);else if(fmt==="apple")verified=await verifyAttestationApple(verifierOpts);else if(fmt==="none"){if(attStmt.size>0)throw Error("None attestation had unexpected attestation statement");verified=!0}else throw Error(`Unsupported Attestation Format: ${fmt}`);if(!verified)return{verified:!1};let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:!0,registrationInfo:{fmt,aaguid:convertAAGUIDToString(aaguid),credentialType,credential:{id:exports_isoBase64URL.fromBuffer(credentialID),publicKey:credentialPublicKey,counter,transports:response.response.transports},attestationObject,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,origin:clientDataJSON.origin,rpID:matchedRPID,authenticatorExtensionResults:extensionsData}}}var init_verifyRegistrationResponse=__esm(()=>{init_decodeAttestationObject();init_decodeClientDataJSON();init_parseAuthenticatorData();init_toHash();init_decodeCredentialPublicKey();init_cose();init_convertAAGUIDToString();init_parseBackupFlags();init_matchExpectedRPID();init_iso();init_settingsService();init_generateRegistrationOptions();init_verifyAttestationFIDOU2F();init_verifyAttestationPacked();init_verifyAttestationAndroidSafetyNet();init_verifyAttestationTPM();init_verifyAttestationAndroidKey();init_verifyAttestationApple()});async function generateAuthenticationOptions(options){let{allowCredentials,challenge=await generateChallenge2(),timeout=60000,userVerification="preferred",extensions:extensions2,rpID}=options,_challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);return{rpId:rpID,challenge:exports_isoBase64URL.fromBuffer(_challenge),allowCredentials:allowCredentials?.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`allowCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),timeout,userVerification,extensions:extensions2}}var init_generateAuthenticationOptions=__esm(()=>{init_iso();init_generateChallenge()});async function verifyAuthenticationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,credential,requireUserVerification=!0,advancedFIDOConfig}=options,{id,rawId,type:credentialType,response:assertionResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);if(!response)throw Error("Credential missing response");if(typeof assertionResponse?.clientDataJSON!=="string")throw Error("Credential response clientDataJSON was not a string");let clientDataJSON=decodeClientDataJSON(assertionResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.get")throw Error(`Unexpected authentication response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin)){let joinedExpectedOrigin=expectedOrigin.join(", ");throw Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`)}}else if(origin!==expectedOrigin)throw Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);if(!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData))throw Error("Credential response authenticatorData was not a base64url string");if(!exports_isoBase64URL.isBase64URL(assertionResponse.signature))throw Error("Credential response signature was not a base64url string");if(assertionResponse.userHandle&&typeof assertionResponse.userHandle!=="string")throw Error("Credential response userHandle was not a string");if(tokenBinding){if(typeof tokenBinding!=="object")throw Error("ClientDataJSON tokenBinding was not an object");if(["present","supported","notSupported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding status ${tokenBinding.status}`)}let authDataBuffer=exports_isoBase64URL.toBuffer(assertionResponse.authenticatorData),parsedAuthData=parseAuthenticatorData(authDataBuffer),{rpIdHash,flags,counter,extensionsData}=parsedAuthData,expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;let matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs);if(advancedFIDOConfig!==void 0){let{userVerification:fidoUserVerification}=advancedFIDOConfig;if(fidoUserVerification==="required"){if(!flags.uv)throw Error("User verification required, but user could not be verified")}}else{if(!flags.up)throw Error("User not present during authentication");if(requireUserVerification&&!flags.uv)throw Error("User verification required, but user could not be verified")}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(assertionResponse.clientDataJSON)),signatureBase=exports_isoUint8Array.concat([authDataBuffer,clientDataHash]),signature=exports_isoBase64URL.toBuffer(assertionResponse.signature);if((counter>0||credential.counter>0)&&counter<=credential.counter)throw Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:await verifySignature2({signature,data:signatureBase,credentialPublicKey:credential.publicKey}),authenticationInfo:{newCounter:counter,credentialID:credential.id,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,authenticatorExtensionResults:extensionsData,origin:clientDataJSON.origin,rpID:matchedRPID}}}var init_verifyAuthenticationResponse=__esm(()=>{init_decodeClientDataJSON();init_toHash();init_verifySignature();init_parseAuthenticatorData();init_parseBackupFlags();init_matchExpectedRPID();init_iso()});var init_mdsTypes=()=>{};var init_types11=()=>{};var init_esm2=__esm(()=>{init_generateRegistrationOptions();init_verifyRegistrationResponse();init_generateAuthenticationOptions();init_verifyAuthenticationResponse();init_metadataService();init_settingsService();init_mdsTypes();init_types11()});function base64UrlEncode2(buffer){let binary="";for(let byte of buffer)binary+=String.fromCharCode(byte);return(typeof btoa<"u"?btoa(binary):Buffer.from(binary,"binary").toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function base64UrlDecode2(value){let padded=value.replace(/-/g,"+").replace(/_/g,"/").padEnd(value.length+(4-value.length%4)%4,"="),binary=typeof atob<"u"?atob(padded):Buffer.from(padded,"base64").toString("binary"),buffer=new ArrayBuffer(binary.length),out=new Uint8Array(buffer);for(let i=0;i<binary.length;i+=1)out[i]=binary.charCodeAt(i);return out}function parseTransports(value){if(!value)return null;if(Array.isArray(value))return value;if(typeof value==="string")try{let parsed=JSON.parse(value);return Array.isArray(parsed)?parsed:null}catch{return null}return null}function parseDeviceType(value){if(value==="singleDevice"||value==="multiDevice")return value;return null}var exports_WebAuthn={};__export(exports_WebAuthn,{WebAuthnService:()=>WebAuthnService});class WebAuthnService{config;challengeTtlMs;constructor(config){this.config=config,this.challengeTtlMs=config.challengeTtlMs??DEFAULT_CHALLENGE_TTL_MS}async createRegistrationOptions(params){let existing=await this.config.storage.listCredentialsByUser(params.userId,params.schemaName),options=await generateRegistrationOptions({rpName:this.config.rp.rpName,rpID:this.config.rp.rpID,userID:new TextEncoder().encode(params.userId),userName:params.userName,userDisplayName:params.userDisplayName??params.userName,attestationType:"none",authenticatorSelection:{residentKey:"preferred",userVerification:this.config.userVerification??"preferred"},excludeCredentials:existing.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"registration",userId:params.userId,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyRegistration(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"registration",params.schemaName);if(!stored||stored.userId!==params.userId)return null;if(stored.expiresAt.getTime()<Date.now())return null;let verification;try{verification=await verifyRegistrationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Registration attestation rejected",{userId:params.userId,reason:error instanceof Error?error.message:String(error)}),null}if(!verification.verified||!verification.registrationInfo)return null;let info=verification.registrationInfo,publicKey=base64UrlEncode2(info.credential.publicKey),attachment=params.response.authenticatorAttachment==="platform"||params.response.authenticatorAttachment==="cross-platform"?params.response.authenticatorAttachment:null;return this.config.storage.insertCredential({userId:params.userId,credentialId:info.credential.id,publicKey,counter:info.credential.counter,transports:info.credential.transports??null,deviceType:info.credentialDeviceType,backedUp:info.credentialBackedUp,aaguid:info.aaguid??null,authenticatorAttachment:attachment,nickname:params.nickname??null,lastUsedAt:null,revokedAt:null},params.schemaName)}async createAuthenticationOptions(params){let credentials=params.userId?await this.config.storage.listCredentialsByUser(params.userId,params.schemaName):[],options=await generateAuthenticationOptions({rpID:this.config.rp.rpID,userVerification:this.config.userVerification??"preferred",allowCredentials:credentials.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"authentication",userId:params.userId??null,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyAuthentication(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"authentication",params.schemaName);if(!stored)return{verified:!1,userId:null,credentialId:null};if(stored.expiresAt.getTime()<Date.now())return{verified:!1,userId:null,credentialId:null};let credential=await this.config.storage.findCredentialById(params.response.id,params.schemaName);if(!credential||credential.revokedAt)return{verified:!1,userId:null,credentialId:null};let verification;try{verification=await verifyAuthenticationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,credential:{id:credential.credentialId,publicKey:base64UrlDecode2(credential.publicKey),counter:credential.counter,transports:credential.transports??void 0},requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Authentication assertion rejected",{userId:credential.userId,credentialId:credential.credentialId,reason:error instanceof Error?error.message:String(error)}),{verified:!1,userId:null,credentialId:null}}if(!verification.verified)return{verified:!1,userId:null,credentialId:null};return await this.config.storage.updateCredentialCounter(credential.credentialId,verification.authenticationInfo.newCounter,params.schemaName),{verified:!0,userId:credential.userId,credentialId:credential.credentialId}}listUserCredentials(userId,schemaName){return this.config.storage.listCredentialsByUser(userId,schemaName)}revokeCredential(credentialId,userId,schemaName){return this.config.storage.revokeCredential(credentialId,userId,schemaName)}renameCredential(credentialId,userId,nickname,schemaName){return this.config.storage.renameCredential(credentialId,userId,nickname,schemaName)}}var DEFAULT_CHALLENGE_TTL_MS=300000;var init_WebAuthn=__esm(()=>{init_esm2()});var init_Services=__esm(()=>{init_ApiKey();init_Auth();init_Authorization();init_Backup();init_Captcha();init_Domain();init_Email();init_Gmail();init_Logger2();init_Monitoring();init_Notification();init_OAuth();init_Payment();init_RateLimiter();init_Secrets();init_Tenant();init_Verification();init_WebAuthn()});function encodeHeaderList(items){return items.map((v)=>encodeURIComponent(v)).join(",")}function decodeHeaderList(header){if(!header)return[];return header.split(",").map((v)=>v.trim()).filter(Boolean).map((v)=>{try{return decodeURIComponent(v)}catch{return v}})}function encodeClaimScopesHeader(claimScopes){if(!claimScopes||Object.keys(claimScopes).length===0)return"";return encodeURIComponent(JSON.stringify(claimScopes))}function decodeClaimScopesHeader(header){if(!header)return;try{let parsed=JSON.parse(decodeURIComponent(header));if(parsed&&typeof parsed==="object"&&!Array.isArray(parsed))return parsed;return}catch{return}}async function withDeadline(promise,timeoutMs,message){promise.catch(()=>{});let timer,deadline=new Promise((_resolve,reject)=>{timer=setTimeout(()=>reject(Error(message)),timeoutMs)});try{return await Promise.race([promise,deadline])}finally{if(timer)clearTimeout(timer)}}function defineRoute(declaration){return{...declaration,toClientEndpoint(){return{method:declaration.method,path:declaration.path,isPublic:declaration.isPublic,isFormData:declaration.isFormData,serviceId:declaration.serviceId,_payload:void 0,_success:void 0,_error:void 0}}}}var INTERNAL_HEADERS;var init_internalHeaders=__esm(()=>{INTERNAL_HEADERS=["x-user-id","x-request-id","x-auth-type","x-api-key-id","x-api-key-owner-type","x-user-roles","x-user-claims","x-user-claim-scopes","x-session-id","x-access-token","x-refresh-token","x-tenant-schema"]});function createResponseSet(){return{headers:{}}}function withEnvelopeFlags(body){let hasSuccess=Object.hasOwn(body,"success")&&typeof body.success==="boolean",hasIsSuccess=Object.hasOwn(body,"isSuccess")&&typeof body.isSuccess==="boolean";if(hasSuccess===hasIsSuccess)return body;let mirrored={};for(let[key2,value]of Object.entries(body))if(mirrored[key2]=value,key2==="success")mirrored.isSuccess=value;else if(key2==="isSuccess")mirrored.success=value;return mirrored}function mirrorFlags(result){if(Array.isArray(result))return result;let proto=Object.getPrototypeOf(result);if(proto!==Object.prototype&&proto!==null)return result;return withEnvelopeFlags(result)}function usableStatus(status){if(typeof status!=="number"||!Number.isInteger(status))return;if(status!==101&&(status<200||status>599))return;return status}function applySetHeaders(target2,set){for(let[key2,value]of Object.entries(set.headers))target2.set(key2,value)}function finalizeResponse(result,set){let setStatus=usableStatus(set.status),setTouched=setStatus!==void 0||Object.keys(set.headers).length>0;if(result instanceof Response){if(!setTouched)return result;let status2=result.status!==200?result.status:setStatus??200,headers2=new Headers;applySetHeaders(headers2,set);for(let cookie of result.headers.getSetCookie())headers2.append("set-cookie",cookie);if(result.headers.forEach((value,key2)=>{if(key2.toLowerCase()==="set-cookie")return;headers2.set(key2,value)}),BODILESS.has(status2))return new Response(null,{status:status2,headers:headers2});return new Response(result.body,{status:status2,headers:headers2})}if(result instanceof Error){let errorStatus=setStatus??500,errorHeaders=new Headers;if(applySetHeaders(errorHeaders,set),!errorHeaders.has("content-type"))errorHeaders.set("content-type","application/json");if(BODILESS.has(errorStatus))return new Response(null,{status:errorStatus,headers:errorHeaders});return new Response(JSON.stringify(withEnvelopeFlags({isSuccess:!1,message:result.message,status:errorStatus,errors:[{message:result.message}],data:null})),{status:errorStatus,headers:errorHeaders})}let status=setStatus??200,headers=new Headers;if(applySetHeaders(headers,set),result===void 0||result===null)return new Response(null,{status,headers});let isScalar=typeof result==="string"||typeof result==="number"||typeof result==="boolean";if(!headers.has("content-type"))headers.set("content-type",isScalar?"text/plain;charset=utf-8":"application/json");if(BODILESS.has(status))return new Response(null,{status,headers});return new Response(isScalar?String(result):JSON.stringify(mirrorFlags(result)),{status,headers})}var BODILESS;var init_response=__esm(()=>{BODILESS=new Set([204,304])});function beginRouteRecording(){if(recordingDepth===0)recording=[],recordedSocket=null,recordedAdapterSteps=[],recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedBootSteps=[],recordedShutdownSteps=[];recordingDepth+=1}function endRouteRecording(){if(recordingDepth===0)throw Error("endRouteRecording() without a matching beginRouteRecording()");if(recordingDepth-=1,recordingDepth>0)return recording??[];let collected=recording??[];return recording=null,collected}function recordRouteGroups(groups){if(recording){recording.push(...groups);return}console.warn(`[nucleus] recordRouteGroups: ${groups.length} route group(s) were recorded while no recording was open, so they were DISCARDED. A host must pass its groups as \`createNucleusServer({ routes: [...] })\`; collecting them outside \`buildNucleus\` records nothing, and if you rely on it alone those routes will answer 404.`)}function recordSocket(route){if(recording)recordedSocket=route}function getRecordedSocket(){return recordedSocket}function recordAdapterStep(step){if(recording)recordedAdapterSteps.push(step)}function recordSwagger(config){if(recording)recordedSwagger=config}function recordRuntime(runtime){recordedRuntime=runtime}function getMountedRuntime(){return recordedRuntime}function recordResolvedOptions(options){recordedResolvedOptions=options}function getResolvedOptions(){return recordedResolvedOptions}function recordStaticAssets(assetsPath){if(recording)recordedStaticAssets=assetsPath}function getRecordedStaticAssets(){return recordedStaticAssets}function recordBootStep(step){if(recording)recordedBootSteps.push(step)}function recordShutdownStep(step){if(recording)recordedShutdownSteps.push(step)}function getRecordedBootSteps(){return recordedBootSteps}function getRecordedShutdownSteps(){return recordedShutdownSteps}var recording=null,recordingDepth=0,recordedSocket=null,recordedAdapterSteps,recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedResolvedOptions=null,recordedBootSteps,recordedShutdownSteps;var init_routeRecording=__esm(()=>{recordedAdapterSteps=[],recordedBootSteps=[],recordedShutdownSteps=[]});function isRouteCollector(value){return typeof value==="object"&&value!==null&&COLLECTOR in value}function collectRoutes(groups=[]){let collected=[],collector={[COLLECTOR]:!0,groups:collected,use(other){return collected.push(...other.groups),collector}};if(groups.length>0)collected.push(...groups),recordRouteGroups(groups);return collector}var COLLECTOR;var init_routeCollector=__esm(()=>{init_routeRecording();COLLECTOR=Symbol.for("nucleus.routeCollector")});function defineWebSocketRoute(route){return route}function eraseSocketData(route){return route}function headersOf(request){let out={};request.headers.forEach((value,key2)=>{out[key2]=value});for(let header of INTERNAL_HEADERS)delete out[header];return out}function upgradeFor(route,request,server){let url=new URL(request.url);if(url.pathname!==route.path)return null;let data={query:Object.fromEntries(url.searchParams),headers:headersOf(request)};if(server.upgrade(request,{data}))return new Response(null,{status:101});return new Response("NOT_FOUND",{status:404})}function websocketHandlers(route){return{idleTimeout:route.idleTimeout,open:(ws)=>route.open?.(ws),message:(ws,message)=>route.message?.(ws,message),close:(ws,code,reason)=>route.close?.(ws,code,reason)}}var init_websocket=__esm(()=>{init_internalHeaders()});function joinPath(prefix,path){if(!prefix)return path;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path==="/"||path==="")return left||"/";let right=path.startsWith("/")?path:`/${path}`;return`${left}${right}`||"/"}function elysiaSchema(route){let schema={};if(route.body)schema.body=route.body;if(route.query)schema.query=route.query;if(route.params)schema.params=route.params;if(route.detail)schema.detail=route.detail;if(route.type)schema.type=route.type;return schema}function mountWebSocketRoute(app,route){let erased=eraseSocketData(route);recordSocket(erased),app.ws(erased.path,{idleTimeout:erased.idleTimeout,open:erased.open,message:erased.message,close:erased.close})}function useRoutes(app,child){if(isRouteCollector(app)){if(isRouteCollector(child))return app.use(child),app;throw Error("useRoutes: a RouteCollector cannot absorb an Elysia plugin. Record it as an "+"adapter step instead \u2014 only the adapter has an Elysia to mount it on.")}if(isRouteCollector(child))return mountGroups(app,child.groups),app;return app.use(child),app}function mountRoutes(app,groups,options={}){if(isRouteCollector(app))return app.use(collectRoutes(groups)),app;return recordRouteGroups(groups),mountGroups(app,groups,options),app}function mountGroups(app,groups,options={}){for(let group of groups)for(let route of group.routes){let method=METHODS[route.method];if(!method)throw Error(`${route.method} ${route.path}: no Elysia method for it. A WebSocket does not `+"belong in an HTTP group \u2014 declare it with defineWebSocketRoute and mount it with "+"mountWebSocketRoute, as routes/pubsub does.");let path=joinPath(group.prefix,route.path),guards=[...group.guards??[],...route.guards??[]];app[method](path,async(context)=>{let set=createResponseSet(),request=context.request,guardContext={request,set,body:context.body,params:context.params??{},query:context.query??{}};if(options.onRequest){let early=await options.onRequest(guardContext);if(early!==void 0)return finalizeResponse(early,set)}for(let guard of guards){let early=await guard(guardContext);if(early!==void 0)return finalizeResponse(early,set)}let result=await route.handler({request,params:context.params??{},query:context.query??{},body:context.body,set});return finalizeResponse(result,set)},elysiaSchema(route))}return app}var METHODS;var init_routeMount=__esm(()=>{init_response();init_routeCollector();init_routeRecording();init_websocket();METHODS={GET:"get",POST:"post",PUT:"put",PATCH:"patch",DELETE:"delete",HEAD:"head",OPTIONS:"options"}});function toCamel3(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function readColumn(row,column){if(column in row)return row[column];let camel=toCamel3(column);return camel in row?row[camel]:void 0}function isBlank(value){if(value===null||value===void 0)return!0;if(typeof value==="string")return value.trim().length===0;if(Array.isArray(value))return value.length===0;return!1}function coerce(value){if(isBlank(value))return;if(Array.isArray(value))return coerce(value[0]);if(typeof value==="string")return value.trim();if(typeof value==="number"||typeof value==="boolean")return String(value);return}function readClaim(profile,claim){if(claim in profile)return profile[claim];if(!claim.includes("."))return;let cursor=profile;for(let segment of claim.split(".")){if(cursor===null||typeof cursor!=="object")return;cursor=cursor[segment]}return cursor}function splitTarget(target2){let i=target2.indexOf(".");if(i===-1)return{table:"",column:""};return{table:target2.slice(0,i),column:target2.slice(i+1)}}function resolveProfileSyncUpdates(input){let users={},profiles={},errors2=[];for(let mapping of input.mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let target2=table==="users"?users:profiles;if(column in target2)continue;let incoming=coerce(readClaim(input.rawProfile,mapping.claim));if(incoming===void 0)continue;let currentRow=table==="users"?input.currentUser:input.currentProfile,current=readColumn(currentRow,column);if(mapping.overwrite===!1&&!isBlank(current))continue;if(current===incoming)continue;target2[column]=incoming}return{users,profiles,errors:errors2}}function validateProfileSyncTargets(mappings,columnsByTable){let errors2=[];for(let mapping of mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let columns=columnsByTable[table]??[],known=new Set(columns.flatMap((c)=>[c,toCamel3(c)]));if(!known.has(column)&&!known.has(toCamel3(column)))errors2.push(`profileSync maps "${mapping.claim}" to "${mapping.target}", but "${table}" has no column "${column}". Add it via a config entity with "extends": true.`)}return errors2}var resolveAuthTablesForRequest=(request,authConfig)=>{let defaults={usersTable:authConfig.usersTable,sessionsTable:authConfig.sessionsTable??null,userRolesTable:authConfig.userRolesTable??void 0,rolesTable:authConfig.rolesTable??void 0,roleClaimsTable:authConfig.roleClaimsTable??void 0,claimsTable:authConfig.claimsTable??void 0,oauthAccountsTable:authConfig.oauthAccountsTable??void 0,apiKeysTable:authConfig.apiKeysTable??void 0,schemaTables:authConfig.schemaTables||{}},registry=authConfig.getTenantRegistry?authConfig.getTenantRegistry():authConfig.tenantRegistry;if(!registry)return defaults;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaults;let ctx=registry.getSchemaContext(schemaName);if(!ctx)return defaults;let tables=ctx.schemaTables;return{usersTable:tables.users??defaults.usersTable,sessionsTable:tables.userSessions??tables.user_sessions??tables.sessions??defaults.sessionsTable,userRolesTable:tables.userRoles??defaults.userRolesTable,rolesTable:tables.roles??defaults.rolesTable,roleClaimsTable:tables.roleClaims??defaults.roleClaimsTable,claimsTable:tables.claims??defaults.claimsTable,oauthAccountsTable:tables.oauthAccounts??defaults.oauthAccountsTable,apiKeysTable:tables.apiKeys??defaults.apiKeysTable,schemaTables:tables}};import{eq as eq20}from"drizzle-orm";function accountStateRefusal(caller){if(caller.isActive===!1)return"Account is not active";let lockedUntil=caller.lockedUntil?new Date(caller.lockedUntil):null;return(lockedUntil!==null&&lockedUntil<=new Date?!1:lockedUntil!==null||caller.isLocked===!0)?"Account is locked":null}function createRequireGodmin(config){let{db}=config;return async function(request){let{usersTable}=resolveAuthTablesForRequest(request,config);if(!db||!usersTable)return{ok:!1,status:500,message:"Database not configured"};let callerId=request.headers.get("x-user-id");if(!callerId)return{ok:!1,status:401,message:"Unauthorized"};let caller=(await db.select().from(usersTable).where(eq20(usersTable.id,callerId)).limit(1))[0];if(!caller||!caller.isGod)return{ok:!1,status:403,message:"Forbidden: godmin privileges required"};let refusal=accountStateRefusal(caller);if(refusal)return{ok:!1,status:403,message:refusal};return{ok:!0,callerId,caller}}}var init_requireGodmin=()=>{};import{and as and15,eq as eq23}from"drizzle-orm";function resolveDefaultRoleNames(authentication){let names2=new Set,single=authentication?.defaultRole?.trim();if(single)names2.add(single);for(let name2 of authentication?.defaultRoles??[]){let trimmed=String(name2??"").trim();if(trimmed)names2.add(trimmed)}return[...names2]}async function assignDefaultRoles(params){let{roleNames,...rest}=params;for(let roleName of roleNames)await assignDefaultRole({...rest,roleName})}async function assignDefaultRole(params){let{db,userId,roleName,rolesTable,userRolesTable,logger:logger2}=params;if(!rolesTable||!userRolesTable){logger2.warn("[AUTH] assignDefaultRole called without rolesTable or userRolesTable \u2014 skipping",{userId,roleName});return}try{let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await db.select().from(rolesTable).where(eq23(rolesCols.name,roleName)).limit(1))[0];if(!role){logger2.warn(`[AUTH] Default role "${roleName}" not found in roles table \u2014 skipping assignment`,{userId});return}let roleId=role.id;if((await db.select().from(userRolesTable).where(and15(eq23(userRolesCols.userId,userId),eq23(userRolesCols.roleId,roleId))).limit(1)).length>0){logger2.debug("[AUTH] User already has default role \u2014 skipping",{userId,roleName});return}await db.insert(userRolesTable).values({userId,roleId}),logger2.info("[AUTH] Default role assigned to new user",{userId,roleName})}catch(err){logger2.warn("[AUTH] Failed to assign default role \u2014 continuing",{userId,roleName,error:err instanceof Error?err.message:String(err)})}}var init_assignDefaultRole=()=>{};import crypto6 from"crypto";var{password:password2}=globalThis.Bun;async function hashPassword(plainPassword){return await password2.hash(plainPassword,{algorithm:"bcrypt",cost:10})}function generateVerificationToken(){return crypto6.randomBytes(32).toString("hex")}function hashVerificationToken(token){return crypto6.createHash("sha256").update(token).digest("hex")}function parseTimeToMs(time2){let match=time2.match(/^(\d+)(s|m|h|d)$/);if(!match?.[1]||!match[2])return 86400000;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value*1000;case"m":return value*60*1000;case"h":return value*60*60*1000;case"d":return value*24*60*60*1000;default:return 86400000}}function validatePasswordStrength(pwd){let errors2=[];if(pwd.length<8)errors2.push("Password must be at least 8 characters");if(!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if(!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if(!/[0-9]/.test(pwd))errors2.push("Password must contain a number");return{valid:errors2.length===0,errors:errors2}}var init_utils6=()=>{};function pickByName(bag,name2){if(!name2)return;let camel=name2.replace(/_([a-z0-9])/g,(_,c)=>c.toUpperCase()),snake=name2.replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase();for(let key2 of[name2,camel,snake]){let found=bag[key2];if(found!==void 0)return found}return}import{inArray as inArray8}from"drizzle-orm";function accountLinkFor(links,table){if(!links?.length||!table)return null;let byTable={};for(let link of links)if(link?.table)byTable[link.table]=link;return pickByName(byTable,table)??null}function accountIdsIn(rows,userColumn){if(!userColumn)return[];let ids=new Set;for(let row of rows){let value=pickByName(row,userColumn),id=String(value??"").trim();if(id)ids.add(id)}return[...ids]}async function closeAccounts(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))];if(ids.length===0||!deps.usersTable)return{closed:0,signedOut:!0,closedIds:[]};let idColumn=pickByName(deps.usersTable,"id"),activeColumn=pickByName(deps.usersTable,"is_active");if(!idColumn||!activeColumn)return{closed:0,signedOut:!1,closedIds:[]};try{await deps.db.update(deps.usersTable).set({isActive:!1}).where(inArray8(idColumn,ids))}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:0,signedOut:!1,closedIds:[]}}let sessionUser=deps.sessionsTable?pickByName(deps.sessionsTable,"user_id"):void 0;if(!deps.sessionsTable||!sessionUser)return{closed:ids.length,signedOut:!1,closedIds:ids};try{return await deps.db.delete(deps.sessionsTable).where(inArray8(sessionUser,ids)),{closed:ids.length,signedOut:!0,closedIds:ids}}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:ids.length,signedOut:!1,closedIds:ids}}}var init_AccountLink=()=>{};import{inArray as inArray9}from"drizzle-orm";async function revokeUserSessions(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))],sessions=deps.sessionsTable;if(!deps.db||!sessions||ids.length===0)return 0;let sessionUser=pickByName(sessions,"user_id");if(!sessionUser)return 0;try{return(await deps.db.delete(sessions).where(inArray9(sessionUser,ids)))?.rowCount??ids.length}catch(error){return deps.onError?.(error),0}}var init_revokeUserSessions=__esm(()=>{init_AccountLink()});var exports_value={};__export(exports_value,{IsUndefined:()=>IsUndefined,IsUint8Array:()=>IsUint8Array,IsSymbol:()=>IsSymbol,IsString:()=>IsString,IsRegExp:()=>IsRegExp,IsObject:()=>IsObject,IsNumber:()=>IsNumber,IsNull:()=>IsNull,IsIterator:()=>IsIterator,IsFunction:()=>IsFunction,IsDate:()=>IsDate,IsBoolean:()=>IsBoolean,IsBigInt:()=>IsBigInt,IsAsyncIterator:()=>IsAsyncIterator,IsArray:()=>IsArray,HasPropertyKey:()=>HasPropertyKey});function HasPropertyKey(value,key2){return key2 in value}function IsAsyncIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.asyncIterator in value}function IsArray(value){return Array.isArray(value)}function IsBigInt(value){return typeof value==="bigint"}function IsBoolean(value){return typeof value==="boolean"}function IsDate(value){return value instanceof globalThis.Date}function IsFunction(value){return typeof value==="function"}function IsIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.iterator in value}function IsNull(value){return value===null}function IsNumber(value){return typeof value==="number"}function IsObject(value){return typeof value==="object"&&value!==null}function IsRegExp(value){return value instanceof globalThis.RegExp}function IsString(value){return typeof value==="string"}function IsSymbol(value){return typeof value==="symbol"}function IsUint8Array(value){return value instanceof globalThis.Uint8Array}function IsUndefined(value){return value===void 0}function ArrayType(value){return value.map((value2)=>Visit(value2))}function DateType(value){return new Date(value.getTime())}function Uint8ArrayType(value){return new Uint8Array(value)}function RegExpType(value){return new RegExp(value.source,value.flags)}function ObjectType(value){let result={};for(let key2 of Object.getOwnPropertyNames(value))result[key2]=Visit(value[key2]);for(let key2 of Object.getOwnPropertySymbols(value))result[key2]=Visit(value[key2]);return result}function Visit(value){return IsArray(value)?ArrayType(value):IsDate(value)?DateType(value):IsUint8Array(value)?Uint8ArrayType(value):IsRegExp(value)?RegExpType(value):IsObject(value)?ObjectType(value):value}function Clone(value){return Visit(value)}var init_value=()=>{};function CloneType(schema,options){return options===void 0?Clone(schema):Clone({...options,...schema})}var init_type=__esm(()=>{init_value()});var init_clone=__esm(()=>{init_type();init_value()});function IsAsyncIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.asyncIterator in value2}function IsIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.iterator in value2}function IsStandardObject(value2){return IsObject2(value2)&&(globalThis.Object.getPrototypeOf(value2)===Object.prototype||globalThis.Object.getPrototypeOf(value2)===null)}function IsPromise(value2){return value2 instanceof globalThis.Promise}function IsDate2(value2){return value2 instanceof Date&&globalThis.Number.isFinite(value2.getTime())}function IsMap(value2){return value2 instanceof globalThis.Map}function IsSet(value2){return value2 instanceof globalThis.Set}function IsTypedArray(value2){return globalThis.ArrayBuffer.isView(value2)}function IsUint8Array2(value2){return value2 instanceof globalThis.Uint8Array}function HasPropertyKey2(value2,key2){return key2 in value2}function IsObject2(value2){return value2!==null&&typeof value2==="object"}function IsArray2(value2){return globalThis.Array.isArray(value2)&&!globalThis.ArrayBuffer.isView(value2)}function IsUndefined2(value2){return value2===void 0}function IsNull2(value2){return value2===null}function IsBoolean2(value2){return typeof value2==="boolean"}function IsNumber2(value2){return typeof value2==="number"}function IsInteger(value2){return globalThis.Number.isInteger(value2)}function IsBigInt2(value2){return typeof value2==="bigint"}function IsString2(value2){return typeof value2==="string"}function IsFunction2(value2){return typeof value2==="function"}function IsSymbol2(value2){return typeof value2==="symbol"}function IsValueType(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNull2(value2)||IsNumber2(value2)||IsString2(value2)||IsSymbol2(value2)||IsUndefined2(value2)}var init_guard=()=>{};var TypeSystemPolicy;var init_policy=__esm(()=>{init_guard();(function(TypeSystemPolicy2){TypeSystemPolicy2.InstanceMode="default",TypeSystemPolicy2.ExactOptionalPropertyTypes=!1,TypeSystemPolicy2.AllowArrayObject=!1,TypeSystemPolicy2.AllowNaN=!1,TypeSystemPolicy2.AllowNullVoid=!1;function IsExactOptionalProperty(value2,key2){return TypeSystemPolicy2.ExactOptionalPropertyTypes?key2 in value2:value2[key2]!==void 0}TypeSystemPolicy2.IsExactOptionalProperty=IsExactOptionalProperty;function IsObjectLike(value2){let isObject=IsObject2(value2);return TypeSystemPolicy2.AllowArrayObject?isObject:isObject&&!IsArray2(value2)}TypeSystemPolicy2.IsObjectLike=IsObjectLike;function IsRecordLike(value2){return IsObjectLike(value2)&&!(value2 instanceof Date)&&!(value2 instanceof Uint8Array)}TypeSystemPolicy2.IsRecordLike=IsRecordLike;function IsNumberLike(value2){return TypeSystemPolicy2.AllowNaN?IsNumber2(value2):Number.isFinite(value2)}TypeSystemPolicy2.IsNumberLike=IsNumberLike;function IsVoidLike(value2){let isUndefined=IsUndefined2(value2);return TypeSystemPolicy2.AllowNullVoid?isUndefined||value2===null:isUndefined}TypeSystemPolicy2.IsVoidLike=IsVoidLike})(TypeSystemPolicy||(TypeSystemPolicy={}))});function ImmutableArray(value2){return globalThis.Object.freeze(value2).map((value3)=>Immutable(value3))}function ImmutableDate(value2){return value2}function ImmutableUint8Array(value2){return value2}function ImmutableRegExp(value2){return value2}function ImmutableObject(value2){let result={};for(let key2 of Object.getOwnPropertyNames(value2))result[key2]=Immutable(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))result[key2]=Immutable(value2[key2]);return globalThis.Object.freeze(result)}function Immutable(value2){return IsArray(value2)?ImmutableArray(value2):IsDate(value2)?ImmutableDate(value2):IsUint8Array(value2)?ImmutableUint8Array(value2):IsRegExp(value2)?ImmutableRegExp(value2):IsObject(value2)?ImmutableObject(value2):value2}var init_immutable=()=>{};function CreateType(schema,options){let result=options!==void 0?{...options,...schema}:schema;switch(TypeSystemPolicy.InstanceMode){case"freeze":return Immutable(result);case"clone":return Clone(result);default:return result}}var init_type2=__esm(()=>{init_policy();init_immutable();init_value()});var init_create=__esm(()=>{init_type2()});var TypeBoxError;var init_error=__esm(()=>{TypeBoxError=class TypeBoxError extends Error{constructor(message){super(message)}}});var init_error2=__esm(()=>{init_error()});var TransformKind,ReadonlyKind,OptionalKind,Hint,Kind;var init_symbols=__esm(()=>{TransformKind=Symbol.for("TypeBox.Transform"),ReadonlyKind=Symbol.for("TypeBox.Readonly"),OptionalKind=Symbol.for("TypeBox.Optional"),Hint=Symbol.for("TypeBox.Hint"),Kind=Symbol.for("TypeBox.Kind")});var init_symbols2=__esm(()=>{init_symbols()});function IsReadonly(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny(value2){return IsKindOf(value2,"Any")}function IsArgument(value2){return IsKindOf(value2,"Argument")}function IsArray3(value2){return IsKindOf(value2,"Array")}function IsAsyncIterator3(value2){return IsKindOf(value2,"AsyncIterator")}function IsBigInt3(value2){return IsKindOf(value2,"BigInt")}function IsBoolean3(value2){return IsKindOf(value2,"Boolean")}function IsComputed(value2){return IsKindOf(value2,"Computed")}function IsConstructor(value2){return IsKindOf(value2,"Constructor")}function IsDate3(value2){return IsKindOf(value2,"Date")}function IsFunction3(value2){return IsKindOf(value2,"Function")}function IsInteger2(value2){return IsKindOf(value2,"Integer")}function IsIntersect(value2){return IsKindOf(value2,"Intersect")}function IsIterator3(value2){return IsKindOf(value2,"Iterator")}function IsKindOf(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralValue(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsLiteral(value2){return IsKindOf(value2,"Literal")}function IsMappedKey(value2){return IsKindOf(value2,"MappedKey")}function IsMappedResult(value2){return IsKindOf(value2,"MappedResult")}function IsNever(value2){return IsKindOf(value2,"Never")}function IsNot(value2){return IsKindOf(value2,"Not")}function IsNull3(value2){return IsKindOf(value2,"Null")}function IsNumber3(value2){return IsKindOf(value2,"Number")}function IsObject3(value2){return IsKindOf(value2,"Object")}function IsPromise2(value2){return IsKindOf(value2,"Promise")}function IsRecord(value2){return IsKindOf(value2,"Record")}function IsRef(value2){return IsKindOf(value2,"Ref")}function IsRegExp2(value2){return IsKindOf(value2,"RegExp")}function IsString3(value2){return IsKindOf(value2,"String")}function IsSymbol3(value2){return IsKindOf(value2,"Symbol")}function IsTemplateLiteral(value2){return IsKindOf(value2,"TemplateLiteral")}function IsThis(value2){return IsKindOf(value2,"This")}function IsTransform(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple(value2){return IsKindOf(value2,"Tuple")}function IsUndefined3(value2){return IsKindOf(value2,"Undefined")}function IsUnion(value2){return IsKindOf(value2,"Union")}function IsUint8Array3(value2){return IsKindOf(value2,"Uint8Array")}function IsUnknown(value2){return IsKindOf(value2,"Unknown")}function IsUnsafe(value2){return IsKindOf(value2,"Unsafe")}function IsVoid(value2){return IsKindOf(value2,"Void")}function IsKind(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])}function IsSchema(value2){return IsAny(value2)||IsArgument(value2)||IsArray3(value2)||IsBoolean3(value2)||IsBigInt3(value2)||IsAsyncIterator3(value2)||IsComputed(value2)||IsConstructor(value2)||IsDate3(value2)||IsFunction3(value2)||IsInteger2(value2)||IsIntersect(value2)||IsIterator3(value2)||IsLiteral(value2)||IsMappedKey(value2)||IsMappedResult(value2)||IsNever(value2)||IsNot(value2)||IsNull3(value2)||IsNumber3(value2)||IsObject3(value2)||IsPromise2(value2)||IsRecord(value2)||IsRef(value2)||IsRegExp2(value2)||IsString3(value2)||IsSymbol3(value2)||IsTemplateLiteral(value2)||IsThis(value2)||IsTuple(value2)||IsUndefined3(value2)||IsUnion(value2)||IsUint8Array3(value2)||IsUnknown(value2)||IsUnsafe(value2)||IsVoid(value2)||IsKind(value2)}var init_kind=__esm(()=>{init_symbols2()});var exports_type={};__export(exports_type,{TypeGuardUnknownTypeError:()=>TypeGuardUnknownTypeError,IsVoid:()=>IsVoid2,IsUnsafe:()=>IsUnsafe2,IsUnknown:()=>IsUnknown2,IsUnionLiteral:()=>IsUnionLiteral,IsUnion:()=>IsUnion2,IsUndefined:()=>IsUndefined4,IsUint8Array:()=>IsUint8Array4,IsTuple:()=>IsTuple2,IsTransform:()=>IsTransform2,IsThis:()=>IsThis2,IsTemplateLiteral:()=>IsTemplateLiteral2,IsSymbol:()=>IsSymbol4,IsString:()=>IsString4,IsSchema:()=>IsSchema2,IsRegExp:()=>IsRegExp3,IsRef:()=>IsRef2,IsRecursive:()=>IsRecursive,IsRecord:()=>IsRecord2,IsReadonly:()=>IsReadonly2,IsProperties:()=>IsProperties,IsPromise:()=>IsPromise3,IsOptional:()=>IsOptional2,IsObject:()=>IsObject4,IsNumber:()=>IsNumber4,IsNull:()=>IsNull4,IsNot:()=>IsNot2,IsNever:()=>IsNever2,IsMappedResult:()=>IsMappedResult2,IsMappedKey:()=>IsMappedKey2,IsLiteralValue:()=>IsLiteralValue2,IsLiteralString:()=>IsLiteralString,IsLiteralNumber:()=>IsLiteralNumber,IsLiteralBoolean:()=>IsLiteralBoolean,IsLiteral:()=>IsLiteral2,IsKindOf:()=>IsKindOf2,IsKind:()=>IsKind2,IsIterator:()=>IsIterator4,IsIntersect:()=>IsIntersect2,IsInteger:()=>IsInteger3,IsImport:()=>IsImport,IsFunction:()=>IsFunction4,IsDate:()=>IsDate4,IsConstructor:()=>IsConstructor2,IsComputed:()=>IsComputed2,IsBoolean:()=>IsBoolean4,IsBigInt:()=>IsBigInt4,IsAsyncIterator:()=>IsAsyncIterator4,IsArray:()=>IsArray4,IsArgument:()=>IsArgument2,IsAny:()=>IsAny2});function IsPattern(value2){try{return new RegExp(value2),!0}catch{return!1}}function IsControlCharacterFree(value2){if(!IsString(value2))return!1;for(let i=0;i<value2.length;i++){let code=value2.charCodeAt(i);if(code>=7&&code<=13||code===27||code===127)return!1}return!0}function IsAdditionalProperties(value2){return IsOptionalBoolean(value2)||IsSchema2(value2)}function IsOptionalBigInt(value2){return IsUndefined(value2)||IsBigInt(value2)}function IsOptionalNumber(value2){return IsUndefined(value2)||IsNumber(value2)}function IsOptionalBoolean(value2){return IsUndefined(value2)||IsBoolean(value2)}function IsOptionalString(value2){return IsUndefined(value2)||IsString(value2)}function IsOptionalPattern(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)&&IsPattern(value2)}function IsOptionalFormat(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)}function IsOptionalSchema(value2){return IsUndefined(value2)||IsSchema2(value2)}function IsReadonly2(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional2(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny2(value2){return IsKindOf2(value2,"Any")&&IsOptionalString(value2.$id)}function IsArgument2(value2){return IsKindOf2(value2,"Argument")&&IsNumber(value2.index)}function IsArray4(value2){return IsKindOf2(value2,"Array")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)&&IsOptionalNumber(value2.minItems)&&IsOptionalNumber(value2.maxItems)&&IsOptionalBoolean(value2.uniqueItems)&&IsOptionalSchema(value2.contains)&&IsOptionalNumber(value2.minContains)&&IsOptionalNumber(value2.maxContains)}function IsAsyncIterator4(value2){return IsKindOf2(value2,"AsyncIterator")&&value2.type==="AsyncIterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsBigInt4(value2){return IsKindOf2(value2,"BigInt")&&value2.type==="bigint"&&IsOptionalString(value2.$id)&&IsOptionalBigInt(value2.exclusiveMaximum)&&IsOptionalBigInt(value2.exclusiveMinimum)&&IsOptionalBigInt(value2.maximum)&&IsOptionalBigInt(value2.minimum)&&IsOptionalBigInt(value2.multipleOf)}function IsBoolean4(value2){return IsKindOf2(value2,"Boolean")&&value2.type==="boolean"&&IsOptionalString(value2.$id)}function IsComputed2(value2){return IsKindOf2(value2,"Computed")&&IsString(value2.target)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))}function IsConstructor2(value2){return IsKindOf2(value2,"Constructor")&&value2.type==="Constructor"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsDate4(value2){return IsKindOf2(value2,"Date")&&value2.type==="Date"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximumTimestamp)&&IsOptionalNumber(value2.exclusiveMinimumTimestamp)&&IsOptionalNumber(value2.maximumTimestamp)&&IsOptionalNumber(value2.minimumTimestamp)&&IsOptionalNumber(value2.multipleOfTimestamp)}function IsFunction4(value2){return IsKindOf2(value2,"Function")&&value2.type==="Function"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsImport(value2){return IsKindOf2(value2,"Import")&&HasPropertyKey(value2,"$defs")&&IsObject(value2.$defs)&&IsProperties(value2.$defs)&&HasPropertyKey(value2,"$ref")&&IsString(value2.$ref)&&value2.$ref in value2.$defs}function IsInteger3(value2){return IsKindOf2(value2,"Integer")&&value2.type==="integer"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsProperties(value2){return IsObject(value2)&&Object.entries(value2).every(([key2,schema])=>IsControlCharacterFree(key2)&&IsSchema2(schema))}function IsIntersect2(value2){return IsKindOf2(value2,"Intersect")&&(IsString(value2.type)&&value2.type!=="object"?!1:!0)&&IsArray(value2.allOf)&&value2.allOf.every((schema)=>IsSchema2(schema)&&!IsTransform2(schema))&&IsOptionalString(value2.type)&&(IsOptionalBoolean(value2.unevaluatedProperties)||IsOptionalSchema(value2.unevaluatedProperties))&&IsOptionalString(value2.$id)}function IsIterator4(value2){return IsKindOf2(value2,"Iterator")&&value2.type==="Iterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsKindOf2(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralString(value2){return IsLiteral2(value2)&&IsString(value2.const)}function IsLiteralNumber(value2){return IsLiteral2(value2)&&IsNumber(value2.const)}function IsLiteralBoolean(value2){return IsLiteral2(value2)&&IsBoolean(value2.const)}function IsLiteral2(value2){return IsKindOf2(value2,"Literal")&&IsOptionalString(value2.$id)&&IsLiteralValue2(value2.const)}function IsLiteralValue2(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsMappedKey2(value2){return IsKindOf2(value2,"MappedKey")&&IsArray(value2.keys)&&value2.keys.every((key2)=>IsNumber(key2)||IsString(key2))}function IsMappedResult2(value2){return IsKindOf2(value2,"MappedResult")&&IsProperties(value2.properties)}function IsNever2(value2){return IsKindOf2(value2,"Never")&&IsObject(value2.not)&&Object.getOwnPropertyNames(value2.not).length===0}function IsNot2(value2){return IsKindOf2(value2,"Not")&&IsSchema2(value2.not)}function IsNull4(value2){return IsKindOf2(value2,"Null")&&value2.type==="null"&&IsOptionalString(value2.$id)}function IsNumber4(value2){return IsKindOf2(value2,"Number")&&value2.type==="number"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsObject4(value2){return IsKindOf2(value2,"Object")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsProperties(value2.properties)&&IsAdditionalProperties(value2.additionalProperties)&&IsOptionalNumber(value2.minProperties)&&IsOptionalNumber(value2.maxProperties)}function IsPromise3(value2){return IsKindOf2(value2,"Promise")&&value2.type==="Promise"&&IsOptionalString(value2.$id)&&IsSchema2(value2.item)}function IsRecord2(value2){return IsKindOf2(value2,"Record")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsAdditionalProperties(value2.additionalProperties)&&IsObject(value2.patternProperties)&&((schema)=>{let keys=Object.getOwnPropertyNames(schema.patternProperties);return keys.length===1&&IsPattern(keys[0])&&IsObject(schema.patternProperties)&&IsSchema2(schema.patternProperties[keys[0]])})(value2)}function IsRecursive(value2){return IsObject(value2)&&Hint in value2&&value2[Hint]==="Recursive"}function IsRef2(value2){return IsKindOf2(value2,"Ref")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsRegExp3(value2){return IsKindOf2(value2,"RegExp")&&IsOptionalString(value2.$id)&&IsString(value2.source)&&IsString(value2.flags)&&IsOptionalNumber(value2.maxLength)&&IsOptionalNumber(value2.minLength)}function IsString4(value2){return IsKindOf2(value2,"String")&&value2.type==="string"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minLength)&&IsOptionalNumber(value2.maxLength)&&IsOptionalPattern(value2.pattern)&&IsOptionalFormat(value2.format)}function IsSymbol4(value2){return IsKindOf2(value2,"Symbol")&&value2.type==="symbol"&&IsOptionalString(value2.$id)}function IsTemplateLiteral2(value2){return IsKindOf2(value2,"TemplateLiteral")&&value2.type==="string"&&IsString(value2.pattern)&&value2.pattern[0]==="^"&&value2.pattern[value2.pattern.length-1]==="$"}function IsThis2(value2){return IsKindOf2(value2,"This")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsTransform2(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple2(value2){return IsKindOf2(value2,"Tuple")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsNumber(value2.minItems)&&IsNumber(value2.maxItems)&&value2.minItems===value2.maxItems&&(IsUndefined(value2.items)&&IsUndefined(value2.additionalItems)&&value2.minItems===0||IsArray(value2.items)&&value2.items.every((schema)=>IsSchema2(schema)))}function IsUndefined4(value2){return IsKindOf2(value2,"Undefined")&&value2.type==="undefined"&&IsOptionalString(value2.$id)}function IsUnionLiteral(value2){return IsUnion2(value2)&&value2.anyOf.every((schema)=>IsLiteralString(schema)||IsLiteralNumber(schema))}function IsUnion2(value2){return IsKindOf2(value2,"Union")&&IsOptionalString(value2.$id)&&IsObject(value2)&&IsArray(value2.anyOf)&&value2.anyOf.every((schema)=>IsSchema2(schema))}function IsUint8Array4(value2){return IsKindOf2(value2,"Uint8Array")&&value2.type==="Uint8Array"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minByteLength)&&IsOptionalNumber(value2.maxByteLength)}function IsUnknown2(value2){return IsKindOf2(value2,"Unknown")&&IsOptionalString(value2.$id)}function IsUnsafe2(value2){return IsKindOf2(value2,"Unsafe")}function IsVoid2(value2){return IsKindOf2(value2,"Void")&&value2.type==="void"&&IsOptionalString(value2.$id)}function IsKind2(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])&&!KnownTypes.includes(value2[Kind])}function IsSchema2(value2){return IsObject(value2)&&(IsAny2(value2)||IsArgument2(value2)||IsArray4(value2)||IsBoolean4(value2)||IsBigInt4(value2)||IsAsyncIterator4(value2)||IsComputed2(value2)||IsConstructor2(value2)||IsDate4(value2)||IsFunction4(value2)||IsInteger3(value2)||IsIntersect2(value2)||IsIterator4(value2)||IsLiteral2(value2)||IsMappedKey2(value2)||IsMappedResult2(value2)||IsNever2(value2)||IsNot2(value2)||IsNull4(value2)||IsNumber4(value2)||IsObject4(value2)||IsPromise3(value2)||IsRecord2(value2)||IsRef2(value2)||IsRegExp3(value2)||IsString4(value2)||IsSymbol4(value2)||IsTemplateLiteral2(value2)||IsThis2(value2)||IsTuple2(value2)||IsUndefined4(value2)||IsUnion2(value2)||IsUint8Array4(value2)||IsUnknown2(value2)||IsUnsafe2(value2)||IsVoid2(value2)||IsKind2(value2))}var TypeGuardUnknownTypeError,KnownTypes;var init_type3=__esm(()=>{init_symbols2();init_error2();TypeGuardUnknownTypeError=class TypeGuardUnknownTypeError extends TypeBoxError{};KnownTypes=["Argument","Any","Array","AsyncIterator","BigInt","Boolean","Computed","Constructor","Date","Enum","Function","Integer","Intersect","Iterator","Literal","MappedKey","MappedResult","Not","Null","Number","Object","Promise","Record","Ref","RegExp","String","Symbol","TemplateLiteral","This","Tuple","Undefined","Union","Uint8Array","Unknown","Void"]});var init_guard2=__esm(()=>{init_kind();init_type3()});var init_helpers2=()=>{};var PatternBoolean="(true|false)",PatternNumber="(0|[1-9][0-9]*)",PatternString="(.*)",PatternNumberExact="^(0|[1-9][0-9]*)$",PatternStringExact="^(.*)$",PatternNeverExact="^(?!.*)$";var init_patterns=()=>{};var exports_format={};__export(exports_format,{Set:()=>Set3,Has:()=>Has,Get:()=>Get,Entries:()=>Entries,Delete:()=>Delete3,Clear:()=>Clear});function Entries(){return new Map(map)}function Clear(){return map.clear()}function Delete3(format2){return map.delete(format2)}function Has(format2){return map.has(format2)}function Set3(format2,func){map.set(format2,func)}function Get(format2){return map.get(format2)}var map;var init_format=__esm(()=>{map=new Map});var exports_type2={};__export(exports_type2,{Set:()=>Set4,Has:()=>Has2,Get:()=>Get2,Entries:()=>Entries2,Delete:()=>Delete4,Clear:()=>Clear2});function Entries2(){return new Map(map2)}function Clear2(){return map2.clear()}function Delete4(kind){return map2.delete(kind)}function Has2(kind){return map2.has(kind)}function Set4(kind,func){map2.set(kind,func)}function Get2(kind){return map2.get(kind)}var map2;var init_type4=__esm(()=>{map2=new Map});var init_registry4=__esm(()=>{init_format();init_type4()});function SetIncludes(T,S){return T.includes(S)}function SetDistinct(T){return[...new Set(T)]}function SetIntersect(T,S){return T.filter((L)=>S.includes(L))}function SetIntersectManyResolve(T,Init){return T.reduce((Acc,L)=>{return SetIntersect(Acc,L)},Init)}function SetIntersectMany(T){return T.length===1?T[0]:T.length>1?SetIntersectManyResolve(T.slice(1),T[0]):[]}function SetUnionMany(T){let Acc=[];for(let L of T)Acc.push(...L);return Acc}var init_sets=()=>{};function Any2(options){return CreateType({[Kind]:"Any"},options)}var init_any=__esm(()=>{init_create();init_symbols2()});var init_any2=__esm(()=>{init_any()});function Array2(items,options){return CreateType({[Kind]:"Array",type:"array",items},options)}var init_array=__esm(()=>{init_type2();init_symbols2()});var init_array2=__esm(()=>{init_array()});function Argument(index){return CreateType({[Kind]:"Argument",index})}var init_argument=__esm(()=>{init_type2();init_symbols2()});var init_argument2=__esm(()=>{init_argument()});function AsyncIterator2(items,options){return CreateType({[Kind]:"AsyncIterator",type:"AsyncIterator",items},options)}var init_async_iterator=__esm(()=>{init_symbols2();init_type2()});var init_async_iterator2=__esm(()=>{init_async_iterator()});function Computed(target2,parameters2,options){return CreateType({[Kind]:"Computed",target:target2,parameters:parameters2},options)}var init_computed=__esm(()=>{init_create();init_symbols()});var init_computed2=__esm(()=>{init_computed()});function DiscardKey(value2,key2){let{[key2]:_,...rest}=value2;return rest}function Discard(value2,keys){return keys.reduce((acc,key2)=>DiscardKey(acc,key2),value2)}var init_discard=()=>{};function Never(options){return CreateType({[Kind]:"Never",not:{}},options)}var init_never=__esm(()=>{init_type2();init_symbols2()});var init_never2=__esm(()=>{init_never()});var init_mapped_key=()=>{};function MappedResult(properties){return CreateType({[Kind]:"MappedResult",properties})}var init_mapped_result=__esm(()=>{init_type2();init_symbols2()});function Constructor(parameters2,returns,options){return CreateType({[Kind]:"Constructor",type:"Constructor",parameters:parameters2,returns},options)}var init_constructor=__esm(()=>{init_type2();init_symbols2()});var init_constructor2=__esm(()=>{init_constructor()});function Function2(parameters2,returns,options){return CreateType({[Kind]:"Function",type:"Function",parameters:parameters2,returns},options)}var init_function=__esm(()=>{init_type2();init_symbols2()});var init_function2=__esm(()=>{init_function()});function UnionCreate(T,options){return CreateType({[Kind]:"Union",anyOf:T},options)}var init_union_create=__esm(()=>{init_type2();init_symbols2()});function IsUnionOptional(types17){return types17.some((type3)=>IsOptional(type3))}function RemoveOptionalFromRest(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType(left):left)}function RemoveOptionalFromType(T){return Discard(T,[OptionalKind])}function ResolveUnion(types17,options){return IsUnionOptional(types17)?Optional(UnionCreate(RemoveOptionalFromRest(types17),options)):UnionCreate(RemoveOptionalFromRest(types17),options)}function UnionEvaluated(T,options){return T.length===1?CreateType(T[0],options):T.length===0?Never(options):ResolveUnion(T,options)}var init_union_evaluated=__esm(()=>{init_type2();init_symbols2();init_discard();init_never2();init_optional2();init_union_create();init_kind()});var init_union_type=()=>{};function Union(types17,options){return types17.length===0?Never(options):types17.length===1?CreateType(types17[0],options):UnionCreate(types17,options)}var init_union=__esm(()=>{init_never2();init_type2();init_union_create()});var init_union2=__esm(()=>{init_union_evaluated();init_union_type();init_union()});function Unescape(pattern){return pattern.replace(/\\\$/g,"$").replace(/\\\*/g,"*").replace(/\\\^/g,"^").replace(/\\\|/g,"|").replace(/\\\(/g,"(").replace(/\\\)/g,")")}function IsNonEscaped(pattern,index,char){return pattern[index]===char&&pattern.charCodeAt(index-1)!==92}function IsOpenParen(pattern,index){return IsNonEscaped(pattern,index,"(")}function IsCloseParen(pattern,index){return IsNonEscaped(pattern,index,")")}function IsSeparator(pattern,index){return IsNonEscaped(pattern,index,"|")}function IsGroup(pattern){if(!(IsOpenParen(pattern,0)&&IsCloseParen(pattern,pattern.length-1)))return!1;let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(count2===0&&index!==pattern.length-1)return!1}return!0}function InGroup(pattern){return pattern.slice(1,pattern.length-1)}function IsPrecedenceOr(pattern){let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0)return!0}return!1}function IsPrecedenceAnd(pattern){for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index))return!0;return!1}function Or(pattern){let[count2,start]=[0,0],expressions=[];for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0){let range2=pattern.slice(start,index);if(range2.length>0)expressions.push(TemplateLiteralParse(range2));start=index+1}}let range=pattern.slice(start);if(range.length>0)expressions.push(TemplateLiteralParse(range));if(expressions.length===0)return{type:"const",const:""};if(expressions.length===1)return expressions[0];return{type:"or",expr:expressions}}function And(pattern){function Group(value2,index){if(!IsOpenParen(value2,index))throw new TemplateLiteralParserError("TemplateLiteralParser: Index must point to open parens");let count2=0;for(let scan=index;scan<value2.length;scan++){if(IsOpenParen(value2,scan))count2+=1;if(IsCloseParen(value2,scan))count2-=1;if(count2===0)return[index,scan]}throw new TemplateLiteralParserError("TemplateLiteralParser: Unclosed group parens in expression")}function Range(pattern2,index){for(let scan=index;scan<pattern2.length;scan++)if(IsOpenParen(pattern2,scan))return[index,scan];return[index,pattern2.length]}let expressions=[];for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index)){let[start,end]=Group(pattern,index),range=pattern.slice(start,end+1);expressions.push(TemplateLiteralParse(range)),index=end}else{let[start,end]=Range(pattern,index),range=pattern.slice(start,end);if(range.length>0)expressions.push(TemplateLiteralParse(range));index=end-1}return expressions.length===0?{type:"const",const:""}:expressions.length===1?expressions[0]:{type:"and",expr:expressions}}function TemplateLiteralParse(pattern){return IsGroup(pattern)?TemplateLiteralParse(InGroup(pattern)):IsPrecedenceOr(pattern)?Or(pattern):IsPrecedenceAnd(pattern)?And(pattern):{type:"const",const:Unescape(pattern)}}function TemplateLiteralParseExact(pattern){return TemplateLiteralParse(pattern.slice(1,pattern.length-1))}var TemplateLiteralParserError;var init_parse=__esm(()=>{init_error2();TemplateLiteralParserError=class TemplateLiteralParserError extends TypeBoxError{}});function IsNumberExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="0"&&expression.expr[1].type==="const"&&expression.expr[1].const==="[1-9][0-9]*"}function IsBooleanExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="true"&&expression.expr[1].type==="const"&&expression.expr[1].const==="false"}function IsStringExpression(expression){return expression.type==="const"&&expression.const===".*"}function IsTemplateLiteralExpressionFinite(expression){return IsNumberExpression(expression)||IsStringExpression(expression)?!1:IsBooleanExpression(expression)?!0:expression.type==="and"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="or"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="const"?!0:(()=>{throw new TemplateLiteralFiniteError("Unknown expression type")})()}function IsTemplateLiteralFinite(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)}var TemplateLiteralFiniteError;var init_finite=__esm(()=>{init_parse();init_error2();TemplateLiteralFiniteError=class TemplateLiteralFiniteError extends TypeBoxError{}});function*GenerateReduce(buffer){if(buffer.length===1)return yield*buffer[0];for(let left of buffer[0])for(let right of GenerateReduce(buffer.slice(1)))yield`${left}${right}`}function*GenerateAnd(expression){return yield*GenerateReduce(expression.expr.map((expr)=>[...TemplateLiteralExpressionGenerate(expr)]))}function*GenerateOr(expression){for(let expr of expression.expr)yield*TemplateLiteralExpressionGenerate(expr)}function*GenerateConst(expression){return yield expression.const}function*TemplateLiteralExpressionGenerate(expression){return expression.type==="and"?yield*GenerateAnd(expression):expression.type==="or"?yield*GenerateOr(expression):expression.type==="const"?yield*GenerateConst(expression):(()=>{throw new TemplateLiteralGenerateError("Unknown expression")})()}function TemplateLiteralGenerate(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)?[...TemplateLiteralExpressionGenerate(expression)]:[]}var TemplateLiteralGenerateError;var init_generate=__esm(()=>{init_finite();init_parse();init_error2();TemplateLiteralGenerateError=class TemplateLiteralGenerateError extends TypeBoxError{}});function Literal(value2,options){return CreateType({[Kind]:"Literal",const:value2,type:typeof value2},options)}var init_literal=__esm(()=>{init_type2();init_symbols2()});var init_literal2=__esm(()=>{init_literal()});function Boolean3(options){return CreateType({[Kind]:"Boolean",type:"boolean"},options)}var init_boolean=__esm(()=>{init_symbols2();init_create()});var init_boolean2=__esm(()=>{init_boolean()});function BigInt2(options){return CreateType({[Kind]:"BigInt",type:"bigint"},options)}var init_bigint=__esm(()=>{init_symbols2();init_create()});var init_bigint2=__esm(()=>{init_bigint()});function Number2(options){return CreateType({[Kind]:"Number",type:"number"},options)}var init_number=__esm(()=>{init_type2();init_symbols2()});var init_number2=__esm(()=>{init_number()});function String2(options){return CreateType({[Kind]:"String",type:"string"},options)}var init_string=__esm(()=>{init_type2();init_symbols2()});var init_string2=__esm(()=>{init_string()});function*FromUnion(syntax){let trim=syntax.trim().replace(/"|'/g,"");return trim==="boolean"?yield Boolean3():trim==="number"?yield Number2():trim==="bigint"?yield BigInt2():trim==="string"?yield String2():yield(()=>{let literals=trim.split("|").map((literal2)=>Literal(literal2.trim()));return literals.length===0?Never():literals.length===1?literals[0]:UnionEvaluated(literals)})()}function*FromTerminal(syntax){if(syntax[1]!=="{"){let L=Literal("$"),R=FromSyntax(syntax.slice(1));return yield*[L,...R]}for(let i=2;i<syntax.length;i++)if(syntax[i]==="}"){let L=FromUnion(syntax.slice(2,i)),R=FromSyntax(syntax.slice(i+1));return yield*[...L,...R]}yield Literal(syntax)}function*FromSyntax(syntax){for(let i=0;i<syntax.length;i++)if(syntax[i]==="$"){let L=Literal(syntax.slice(0,i)),R=FromTerminal(syntax.slice(i));return yield*[L,...R]}yield Literal(syntax)}function TemplateLiteralSyntax(syntax){return[...FromSyntax(syntax)]}var init_syntax=__esm(()=>{init_literal2();init_boolean2();init_bigint2();init_number2();init_string2();init_union2();init_never2()});function Escape(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Visit2(schema,acc){return IsTemplateLiteral(schema)?schema.pattern.slice(1,schema.pattern.length-1):IsUnion(schema)?`(${schema.anyOf.map((schema2)=>Visit2(schema2,acc)).join("|")})`:IsNumber3(schema)?`${acc}${PatternNumber}`:IsInteger2(schema)?`${acc}${PatternNumber}`:IsBigInt3(schema)?`${acc}${PatternNumber}`:IsString3(schema)?`${acc}${PatternString}`:IsLiteral(schema)?`${acc}${Escape(schema.const.toString())}`:IsBoolean3(schema)?`${acc}${PatternBoolean}`:(()=>{throw new TemplateLiteralPatternError(`Unexpected Kind '${schema[Kind]}'`)})()}function TemplateLiteralPattern(kinds){return`^${kinds.map((schema)=>Visit2(schema,"")).join("")}$`}var TemplateLiteralPatternError;var init_pattern=__esm(()=>{init_patterns();init_symbols2();init_error2();init_kind();TemplateLiteralPatternError=class TemplateLiteralPatternError extends TypeBoxError{}});function TemplateLiteralToUnion(schema){let L=TemplateLiteralGenerate(schema).map((S)=>Literal(S));return UnionEvaluated(L)}var init_union3=__esm(()=>{init_union2();init_literal2();init_generate()});function TemplateLiteral(unresolved,options){let pattern=IsString(unresolved)?TemplateLiteralPattern(TemplateLiteralSyntax(unresolved)):TemplateLiteralPattern(unresolved);return CreateType({[Kind]:"TemplateLiteral",type:"string",pattern},options)}var init_template_literal=__esm(()=>{init_type2();init_syntax();init_pattern();init_symbols2()});var init_template_literal2=__esm(()=>{init_finite();init_generate();init_syntax();init_parse();init_pattern();init_union3();init_template_literal()});function FromTemplateLiteral(templateLiteral){return TemplateLiteralGenerate(templateLiteral).map((key2)=>key2.toString())}function FromUnion2(types17){let result=[];for(let type3 of types17)result.push(...IndexPropertyKeys(type3));return result}function FromLiteral(literalValue){return[literalValue.toString()]}function IndexPropertyKeys(type3){return[...new Set(IsTemplateLiteral(type3)?FromTemplateLiteral(type3):IsUnion(type3)?FromUnion2(type3.anyOf):IsLiteral(type3)?FromLiteral(type3.const):IsNumber3(type3)?["[number]"]:IsInteger2(type3)?["[number]"]:[])]}var init_indexed_property_keys=__esm(()=>{init_template_literal2();init_kind()});function FromProperties(type3,properties,options){let result={};for(let K2 of Object.getOwnPropertyNames(properties))result[K2]=Index(type3,IndexPropertyKeys(properties[K2]),options);return result}function FromMappedResult(type3,mappedResult,options){return FromProperties(type3,mappedResult.properties,options)}function IndexFromMappedResult(type3,mappedResult,options){let properties=FromMappedResult(type3,mappedResult,options);return MappedResult(properties)}var init_indexed_from_mapped_result=__esm(()=>{init_mapped2();init_indexed_property_keys();init_indexed2()});function FromRest(types17,key2){return types17.map((type3)=>IndexFromPropertyKey(type3,key2))}function FromIntersectRest(types17){return types17.filter((type3)=>!IsNever(type3))}function FromIntersect(types17,key2){return IntersectEvaluated(FromIntersectRest(FromRest(types17,key2)))}function FromUnionRest(types17){return types17.some((L)=>IsNever(L))?[]:types17}function FromUnion3(types17,key2){return UnionEvaluated(FromUnionRest(FromRest(types17,key2)))}function FromTuple(types17,key2){return key2 in types17?types17[key2]:key2==="[number]"?UnionEvaluated(types17):Never()}function FromArray(type3,key2){return key2==="[number]"?type3:Never()}function FromProperty(properties,propertyKey){return propertyKey in properties?properties[propertyKey]:Never()}function IndexFromPropertyKey(type3,propertyKey){return IsIntersect(type3)?FromIntersect(type3.allOf,propertyKey):IsUnion(type3)?FromUnion3(type3.anyOf,propertyKey):IsTuple(type3)?FromTuple(type3.items??[],propertyKey):IsArray3(type3)?FromArray(type3.items,propertyKey):IsObject3(type3)?FromProperty(type3.properties,propertyKey):Never()}function IndexFromPropertyKeys(type3,propertyKeys){return propertyKeys.map((propertyKey)=>IndexFromPropertyKey(type3,propertyKey))}function FromSchema(type3,propertyKeys){return UnionEvaluated(IndexFromPropertyKeys(type3,propertyKeys))}function Index(type3,key2,options){if(IsRef(type3)||IsRef(key2)){if(!IsSchema(type3)||!IsSchema(key2))throw new TypeBoxError("Index types using Ref parameters require both Type and Key to be of TSchema");return Computed("Index",[type3,key2])}if(IsMappedResult(key2))return IndexFromMappedResult(type3,key2,options);if(IsMappedKey(key2))return IndexFromMappedKey(type3,key2,options);return CreateType(IsSchema(key2)?FromSchema(type3,IndexPropertyKeys(key2)):FromSchema(type3,key2),options)}var init_indexed=__esm(()=>{init_type2();init_error2();init_computed2();init_never2();init_intersect2();init_union2();init_indexed_property_keys();init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_kind()});function MappedIndexPropertyKey(type3,key2,options){return{[key2]:Index(type3,[key2],Clone(options))}}function MappedIndexPropertyKeys(type3,propertyKeys,options){return propertyKeys.reduce((result,left)=>{return{...result,...MappedIndexPropertyKey(type3,left,options)}},{})}function MappedIndexProperties(type3,mappedKey,options){return MappedIndexPropertyKeys(type3,mappedKey.keys,options)}function IndexFromMappedKey(type3,mappedKey,options){let properties=MappedIndexProperties(type3,mappedKey,options);return MappedResult(properties)}var init_indexed_from_mapped_key=__esm(()=>{init_indexed();init_mapped2();init_value()});var init_indexed2=__esm(()=>{init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_indexed_property_keys();init_indexed()});function Iterator2(items,options){return CreateType({[Kind]:"Iterator",type:"Iterator",items},options)}var init_iterator=__esm(()=>{init_type2();init_symbols2()});var init_iterator2=__esm(()=>{init_iterator()});function RequiredArray(properties){return globalThis.Object.keys(properties).filter((key2)=>!IsOptional(properties[key2]))}function _Object(properties,options){let required=RequiredArray(properties),schema=required.length>0?{[Kind]:"Object",type:"object",required,properties}:{[Kind]:"Object",type:"object",properties};return CreateType(schema,options)}var Object2;var init_object=__esm(()=>{init_type2();init_symbols2();init_kind();Object2=_Object});var init_object2=__esm(()=>{init_object()});function Promise2(item,options){return CreateType({[Kind]:"Promise",type:"Promise",item},options)}var init_promise=__esm(()=>{init_type2();init_symbols2()});var init_promise2=__esm(()=>{init_promise()});function RemoveReadonly(schema){return CreateType(Discard(schema,[ReadonlyKind]))}function AddReadonly(schema){return CreateType({...schema,[ReadonlyKind]:"Readonly"})}function ReadonlyWithFlag(schema,F){return F===!1?RemoveReadonly(schema):AddReadonly(schema)}function Readonly(schema,enable){let F=enable??!0;return IsMappedResult(schema)?ReadonlyFromMappedResult(schema,F):ReadonlyWithFlag(schema,F)}var init_readonly=__esm(()=>{init_type2();init_symbols2();init_discard();init_readonly_from_mapped_result();init_kind()});function FromProperties2(K,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Readonly(K[K2],F);return Acc}function FromMappedResult2(R,F){return FromProperties2(R.properties,F)}function ReadonlyFromMappedResult(R,F){let P=FromMappedResult2(R,F);return MappedResult(P)}var init_readonly_from_mapped_result=__esm(()=>{init_mapped2();init_readonly()});var init_readonly2=__esm(()=>{init_readonly_from_mapped_result();init_readonly()});function Tuple(types17,options){return CreateType(types17.length>0?{[Kind]:"Tuple",type:"array",items:types17,additionalItems:!1,minItems:types17.length,maxItems:types17.length}:{[Kind]:"Tuple",type:"array",minItems:types17.length,maxItems:types17.length},options)}var init_tuple=__esm(()=>{init_type2();init_symbols2()});var init_tuple2=__esm(()=>{init_tuple()});function FromMappedResult3(K,P){return K in P?FromSchemaType(K,P[K]):MappedResult(P)}function MappedKeyToKnownMappedResultProperties(K){return{[K]:Literal(K)}}function MappedKeyToUnknownMappedResultProperties(P){let Acc={};for(let L of P)Acc[L]=Literal(L);return Acc}function MappedKeyToMappedResultProperties(K,P){return SetIncludes(P,K)?MappedKeyToKnownMappedResultProperties(K):MappedKeyToUnknownMappedResultProperties(P)}function FromMappedKey(K,P){let R=MappedKeyToMappedResultProperties(K,P);return FromMappedResult3(K,R)}function FromRest2(K,T){return T.map((L)=>FromSchemaType(K,L))}function FromProperties3(K,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(T))Acc[K2]=FromSchemaType(K,T[K2]);return Acc}function FromSchemaType(K,T){let options={...T};return IsOptional(T)?Optional(FromSchemaType(K,Discard(T,[OptionalKind]))):IsReadonly(T)?Readonly(FromSchemaType(K,Discard(T,[ReadonlyKind]))):IsMappedResult(T)?FromMappedResult3(K,T.properties):IsMappedKey(T)?FromMappedKey(K,T.keys):IsConstructor(T)?Constructor(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsFunction3(T)?Function2(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsAsyncIterator3(T)?AsyncIterator2(FromSchemaType(K,T.items),options):IsIterator3(T)?Iterator2(FromSchemaType(K,T.items),options):IsIntersect(T)?Intersect(FromRest2(K,T.allOf),options):IsUnion(T)?Union(FromRest2(K,T.anyOf),options):IsTuple(T)?Tuple(FromRest2(K,T.items??[]),options):IsObject3(T)?Object2(FromProperties3(K,T.properties),options):IsArray3(T)?Array2(FromSchemaType(K,T.items),options):IsPromise2(T)?Promise2(FromSchemaType(K,T.item),options):T}function MappedFunctionReturnType(K,T){let Acc={};for(let L of K)Acc[L]=FromSchemaType(L,T);return Acc}function Mapped(key2,map3,options){let K=IsSchema(key2)?IndexPropertyKeys(key2):key2,RT=map3({[Kind]:"MappedKey",keys:K}),R=MappedFunctionReturnType(K,RT);return Object2(R,options)}var init_mapped=__esm(()=>{init_symbols2();init_discard();init_array2();init_async_iterator2();init_constructor2();init_function2();init_indexed2();init_intersect2();init_iterator2();init_literal2();init_object2();init_optional2();init_promise2();init_readonly2();init_tuple2();init_union2();init_sets();init_mapped_result();init_kind()});var init_mapped2=__esm(()=>{init_mapped_key();init_mapped_result();init_mapped()});function RemoveOptional(schema){return CreateType(Discard(schema,[OptionalKind]))}function AddOptional(schema){return CreateType({...schema,[OptionalKind]:"Optional"})}function OptionalWithFlag(schema,F){return F===!1?RemoveOptional(schema):AddOptional(schema)}function Optional(schema,enable){let F=enable??!0;return IsMappedResult(schema)?OptionalFromMappedResult(schema,F):OptionalWithFlag(schema,F)}var init_optional=__esm(()=>{init_type2();init_symbols2();init_discard();init_optional_from_mapped_result();init_kind()});function FromProperties4(P,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Optional(P[K2],F);return Acc}function FromMappedResult4(R,F){return FromProperties4(R.properties,F)}function OptionalFromMappedResult(R,F){let P=FromMappedResult4(R,F);return MappedResult(P)}var init_optional_from_mapped_result=__esm(()=>{init_mapped2();init_optional()});var init_optional2=__esm(()=>{init_optional_from_mapped_result();init_optional()});function IntersectCreate(T,options={}){let allObjects=T.every((schema)=>IsObject3(schema)),clonedUnevaluatedProperties=IsSchema(options.unevaluatedProperties)?{unevaluatedProperties:options.unevaluatedProperties}:{};return CreateType(options.unevaluatedProperties===!1||IsSchema(options.unevaluatedProperties)||allObjects?{...clonedUnevaluatedProperties,[Kind]:"Intersect",type:"object",allOf:T}:{...clonedUnevaluatedProperties,[Kind]:"Intersect",allOf:T},options)}var init_intersect_create=__esm(()=>{init_type2();init_symbols2();init_kind()});function IsIntersectOptional(types17){return types17.every((left)=>IsOptional(left))}function RemoveOptionalFromType2(type3){return Discard(type3,[OptionalKind])}function RemoveOptionalFromRest2(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType2(left):left)}function ResolveIntersect(types17,options){return IsIntersectOptional(types17)?Optional(IntersectCreate(RemoveOptionalFromRest2(types17),options)):IntersectCreate(RemoveOptionalFromRest2(types17),options)}function IntersectEvaluated(types17,options={}){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return ResolveIntersect(types17,options)}var init_intersect_evaluated=__esm(()=>{init_symbols2();init_type2();init_discard();init_never2();init_optional2();init_intersect_create();init_kind()});var init_intersect_type=()=>{};function Intersect(types17,options){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return IntersectCreate(types17,options)}var init_intersect=__esm(()=>{init_type2();init_never2();init_intersect_create();init_kind()});var init_intersect2=__esm(()=>{init_intersect_evaluated();init_intersect_type();init_intersect()});function Ref(...args){let[$ref,options]=typeof args[0]==="string"?[args[0],args[1]]:[args[0].$id,args[1]];if(typeof $ref!=="string")throw new TypeBoxError("Ref: $ref must be a string");return CreateType({[Kind]:"Ref",$ref},options)}var init_ref=__esm(()=>{init_error2();init_type2();init_symbols2()});var init_ref2=__esm(()=>{init_ref()});function FromComputed(target2,parameters2){return Computed("Awaited",[Computed(target2,parameters2)])}function FromRef($ref){return Computed("Awaited",[Ref($ref)])}function FromIntersect2(types17){return Intersect(FromRest3(types17))}function FromUnion4(types17){return Union(FromRest3(types17))}function FromPromise(type3){return Awaited(type3)}function FromRest3(types17){return types17.map((type3)=>Awaited(type3))}function Awaited(type3,options){return CreateType(IsComputed(type3)?FromComputed(type3.target,type3.parameters):IsIntersect(type3)?FromIntersect2(type3.allOf):IsUnion(type3)?FromUnion4(type3.anyOf):IsPromise2(type3)?FromPromise(type3.item):IsRef(type3)?FromRef(type3.$ref):type3,options)}var init_awaited=__esm(()=>{init_type2();init_computed2();init_intersect2();init_union2();init_ref2();init_kind()});var init_awaited2=__esm(()=>{init_awaited()});function FromRest4(types17){let result=[];for(let L of types17)result.push(KeyOfPropertyKeys(L));return result}function FromIntersect3(types17){let propertyKeysArray=FromRest4(types17);return SetUnionMany(propertyKeysArray)}function FromUnion5(types17){let propertyKeysArray=FromRest4(types17);return SetIntersectMany(propertyKeysArray)}function FromTuple2(types17){return types17.map((_,indexer)=>indexer.toString())}function FromArray2(_){return["[number]"]}function FromProperties5(T){return globalThis.Object.getOwnPropertyNames(T)}function FromPatternProperties(patternProperties){if(!includePatternProperties)return[];return globalThis.Object.getOwnPropertyNames(patternProperties).map((key2)=>{return key2[0]==="^"&&key2[key2.length-1]==="$"?key2.slice(1,key2.length-1):key2})}function KeyOfPropertyKeys(type3){return IsIntersect(type3)?FromIntersect3(type3.allOf):IsUnion(type3)?FromUnion5(type3.anyOf):IsTuple(type3)?FromTuple2(type3.items??[]):IsArray3(type3)?FromArray2(type3.items):IsObject3(type3)?FromProperties5(type3.properties):IsRecord(type3)?FromPatternProperties(type3.patternProperties):[]}function KeyOfPattern(schema){includePatternProperties=!0;let keys=KeyOfPropertyKeys(schema);return includePatternProperties=!1,`^(${keys.map((key2)=>`(${key2})`).join("|")})$`}var includePatternProperties=!1;var init_keyof_property_keys=__esm(()=>{init_sets();init_kind()});function FromComputed2(target2,parameters2){return Computed("KeyOf",[Computed(target2,parameters2)])}function FromRef2($ref){return Computed("KeyOf",[Ref($ref)])}function KeyOfFromType(type3,options){let propertyKeys=KeyOfPropertyKeys(type3),propertyKeyTypes=KeyOfPropertyKeysToRest(propertyKeys),result=UnionEvaluated(propertyKeyTypes);return CreateType(result,options)}function KeyOfPropertyKeysToRest(propertyKeys){return propertyKeys.map((L)=>L==="[number]"?Number2():Literal(L))}function KeyOf(type3,options){return IsComputed(type3)?FromComputed2(type3.target,type3.parameters):IsRef(type3)?FromRef2(type3.$ref):IsMappedResult(type3)?KeyOfFromMappedResult(type3,options):KeyOfFromType(type3,options)}var init_keyof=__esm(()=>{init_type2();init_literal2();init_number2();init_computed2();init_ref2();init_keyof_property_keys();init_union2();init_keyof_from_mapped_result();init_kind()});function FromProperties6(properties,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=KeyOf(properties[K2],Clone(options));return result}function FromMappedResult5(mappedResult,options){return FromProperties6(mappedResult.properties,options)}function KeyOfFromMappedResult(mappedResult,options){let properties=FromMappedResult5(mappedResult,options);return MappedResult(properties)}var init_keyof_from_mapped_result=__esm(()=>{init_mapped2();init_keyof();init_value()});function KeyOfPropertyEntries(schema){let keys=KeyOfPropertyKeys(schema),schemas=IndexFromPropertyKeys(schema,keys);return keys.map((_,index)=>[keys[index],schemas[index]])}var init_keyof_property_entries=__esm(()=>{init_indexed();init_keyof_property_keys()});var init_keyof2=__esm(()=>{init_keyof_from_mapped_result();init_keyof_property_entries();init_keyof_property_keys();init_keyof()});function CompositeKeys(T){let Acc=[];for(let L of T)Acc.push(...KeyOfPropertyKeys(L));return SetDistinct(Acc)}function FilterNever(T){return T.filter((L)=>!IsNever(L))}function CompositeProperty(T,K){let Acc=[];for(let L of T)Acc.push(...IndexFromPropertyKeys(L,[K]));return FilterNever(Acc)}function CompositeProperties(T,K){let Acc={};for(let L of K)Acc[L]=IntersectEvaluated(CompositeProperty(T,L));return Acc}function Composite(T,options){let K=CompositeKeys(T),P=CompositeProperties(T,K);return Object2(P,options)}var init_composite=__esm(()=>{init_intersect2();init_indexed2();init_keyof2();init_object2();init_sets();init_kind()});var init_composite2=__esm(()=>{init_composite()});function Date2(options){return CreateType({[Kind]:"Date",type:"Date"},options)}var init_date=__esm(()=>{init_symbols2();init_type2()});var init_date2=__esm(()=>{init_date()});function Null2(options){return CreateType({[Kind]:"Null",type:"null"},options)}var init_null=__esm(()=>{init_type2();init_symbols2()});var init_null2=__esm(()=>{init_null()});function Symbol2(options){return CreateType({[Kind]:"Symbol",type:"symbol"},options)}var init_symbol=__esm(()=>{init_type2();init_symbols2()});var init_symbol2=__esm(()=>{init_symbol()});function Undefined(options){return CreateType({[Kind]:"Undefined",type:"undefined"},options)}var init_undefined=__esm(()=>{init_type2();init_symbols2()});var init_undefined2=__esm(()=>{init_undefined()});function Uint8Array2(options){return CreateType({[Kind]:"Uint8Array",type:"Uint8Array"},options)}var init_uint8array=__esm(()=>{init_type2();init_symbols2()});var init_uint8array2=__esm(()=>{init_uint8array()});function Unknown(options){return CreateType({[Kind]:"Unknown"},options)}var init_unknown=__esm(()=>{init_type2();init_symbols2()});var init_unknown2=__esm(()=>{init_unknown()});function FromArray3(T){return T.map((L)=>FromValue(L,!1))}function FromProperties7(value2){let Acc={};for(let K of globalThis.Object.getOwnPropertyNames(value2))Acc[K]=Readonly(FromValue(value2[K],!1));return Acc}function ConditionalReadonly(T,root){return root===!0?T:Readonly(T)}function FromValue(value2,root){return IsAsyncIterator(value2)?ConditionalReadonly(Any2(),root):IsIterator(value2)?ConditionalReadonly(Any2(),root):IsArray(value2)?Readonly(Tuple(FromArray3(value2))):IsUint8Array(value2)?Uint8Array2():IsDate(value2)?Date2():IsObject(value2)?ConditionalReadonly(Object2(FromProperties7(value2)),root):IsFunction(value2)?ConditionalReadonly(Function2([],Unknown()),root):IsUndefined(value2)?Undefined():IsNull(value2)?Null2():IsSymbol(value2)?Symbol2():IsBigInt(value2)?BigInt2():IsNumber(value2)?Literal(value2):IsBoolean(value2)?Literal(value2):IsString(value2)?Literal(value2):Object2({})}function Const(T,options){return CreateType(FromValue(T,!0),options)}var init_const=__esm(()=>{init_any2();init_bigint2();init_date2();init_function2();init_literal2();init_null2();init_object2();init_symbol2();init_tuple2();init_readonly2();init_undefined2();init_uint8array2();init_unknown2();init_create()});var init_const2=__esm(()=>{init_const()});function ConstructorParameters(schema,options){return IsConstructor(schema)?Tuple(schema.parameters,options):Never(options)}var init_constructor_parameters=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_constructor_parameters2=__esm(()=>{init_constructor_parameters()});function Enum(item,options){if(IsUndefined(item))throw Error("Enum undefined or empty");let values1=globalThis.Object.getOwnPropertyNames(item).filter((key2)=>isNaN(key2)).map((key2)=>item[key2]),anyOf=[...new Set(values1)].map((value2)=>Literal(value2));return Union(anyOf,{...options,[Hint]:"Enum"})}var init_enum=__esm(()=>{init_literal2();init_symbols2();init_union2()});var init_enum2=__esm(()=>{init_enum()});function IntoBooleanResult(result){return result===ExtendsResult.False?result:ExtendsResult.True}function Throw(message){throw new ExtendsResolverError(message)}function IsStructuralRight(right){return exports_type.IsNever(right)||exports_type.IsIntersect(right)||exports_type.IsUnion(right)||exports_type.IsUnknown(right)||exports_type.IsAny(right)}function StructuralRight(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):Throw("StructuralRight")}function FromAnyRight(left,right){return ExtendsResult.True}function FromAny(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)&&right.anyOf.some((schema)=>exports_type.IsAny(schema)||exports_type.IsUnknown(schema))?ExtendsResult.True:exports_type.IsUnion(right)?ExtendsResult.Union:exports_type.IsUnknown(right)?ExtendsResult.True:exports_type.IsAny(right)?ExtendsResult.True:ExtendsResult.Union}function FromArrayRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)?ExtendsResult.True:ExtendsResult.False}function FromArray4(left,right){return exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsArray(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromAsyncIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsAsyncIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromBigInt(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBigInt(right)?ExtendsResult.True:ExtendsResult.False}function FromBooleanRight(left,right){return exports_type.IsLiteralBoolean(left)?ExtendsResult.True:exports_type.IsBoolean(left)?ExtendsResult.True:ExtendsResult.False}function FromBoolean(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBoolean(right)?ExtendsResult.True:ExtendsResult.False}function FromConstructor(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsConstructor(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromDate(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsDate(right)?ExtendsResult.True:ExtendsResult.False}function FromFunction(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsFunction(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromIntegerRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsNumber(left.const)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromInteger(left,right){return exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):ExtendsResult.False}function FromIntersectRight(left,right){return right.allOf.every((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIntersect4(left,right){return left.allOf.some((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromLiteral2(left,right){return exports_type.IsLiteral(right)&&right.const===left.const?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):ExtendsResult.False}function FromNeverRight(left,right){return ExtendsResult.False}function FromNever(left,right){return ExtendsResult.True}function UnwrapTNot(schema){let[current,depth]=[schema,0];while(!0){if(!exports_type.IsNot(current))break;current=current.not,depth+=1}return depth%2===0?current:Unknown()}function FromNot(left,right){return exports_type.IsNot(left)?Visit3(UnwrapTNot(left),right):exports_type.IsNot(right)?Visit3(left,UnwrapTNot(right)):Throw("Invalid fallthrough for Not")}function FromNull(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsNull(right)?ExtendsResult.True:ExtendsResult.False}function FromNumberRight(left,right){return exports_type.IsLiteralNumber(left)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromNumber(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:ExtendsResult.False}function IsObjectPropertyCount(schema,count2){return Object.getOwnPropertyNames(schema.properties).length===count2}function IsObjectStringLike(schema){return IsObjectArrayLike(schema)}function IsObjectSymbolLike(schema){return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"description"in schema.properties&&exports_type.IsUnion(schema.properties.description)&&schema.properties.description.anyOf.length===2&&(exports_type.IsString(schema.properties.description.anyOf[0])&&exports_type.IsUndefined(schema.properties.description.anyOf[1])||exports_type.IsString(schema.properties.description.anyOf[1])&&exports_type.IsUndefined(schema.properties.description.anyOf[0]))}function IsObjectNumberLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBooleanLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBigIntLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectDateLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectUint8ArrayLike(schema){return IsObjectArrayLike(schema)}function IsObjectFunctionLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectConstructorLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectArrayLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectPromiseLike(schema){let then=Function2([Any2()],Any2());return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"then"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.then,then))===ExtendsResult.True}function Property(left,right){return Visit3(left,right)===ExtendsResult.False?ExtendsResult.False:exports_type.IsOptional(left)&&!exports_type.IsOptional(right)?ExtendsResult.False:ExtendsResult.True}function FromObjectRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)||exports_type.IsLiteralString(left)&&IsObjectStringLike(right)||exports_type.IsLiteralNumber(left)&&IsObjectNumberLike(right)||exports_type.IsLiteralBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsBigInt(left)&&IsObjectBigIntLike(right)||exports_type.IsString(left)&&IsObjectStringLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsNumber(left)&&IsObjectNumberLike(right)||exports_type.IsInteger(left)&&IsObjectNumberLike(right)||exports_type.IsBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsUint8Array(left)&&IsObjectUint8ArrayLike(right)||exports_type.IsDate(left)&&IsObjectDateLike(right)||exports_type.IsConstructor(left)&&IsObjectConstructorLike(right)||exports_type.IsFunction(left)&&IsObjectFunctionLike(right)?ExtendsResult.True:exports_type.IsRecord(left)&&exports_type.IsString(RecordKey(left))?(()=>{return right[Hint]==="Record"?ExtendsResult.True:ExtendsResult.False})():exports_type.IsRecord(left)&&exports_type.IsNumber(RecordKey(left))?(()=>{return IsObjectPropertyCount(right,0)?ExtendsResult.True:ExtendsResult.False})():ExtendsResult.False}function FromObject(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):!exports_type.IsObject(right)?ExtendsResult.False:(()=>{for(let key2 of Object.getOwnPropertyNames(right.properties)){if(!(key2 in left.properties)&&!exports_type.IsOptional(right.properties[key2]))return ExtendsResult.False;if(exports_type.IsOptional(right.properties[key2]))return ExtendsResult.True;if(Property(left.properties[key2],right.properties[key2])===ExtendsResult.False)return ExtendsResult.False}return ExtendsResult.True})()}function FromPromise2(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectPromiseLike(right)?ExtendsResult.True:!exports_type.IsPromise(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.item,right.item))}function RecordKey(schema){return PatternNumberExact in schema.patternProperties?Number2():(PatternStringExact in schema.patternProperties)?String2():Throw("Unknown record key pattern")}function RecordValue(schema){return PatternNumberExact in schema.patternProperties?schema.patternProperties[PatternNumberExact]:(PatternStringExact in schema.patternProperties)?schema.patternProperties[PatternStringExact]:Throw("Unable to get record value schema")}function FromRecordRight(left,right){let[Key,Value]=[RecordKey(right),RecordValue(right)];return exports_type.IsLiteralString(left)&&exports_type.IsNumber(Key)&&IntoBooleanResult(Visit3(left,Value))===ExtendsResult.True?ExtendsResult.True:exports_type.IsUint8Array(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsString(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsArray(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsObject(left)?(()=>{for(let key2 of Object.getOwnPropertyNames(left.properties))if(Property(Value,left.properties[key2])===ExtendsResult.False)return ExtendsResult.False;return ExtendsResult.True})():ExtendsResult.False}function FromRecord(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsRecord(right)?ExtendsResult.False:Visit3(RecordValue(left),RecordValue(right))}function FromRegExp(left,right){let L=exports_type.IsRegExp(left)?String2():left,R=exports_type.IsRegExp(right)?String2():right;return Visit3(L,R)}function FromStringRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsString(left.const)?ExtendsResult.True:exports_type.IsString(left)?ExtendsResult.True:ExtendsResult.False}function FromString(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?ExtendsResult.True:ExtendsResult.False}function FromSymbol(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsSymbol(right)?ExtendsResult.True:ExtendsResult.False}function FromTemplateLiteral2(left,right){return exports_type.IsTemplateLiteral(left)?Visit3(TemplateLiteralToUnion(left),right):exports_type.IsTemplateLiteral(right)?Visit3(left,TemplateLiteralToUnion(right)):Throw("Invalid fallthrough for TemplateLiteral")}function IsArrayOfTuple(left,right){return exports_type.IsArray(right)&&left.items!==void 0&&left.items.every((schema)=>Visit3(schema,right.items)===ExtendsResult.True)}function FromTupleRight(left,right){return exports_type.IsNever(left)?ExtendsResult.True:exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:ExtendsResult.False}function FromTuple3(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:exports_type.IsArray(right)&&IsArrayOfTuple(left,right)?ExtendsResult.True:!exports_type.IsTuple(right)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)||!exports_value.IsUndefined(left.items)&&exports_value.IsUndefined(right.items)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)?ExtendsResult.True:left.items.every((schema,index)=>Visit3(schema,right.items[index])===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUint8Array(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsUint8Array(right)?ExtendsResult.True:ExtendsResult.False}function FromUndefined(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsVoid(right)?FromVoidRight(left,right):exports_type.IsUndefined(right)?ExtendsResult.True:ExtendsResult.False}function FromUnionRight(left,right){return right.anyOf.some((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnion6(left,right){return left.anyOf.every((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnknownRight(left,right){return ExtendsResult.True}function FromUnknown(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):exports_type.IsArray(right)?FromArrayRight(left,right):exports_type.IsTuple(right)?FromTupleRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsUnknown(right)?ExtendsResult.True:ExtendsResult.False}function FromVoidRight(left,right){return exports_type.IsUndefined(left)?ExtendsResult.True:exports_type.IsUndefined(left)?ExtendsResult.True:ExtendsResult.False}function FromVoid(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsVoid(right)?ExtendsResult.True:ExtendsResult.False}function Visit3(left,right){return exports_type.IsTemplateLiteral(left)||exports_type.IsTemplateLiteral(right)?FromTemplateLiteral2(left,right):exports_type.IsRegExp(left)||exports_type.IsRegExp(right)?FromRegExp(left,right):exports_type.IsNot(left)||exports_type.IsNot(right)?FromNot(left,right):exports_type.IsAny(left)?FromAny(left,right):exports_type.IsArray(left)?FromArray4(left,right):exports_type.IsBigInt(left)?FromBigInt(left,right):exports_type.IsBoolean(left)?FromBoolean(left,right):exports_type.IsAsyncIterator(left)?FromAsyncIterator(left,right):exports_type.IsConstructor(left)?FromConstructor(left,right):exports_type.IsDate(left)?FromDate(left,right):exports_type.IsFunction(left)?FromFunction(left,right):exports_type.IsInteger(left)?FromInteger(left,right):exports_type.IsIntersect(left)?FromIntersect4(left,right):exports_type.IsIterator(left)?FromIterator(left,right):exports_type.IsLiteral(left)?FromLiteral2(left,right):exports_type.IsNever(left)?FromNever(left,right):exports_type.IsNull(left)?FromNull(left,right):exports_type.IsNumber(left)?FromNumber(left,right):exports_type.IsObject(left)?FromObject(left,right):exports_type.IsRecord(left)?FromRecord(left,right):exports_type.IsString(left)?FromString(left,right):exports_type.IsSymbol(left)?FromSymbol(left,right):exports_type.IsTuple(left)?FromTuple3(left,right):exports_type.IsPromise(left)?FromPromise2(left,right):exports_type.IsUint8Array(left)?FromUint8Array(left,right):exports_type.IsUndefined(left)?FromUndefined(left,right):exports_type.IsUnion(left)?FromUnion6(left,right):exports_type.IsUnknown(left)?FromUnknown(left,right):exports_type.IsVoid(left)?FromVoid(left,right):Throw(`Unknown left type operand '${left[Kind]}'`)}function ExtendsCheck(left,right){return Visit3(left,right)}var ExtendsResolverError,ExtendsResult;var init_extends_check=__esm(()=>{init_any2();init_function2();init_number2();init_string2();init_unknown2();init_template_literal2();init_patterns();init_symbols2();init_error2();init_guard2();ExtendsResolverError=class ExtendsResolverError extends TypeBoxError{};(function(ExtendsResult2){ExtendsResult2[ExtendsResult2.Union=0]="Union",ExtendsResult2[ExtendsResult2.True=1]="True",ExtendsResult2[ExtendsResult2.False=2]="False"})(ExtendsResult||(ExtendsResult={}))});function FromProperties8(P,Right,True,False,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extends(P[K2],Right,True,False,Clone(options));return Acc}function FromMappedResult6(Left,Right,True,False,options){return FromProperties8(Left.properties,Right,True,False,options)}function ExtendsFromMappedResult(Left,Right,True,False,options){let P=FromMappedResult6(Left,Right,True,False,options);return MappedResult(P)}var init_extends_from_mapped_result=__esm(()=>{init_mapped2();init_extends();init_value()});function ExtendsResolve(left,right,trueType,falseType){let R=ExtendsCheck(left,right);return R===ExtendsResult.Union?Union([trueType,falseType]):R===ExtendsResult.True?trueType:falseType}function Extends(L,R,T,F,options){return IsMappedResult(L)?ExtendsFromMappedResult(L,R,T,F,options):IsMappedKey(L)?CreateType(ExtendsFromMappedKey(L,R,T,F,options)):CreateType(ExtendsResolve(L,R,T,F),options)}var init_extends=__esm(()=>{init_type2();init_union2();init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_kind()});function FromPropertyKey(K,U,L,R,options){return{[K]:Extends(Literal(K),U,L,R,Clone(options))}}function FromPropertyKeys(K,U,L,R,options){return K.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey(LK,U,L,R,options)}},{})}function FromMappedKey2(K,U,L,R,options){return FromPropertyKeys(K.keys,U,L,R,options)}function ExtendsFromMappedKey(T,U,L,R,options){let P=FromMappedKey2(T,U,L,R,options);return MappedResult(P)}var init_extends_from_mapped_key=__esm(()=>{init_mapped2();init_literal2();init_extends();init_value()});function Intersect2(schema){return schema.allOf.every((schema2)=>ExtendsUndefinedCheck(schema2))}function Union2(schema){return schema.anyOf.some((schema2)=>ExtendsUndefinedCheck(schema2))}function Not(schema){return!ExtendsUndefinedCheck(schema.not)}function ExtendsUndefinedCheck(schema){return schema[Kind]==="Intersect"?Intersect2(schema):schema[Kind]==="Union"?Union2(schema):schema[Kind]==="Not"?Not(schema):schema[Kind]==="Undefined"?!0:!1}var init_extends_undefined=__esm(()=>{init_symbols2()});var init_extends2=__esm(()=>{init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_extends_undefined();init_extends()});function ExcludeFromTemplateLiteral(L,R){return Exclude(TemplateLiteralToUnion(L),R)}var init_exclude_from_template_literal=__esm(()=>{init_exclude();init_template_literal2()});function ExcludeRest(L,R){let excluded=L.filter((inner)=>ExtendsCheck(inner,R)===ExtendsResult.False);return excluded.length===1?excluded[0]:Union(excluded)}function Exclude(L,R,options={}){if(IsTemplateLiteral(L))return CreateType(ExcludeFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExcludeFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExcludeRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?Never():L,options)}var init_exclude=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_exclude_from_mapped_result();init_exclude_from_template_literal();init_kind()});function FromProperties9(P,U){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Exclude(P[K2],U);return Acc}function FromMappedResult7(R,T){return FromProperties9(R.properties,T)}function ExcludeFromMappedResult(R,T){let P=FromMappedResult7(R,T);return MappedResult(P)}var init_exclude_from_mapped_result=__esm(()=>{init_mapped2();init_exclude()});var init_exclude2=__esm(()=>{init_exclude_from_mapped_result();init_exclude_from_template_literal();init_exclude()});function ExtractFromTemplateLiteral(L,R){return Extract(TemplateLiteralToUnion(L),R)}var init_extract_from_template_literal=__esm(()=>{init_extract();init_template_literal2()});function ExtractRest(L,R){let extracted=L.filter((inner)=>ExtendsCheck(inner,R)!==ExtendsResult.False);return extracted.length===1?extracted[0]:Union(extracted)}function Extract(L,R,options){if(IsTemplateLiteral(L))return CreateType(ExtractFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExtractFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExtractRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?L:Never(),options)}var init_extract=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_extract_from_mapped_result();init_extract_from_template_literal();init_kind()});function FromProperties10(P,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extract(P[K2],T);return Acc}function FromMappedResult8(R,T){return FromProperties10(R.properties,T)}function ExtractFromMappedResult(R,T){let P=FromMappedResult8(R,T);return MappedResult(P)}var init_extract_from_mapped_result=__esm(()=>{init_mapped2();init_extract()});var init_extract2=__esm(()=>{init_extract_from_mapped_result();init_extract_from_template_literal();init_extract()});function InstanceType(schema,options){return IsConstructor(schema)?CreateType(schema.returns,options):Never(options)}var init_instance_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_instance_type2=__esm(()=>{init_instance_type()});function ReadonlyOptional(schema){return Readonly(Optional(schema))}var init_readonly_optional=__esm(()=>{init_readonly2();init_optional2()});var init_readonly_optional2=__esm(()=>{init_readonly_optional()});function RecordCreateFromPattern(pattern2,T,options){return CreateType({[Kind]:"Record",type:"object",patternProperties:{[pattern2]:T}},options)}function RecordCreateFromKeys(K,T,options){let result={};for(let K2 of K)result[K2]=T;return Object2(result,{...options,[Hint]:"Record"})}function FromTemplateLiteralKey(K,T,options){return IsTemplateLiteralFinite(K)?RecordCreateFromKeys(IndexPropertyKeys(K),T,options):RecordCreateFromPattern(K.pattern,T,options)}function FromUnionKey(key2,type3,options){return RecordCreateFromKeys(IndexPropertyKeys(Union(key2)),type3,options)}function FromLiteralKey(key2,type3,options){return RecordCreateFromKeys([key2.toString()],type3,options)}function FromRegExpKey(key2,type3,options){return RecordCreateFromPattern(key2.source,type3,options)}function FromStringKey(key2,type3,options){let pattern2=IsUndefined(key2.pattern)?PatternStringExact:key2.pattern;return RecordCreateFromPattern(pattern2,type3,options)}function FromAnyKey(_,type3,options){return RecordCreateFromPattern(PatternStringExact,type3,options)}function FromNeverKey(_key,type3,options){return RecordCreateFromPattern(PatternNeverExact,type3,options)}function FromBooleanKey(_key,type3,options){return Object2({true:type3,false:type3},options)}function FromIntegerKey(_key,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function FromNumberKey(_,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function Record(key2,type3,options={}){return IsUnion(key2)?FromUnionKey(key2.anyOf,type3,options):IsTemplateLiteral(key2)?FromTemplateLiteralKey(key2,type3,options):IsLiteral(key2)?FromLiteralKey(key2.const,type3,options):IsBoolean3(key2)?FromBooleanKey(key2,type3,options):IsInteger2(key2)?FromIntegerKey(key2,type3,options):IsNumber3(key2)?FromNumberKey(key2,type3,options):IsRegExp2(key2)?FromRegExpKey(key2,type3,options):IsString3(key2)?FromStringKey(key2,type3,options):IsAny(key2)?FromAnyKey(key2,type3,options):IsNever(key2)?FromNeverKey(key2,type3,options):Never(options)}function RecordPattern(record){return globalThis.Object.getOwnPropertyNames(record.patternProperties)[0]}function RecordKey2(type3){let pattern2=RecordPattern(type3);return pattern2===PatternStringExact?String2():pattern2===PatternNumberExact?Number2():String2({pattern:pattern2})}function RecordValue2(type3){return type3.patternProperties[RecordPattern(type3)]}var init_record=__esm(()=>{init_type2();init_symbols2();init_never2();init_number2();init_object2();init_string2();init_union2();init_template_literal2();init_patterns();init_indexed2();init_kind()});var init_record2=__esm(()=>{init_record()});function FromConstructor2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromFunction2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromIntersect5(args,type3){return type3.allOf=FromTypes(args,type3.allOf),type3}function FromUnion7(args,type3){return type3.anyOf=FromTypes(args,type3.anyOf),type3}function FromTuple4(args,type3){if(IsUndefined(type3.items))return type3;return type3.items=FromTypes(args,type3.items),type3}function FromArray5(args,type3){return type3.items=FromType(args,type3.items),type3}function FromAsyncIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromPromise3(args,type3){return type3.item=FromType(args,type3.item),type3}function FromObject2(args,type3){let mappedProperties=FromProperties11(args,type3.properties);return{...type3,...Object2(mappedProperties)}}function FromRecord2(args,type3){let mappedKey=FromType(args,RecordKey2(type3)),mappedValue=FromType(args,RecordValue2(type3)),result=Record(mappedKey,mappedValue);return{...type3,...result}}function FromArgument(args,argument2){return argument2.index in args?args[argument2.index]:Unknown()}function FromProperty2(args,type3){let isReadonly=IsReadonly(type3),isOptional=IsOptional(type3),mapped2=FromType(args,type3);return isReadonly&&isOptional?ReadonlyOptional(mapped2):isReadonly&&!isOptional?Readonly(mapped2):!isReadonly&&isOptional?Optional(mapped2):mapped2}function FromProperties11(args,properties){return globalThis.Object.getOwnPropertyNames(properties).reduce((result,key2)=>{return{...result,[key2]:FromProperty2(args,properties[key2])}},{})}function FromTypes(args,types17){return types17.map((type3)=>FromType(args,type3))}function FromType(args,type3){return IsConstructor(type3)?FromConstructor2(args,type3):IsFunction3(type3)?FromFunction2(args,type3):IsIntersect(type3)?FromIntersect5(args,type3):IsUnion(type3)?FromUnion7(args,type3):IsTuple(type3)?FromTuple4(args,type3):IsArray3(type3)?FromArray5(args,type3):IsAsyncIterator3(type3)?FromAsyncIterator2(args,type3):IsIterator3(type3)?FromIterator2(args,type3):IsPromise2(type3)?FromPromise3(args,type3):IsObject3(type3)?FromObject2(args,type3):IsRecord(type3)?FromRecord2(args,type3):IsArgument(type3)?FromArgument(args,type3):type3}function Instantiate(type3,args){return FromType(args,CloneType(type3))}var init_instantiate=__esm(()=>{init_type();init_unknown2();init_readonly_optional2();init_readonly2();init_optional2();init_object2();init_record2();init_kind()});var init_instantiate2=__esm(()=>{init_instantiate()});function Integer2(options){return CreateType({[Kind]:"Integer",type:"integer"},options)}var init_integer=__esm(()=>{init_type2();init_symbols2()});var init_integer2=__esm(()=>{init_integer()});function MappedIntrinsicPropertyKey(K,M,options){return{[K]:Intrinsic(Literal(K),M,Clone(options))}}function MappedIntrinsicPropertyKeys(K,M,options){return K.reduce((Acc,L)=>{return{...Acc,...MappedIntrinsicPropertyKey(L,M,options)}},{})}function MappedIntrinsicProperties(T,M,options){return MappedIntrinsicPropertyKeys(T.keys,M,options)}function IntrinsicFromMappedKey(T,M,options){let P=MappedIntrinsicProperties(T,M,options);return MappedResult(P)}var init_intrinsic_from_mapped_key=__esm(()=>{init_mapped2();init_intrinsic();init_literal2();init_value()});function ApplyUncapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toLowerCase(),rest].join("")}function ApplyCapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toUpperCase(),rest].join("")}function ApplyUppercase(value2){return value2.toUpperCase()}function ApplyLowercase(value2){return value2.toLowerCase()}function FromTemplateLiteral3(schema,mode,options){let expression=TemplateLiteralParseExact(schema.pattern);if(!IsTemplateLiteralExpressionFinite(expression))return{...schema,pattern:FromLiteralValue(schema.pattern,mode)};let literals=[...TemplateLiteralExpressionGenerate(expression)].map((value2)=>Literal(value2)),mapped2=FromRest5(literals,mode),union3=Union(mapped2);return TemplateLiteral([union3],options)}function FromLiteralValue(value2,mode){return typeof value2==="string"?mode==="Uncapitalize"?ApplyUncapitalize(value2):mode==="Capitalize"?ApplyCapitalize(value2):mode==="Uppercase"?ApplyUppercase(value2):mode==="Lowercase"?ApplyLowercase(value2):value2:value2.toString()}function FromRest5(T,M){return T.map((L)=>Intrinsic(L,M))}function Intrinsic(schema,mode,options={}){return IsMappedKey(schema)?IntrinsicFromMappedKey(schema,mode,options):IsTemplateLiteral(schema)?FromTemplateLiteral3(schema,mode,options):IsUnion(schema)?Union(FromRest5(schema.anyOf,mode),options):IsLiteral(schema)?Literal(FromLiteralValue(schema.const,mode),options):CreateType(schema,options)}var init_intrinsic=__esm(()=>{init_type2();init_template_literal2();init_intrinsic_from_mapped_key();init_literal2();init_union2();init_kind()});function Capitalize(T,options={}){return Intrinsic(T,"Capitalize",options)}var init_capitalize=__esm(()=>{init_intrinsic()});function Lowercase(T,options={}){return Intrinsic(T,"Lowercase",options)}var init_lowercase=__esm(()=>{init_intrinsic()});function Uncapitalize(T,options={}){return Intrinsic(T,"Uncapitalize",options)}var init_uncapitalize=__esm(()=>{init_intrinsic()});function Uppercase(T,options={}){return Intrinsic(T,"Uppercase",options)}var init_uppercase=__esm(()=>{init_intrinsic()});var init_intrinsic2=__esm(()=>{init_capitalize();init_intrinsic_from_mapped_key();init_intrinsic();init_lowercase();init_uncapitalize();init_uppercase()});function FromProperties12(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Omit(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult9(mappedResult,propertyKeys,options){return FromProperties12(mappedResult.properties,propertyKeys,options)}function OmitFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult9(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_omit_from_mapped_result=__esm(()=>{init_mapped2();init_omit();init_value()});function FromIntersect6(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromUnion8(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromProperty3(properties,key2){let{[key2]:_,...R}=properties;return R}function FromProperties13(properties,propertyKeys){return propertyKeys.reduce((T,K2)=>FromProperty3(T,K2),properties)}function FromObject3(type3,propertyKeys,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties13(properties,propertyKeys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function OmitResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect6(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion8(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject3(type3,propertyKeys,type3.properties):Object2({})}function Omit(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?OmitFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?OmitFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Omit",[type3,typeKey],options):CreateType({...OmitResolve(type3,propertyKeys),...options})}var init_omit=__esm(()=>{init_type2();init_symbols();init_computed2();init_literal2();init_indexed2();init_intersect2();init_union2();init_object2();init_omit_from_mapped_key();init_omit_from_mapped_result();init_kind()});function FromPropertyKey2(type3,key2,options){return{[key2]:Omit(type3,[key2],Clone(options))}}function FromPropertyKeys2(type3,propertyKeys,options){return propertyKeys.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey2(type3,LK,options)}},{})}function FromMappedKey3(type3,mappedKey,options){return FromPropertyKeys2(type3,mappedKey.keys,options)}function OmitFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey3(type3,mappedKey,options);return MappedResult(properties)}var init_omit_from_mapped_key=__esm(()=>{init_mapped2();init_omit();init_value()});var init_omit2=__esm(()=>{init_omit_from_mapped_key();init_omit_from_mapped_result();init_omit()});function FromProperties14(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Pick(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult10(mappedResult,propertyKeys,options){return FromProperties14(mappedResult.properties,propertyKeys,options)}function PickFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult10(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_pick_from_mapped_result=__esm(()=>{init_mapped2();init_pick();init_value()});function FromIntersect7(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromUnion9(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromProperties15(properties,propertyKeys){let result={};for(let K2 of propertyKeys)if(K2 in properties)result[K2]=properties[K2];return result}function FromObject4(Type,keys,properties){let options=Discard(Type,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties15(properties,keys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys2(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function PickResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect7(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion9(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject4(type3,propertyKeys,type3.properties):Object2({})}function Pick(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys2(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?PickFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?PickFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Pick",[type3,typeKey],options):CreateType({...PickResolve(type3,propertyKeys),...options})}var init_pick=__esm(()=>{init_type2();init_computed2();init_intersect2();init_literal2();init_object2();init_union2();init_indexed2();init_symbols();init_kind();init_pick_from_mapped_key();init_pick_from_mapped_result()});function FromPropertyKey3(type3,key2,options){return{[key2]:Pick(type3,[key2],Clone(options))}}function FromPropertyKeys3(type3,propertyKeys,options){return propertyKeys.reduce((result,leftKey)=>{return{...result,...FromPropertyKey3(type3,leftKey,options)}},{})}function FromMappedKey4(type3,mappedKey,options){return FromPropertyKeys3(type3,mappedKey.keys,options)}function PickFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey4(type3,mappedKey,options);return MappedResult(properties)}var init_pick_from_mapped_key=__esm(()=>{init_mapped2();init_pick();init_value()});var init_pick2=__esm(()=>{init_pick_from_mapped_key();init_pick_from_mapped_result();init_pick()});function FromComputed3(target2,parameters2){return Computed("Partial",[Computed(target2,parameters2)])}function FromRef3($ref){return Computed("Partial",[Ref($ref)])}function FromProperties16(properties){let partialProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))partialProperties[K]=Optional(properties[K]);return partialProperties}function FromObject5(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties16(properties);return Object2(mappedProperties,options)}function FromRest6(types17){return types17.map((type3)=>PartialResolve(type3))}function PartialResolve(type3){return IsComputed(type3)?FromComputed3(type3.target,type3.parameters):IsRef(type3)?FromRef3(type3.$ref):IsIntersect(type3)?Intersect(FromRest6(type3.allOf)):IsUnion(type3)?Union(FromRest6(type3.anyOf)):IsObject3(type3)?FromObject5(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Partial(type3,options){if(IsMappedResult(type3))return PartialFromMappedResult(type3,options);else return CreateType({...PartialResolve(type3),...options})}var init_partial=__esm(()=>{init_type2();init_computed2();init_optional2();init_object2();init_intersect2();init_union2();init_ref2();init_discard();init_symbols2();init_partial_from_mapped_result();init_kind()});function FromProperties17(K,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Partial(K[K2],Clone(options));return Acc}function FromMappedResult11(R,options){return FromProperties17(R.properties,options)}function PartialFromMappedResult(R,options){let P=FromMappedResult11(R,options);return MappedResult(P)}var init_partial_from_mapped_result=__esm(()=>{init_mapped2();init_partial();init_value()});var init_partial2=__esm(()=>{init_partial_from_mapped_result();init_partial()});function FromComputed4(target2,parameters2){return Computed("Required",[Computed(target2,parameters2)])}function FromRef4($ref){return Computed("Required",[Ref($ref)])}function FromProperties18(properties){let requiredProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))requiredProperties[K]=Discard(properties[K],[OptionalKind]);return requiredProperties}function FromObject6(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties18(properties);return Object2(mappedProperties,options)}function FromRest7(types17){return types17.map((type3)=>RequiredResolve(type3))}function RequiredResolve(type3){return IsComputed(type3)?FromComputed4(type3.target,type3.parameters):IsRef(type3)?FromRef4(type3.$ref):IsIntersect(type3)?Intersect(FromRest7(type3.allOf)):IsUnion(type3)?Union(FromRest7(type3.anyOf)):IsObject3(type3)?FromObject6(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Required(type3,options){if(IsMappedResult(type3))return RequiredFromMappedResult(type3,options);else return CreateType({...RequiredResolve(type3),...options})}var init_required=__esm(()=>{init_type2();init_computed2();init_object2();init_intersect2();init_union2();init_ref2();init_symbols2();init_discard();init_required_from_mapped_result();init_kind()});function FromProperties19(P,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Required(P[K2],options);return Acc}function FromMappedResult12(R,options){return FromProperties19(R.properties,options)}function RequiredFromMappedResult(R,options){let P=FromMappedResult12(R,options);return MappedResult(P)}var init_required_from_mapped_result=__esm(()=>{init_mapped2();init_required()});var init_required2=__esm(()=>{init_required_from_mapped_result();init_required()});function DereferenceParameters(moduleProperties,types17){return types17.map((type3)=>{return IsRef(type3)?Dereference(moduleProperties,type3.$ref):FromType2(moduleProperties,type3)})}function Dereference(moduleProperties,ref2){return ref2 in moduleProperties?IsRef(moduleProperties[ref2])?Dereference(moduleProperties,moduleProperties[ref2].$ref):FromType2(moduleProperties,moduleProperties[ref2]):Never()}function FromAwaited(parameters2){return Awaited(parameters2[0])}function FromIndex(parameters2){return Index(parameters2[0],parameters2[1])}function FromKeyOf(parameters2){return KeyOf(parameters2[0])}function FromPartial(parameters2){return Partial(parameters2[0])}function FromOmit(parameters2){return Omit(parameters2[0],parameters2[1])}function FromPick(parameters2){return Pick(parameters2[0],parameters2[1])}function FromRequired(parameters2){return Required(parameters2[0])}function FromComputed5(moduleProperties,target2,parameters2){let dereferenced=DereferenceParameters(moduleProperties,parameters2);return target2==="Awaited"?FromAwaited(dereferenced):target2==="Index"?FromIndex(dereferenced):target2==="KeyOf"?FromKeyOf(dereferenced):target2==="Partial"?FromPartial(dereferenced):target2==="Omit"?FromOmit(dereferenced):target2==="Pick"?FromPick(dereferenced):target2==="Required"?FromRequired(dereferenced):Never()}function FromArray6(moduleProperties,type3){return Array2(FromType2(moduleProperties,type3))}function FromAsyncIterator3(moduleProperties,type3){return AsyncIterator2(FromType2(moduleProperties,type3))}function FromConstructor3(moduleProperties,parameters2,instanceType){return Constructor(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,instanceType))}function FromFunction3(moduleProperties,parameters2,returnType){return Function2(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,returnType))}function FromIntersect8(moduleProperties,types17){return Intersect(FromTypes2(moduleProperties,types17))}function FromIterator3(moduleProperties,type3){return Iterator2(FromType2(moduleProperties,type3))}function FromObject7(moduleProperties,properties){return Object2(globalThis.Object.keys(properties).reduce((result,key2)=>{return{...result,[key2]:FromType2(moduleProperties,properties[key2])}},{}))}function FromRecord3(moduleProperties,type3){let[value2,pattern2]=[FromType2(moduleProperties,RecordValue2(type3)),RecordPattern(type3)],result=CloneType(type3);return result.patternProperties[pattern2]=value2,result}function FromTransform(moduleProperties,transform){return IsRef(transform)?{...Dereference(moduleProperties,transform.$ref),[TransformKind]:transform[TransformKind]}:transform}function FromTuple5(moduleProperties,types17){return Tuple(FromTypes2(moduleProperties,types17))}function FromUnion10(moduleProperties,types17){return Union(FromTypes2(moduleProperties,types17))}function FromTypes2(moduleProperties,types17){return types17.map((type3)=>FromType2(moduleProperties,type3))}function FromType2(moduleProperties,type3){return IsOptional(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[OptionalKind])),type3):IsReadonly(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[ReadonlyKind])),type3):IsTransform(type3)?CreateType(FromTransform(moduleProperties,type3),type3):IsArray3(type3)?CreateType(FromArray6(moduleProperties,type3.items),type3):IsAsyncIterator3(type3)?CreateType(FromAsyncIterator3(moduleProperties,type3.items),type3):IsComputed(type3)?CreateType(FromComputed5(moduleProperties,type3.target,type3.parameters)):IsConstructor(type3)?CreateType(FromConstructor3(moduleProperties,type3.parameters,type3.returns),type3):IsFunction3(type3)?CreateType(FromFunction3(moduleProperties,type3.parameters,type3.returns),type3):IsIntersect(type3)?CreateType(FromIntersect8(moduleProperties,type3.allOf),type3):IsIterator3(type3)?CreateType(FromIterator3(moduleProperties,type3.items),type3):IsObject3(type3)?CreateType(FromObject7(moduleProperties,type3.properties),type3):IsRecord(type3)?CreateType(FromRecord3(moduleProperties,type3)):IsTuple(type3)?CreateType(FromTuple5(moduleProperties,type3.items||[]),type3):IsUnion(type3)?CreateType(FromUnion10(moduleProperties,type3.anyOf),type3):type3}function ComputeType(moduleProperties,key2){return key2 in moduleProperties?FromType2(moduleProperties,moduleProperties[key2]):Never()}function ComputeModuleProperties(moduleProperties){return globalThis.Object.getOwnPropertyNames(moduleProperties).reduce((result,key2)=>{return{...result,[key2]:ComputeType(moduleProperties,key2)}},{})}var init_compute=__esm(()=>{init_create();init_clone();init_discard();init_array2();init_awaited2();init_async_iterator2();init_constructor2();init_indexed2();init_function2();init_intersect2();init_iterator2();init_keyof2();init_object2();init_omit2();init_pick2();init_never2();init_partial2();init_record2();init_required2();init_tuple2();init_union2();init_symbols2();init_kind()});class TModule{constructor($defs){let computed2=ComputeModuleProperties($defs),identified=this.WithIdentifiers(computed2);this.$defs=identified}Import(key2,options){let $defs={...this.$defs,[key2]:CreateType(this.$defs[key2],options)};return CreateType({[Kind]:"Import",$defs,$ref:key2})}WithIdentifiers($defs){return globalThis.Object.getOwnPropertyNames($defs).reduce((result,key2)=>{return{...result,[key2]:{...$defs[key2],$id:key2}}},{})}}function Module(properties){return new TModule(properties)}var init_module=__esm(()=>{init_create();init_symbols2();init_compute()});var init_module2=__esm(()=>{init_module()});function Not2(type3,options){return CreateType({[Kind]:"Not",not:type3},options)}var init_not=__esm(()=>{init_type2();init_symbols2()});var init_not2=__esm(()=>{init_not()});function Parameters(schema,options){return IsFunction3(schema)?Tuple(schema.parameters,options):Never()}var init_parameters2=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_parameters3=__esm(()=>{init_parameters2()});function Recursive(callback,options={}){if(IsUndefined(options.$id))options.$id=`T${Ordinal++}`;let thisType=CloneType(callback({[Kind]:"This",$ref:`${options.$id}`}));return thisType.$id=options.$id,CreateType({[Hint]:"Recursive",...thisType},options)}var Ordinal=0;var init_recursive=__esm(()=>{init_type();init_type2();init_symbols2()});var init_recursive2=__esm(()=>{init_recursive()});function RegExp2(unresolved,options){let expr=IsString(unresolved)?new globalThis.RegExp(unresolved):unresolved;return CreateType({[Kind]:"RegExp",type:"RegExp",source:expr.source,flags:expr.flags},options)}var init_regexp=__esm(()=>{init_type2();init_symbols2()});var init_regexp2=__esm(()=>{init_regexp()});function RestResolve(T){return IsIntersect(T)?T.allOf:IsUnion(T)?T.anyOf:IsTuple(T)?T.items??[]:[]}function Rest(T){return RestResolve(T)}var init_rest=__esm(()=>{init_kind()});var init_rest2=__esm(()=>{init_rest()});function ReturnType(schema,options){return IsFunction3(schema)?CreateType(schema.returns,options):Never(options)}var init_return_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_return_type2=__esm(()=>{init_return_type()});var init_anyschema=()=>{};var init_schema3=()=>{};var init_schema4=__esm(()=>{init_anyschema();init_schema3()});var init_static=()=>{};var init_static2=__esm(()=>{init_static()});class TransformDecodeBuilder{constructor(schema2){this.schema=schema2}Decode(decode3){return new TransformEncodeBuilder(this.schema,decode3)}}class TransformEncodeBuilder{constructor(schema2,decode3){this.schema=schema2,this.decode=decode3}EncodeTransform(encode4,schema2){let Codec={Encode:(value2)=>schema2[TransformKind].Encode(encode4(value2)),Decode:(value2)=>this.decode(schema2[TransformKind].Decode(value2))};return{...schema2,[TransformKind]:Codec}}EncodeSchema(encode4,schema2){let Codec={Decode:this.decode,Encode:encode4};return{...schema2,[TransformKind]:Codec}}Encode(encode4){return IsTransform(this.schema)?this.EncodeTransform(encode4,this.schema):this.EncodeSchema(encode4,this.schema)}}function Transform(schema2){return new TransformDecodeBuilder(schema2)}var init_transform=__esm(()=>{init_symbols2();init_kind()});var init_transform2=__esm(()=>{init_transform()});function Unsafe(options={}){return CreateType({[Kind]:options[Kind]??"Unsafe"},options)}var init_unsafe=__esm(()=>{init_type2();init_symbols2()});var init_unsafe2=__esm(()=>{init_unsafe()});function Void(options){return CreateType({[Kind]:"Void",type:"void"},options)}var init_void=__esm(()=>{init_type2();init_symbols2()});var init_void2=__esm(()=>{init_void()});var exports_type3={};__export(exports_type3,{Void:()=>Void,Uppercase:()=>Uppercase,Unsafe:()=>Unsafe,Unknown:()=>Unknown,Union:()=>Union,Undefined:()=>Undefined,Uncapitalize:()=>Uncapitalize,Uint8Array:()=>Uint8Array2,Tuple:()=>Tuple,Transform:()=>Transform,TemplateLiteral:()=>TemplateLiteral,Symbol:()=>Symbol2,String:()=>String2,ReturnType:()=>ReturnType,Rest:()=>Rest,Required:()=>Required,RegExp:()=>RegExp2,Ref:()=>Ref,Recursive:()=>Recursive,Record:()=>Record,ReadonlyOptional:()=>ReadonlyOptional,Readonly:()=>Readonly,Promise:()=>Promise2,Pick:()=>Pick,Partial:()=>Partial,Parameters:()=>Parameters,Optional:()=>Optional,Omit:()=>Omit,Object:()=>Object2,Number:()=>Number2,Null:()=>Null2,Not:()=>Not2,Never:()=>Never,Module:()=>Module,Mapped:()=>Mapped,Lowercase:()=>Lowercase,Literal:()=>Literal,KeyOf:()=>KeyOf,Iterator:()=>Iterator2,Intersect:()=>Intersect,Integer:()=>Integer2,Instantiate:()=>Instantiate,InstanceType:()=>InstanceType,Index:()=>Index,Function:()=>Function2,Extract:()=>Extract,Extends:()=>Extends,Exclude:()=>Exclude,Enum:()=>Enum,Date:()=>Date2,ConstructorParameters:()=>ConstructorParameters,Constructor:()=>Constructor,Const:()=>Const,Composite:()=>Composite,Capitalize:()=>Capitalize,Boolean:()=>Boolean3,BigInt:()=>BigInt2,Awaited:()=>Awaited,AsyncIterator:()=>AsyncIterator2,Array:()=>Array2,Argument:()=>Argument,Any:()=>Any2});var init_type5=__esm(()=>{init_any2();init_argument2();init_array2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_intrinsic2();init_iterator2();init_keyof2();init_literal2();init_mapped2();init_module2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2()});var Type;var init_type6=__esm(()=>{init_type5();Type=exports_type3});var init_esm3=__esm(()=>{init_clone();init_create();init_error2();init_guard2();init_helpers2();init_patterns();init_registry4();init_sets();init_symbols2();init_any2();init_array2();init_argument2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_iterator2();init_intrinsic2();init_keyof2();init_literal2();init_module2();init_mapped2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_schema4();init_static2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2();init_type6()});function isEmailExempt(email,exemptDomains){if(!exemptDomains||exemptDomains.length===0)return!1;let domain=email.split("@")[1]?.toLowerCase();if(!domain)return!1;return exemptDomains.some((d)=>domain===d.toLowerCase()||domain.endsWith(`.${d.toLowerCase()}`))}function normalizeTrustedOrigins(raw,env=process.env){if(Array.isArray(raw))return raw.length>0?raw:void 0;if(typeof raw!=="string"||!raw.trim())return;let trimmed=raw.trim(),fromEnv=env[trimmed],isEnvName=/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed),list2=(fromEnv??(isEnvName?"":trimmed)).split(/[,;\s]+/).map((entry)=>entry.trim().replace(/\/+$/,"")).filter(Boolean);return list2.length>0?list2:void 0}function pickTrustedOrigin(candidate,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]];if(candidate&&isOriginTrusted(candidate.replace(/\/+$/,""),trusted))return candidate.replace(/\/+$/,"");return fallbackOrigin}function resolveAppOrigin(request,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]],candidates=[],appOrigin=request.headers.get("x-app-origin");if(appOrigin)candidates.push(appOrigin.replace(/\/+$/,""));let origin=request.headers.get("origin");if(origin)candidates.push(origin.replace(/\/+$/,""));let forwardedHost=request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();if(forwardedHost){let proto=request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()||"https";candidates.push(`${proto}://${forwardedHost}`)}for(let candidate of candidates)if(isOriginTrusted(candidate,trusted))return candidate;return fallbackOrigin}function extractConfiguredPath(configuredUrl,defaultPath){if(!configuredUrl)return defaultPath;try{return new URL(configuredUrl).pathname}catch{return configuredUrl.startsWith("/")?configuredUrl:defaultPath}}function buildEmailActionLink(params){let{request,configuredUrl,path,query,allowedOrigins}=params,origin=resolveAppOrigin(request,configuredUrl,allowedOrigins),normalizedPath=path.startsWith("/")?path:`/${path}`,queryString=new URLSearchParams(query).toString();return`${origin}${normalizedPath}${queryString?`?${queryString}`:""}`}var originHost=(value2)=>{try{return new URL(value2).host.toLowerCase()}catch{return value2.includes("://")?null:value2.toLowerCase().replace(/[/?#].*$/,"")||null}},isOriginTrusted=(candidate,trusted)=>{let candHost=originHost(candidate);if(!candHost)return!1;for(let entry of trusted){let tHost=originHost(entry);if(!tHost)continue;if(tHost.startsWith("*.")){let base=tHost.slice(2);if(candHost===base||candHost.endsWith(`.${base}`))return!0}else if(candHost===tHost)return!0}return!1};var{password:password3}=globalThis.Bun;async function verifyPassword(plainPassword,hashedPassword){try{return await password3.verify(plainPassword,hashedPassword)}catch{return!1}}function labelFromRawUserAgent(userAgent){let ua=(userAgent??"").trim(),lower=ua.toLowerCase();if(!ua||lower==="unknown"||lower==="unknown browser")return;let meaningful=(ua.match(/[A-Za-z][A-Za-z0-9._-]*\/[0-9][^\s;)]*/g)??[]).find((t)=>!/^mozilla\//i.test(t));if(meaningful)return meaningful.split("/")[0];return ua.match(/[A-Za-z][A-Za-z0-9 ._-]{2,}/)?.[0]?.trim()||void 0}function parseUserAgentForLogin(userAgent,ipAddress,deviceHint,clientHints){let ua=userAgent.toLowerCase(),headlessIndicators=["headlesschrome","headless","phantomjs","nightmare","selenium","webdriver","puppeteer","playwright"],botIndicators=["bot","crawler","spider","scraper","curl","wget","python-requests","python-urllib","java/","httpclient","go-http-client","node-fetch","axios","postman","insomnia","httpie"],isHeadless=headlessIndicators.some((indicator)=>ua.includes(indicator)),isBot=botIndicators.some((indicator)=>ua.includes(indicator)),isSuspicious=isHeadless||isBot,suspiciousPatterns=[];if(isHeadless)suspiciousPatterns.push("headless_browser");if(isBot)suspiciousPatterns.push("bot_user_agent");if(!ua||ua.length<10)suspiciousPatterns.push("missing_or_short_ua");if(ua==="mozilla/5.0")suspiciousPatterns.push("generic_ua");if(ua.includes("nucleusserveraction")||ua.includes("serveraction"))suspiciousPatterns.push("server_action");let deviceType="unknown";if(ua.includes("ipad"))deviceType="tablet";else if(ua.includes("iphone"))deviceType="mobile";else if(ua.includes("macintosh")||ua.includes("windows")&&!ua.includes("windows phone")||ua.includes("linux")&&!ua.includes("android"))deviceType="desktop";else if(ua.includes("tablet")||ua.includes("android")&&ua.includes("tablet"))deviceType="tablet";else if(ua.includes("mobile")||ua.includes("android"))deviceType="mobile";let browserName,browserVersion;if(isHeadless)browserName="Headless Browser";else if(isBot)browserName="Bot/Crawler";else if(ua.includes("edg")){browserName="Edge";let match=userAgent.match(/Edg\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("opr/")||ua.includes("opera")){browserName="Opera";let match=userAgent.match(/OPR\/(\d+\.\d+)/i)||userAgent.match(/Opera\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("samsungbrowser")){browserName="Samsung Internet";let match=userAgent.match(/SamsungBrowser\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("crios")){browserName="Chrome";let match=userAgent.match(/CriOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("fxios")){browserName="Firefox";let match=userAgent.match(/FxiOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("chrome")){browserName="Chrome";let match=userAgent.match(/Chrome\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("firefox")){browserName="Firefox";let match=userAgent.match(/Firefox\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("safari")){browserName="Safari";let match=userAgent.match(/Version\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}let osName,osVersion;if(ua.includes("windows nt 10"))osName="Windows",osVersion="10/11";else if(ua.includes("windows nt"))osName="Windows";else if(ua.includes("iphone")||ua.includes("ipad")){osName="iOS";let match=userAgent.match(/OS (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("mac os x")){osName="macOS";let match=userAgent.match(/Mac OS X (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("android")){osName="Android";let match=userAgent.match(/Android (\d+\.?\d*)/i);if(match?.[1])osVersion=match[1]}else if(ua.includes("linux"))osName="Linux";if(!browserName&&clientHints?.uaHeader){let brands=[...clientHints.uaHeader.matchAll(/"([^"]+)";v="([^"]+)"/g)].map((m)=>({brand:m[1]??"",version:m[2]??""})).filter((b)=>b.brand&&!/not.?a.?brand/i.test(b.brand)),preferred=brands.find((b)=>/google chrome|microsoft edge|opera|firefox|safari/i.test(b.brand))??brands.find((b)=>!/chromium/i.test(b.brand))??brands[0];if(preferred)browserName=preferred.brand.replace(/^Google /,"").replace(/^Microsoft /,""),browserVersion=preferred.version}if(!osName&&clientHints?.platformHeader)osName=clientHints.platformHeader.replace(/"/g,"").trim()||osName;if(deviceType==="unknown"&&clientHints?.mobileHeader==="?1")deviceType="mobile";return{deviceName:browserName&&osName?`${browserName} on ${osName}`:browserName?browserName:osName?osName:deviceType!=="unknown"?deviceType.charAt(0).toUpperCase()+deviceType.slice(1):labelFromRawUserAgent(userAgent)??"Unknown Device",deviceType,browserName,browserVersion,osName,osVersion,ipAddress,userAgent,deviceHint,locationCountry:void 0,locationCity:void 0,isHeadless,isBot,isSuspicious,suspiciousPatterns}}var init_utils7=()=>{};function deviceContextFromRequest(request){let rawFwd=request.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),isPrivate=(ip)=>!ip||ip==="127.0.0.1"||ip==="::1"||ip==="localhost"||ip.startsWith("10.")||ip.startsWith("192.168.")||ip.startsWith("172.");return{ipAddress:request.headers.get("cf-connecting-ip")?.trim()||request.headers.get("true-client-ip")?.trim()||(!isPrivate(rawFwd)?rawFwd:void 0)||request.headers.get("x-real-ip")?.trim()||rawFwd||"127.0.0.1",userAgent:request.headers.get("user-agent")||"",clientHints:{uaHeader:request.headers.get("sec-ch-ua")??void 0,platformHeader:request.headers.get("sec-ch-ua-platform")??void 0,mobileHeader:request.headers.get("sec-ch-ua-mobile")??void 0}}}function ensureDeviceInfo(info,clientHints){if(info.browserName&&info.osName&&info.deviceName)return info;let parsed=info.userAgent?parseUserAgentForLogin(info.userAgent,info.ipAddress,info.deviceHint,clientHints):void 0;return{ipAddress:info.ipAddress,userAgent:info.userAgent,deviceHint:info.deviceHint,deviceName:info.deviceName??parsed?.deviceName??"Unknown Device",deviceType:info.deviceType&&info.deviceType!=="unknown"?info.deviceType:parsed?.deviceType??info.deviceType??"unknown",browserName:info.browserName??parsed?.browserName,browserVersion:info.browserVersion??parsed?.browserVersion,osName:info.osName??parsed?.osName,osVersion:info.osVersion??parsed?.osVersion,locationCountry:info.locationCountry,locationCity:info.locationCity}}var init_deviceInfo=__esm(()=>{init_utils7()});function boundedStream(source,limit){if(limit<=0)return new ReadableStream({start(controller){controller.close()},cancel:()=>source.cancel().catch(()=>{})});let reader=source.getReader(),sent=0;return new ReadableStream({async pull(controller){while(sent<limit){let{done,value:value2}=await reader.read();if(done){controller.close();return}if(!value2||value2.byteLength===0)continue;let remaining=limit-sent;if(value2.byteLength<=remaining)sent+=value2.byteLength,controller.enqueue(value2);else controller.enqueue(value2.subarray(0,remaining)),sent=limit;if(sent>=limit){controller.close(),reader.cancel().catch(()=>{});return}return}controller.close()},cancel(reason){return reader.cancel(reason).catch(()=>{})}})}import{randomUUID as randomUUID5}from"crypto";import path from"path";function unboundedIfZero(value2){return Number.isFinite(value2)&&value2>0?value2:Number.POSITIVE_INFINITY}function mergeStorageConfig(config){if(!config)return DEFAULT_STORAGE_CONFIG;return{enabled:config.enabled??DEFAULT_STORAGE_CONFIG.enabled,basePath:config.basePath??DEFAULT_STORAGE_CONFIG.basePath,maxFileSizeBytes:unboundedIfZero(config.maxFileSizeBytes??DEFAULT_STORAGE_CONFIG.maxFileSizeBytes),allowedMimeTypes:config.allowedMimeTypes??DEFAULT_STORAGE_CONFIG.allowedMimeTypes,blockedMimeTypes:config.blockedMimeTypes??DEFAULT_STORAGE_CONFIG.blockedMimeTypes,formData:{filesField:config.formData?.filesField??DEFAULT_STORAGE_CONFIG.formData.filesField,dataField:config.formData?.dataField??DEFAULT_STORAGE_CONFIG.formData.dataField,maxFiles:unboundedIfZero(config.formData?.maxFiles??DEFAULT_STORAGE_CONFIG.formData.maxFiles)}}}function normalizeMimeType(mimeType){return(mimeType??"").split(";")[0]?.trim().toLowerCase()??""}function isMimeTypeListed(list2,mimeType){if(!list2||list2.length===0)return!1;let normalized=normalizeMimeType(mimeType);if(!normalized)return!1;return list2.some((entry)=>normalizeMimeType(entry)===normalized)}function parseFormDataBody(body,config){let result={data:{},files:[]};if(!body||typeof body!=="object")return result;let bodyObj=body,dataField=bodyObj[config.formData.dataField];if(dataField){if(typeof dataField==="string")try{result.data=JSON.parse(dataField)}catch{result.data={}}else if(typeof dataField==="object")result.data=dataField}let filesField=bodyObj[config.formData.filesField];if(filesField){if(filesField instanceof File)result.files=[filesField];else if(Array.isArray(filesField))result.files=filesField.filter((f)=>f instanceof File)}return result}function validateFile(file,config){if(file.size>config.maxFileSizeBytes)return{valid:!1,error:`File ${file.name} exceeds maximum size of ${config.maxFileSizeBytes} bytes`,rejected:!0};if(isMimeTypeListed(config.blockedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not allowed`,rejected:!0};if(config.allowedMimeTypes.length>0&&!isMimeTypeListed(config.allowedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not in allowed list`,rejected:!0};return{valid:!0}}function setStorageProvider(provider){activeStorageProvider=provider}function getStorageProvider(){return activeStorageProvider}async function uploadFile(file,config,subFolder){let id=randomUUID5(),ext=path.extname(file.name),uniqueName=`${id}${ext}`,folderPath=subFolder?path.join(config.basePath,subFolder):config.basePath,provider=activeStorageProvider;if(provider&&provider.kind!=="local"){let relative=subFolder?`${subFolder}/${uniqueName}`:uniqueName;await provider.write(relative,new Uint8Array(await file.arrayBuffer()))}else await fileManager.createFile({dir:folderPath,name:uniqueName,data:file,options:{type:file.type,createDir:!0}});return{id,name:uniqueName,originalName:file.name,path:folderPath,mimeType:file.type,size:file.size,createdAt:new Date}}async function uploadFiles(files,config,subFolder){let success=[],failed=[];for(let file of files.slice(0,config.formData.maxFiles)){let validation=validateFile(file,config);if(!validation.valid){failed.push({file:file.name,error:validation.error||"Unknown error",rejected:validation.rejected===!0});continue}try{let result=await uploadFile(file,config,subFolder);success.push(result)}catch(error3){failed.push({file:file.name,error:error3 instanceof Error?error3.message:"Upload failed"})}}return{success,failed}}function isPathWithinBase(base,target2){let resolvedBase=path.resolve(base),resolvedTarget=path.resolve(target2);return resolvedTarget===resolvedBase||resolvedTarget.startsWith(resolvedBase+path.sep)}async function deleteFile(filePath,fileName,storageBase){try{let fullPath=path.join(filePath,fileName);if(storageBase&&!isPathWithinBase(storageBase,fullPath))return!1;let provider=activeStorageProvider;if(provider&&provider.kind!=="local"&&storageBase)return await provider.delete(path.relative(storageBase,fullPath));return await fileManager.deleteFile(fullPath)}catch{return!1}}var DEFAULT_STORAGE_CONFIG,activeStorageProvider=null;var init_helpers3=__esm(()=>{init_File();DEFAULT_STORAGE_CONFIG={enabled:!1,basePath:"./uploads",maxFileSizeBytes:104857600,allowedMimeTypes:[],blockedMimeTypes:["application/x-executable","application/x-msdos-program","text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/x-httpd-php"],formData:{filesField:"files",dataField:"data",maxFiles:10}}});import{readFileSync as readFileSync4}from"fs";import*as os3 from"os";function parseCpuMax(raw){if(!raw)return null;let[quota,period]=raw.trim().split(/\s+/);if(!quota||quota==="max")return null;let q=Number(quota),p=Number(period??"100000");if(!Number.isFinite(q)||!Number.isFinite(p)||p<=0||q<=0)return null;return q/p}function parseCpuV1(quotaRaw,periodRaw){let q=Number((quotaRaw??"").trim()),p=Number((periodRaw??"").trim());if(!Number.isFinite(q)||q<=0||!Number.isFinite(p)||p<=0)return null;return q/p}function read(path2){try{return readFileSync4(path2,"utf8")}catch{return null}}function cpuBudget(sources={}){let cores=sources.cores??os3.cpus().length??1,limit=parseCpuMax(sources.cpuMax??read("/sys/fs/cgroup/cpu.max"))??parseCpuV1(sources.v1Quota??read("/sys/fs/cgroup/cpu/cpu.cfs_quota_us"),sources.v1Period??read("/sys/fs/cgroup/cpu/cpu.cfs_period_us"));if(limit===null)return Math.max(1,cores);return Math.max(1,Math.min(cores,Math.ceil(limit)))}var init_cpuBudget=()=>{};var require_is=__commonJS((exports,module3)=>{var defined=function(val){return typeof val<"u"&&val!==null},object3=function(val){return typeof val==="object"},plainObject=function(val){return Object.prototype.toString.call(val)==="[object Object]"},fn=function(val){return typeof val==="function"},bool=function(val){return typeof val==="boolean"},buffer=function(val){return val instanceof Buffer},typedArray=function(val){if(defined(val))switch(val.constructor){case Uint8Array:case Uint8ClampedArray:case Int8Array:case Uint16Array:case Int16Array:case Uint32Array:case Int32Array:case Float32Array:case Float64Array:return!0}return!1},arrayBuffer=function(val){return val instanceof ArrayBuffer},string3=function(val){return typeof val==="string"&&val.length>0},number3=function(val){return typeof val==="number"&&!Number.isNaN(val)},integer3=function(val){return Number.isInteger(val)},inRange=function(val,min,max){return val>=min&&val<=max},inArray11=function(val,list2){return list2.includes(val)},invalidParameterError=function(name2,expected,actual){return Error(`Expected ${expected} for ${name2} but received ${actual} of type ${typeof actual}`)},nativeError=function(native,context){return context.message=native.message,context};module3.exports={defined,object:object3,plainObject,fn,bool,buffer,typedArray,arrayBuffer,string:string3,number:number3,integer:integer3,inRange,inArray:inArray11,invalidParameterError,nativeError}});var require_process=__commonJS((exports,module3)=>{var isLinux=()=>process.platform==="linux",report=null,getReport=()=>{if(!report)if(isLinux()&&process.report){let orig=process.report.excludeNetwork;process.report.excludeNetwork=!0,report=process.report.getReport(),process.report.excludeNetwork=orig}else report={};return report};module3.exports={isLinux,getReport}});var require_filesystem=__commonJS((exports,module3)=>{var fs3=__require("fs"),readFileSync5=(path2)=>{let fd=fs3.openSync(path2,"r"),buffer=Buffer.alloc(2048),bytesRead=fs3.readSync(fd,buffer,0,2048,0);return fs3.close(fd,()=>{}),buffer.subarray(0,bytesRead)},readFile2=(path2)=>new Promise((resolve2,reject)=>{fs3.open(path2,"r",(err,fd)=>{if(err)reject(err);else{let buffer=Buffer.alloc(2048);fs3.read(fd,buffer,0,2048,0,(_,bytesRead)=>{resolve2(buffer.subarray(0,bytesRead)),fs3.close(fd,()=>{})})}})});module3.exports={LDD_PATH:"/usr/bin/ldd",SELF_PATH:"/proc/self/exe",readFileSync:readFileSync5,readFile:readFile2}});var require_elf=__commonJS((exports,module3)=>{var interpreterPath=(elf)=>{if(elf.length<64)return null;if(elf.readUInt32BE(0)!==2135247942)return null;if(elf.readUInt8(4)!==2)return null;if(elf.readUInt8(5)!==1)return null;let offset=elf.readUInt32LE(32),size=elf.readUInt16LE(54),count2=elf.readUInt16LE(56);for(let i=0;i<count2;i++){let headerOffset=offset+i*size;if(elf.readUInt32LE(headerOffset)===3){let fileOffset=elf.readUInt32LE(headerOffset+8),fileSize=elf.readUInt32LE(headerOffset+32);return elf.subarray(fileOffset,fileOffset+fileSize).toString().replace(/\0.*$/g,"")}}return null};module3.exports={interpreterPath}});var require_detect_libc=__commonJS((exports,module3)=>{var childProcess=__require("child_process"),{isLinux,getReport}=require_process(),{LDD_PATH,SELF_PATH,readFile:readFile2,readFileSync:readFileSync5}=require_filesystem(),{interpreterPath}=require_elf(),cachedFamilyInterpreter,cachedFamilyFilesystem,cachedVersionFilesystem,commandOut="",safeCommand=()=>{if(!commandOut)return new Promise((resolve2)=>{childProcess.exec("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",(err,out)=>{commandOut=err?" ":out,resolve2(commandOut)})});return commandOut},safeCommandSync=()=>{if(!commandOut)try{commandOut=childProcess.execSync("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",{encoding:"utf8"})}catch(_err){commandOut=" "}return commandOut},GLIBC="glibc",RE_GLIBC_VERSION=/LIBC[a-z0-9 \-).]*?(\d+\.\d+)/i,MUSL="musl",isFileMusl=(f)=>f.includes("libc.musl-")||f.includes("ld-musl-"),familyFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return GLIBC;if(Array.isArray(report.sharedObjects)){if(report.sharedObjects.some(isFileMusl))return MUSL}return null},familyFromCommand=(out)=>{let[getconf,ldd1]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return GLIBC;if(ldd1&&ldd1.includes(MUSL))return MUSL;return null},familyFromInterpreterPath=(path2)=>{if(path2){if(path2.includes("/ld-musl-"))return MUSL;else if(path2.includes("/ld-linux-"))return GLIBC}return null},getFamilyFromLddContent=(content)=>{if(content=content.toString(),content.includes("musl"))return MUSL;if(content.includes("GNU C Library"))return GLIBC;return null},familyFromFilesystem=async()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=await readFile2(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromFilesystemSync=()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=readFileSync5(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromInterpreter=async()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=await readFile2(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},familyFromInterpreterSync=()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=readFileSync5(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},family=async()=>{let family2=null;if(isLinux()){if(family2=await familyFromInterpreter(),!family2){if(family2=await familyFromFilesystem(),!family2)family2=familyFromReport();if(!family2){let out=await safeCommand();family2=familyFromCommand(out)}}}return family2},familySync=()=>{let family2=null;if(isLinux()){if(family2=familyFromInterpreterSync(),!family2){if(family2=familyFromFilesystemSync(),!family2)family2=familyFromReport();if(!family2){let out=safeCommandSync();family2=familyFromCommand(out)}}}return family2},isNonGlibcLinux=async()=>isLinux()&&await family()!==GLIBC,isNonGlibcLinuxSync=()=>isLinux()&&familySync()!==GLIBC,versionFromFilesystem=async()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=(await readFile2(LDD_PATH)).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromFilesystemSync=()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=readFileSync5(LDD_PATH).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return report.header.glibcVersionRuntime;return null},versionSuffix=(s)=>s.trim().split(/\s+/)[1],versionFromCommand=(out)=>{let[getconf,ldd1,ldd2]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return versionSuffix(getconf);if(ldd1&&ldd2&&ldd1.includes(MUSL))return versionSuffix(ldd2);return null},version=async()=>{let version2=null;if(isLinux()){if(version2=await versionFromFilesystem(),!version2)version2=versionFromReport();if(!version2){let out=await safeCommand();version2=versionFromCommand(out)}}return version2},versionSync=()=>{let version2=null;if(isLinux()){if(version2=versionFromFilesystemSync(),!version2)version2=versionFromReport();if(!version2){let out=safeCommandSync();version2=versionFromCommand(out)}}return version2};module3.exports={GLIBC,MUSL,family,familySync,isNonGlibcLinux,isNonGlibcLinuxSync,version,versionSync}});var require_debug=__commonJS((exports,module3)=>{var debug=typeof process==="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...args)=>console.error("SEMVER",...args):()=>{};module3.exports=debug});var require_constants2=__commonJS((exports,module3)=>{var MAX_SAFE_INTEGER=Number.MAX_SAFE_INTEGER||9007199254740991,RELEASE_TYPES=["major","premajor","minor","preminor","patch","prepatch","prerelease"];module3.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER,RELEASE_TYPES,SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var require_re=__commonJS((exports,module3)=>{var{MAX_SAFE_COMPONENT_LENGTH,MAX_SAFE_BUILD_LENGTH,MAX_LENGTH}=require_constants2(),debug=require_debug();exports=module3.exports={};var re=exports.re=[],safeRe=exports.safeRe=[],src=exports.src=[],safeSrc=exports.safeSrc=[],t=exports.t={},R=0,LETTERDASHNUMBER="[a-zA-Z0-9-]",safeRegexReplacements=[["\\s",1],["\\d",MAX_LENGTH],[LETTERDASHNUMBER,MAX_SAFE_BUILD_LENGTH]],makeSafeRegex=(value2)=>{for(let[token,max]of safeRegexReplacements)value2=value2.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);return value2},createToken=(name2,value2,isGlobal)=>{let safe=makeSafeRegex(value2),index=R++;debug(name2,index,value2),t[name2]=index,src[index]=value2,safeSrc[index]=safe,re[index]=new RegExp(value2,isGlobal?"g":void 0),safeRe[index]=new RegExp(safe,isGlobal?"g":void 0)};createToken("NUMERICIDENTIFIER","0|[1-9]\\d*");createToken("NUMERICIDENTIFIERLOOSE","\\d+");createToken("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);createToken("MAINVERSION",`(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);createToken("MAINVERSIONLOOSE",`(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASEIDENTIFIER",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);createToken("PRERELEASEIDENTIFIERLOOSE",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASE",`(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);createToken("PRERELEASELOOSE",`(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);createToken("BUILDIDENTIFIER",`${LETTERDASHNUMBER}+`);createToken("BUILD",`(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);createToken("FULLPLAIN",`v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);createToken("FULL",`^${src[t.FULLPLAIN]}$`);createToken("LOOSEPLAIN",`[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);createToken("LOOSE",`^${src[t.LOOSEPLAIN]}$`);createToken("GTLT","((?:<|>)?=?)");createToken("XRANGEIDENTIFIERLOOSE",`${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);createToken("XRANGEIDENTIFIER",`${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);createToken("XRANGEPLAIN",`[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGEPLAINLOOSE",`[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);createToken("XRANGELOOSE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);createToken("COERCEPLAIN",`(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);createToken("COERCE",`${src[t.COERCEPLAIN]}(?:$|[^\\d])`);createToken("COERCEFULL",src[t.COERCEPLAIN]+`(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);createToken("COERCERTL",src[t.COERCE],!0);createToken("COERCERTLFULL",src[t.COERCEFULL],!0);createToken("LONETILDE","(?:~>?)");createToken("TILDETRIM",`(\\s*)${src[t.LONETILDE]}\\s+`,!0);exports.tildeTrimReplace="$1~";createToken("TILDE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);createToken("TILDELOOSE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("LONECARET","(?:\\^)");createToken("CARETTRIM",`(\\s*)${src[t.LONECARET]}\\s+`,!0);exports.caretTrimReplace="$1^";createToken("CARET",`^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);createToken("CARETLOOSE",`^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("COMPARATORLOOSE",`^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);createToken("COMPARATOR",`^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);createToken("COMPARATORTRIM",`(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`,!0);exports.comparatorTrimReplace="$1$2$3";createToken("HYPHENRANGE",`^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);createToken("HYPHENRANGELOOSE",`^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);createToken("STAR","(<|>)?=?\\s*\\*");createToken("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");createToken("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var require_parse_options=__commonJS((exports,module3)=>{var looseOption=Object.freeze({loose:!0}),emptyOpts=Object.freeze({}),parseOptions=(options)=>{if(!options)return emptyOpts;if(typeof options!=="object")return looseOption;return options};module3.exports=parseOptions});var require_identifiers=__commonJS((exports,module3)=>{var numeric=/^[0-9]+$/,compareIdentifiers=(a,b)=>{if(typeof a==="number"&&typeof b==="number")return a===b?0:a<b?-1:1;let anum=numeric.test(a),bnum=numeric.test(b);if(anum&&bnum)a=+a,b=+b;return a===b?0:anum&&!bnum?-1:bnum&&!anum?1:a<b?-1:1},rcompareIdentifiers=(a,b)=>compareIdentifiers(b,a);module3.exports={compareIdentifiers,rcompareIdentifiers}});var require_semver=__commonJS((exports,module3)=>{var debug=require_debug(),{MAX_LENGTH,MAX_SAFE_INTEGER}=require_constants2(),{safeRe:re,t}=require_re(),parseOptions=require_parse_options(),{compareIdentifiers}=require_identifiers();class SemVer{constructor(version,options){if(options=parseOptions(options),version instanceof SemVer)if(version.loose===!!options.loose&&version.includePrerelease===!!options.includePrerelease)return version;else version=version.version;else if(typeof version!=="string")throw TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);if(version.length>MAX_LENGTH)throw TypeError(`version is longer than ${MAX_LENGTH} characters`);debug("SemVer",version,options),this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease;let m=version.trim().match(options.loose?re[t.LOOSE]:re[t.FULL]);if(!m)throw TypeError(`Invalid Version: ${version}`);if(this.raw=version,this.major=+m[1],this.minor=+m[2],this.patch=+m[3],this.major>MAX_SAFE_INTEGER||this.major<0)throw TypeError("Invalid major version");if(this.minor>MAX_SAFE_INTEGER||this.minor<0)throw TypeError("Invalid minor version");if(this.patch>MAX_SAFE_INTEGER||this.patch<0)throw TypeError("Invalid patch version");if(!m[4])this.prerelease=[];else this.prerelease=m[4].split(".").map((id)=>{if(/^[0-9]+$/.test(id)){let num3=+id;if(num3>=0&&num3<MAX_SAFE_INTEGER)return num3}return id});this.build=m[5]?m[5].split("."):[],this.format()}format(){if(this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length)this.version+=`-${this.prerelease.join(".")}`;return this.version}toString(){return this.version}compare(other){if(debug("SemVer.compare",this.version,this.options,other),!(other instanceof SemVer)){if(typeof other==="string"&&other===this.version)return 0;other=new SemVer(other,this.options)}if(other.version===this.version)return 0;return this.compareMain(other)||this.comparePre(other)}compareMain(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.major<other.major)return-1;if(this.major>other.major)return 1;if(this.minor<other.minor)return-1;if(this.minor>other.minor)return 1;if(this.patch<other.patch)return-1;if(this.patch>other.patch)return 1;return 0}comparePre(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.prerelease.length&&!other.prerelease.length)return-1;else if(!this.prerelease.length&&other.prerelease.length)return 1;else if(!this.prerelease.length&&!other.prerelease.length)return 0;let i=0;do{let a=this.prerelease[i],b=other.prerelease[i];if(debug("prerelease compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}compareBuild(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);let i=0;do{let a=this.build[i],b=other.build[i];if(debug("build compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}inc(release,identifier,identifierBase){if(release.startsWith("pre")){if(!identifier&&identifierBase===!1)throw Error("invalid increment argument: identifier is empty");if(identifier){let match=`-${identifier}`.match(this.options.loose?re[t.PRERELEASELOOSE]:re[t.PRERELEASE]);if(!match||match[1]!==identifier)throw Error(`invalid identifier: ${identifier}`)}}switch(release){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",identifier,identifierBase);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",identifier,identifierBase);break;case"prepatch":this.prerelease.length=0,this.inc("patch",identifier,identifierBase),this.inc("pre",identifier,identifierBase);break;case"prerelease":if(this.prerelease.length===0)this.inc("patch",identifier,identifierBase);this.inc("pre",identifier,identifierBase);break;case"release":if(this.prerelease.length===0)throw Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":if(this.minor!==0||this.patch!==0||this.prerelease.length===0)this.major++;this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":if(this.patch!==0||this.prerelease.length===0)this.minor++;this.patch=0,this.prerelease=[];break;case"patch":if(this.prerelease.length===0)this.patch++;this.prerelease=[];break;case"pre":{let base=Number(identifierBase)?1:0;if(this.prerelease.length===0)this.prerelease=[base];else{let i=this.prerelease.length;while(--i>=0)if(typeof this.prerelease[i]==="number")this.prerelease[i]++,i=-2;if(i===-1){if(identifier===this.prerelease.join(".")&&identifierBase===!1)throw Error("invalid increment argument: identifier already exists");this.prerelease.push(base)}}if(identifier){let prerelease=[identifier,base];if(identifierBase===!1)prerelease=[identifier];if(compareIdentifiers(this.prerelease[0],identifier)===0){if(isNaN(this.prerelease[1]))this.prerelease=prerelease}else this.prerelease=prerelease}break}default:throw Error(`invalid increment argument: ${release}`)}if(this.raw=this.format(),this.build.length)this.raw+=`+${this.build.join(".")}`;return this}}module3.exports=SemVer});var require_parse=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=(version,options,throwErrors=!1)=>{if(version instanceof SemVer)return version;try{return new SemVer(version,options)}catch(er){if(!throwErrors)return null;throw er}};module3.exports=parse3});var require_coerce=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=require_parse(),{safeRe:re,t}=require_re(),coerce2=(version,options)=>{if(version instanceof SemVer)return version;if(typeof version==="number")version=String(version);if(typeof version!=="string")return null;options=options||{};let match=null;if(!options.rtl)match=version.match(options.includePrerelease?re[t.COERCEFULL]:re[t.COERCE]);else{let coerceRtlRegex=options.includePrerelease?re[t.COERCERTLFULL]:re[t.COERCERTL],next;while((next=coerceRtlRegex.exec(version))&&(!match||match.index+match[0].length!==version.length)){if(!match||next.index+next[0].length!==match.index+match[0].length)match=next;coerceRtlRegex.lastIndex=next.index+next[1].length+next[2].length}coerceRtlRegex.lastIndex=-1}if(match===null)return null;let major=match[2],minor=match[3]||"0",patch=match[4]||"0",prerelease=options.includePrerelease&&match[5]?`-${match[5]}`:"",build=options.includePrerelease&&match[6]?`+${match[6]}`:"";return parse3(`${major}.${minor}.${patch}${prerelease}${build}`,options)};module3.exports=coerce2});var require_compare=__commonJS((exports,module3)=>{var SemVer=require_semver(),compare2=(a,b,loose)=>new SemVer(a,loose).compare(new SemVer(b,loose));module3.exports=compare2});var require_gte=__commonJS((exports,module3)=>{var compare2=require_compare(),gte=(a,b,loose)=>compare2(a,b,loose)>=0;module3.exports=gte});var require_lrucache=__commonJS((exports,module3)=>{class LRUCache{constructor(){this.max=1000,this.map=new Map}get(key2){let value2=this.map.get(key2);if(value2===void 0)return;else return this.map.delete(key2),this.map.set(key2,value2),value2}delete(key2){return this.map.delete(key2)}set(key2,value2){if(!this.delete(key2)&&value2!==void 0){if(this.map.size>=this.max){let firstKey=this.map.keys().next().value;this.delete(firstKey)}this.map.set(key2,value2)}return this}}module3.exports=LRUCache});var require_eq=__commonJS((exports,module3)=>{var compare2=require_compare(),eq31=(a,b,loose)=>compare2(a,b,loose)===0;module3.exports=eq31});var require_neq=__commonJS((exports,module3)=>{var compare2=require_compare(),neq=(a,b,loose)=>compare2(a,b,loose)!==0;module3.exports=neq});var require_gt=__commonJS((exports,module3)=>{var compare2=require_compare(),gt=(a,b,loose)=>compare2(a,b,loose)>0;module3.exports=gt});var require_lt=__commonJS((exports,module3)=>{var compare2=require_compare(),lt2=(a,b,loose)=>compare2(a,b,loose)<0;module3.exports=lt2});var require_lte=__commonJS((exports,module3)=>{var compare2=require_compare(),lte=(a,b,loose)=>compare2(a,b,loose)<=0;module3.exports=lte});var require_cmp=__commonJS((exports,module3)=>{var eq31=require_eq(),neq=require_neq(),gt=require_gt(),gte=require_gte(),lt2=require_lt(),lte=require_lte(),cmp=(a,op,b,loose)=>{switch(op){case"===":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a===b;case"!==":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a!==b;case"":case"=":case"==":return eq31(a,b,loose);case"!=":return neq(a,b,loose);case">":return gt(a,b,loose);case">=":return gte(a,b,loose);case"<":return lt2(a,b,loose);case"<=":return lte(a,b,loose);default:throw TypeError(`Invalid operator: ${op}`)}};module3.exports=cmp});var require_comparator=__commonJS((exports,module3)=>{var ANY=Symbol("SemVer ANY");class Comparator{static get ANY(){return ANY}constructor(comp,options){if(options=parseOptions(options),comp instanceof Comparator)if(comp.loose===!!options.loose)return comp;else comp=comp.value;if(comp=comp.trim().split(/\s+/).join(" "),debug("comparator",comp,options),this.options=options,this.loose=!!options.loose,this.parse(comp),this.semver===ANY)this.value="";else this.value=this.operator+this.semver.version;debug("comp",this)}parse(comp){let r=this.options.loose?re[t.COMPARATORLOOSE]:re[t.COMPARATOR],m=comp.match(r);if(!m)throw TypeError(`Invalid comparator: ${comp}`);if(this.operator=m[1]!==void 0?m[1]:"",this.operator==="=")this.operator="";if(!m[2])this.semver=ANY;else this.semver=new SemVer(m[2],this.options.loose)}toString(){return this.value}test(version){if(debug("Comparator.test",version,this.options.loose),this.semver===ANY||version===ANY)return!0;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}return cmp(version,this.operator,this.semver,this.options)}intersects(comp,options){if(!(comp instanceof Comparator))throw TypeError("a Comparator is required");if(this.operator===""){if(this.value==="")return!0;return new Range(comp.value,options).test(this.value)}else if(comp.operator===""){if(comp.value==="")return!0;return new Range(this.value,options).test(comp.semver)}if(options=parseOptions(options),options.includePrerelease&&(this.value==="<0.0.0-0"||comp.value==="<0.0.0-0"))return!1;if(!options.includePrerelease&&(this.value.startsWith("<0.0.0")||comp.value.startsWith("<0.0.0")))return!1;if(this.operator.startsWith(">")&&comp.operator.startsWith(">"))return!0;if(this.operator.startsWith("<")&&comp.operator.startsWith("<"))return!0;if(this.semver.version===comp.semver.version&&this.operator.includes("=")&&comp.operator.includes("="))return!0;if(cmp(this.semver,"<",comp.semver,options)&&this.operator.startsWith(">")&&comp.operator.startsWith("<"))return!0;if(cmp(this.semver,">",comp.semver,options)&&this.operator.startsWith("<")&&comp.operator.startsWith(">"))return!0;return!1}}module3.exports=Comparator;var parseOptions=require_parse_options(),{safeRe:re,t}=require_re(),cmp=require_cmp(),debug=require_debug(),SemVer=require_semver(),Range=require_range()});var require_range=__commonJS((exports,module3)=>{var SPACE_CHARACTERS=/\s+/g;class Range{constructor(range,options){if(options=parseOptions(options),range instanceof Range)if(range.loose===!!options.loose&&range.includePrerelease===!!options.includePrerelease)return range;else return new Range(range.raw,options);if(range instanceof Comparator)return this.raw=range.value,this.set=[[range]],this.formatted=void 0,this;if(this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease,this.raw=range.trim().replace(SPACE_CHARACTERS," "),this.set=this.raw.split("||").map((r)=>this.parseRange(r.trim())).filter((c)=>c.length),!this.set.length)throw TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let first=this.set[0];if(this.set=this.set.filter((c)=>!isNullSet(c[0])),this.set.length===0)this.set=[first];else if(this.set.length>1){for(let c of this.set)if(c.length===1&&isAny(c[0])){this.set=[c];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let i=0;i<this.set.length;i++){if(i>0)this.formatted+="||";let comps=this.set[i];for(let k=0;k<comps.length;k++){if(k>0)this.formatted+=" ";this.formatted+=comps[k].toString().trim()}}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(range){let memoKey=((this.options.includePrerelease&&FLAG_INCLUDE_PRERELEASE)|(this.options.loose&&FLAG_LOOSE))+":"+range,cached=cache.get(memoKey);if(cached)return cached;let loose=this.options.loose,hr=loose?re[t.HYPHENRANGELOOSE]:re[t.HYPHENRANGE];range=range.replace(hr,hyphenReplace(this.options.includePrerelease)),debug("hyphen replace",range),range=range.replace(re[t.COMPARATORTRIM],comparatorTrimReplace),debug("comparator trim",range),range=range.replace(re[t.TILDETRIM],tildeTrimReplace),debug("tilde trim",range),range=range.replace(re[t.CARETTRIM],caretTrimReplace),debug("caret trim",range);let rangeList=range.split(" ").map((comp)=>parseComparator(comp,this.options)).join(" ").split(/\s+/).map((comp)=>replaceGTE0(comp,this.options));if(loose)rangeList=rangeList.filter((comp)=>{return debug("loose invalid filter",comp,this.options),!!comp.match(re[t.COMPARATORLOOSE])});debug("range list",rangeList);let rangeMap=new Map,comparators=rangeList.map((comp)=>new Comparator(comp,this.options));for(let comp of comparators){if(isNullSet(comp))return[comp];rangeMap.set(comp.value,comp)}if(rangeMap.size>1&&rangeMap.has(""))rangeMap.delete("");let result=[...rangeMap.values()];return cache.set(memoKey,result),result}intersects(range,options){if(!(range instanceof Range))throw TypeError("a Range is required");return this.set.some((thisComparators)=>{return isSatisfiable(thisComparators,options)&&range.set.some((rangeComparators)=>{return isSatisfiable(rangeComparators,options)&&thisComparators.every((thisComparator)=>{return rangeComparators.every((rangeComparator)=>{return thisComparator.intersects(rangeComparator,options)})})})})}test(version){if(!version)return!1;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}for(let i=0;i<this.set.length;i++)if(testSet(this.set[i],version,this.options))return!0;return!1}}module3.exports=Range;var LRU=require_lrucache(),cache=new LRU,parseOptions=require_parse_options(),Comparator=require_comparator(),debug=require_debug(),SemVer=require_semver(),{safeRe:re,t,comparatorTrimReplace,tildeTrimReplace,caretTrimReplace}=require_re(),{FLAG_INCLUDE_PRERELEASE,FLAG_LOOSE}=require_constants2(),isNullSet=(c)=>c.value==="<0.0.0-0",isAny=(c)=>c.value==="",isSatisfiable=(comparators,options)=>{let result=!0,remainingComparators=comparators.slice(),testComparator=remainingComparators.pop();while(result&&remainingComparators.length)result=remainingComparators.every((otherComparator)=>{return testComparator.intersects(otherComparator,options)}),testComparator=remainingComparators.pop();return result},parseComparator=(comp,options)=>{return comp=comp.replace(re[t.BUILD],""),debug("comp",comp,options),comp=replaceCarets(comp,options),debug("caret",comp),comp=replaceTildes(comp,options),debug("tildes",comp),comp=replaceXRanges(comp,options),debug("xrange",comp),comp=replaceStars(comp,options),debug("stars",comp),comp},isX=(id)=>!id||id.toLowerCase()==="x"||id==="*",replaceTildes=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceTilde(c,options)).join(" ")},replaceTilde=(comp,options)=>{let r=options.loose?re[t.TILDELOOSE]:re[t.TILDE];return comp.replace(r,(_,M,m,p,pr)=>{debug("tilde",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0 <${+M+1}.0.0-0`;else if(isX(p))ret=`>=${M}.${m}.0 <${M}.${+m+1}.0-0`;else if(pr)debug("replaceTilde pr",pr),ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${M}.${+m+1}.0-0`;return debug("tilde return",ret),ret})},replaceCarets=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceCaret(c,options)).join(" ")},replaceCaret=(comp,options)=>{debug("caret",comp,options);let r=options.loose?re[t.CARETLOOSE]:re[t.CARET],z=options.includePrerelease?"-0":"";return comp.replace(r,(_,M,m,p,pr)=>{debug("caret",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0${z} <${+M+1}.0.0-0`;else if(isX(p))if(M==="0")ret=`>=${M}.${m}.0${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.0${z} <${+M+1}.0.0-0`;else if(pr)if(debug("replaceCaret pr",pr),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p}-${pr} <${+M+1}.0.0-0`;else if(debug("no pr"),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}${z} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${+M+1}.0.0-0`;return debug("caret return",ret),ret})},replaceXRanges=(comp,options)=>{return debug("replaceXRanges",comp,options),comp.split(/\s+/).map((c)=>replaceXRange(c,options)).join(" ")},replaceXRange=(comp,options)=>{comp=comp.trim();let r=options.loose?re[t.XRANGELOOSE]:re[t.XRANGE];return comp.replace(r,(ret,gtlt,M,m,p,pr)=>{debug("xRange",comp,ret,gtlt,M,m,p,pr);let xM=isX(M),xm=xM||isX(m),xp=xm||isX(p),anyX=xp;if(gtlt==="="&&anyX)gtlt="";if(pr=options.includePrerelease?"-0":"",xM)if(gtlt===">"||gtlt==="<")ret="<0.0.0-0";else ret="*";else if(gtlt&&anyX){if(xm)m=0;if(p=0,gtlt===">")if(gtlt=">=",xm)M=+M+1,m=0,p=0;else m=+m+1,p=0;else if(gtlt==="<=")if(gtlt="<",xm)M=+M+1;else m=+m+1;if(gtlt==="<")pr="-0";ret=`${gtlt+M}.${m}.${p}${pr}`}else if(xm)ret=`>=${M}.0.0${pr} <${+M+1}.0.0-0`;else if(xp)ret=`>=${M}.${m}.0${pr} <${M}.${+m+1}.0-0`;return debug("xRange return",ret),ret})},replaceStars=(comp,options)=>{return debug("replaceStars",comp,options),comp.trim().replace(re[t.STAR],"")},replaceGTE0=(comp,options)=>{return debug("replaceGTE0",comp,options),comp.trim().replace(re[options.includePrerelease?t.GTE0PRE:t.GTE0],"")},hyphenReplace=(incPr)=>($0,from,fM,fm,fp,fpr,fb,to,tM,tm,tp,tpr)=>{if(isX(fM))from="";else if(isX(fm))from=`>=${fM}.0.0${incPr?"-0":""}`;else if(isX(fp))from=`>=${fM}.${fm}.0${incPr?"-0":""}`;else if(fpr)from=`>=${from}`;else from=`>=${from}${incPr?"-0":""}`;if(isX(tM))to="";else if(isX(tm))to=`<${+tM+1}.0.0-0`;else if(isX(tp))to=`<${tM}.${+tm+1}.0-0`;else if(tpr)to=`<=${tM}.${tm}.${tp}-${tpr}`;else if(incPr)to=`<${tM}.${tm}.${+tp+1}-0`;else to=`<=${to}`;return`${from} ${to}`.trim()},testSet=(set2,version,options)=>{for(let i=0;i<set2.length;i++)if(!set2[i].test(version))return!1;if(version.prerelease.length&&!options.includePrerelease){for(let i=0;i<set2.length;i++){if(debug(set2[i].semver),set2[i].semver===Comparator.ANY)continue;if(set2[i].semver.prerelease.length>0){let allowed=set2[i].semver;if(allowed.major===version.major&&allowed.minor===version.minor&&allowed.patch===version.patch)return!0}}return!1}return!0}});var require_satisfies=__commonJS((exports,module3)=>{var Range=require_range(),satisfies=(version,range,options)=>{try{range=new Range(range,options)}catch(er){return!1}return range.test(version)};module3.exports=satisfies});var require_package=__commonJS((exports,module3)=>{module3.exports={name:"sharp",description:"High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",version:"0.33.5",author:"Lovell Fuller <npm@lovell.info>",homepage:"https://sharp.pixelplumbing.com",contributors:["Pierre Inglebert <pierre.inglebert@gmail.com>","Jonathan Ong <jonathanrichardong@gmail.com>","Chanon Sajjamanochai <chanon.s@gmail.com>","Juliano Julio <julianojulio@gmail.com>","Daniel Gasienica <daniel@gasienica.ch>","Julian Walker <julian@fiftythree.com>","Amit Pitaru <pitaru.amit@gmail.com>","Brandon Aaron <hello.brandon@aaron.sh>","Andreas Lind <andreas@one.com>","Maurus Cuelenaere <mcuelenaere@gmail.com>","Linus Unneb\xE4ck <linus@folkdatorn.se>","Victor Mateevitsi <mvictoras@gmail.com>","Alaric Holloway <alaric.holloway@gmail.com>","Bernhard K. Weisshuhn <bkw@codingforce.com>","Chris Riley <criley@primedia.com>","David Carley <dacarley@gmail.com>","John Tobin <john@limelightmobileinc.com>","Kenton Gray <kentongray@gmail.com>","Felix B\xFCnemann <Felix.Buenemann@gmail.com>","Samy Al Zahrani <samyalzahrany@gmail.com>","Chintan Thakkar <lemnisk8@gmail.com>","F. Orlando Galashan <frulo@gmx.de>","Kleis Auke Wolthuizen <info@kleisauke.nl>","Matt Hirsch <mhirsch@media.mit.edu>","Matthias Thoemmes <thoemmes@gmail.com>","Patrick Paskaris <patrick@paskaris.gr>","J\xE9r\xE9my Lal <kapouer@melix.org>","Rahul Nanwani <r.nanwani@gmail.com>","Alice Monday <alice0meta@gmail.com>","Kristo Jorgenson <kristo.jorgenson@gmail.com>","YvesBos <yves_bos@outlook.com>","Guy Maliar <guy@tailorbrands.com>","Nicolas Coden <nicolas@ncoden.fr>","Matt Parrish <matt.r.parrish@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Matthew McEachen <matthew+github@mceachen.org>","Jarda Kot\u011B\u0161ovec <jarda.kotesovec@gmail.com>","Kenric D'Souza <kenric.dsouza@gmail.com>","Oleh Aleinyk <oleg.aleynik@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Andrea Bianco <andrea.bianco@unibas.ch>","Rik Heywood <rik@rik.org>","Thomas Parisot <hi@oncletom.io>","Nathan Graves <nathanrgraves+github@gmail.com>","Tom Lokhorst <tom@lokhorst.eu>","Espen Hovlandsdal <espen@hovlandsdal.com>","Sylvain Dumont <sylvain.dumont35@gmail.com>","Alun Davies <alun.owain.davies@googlemail.com>","Aidan Hoolachan <ajhoolachan21@gmail.com>","Axel Eirola <axel.eirola@iki.fi>","Freezy <freezy@xbmc.org>","Daiz <taneli.vatanen@gmail.com>","Julian Aubourg <j@ubourg.net>","Keith Belovay <keith@picthrive.com>","Michael B. Klein <mbklein@gmail.com>","Jordan Prudhomme <jordan@raboland.fr>","Ilya Ovdin <iovdin@gmail.com>","Andargor <andargor@yahoo.com>","Paul Neave <paul.neave@gmail.com>","Brendan Kennedy <brenwken@gmail.com>","Brychan Bennett-Odlum <git@brychan.io>","Edward Silverton <e.silverton@gmail.com>","Roman Malieiev <aromaleev@gmail.com>","Tomas Szabo <tomas.szabo@deftomat.com>","Robert O'Rourke <robert@o-rourke.org>","Guillermo Alfonso Varela Chouci\xF1o <guillevch@gmail.com>","Christian Flintrup <chr@gigahost.dk>","Manan Jadhav <manan@motionden.com>","Leon Radley <leon@radley.se>","alza54 <alza54@thiocod.in>","Jacob Smith <jacob@frende.me>","Michael Nutt <michael@nutt.im>","Brad Parham <baparham@gmail.com>","Taneli Vatanen <taneli.vatanen@gmail.com>","Joris Dugu\xE9 <zaruike10@gmail.com>","Chris Banks <christopher.bradley.banks@gmail.com>","Ompal Singh <ompal.hitm09@gmail.com>","Brodan <christopher.hranj@gmail.com>","Ankur Parihar <ankur.github@gmail.com>","Brahim Ait elhaj <brahima@gmail.com>","Mart Jansink <m.jansink@gmail.com>","Lachlan Newman <lachnewman007@gmail.com>","Dennis Beatty <dennis@dcbeatty.com>","Ingvar Stepanyan <me@rreverser.com>","Don Denton <don@happycollision.com>"],scripts:{install:"node install/check",clean:"rm -rf src/build/ .nyc_output/ coverage/ test/fixtures/output.*",test:"npm run test-lint && npm run test-unit && npm run test-licensing && npm run test-types","test-lint":"semistandard && cpplint","test-unit":"nyc --reporter=lcov --reporter=text --check-coverage --branches=100 mocha","test-licensing":'license-checker --production --summary --onlyAllow="Apache-2.0;BSD;ISC;LGPL-3.0-or-later;MIT"',"test-leak":"./test/leak/leak.sh","test-types":"tsd","package-from-local-build":"node npm/from-local-build","package-from-github-release":"node npm/from-github-release","docs-build":"node docs/build && node docs/search-index/build","docs-serve":"cd docs && npx serve","docs-publish":"cd docs && npx firebase-tools deploy --project pixelplumbing --only hosting:pixelplumbing-sharp"},type:"commonjs",main:"lib/index.js",types:"lib/index.d.ts",files:["install","lib","src/*.{cc,h,gyp}"],repository:{type:"git",url:"git://github.com/lovell/sharp.git"},keywords:["jpeg","png","webp","avif","tiff","gif","svg","jp2","dzi","image","resize","thumbnail","crop","embed","libvips","vips"],dependencies:{color:"^4.2.3","detect-libc":"^2.0.3",semver:"^7.6.3"},optionalDependencies:{"@img/sharp-darwin-arm64":"0.33.5","@img/sharp-darwin-x64":"0.33.5","@img/sharp-libvips-darwin-arm64":"1.0.4","@img/sharp-libvips-darwin-x64":"1.0.4","@img/sharp-libvips-linux-arm":"1.0.5","@img/sharp-libvips-linux-arm64":"1.0.4","@img/sharp-libvips-linux-s390x":"1.0.4","@img/sharp-libvips-linux-x64":"1.0.4","@img/sharp-libvips-linuxmusl-arm64":"1.0.4","@img/sharp-libvips-linuxmusl-x64":"1.0.4","@img/sharp-linux-arm":"0.33.5","@img/sharp-linux-arm64":"0.33.5","@img/sharp-linux-s390x":"0.33.5","@img/sharp-linux-x64":"0.33.5","@img/sharp-linuxmusl-arm64":"0.33.5","@img/sharp-linuxmusl-x64":"0.33.5","@img/sharp-wasm32":"0.33.5","@img/sharp-win32-ia32":"0.33.5","@img/sharp-win32-x64":"0.33.5"},devDependencies:{"@emnapi/runtime":"^1.2.0","@img/sharp-libvips-dev":"1.0.4","@img/sharp-libvips-dev-wasm32":"1.0.5","@img/sharp-libvips-win32-ia32":"1.0.4","@img/sharp-libvips-win32-x64":"1.0.4","@types/node":"*",async:"^3.2.5",cc:"^3.0.1",emnapi:"^1.2.0","exif-reader":"^2.0.1","extract-zip":"^2.0.1",icc:"^3.0.0","jsdoc-to-markdown":"^8.0.3","license-checker":"^25.0.1",mocha:"^10.7.3","node-addon-api":"^8.1.0",nyc:"^17.0.0",prebuild:"^13.0.1",semistandard:"^17.0.0","tar-fs":"^3.0.6",tsd:"^0.31.1"},license:"Apache-2.0",engines:{node:"^18.17.0 || ^20.3.0 || >=21.0.0"},config:{libvips:">=8.15.3"},funding:{url:"https://opencollective.com/libvips"},binary:{napi_versions:[9]},semistandard:{env:["mocha"]},cc:{linelength:"120",filter:["build/include"]},nyc:{include:["lib"]},tsd:{directory:"test/types/"}}});var require_libvips=__commonJS((exports,module3)=>{var{spawnSync}=__require("child_process"),{createHash:createHash3}=__require("crypto"),semverCoerce=require_coerce(),semverGreaterThanOrEqualTo=require_gte(),semverSatisfies=require_satisfies(),detectLibc=require_detect_libc(),{config,engines,optionalDependencies}=require_package(),minimumLibvipsVersionLabelled=process.env.npm_package_config_libvips||config.libvips,minimumLibvipsVersion=semverCoerce(minimumLibvipsVersionLabelled).version,prebuiltPlatforms=["darwin-arm64","darwin-x64","linux-arm","linux-arm64","linux-s390x","linux-x64","linuxmusl-arm64","linuxmusl-x64","win32-ia32","win32-x64"],spawnSyncOptions={encoding:"utf8",shell:!0},log3=(item)=>{if(item instanceof Error)console.error(`sharp: Installation error: ${item.message}`);else console.log(`sharp: ${item}`)},runtimeLibc=()=>detectLibc.isNonGlibcLinuxSync()?detectLibc.familySync():"",runtimePlatformArch=()=>`${process.platform}${runtimeLibc()}-${process.arch}`,buildPlatformArch=()=>{if(isEmscripten())return"wasm32";let{npm_config_arch,npm_config_platform,npm_config_libc}=process.env,libc=typeof npm_config_libc==="string"?npm_config_libc:runtimeLibc();return`${npm_config_platform||process.platform}${libc}-${npm_config_arch||process.arch}`},buildSharpLibvipsIncludeDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/include`)}catch{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/include");})()}catch{}}return""},buildSharpLibvipsCPlusPlusDir=()=>{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/cplusplus");})()}catch{}return""},buildSharpLibvipsLibDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/lib`)}catch{try{return __require(`@img/sharp-libvips-${buildPlatformArch()}/lib`)}catch{}}return""},isUnsupportedNodeRuntime=()=>{if(process.release?.name==="node"&&process.versions){if(!semverSatisfies(process.versions.node,engines.node))return{found:process.versions.node,expected:engines.node}}},isEmscripten=()=>{let{CC}=process.env;return Boolean(CC&&CC.endsWith("/emcc"))},isRosetta=()=>{if(process.platform==="darwin"&&process.arch==="x64")return(spawnSync("sysctl sysctl.proc_translated",spawnSyncOptions).stdout||"").trim()==="sysctl.proc_translated: 1";return!1},sha5122=(s)=>createHash3("sha512").update(s).digest("hex"),yarnLocator=()=>{try{let identHash=sha5122(`imgsharp-libvips-${buildPlatformArch()}`),npmVersion=semverCoerce(optionalDependencies[`@img/sharp-libvips-${buildPlatformArch()}`]).version;return sha5122(`${identHash}npm:${npmVersion}`).slice(0,10)}catch{}return""},spawnRebuild=()=>spawnSync(`node-gyp rebuild --directory=src ${isEmscripten()?"--nodedir=emscripten":""}`,{...spawnSyncOptions,stdio:"inherit"}).status,globalLibvipsVersion=()=>{if(process.platform!=="win32")return(spawnSync("pkg-config --modversion vips-cpp",{...spawnSyncOptions,env:{...process.env,PKG_CONFIG_PATH:pkgConfigPath()}}).stdout||"").trim();else return""},pkgConfigPath=()=>{if(process.platform!=="win32")return[(spawnSync('which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',spawnSyncOptions).stdout||"").trim(),process.env.PKG_CONFIG_PATH,"/usr/local/lib/pkgconfig","/usr/lib/pkgconfig","/usr/local/libdata/pkgconfig","/usr/libdata/pkgconfig"].filter(Boolean).join(":");else return""},skipSearch=(status,reason,logger2)=>{if(logger2)logger2(`Detected ${reason}, skipping search for globally-installed libvips`);return status},useGlobalLibvips=(logger2)=>{if(Boolean(process.env.SHARP_IGNORE_GLOBAL_LIBVIPS)===!0)return skipSearch(!1,"SHARP_IGNORE_GLOBAL_LIBVIPS",logger2);if(Boolean(process.env.SHARP_FORCE_GLOBAL_LIBVIPS)===!0)return skipSearch(!0,"SHARP_FORCE_GLOBAL_LIBVIPS",logger2);if(isRosetta())return skipSearch(!1,"Rosetta",logger2);let globalVipsVersion=globalLibvipsVersion();return!!globalVipsVersion&&semverGreaterThanOrEqualTo(globalVipsVersion,minimumLibvipsVersion)};module3.exports={minimumLibvipsVersion,prebuiltPlatforms,buildPlatformArch,buildSharpLibvipsIncludeDir,buildSharpLibvipsCPlusPlusDir,buildSharpLibvipsLibDir,isUnsupportedNodeRuntime,runtimePlatformArch,log:log3,yarnLocator,spawnRebuild,globalLibvipsVersion,pkgConfigPath,useGlobalLibvips}});var require_sharp=__commonJS((exports,module3)=>{var{familySync,versionSync}=require_detect_libc(),{runtimePlatformArch,isUnsupportedNodeRuntime,prebuiltPlatforms,minimumLibvipsVersion}=require_libvips(),runtimePlatform=runtimePlatformArch(),paths=[`../src/build/Release/sharp-${runtimePlatform}.node`,"../src/build/Release/sharp-wasm32.node",`@img/sharp-${runtimePlatform}/sharp.node`,"@img/sharp-wasm32/sharp.node"],sharp,errors2=[];for(let path2 of paths)try{sharp=__require(path2);break}catch(err){errors2.push(err)}if(sharp)module3.exports=sharp;else{let[isLinux,isMacOs,isWindows]=["linux","darwin","win32"].map((os4)=>runtimePlatform.startsWith(os4)),help=[`Could not load the "sharp" module using the ${runtimePlatform} runtime`];errors2.forEach((err)=>{if(err.code!=="MODULE_NOT_FOUND")help.push(`${err.code}: ${err.message}`)});let messages=errors2.map((err)=>err.message).join(" ");if(help.push("Possible solutions:"),isUnsupportedNodeRuntime()){let{found,expected}=isUnsupportedNodeRuntime();help.push("- Please upgrade Node.js:",`    Found ${found}`,`    Requires ${expected}`)}else if(prebuiltPlatforms.includes(runtimePlatform)){let[os4,cpu]=runtimePlatform.split("-"),libc=os4.endsWith("musl")?" --libc=musl":"";help.push("- Ensure optional dependencies can be installed:","    npm install --include=optional sharp","- Ensure your package manager supports multi-platform installation:","    See https://sharp.pixelplumbing.com/install#cross-platform","- Add platform-specific dependencies:",`    npm install --os=${os4.replace("musl","")}${libc} --cpu=${cpu} sharp`)}else help.push(`- Manually install libvips >= ${minimumLibvipsVersion}`,"- Add experimental WebAssembly-based dependencies:","    npm install --cpu=wasm32 sharp","    npm install @img/sharp-wasm32");if(isLinux&&/(symbol not found|CXXABI_)/i.test(messages))try{let{config}=__require(`@img/sharp-libvips-${runtimePlatform}/package`),libcFound=`${familySync()} ${versionSync()}`,libcRequires=`${config.musl?"musl":"glibc"} ${config.musl||config.glibc}`;help.push("- Update your OS:",`    Found ${libcFound}`,`    Requires ${libcRequires}`)}catch(errEngines){}if(isLinux&&/\/snap\/core[0-9]{2}/.test(messages))help.push("- Remove the Node.js Snap, which does not support native modules","    snap remove node");if(isMacOs&&/Incompatible library version/.test(messages))help.push("- Update Homebrew:","    brew update && brew upgrade vips");if(errors2.some((err)=>err.code==="ERR_DLOPEN_DISABLED"))help.push("- Run Node.js without using the --no-addons flag");if(isWindows&&/The specified procedure could not be found/.test(messages))help.push("- Using the canvas package on Windows?","    See https://sharp.pixelplumbing.com/install#canvas-and-windows","- Check for outdated versions of sharp in the dependency tree:","    npm ls sharp");throw help.push("- Consult the installation documentation:","    See https://sharp.pixelplumbing.com/install"),Error(help.join(`
+${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algorithms!==void 0){let getInfoAlgs=authenticatorGetInfo.algorithms.map((_alg)=>_alg.alg);if(getInfoAlgs.indexOf(attestationStatementAlg)<0)throw Error(`Attestation statement alg ${attestationStatementAlg} did not match one of ${getInfoAlgs}`)}let authenticatorCerts=x5c.map(convertCertBufferToPEM),statementRootCerts=attestationRootCertificates.map(convertCertBufferToPEM),authenticatorIsSelfReferencing=!1;if(authenticatorCerts.length===1&&statementRootCerts.indexOf(authenticatorCerts[0])>=0)authenticatorIsSelfReferencing=!0;if(!authenticatorIsSelfReferencing)try{await validateCertificatePath(authenticatorCerts,statementRootCerts)}catch(err){throw Error(`Could not validate certificate path with any metadata root certificates: ${err.message}`)}return!0}function stringifyCOSEInfo(info){let{kty,alg,crv}=info,toReturn="";if(kty!==COSEKTY.RSA)toReturn=`{ kty: ${kty}, alg: ${alg}, crv: ${crv} }`;else toReturn=`{ kty: ${kty}, alg: ${alg} }`;return toReturn}var algSignToCOSEInfoMap;var init_verifyAttestationWithMetadata=__esm(()=>{init_convertCertBufferToPEM();init_validateCertificatePath();init_decodeCredentialPublicKey();init_cose();algSignToCOSEInfoMap={secp256r1_ecdsa_sha256_raw:{kty:2,alg:-7,crv:1},secp256r1_ecdsa_sha256_der:{kty:2,alg:-7,crv:1},rsassa_pss_sha256_raw:{kty:3,alg:-37},rsassa_pss_sha256_der:{kty:3,alg:-37},secp256k1_ecdsa_sha256_raw:{kty:2,alg:-47,crv:8},secp256k1_ecdsa_sha256_der:{kty:2,alg:-47,crv:8},rsassa_pss_sha384_raw:{kty:3,alg:-38},rsassa_pkcsv15_sha256_raw:{kty:3,alg:-257},rsassa_pkcsv15_sha384_raw:{kty:3,alg:-258},rsassa_pkcsv15_sha512_raw:{kty:3,alg:-259},rsassa_pkcsv15_sha1_raw:{kty:3,alg:-65535},secp384r1_ecdsa_sha384_raw:{kty:2,alg:-35,crv:2},secp512r1_ecdsa_sha256_raw:{kty:2,alg:-36,crv:3},ed25519_eddsa_sha512_raw:{kty:1,alg:-8,crv:6}}});async function verifyAttestationPacked(options){let{attStmt,clientDataHash,authData,credentialPublicKey,aaguid,rootCertificates}=options,sig=attStmt.get("sig"),x5c=attStmt.get("x5c"),alg=attStmt.get("alg");if(!sig)throw Error("No attestation signature provided in attestation statement (Packed)");if(!alg)throw Error("Attestation statement did not contain alg (Packed)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Packed)`);let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]),verified=!1;if(x5c){let{subject,basicConstraintsCA,version,notBefore,notAfter,parsedCertificate}=getCertificateInfo(x5c[0]),{OU,CN,O,C}=subject;if(OU!=="Authenticator Attestation")throw Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');if(!CN)throw Error("Certificate CN was empty (Packed|Full)");if(!O)throw Error("Certificate O was empty (Packed|Full)");if(!C||C.length!==2)throw Error("Certificate C was not two-character ISO 3166 code (Packed|Full)");if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (Packed|Full)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (Packed|Full)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (Packed|Full)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);try{await validateExtFIDOGenCEAAGUID(parsedCertificate.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (Packed|Full)`)}let statement=await MetadataService.getStatement(aaguid);if(statement){if(statement.attestationTypes.indexOf("basic_full")<0)throw Error("Metadata does not indicate support for full attestations (Packed|Full)");try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (Packed|Full)`)}}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Packed|Full)`)}verified=await verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0]})}else verified=await verifySignature2({signature:sig,data:signatureBase,credentialPublicKey,hashAlgorithm:alg});return verified}var init_verifyAttestationPacked=__esm(()=>{init_cose();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationAndroidSafetyNet(options){let{attStmt,clientDataHash,authData,aaguid,rootCertificates,verifyTimestampMS=!0,credentialPublicKey,attestationSafetyNetEnforceCTSCheck}=options,alg=attStmt.get("alg"),response=attStmt.get("response");if(!attStmt.get("ver"))throw Error("No ver value in attestation (SafetyNet)");if(!response)throw Error("No response was included in attStmt by authenticator (SafetyNet)");let jwtParts=exports_isoUint8Array.toUTF8String(response).split("."),HEADER=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[0])),PAYLOAD=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[1])),SIGNATURE=jwtParts[2],{nonce,ctsProfileMatch,timestampMs}=PAYLOAD;if(verifyTimestampMS){let now=Date.now();if(timestampMs>Date.now())throw Error(`Payload timestamp "${timestampMs}" was later than "${now}" (SafetyNet)`);let timestampPlusDelay=timestampMs+60000;if(now=Date.now(),timestampPlusDelay<now)throw Error(`Payload timestamp "${timestampPlusDelay}" has expired (SafetyNet)`)}let nonceBase=exports_isoUint8Array.concat([authData,clientDataHash]),nonceBuffer=await toHash(nonceBase),expectedNonce=exports_isoBase64URL.fromBuffer(nonceBuffer,"base64");if(nonce!==expectedNonce)throw Error("Could not verify payload nonce (SafetyNet)");if(attestationSafetyNetEnforceCTSCheck&&!ctsProfileMatch)throw Error("Could not verify device integrity (SafetyNet)");let leafCertBuffer=exports_isoBase64URL.toBuffer(HEADER.x5c[0],"base64"),leafCertInfo=getCertificateInfo(leafCertBuffer),{subject}=leafCertInfo;if(subject.CN!=="attest.android.com")throw Error('Certificate common name was not "attest.android.com" (SafetyNet)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c:HEADER.x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (SafetyNet)`)}else try{await validateCertificatePath(HEADER.x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (SafetyNet)`)}let signatureBaseBuffer=exports_isoUint8Array.fromUTF8String(`${jwtParts[0]}.${jwtParts[1]}`),signatureBuffer=exports_isoBase64URL.toBuffer(SIGNATURE);return await verifySignature2({signature:signatureBuffer,data:signatureBaseBuffer,x509Certificate:leafCertBuffer})}var init_verifyAttestationAndroidSafetyNet=__esm(()=>{init_toHash();init_verifySignature();init_getCertificateInfo();init_validateCertificatePath();init_convertCertBufferToPEM();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});var TPM_ST,TPM_ALG,TPM_ECC_CURVE,TPM_MANUFACTURERS,TPM_ECC_CURVE_COSE_CRV_MAP;var init_constants2=__esm(()=>{TPM_ST={196:"TPM_ST_RSP_COMMAND",32768:"TPM_ST_NULL",32769:"TPM_ST_NO_SESSIONS",32770:"TPM_ST_SESSIONS",32788:"TPM_ST_ATTEST_NV",32789:"TPM_ST_ATTEST_COMMAND_AUDIT",32790:"TPM_ST_ATTEST_SESSION_AUDIT",32791:"TPM_ST_ATTEST_CERTIFY",32792:"TPM_ST_ATTEST_QUOTE",32793:"TPM_ST_ATTEST_TIME",32794:"TPM_ST_ATTEST_CREATION",32801:"TPM_ST_CREATION",32802:"TPM_ST_VERIFIED",32803:"TPM_ST_AUTH_SECRET",32804:"TPM_ST_HASHCHECK",32805:"TPM_ST_AUTH_SIGNED",32809:"TPM_ST_FU_MANIFEST"},TPM_ALG={0:"TPM_ALG_ERROR",1:"TPM_ALG_RSA",4:"TPM_ALG_SHA",4:"TPM_ALG_SHA1",5:"TPM_ALG_HMAC",6:"TPM_ALG_AES",7:"TPM_ALG_MGF1",8:"TPM_ALG_KEYEDHASH",10:"TPM_ALG_XOR",11:"TPM_ALG_SHA256",12:"TPM_ALG_SHA384",13:"TPM_ALG_SHA512",16:"TPM_ALG_NULL",18:"TPM_ALG_SM3_256",19:"TPM_ALG_SM4",20:"TPM_ALG_RSASSA",21:"TPM_ALG_RSAES",22:"TPM_ALG_RSAPSS",23:"TPM_ALG_OAEP",24:"TPM_ALG_ECDSA",25:"TPM_ALG_ECDH",26:"TPM_ALG_ECDAA",27:"TPM_ALG_SM2",28:"TPM_ALG_ECSCHNORR",29:"TPM_ALG_ECMQV",32:"TPM_ALG_KDF1_SP800_56A",33:"TPM_ALG_KDF2",34:"TPM_ALG_KDF1_SP800_108",35:"TPM_ALG_ECC",37:"TPM_ALG_SYMCIPHER",38:"TPM_ALG_CAMELLIA",64:"TPM_ALG_CTR",65:"TPM_ALG_OFB",66:"TPM_ALG_CBC",67:"TPM_ALG_CFB",68:"TPM_ALG_ECB"},TPM_ECC_CURVE={0:"TPM_ECC_NONE",1:"TPM_ECC_NIST_P192",2:"TPM_ECC_NIST_P224",3:"TPM_ECC_NIST_P256",4:"TPM_ECC_NIST_P384",5:"TPM_ECC_NIST_P521",16:"TPM_ECC_BN_P256",17:"TPM_ECC_BN_P638",32:"TPM_ECC_SM2_P256"},TPM_MANUFACTURERS={"id:414D4400":{name:"AMD",id:"AMD"},"id:414E5400":{name:"Ant Group",id:"ANT"},"id:41544D4C":{name:"Atmel",id:"ATML"},"id:4252434D":{name:"Broadcom",id:"BRCM"},"id:4353434F":{name:"Cisco",id:"CSCO"},"id:464C5953":{name:"Flyslice Technologies",id:"FLYS"},"id:524F4343":{name:"Fuzhou Rockchip",id:"ROCC"},"id:474F4F47":{name:"Google",id:"GOOG"},"id:48504900":{name:"HPI",id:"HPI"},"id:48504500":{name:"HPE",id:"HPE"},"id:48495349":{name:"Huawei",id:"HISI"},"id:49424d00":{name:"IBM",id:"IBM"},"id:49424D00":{name:"IBM",id:"IBM"},"id:49465800":{name:"Infineon",id:"IFX"},"id:494E5443":{name:"Intel",id:"INTC"},"id:4C454E00":{name:"Lenovo",id:"LEN"},"id:4D534654":{name:"Microsoft",id:"MSFT"},"id:4E534D20":{name:"National Semiconductor",id:"NSM"},"id:4E545A00":{name:"Nationz",id:"NTZ"},"id:4E534700":{name:"NSING",id:"NSG"},"id:4E544300":{name:"Nuvoton Technology",id:"NTC"},"id:51434F4D":{name:"Qualcomm",id:"QCOM"},"id:534D534E":{name:"Samsung",id:"SMSN"},"id:53454345":{name:"SecEdge",id:"SECE"},"id:534E5300":{name:"Sinosun",id:"SNS"},"id:534D5343":{name:"SMSC",id:"SMSC"},"id:53544D20":{name:"STMicroelectronics",id:"STM"},"id:54584E00":{name:"Texas Instruments",id:"TXN"},"id:57454300":{name:"Winbond",id:"WEC"},"id:5345414C":{name:"Wisekey",id:"SEAL"},"id:FFFFF1D0":{name:"FIDO Alliance",id:"FIDO"}},TPM_ECC_CURVE_COSE_CRV_MAP={TPM_ECC_NIST_P256:1,TPM_ECC_NIST_P384:2,TPM_ECC_NIST_P521:3,TPM_ECC_BN_P256:1,TPM_ECC_SM2_P256:1}});function parseCertInfo(certInfo){let pointer=0,dataView=exports_isoUint8Array.toDataView(certInfo),magic=dataView.getUint32(pointer);pointer+=4;let typeBuffer=dataView.getUint16(pointer);pointer+=2;let type=TPM_ST[typeBuffer],qualifiedSignerLength=dataView.getUint16(pointer);pointer+=2;let qualifiedSigner=certInfo.slice(pointer,pointer+=qualifiedSignerLength),extraDataLength=dataView.getUint16(pointer);pointer+=2;let extraData=certInfo.slice(pointer,pointer+=extraDataLength),clock=certInfo.slice(pointer,pointer+=8),resetCount=dataView.getUint32(pointer);pointer+=4;let restartCount=dataView.getUint32(pointer);pointer+=4;let safe=!!certInfo.slice(pointer,pointer+=1),clockInfo={clock,resetCount,restartCount,safe},firmwareVersion=certInfo.slice(pointer,pointer+=8),attestedNameLength=dataView.getUint16(pointer);pointer+=2;let attestedName=certInfo.slice(pointer,pointer+=attestedNameLength),attestedNameDataView=exports_isoUint8Array.toDataView(attestedName),qualifiedNameLength=dataView.getUint16(pointer);pointer+=2;let qualifiedName=certInfo.slice(pointer,pointer+=qualifiedNameLength),attested={nameAlg:TPM_ALG[attestedNameDataView.getUint16(0)],nameAlgBuffer:attestedName.slice(0,2),name:attestedName,qualifiedName};return{magic,type,qualifiedSigner,extraData,clockInfo,firmwareVersion,attested}}var init_parseCertInfo=__esm(()=>{init_constants2();init_iso()});function parsePubArea(pubArea){let pointer=0,dataView=exports_isoUint8Array.toDataView(pubArea),type=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let nameAlg=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let objectAttributesInt=dataView.getUint32(pointer);pointer+=4;let objectAttributes={fixedTPM:!!(objectAttributesInt&1),stClear:!!(objectAttributesInt&2),fixedParent:!!(objectAttributesInt&8),sensitiveDataOrigin:!!(objectAttributesInt&16),userWithAuth:!!(objectAttributesInt&32),adminWithPolicy:!!(objectAttributesInt&64),noDA:!!(objectAttributesInt&512),encryptedDuplication:!!(objectAttributesInt&1024),restricted:!!(objectAttributesInt&32768),decrypt:!!(objectAttributesInt&65536),signOrEncrypt:!!(objectAttributesInt&131072)},authPolicyLength=dataView.getUint16(pointer);pointer+=2;let authPolicy=pubArea.slice(pointer,pointer+=authPolicyLength),parameters2={},unique=Uint8Array.from([]);if(type==="TPM_ALG_RSA"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let keyBits=dataView.getUint16(pointer);pointer+=2;let exponent=dataView.getUint32(pointer);pointer+=4,parameters2.rsa={symmetric,scheme,keyBits,exponent};let uniqueLength=dataView.getUint16(pointer);pointer+=2,unique=pubArea.slice(pointer,pointer+=uniqueLength)}else if(type==="TPM_ALG_ECC"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let curveID=TPM_ECC_CURVE[dataView.getUint16(pointer)];pointer+=2;let kdf=TPM_ALG[dataView.getUint16(pointer)];pointer+=2,parameters2.ecc={symmetric,scheme,curveID,kdf};let uniqueXLength=dataView.getUint16(pointer);pointer+=2;let uniqueX=pubArea.slice(pointer,pointer+=uniqueXLength),uniqueYLength=dataView.getUint16(pointer);pointer+=2;let uniqueY=pubArea.slice(pointer,pointer+=uniqueYLength);unique=exports_isoUint8Array.concat([uniqueX,uniqueY])}else throw Error(`Unexpected type "${type}" (TPM)`);return{type,nameAlg,objectAttributes,authPolicy,parameters:parameters2,unique}}var init_parsePubArea=__esm(()=>{init_constants2();init_iso()});async function verifyAttestationTPM(options){let{aaguid,attStmt,authData,credentialPublicKey,clientDataHash,rootCertificates}=options,ver=attStmt.get("ver"),sig=attStmt.get("sig"),alg=attStmt.get("alg"),x5c=attStmt.get("x5c"),pubArea=attStmt.get("pubArea"),certInfo=attStmt.get("certInfo");if(ver!=="2.0")throw Error(`Unexpected ver "${ver}", expected "2.0" (TPM)`);if(!sig)throw Error("No attestation signature provided in attestation statement (TPM)");if(!alg)throw Error("Attestation statement did not contain alg (TPM)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (TPM)`);if(!x5c)throw Error("No attestation certificate provided in attestation statement (TPM)");if(!pubArea)throw Error("Attestation statement did not contain pubArea (TPM)");if(!certInfo)throw Error("Attestation statement did not contain certInfo (TPM)");let parsedPubArea=parsePubArea(pubArea),{unique,type:pubType,parameters:parameters2}=parsedPubArea,cosePublicKey=decodeCredentialPublicKey(credentialPublicKey);if(pubType==="TPM_ALG_RSA"){if(!isCOSEPublicKeyRSA(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!n)throw Error("COSE public key missing n (TPM|RSA)");if(!e)throw Error("COSE public key missing e (TPM|RSA)");if(!exports_isoUint8Array.areEqual(unique,n))throw Error("PubArea unique is not same as credentialPublicKey (TPM|RSA)");if(!parameters2.rsa)throw Error("Parsed pubArea type is RSA, but missing parameters.rsa (TPM|RSA)");let eBuffer=e,pubAreaExponent=parameters2.rsa.exponent||65537,eSum=eBuffer[0]+(eBuffer[1]<<8)+(eBuffer[2]<<16);if(pubAreaExponent!==eSum)throw Error(`Unexpected public key exp ${eSum}, expected ${pubAreaExponent} (TPM|RSA)`)}else if(pubType==="TPM_ALG_ECC"){if(!isCOSEPublicKeyEC2(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!crv)throw Error("COSE public key missing crv (TPM|ECC)");if(!x)throw Error("COSE public key missing x (TPM|ECC)");if(!y)throw Error("COSE public key missing y (TPM|ECC)");if(!exports_isoUint8Array.areEqual(unique,exports_isoUint8Array.concat([x,y])))throw Error("PubArea unique is not same as public key x and y (TPM|ECC)");if(!parameters2.ecc)throw Error("Parsed pubArea type is ECC, but missing parameters.ecc (TPM|ECC)");let pubAreaCurveID=parameters2.ecc.curveID,pubAreaCurveIDMapToCOSECRV=TPM_ECC_CURVE_COSE_CRV_MAP[pubAreaCurveID];if(pubAreaCurveIDMapToCOSECRV!==crv)throw Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${crv}" (TPM|ECC)`)}else throw Error(`Unsupported pubArea.type "${pubType}"`);let parsedCertInfo=parseCertInfo(certInfo),{magic,type:certType,attested,extraData}=parsedCertInfo;if(magic!==4283712327)throw Error(`Unexpected magic value "${magic}", expected "0xff544347" (TPM)`);if(certType!=="TPM_ST_ATTEST_CERTIFY")throw Error(`Unexpected type "${certType}", expected "TPM_ST_ATTEST_CERTIFY" (TPM)`);let pubAreaHash=await toHash(pubArea,attestedNameAlgToCOSEAlg(attested.nameAlg)),attestedName=exports_isoUint8Array.concat([attested.nameAlgBuffer,pubAreaHash]);if(!exports_isoUint8Array.areEqual(attested.name,attestedName))throw Error("Attested name comparison failed (TPM)");let attToBeSigned=exports_isoUint8Array.concat([authData,clientDataHash]),attToBeSignedHash=await toHash(attToBeSigned,alg);if(!exports_isoUint8Array.areEqual(extraData,attToBeSignedHash))throw Error("CertInfo extra data did not equal hashed attestation (TPM)");if(x5c.length<1)throw Error("No certificates present in x5c array (TPM)");let leafCertInfo=getCertificateInfo(x5c[0]),{basicConstraintsCA,version,subject,notAfter,notBefore}=leafCertInfo;if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (TPM)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (TPM)");if(subject.combined.length>0)throw Error("Certificate subject was not empty (TPM)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (TPM)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (TPM)`);let parsedCert=AsnParser.parse(x5c[0],Certificate);if(!parsedCert.tbsCertificate.extensions)throw Error("Certificate was missing extensions (TPM)");let subjectAltNamePresent,extKeyUsage;if(parsedCert.tbsCertificate.extensions.forEach((ext)=>{if(ext.extnID===id_ce_subjectAltName)subjectAltNamePresent=AsnParser.parse(ext.extnValue,SubjectAlternativeName);else if(ext.extnID===id_ce_extKeyUsage)extKeyUsage=AsnParser.parse(ext.extnValue,ExtendedKeyUsage)}),!subjectAltNamePresent)throw Error("Certificate did not contain subjectAltName extension (TPM)");if(!subjectAltNamePresent[0].directoryName?.[0].length)throw Error("Certificate subjectAltName extension directoryName was empty (TPM)");let{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}=getTcgAtTpmValues(subjectAltNamePresent[0].directoryName);if(!tcgAtTpmManufacturer||!tcgAtTpmModel||!tcgAtTpmVersion)throw Error("Certificate contained incomplete subjectAltName data (TPM)");if(!extKeyUsage)throw Error("Certificate did not contain ExtendedKeyUsage extension (TPM)");if(!TPM_MANUFACTURERS[tcgAtTpmManufacturer])throw Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);if(extKeyUsage[0]!=="2.23.133.8.3")throw Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);try{await validateExtFIDOGenCEAAGUID(parsedCert.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (TPM)`)}let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (TPM)`)}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (TPM)`)}return verifySignature2({signature:sig,data:certInfo,x509Certificate:x5c[0],hashAlgorithm:alg})}function getTcgAtTpmValues(root){let tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion;return root.forEach((relName)=>{relName.forEach((attr)=>{if(attr.type==="2.23.133.2.1")tcgAtTpmManufacturer=attr.value.toString();else if(attr.type==="2.23.133.2.2")tcgAtTpmModel=attr.value.toString();else if(attr.type==="2.23.133.2.3")tcgAtTpmVersion=attr.value.toString()})}),{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}}function attestedNameAlgToCOSEAlg(alg){if(alg==="TPM_ALG_SHA256")return COSEALG.ES256;else if(alg==="TPM_ALG_SHA384")return COSEALG.ES384;else if(alg==="TPM_ALG_SHA512")return COSEALG.ES512;throw Error(`Unexpected TPM attested name alg ${alg}`)}var init_verifyAttestationTPM=__esm(()=>{init_es2015();init_es20152();init_decodeCredentialPublicKey();init_cose();init_toHash();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata();init_constants2();init_parseCertInfo();init_parsePubArea()});class RootOfTrust{verifiedBootKey=new OctetString2;deviceLocked=!1;verifiedBootState=VerifiedBootState.verified;verifiedBootHash;constructor(params={}){Object.assign(this,params)}}class AuthorizationList{purpose;algorithm;keySize;digest;padding;ecCurve;rsaPublicExponent;mgfDigest;rollbackResistance;earlyBootOnly;activeDateTime;originationExpireDateTime;usageExpireDateTime;usageCountLimit;noAuthRequired;userAuthType;authTimeout;allowWhileOnBody;trustedUserPresenceRequired;trustedConfirmationRequired;unlockedDeviceRequired;allApplications;applicationId;creationDateTime;origin;rollbackResistant;rootOfTrust;osVersion;osPatchLevel;attestationApplicationId;attestationIdBrand;attestationIdDevice;attestationIdProduct;attestationIdSerial;attestationIdImei;attestationIdMeid;attestationIdManufacturer;attestationIdModel;vendorPatchLevel;bootPatchLevel;deviceUniqueAttestation;attestationIdSecondImei;moduleHash;constructor(params={}){Object.assign(this,params)}}class KeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;teeEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}}class KeyMintKeyDescription{attestationVersion=Version3.keyMint4;attestationSecurityLevel=SecurityLevel.software;keyMintVersion=0;keyMintSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;hardwareEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}toLegacyKeyDescription(){return new KeyDescription({attestationVersion:this.attestationVersion,attestationSecurityLevel:this.attestationSecurityLevel,keymasterVersion:this.keyMintVersion,keymasterSecurityLevel:this.keyMintSecurityLevel,attestationChallenge:this.attestationChallenge,uniqueId:this.uniqueId,softwareEnforced:this.softwareEnforced,teeEnforced:this.hardwareEnforced})}static fromLegacyKeyDescription(keyDesc){return new KeyMintKeyDescription({attestationVersion:keyDesc.attestationVersion,attestationSecurityLevel:keyDesc.attestationSecurityLevel,keyMintVersion:keyDesc.keymasterVersion,keyMintSecurityLevel:keyDesc.keymasterSecurityLevel,attestationChallenge:keyDesc.attestationChallenge,uniqueId:keyDesc.uniqueId,softwareEnforced:keyDesc.softwareEnforced,hardwareEnforced:keyDesc.teeEnforced})}}var IntegerSet_1,id_ce_keyDescription="1.3.6.1.4.1.11129.2.1.17",VerifiedBootState,IntegerSet,SecurityLevel,Version3;var init_key_description=__esm(()=>{init_modules();init_es2015();(function(VerifiedBootState2){VerifiedBootState2[VerifiedBootState2.verified=0]="verified",VerifiedBootState2[VerifiedBootState2.selfSigned=1]="selfSigned",VerifiedBootState2[VerifiedBootState2.unverified=2]="unverified",VerifiedBootState2[VerifiedBootState2.failed=3]="failed"})(VerifiedBootState||(VerifiedBootState={}));__decorate([AsnProp({type:OctetString2})],RootOfTrust.prototype,"verifiedBootKey",void 0);__decorate([AsnProp({type:AsnPropTypes.Boolean})],RootOfTrust.prototype,"deviceLocked",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],RootOfTrust.prototype,"verifiedBootState",void 0);__decorate([AsnProp({type:OctetString2,optional:!0})],RootOfTrust.prototype,"verifiedBootHash",void 0);IntegerSet=IntegerSet_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,IntegerSet_1.prototype)}};IntegerSet=IntegerSet_1=__decorate([AsnType({type:AsnTypeTypes.Set,itemType:AsnPropTypes.Integer})],IntegerSet);__decorate([AsnProp({context:1,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"purpose",void 0);__decorate([AsnProp({context:2,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"algorithm",void 0);__decorate([AsnProp({context:3,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"keySize",void 0);__decorate([AsnProp({context:5,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"digest",void 0);__decorate([AsnProp({context:6,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"padding",void 0);__decorate([AsnProp({context:10,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"ecCurve",void 0);__decorate([AsnProp({context:200,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"rsaPublicExponent",void 0);__decorate([AsnProp({context:203,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"mgfDigest",void 0);__decorate([AsnProp({context:303,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistance",void 0);__decorate([AsnProp({context:305,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"earlyBootOnly",void 0);__decorate([AsnProp({context:400,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"activeDateTime",void 0);__decorate([AsnProp({context:401,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"originationExpireDateTime",void 0);__decorate([AsnProp({context:402,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageExpireDateTime",void 0);__decorate([AsnProp({context:405,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageCountLimit",void 0);__decorate([AsnProp({context:503,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"noAuthRequired",void 0);__decorate([AsnProp({context:504,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"userAuthType",void 0);__decorate([AsnProp({context:505,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"authTimeout",void 0);__decorate([AsnProp({context:506,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allowWhileOnBody",void 0);__decorate([AsnProp({context:507,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedUserPresenceRequired",void 0);__decorate([AsnProp({context:508,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedConfirmationRequired",void 0);__decorate([AsnProp({context:509,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"unlockedDeviceRequired",void 0);__decorate([AsnProp({context:600,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allApplications",void 0);__decorate([AsnProp({context:601,type:OctetString2,optional:!0})],AuthorizationList.prototype,"applicationId",void 0);__decorate([AsnProp({context:701,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"creationDateTime",void 0);__decorate([AsnProp({context:702,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"origin",void 0);__decorate([AsnProp({context:703,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistant",void 0);__decorate([AsnProp({context:704,type:RootOfTrust,optional:!0})],AuthorizationList.prototype,"rootOfTrust",void 0);__decorate([AsnProp({context:705,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osVersion",void 0);__decorate([AsnProp({context:706,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osPatchLevel",void 0);__decorate([AsnProp({context:709,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationApplicationId",void 0);__decorate([AsnProp({context:710,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdBrand",void 0);__decorate([AsnProp({context:711,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdDevice",void 0);__decorate([AsnProp({context:712,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdProduct",void 0);__decorate([AsnProp({context:713,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSerial",void 0);__decorate([AsnProp({context:714,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdImei",void 0);__decorate([AsnProp({context:715,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdMeid",void 0);__decorate([AsnProp({context:716,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdManufacturer",void 0);__decorate([AsnProp({context:717,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdModel",void 0);__decorate([AsnProp({context:718,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"vendorPatchLevel",void 0);__decorate([AsnProp({context:719,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"bootPatchLevel",void 0);__decorate([AsnProp({context:720,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"deviceUniqueAttestation",void 0);__decorate([AsnProp({context:723,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSecondImei",void 0);__decorate([AsnProp({context:724,type:OctetString2,optional:!0})],AuthorizationList.prototype,"moduleHash",void 0);(function(SecurityLevel2){SecurityLevel2[SecurityLevel2.software=0]="software",SecurityLevel2[SecurityLevel2.trustedEnvironment=1]="trustedEnvironment",SecurityLevel2[SecurityLevel2.strongBox=2]="strongBox"})(SecurityLevel||(SecurityLevel={}));(function(Version4){Version4[Version4.KM2=1]="KM2",Version4[Version4.KM3=2]="KM3",Version4[Version4.KM4=3]="KM4",Version4[Version4.KM4_1=4]="KM4_1",Version4[Version4.keyMint1=100]="keyMint1",Version4[Version4.keyMint2=200]="keyMint2",Version4[Version4.keyMint3=300]="keyMint3",Version4[Version4.keyMint4=400]="keyMint4"})(Version3||(Version3={}));__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"teeEnforced",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"keyMintVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"keyMintSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"hardwareEnforced",void 0)});class NonStandardKeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new NonStandardAuthorizationList;teeEnforced=new NonStandardAuthorizationList;get keyMintVersion(){return this.keymasterVersion}set keyMintVersion(value){this.keymasterVersion=value}get keyMintSecurityLevel(){return this.keymasterSecurityLevel}set keyMintSecurityLevel(value){this.keymasterSecurityLevel=value}get hardwareEnforced(){return this.teeEnforced}set hardwareEnforced(value){this.teeEnforced=value}constructor(params={}){Object.assign(this,params)}}var NonStandardAuthorizationList_1,NonStandardAuthorization,NonStandardAuthorizationList,NonStandardKeyMintKeyDescription;var init_nonstandard=__esm(()=>{init_modules();init_es2015();init_key_description();NonStandardAuthorization=class extends AuthorizationList{};NonStandardAuthorization=__decorate([AsnType({type:AsnTypeTypes.Choice})],NonStandardAuthorization);NonStandardAuthorizationList=NonStandardAuthorizationList_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,NonStandardAuthorizationList_1.prototype)}findProperty(key2){let prop=this.find((o)=>o[key2]!==void 0);if(prop)return prop[key2];return}};NonStandardAuthorizationList=NonStandardAuthorizationList_1=__decorate([AsnType({type:AsnTypeTypes.Sequence,itemType:NonStandardAuthorization})],NonStandardAuthorizationList);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"teeEnforced",void 0);NonStandardKeyMintKeyDescription=class extends NonStandardKeyDescription{constructor(params={}){if("keymasterVersion"in params&&!("keyMintVersion"in params))params.keyMintVersion=params.keymasterVersion;if("keymasterSecurityLevel"in params&&!("keyMintSecurityLevel"in params))params.keyMintSecurityLevel=params.keymasterSecurityLevel;if("teeEnforced"in params&&!("hardwareEnforced"in params))params.hardwareEnforced=params.teeEnforced;super(params)}};NonStandardKeyMintKeyDescription=__decorate([AsnType({type:AsnTypeTypes.Sequence})],NonStandardKeyMintKeyDescription)});class AttestationPackageInfo{packageName;version;constructor(params={}){Object.assign(this,params)}}class AttestationApplicationId{packageInfos;signatureDigests;constructor(params={}){Object.assign(this,params)}}var init_attestation=__esm(()=>{init_modules();init_es2015();__decorate([AsnProp({type:AsnPropTypes.OctetString})],AttestationPackageInfo.prototype,"packageName",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],AttestationPackageInfo.prototype,"version",void 0);__decorate([AsnProp({type:AttestationPackageInfo,repeated:"set"})],AttestationApplicationId.prototype,"packageInfos",void 0);__decorate([AsnProp({type:AsnPropTypes.OctetString,repeated:"set"})],AttestationApplicationId.prototype,"signatureDigests",void 0)});var init_es201511=__esm(()=>{init_key_description();init_nonstandard();init_attestation()});async function verifyAttestationAndroidKey(options){let{authData,clientDataHash,attStmt,credentialPublicKey,aaguid,rootCertificates}=options,x5c=attStmt.get("x5c"),sig=attStmt.get("sig"),alg=attStmt.get("alg");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Android Key)");if(!sig)throw Error("No attestation signature provided in attestation statement (Android Key)");if(!alg)throw Error("Attestation statement did not contain alg (Android Key)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Android Key)`);let parsedCert=AsnParser.parse(x5c[0],Certificate),parsedCertPubKey=new Uint8Array(parsedCert.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey),credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,parsedCertPubKey))throw Error("Credential public key does not equal leaf cert public key (Android Key)");let extKeyStore=parsedCert.tbsCertificate.extensions?.find((ext)=>ext.extnID===id_ce_keyDescription);if(!extKeyStore)throw Error("Certificate did not contain extKeyStore (Android Key)");let parsedExtKeyStore=AsnParser.parse(extKeyStore.extnValue,KeyDescription),{attestationChallenge,teeEnforced,softwareEnforced}=parsedExtKeyStore;if(!exports_isoUint8Array.areEqual(new Uint8Array(attestationChallenge.buffer),clientDataHash))throw Error("Attestation challenge was not equal to client data hash (Android Key)");if(teeEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');if(softwareEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}else{let x5cNoRootPEM=x5c.slice(0,-1).map(convertCertBufferToPEM),x5cRootPEM=x5c.slice(-1).map(convertCertBufferToPEM);try{await validateCertificatePath(x5cNoRootPEM,x5cRootPEM)}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}if(rootCertificates.length>0&&rootCertificates.indexOf(x5cRootPEM[0])<0)throw Error("x5c root certificate was not a known root certificate (Android Key)")}let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]);return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:alg})}var init_verifyAttestationAndroidKey=__esm(()=>{init_es2015();init_es20152();init_es201511();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_convertCOSEtoPKCS();init_cose();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationApple(options){let{attStmt,authData,clientDataHash,credentialPublicKey,rootCertificates}=options,x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Apple)");try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Apple)`)}let parsedCredCert=AsnParser.parse(x5c[0],Certificate),{extensions:extensions2,subjectPublicKeyInfo}=parsedCredCert.tbsCertificate;if(!extensions2)throw Error("credCert missing extensions (Apple)");let extCertNonce=extensions2.find((ext)=>ext.extnID==="1.2.840.113635.100.8.2");if(!extCertNonce)throw Error('credCert missing "1.2.840.113635.100.8.2" extension (Apple)');let nonceToHash=exports_isoUint8Array.concat([authData,clientDataHash]),nonce=await toHash(nonceToHash),extNonce=new Uint8Array(extCertNonce.extnValue.buffer).slice(6);if(!exports_isoUint8Array.areEqual(nonce,extNonce))throw Error("credCert nonce was not expected value (Apple)");let credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey),credCertSubjectPublicKey=new Uint8Array(subjectPublicKeyInfo.subjectPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,credCertSubjectPublicKey))throw Error("Credential public key does not equal credCert public key (Apple)");return!0}var init_verifyAttestationApple=__esm(()=>{init_es2015();init_es20152();init_validateCertificatePath();init_convertCertBufferToPEM();init_toHash();init_convertCOSEtoPKCS();init_iso()});async function verifyRegistrationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,requireUserPresence=!0,requireUserVerification=!0,supportedAlgorithmIDs=supportedCOSEAlgorithmIdentifiers,attestationSafetyNetEnforceCTSCheck=!0}=options,{id,rawId,type:credentialType,response:attestationResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);let clientDataJSON=decodeClientDataJSON(attestationResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected registration response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected registration response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.create")throw Error(`Unexpected registration response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin))throw Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`)}else if(origin!==expectedOrigin)throw Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);if(tokenBinding){if(typeof tokenBinding!=="object")throw Error(`Unexpected value for TokenBinding "${tokenBinding}"`);if(["present","supported","not-supported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`)}let attestationObject=exports_isoBase64URL.toBuffer(attestationResponse.attestationObject),decodedAttestationObject=decodeAttestationObject(attestationObject),fmt=decodedAttestationObject.get("fmt"),authData=decodedAttestationObject.get("authData"),attStmt=decodedAttestationObject.get("attStmt"),parsedAuthData=parseAuthenticatorData(authData),{aaguid,rpIdHash,flags,credentialID,counter,credentialPublicKey,extensionsData}=parsedAuthData,matchedRPID;if(expectedRPID){let expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs)}if(requireUserPresence&&!flags.up)throw Error("User presence was required, but user was not present");if(requireUserVerification&&!flags.uv)throw Error("User verification was required, but user could not be verified");if(!credentialID)throw Error("No credential ID was provided by authenticator");if(!credentialPublicKey)throw Error("No public key was provided by authenticator");if(!aaguid)throw Error("No AAGUID was present during registration");let alg=decodeCredentialPublicKey(credentialPublicKey).get(COSEKEYS.alg);if(typeof alg!=="number")throw Error("Credential public key was missing numeric alg");if(!supportedAlgorithmIDs.includes(alg)){let supported=supportedAlgorithmIDs.join(", ");throw Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`)}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(attestationResponse.clientDataJSON)),rootCertificates=SettingsService.getRootCertificates({identifier:fmt}),verifierOpts={aaguid,attStmt,authData,clientDataHash,credentialID,credentialPublicKey,rootCertificates,rpIdHash,attestationSafetyNetEnforceCTSCheck},verified=!1;if(fmt==="fido-u2f")verified=await verifyAttestationFIDOU2F(verifierOpts);else if(fmt==="packed")verified=await verifyAttestationPacked(verifierOpts);else if(fmt==="android-safetynet")verified=await verifyAttestationAndroidSafetyNet(verifierOpts);else if(fmt==="android-key")verified=await verifyAttestationAndroidKey(verifierOpts);else if(fmt==="tpm")verified=await verifyAttestationTPM(verifierOpts);else if(fmt==="apple")verified=await verifyAttestationApple(verifierOpts);else if(fmt==="none"){if(attStmt.size>0)throw Error("None attestation had unexpected attestation statement");verified=!0}else throw Error(`Unsupported Attestation Format: ${fmt}`);if(!verified)return{verified:!1};let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:!0,registrationInfo:{fmt,aaguid:convertAAGUIDToString(aaguid),credentialType,credential:{id:exports_isoBase64URL.fromBuffer(credentialID),publicKey:credentialPublicKey,counter,transports:response.response.transports},attestationObject,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,origin:clientDataJSON.origin,rpID:matchedRPID,authenticatorExtensionResults:extensionsData}}}var init_verifyRegistrationResponse=__esm(()=>{init_decodeAttestationObject();init_decodeClientDataJSON();init_parseAuthenticatorData();init_toHash();init_decodeCredentialPublicKey();init_cose();init_convertAAGUIDToString();init_parseBackupFlags();init_matchExpectedRPID();init_iso();init_settingsService();init_generateRegistrationOptions();init_verifyAttestationFIDOU2F();init_verifyAttestationPacked();init_verifyAttestationAndroidSafetyNet();init_verifyAttestationTPM();init_verifyAttestationAndroidKey();init_verifyAttestationApple()});async function generateAuthenticationOptions(options){let{allowCredentials,challenge=await generateChallenge2(),timeout=60000,userVerification="preferred",extensions:extensions2,rpID}=options,_challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);return{rpId:rpID,challenge:exports_isoBase64URL.fromBuffer(_challenge),allowCredentials:allowCredentials?.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`allowCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),timeout,userVerification,extensions:extensions2}}var init_generateAuthenticationOptions=__esm(()=>{init_iso();init_generateChallenge()});async function verifyAuthenticationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,credential,requireUserVerification=!0,advancedFIDOConfig}=options,{id,rawId,type:credentialType,response:assertionResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);if(!response)throw Error("Credential missing response");if(typeof assertionResponse?.clientDataJSON!=="string")throw Error("Credential response clientDataJSON was not a string");let clientDataJSON=decodeClientDataJSON(assertionResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.get")throw Error(`Unexpected authentication response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin)){let joinedExpectedOrigin=expectedOrigin.join(", ");throw Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`)}}else if(origin!==expectedOrigin)throw Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);if(!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData))throw Error("Credential response authenticatorData was not a base64url string");if(!exports_isoBase64URL.isBase64URL(assertionResponse.signature))throw Error("Credential response signature was not a base64url string");if(assertionResponse.userHandle&&typeof assertionResponse.userHandle!=="string")throw Error("Credential response userHandle was not a string");if(tokenBinding){if(typeof tokenBinding!=="object")throw Error("ClientDataJSON tokenBinding was not an object");if(["present","supported","notSupported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding status ${tokenBinding.status}`)}let authDataBuffer=exports_isoBase64URL.toBuffer(assertionResponse.authenticatorData),parsedAuthData=parseAuthenticatorData(authDataBuffer),{rpIdHash,flags,counter,extensionsData}=parsedAuthData,expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;let matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs);if(advancedFIDOConfig!==void 0){let{userVerification:fidoUserVerification}=advancedFIDOConfig;if(fidoUserVerification==="required"){if(!flags.uv)throw Error("User verification required, but user could not be verified")}}else{if(!flags.up)throw Error("User not present during authentication");if(requireUserVerification&&!flags.uv)throw Error("User verification required, but user could not be verified")}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(assertionResponse.clientDataJSON)),signatureBase=exports_isoUint8Array.concat([authDataBuffer,clientDataHash]),signature=exports_isoBase64URL.toBuffer(assertionResponse.signature);if((counter>0||credential.counter>0)&&counter<=credential.counter)throw Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:await verifySignature2({signature,data:signatureBase,credentialPublicKey:credential.publicKey}),authenticationInfo:{newCounter:counter,credentialID:credential.id,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,authenticatorExtensionResults:extensionsData,origin:clientDataJSON.origin,rpID:matchedRPID}}}var init_verifyAuthenticationResponse=__esm(()=>{init_decodeClientDataJSON();init_toHash();init_verifySignature();init_parseAuthenticatorData();init_parseBackupFlags();init_matchExpectedRPID();init_iso()});var init_mdsTypes=()=>{};var init_types11=()=>{};var init_esm2=__esm(()=>{init_generateRegistrationOptions();init_verifyRegistrationResponse();init_generateAuthenticationOptions();init_verifyAuthenticationResponse();init_metadataService();init_settingsService();init_mdsTypes();init_types11()});function base64UrlEncode2(buffer){let binary="";for(let byte of buffer)binary+=String.fromCharCode(byte);return(typeof btoa<"u"?btoa(binary):Buffer.from(binary,"binary").toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function base64UrlDecode2(value){let padded=value.replace(/-/g,"+").replace(/_/g,"/").padEnd(value.length+(4-value.length%4)%4,"="),binary=typeof atob<"u"?atob(padded):Buffer.from(padded,"base64").toString("binary"),buffer=new ArrayBuffer(binary.length),out=new Uint8Array(buffer);for(let i=0;i<binary.length;i+=1)out[i]=binary.charCodeAt(i);return out}function parseTransports(value){if(!value)return null;if(Array.isArray(value))return value;if(typeof value==="string")try{let parsed=JSON.parse(value);return Array.isArray(parsed)?parsed:null}catch{return null}return null}function parseDeviceType(value){if(value==="singleDevice"||value==="multiDevice")return value;return null}var exports_WebAuthn={};__export(exports_WebAuthn,{WebAuthnService:()=>WebAuthnService});class WebAuthnService{config;challengeTtlMs;constructor(config){this.config=config,this.challengeTtlMs=config.challengeTtlMs??DEFAULT_CHALLENGE_TTL_MS}async createRegistrationOptions(params){let existing=await this.config.storage.listCredentialsByUser(params.userId,params.schemaName),options=await generateRegistrationOptions({rpName:this.config.rp.rpName,rpID:this.config.rp.rpID,userID:new TextEncoder().encode(params.userId),userName:params.userName,userDisplayName:params.userDisplayName??params.userName,attestationType:"none",authenticatorSelection:{residentKey:"preferred",userVerification:this.config.userVerification??"preferred"},excludeCredentials:existing.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"registration",userId:params.userId,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyRegistration(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"registration",params.schemaName);if(!stored||stored.userId!==params.userId)return null;if(stored.expiresAt.getTime()<Date.now())return null;let verification;try{verification=await verifyRegistrationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Registration attestation rejected",{userId:params.userId,reason:error instanceof Error?error.message:String(error)}),null}if(!verification.verified||!verification.registrationInfo)return null;let info=verification.registrationInfo,publicKey=base64UrlEncode2(info.credential.publicKey),attachment=params.response.authenticatorAttachment==="platform"||params.response.authenticatorAttachment==="cross-platform"?params.response.authenticatorAttachment:null;return this.config.storage.insertCredential({userId:params.userId,credentialId:info.credential.id,publicKey,counter:info.credential.counter,transports:info.credential.transports??null,deviceType:info.credentialDeviceType,backedUp:info.credentialBackedUp,aaguid:info.aaguid??null,authenticatorAttachment:attachment,nickname:params.nickname??null,lastUsedAt:null,revokedAt:null},params.schemaName)}async createAuthenticationOptions(params){let credentials=params.userId?await this.config.storage.listCredentialsByUser(params.userId,params.schemaName):[],options=await generateAuthenticationOptions({rpID:this.config.rp.rpID,userVerification:this.config.userVerification??"preferred",allowCredentials:credentials.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"authentication",userId:params.userId??null,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyAuthentication(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"authentication",params.schemaName);if(!stored)return{verified:!1,userId:null,credentialId:null};if(stored.expiresAt.getTime()<Date.now())return{verified:!1,userId:null,credentialId:null};let credential=await this.config.storage.findCredentialById(params.response.id,params.schemaName);if(!credential||credential.revokedAt)return{verified:!1,userId:null,credentialId:null};let verification;try{verification=await verifyAuthenticationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,credential:{id:credential.credentialId,publicKey:base64UrlDecode2(credential.publicKey),counter:credential.counter,transports:credential.transports??void 0},requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Authentication assertion rejected",{userId:credential.userId,credentialId:credential.credentialId,reason:error instanceof Error?error.message:String(error)}),{verified:!1,userId:null,credentialId:null}}if(!verification.verified)return{verified:!1,userId:null,credentialId:null};return await this.config.storage.updateCredentialCounter(credential.credentialId,verification.authenticationInfo.newCounter,params.schemaName),{verified:!0,userId:credential.userId,credentialId:credential.credentialId}}listUserCredentials(userId,schemaName){return this.config.storage.listCredentialsByUser(userId,schemaName)}revokeCredential(credentialId,userId,schemaName){return this.config.storage.revokeCredential(credentialId,userId,schemaName)}renameCredential(credentialId,userId,nickname,schemaName){return this.config.storage.renameCredential(credentialId,userId,nickname,schemaName)}}var DEFAULT_CHALLENGE_TTL_MS=300000;var init_WebAuthn=__esm(()=>{init_esm2()});var init_Services=__esm(()=>{init_ApiKey();init_Auth();init_Authorization();init_Backup();init_Captcha();init_Domain();init_Email();init_Gmail();init_Logger2();init_Monitoring();init_Notification();init_OAuth();init_Payment();init_RateLimiter();init_Secrets();init_Tenant();init_Verification();init_WebAuthn()});function encodeHeaderList(items){return items.map((v)=>encodeURIComponent(v)).join(",")}function decodeHeaderList(header){if(!header)return[];return header.split(",").map((v)=>v.trim()).filter(Boolean).map((v)=>{try{return decodeURIComponent(v)}catch{return v}})}function encodeClaimScopesHeader(claimScopes){if(!claimScopes||Object.keys(claimScopes).length===0)return"";return encodeURIComponent(JSON.stringify(claimScopes))}function decodeClaimScopesHeader(header){if(!header)return;try{let parsed=JSON.parse(decodeURIComponent(header));if(parsed&&typeof parsed==="object"&&!Array.isArray(parsed))return parsed;return}catch{return}}async function withDeadline(promise,timeoutMs,message){promise.catch(()=>{});let timer,deadline=new Promise((_resolve,reject)=>{timer=setTimeout(()=>reject(Error(message)),timeoutMs)});try{return await Promise.race([promise,deadline])}finally{if(timer)clearTimeout(timer)}}function defineRoute(declaration){return{...declaration,toClientEndpoint(){return{method:declaration.method,path:declaration.path,isPublic:declaration.isPublic,isFormData:declaration.isFormData,serviceId:declaration.serviceId,_payload:void 0,_success:void 0,_error:void 0}}}}var INTERNAL_HEADERS;var init_internalHeaders=__esm(()=>{INTERNAL_HEADERS=["x-user-id","x-request-id","x-auth-type","x-api-key-id","x-api-key-owner-type","x-user-roles","x-user-claims","x-user-claim-scopes","x-session-id","x-access-token","x-refresh-token","x-tenant-schema"]});function createResponseSet(){return{headers:{}}}function withEnvelopeFlags(body){let hasSuccess=Object.hasOwn(body,"success")&&typeof body.success==="boolean",hasIsSuccess=Object.hasOwn(body,"isSuccess")&&typeof body.isSuccess==="boolean";if(hasSuccess===hasIsSuccess)return body;let mirrored={};for(let[key2,value]of Object.entries(body))if(mirrored[key2]=value,key2==="success")mirrored.isSuccess=value;else if(key2==="isSuccess")mirrored.success=value;return mirrored}function mirrorFlags(result){if(Array.isArray(result))return result;let proto=Object.getPrototypeOf(result);if(proto!==Object.prototype&&proto!==null)return result;return withEnvelopeFlags(result)}function usableStatus(status){if(typeof status!=="number"||!Number.isInteger(status))return;if(status!==101&&(status<200||status>599))return;return status}function applySetHeaders(target2,set){for(let[key2,value]of Object.entries(set.headers))target2.set(key2,value)}function finalizeResponse(result,set){let setStatus=usableStatus(set.status),setTouched=setStatus!==void 0||Object.keys(set.headers).length>0;if(result instanceof Response){if(!setTouched)return result;let status2=result.status!==200?result.status:setStatus??200,headers2=new Headers;applySetHeaders(headers2,set);for(let cookie of result.headers.getSetCookie())headers2.append("set-cookie",cookie);if(result.headers.forEach((value,key2)=>{if(key2.toLowerCase()==="set-cookie")return;headers2.set(key2,value)}),BODILESS.has(status2))return new Response(null,{status:status2,headers:headers2});return new Response(result.body,{status:status2,headers:headers2})}if(result instanceof Error){let errorStatus=setStatus??500,errorHeaders=new Headers;if(applySetHeaders(errorHeaders,set),!errorHeaders.has("content-type"))errorHeaders.set("content-type","application/json");if(BODILESS.has(errorStatus))return new Response(null,{status:errorStatus,headers:errorHeaders});return new Response(JSON.stringify(withEnvelopeFlags({isSuccess:!1,message:result.message,status:errorStatus,errors:[{message:result.message}],data:null})),{status:errorStatus,headers:errorHeaders})}let status=setStatus??200,headers=new Headers;if(applySetHeaders(headers,set),result===void 0||result===null)return new Response(null,{status,headers});let isScalar=typeof result==="string"||typeof result==="number"||typeof result==="boolean";if(!headers.has("content-type"))headers.set("content-type",isScalar?"text/plain;charset=utf-8":"application/json");if(BODILESS.has(status))return new Response(null,{status,headers});return new Response(isScalar?String(result):JSON.stringify(mirrorFlags(result)),{status,headers})}var BODILESS;var init_response=__esm(()=>{BODILESS=new Set([204,304])});function beginRouteRecording(){if(recordingDepth===0)recording=[],recordedSocket=null,recordedAdapterSteps=[],recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedBootSteps=[],recordedShutdownSteps=[];recordingDepth+=1}function endRouteRecording(){if(recordingDepth===0)throw Error("endRouteRecording() without a matching beginRouteRecording()");if(recordingDepth-=1,recordingDepth>0)return recording??[];let collected=recording??[];return recording=null,collected}function recordRouteGroups(groups){if(recording){recording.push(...groups);return}console.warn(`[nucleus] recordRouteGroups: ${groups.length} route group(s) were recorded while no recording was open, so they were DISCARDED. A host must pass its groups as \`createNucleusServer({ routes: [...] })\`; collecting them outside \`buildNucleus\` records nothing, and if you rely on it alone those routes will answer 404.`)}function recordSocket(route){if(recording)recordedSocket=route}function getRecordedSocket(){return recordedSocket}function recordAdapterStep(step){if(recording)recordedAdapterSteps.push(step)}function recordSwagger(config){if(recording)recordedSwagger=config}function recordRuntime(runtime){recordedRuntime=runtime}function getMountedRuntime(){return recordedRuntime}function recordResolvedOptions(options){recordedResolvedOptions=options}function getResolvedOptions(){return recordedResolvedOptions}function recordStaticAssets(assetsPath){if(recording)recordedStaticAssets=assetsPath}function getRecordedStaticAssets(){return recordedStaticAssets}function recordBootStep(step){if(recording)recordedBootSteps.push(step)}function recordShutdownStep(step){if(recording)recordedShutdownSteps.push(step)}function getRecordedBootSteps(){return recordedBootSteps}function getRecordedShutdownSteps(){return recordedShutdownSteps}var recording=null,recordingDepth=0,recordedSocket=null,recordedAdapterSteps,recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedResolvedOptions=null,recordedBootSteps,recordedShutdownSteps;var init_routeRecording=__esm(()=>{recordedAdapterSteps=[],recordedBootSteps=[],recordedShutdownSteps=[]});function isRouteCollector(value){return typeof value==="object"&&value!==null&&COLLECTOR in value}function collectRoutes(groups=[]){let collected=[],collector={[COLLECTOR]:!0,groups:collected,use(other){return collected.push(...other.groups),collector}};if(groups.length>0)collected.push(...groups),recordRouteGroups(groups);return collector}var COLLECTOR;var init_routeCollector=__esm(()=>{init_routeRecording();COLLECTOR=Symbol.for("nucleus.routeCollector")});function defineWebSocketRoute(route){return route}function eraseSocketData(route){return route}function headersOf(request){let out={};request.headers.forEach((value,key2)=>{out[key2]=value});for(let header of INTERNAL_HEADERS)delete out[header];return out}function upgradeFor(route,request,server){let url=new URL(request.url);if(url.pathname!==route.path)return null;let data={query:Object.fromEntries(url.searchParams),headers:headersOf(request)};if(server.upgrade(request,{data}))return new Response(null,{status:101});return new Response("NOT_FOUND",{status:404})}function websocketHandlers(route){return{idleTimeout:route.idleTimeout,open:(ws)=>route.open?.(ws),message:(ws,message)=>route.message?.(ws,message),close:(ws,code,reason)=>route.close?.(ws,code,reason)}}var init_websocket=__esm(()=>{init_internalHeaders()});function joinPath(prefix,path){if(!prefix)return path;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path==="/"||path==="")return left||"/";let right=path.startsWith("/")?path:`/${path}`;return`${left}${right}`||"/"}function elysiaSchema(route){let schema={};if(route.body)schema.body=route.body;if(route.query)schema.query=route.query;if(route.params)schema.params=route.params;if(route.detail)schema.detail=route.detail;if(route.type)schema.type=route.type;return schema}function mountWebSocketRoute(app,route){let erased=eraseSocketData(route);recordSocket(erased),app.ws(erased.path,{idleTimeout:erased.idleTimeout,open:erased.open,message:erased.message,close:erased.close})}function useRoutes(app,child){if(isRouteCollector(app)){if(isRouteCollector(child))return app.use(child),app;throw Error("useRoutes: a RouteCollector cannot absorb an Elysia plugin. Record it as an "+"adapter step instead \u2014 only the adapter has an Elysia to mount it on.")}if(isRouteCollector(child))return mountGroups(app,child.groups),app;return app.use(child),app}function mountRoutes(app,groups,options={}){if(isRouteCollector(app))return app.use(collectRoutes(groups)),app;return recordRouteGroups(groups),mountGroups(app,groups,options),app}function mountGroups(app,groups,options={}){for(let group of groups)for(let route of group.routes){let method=METHODS[route.method];if(!method)throw Error(`${route.method} ${route.path}: no Elysia method for it. A WebSocket does not `+"belong in an HTTP group \u2014 declare it with defineWebSocketRoute and mount it with "+"mountWebSocketRoute, as routes/pubsub does.");let path=joinPath(group.prefix,route.path),guards=[...group.guards??[],...route.guards??[]];app[method](path,async(context)=>{let set=createResponseSet(),request=context.request,guardContext={request,set,body:context.body,params:context.params??{},query:context.query??{}};if(options.onRequest){let early=await options.onRequest(guardContext);if(early!==void 0)return finalizeResponse(early,set)}for(let guard of guards){let early=await guard(guardContext);if(early!==void 0)return finalizeResponse(early,set)}let result=await route.handler({request,params:context.params??{},query:context.query??{},body:context.body,set});return finalizeResponse(result,set)},elysiaSchema(route))}return app}var METHODS;var init_routeMount=__esm(()=>{init_response();init_routeCollector();init_routeRecording();init_websocket();METHODS={GET:"get",POST:"post",PUT:"put",PATCH:"patch",DELETE:"delete",HEAD:"head",OPTIONS:"options"}});function toCamel3(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function readColumn(row,column){if(column in row)return row[column];let camel=toCamel3(column);return camel in row?row[camel]:void 0}function isBlank(value){if(value===null||value===void 0)return!0;if(typeof value==="string")return value.trim().length===0;if(Array.isArray(value))return value.length===0;return!1}function coerce(value){if(isBlank(value))return;if(Array.isArray(value))return coerce(value[0]);if(typeof value==="string")return value.trim();if(typeof value==="number"||typeof value==="boolean")return String(value);return}function readClaim(profile,claim){if(claim in profile)return profile[claim];if(!claim.includes("."))return;let cursor=profile;for(let segment of claim.split(".")){if(cursor===null||typeof cursor!=="object")return;cursor=cursor[segment]}return cursor}function splitTarget(target2){let i=target2.indexOf(".");if(i===-1)return{table:"",column:""};return{table:target2.slice(0,i),column:target2.slice(i+1)}}function resolveProfileSyncUpdates(input){let users={},profiles={},errors2=[];for(let mapping of input.mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let target2=table==="users"?users:profiles;if(column in target2)continue;let incoming=coerce(readClaim(input.rawProfile,mapping.claim));if(incoming===void 0)continue;let currentRow=table==="users"?input.currentUser:input.currentProfile,current=readColumn(currentRow,column);if(mapping.overwrite===!1&&!isBlank(current))continue;if(current===incoming)continue;target2[column]=incoming}return{users,profiles,errors:errors2}}function validateProfileSyncTargets(mappings,columnsByTable){let errors2=[];for(let mapping of mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let columns=columnsByTable[table]??[],known=new Set(columns.flatMap((c)=>[c,toCamel3(c)]));if(!known.has(column)&&!known.has(toCamel3(column)))errors2.push(`profileSync maps "${mapping.claim}" to "${mapping.target}", but "${table}" has no column "${column}". Add it via a config entity with "extends": true.`)}return errors2}function isCommonPassword(pwd){let bare=foldAccents(pwd.trim());if(COMMON_PASSWORDS.has(bare))return!0;let stripped=normalizeForListCheck(pwd);return stripped.length>0&&COMMON_PASSWORDS.has(stripped)}function containsUserInfo(pwd,identity){if(!identity)return!1;let lowered=foldAccents(pwd.trim());if(!lowered)return!1;let id=foldAccents(identity.trim());if(!id)return!1;let parts=new Set([id]),at=id.indexOf("@");if(at>0){parts.add(id.slice(0,at));let domain=id.slice(at+1).split(".")[0];if(domain)parts.add(domain)}for(let part of parts)if(part.length>=3&&lowered.includes(part))return!0;return!1}function validateAgainstPolicy(pwd,policy,identity){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if((policy?.requireUppercase??!0)&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if((policy?.requireLowercase??!0)&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if((policy?.requireNumber??!0)&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if((policy?.requireSpecialChar??!1)&&!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd))errors2.push("Password must contain a special character");if(policy?.preventCommonPasswords&&isCommonPassword(pwd))errors2.push("Password is too common");if(policy?.preventUserInfoInPassword&&containsUserInfo(pwd,identity))errors2.push("Password must not contain your email or username");return{valid:errors2.length===0,errors:errors2}}var COMMON_PASSWORDS,foldAccents=(value)=>value.replace(/[\u0130I\u0131]/g,"i").replace(/[\u015E\u015F]/g,"s").replace(/[\u011E\u011F]/g,"g").replace(/[\u00C7\u00E7]/g,"c").replace(/[\u00D6\u00F6]/g,"o").replace(/[\u00DC\u00FC]/g,"u").toLowerCase(),normalizeForListCheck=(pwd)=>foldAccents(pwd.trim()).replace(/[0-9]+$/,"").replace(/[!@#$%^&*._-]+$/,"");var init_passwordPolicy=__esm(()=>{COMMON_PASSWORDS=new Set(["password","passwort","parola","sifre","qwerty","qwertyui","azerty","asdfgh","zxcvbn","qazwsx","qweasd","letmein","welcome","admin","administrator","root","toor","guest","test","demo","login","pass","secret","master","dragon","monkey","sunshine","princess","football","baseball","superman","batman","trustno","iloveyou","starwars","whatever","freedom","shadow","michael","jennifer","jordan","harley","ranger","hunter","buster","thomas","robert","soccer","hockey","killer","george","charlie","andrew","tigger","joshua","pepper","daniel","ginger","summer","ashley","bailey","banana","chelsea","diamond","yellow","orange","purple","silver","cookie","maggie","nicole","hannah","jessica","matthew","access","flower","hello","hellothere","changeme","default","temporary","temppass","newpass","passpass","system","manager","service","oracle","postgres","mysql","redis","server","database","internet","computer","samsung","google","facebook","twitter","linkedin","company","business","office","work","school","student","teacher","abcdef","abcabc","aaaaaa","zzzzzz","asdfasdf","qwerqwer","iloveu","princess1","letmein1","trustno1","passw0rd","p@ssword","p@ssw0rd","qwerty1","admin1","welcome1","password1","abc","abcd","abcde","ankara","istanbul","izmir","galatasaray","fenerbahce","besiktas","trabzonspor","turkiye","merhaba","deneme","sifrem","gizli","kullanici","yonetici"])});var resolveAuthTablesForRequest=(request,authConfig)=>{let defaults={usersTable:authConfig.usersTable,sessionsTable:authConfig.sessionsTable??null,userRolesTable:authConfig.userRolesTable??void 0,rolesTable:authConfig.rolesTable??void 0,roleClaimsTable:authConfig.roleClaimsTable??void 0,claimsTable:authConfig.claimsTable??void 0,oauthAccountsTable:authConfig.oauthAccountsTable??void 0,apiKeysTable:authConfig.apiKeysTable??void 0,schemaTables:authConfig.schemaTables||{}},registry=authConfig.getTenantRegistry?authConfig.getTenantRegistry():authConfig.tenantRegistry;if(!registry)return defaults;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaults;let ctx=registry.getSchemaContext(schemaName);if(!ctx)return defaults;let tables=ctx.schemaTables;return{usersTable:tables.users??defaults.usersTable,sessionsTable:tables.userSessions??tables.user_sessions??tables.sessions??defaults.sessionsTable,userRolesTable:tables.userRoles??defaults.userRolesTable,rolesTable:tables.roles??defaults.rolesTable,roleClaimsTable:tables.roleClaims??defaults.roleClaimsTable,claimsTable:tables.claims??defaults.claimsTable,oauthAccountsTable:tables.oauthAccounts??defaults.oauthAccountsTable,apiKeysTable:tables.apiKeys??defaults.apiKeysTable,schemaTables:tables}};import{eq as eq20}from"drizzle-orm";function accountStateRefusal(caller){if(caller.isActive===!1)return"Account is not active";let lockedUntil=caller.lockedUntil?new Date(caller.lockedUntil):null;return(lockedUntil!==null&&lockedUntil<=new Date?!1:lockedUntil!==null||caller.isLocked===!0)?"Account is locked":null}function createRequireGodmin(config){let{db}=config;return async function(request){let{usersTable}=resolveAuthTablesForRequest(request,config);if(!db||!usersTable)return{ok:!1,status:500,message:"Database not configured"};let callerId=request.headers.get("x-user-id");if(!callerId)return{ok:!1,status:401,message:"Unauthorized"};let caller=(await db.select().from(usersTable).where(eq20(usersTable.id,callerId)).limit(1))[0];if(!caller||!caller.isGod)return{ok:!1,status:403,message:"Forbidden: godmin privileges required"};let refusal=accountStateRefusal(caller);if(refusal)return{ok:!1,status:403,message:refusal};return{ok:!0,callerId,caller}}}var init_requireGodmin=()=>{};import{and as and15,eq as eq23}from"drizzle-orm";function resolveDefaultRoleNames(authentication){let names2=new Set,single=authentication?.defaultRole?.trim();if(single)names2.add(single);for(let name2 of authentication?.defaultRoles??[]){let trimmed=String(name2??"").trim();if(trimmed)names2.add(trimmed)}return[...names2]}async function assignDefaultRoles(params){let{roleNames,...rest}=params;for(let roleName of roleNames)await assignDefaultRole({...rest,roleName})}async function assignDefaultRole(params){let{db,userId,roleName,rolesTable,userRolesTable,logger:logger2}=params;if(!rolesTable||!userRolesTable){logger2.warn("[AUTH] assignDefaultRole called without rolesTable or userRolesTable \u2014 skipping",{userId,roleName});return}try{let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await db.select().from(rolesTable).where(eq23(rolesCols.name,roleName)).limit(1))[0];if(!role){logger2.warn(`[AUTH] Default role "${roleName}" not found in roles table \u2014 skipping assignment`,{userId});return}let roleId=role.id;if((await db.select().from(userRolesTable).where(and15(eq23(userRolesCols.userId,userId),eq23(userRolesCols.roleId,roleId))).limit(1)).length>0){logger2.debug("[AUTH] User already has default role \u2014 skipping",{userId,roleName});return}await db.insert(userRolesTable).values({userId,roleId}),logger2.info("[AUTH] Default role assigned to new user",{userId,roleName})}catch(err){logger2.warn("[AUTH] Failed to assign default role \u2014 continuing",{userId,roleName,error:err instanceof Error?err.message:String(err)})}}var init_assignDefaultRole=()=>{};import crypto6 from"crypto";var{password:password2}=globalThis.Bun;async function hashPassword(plainPassword){return await password2.hash(plainPassword,{algorithm:"bcrypt",cost:10})}function generateVerificationToken(){return crypto6.randomBytes(32).toString("hex")}function hashVerificationToken(token){return crypto6.createHash("sha256").update(token).digest("hex")}function parseTimeToMs(time2){let match=time2.match(/^(\d+)(s|m|h|d)$/);if(!match?.[1]||!match[2])return 86400000;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value*1000;case"m":return value*60*1000;case"h":return value*60*60*1000;case"d":return value*24*60*60*1000;default:return 86400000}}function validatePasswordStrength(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var init_utils6=__esm(()=>{init_passwordPolicy()});function pickByName(bag,name2){if(!name2)return;let camel=name2.replace(/_([a-z0-9])/g,(_,c)=>c.toUpperCase()),snake=name2.replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase();for(let key2 of[name2,camel,snake]){let found=bag[key2];if(found!==void 0)return found}return}import{inArray as inArray8}from"drizzle-orm";function accountLinkFor(links,table){if(!links?.length||!table)return null;let byTable={};for(let link of links)if(link?.table)byTable[link.table]=link;return pickByName(byTable,table)??null}function accountIdsIn(rows,userColumn){if(!userColumn)return[];let ids=new Set;for(let row of rows){let value=pickByName(row,userColumn),id=String(value??"").trim();if(id)ids.add(id)}return[...ids]}async function closeAccounts(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))];if(ids.length===0||!deps.usersTable)return{closed:0,signedOut:!0,closedIds:[]};let idColumn=pickByName(deps.usersTable,"id"),activeColumn=pickByName(deps.usersTable,"is_active");if(!idColumn||!activeColumn)return{closed:0,signedOut:!1,closedIds:[]};try{await deps.db.update(deps.usersTable).set({isActive:!1}).where(inArray8(idColumn,ids))}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:0,signedOut:!1,closedIds:[]}}let sessionUser=deps.sessionsTable?pickByName(deps.sessionsTable,"user_id"):void 0;if(!deps.sessionsTable||!sessionUser)return{closed:ids.length,signedOut:!1,closedIds:ids};try{return await deps.db.delete(deps.sessionsTable).where(inArray8(sessionUser,ids)),{closed:ids.length,signedOut:!0,closedIds:ids}}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:ids.length,signedOut:!1,closedIds:ids}}}var init_AccountLink=()=>{};import{inArray as inArray9}from"drizzle-orm";async function revokeUserSessions(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))],sessions=deps.sessionsTable;if(!deps.db||!sessions||ids.length===0)return 0;let sessionUser=pickByName(sessions,"user_id");if(!sessionUser)return 0;try{return(await deps.db.delete(sessions).where(inArray9(sessionUser,ids)))?.rowCount??ids.length}catch(error){return deps.onError?.(error),0}}var init_revokeUserSessions=__esm(()=>{init_AccountLink()});var exports_value={};__export(exports_value,{IsUndefined:()=>IsUndefined,IsUint8Array:()=>IsUint8Array,IsSymbol:()=>IsSymbol,IsString:()=>IsString,IsRegExp:()=>IsRegExp,IsObject:()=>IsObject,IsNumber:()=>IsNumber,IsNull:()=>IsNull,IsIterator:()=>IsIterator,IsFunction:()=>IsFunction,IsDate:()=>IsDate,IsBoolean:()=>IsBoolean,IsBigInt:()=>IsBigInt,IsAsyncIterator:()=>IsAsyncIterator,IsArray:()=>IsArray,HasPropertyKey:()=>HasPropertyKey});function HasPropertyKey(value,key2){return key2 in value}function IsAsyncIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.asyncIterator in value}function IsArray(value){return Array.isArray(value)}function IsBigInt(value){return typeof value==="bigint"}function IsBoolean(value){return typeof value==="boolean"}function IsDate(value){return value instanceof globalThis.Date}function IsFunction(value){return typeof value==="function"}function IsIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.iterator in value}function IsNull(value){return value===null}function IsNumber(value){return typeof value==="number"}function IsObject(value){return typeof value==="object"&&value!==null}function IsRegExp(value){return value instanceof globalThis.RegExp}function IsString(value){return typeof value==="string"}function IsSymbol(value){return typeof value==="symbol"}function IsUint8Array(value){return value instanceof globalThis.Uint8Array}function IsUndefined(value){return value===void 0}function ArrayType(value){return value.map((value2)=>Visit(value2))}function DateType(value){return new Date(value.getTime())}function Uint8ArrayType(value){return new Uint8Array(value)}function RegExpType(value){return new RegExp(value.source,value.flags)}function ObjectType(value){let result={};for(let key2 of Object.getOwnPropertyNames(value))result[key2]=Visit(value[key2]);for(let key2 of Object.getOwnPropertySymbols(value))result[key2]=Visit(value[key2]);return result}function Visit(value){return IsArray(value)?ArrayType(value):IsDate(value)?DateType(value):IsUint8Array(value)?Uint8ArrayType(value):IsRegExp(value)?RegExpType(value):IsObject(value)?ObjectType(value):value}function Clone(value){return Visit(value)}var init_value=()=>{};function CloneType(schema,options){return options===void 0?Clone(schema):Clone({...options,...schema})}var init_type=__esm(()=>{init_value()});var init_clone=__esm(()=>{init_type();init_value()});function IsAsyncIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.asyncIterator in value2}function IsIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.iterator in value2}function IsStandardObject(value2){return IsObject2(value2)&&(globalThis.Object.getPrototypeOf(value2)===Object.prototype||globalThis.Object.getPrototypeOf(value2)===null)}function IsPromise(value2){return value2 instanceof globalThis.Promise}function IsDate2(value2){return value2 instanceof Date&&globalThis.Number.isFinite(value2.getTime())}function IsMap(value2){return value2 instanceof globalThis.Map}function IsSet(value2){return value2 instanceof globalThis.Set}function IsTypedArray(value2){return globalThis.ArrayBuffer.isView(value2)}function IsUint8Array2(value2){return value2 instanceof globalThis.Uint8Array}function HasPropertyKey2(value2,key2){return key2 in value2}function IsObject2(value2){return value2!==null&&typeof value2==="object"}function IsArray2(value2){return globalThis.Array.isArray(value2)&&!globalThis.ArrayBuffer.isView(value2)}function IsUndefined2(value2){return value2===void 0}function IsNull2(value2){return value2===null}function IsBoolean2(value2){return typeof value2==="boolean"}function IsNumber2(value2){return typeof value2==="number"}function IsInteger(value2){return globalThis.Number.isInteger(value2)}function IsBigInt2(value2){return typeof value2==="bigint"}function IsString2(value2){return typeof value2==="string"}function IsFunction2(value2){return typeof value2==="function"}function IsSymbol2(value2){return typeof value2==="symbol"}function IsValueType(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNull2(value2)||IsNumber2(value2)||IsString2(value2)||IsSymbol2(value2)||IsUndefined2(value2)}var init_guard=()=>{};var TypeSystemPolicy;var init_policy=__esm(()=>{init_guard();(function(TypeSystemPolicy2){TypeSystemPolicy2.InstanceMode="default",TypeSystemPolicy2.ExactOptionalPropertyTypes=!1,TypeSystemPolicy2.AllowArrayObject=!1,TypeSystemPolicy2.AllowNaN=!1,TypeSystemPolicy2.AllowNullVoid=!1;function IsExactOptionalProperty(value2,key2){return TypeSystemPolicy2.ExactOptionalPropertyTypes?key2 in value2:value2[key2]!==void 0}TypeSystemPolicy2.IsExactOptionalProperty=IsExactOptionalProperty;function IsObjectLike(value2){let isObject=IsObject2(value2);return TypeSystemPolicy2.AllowArrayObject?isObject:isObject&&!IsArray2(value2)}TypeSystemPolicy2.IsObjectLike=IsObjectLike;function IsRecordLike(value2){return IsObjectLike(value2)&&!(value2 instanceof Date)&&!(value2 instanceof Uint8Array)}TypeSystemPolicy2.IsRecordLike=IsRecordLike;function IsNumberLike(value2){return TypeSystemPolicy2.AllowNaN?IsNumber2(value2):Number.isFinite(value2)}TypeSystemPolicy2.IsNumberLike=IsNumberLike;function IsVoidLike(value2){let isUndefined=IsUndefined2(value2);return TypeSystemPolicy2.AllowNullVoid?isUndefined||value2===null:isUndefined}TypeSystemPolicy2.IsVoidLike=IsVoidLike})(TypeSystemPolicy||(TypeSystemPolicy={}))});function ImmutableArray(value2){return globalThis.Object.freeze(value2).map((value3)=>Immutable(value3))}function ImmutableDate(value2){return value2}function ImmutableUint8Array(value2){return value2}function ImmutableRegExp(value2){return value2}function ImmutableObject(value2){let result={};for(let key2 of Object.getOwnPropertyNames(value2))result[key2]=Immutable(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))result[key2]=Immutable(value2[key2]);return globalThis.Object.freeze(result)}function Immutable(value2){return IsArray(value2)?ImmutableArray(value2):IsDate(value2)?ImmutableDate(value2):IsUint8Array(value2)?ImmutableUint8Array(value2):IsRegExp(value2)?ImmutableRegExp(value2):IsObject(value2)?ImmutableObject(value2):value2}var init_immutable=()=>{};function CreateType(schema,options){let result=options!==void 0?{...options,...schema}:schema;switch(TypeSystemPolicy.InstanceMode){case"freeze":return Immutable(result);case"clone":return Clone(result);default:return result}}var init_type2=__esm(()=>{init_policy();init_immutable();init_value()});var init_create=__esm(()=>{init_type2()});var TypeBoxError;var init_error=__esm(()=>{TypeBoxError=class TypeBoxError extends Error{constructor(message){super(message)}}});var init_error2=__esm(()=>{init_error()});var TransformKind,ReadonlyKind,OptionalKind,Hint,Kind;var init_symbols=__esm(()=>{TransformKind=Symbol.for("TypeBox.Transform"),ReadonlyKind=Symbol.for("TypeBox.Readonly"),OptionalKind=Symbol.for("TypeBox.Optional"),Hint=Symbol.for("TypeBox.Hint"),Kind=Symbol.for("TypeBox.Kind")});var init_symbols2=__esm(()=>{init_symbols()});function IsReadonly(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny(value2){return IsKindOf(value2,"Any")}function IsArgument(value2){return IsKindOf(value2,"Argument")}function IsArray3(value2){return IsKindOf(value2,"Array")}function IsAsyncIterator3(value2){return IsKindOf(value2,"AsyncIterator")}function IsBigInt3(value2){return IsKindOf(value2,"BigInt")}function IsBoolean3(value2){return IsKindOf(value2,"Boolean")}function IsComputed(value2){return IsKindOf(value2,"Computed")}function IsConstructor(value2){return IsKindOf(value2,"Constructor")}function IsDate3(value2){return IsKindOf(value2,"Date")}function IsFunction3(value2){return IsKindOf(value2,"Function")}function IsInteger2(value2){return IsKindOf(value2,"Integer")}function IsIntersect(value2){return IsKindOf(value2,"Intersect")}function IsIterator3(value2){return IsKindOf(value2,"Iterator")}function IsKindOf(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralValue(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsLiteral(value2){return IsKindOf(value2,"Literal")}function IsMappedKey(value2){return IsKindOf(value2,"MappedKey")}function IsMappedResult(value2){return IsKindOf(value2,"MappedResult")}function IsNever(value2){return IsKindOf(value2,"Never")}function IsNot(value2){return IsKindOf(value2,"Not")}function IsNull3(value2){return IsKindOf(value2,"Null")}function IsNumber3(value2){return IsKindOf(value2,"Number")}function IsObject3(value2){return IsKindOf(value2,"Object")}function IsPromise2(value2){return IsKindOf(value2,"Promise")}function IsRecord(value2){return IsKindOf(value2,"Record")}function IsRef(value2){return IsKindOf(value2,"Ref")}function IsRegExp2(value2){return IsKindOf(value2,"RegExp")}function IsString3(value2){return IsKindOf(value2,"String")}function IsSymbol3(value2){return IsKindOf(value2,"Symbol")}function IsTemplateLiteral(value2){return IsKindOf(value2,"TemplateLiteral")}function IsThis(value2){return IsKindOf(value2,"This")}function IsTransform(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple(value2){return IsKindOf(value2,"Tuple")}function IsUndefined3(value2){return IsKindOf(value2,"Undefined")}function IsUnion(value2){return IsKindOf(value2,"Union")}function IsUint8Array3(value2){return IsKindOf(value2,"Uint8Array")}function IsUnknown(value2){return IsKindOf(value2,"Unknown")}function IsUnsafe(value2){return IsKindOf(value2,"Unsafe")}function IsVoid(value2){return IsKindOf(value2,"Void")}function IsKind(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])}function IsSchema(value2){return IsAny(value2)||IsArgument(value2)||IsArray3(value2)||IsBoolean3(value2)||IsBigInt3(value2)||IsAsyncIterator3(value2)||IsComputed(value2)||IsConstructor(value2)||IsDate3(value2)||IsFunction3(value2)||IsInteger2(value2)||IsIntersect(value2)||IsIterator3(value2)||IsLiteral(value2)||IsMappedKey(value2)||IsMappedResult(value2)||IsNever(value2)||IsNot(value2)||IsNull3(value2)||IsNumber3(value2)||IsObject3(value2)||IsPromise2(value2)||IsRecord(value2)||IsRef(value2)||IsRegExp2(value2)||IsString3(value2)||IsSymbol3(value2)||IsTemplateLiteral(value2)||IsThis(value2)||IsTuple(value2)||IsUndefined3(value2)||IsUnion(value2)||IsUint8Array3(value2)||IsUnknown(value2)||IsUnsafe(value2)||IsVoid(value2)||IsKind(value2)}var init_kind=__esm(()=>{init_symbols2()});var exports_type={};__export(exports_type,{TypeGuardUnknownTypeError:()=>TypeGuardUnknownTypeError,IsVoid:()=>IsVoid2,IsUnsafe:()=>IsUnsafe2,IsUnknown:()=>IsUnknown2,IsUnionLiteral:()=>IsUnionLiteral,IsUnion:()=>IsUnion2,IsUndefined:()=>IsUndefined4,IsUint8Array:()=>IsUint8Array4,IsTuple:()=>IsTuple2,IsTransform:()=>IsTransform2,IsThis:()=>IsThis2,IsTemplateLiteral:()=>IsTemplateLiteral2,IsSymbol:()=>IsSymbol4,IsString:()=>IsString4,IsSchema:()=>IsSchema2,IsRegExp:()=>IsRegExp3,IsRef:()=>IsRef2,IsRecursive:()=>IsRecursive,IsRecord:()=>IsRecord2,IsReadonly:()=>IsReadonly2,IsProperties:()=>IsProperties,IsPromise:()=>IsPromise3,IsOptional:()=>IsOptional2,IsObject:()=>IsObject4,IsNumber:()=>IsNumber4,IsNull:()=>IsNull4,IsNot:()=>IsNot2,IsNever:()=>IsNever2,IsMappedResult:()=>IsMappedResult2,IsMappedKey:()=>IsMappedKey2,IsLiteralValue:()=>IsLiteralValue2,IsLiteralString:()=>IsLiteralString,IsLiteralNumber:()=>IsLiteralNumber,IsLiteralBoolean:()=>IsLiteralBoolean,IsLiteral:()=>IsLiteral2,IsKindOf:()=>IsKindOf2,IsKind:()=>IsKind2,IsIterator:()=>IsIterator4,IsIntersect:()=>IsIntersect2,IsInteger:()=>IsInteger3,IsImport:()=>IsImport,IsFunction:()=>IsFunction4,IsDate:()=>IsDate4,IsConstructor:()=>IsConstructor2,IsComputed:()=>IsComputed2,IsBoolean:()=>IsBoolean4,IsBigInt:()=>IsBigInt4,IsAsyncIterator:()=>IsAsyncIterator4,IsArray:()=>IsArray4,IsArgument:()=>IsArgument2,IsAny:()=>IsAny2});function IsPattern(value2){try{return new RegExp(value2),!0}catch{return!1}}function IsControlCharacterFree(value2){if(!IsString(value2))return!1;for(let i=0;i<value2.length;i++){let code=value2.charCodeAt(i);if(code>=7&&code<=13||code===27||code===127)return!1}return!0}function IsAdditionalProperties(value2){return IsOptionalBoolean(value2)||IsSchema2(value2)}function IsOptionalBigInt(value2){return IsUndefined(value2)||IsBigInt(value2)}function IsOptionalNumber(value2){return IsUndefined(value2)||IsNumber(value2)}function IsOptionalBoolean(value2){return IsUndefined(value2)||IsBoolean(value2)}function IsOptionalString(value2){return IsUndefined(value2)||IsString(value2)}function IsOptionalPattern(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)&&IsPattern(value2)}function IsOptionalFormat(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)}function IsOptionalSchema(value2){return IsUndefined(value2)||IsSchema2(value2)}function IsReadonly2(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional2(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny2(value2){return IsKindOf2(value2,"Any")&&IsOptionalString(value2.$id)}function IsArgument2(value2){return IsKindOf2(value2,"Argument")&&IsNumber(value2.index)}function IsArray4(value2){return IsKindOf2(value2,"Array")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)&&IsOptionalNumber(value2.minItems)&&IsOptionalNumber(value2.maxItems)&&IsOptionalBoolean(value2.uniqueItems)&&IsOptionalSchema(value2.contains)&&IsOptionalNumber(value2.minContains)&&IsOptionalNumber(value2.maxContains)}function IsAsyncIterator4(value2){return IsKindOf2(value2,"AsyncIterator")&&value2.type==="AsyncIterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsBigInt4(value2){return IsKindOf2(value2,"BigInt")&&value2.type==="bigint"&&IsOptionalString(value2.$id)&&IsOptionalBigInt(value2.exclusiveMaximum)&&IsOptionalBigInt(value2.exclusiveMinimum)&&IsOptionalBigInt(value2.maximum)&&IsOptionalBigInt(value2.minimum)&&IsOptionalBigInt(value2.multipleOf)}function IsBoolean4(value2){return IsKindOf2(value2,"Boolean")&&value2.type==="boolean"&&IsOptionalString(value2.$id)}function IsComputed2(value2){return IsKindOf2(value2,"Computed")&&IsString(value2.target)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))}function IsConstructor2(value2){return IsKindOf2(value2,"Constructor")&&value2.type==="Constructor"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsDate4(value2){return IsKindOf2(value2,"Date")&&value2.type==="Date"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximumTimestamp)&&IsOptionalNumber(value2.exclusiveMinimumTimestamp)&&IsOptionalNumber(value2.maximumTimestamp)&&IsOptionalNumber(value2.minimumTimestamp)&&IsOptionalNumber(value2.multipleOfTimestamp)}function IsFunction4(value2){return IsKindOf2(value2,"Function")&&value2.type==="Function"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsImport(value2){return IsKindOf2(value2,"Import")&&HasPropertyKey(value2,"$defs")&&IsObject(value2.$defs)&&IsProperties(value2.$defs)&&HasPropertyKey(value2,"$ref")&&IsString(value2.$ref)&&value2.$ref in value2.$defs}function IsInteger3(value2){return IsKindOf2(value2,"Integer")&&value2.type==="integer"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsProperties(value2){return IsObject(value2)&&Object.entries(value2).every(([key2,schema])=>IsControlCharacterFree(key2)&&IsSchema2(schema))}function IsIntersect2(value2){return IsKindOf2(value2,"Intersect")&&(IsString(value2.type)&&value2.type!=="object"?!1:!0)&&IsArray(value2.allOf)&&value2.allOf.every((schema)=>IsSchema2(schema)&&!IsTransform2(schema))&&IsOptionalString(value2.type)&&(IsOptionalBoolean(value2.unevaluatedProperties)||IsOptionalSchema(value2.unevaluatedProperties))&&IsOptionalString(value2.$id)}function IsIterator4(value2){return IsKindOf2(value2,"Iterator")&&value2.type==="Iterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsKindOf2(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralString(value2){return IsLiteral2(value2)&&IsString(value2.const)}function IsLiteralNumber(value2){return IsLiteral2(value2)&&IsNumber(value2.const)}function IsLiteralBoolean(value2){return IsLiteral2(value2)&&IsBoolean(value2.const)}function IsLiteral2(value2){return IsKindOf2(value2,"Literal")&&IsOptionalString(value2.$id)&&IsLiteralValue2(value2.const)}function IsLiteralValue2(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsMappedKey2(value2){return IsKindOf2(value2,"MappedKey")&&IsArray(value2.keys)&&value2.keys.every((key2)=>IsNumber(key2)||IsString(key2))}function IsMappedResult2(value2){return IsKindOf2(value2,"MappedResult")&&IsProperties(value2.properties)}function IsNever2(value2){return IsKindOf2(value2,"Never")&&IsObject(value2.not)&&Object.getOwnPropertyNames(value2.not).length===0}function IsNot2(value2){return IsKindOf2(value2,"Not")&&IsSchema2(value2.not)}function IsNull4(value2){return IsKindOf2(value2,"Null")&&value2.type==="null"&&IsOptionalString(value2.$id)}function IsNumber4(value2){return IsKindOf2(value2,"Number")&&value2.type==="number"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsObject4(value2){return IsKindOf2(value2,"Object")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsProperties(value2.properties)&&IsAdditionalProperties(value2.additionalProperties)&&IsOptionalNumber(value2.minProperties)&&IsOptionalNumber(value2.maxProperties)}function IsPromise3(value2){return IsKindOf2(value2,"Promise")&&value2.type==="Promise"&&IsOptionalString(value2.$id)&&IsSchema2(value2.item)}function IsRecord2(value2){return IsKindOf2(value2,"Record")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsAdditionalProperties(value2.additionalProperties)&&IsObject(value2.patternProperties)&&((schema)=>{let keys=Object.getOwnPropertyNames(schema.patternProperties);return keys.length===1&&IsPattern(keys[0])&&IsObject(schema.patternProperties)&&IsSchema2(schema.patternProperties[keys[0]])})(value2)}function IsRecursive(value2){return IsObject(value2)&&Hint in value2&&value2[Hint]==="Recursive"}function IsRef2(value2){return IsKindOf2(value2,"Ref")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsRegExp3(value2){return IsKindOf2(value2,"RegExp")&&IsOptionalString(value2.$id)&&IsString(value2.source)&&IsString(value2.flags)&&IsOptionalNumber(value2.maxLength)&&IsOptionalNumber(value2.minLength)}function IsString4(value2){return IsKindOf2(value2,"String")&&value2.type==="string"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minLength)&&IsOptionalNumber(value2.maxLength)&&IsOptionalPattern(value2.pattern)&&IsOptionalFormat(value2.format)}function IsSymbol4(value2){return IsKindOf2(value2,"Symbol")&&value2.type==="symbol"&&IsOptionalString(value2.$id)}function IsTemplateLiteral2(value2){return IsKindOf2(value2,"TemplateLiteral")&&value2.type==="string"&&IsString(value2.pattern)&&value2.pattern[0]==="^"&&value2.pattern[value2.pattern.length-1]==="$"}function IsThis2(value2){return IsKindOf2(value2,"This")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsTransform2(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple2(value2){return IsKindOf2(value2,"Tuple")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsNumber(value2.minItems)&&IsNumber(value2.maxItems)&&value2.minItems===value2.maxItems&&(IsUndefined(value2.items)&&IsUndefined(value2.additionalItems)&&value2.minItems===0||IsArray(value2.items)&&value2.items.every((schema)=>IsSchema2(schema)))}function IsUndefined4(value2){return IsKindOf2(value2,"Undefined")&&value2.type==="undefined"&&IsOptionalString(value2.$id)}function IsUnionLiteral(value2){return IsUnion2(value2)&&value2.anyOf.every((schema)=>IsLiteralString(schema)||IsLiteralNumber(schema))}function IsUnion2(value2){return IsKindOf2(value2,"Union")&&IsOptionalString(value2.$id)&&IsObject(value2)&&IsArray(value2.anyOf)&&value2.anyOf.every((schema)=>IsSchema2(schema))}function IsUint8Array4(value2){return IsKindOf2(value2,"Uint8Array")&&value2.type==="Uint8Array"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minByteLength)&&IsOptionalNumber(value2.maxByteLength)}function IsUnknown2(value2){return IsKindOf2(value2,"Unknown")&&IsOptionalString(value2.$id)}function IsUnsafe2(value2){return IsKindOf2(value2,"Unsafe")}function IsVoid2(value2){return IsKindOf2(value2,"Void")&&value2.type==="void"&&IsOptionalString(value2.$id)}function IsKind2(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])&&!KnownTypes.includes(value2[Kind])}function IsSchema2(value2){return IsObject(value2)&&(IsAny2(value2)||IsArgument2(value2)||IsArray4(value2)||IsBoolean4(value2)||IsBigInt4(value2)||IsAsyncIterator4(value2)||IsComputed2(value2)||IsConstructor2(value2)||IsDate4(value2)||IsFunction4(value2)||IsInteger3(value2)||IsIntersect2(value2)||IsIterator4(value2)||IsLiteral2(value2)||IsMappedKey2(value2)||IsMappedResult2(value2)||IsNever2(value2)||IsNot2(value2)||IsNull4(value2)||IsNumber4(value2)||IsObject4(value2)||IsPromise3(value2)||IsRecord2(value2)||IsRef2(value2)||IsRegExp3(value2)||IsString4(value2)||IsSymbol4(value2)||IsTemplateLiteral2(value2)||IsThis2(value2)||IsTuple2(value2)||IsUndefined4(value2)||IsUnion2(value2)||IsUint8Array4(value2)||IsUnknown2(value2)||IsUnsafe2(value2)||IsVoid2(value2)||IsKind2(value2))}var TypeGuardUnknownTypeError,KnownTypes;var init_type3=__esm(()=>{init_symbols2();init_error2();TypeGuardUnknownTypeError=class TypeGuardUnknownTypeError extends TypeBoxError{};KnownTypes=["Argument","Any","Array","AsyncIterator","BigInt","Boolean","Computed","Constructor","Date","Enum","Function","Integer","Intersect","Iterator","Literal","MappedKey","MappedResult","Not","Null","Number","Object","Promise","Record","Ref","RegExp","String","Symbol","TemplateLiteral","This","Tuple","Undefined","Union","Uint8Array","Unknown","Void"]});var init_guard2=__esm(()=>{init_kind();init_type3()});var init_helpers2=()=>{};var PatternBoolean="(true|false)",PatternNumber="(0|[1-9][0-9]*)",PatternString="(.*)",PatternNumberExact="^(0|[1-9][0-9]*)$",PatternStringExact="^(.*)$",PatternNeverExact="^(?!.*)$";var init_patterns=()=>{};var exports_format={};__export(exports_format,{Set:()=>Set3,Has:()=>Has,Get:()=>Get,Entries:()=>Entries,Delete:()=>Delete3,Clear:()=>Clear});function Entries(){return new Map(map)}function Clear(){return map.clear()}function Delete3(format2){return map.delete(format2)}function Has(format2){return map.has(format2)}function Set3(format2,func){map.set(format2,func)}function Get(format2){return map.get(format2)}var map;var init_format=__esm(()=>{map=new Map});var exports_type2={};__export(exports_type2,{Set:()=>Set4,Has:()=>Has2,Get:()=>Get2,Entries:()=>Entries2,Delete:()=>Delete4,Clear:()=>Clear2});function Entries2(){return new Map(map2)}function Clear2(){return map2.clear()}function Delete4(kind){return map2.delete(kind)}function Has2(kind){return map2.has(kind)}function Set4(kind,func){map2.set(kind,func)}function Get2(kind){return map2.get(kind)}var map2;var init_type4=__esm(()=>{map2=new Map});var init_registry4=__esm(()=>{init_format();init_type4()});function SetIncludes(T,S){return T.includes(S)}function SetDistinct(T){return[...new Set(T)]}function SetIntersect(T,S){return T.filter((L)=>S.includes(L))}function SetIntersectManyResolve(T,Init){return T.reduce((Acc,L)=>{return SetIntersect(Acc,L)},Init)}function SetIntersectMany(T){return T.length===1?T[0]:T.length>1?SetIntersectManyResolve(T.slice(1),T[0]):[]}function SetUnionMany(T){let Acc=[];for(let L of T)Acc.push(...L);return Acc}var init_sets=()=>{};function Any2(options){return CreateType({[Kind]:"Any"},options)}var init_any=__esm(()=>{init_create();init_symbols2()});var init_any2=__esm(()=>{init_any()});function Array2(items,options){return CreateType({[Kind]:"Array",type:"array",items},options)}var init_array=__esm(()=>{init_type2();init_symbols2()});var init_array2=__esm(()=>{init_array()});function Argument(index){return CreateType({[Kind]:"Argument",index})}var init_argument=__esm(()=>{init_type2();init_symbols2()});var init_argument2=__esm(()=>{init_argument()});function AsyncIterator2(items,options){return CreateType({[Kind]:"AsyncIterator",type:"AsyncIterator",items},options)}var init_async_iterator=__esm(()=>{init_symbols2();init_type2()});var init_async_iterator2=__esm(()=>{init_async_iterator()});function Computed(target2,parameters2,options){return CreateType({[Kind]:"Computed",target:target2,parameters:parameters2},options)}var init_computed=__esm(()=>{init_create();init_symbols()});var init_computed2=__esm(()=>{init_computed()});function DiscardKey(value2,key2){let{[key2]:_,...rest}=value2;return rest}function Discard(value2,keys){return keys.reduce((acc,key2)=>DiscardKey(acc,key2),value2)}var init_discard=()=>{};function Never(options){return CreateType({[Kind]:"Never",not:{}},options)}var init_never=__esm(()=>{init_type2();init_symbols2()});var init_never2=__esm(()=>{init_never()});var init_mapped_key=()=>{};function MappedResult(properties){return CreateType({[Kind]:"MappedResult",properties})}var init_mapped_result=__esm(()=>{init_type2();init_symbols2()});function Constructor(parameters2,returns,options){return CreateType({[Kind]:"Constructor",type:"Constructor",parameters:parameters2,returns},options)}var init_constructor=__esm(()=>{init_type2();init_symbols2()});var init_constructor2=__esm(()=>{init_constructor()});function Function2(parameters2,returns,options){return CreateType({[Kind]:"Function",type:"Function",parameters:parameters2,returns},options)}var init_function=__esm(()=>{init_type2();init_symbols2()});var init_function2=__esm(()=>{init_function()});function UnionCreate(T,options){return CreateType({[Kind]:"Union",anyOf:T},options)}var init_union_create=__esm(()=>{init_type2();init_symbols2()});function IsUnionOptional(types17){return types17.some((type3)=>IsOptional(type3))}function RemoveOptionalFromRest(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType(left):left)}function RemoveOptionalFromType(T){return Discard(T,[OptionalKind])}function ResolveUnion(types17,options){return IsUnionOptional(types17)?Optional(UnionCreate(RemoveOptionalFromRest(types17),options)):UnionCreate(RemoveOptionalFromRest(types17),options)}function UnionEvaluated(T,options){return T.length===1?CreateType(T[0],options):T.length===0?Never(options):ResolveUnion(T,options)}var init_union_evaluated=__esm(()=>{init_type2();init_symbols2();init_discard();init_never2();init_optional2();init_union_create();init_kind()});var init_union_type=()=>{};function Union(types17,options){return types17.length===0?Never(options):types17.length===1?CreateType(types17[0],options):UnionCreate(types17,options)}var init_union=__esm(()=>{init_never2();init_type2();init_union_create()});var init_union2=__esm(()=>{init_union_evaluated();init_union_type();init_union()});function Unescape(pattern){return pattern.replace(/\\\$/g,"$").replace(/\\\*/g,"*").replace(/\\\^/g,"^").replace(/\\\|/g,"|").replace(/\\\(/g,"(").replace(/\\\)/g,")")}function IsNonEscaped(pattern,index,char){return pattern[index]===char&&pattern.charCodeAt(index-1)!==92}function IsOpenParen(pattern,index){return IsNonEscaped(pattern,index,"(")}function IsCloseParen(pattern,index){return IsNonEscaped(pattern,index,")")}function IsSeparator(pattern,index){return IsNonEscaped(pattern,index,"|")}function IsGroup(pattern){if(!(IsOpenParen(pattern,0)&&IsCloseParen(pattern,pattern.length-1)))return!1;let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(count2===0&&index!==pattern.length-1)return!1}return!0}function InGroup(pattern){return pattern.slice(1,pattern.length-1)}function IsPrecedenceOr(pattern){let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0)return!0}return!1}function IsPrecedenceAnd(pattern){for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index))return!0;return!1}function Or(pattern){let[count2,start]=[0,0],expressions=[];for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0){let range2=pattern.slice(start,index);if(range2.length>0)expressions.push(TemplateLiteralParse(range2));start=index+1}}let range=pattern.slice(start);if(range.length>0)expressions.push(TemplateLiteralParse(range));if(expressions.length===0)return{type:"const",const:""};if(expressions.length===1)return expressions[0];return{type:"or",expr:expressions}}function And(pattern){function Group(value2,index){if(!IsOpenParen(value2,index))throw new TemplateLiteralParserError("TemplateLiteralParser: Index must point to open parens");let count2=0;for(let scan=index;scan<value2.length;scan++){if(IsOpenParen(value2,scan))count2+=1;if(IsCloseParen(value2,scan))count2-=1;if(count2===0)return[index,scan]}throw new TemplateLiteralParserError("TemplateLiteralParser: Unclosed group parens in expression")}function Range(pattern2,index){for(let scan=index;scan<pattern2.length;scan++)if(IsOpenParen(pattern2,scan))return[index,scan];return[index,pattern2.length]}let expressions=[];for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index)){let[start,end]=Group(pattern,index),range=pattern.slice(start,end+1);expressions.push(TemplateLiteralParse(range)),index=end}else{let[start,end]=Range(pattern,index),range=pattern.slice(start,end);if(range.length>0)expressions.push(TemplateLiteralParse(range));index=end-1}return expressions.length===0?{type:"const",const:""}:expressions.length===1?expressions[0]:{type:"and",expr:expressions}}function TemplateLiteralParse(pattern){return IsGroup(pattern)?TemplateLiteralParse(InGroup(pattern)):IsPrecedenceOr(pattern)?Or(pattern):IsPrecedenceAnd(pattern)?And(pattern):{type:"const",const:Unescape(pattern)}}function TemplateLiteralParseExact(pattern){return TemplateLiteralParse(pattern.slice(1,pattern.length-1))}var TemplateLiteralParserError;var init_parse=__esm(()=>{init_error2();TemplateLiteralParserError=class TemplateLiteralParserError extends TypeBoxError{}});function IsNumberExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="0"&&expression.expr[1].type==="const"&&expression.expr[1].const==="[1-9][0-9]*"}function IsBooleanExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="true"&&expression.expr[1].type==="const"&&expression.expr[1].const==="false"}function IsStringExpression(expression){return expression.type==="const"&&expression.const===".*"}function IsTemplateLiteralExpressionFinite(expression){return IsNumberExpression(expression)||IsStringExpression(expression)?!1:IsBooleanExpression(expression)?!0:expression.type==="and"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="or"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="const"?!0:(()=>{throw new TemplateLiteralFiniteError("Unknown expression type")})()}function IsTemplateLiteralFinite(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)}var TemplateLiteralFiniteError;var init_finite=__esm(()=>{init_parse();init_error2();TemplateLiteralFiniteError=class TemplateLiteralFiniteError extends TypeBoxError{}});function*GenerateReduce(buffer){if(buffer.length===1)return yield*buffer[0];for(let left of buffer[0])for(let right of GenerateReduce(buffer.slice(1)))yield`${left}${right}`}function*GenerateAnd(expression){return yield*GenerateReduce(expression.expr.map((expr)=>[...TemplateLiteralExpressionGenerate(expr)]))}function*GenerateOr(expression){for(let expr of expression.expr)yield*TemplateLiteralExpressionGenerate(expr)}function*GenerateConst(expression){return yield expression.const}function*TemplateLiteralExpressionGenerate(expression){return expression.type==="and"?yield*GenerateAnd(expression):expression.type==="or"?yield*GenerateOr(expression):expression.type==="const"?yield*GenerateConst(expression):(()=>{throw new TemplateLiteralGenerateError("Unknown expression")})()}function TemplateLiteralGenerate(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)?[...TemplateLiteralExpressionGenerate(expression)]:[]}var TemplateLiteralGenerateError;var init_generate=__esm(()=>{init_finite();init_parse();init_error2();TemplateLiteralGenerateError=class TemplateLiteralGenerateError extends TypeBoxError{}});function Literal(value2,options){return CreateType({[Kind]:"Literal",const:value2,type:typeof value2},options)}var init_literal=__esm(()=>{init_type2();init_symbols2()});var init_literal2=__esm(()=>{init_literal()});function Boolean3(options){return CreateType({[Kind]:"Boolean",type:"boolean"},options)}var init_boolean=__esm(()=>{init_symbols2();init_create()});var init_boolean2=__esm(()=>{init_boolean()});function BigInt2(options){return CreateType({[Kind]:"BigInt",type:"bigint"},options)}var init_bigint=__esm(()=>{init_symbols2();init_create()});var init_bigint2=__esm(()=>{init_bigint()});function Number2(options){return CreateType({[Kind]:"Number",type:"number"},options)}var init_number=__esm(()=>{init_type2();init_symbols2()});var init_number2=__esm(()=>{init_number()});function String2(options){return CreateType({[Kind]:"String",type:"string"},options)}var init_string=__esm(()=>{init_type2();init_symbols2()});var init_string2=__esm(()=>{init_string()});function*FromUnion(syntax){let trim=syntax.trim().replace(/"|'/g,"");return trim==="boolean"?yield Boolean3():trim==="number"?yield Number2():trim==="bigint"?yield BigInt2():trim==="string"?yield String2():yield(()=>{let literals=trim.split("|").map((literal2)=>Literal(literal2.trim()));return literals.length===0?Never():literals.length===1?literals[0]:UnionEvaluated(literals)})()}function*FromTerminal(syntax){if(syntax[1]!=="{"){let L=Literal("$"),R=FromSyntax(syntax.slice(1));return yield*[L,...R]}for(let i=2;i<syntax.length;i++)if(syntax[i]==="}"){let L=FromUnion(syntax.slice(2,i)),R=FromSyntax(syntax.slice(i+1));return yield*[...L,...R]}yield Literal(syntax)}function*FromSyntax(syntax){for(let i=0;i<syntax.length;i++)if(syntax[i]==="$"){let L=Literal(syntax.slice(0,i)),R=FromTerminal(syntax.slice(i));return yield*[L,...R]}yield Literal(syntax)}function TemplateLiteralSyntax(syntax){return[...FromSyntax(syntax)]}var init_syntax=__esm(()=>{init_literal2();init_boolean2();init_bigint2();init_number2();init_string2();init_union2();init_never2()});function Escape(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Visit2(schema,acc){return IsTemplateLiteral(schema)?schema.pattern.slice(1,schema.pattern.length-1):IsUnion(schema)?`(${schema.anyOf.map((schema2)=>Visit2(schema2,acc)).join("|")})`:IsNumber3(schema)?`${acc}${PatternNumber}`:IsInteger2(schema)?`${acc}${PatternNumber}`:IsBigInt3(schema)?`${acc}${PatternNumber}`:IsString3(schema)?`${acc}${PatternString}`:IsLiteral(schema)?`${acc}${Escape(schema.const.toString())}`:IsBoolean3(schema)?`${acc}${PatternBoolean}`:(()=>{throw new TemplateLiteralPatternError(`Unexpected Kind '${schema[Kind]}'`)})()}function TemplateLiteralPattern(kinds){return`^${kinds.map((schema)=>Visit2(schema,"")).join("")}$`}var TemplateLiteralPatternError;var init_pattern=__esm(()=>{init_patterns();init_symbols2();init_error2();init_kind();TemplateLiteralPatternError=class TemplateLiteralPatternError extends TypeBoxError{}});function TemplateLiteralToUnion(schema){let L=TemplateLiteralGenerate(schema).map((S)=>Literal(S));return UnionEvaluated(L)}var init_union3=__esm(()=>{init_union2();init_literal2();init_generate()});function TemplateLiteral(unresolved,options){let pattern=IsString(unresolved)?TemplateLiteralPattern(TemplateLiteralSyntax(unresolved)):TemplateLiteralPattern(unresolved);return CreateType({[Kind]:"TemplateLiteral",type:"string",pattern},options)}var init_template_literal=__esm(()=>{init_type2();init_syntax();init_pattern();init_symbols2()});var init_template_literal2=__esm(()=>{init_finite();init_generate();init_syntax();init_parse();init_pattern();init_union3();init_template_literal()});function FromTemplateLiteral(templateLiteral){return TemplateLiteralGenerate(templateLiteral).map((key2)=>key2.toString())}function FromUnion2(types17){let result=[];for(let type3 of types17)result.push(...IndexPropertyKeys(type3));return result}function FromLiteral(literalValue){return[literalValue.toString()]}function IndexPropertyKeys(type3){return[...new Set(IsTemplateLiteral(type3)?FromTemplateLiteral(type3):IsUnion(type3)?FromUnion2(type3.anyOf):IsLiteral(type3)?FromLiteral(type3.const):IsNumber3(type3)?["[number]"]:IsInteger2(type3)?["[number]"]:[])]}var init_indexed_property_keys=__esm(()=>{init_template_literal2();init_kind()});function FromProperties(type3,properties,options){let result={};for(let K2 of Object.getOwnPropertyNames(properties))result[K2]=Index(type3,IndexPropertyKeys(properties[K2]),options);return result}function FromMappedResult(type3,mappedResult,options){return FromProperties(type3,mappedResult.properties,options)}function IndexFromMappedResult(type3,mappedResult,options){let properties=FromMappedResult(type3,mappedResult,options);return MappedResult(properties)}var init_indexed_from_mapped_result=__esm(()=>{init_mapped2();init_indexed_property_keys();init_indexed2()});function FromRest(types17,key2){return types17.map((type3)=>IndexFromPropertyKey(type3,key2))}function FromIntersectRest(types17){return types17.filter((type3)=>!IsNever(type3))}function FromIntersect(types17,key2){return IntersectEvaluated(FromIntersectRest(FromRest(types17,key2)))}function FromUnionRest(types17){return types17.some((L)=>IsNever(L))?[]:types17}function FromUnion3(types17,key2){return UnionEvaluated(FromUnionRest(FromRest(types17,key2)))}function FromTuple(types17,key2){return key2 in types17?types17[key2]:key2==="[number]"?UnionEvaluated(types17):Never()}function FromArray(type3,key2){return key2==="[number]"?type3:Never()}function FromProperty(properties,propertyKey){return propertyKey in properties?properties[propertyKey]:Never()}function IndexFromPropertyKey(type3,propertyKey){return IsIntersect(type3)?FromIntersect(type3.allOf,propertyKey):IsUnion(type3)?FromUnion3(type3.anyOf,propertyKey):IsTuple(type3)?FromTuple(type3.items??[],propertyKey):IsArray3(type3)?FromArray(type3.items,propertyKey):IsObject3(type3)?FromProperty(type3.properties,propertyKey):Never()}function IndexFromPropertyKeys(type3,propertyKeys){return propertyKeys.map((propertyKey)=>IndexFromPropertyKey(type3,propertyKey))}function FromSchema(type3,propertyKeys){return UnionEvaluated(IndexFromPropertyKeys(type3,propertyKeys))}function Index(type3,key2,options){if(IsRef(type3)||IsRef(key2)){if(!IsSchema(type3)||!IsSchema(key2))throw new TypeBoxError("Index types using Ref parameters require both Type and Key to be of TSchema");return Computed("Index",[type3,key2])}if(IsMappedResult(key2))return IndexFromMappedResult(type3,key2,options);if(IsMappedKey(key2))return IndexFromMappedKey(type3,key2,options);return CreateType(IsSchema(key2)?FromSchema(type3,IndexPropertyKeys(key2)):FromSchema(type3,key2),options)}var init_indexed=__esm(()=>{init_type2();init_error2();init_computed2();init_never2();init_intersect2();init_union2();init_indexed_property_keys();init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_kind()});function MappedIndexPropertyKey(type3,key2,options){return{[key2]:Index(type3,[key2],Clone(options))}}function MappedIndexPropertyKeys(type3,propertyKeys,options){return propertyKeys.reduce((result,left)=>{return{...result,...MappedIndexPropertyKey(type3,left,options)}},{})}function MappedIndexProperties(type3,mappedKey,options){return MappedIndexPropertyKeys(type3,mappedKey.keys,options)}function IndexFromMappedKey(type3,mappedKey,options){let properties=MappedIndexProperties(type3,mappedKey,options);return MappedResult(properties)}var init_indexed_from_mapped_key=__esm(()=>{init_indexed();init_mapped2();init_value()});var init_indexed2=__esm(()=>{init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_indexed_property_keys();init_indexed()});function Iterator2(items,options){return CreateType({[Kind]:"Iterator",type:"Iterator",items},options)}var init_iterator=__esm(()=>{init_type2();init_symbols2()});var init_iterator2=__esm(()=>{init_iterator()});function RequiredArray(properties){return globalThis.Object.keys(properties).filter((key2)=>!IsOptional(properties[key2]))}function _Object(properties,options){let required=RequiredArray(properties),schema=required.length>0?{[Kind]:"Object",type:"object",required,properties}:{[Kind]:"Object",type:"object",properties};return CreateType(schema,options)}var Object2;var init_object=__esm(()=>{init_type2();init_symbols2();init_kind();Object2=_Object});var init_object2=__esm(()=>{init_object()});function Promise2(item,options){return CreateType({[Kind]:"Promise",type:"Promise",item},options)}var init_promise=__esm(()=>{init_type2();init_symbols2()});var init_promise2=__esm(()=>{init_promise()});function RemoveReadonly(schema){return CreateType(Discard(schema,[ReadonlyKind]))}function AddReadonly(schema){return CreateType({...schema,[ReadonlyKind]:"Readonly"})}function ReadonlyWithFlag(schema,F){return F===!1?RemoveReadonly(schema):AddReadonly(schema)}function Readonly(schema,enable){let F=enable??!0;return IsMappedResult(schema)?ReadonlyFromMappedResult(schema,F):ReadonlyWithFlag(schema,F)}var init_readonly=__esm(()=>{init_type2();init_symbols2();init_discard();init_readonly_from_mapped_result();init_kind()});function FromProperties2(K,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Readonly(K[K2],F);return Acc}function FromMappedResult2(R,F){return FromProperties2(R.properties,F)}function ReadonlyFromMappedResult(R,F){let P=FromMappedResult2(R,F);return MappedResult(P)}var init_readonly_from_mapped_result=__esm(()=>{init_mapped2();init_readonly()});var init_readonly2=__esm(()=>{init_readonly_from_mapped_result();init_readonly()});function Tuple(types17,options){return CreateType(types17.length>0?{[Kind]:"Tuple",type:"array",items:types17,additionalItems:!1,minItems:types17.length,maxItems:types17.length}:{[Kind]:"Tuple",type:"array",minItems:types17.length,maxItems:types17.length},options)}var init_tuple=__esm(()=>{init_type2();init_symbols2()});var init_tuple2=__esm(()=>{init_tuple()});function FromMappedResult3(K,P){return K in P?FromSchemaType(K,P[K]):MappedResult(P)}function MappedKeyToKnownMappedResultProperties(K){return{[K]:Literal(K)}}function MappedKeyToUnknownMappedResultProperties(P){let Acc={};for(let L of P)Acc[L]=Literal(L);return Acc}function MappedKeyToMappedResultProperties(K,P){return SetIncludes(P,K)?MappedKeyToKnownMappedResultProperties(K):MappedKeyToUnknownMappedResultProperties(P)}function FromMappedKey(K,P){let R=MappedKeyToMappedResultProperties(K,P);return FromMappedResult3(K,R)}function FromRest2(K,T){return T.map((L)=>FromSchemaType(K,L))}function FromProperties3(K,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(T))Acc[K2]=FromSchemaType(K,T[K2]);return Acc}function FromSchemaType(K,T){let options={...T};return IsOptional(T)?Optional(FromSchemaType(K,Discard(T,[OptionalKind]))):IsReadonly(T)?Readonly(FromSchemaType(K,Discard(T,[ReadonlyKind]))):IsMappedResult(T)?FromMappedResult3(K,T.properties):IsMappedKey(T)?FromMappedKey(K,T.keys):IsConstructor(T)?Constructor(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsFunction3(T)?Function2(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsAsyncIterator3(T)?AsyncIterator2(FromSchemaType(K,T.items),options):IsIterator3(T)?Iterator2(FromSchemaType(K,T.items),options):IsIntersect(T)?Intersect(FromRest2(K,T.allOf),options):IsUnion(T)?Union(FromRest2(K,T.anyOf),options):IsTuple(T)?Tuple(FromRest2(K,T.items??[]),options):IsObject3(T)?Object2(FromProperties3(K,T.properties),options):IsArray3(T)?Array2(FromSchemaType(K,T.items),options):IsPromise2(T)?Promise2(FromSchemaType(K,T.item),options):T}function MappedFunctionReturnType(K,T){let Acc={};for(let L of K)Acc[L]=FromSchemaType(L,T);return Acc}function Mapped(key2,map3,options){let K=IsSchema(key2)?IndexPropertyKeys(key2):key2,RT=map3({[Kind]:"MappedKey",keys:K}),R=MappedFunctionReturnType(K,RT);return Object2(R,options)}var init_mapped=__esm(()=>{init_symbols2();init_discard();init_array2();init_async_iterator2();init_constructor2();init_function2();init_indexed2();init_intersect2();init_iterator2();init_literal2();init_object2();init_optional2();init_promise2();init_readonly2();init_tuple2();init_union2();init_sets();init_mapped_result();init_kind()});var init_mapped2=__esm(()=>{init_mapped_key();init_mapped_result();init_mapped()});function RemoveOptional(schema){return CreateType(Discard(schema,[OptionalKind]))}function AddOptional(schema){return CreateType({...schema,[OptionalKind]:"Optional"})}function OptionalWithFlag(schema,F){return F===!1?RemoveOptional(schema):AddOptional(schema)}function Optional(schema,enable){let F=enable??!0;return IsMappedResult(schema)?OptionalFromMappedResult(schema,F):OptionalWithFlag(schema,F)}var init_optional=__esm(()=>{init_type2();init_symbols2();init_discard();init_optional_from_mapped_result();init_kind()});function FromProperties4(P,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Optional(P[K2],F);return Acc}function FromMappedResult4(R,F){return FromProperties4(R.properties,F)}function OptionalFromMappedResult(R,F){let P=FromMappedResult4(R,F);return MappedResult(P)}var init_optional_from_mapped_result=__esm(()=>{init_mapped2();init_optional()});var init_optional2=__esm(()=>{init_optional_from_mapped_result();init_optional()});function IntersectCreate(T,options={}){let allObjects=T.every((schema)=>IsObject3(schema)),clonedUnevaluatedProperties=IsSchema(options.unevaluatedProperties)?{unevaluatedProperties:options.unevaluatedProperties}:{};return CreateType(options.unevaluatedProperties===!1||IsSchema(options.unevaluatedProperties)||allObjects?{...clonedUnevaluatedProperties,[Kind]:"Intersect",type:"object",allOf:T}:{...clonedUnevaluatedProperties,[Kind]:"Intersect",allOf:T},options)}var init_intersect_create=__esm(()=>{init_type2();init_symbols2();init_kind()});function IsIntersectOptional(types17){return types17.every((left)=>IsOptional(left))}function RemoveOptionalFromType2(type3){return Discard(type3,[OptionalKind])}function RemoveOptionalFromRest2(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType2(left):left)}function ResolveIntersect(types17,options){return IsIntersectOptional(types17)?Optional(IntersectCreate(RemoveOptionalFromRest2(types17),options)):IntersectCreate(RemoveOptionalFromRest2(types17),options)}function IntersectEvaluated(types17,options={}){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return ResolveIntersect(types17,options)}var init_intersect_evaluated=__esm(()=>{init_symbols2();init_type2();init_discard();init_never2();init_optional2();init_intersect_create();init_kind()});var init_intersect_type=()=>{};function Intersect(types17,options){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return IntersectCreate(types17,options)}var init_intersect=__esm(()=>{init_type2();init_never2();init_intersect_create();init_kind()});var init_intersect2=__esm(()=>{init_intersect_evaluated();init_intersect_type();init_intersect()});function Ref(...args){let[$ref,options]=typeof args[0]==="string"?[args[0],args[1]]:[args[0].$id,args[1]];if(typeof $ref!=="string")throw new TypeBoxError("Ref: $ref must be a string");return CreateType({[Kind]:"Ref",$ref},options)}var init_ref=__esm(()=>{init_error2();init_type2();init_symbols2()});var init_ref2=__esm(()=>{init_ref()});function FromComputed(target2,parameters2){return Computed("Awaited",[Computed(target2,parameters2)])}function FromRef($ref){return Computed("Awaited",[Ref($ref)])}function FromIntersect2(types17){return Intersect(FromRest3(types17))}function FromUnion4(types17){return Union(FromRest3(types17))}function FromPromise(type3){return Awaited(type3)}function FromRest3(types17){return types17.map((type3)=>Awaited(type3))}function Awaited(type3,options){return CreateType(IsComputed(type3)?FromComputed(type3.target,type3.parameters):IsIntersect(type3)?FromIntersect2(type3.allOf):IsUnion(type3)?FromUnion4(type3.anyOf):IsPromise2(type3)?FromPromise(type3.item):IsRef(type3)?FromRef(type3.$ref):type3,options)}var init_awaited=__esm(()=>{init_type2();init_computed2();init_intersect2();init_union2();init_ref2();init_kind()});var init_awaited2=__esm(()=>{init_awaited()});function FromRest4(types17){let result=[];for(let L of types17)result.push(KeyOfPropertyKeys(L));return result}function FromIntersect3(types17){let propertyKeysArray=FromRest4(types17);return SetUnionMany(propertyKeysArray)}function FromUnion5(types17){let propertyKeysArray=FromRest4(types17);return SetIntersectMany(propertyKeysArray)}function FromTuple2(types17){return types17.map((_,indexer)=>indexer.toString())}function FromArray2(_){return["[number]"]}function FromProperties5(T){return globalThis.Object.getOwnPropertyNames(T)}function FromPatternProperties(patternProperties){if(!includePatternProperties)return[];return globalThis.Object.getOwnPropertyNames(patternProperties).map((key2)=>{return key2[0]==="^"&&key2[key2.length-1]==="$"?key2.slice(1,key2.length-1):key2})}function KeyOfPropertyKeys(type3){return IsIntersect(type3)?FromIntersect3(type3.allOf):IsUnion(type3)?FromUnion5(type3.anyOf):IsTuple(type3)?FromTuple2(type3.items??[]):IsArray3(type3)?FromArray2(type3.items):IsObject3(type3)?FromProperties5(type3.properties):IsRecord(type3)?FromPatternProperties(type3.patternProperties):[]}function KeyOfPattern(schema){includePatternProperties=!0;let keys=KeyOfPropertyKeys(schema);return includePatternProperties=!1,`^(${keys.map((key2)=>`(${key2})`).join("|")})$`}var includePatternProperties=!1;var init_keyof_property_keys=__esm(()=>{init_sets();init_kind()});function FromComputed2(target2,parameters2){return Computed("KeyOf",[Computed(target2,parameters2)])}function FromRef2($ref){return Computed("KeyOf",[Ref($ref)])}function KeyOfFromType(type3,options){let propertyKeys=KeyOfPropertyKeys(type3),propertyKeyTypes=KeyOfPropertyKeysToRest(propertyKeys),result=UnionEvaluated(propertyKeyTypes);return CreateType(result,options)}function KeyOfPropertyKeysToRest(propertyKeys){return propertyKeys.map((L)=>L==="[number]"?Number2():Literal(L))}function KeyOf(type3,options){return IsComputed(type3)?FromComputed2(type3.target,type3.parameters):IsRef(type3)?FromRef2(type3.$ref):IsMappedResult(type3)?KeyOfFromMappedResult(type3,options):KeyOfFromType(type3,options)}var init_keyof=__esm(()=>{init_type2();init_literal2();init_number2();init_computed2();init_ref2();init_keyof_property_keys();init_union2();init_keyof_from_mapped_result();init_kind()});function FromProperties6(properties,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=KeyOf(properties[K2],Clone(options));return result}function FromMappedResult5(mappedResult,options){return FromProperties6(mappedResult.properties,options)}function KeyOfFromMappedResult(mappedResult,options){let properties=FromMappedResult5(mappedResult,options);return MappedResult(properties)}var init_keyof_from_mapped_result=__esm(()=>{init_mapped2();init_keyof();init_value()});function KeyOfPropertyEntries(schema){let keys=KeyOfPropertyKeys(schema),schemas=IndexFromPropertyKeys(schema,keys);return keys.map((_,index)=>[keys[index],schemas[index]])}var init_keyof_property_entries=__esm(()=>{init_indexed();init_keyof_property_keys()});var init_keyof2=__esm(()=>{init_keyof_from_mapped_result();init_keyof_property_entries();init_keyof_property_keys();init_keyof()});function CompositeKeys(T){let Acc=[];for(let L of T)Acc.push(...KeyOfPropertyKeys(L));return SetDistinct(Acc)}function FilterNever(T){return T.filter((L)=>!IsNever(L))}function CompositeProperty(T,K){let Acc=[];for(let L of T)Acc.push(...IndexFromPropertyKeys(L,[K]));return FilterNever(Acc)}function CompositeProperties(T,K){let Acc={};for(let L of K)Acc[L]=IntersectEvaluated(CompositeProperty(T,L));return Acc}function Composite(T,options){let K=CompositeKeys(T),P=CompositeProperties(T,K);return Object2(P,options)}var init_composite=__esm(()=>{init_intersect2();init_indexed2();init_keyof2();init_object2();init_sets();init_kind()});var init_composite2=__esm(()=>{init_composite()});function Date2(options){return CreateType({[Kind]:"Date",type:"Date"},options)}var init_date=__esm(()=>{init_symbols2();init_type2()});var init_date2=__esm(()=>{init_date()});function Null2(options){return CreateType({[Kind]:"Null",type:"null"},options)}var init_null=__esm(()=>{init_type2();init_symbols2()});var init_null2=__esm(()=>{init_null()});function Symbol2(options){return CreateType({[Kind]:"Symbol",type:"symbol"},options)}var init_symbol=__esm(()=>{init_type2();init_symbols2()});var init_symbol2=__esm(()=>{init_symbol()});function Undefined(options){return CreateType({[Kind]:"Undefined",type:"undefined"},options)}var init_undefined=__esm(()=>{init_type2();init_symbols2()});var init_undefined2=__esm(()=>{init_undefined()});function Uint8Array2(options){return CreateType({[Kind]:"Uint8Array",type:"Uint8Array"},options)}var init_uint8array=__esm(()=>{init_type2();init_symbols2()});var init_uint8array2=__esm(()=>{init_uint8array()});function Unknown(options){return CreateType({[Kind]:"Unknown"},options)}var init_unknown=__esm(()=>{init_type2();init_symbols2()});var init_unknown2=__esm(()=>{init_unknown()});function FromArray3(T){return T.map((L)=>FromValue(L,!1))}function FromProperties7(value2){let Acc={};for(let K of globalThis.Object.getOwnPropertyNames(value2))Acc[K]=Readonly(FromValue(value2[K],!1));return Acc}function ConditionalReadonly(T,root){return root===!0?T:Readonly(T)}function FromValue(value2,root){return IsAsyncIterator(value2)?ConditionalReadonly(Any2(),root):IsIterator(value2)?ConditionalReadonly(Any2(),root):IsArray(value2)?Readonly(Tuple(FromArray3(value2))):IsUint8Array(value2)?Uint8Array2():IsDate(value2)?Date2():IsObject(value2)?ConditionalReadonly(Object2(FromProperties7(value2)),root):IsFunction(value2)?ConditionalReadonly(Function2([],Unknown()),root):IsUndefined(value2)?Undefined():IsNull(value2)?Null2():IsSymbol(value2)?Symbol2():IsBigInt(value2)?BigInt2():IsNumber(value2)?Literal(value2):IsBoolean(value2)?Literal(value2):IsString(value2)?Literal(value2):Object2({})}function Const(T,options){return CreateType(FromValue(T,!0),options)}var init_const=__esm(()=>{init_any2();init_bigint2();init_date2();init_function2();init_literal2();init_null2();init_object2();init_symbol2();init_tuple2();init_readonly2();init_undefined2();init_uint8array2();init_unknown2();init_create()});var init_const2=__esm(()=>{init_const()});function ConstructorParameters(schema,options){return IsConstructor(schema)?Tuple(schema.parameters,options):Never(options)}var init_constructor_parameters=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_constructor_parameters2=__esm(()=>{init_constructor_parameters()});function Enum(item,options){if(IsUndefined(item))throw Error("Enum undefined or empty");let values1=globalThis.Object.getOwnPropertyNames(item).filter((key2)=>isNaN(key2)).map((key2)=>item[key2]),anyOf=[...new Set(values1)].map((value2)=>Literal(value2));return Union(anyOf,{...options,[Hint]:"Enum"})}var init_enum=__esm(()=>{init_literal2();init_symbols2();init_union2()});var init_enum2=__esm(()=>{init_enum()});function IntoBooleanResult(result){return result===ExtendsResult.False?result:ExtendsResult.True}function Throw(message){throw new ExtendsResolverError(message)}function IsStructuralRight(right){return exports_type.IsNever(right)||exports_type.IsIntersect(right)||exports_type.IsUnion(right)||exports_type.IsUnknown(right)||exports_type.IsAny(right)}function StructuralRight(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):Throw("StructuralRight")}function FromAnyRight(left,right){return ExtendsResult.True}function FromAny(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)&&right.anyOf.some((schema)=>exports_type.IsAny(schema)||exports_type.IsUnknown(schema))?ExtendsResult.True:exports_type.IsUnion(right)?ExtendsResult.Union:exports_type.IsUnknown(right)?ExtendsResult.True:exports_type.IsAny(right)?ExtendsResult.True:ExtendsResult.Union}function FromArrayRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)?ExtendsResult.True:ExtendsResult.False}function FromArray4(left,right){return exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsArray(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromAsyncIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsAsyncIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromBigInt(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBigInt(right)?ExtendsResult.True:ExtendsResult.False}function FromBooleanRight(left,right){return exports_type.IsLiteralBoolean(left)?ExtendsResult.True:exports_type.IsBoolean(left)?ExtendsResult.True:ExtendsResult.False}function FromBoolean(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBoolean(right)?ExtendsResult.True:ExtendsResult.False}function FromConstructor(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsConstructor(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromDate(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsDate(right)?ExtendsResult.True:ExtendsResult.False}function FromFunction(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsFunction(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromIntegerRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsNumber(left.const)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromInteger(left,right){return exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):ExtendsResult.False}function FromIntersectRight(left,right){return right.allOf.every((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIntersect4(left,right){return left.allOf.some((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromLiteral2(left,right){return exports_type.IsLiteral(right)&&right.const===left.const?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):ExtendsResult.False}function FromNeverRight(left,right){return ExtendsResult.False}function FromNever(left,right){return ExtendsResult.True}function UnwrapTNot(schema){let[current,depth]=[schema,0];while(!0){if(!exports_type.IsNot(current))break;current=current.not,depth+=1}return depth%2===0?current:Unknown()}function FromNot(left,right){return exports_type.IsNot(left)?Visit3(UnwrapTNot(left),right):exports_type.IsNot(right)?Visit3(left,UnwrapTNot(right)):Throw("Invalid fallthrough for Not")}function FromNull(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsNull(right)?ExtendsResult.True:ExtendsResult.False}function FromNumberRight(left,right){return exports_type.IsLiteralNumber(left)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromNumber(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:ExtendsResult.False}function IsObjectPropertyCount(schema,count2){return Object.getOwnPropertyNames(schema.properties).length===count2}function IsObjectStringLike(schema){return IsObjectArrayLike(schema)}function IsObjectSymbolLike(schema){return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"description"in schema.properties&&exports_type.IsUnion(schema.properties.description)&&schema.properties.description.anyOf.length===2&&(exports_type.IsString(schema.properties.description.anyOf[0])&&exports_type.IsUndefined(schema.properties.description.anyOf[1])||exports_type.IsString(schema.properties.description.anyOf[1])&&exports_type.IsUndefined(schema.properties.description.anyOf[0]))}function IsObjectNumberLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBooleanLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBigIntLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectDateLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectUint8ArrayLike(schema){return IsObjectArrayLike(schema)}function IsObjectFunctionLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectConstructorLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectArrayLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectPromiseLike(schema){let then=Function2([Any2()],Any2());return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"then"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.then,then))===ExtendsResult.True}function Property(left,right){return Visit3(left,right)===ExtendsResult.False?ExtendsResult.False:exports_type.IsOptional(left)&&!exports_type.IsOptional(right)?ExtendsResult.False:ExtendsResult.True}function FromObjectRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)||exports_type.IsLiteralString(left)&&IsObjectStringLike(right)||exports_type.IsLiteralNumber(left)&&IsObjectNumberLike(right)||exports_type.IsLiteralBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsBigInt(left)&&IsObjectBigIntLike(right)||exports_type.IsString(left)&&IsObjectStringLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsNumber(left)&&IsObjectNumberLike(right)||exports_type.IsInteger(left)&&IsObjectNumberLike(right)||exports_type.IsBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsUint8Array(left)&&IsObjectUint8ArrayLike(right)||exports_type.IsDate(left)&&IsObjectDateLike(right)||exports_type.IsConstructor(left)&&IsObjectConstructorLike(right)||exports_type.IsFunction(left)&&IsObjectFunctionLike(right)?ExtendsResult.True:exports_type.IsRecord(left)&&exports_type.IsString(RecordKey(left))?(()=>{return right[Hint]==="Record"?ExtendsResult.True:ExtendsResult.False})():exports_type.IsRecord(left)&&exports_type.IsNumber(RecordKey(left))?(()=>{return IsObjectPropertyCount(right,0)?ExtendsResult.True:ExtendsResult.False})():ExtendsResult.False}function FromObject(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):!exports_type.IsObject(right)?ExtendsResult.False:(()=>{for(let key2 of Object.getOwnPropertyNames(right.properties)){if(!(key2 in left.properties)&&!exports_type.IsOptional(right.properties[key2]))return ExtendsResult.False;if(exports_type.IsOptional(right.properties[key2]))return ExtendsResult.True;if(Property(left.properties[key2],right.properties[key2])===ExtendsResult.False)return ExtendsResult.False}return ExtendsResult.True})()}function FromPromise2(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectPromiseLike(right)?ExtendsResult.True:!exports_type.IsPromise(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.item,right.item))}function RecordKey(schema){return PatternNumberExact in schema.patternProperties?Number2():(PatternStringExact in schema.patternProperties)?String2():Throw("Unknown record key pattern")}function RecordValue(schema){return PatternNumberExact in schema.patternProperties?schema.patternProperties[PatternNumberExact]:(PatternStringExact in schema.patternProperties)?schema.patternProperties[PatternStringExact]:Throw("Unable to get record value schema")}function FromRecordRight(left,right){let[Key,Value]=[RecordKey(right),RecordValue(right)];return exports_type.IsLiteralString(left)&&exports_type.IsNumber(Key)&&IntoBooleanResult(Visit3(left,Value))===ExtendsResult.True?ExtendsResult.True:exports_type.IsUint8Array(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsString(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsArray(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsObject(left)?(()=>{for(let key2 of Object.getOwnPropertyNames(left.properties))if(Property(Value,left.properties[key2])===ExtendsResult.False)return ExtendsResult.False;return ExtendsResult.True})():ExtendsResult.False}function FromRecord(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsRecord(right)?ExtendsResult.False:Visit3(RecordValue(left),RecordValue(right))}function FromRegExp(left,right){let L=exports_type.IsRegExp(left)?String2():left,R=exports_type.IsRegExp(right)?String2():right;return Visit3(L,R)}function FromStringRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsString(left.const)?ExtendsResult.True:exports_type.IsString(left)?ExtendsResult.True:ExtendsResult.False}function FromString(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?ExtendsResult.True:ExtendsResult.False}function FromSymbol(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsSymbol(right)?ExtendsResult.True:ExtendsResult.False}function FromTemplateLiteral2(left,right){return exports_type.IsTemplateLiteral(left)?Visit3(TemplateLiteralToUnion(left),right):exports_type.IsTemplateLiteral(right)?Visit3(left,TemplateLiteralToUnion(right)):Throw("Invalid fallthrough for TemplateLiteral")}function IsArrayOfTuple(left,right){return exports_type.IsArray(right)&&left.items!==void 0&&left.items.every((schema)=>Visit3(schema,right.items)===ExtendsResult.True)}function FromTupleRight(left,right){return exports_type.IsNever(left)?ExtendsResult.True:exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:ExtendsResult.False}function FromTuple3(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:exports_type.IsArray(right)&&IsArrayOfTuple(left,right)?ExtendsResult.True:!exports_type.IsTuple(right)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)||!exports_value.IsUndefined(left.items)&&exports_value.IsUndefined(right.items)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)?ExtendsResult.True:left.items.every((schema,index)=>Visit3(schema,right.items[index])===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUint8Array(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsUint8Array(right)?ExtendsResult.True:ExtendsResult.False}function FromUndefined(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsVoid(right)?FromVoidRight(left,right):exports_type.IsUndefined(right)?ExtendsResult.True:ExtendsResult.False}function FromUnionRight(left,right){return right.anyOf.some((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnion6(left,right){return left.anyOf.every((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnknownRight(left,right){return ExtendsResult.True}function FromUnknown(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):exports_type.IsArray(right)?FromArrayRight(left,right):exports_type.IsTuple(right)?FromTupleRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsUnknown(right)?ExtendsResult.True:ExtendsResult.False}function FromVoidRight(left,right){return exports_type.IsUndefined(left)?ExtendsResult.True:exports_type.IsUndefined(left)?ExtendsResult.True:ExtendsResult.False}function FromVoid(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsVoid(right)?ExtendsResult.True:ExtendsResult.False}function Visit3(left,right){return exports_type.IsTemplateLiteral(left)||exports_type.IsTemplateLiteral(right)?FromTemplateLiteral2(left,right):exports_type.IsRegExp(left)||exports_type.IsRegExp(right)?FromRegExp(left,right):exports_type.IsNot(left)||exports_type.IsNot(right)?FromNot(left,right):exports_type.IsAny(left)?FromAny(left,right):exports_type.IsArray(left)?FromArray4(left,right):exports_type.IsBigInt(left)?FromBigInt(left,right):exports_type.IsBoolean(left)?FromBoolean(left,right):exports_type.IsAsyncIterator(left)?FromAsyncIterator(left,right):exports_type.IsConstructor(left)?FromConstructor(left,right):exports_type.IsDate(left)?FromDate(left,right):exports_type.IsFunction(left)?FromFunction(left,right):exports_type.IsInteger(left)?FromInteger(left,right):exports_type.IsIntersect(left)?FromIntersect4(left,right):exports_type.IsIterator(left)?FromIterator(left,right):exports_type.IsLiteral(left)?FromLiteral2(left,right):exports_type.IsNever(left)?FromNever(left,right):exports_type.IsNull(left)?FromNull(left,right):exports_type.IsNumber(left)?FromNumber(left,right):exports_type.IsObject(left)?FromObject(left,right):exports_type.IsRecord(left)?FromRecord(left,right):exports_type.IsString(left)?FromString(left,right):exports_type.IsSymbol(left)?FromSymbol(left,right):exports_type.IsTuple(left)?FromTuple3(left,right):exports_type.IsPromise(left)?FromPromise2(left,right):exports_type.IsUint8Array(left)?FromUint8Array(left,right):exports_type.IsUndefined(left)?FromUndefined(left,right):exports_type.IsUnion(left)?FromUnion6(left,right):exports_type.IsUnknown(left)?FromUnknown(left,right):exports_type.IsVoid(left)?FromVoid(left,right):Throw(`Unknown left type operand '${left[Kind]}'`)}function ExtendsCheck(left,right){return Visit3(left,right)}var ExtendsResolverError,ExtendsResult;var init_extends_check=__esm(()=>{init_any2();init_function2();init_number2();init_string2();init_unknown2();init_template_literal2();init_patterns();init_symbols2();init_error2();init_guard2();ExtendsResolverError=class ExtendsResolverError extends TypeBoxError{};(function(ExtendsResult2){ExtendsResult2[ExtendsResult2.Union=0]="Union",ExtendsResult2[ExtendsResult2.True=1]="True",ExtendsResult2[ExtendsResult2.False=2]="False"})(ExtendsResult||(ExtendsResult={}))});function FromProperties8(P,Right,True,False,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extends(P[K2],Right,True,False,Clone(options));return Acc}function FromMappedResult6(Left,Right,True,False,options){return FromProperties8(Left.properties,Right,True,False,options)}function ExtendsFromMappedResult(Left,Right,True,False,options){let P=FromMappedResult6(Left,Right,True,False,options);return MappedResult(P)}var init_extends_from_mapped_result=__esm(()=>{init_mapped2();init_extends();init_value()});function ExtendsResolve(left,right,trueType,falseType){let R=ExtendsCheck(left,right);return R===ExtendsResult.Union?Union([trueType,falseType]):R===ExtendsResult.True?trueType:falseType}function Extends(L,R,T,F,options){return IsMappedResult(L)?ExtendsFromMappedResult(L,R,T,F,options):IsMappedKey(L)?CreateType(ExtendsFromMappedKey(L,R,T,F,options)):CreateType(ExtendsResolve(L,R,T,F),options)}var init_extends=__esm(()=>{init_type2();init_union2();init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_kind()});function FromPropertyKey(K,U,L,R,options){return{[K]:Extends(Literal(K),U,L,R,Clone(options))}}function FromPropertyKeys(K,U,L,R,options){return K.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey(LK,U,L,R,options)}},{})}function FromMappedKey2(K,U,L,R,options){return FromPropertyKeys(K.keys,U,L,R,options)}function ExtendsFromMappedKey(T,U,L,R,options){let P=FromMappedKey2(T,U,L,R,options);return MappedResult(P)}var init_extends_from_mapped_key=__esm(()=>{init_mapped2();init_literal2();init_extends();init_value()});function Intersect2(schema){return schema.allOf.every((schema2)=>ExtendsUndefinedCheck(schema2))}function Union2(schema){return schema.anyOf.some((schema2)=>ExtendsUndefinedCheck(schema2))}function Not(schema){return!ExtendsUndefinedCheck(schema.not)}function ExtendsUndefinedCheck(schema){return schema[Kind]==="Intersect"?Intersect2(schema):schema[Kind]==="Union"?Union2(schema):schema[Kind]==="Not"?Not(schema):schema[Kind]==="Undefined"?!0:!1}var init_extends_undefined=__esm(()=>{init_symbols2()});var init_extends2=__esm(()=>{init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_extends_undefined();init_extends()});function ExcludeFromTemplateLiteral(L,R){return Exclude(TemplateLiteralToUnion(L),R)}var init_exclude_from_template_literal=__esm(()=>{init_exclude();init_template_literal2()});function ExcludeRest(L,R){let excluded=L.filter((inner)=>ExtendsCheck(inner,R)===ExtendsResult.False);return excluded.length===1?excluded[0]:Union(excluded)}function Exclude(L,R,options={}){if(IsTemplateLiteral(L))return CreateType(ExcludeFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExcludeFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExcludeRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?Never():L,options)}var init_exclude=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_exclude_from_mapped_result();init_exclude_from_template_literal();init_kind()});function FromProperties9(P,U){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Exclude(P[K2],U);return Acc}function FromMappedResult7(R,T){return FromProperties9(R.properties,T)}function ExcludeFromMappedResult(R,T){let P=FromMappedResult7(R,T);return MappedResult(P)}var init_exclude_from_mapped_result=__esm(()=>{init_mapped2();init_exclude()});var init_exclude2=__esm(()=>{init_exclude_from_mapped_result();init_exclude_from_template_literal();init_exclude()});function ExtractFromTemplateLiteral(L,R){return Extract(TemplateLiteralToUnion(L),R)}var init_extract_from_template_literal=__esm(()=>{init_extract();init_template_literal2()});function ExtractRest(L,R){let extracted=L.filter((inner)=>ExtendsCheck(inner,R)!==ExtendsResult.False);return extracted.length===1?extracted[0]:Union(extracted)}function Extract(L,R,options){if(IsTemplateLiteral(L))return CreateType(ExtractFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExtractFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExtractRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?L:Never(),options)}var init_extract=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_extract_from_mapped_result();init_extract_from_template_literal();init_kind()});function FromProperties10(P,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extract(P[K2],T);return Acc}function FromMappedResult8(R,T){return FromProperties10(R.properties,T)}function ExtractFromMappedResult(R,T){let P=FromMappedResult8(R,T);return MappedResult(P)}var init_extract_from_mapped_result=__esm(()=>{init_mapped2();init_extract()});var init_extract2=__esm(()=>{init_extract_from_mapped_result();init_extract_from_template_literal();init_extract()});function InstanceType(schema,options){return IsConstructor(schema)?CreateType(schema.returns,options):Never(options)}var init_instance_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_instance_type2=__esm(()=>{init_instance_type()});function ReadonlyOptional(schema){return Readonly(Optional(schema))}var init_readonly_optional=__esm(()=>{init_readonly2();init_optional2()});var init_readonly_optional2=__esm(()=>{init_readonly_optional()});function RecordCreateFromPattern(pattern2,T,options){return CreateType({[Kind]:"Record",type:"object",patternProperties:{[pattern2]:T}},options)}function RecordCreateFromKeys(K,T,options){let result={};for(let K2 of K)result[K2]=T;return Object2(result,{...options,[Hint]:"Record"})}function FromTemplateLiteralKey(K,T,options){return IsTemplateLiteralFinite(K)?RecordCreateFromKeys(IndexPropertyKeys(K),T,options):RecordCreateFromPattern(K.pattern,T,options)}function FromUnionKey(key2,type3,options){return RecordCreateFromKeys(IndexPropertyKeys(Union(key2)),type3,options)}function FromLiteralKey(key2,type3,options){return RecordCreateFromKeys([key2.toString()],type3,options)}function FromRegExpKey(key2,type3,options){return RecordCreateFromPattern(key2.source,type3,options)}function FromStringKey(key2,type3,options){let pattern2=IsUndefined(key2.pattern)?PatternStringExact:key2.pattern;return RecordCreateFromPattern(pattern2,type3,options)}function FromAnyKey(_,type3,options){return RecordCreateFromPattern(PatternStringExact,type3,options)}function FromNeverKey(_key,type3,options){return RecordCreateFromPattern(PatternNeverExact,type3,options)}function FromBooleanKey(_key,type3,options){return Object2({true:type3,false:type3},options)}function FromIntegerKey(_key,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function FromNumberKey(_,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function Record(key2,type3,options={}){return IsUnion(key2)?FromUnionKey(key2.anyOf,type3,options):IsTemplateLiteral(key2)?FromTemplateLiteralKey(key2,type3,options):IsLiteral(key2)?FromLiteralKey(key2.const,type3,options):IsBoolean3(key2)?FromBooleanKey(key2,type3,options):IsInteger2(key2)?FromIntegerKey(key2,type3,options):IsNumber3(key2)?FromNumberKey(key2,type3,options):IsRegExp2(key2)?FromRegExpKey(key2,type3,options):IsString3(key2)?FromStringKey(key2,type3,options):IsAny(key2)?FromAnyKey(key2,type3,options):IsNever(key2)?FromNeverKey(key2,type3,options):Never(options)}function RecordPattern(record){return globalThis.Object.getOwnPropertyNames(record.patternProperties)[0]}function RecordKey2(type3){let pattern2=RecordPattern(type3);return pattern2===PatternStringExact?String2():pattern2===PatternNumberExact?Number2():String2({pattern:pattern2})}function RecordValue2(type3){return type3.patternProperties[RecordPattern(type3)]}var init_record=__esm(()=>{init_type2();init_symbols2();init_never2();init_number2();init_object2();init_string2();init_union2();init_template_literal2();init_patterns();init_indexed2();init_kind()});var init_record2=__esm(()=>{init_record()});function FromConstructor2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromFunction2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromIntersect5(args,type3){return type3.allOf=FromTypes(args,type3.allOf),type3}function FromUnion7(args,type3){return type3.anyOf=FromTypes(args,type3.anyOf),type3}function FromTuple4(args,type3){if(IsUndefined(type3.items))return type3;return type3.items=FromTypes(args,type3.items),type3}function FromArray5(args,type3){return type3.items=FromType(args,type3.items),type3}function FromAsyncIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromPromise3(args,type3){return type3.item=FromType(args,type3.item),type3}function FromObject2(args,type3){let mappedProperties=FromProperties11(args,type3.properties);return{...type3,...Object2(mappedProperties)}}function FromRecord2(args,type3){let mappedKey=FromType(args,RecordKey2(type3)),mappedValue=FromType(args,RecordValue2(type3)),result=Record(mappedKey,mappedValue);return{...type3,...result}}function FromArgument(args,argument2){return argument2.index in args?args[argument2.index]:Unknown()}function FromProperty2(args,type3){let isReadonly=IsReadonly(type3),isOptional=IsOptional(type3),mapped2=FromType(args,type3);return isReadonly&&isOptional?ReadonlyOptional(mapped2):isReadonly&&!isOptional?Readonly(mapped2):!isReadonly&&isOptional?Optional(mapped2):mapped2}function FromProperties11(args,properties){return globalThis.Object.getOwnPropertyNames(properties).reduce((result,key2)=>{return{...result,[key2]:FromProperty2(args,properties[key2])}},{})}function FromTypes(args,types17){return types17.map((type3)=>FromType(args,type3))}function FromType(args,type3){return IsConstructor(type3)?FromConstructor2(args,type3):IsFunction3(type3)?FromFunction2(args,type3):IsIntersect(type3)?FromIntersect5(args,type3):IsUnion(type3)?FromUnion7(args,type3):IsTuple(type3)?FromTuple4(args,type3):IsArray3(type3)?FromArray5(args,type3):IsAsyncIterator3(type3)?FromAsyncIterator2(args,type3):IsIterator3(type3)?FromIterator2(args,type3):IsPromise2(type3)?FromPromise3(args,type3):IsObject3(type3)?FromObject2(args,type3):IsRecord(type3)?FromRecord2(args,type3):IsArgument(type3)?FromArgument(args,type3):type3}function Instantiate(type3,args){return FromType(args,CloneType(type3))}var init_instantiate=__esm(()=>{init_type();init_unknown2();init_readonly_optional2();init_readonly2();init_optional2();init_object2();init_record2();init_kind()});var init_instantiate2=__esm(()=>{init_instantiate()});function Integer2(options){return CreateType({[Kind]:"Integer",type:"integer"},options)}var init_integer=__esm(()=>{init_type2();init_symbols2()});var init_integer2=__esm(()=>{init_integer()});function MappedIntrinsicPropertyKey(K,M,options){return{[K]:Intrinsic(Literal(K),M,Clone(options))}}function MappedIntrinsicPropertyKeys(K,M,options){return K.reduce((Acc,L)=>{return{...Acc,...MappedIntrinsicPropertyKey(L,M,options)}},{})}function MappedIntrinsicProperties(T,M,options){return MappedIntrinsicPropertyKeys(T.keys,M,options)}function IntrinsicFromMappedKey(T,M,options){let P=MappedIntrinsicProperties(T,M,options);return MappedResult(P)}var init_intrinsic_from_mapped_key=__esm(()=>{init_mapped2();init_intrinsic();init_literal2();init_value()});function ApplyUncapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toLowerCase(),rest].join("")}function ApplyCapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toUpperCase(),rest].join("")}function ApplyUppercase(value2){return value2.toUpperCase()}function ApplyLowercase(value2){return value2.toLowerCase()}function FromTemplateLiteral3(schema,mode,options){let expression=TemplateLiteralParseExact(schema.pattern);if(!IsTemplateLiteralExpressionFinite(expression))return{...schema,pattern:FromLiteralValue(schema.pattern,mode)};let literals=[...TemplateLiteralExpressionGenerate(expression)].map((value2)=>Literal(value2)),mapped2=FromRest5(literals,mode),union3=Union(mapped2);return TemplateLiteral([union3],options)}function FromLiteralValue(value2,mode){return typeof value2==="string"?mode==="Uncapitalize"?ApplyUncapitalize(value2):mode==="Capitalize"?ApplyCapitalize(value2):mode==="Uppercase"?ApplyUppercase(value2):mode==="Lowercase"?ApplyLowercase(value2):value2:value2.toString()}function FromRest5(T,M){return T.map((L)=>Intrinsic(L,M))}function Intrinsic(schema,mode,options={}){return IsMappedKey(schema)?IntrinsicFromMappedKey(schema,mode,options):IsTemplateLiteral(schema)?FromTemplateLiteral3(schema,mode,options):IsUnion(schema)?Union(FromRest5(schema.anyOf,mode),options):IsLiteral(schema)?Literal(FromLiteralValue(schema.const,mode),options):CreateType(schema,options)}var init_intrinsic=__esm(()=>{init_type2();init_template_literal2();init_intrinsic_from_mapped_key();init_literal2();init_union2();init_kind()});function Capitalize(T,options={}){return Intrinsic(T,"Capitalize",options)}var init_capitalize=__esm(()=>{init_intrinsic()});function Lowercase(T,options={}){return Intrinsic(T,"Lowercase",options)}var init_lowercase=__esm(()=>{init_intrinsic()});function Uncapitalize(T,options={}){return Intrinsic(T,"Uncapitalize",options)}var init_uncapitalize=__esm(()=>{init_intrinsic()});function Uppercase(T,options={}){return Intrinsic(T,"Uppercase",options)}var init_uppercase=__esm(()=>{init_intrinsic()});var init_intrinsic2=__esm(()=>{init_capitalize();init_intrinsic_from_mapped_key();init_intrinsic();init_lowercase();init_uncapitalize();init_uppercase()});function FromProperties12(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Omit(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult9(mappedResult,propertyKeys,options){return FromProperties12(mappedResult.properties,propertyKeys,options)}function OmitFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult9(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_omit_from_mapped_result=__esm(()=>{init_mapped2();init_omit();init_value()});function FromIntersect6(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromUnion8(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromProperty3(properties,key2){let{[key2]:_,...R}=properties;return R}function FromProperties13(properties,propertyKeys){return propertyKeys.reduce((T,K2)=>FromProperty3(T,K2),properties)}function FromObject3(type3,propertyKeys,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties13(properties,propertyKeys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function OmitResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect6(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion8(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject3(type3,propertyKeys,type3.properties):Object2({})}function Omit(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?OmitFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?OmitFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Omit",[type3,typeKey],options):CreateType({...OmitResolve(type3,propertyKeys),...options})}var init_omit=__esm(()=>{init_type2();init_symbols();init_computed2();init_literal2();init_indexed2();init_intersect2();init_union2();init_object2();init_omit_from_mapped_key();init_omit_from_mapped_result();init_kind()});function FromPropertyKey2(type3,key2,options){return{[key2]:Omit(type3,[key2],Clone(options))}}function FromPropertyKeys2(type3,propertyKeys,options){return propertyKeys.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey2(type3,LK,options)}},{})}function FromMappedKey3(type3,mappedKey,options){return FromPropertyKeys2(type3,mappedKey.keys,options)}function OmitFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey3(type3,mappedKey,options);return MappedResult(properties)}var init_omit_from_mapped_key=__esm(()=>{init_mapped2();init_omit();init_value()});var init_omit2=__esm(()=>{init_omit_from_mapped_key();init_omit_from_mapped_result();init_omit()});function FromProperties14(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Pick(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult10(mappedResult,propertyKeys,options){return FromProperties14(mappedResult.properties,propertyKeys,options)}function PickFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult10(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_pick_from_mapped_result=__esm(()=>{init_mapped2();init_pick();init_value()});function FromIntersect7(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromUnion9(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromProperties15(properties,propertyKeys){let result={};for(let K2 of propertyKeys)if(K2 in properties)result[K2]=properties[K2];return result}function FromObject4(Type,keys,properties){let options=Discard(Type,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties15(properties,keys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys2(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function PickResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect7(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion9(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject4(type3,propertyKeys,type3.properties):Object2({})}function Pick(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys2(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?PickFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?PickFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Pick",[type3,typeKey],options):CreateType({...PickResolve(type3,propertyKeys),...options})}var init_pick=__esm(()=>{init_type2();init_computed2();init_intersect2();init_literal2();init_object2();init_union2();init_indexed2();init_symbols();init_kind();init_pick_from_mapped_key();init_pick_from_mapped_result()});function FromPropertyKey3(type3,key2,options){return{[key2]:Pick(type3,[key2],Clone(options))}}function FromPropertyKeys3(type3,propertyKeys,options){return propertyKeys.reduce((result,leftKey)=>{return{...result,...FromPropertyKey3(type3,leftKey,options)}},{})}function FromMappedKey4(type3,mappedKey,options){return FromPropertyKeys3(type3,mappedKey.keys,options)}function PickFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey4(type3,mappedKey,options);return MappedResult(properties)}var init_pick_from_mapped_key=__esm(()=>{init_mapped2();init_pick();init_value()});var init_pick2=__esm(()=>{init_pick_from_mapped_key();init_pick_from_mapped_result();init_pick()});function FromComputed3(target2,parameters2){return Computed("Partial",[Computed(target2,parameters2)])}function FromRef3($ref){return Computed("Partial",[Ref($ref)])}function FromProperties16(properties){let partialProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))partialProperties[K]=Optional(properties[K]);return partialProperties}function FromObject5(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties16(properties);return Object2(mappedProperties,options)}function FromRest6(types17){return types17.map((type3)=>PartialResolve(type3))}function PartialResolve(type3){return IsComputed(type3)?FromComputed3(type3.target,type3.parameters):IsRef(type3)?FromRef3(type3.$ref):IsIntersect(type3)?Intersect(FromRest6(type3.allOf)):IsUnion(type3)?Union(FromRest6(type3.anyOf)):IsObject3(type3)?FromObject5(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Partial(type3,options){if(IsMappedResult(type3))return PartialFromMappedResult(type3,options);else return CreateType({...PartialResolve(type3),...options})}var init_partial=__esm(()=>{init_type2();init_computed2();init_optional2();init_object2();init_intersect2();init_union2();init_ref2();init_discard();init_symbols2();init_partial_from_mapped_result();init_kind()});function FromProperties17(K,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Partial(K[K2],Clone(options));return Acc}function FromMappedResult11(R,options){return FromProperties17(R.properties,options)}function PartialFromMappedResult(R,options){let P=FromMappedResult11(R,options);return MappedResult(P)}var init_partial_from_mapped_result=__esm(()=>{init_mapped2();init_partial();init_value()});var init_partial2=__esm(()=>{init_partial_from_mapped_result();init_partial()});function FromComputed4(target2,parameters2){return Computed("Required",[Computed(target2,parameters2)])}function FromRef4($ref){return Computed("Required",[Ref($ref)])}function FromProperties18(properties){let requiredProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))requiredProperties[K]=Discard(properties[K],[OptionalKind]);return requiredProperties}function FromObject6(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties18(properties);return Object2(mappedProperties,options)}function FromRest7(types17){return types17.map((type3)=>RequiredResolve(type3))}function RequiredResolve(type3){return IsComputed(type3)?FromComputed4(type3.target,type3.parameters):IsRef(type3)?FromRef4(type3.$ref):IsIntersect(type3)?Intersect(FromRest7(type3.allOf)):IsUnion(type3)?Union(FromRest7(type3.anyOf)):IsObject3(type3)?FromObject6(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Required(type3,options){if(IsMappedResult(type3))return RequiredFromMappedResult(type3,options);else return CreateType({...RequiredResolve(type3),...options})}var init_required=__esm(()=>{init_type2();init_computed2();init_object2();init_intersect2();init_union2();init_ref2();init_symbols2();init_discard();init_required_from_mapped_result();init_kind()});function FromProperties19(P,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Required(P[K2],options);return Acc}function FromMappedResult12(R,options){return FromProperties19(R.properties,options)}function RequiredFromMappedResult(R,options){let P=FromMappedResult12(R,options);return MappedResult(P)}var init_required_from_mapped_result=__esm(()=>{init_mapped2();init_required()});var init_required2=__esm(()=>{init_required_from_mapped_result();init_required()});function DereferenceParameters(moduleProperties,types17){return types17.map((type3)=>{return IsRef(type3)?Dereference(moduleProperties,type3.$ref):FromType2(moduleProperties,type3)})}function Dereference(moduleProperties,ref2){return ref2 in moduleProperties?IsRef(moduleProperties[ref2])?Dereference(moduleProperties,moduleProperties[ref2].$ref):FromType2(moduleProperties,moduleProperties[ref2]):Never()}function FromAwaited(parameters2){return Awaited(parameters2[0])}function FromIndex(parameters2){return Index(parameters2[0],parameters2[1])}function FromKeyOf(parameters2){return KeyOf(parameters2[0])}function FromPartial(parameters2){return Partial(parameters2[0])}function FromOmit(parameters2){return Omit(parameters2[0],parameters2[1])}function FromPick(parameters2){return Pick(parameters2[0],parameters2[1])}function FromRequired(parameters2){return Required(parameters2[0])}function FromComputed5(moduleProperties,target2,parameters2){let dereferenced=DereferenceParameters(moduleProperties,parameters2);return target2==="Awaited"?FromAwaited(dereferenced):target2==="Index"?FromIndex(dereferenced):target2==="KeyOf"?FromKeyOf(dereferenced):target2==="Partial"?FromPartial(dereferenced):target2==="Omit"?FromOmit(dereferenced):target2==="Pick"?FromPick(dereferenced):target2==="Required"?FromRequired(dereferenced):Never()}function FromArray6(moduleProperties,type3){return Array2(FromType2(moduleProperties,type3))}function FromAsyncIterator3(moduleProperties,type3){return AsyncIterator2(FromType2(moduleProperties,type3))}function FromConstructor3(moduleProperties,parameters2,instanceType){return Constructor(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,instanceType))}function FromFunction3(moduleProperties,parameters2,returnType){return Function2(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,returnType))}function FromIntersect8(moduleProperties,types17){return Intersect(FromTypes2(moduleProperties,types17))}function FromIterator3(moduleProperties,type3){return Iterator2(FromType2(moduleProperties,type3))}function FromObject7(moduleProperties,properties){return Object2(globalThis.Object.keys(properties).reduce((result,key2)=>{return{...result,[key2]:FromType2(moduleProperties,properties[key2])}},{}))}function FromRecord3(moduleProperties,type3){let[value2,pattern2]=[FromType2(moduleProperties,RecordValue2(type3)),RecordPattern(type3)],result=CloneType(type3);return result.patternProperties[pattern2]=value2,result}function FromTransform(moduleProperties,transform){return IsRef(transform)?{...Dereference(moduleProperties,transform.$ref),[TransformKind]:transform[TransformKind]}:transform}function FromTuple5(moduleProperties,types17){return Tuple(FromTypes2(moduleProperties,types17))}function FromUnion10(moduleProperties,types17){return Union(FromTypes2(moduleProperties,types17))}function FromTypes2(moduleProperties,types17){return types17.map((type3)=>FromType2(moduleProperties,type3))}function FromType2(moduleProperties,type3){return IsOptional(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[OptionalKind])),type3):IsReadonly(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[ReadonlyKind])),type3):IsTransform(type3)?CreateType(FromTransform(moduleProperties,type3),type3):IsArray3(type3)?CreateType(FromArray6(moduleProperties,type3.items),type3):IsAsyncIterator3(type3)?CreateType(FromAsyncIterator3(moduleProperties,type3.items),type3):IsComputed(type3)?CreateType(FromComputed5(moduleProperties,type3.target,type3.parameters)):IsConstructor(type3)?CreateType(FromConstructor3(moduleProperties,type3.parameters,type3.returns),type3):IsFunction3(type3)?CreateType(FromFunction3(moduleProperties,type3.parameters,type3.returns),type3):IsIntersect(type3)?CreateType(FromIntersect8(moduleProperties,type3.allOf),type3):IsIterator3(type3)?CreateType(FromIterator3(moduleProperties,type3.items),type3):IsObject3(type3)?CreateType(FromObject7(moduleProperties,type3.properties),type3):IsRecord(type3)?CreateType(FromRecord3(moduleProperties,type3)):IsTuple(type3)?CreateType(FromTuple5(moduleProperties,type3.items||[]),type3):IsUnion(type3)?CreateType(FromUnion10(moduleProperties,type3.anyOf),type3):type3}function ComputeType(moduleProperties,key2){return key2 in moduleProperties?FromType2(moduleProperties,moduleProperties[key2]):Never()}function ComputeModuleProperties(moduleProperties){return globalThis.Object.getOwnPropertyNames(moduleProperties).reduce((result,key2)=>{return{...result,[key2]:ComputeType(moduleProperties,key2)}},{})}var init_compute=__esm(()=>{init_create();init_clone();init_discard();init_array2();init_awaited2();init_async_iterator2();init_constructor2();init_indexed2();init_function2();init_intersect2();init_iterator2();init_keyof2();init_object2();init_omit2();init_pick2();init_never2();init_partial2();init_record2();init_required2();init_tuple2();init_union2();init_symbols2();init_kind()});class TModule{constructor($defs){let computed2=ComputeModuleProperties($defs),identified=this.WithIdentifiers(computed2);this.$defs=identified}Import(key2,options){let $defs={...this.$defs,[key2]:CreateType(this.$defs[key2],options)};return CreateType({[Kind]:"Import",$defs,$ref:key2})}WithIdentifiers($defs){return globalThis.Object.getOwnPropertyNames($defs).reduce((result,key2)=>{return{...result,[key2]:{...$defs[key2],$id:key2}}},{})}}function Module(properties){return new TModule(properties)}var init_module=__esm(()=>{init_create();init_symbols2();init_compute()});var init_module2=__esm(()=>{init_module()});function Not2(type3,options){return CreateType({[Kind]:"Not",not:type3},options)}var init_not=__esm(()=>{init_type2();init_symbols2()});var init_not2=__esm(()=>{init_not()});function Parameters(schema,options){return IsFunction3(schema)?Tuple(schema.parameters,options):Never()}var init_parameters2=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_parameters3=__esm(()=>{init_parameters2()});function Recursive(callback,options={}){if(IsUndefined(options.$id))options.$id=`T${Ordinal++}`;let thisType=CloneType(callback({[Kind]:"This",$ref:`${options.$id}`}));return thisType.$id=options.$id,CreateType({[Hint]:"Recursive",...thisType},options)}var Ordinal=0;var init_recursive=__esm(()=>{init_type();init_type2();init_symbols2()});var init_recursive2=__esm(()=>{init_recursive()});function RegExp2(unresolved,options){let expr=IsString(unresolved)?new globalThis.RegExp(unresolved):unresolved;return CreateType({[Kind]:"RegExp",type:"RegExp",source:expr.source,flags:expr.flags},options)}var init_regexp=__esm(()=>{init_type2();init_symbols2()});var init_regexp2=__esm(()=>{init_regexp()});function RestResolve(T){return IsIntersect(T)?T.allOf:IsUnion(T)?T.anyOf:IsTuple(T)?T.items??[]:[]}function Rest(T){return RestResolve(T)}var init_rest=__esm(()=>{init_kind()});var init_rest2=__esm(()=>{init_rest()});function ReturnType(schema,options){return IsFunction3(schema)?CreateType(schema.returns,options):Never(options)}var init_return_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_return_type2=__esm(()=>{init_return_type()});var init_anyschema=()=>{};var init_schema3=()=>{};var init_schema4=__esm(()=>{init_anyschema();init_schema3()});var init_static=()=>{};var init_static2=__esm(()=>{init_static()});class TransformDecodeBuilder{constructor(schema2){this.schema=schema2}Decode(decode3){return new TransformEncodeBuilder(this.schema,decode3)}}class TransformEncodeBuilder{constructor(schema2,decode3){this.schema=schema2,this.decode=decode3}EncodeTransform(encode4,schema2){let Codec={Encode:(value2)=>schema2[TransformKind].Encode(encode4(value2)),Decode:(value2)=>this.decode(schema2[TransformKind].Decode(value2))};return{...schema2,[TransformKind]:Codec}}EncodeSchema(encode4,schema2){let Codec={Decode:this.decode,Encode:encode4};return{...schema2,[TransformKind]:Codec}}Encode(encode4){return IsTransform(this.schema)?this.EncodeTransform(encode4,this.schema):this.EncodeSchema(encode4,this.schema)}}function Transform(schema2){return new TransformDecodeBuilder(schema2)}var init_transform=__esm(()=>{init_symbols2();init_kind()});var init_transform2=__esm(()=>{init_transform()});function Unsafe(options={}){return CreateType({[Kind]:options[Kind]??"Unsafe"},options)}var init_unsafe=__esm(()=>{init_type2();init_symbols2()});var init_unsafe2=__esm(()=>{init_unsafe()});function Void(options){return CreateType({[Kind]:"Void",type:"void"},options)}var init_void=__esm(()=>{init_type2();init_symbols2()});var init_void2=__esm(()=>{init_void()});var exports_type3={};__export(exports_type3,{Void:()=>Void,Uppercase:()=>Uppercase,Unsafe:()=>Unsafe,Unknown:()=>Unknown,Union:()=>Union,Undefined:()=>Undefined,Uncapitalize:()=>Uncapitalize,Uint8Array:()=>Uint8Array2,Tuple:()=>Tuple,Transform:()=>Transform,TemplateLiteral:()=>TemplateLiteral,Symbol:()=>Symbol2,String:()=>String2,ReturnType:()=>ReturnType,Rest:()=>Rest,Required:()=>Required,RegExp:()=>RegExp2,Ref:()=>Ref,Recursive:()=>Recursive,Record:()=>Record,ReadonlyOptional:()=>ReadonlyOptional,Readonly:()=>Readonly,Promise:()=>Promise2,Pick:()=>Pick,Partial:()=>Partial,Parameters:()=>Parameters,Optional:()=>Optional,Omit:()=>Omit,Object:()=>Object2,Number:()=>Number2,Null:()=>Null2,Not:()=>Not2,Never:()=>Never,Module:()=>Module,Mapped:()=>Mapped,Lowercase:()=>Lowercase,Literal:()=>Literal,KeyOf:()=>KeyOf,Iterator:()=>Iterator2,Intersect:()=>Intersect,Integer:()=>Integer2,Instantiate:()=>Instantiate,InstanceType:()=>InstanceType,Index:()=>Index,Function:()=>Function2,Extract:()=>Extract,Extends:()=>Extends,Exclude:()=>Exclude,Enum:()=>Enum,Date:()=>Date2,ConstructorParameters:()=>ConstructorParameters,Constructor:()=>Constructor,Const:()=>Const,Composite:()=>Composite,Capitalize:()=>Capitalize,Boolean:()=>Boolean3,BigInt:()=>BigInt2,Awaited:()=>Awaited,AsyncIterator:()=>AsyncIterator2,Array:()=>Array2,Argument:()=>Argument,Any:()=>Any2});var init_type5=__esm(()=>{init_any2();init_argument2();init_array2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_intrinsic2();init_iterator2();init_keyof2();init_literal2();init_mapped2();init_module2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2()});var Type;var init_type6=__esm(()=>{init_type5();Type=exports_type3});var init_esm3=__esm(()=>{init_clone();init_create();init_error2();init_guard2();init_helpers2();init_patterns();init_registry4();init_sets();init_symbols2();init_any2();init_array2();init_argument2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_iterator2();init_intrinsic2();init_keyof2();init_literal2();init_module2();init_mapped2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_schema4();init_static2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2();init_type6()});function isEmailExempt(email,exemptDomains){if(!exemptDomains||exemptDomains.length===0)return!1;let domain=email.split("@")[1]?.toLowerCase();if(!domain)return!1;return exemptDomains.some((d)=>domain===d.toLowerCase()||domain.endsWith(`.${d.toLowerCase()}`))}function normalizeTrustedOrigins(raw,env=process.env){if(Array.isArray(raw))return raw.length>0?raw:void 0;if(typeof raw!=="string"||!raw.trim())return;let trimmed=raw.trim(),fromEnv=env[trimmed],isEnvName=/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed),list2=(fromEnv??(isEnvName?"":trimmed)).split(/[,;\s]+/).map((entry)=>entry.trim().replace(/\/+$/,"")).filter(Boolean);return list2.length>0?list2:void 0}function pickTrustedOrigin(candidate,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]];if(candidate&&isOriginTrusted(candidate.replace(/\/+$/,""),trusted))return candidate.replace(/\/+$/,"");return fallbackOrigin}function resolveAppOrigin(request,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]],candidates=[],appOrigin=request.headers.get("x-app-origin");if(appOrigin)candidates.push(appOrigin.replace(/\/+$/,""));let origin=request.headers.get("origin");if(origin)candidates.push(origin.replace(/\/+$/,""));let forwardedHost=request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();if(forwardedHost){let proto=request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()||"https";candidates.push(`${proto}://${forwardedHost}`)}for(let candidate of candidates)if(isOriginTrusted(candidate,trusted))return candidate;return fallbackOrigin}function extractConfiguredPath(configuredUrl,defaultPath){if(!configuredUrl)return defaultPath;try{return new URL(configuredUrl).pathname}catch{return configuredUrl.startsWith("/")?configuredUrl:defaultPath}}function buildEmailActionLink(params){let{request,configuredUrl,path,query,allowedOrigins}=params,origin=resolveAppOrigin(request,configuredUrl,allowedOrigins),normalizedPath=path.startsWith("/")?path:`/${path}`,queryString=new URLSearchParams(query).toString();return`${origin}${normalizedPath}${queryString?`?${queryString}`:""}`}var originHost=(value2)=>{try{return new URL(value2).host.toLowerCase()}catch{return value2.includes("://")?null:value2.toLowerCase().replace(/[/?#].*$/,"")||null}},isOriginTrusted=(candidate,trusted)=>{let candHost=originHost(candidate);if(!candHost)return!1;for(let entry of trusted){let tHost=originHost(entry);if(!tHost)continue;if(tHost.startsWith("*.")){let base=tHost.slice(2);if(candHost===base||candHost.endsWith(`.${base}`))return!0}else if(candHost===tHost)return!0}return!1};var{password:password3}=globalThis.Bun;async function verifyPassword(plainPassword,hashedPassword){try{return await password3.verify(plainPassword,hashedPassword)}catch{return!1}}function labelFromRawUserAgent(userAgent){let ua=(userAgent??"").trim(),lower=ua.toLowerCase();if(!ua||lower==="unknown"||lower==="unknown browser")return;let meaningful=(ua.match(/[A-Za-z][A-Za-z0-9._-]*\/[0-9][^\s;)]*/g)??[]).find((t)=>!/^mozilla\//i.test(t));if(meaningful)return meaningful.split("/")[0];return ua.match(/[A-Za-z][A-Za-z0-9 ._-]{2,}/)?.[0]?.trim()||void 0}function parseUserAgentForLogin(userAgent,ipAddress,deviceHint,clientHints){let ua=userAgent.toLowerCase(),headlessIndicators=["headlesschrome","headless","phantomjs","nightmare","selenium","webdriver","puppeteer","playwright"],botIndicators=["bot","crawler","spider","scraper","curl","wget","python-requests","python-urllib","java/","httpclient","go-http-client","node-fetch","axios","postman","insomnia","httpie"],isHeadless=headlessIndicators.some((indicator)=>ua.includes(indicator)),isBot=botIndicators.some((indicator)=>ua.includes(indicator)),isSuspicious=isHeadless||isBot,suspiciousPatterns=[];if(isHeadless)suspiciousPatterns.push("headless_browser");if(isBot)suspiciousPatterns.push("bot_user_agent");if(!ua||ua.length<10)suspiciousPatterns.push("missing_or_short_ua");if(ua==="mozilla/5.0")suspiciousPatterns.push("generic_ua");if(ua.includes("nucleusserveraction")||ua.includes("serveraction"))suspiciousPatterns.push("server_action");let deviceType="unknown";if(ua.includes("ipad"))deviceType="tablet";else if(ua.includes("iphone"))deviceType="mobile";else if(ua.includes("macintosh")||ua.includes("windows")&&!ua.includes("windows phone")||ua.includes("linux")&&!ua.includes("android"))deviceType="desktop";else if(ua.includes("tablet")||ua.includes("android")&&ua.includes("tablet"))deviceType="tablet";else if(ua.includes("mobile")||ua.includes("android"))deviceType="mobile";let browserName,browserVersion;if(isHeadless)browserName="Headless Browser";else if(isBot)browserName="Bot/Crawler";else if(ua.includes("edg")){browserName="Edge";let match=userAgent.match(/Edg\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("opr/")||ua.includes("opera")){browserName="Opera";let match=userAgent.match(/OPR\/(\d+\.\d+)/i)||userAgent.match(/Opera\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("samsungbrowser")){browserName="Samsung Internet";let match=userAgent.match(/SamsungBrowser\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("crios")){browserName="Chrome";let match=userAgent.match(/CriOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("fxios")){browserName="Firefox";let match=userAgent.match(/FxiOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("chrome")){browserName="Chrome";let match=userAgent.match(/Chrome\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("firefox")){browserName="Firefox";let match=userAgent.match(/Firefox\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("safari")){browserName="Safari";let match=userAgent.match(/Version\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}let osName,osVersion;if(ua.includes("windows nt 10"))osName="Windows",osVersion="10/11";else if(ua.includes("windows nt"))osName="Windows";else if(ua.includes("iphone")||ua.includes("ipad")){osName="iOS";let match=userAgent.match(/OS (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("mac os x")){osName="macOS";let match=userAgent.match(/Mac OS X (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("android")){osName="Android";let match=userAgent.match(/Android (\d+\.?\d*)/i);if(match?.[1])osVersion=match[1]}else if(ua.includes("linux"))osName="Linux";if(!browserName&&clientHints?.uaHeader){let brands=[...clientHints.uaHeader.matchAll(/"([^"]+)";v="([^"]+)"/g)].map((m)=>({brand:m[1]??"",version:m[2]??""})).filter((b)=>b.brand&&!/not.?a.?brand/i.test(b.brand)),preferred=brands.find((b)=>/google chrome|microsoft edge|opera|firefox|safari/i.test(b.brand))??brands.find((b)=>!/chromium/i.test(b.brand))??brands[0];if(preferred)browserName=preferred.brand.replace(/^Google /,"").replace(/^Microsoft /,""),browserVersion=preferred.version}if(!osName&&clientHints?.platformHeader)osName=clientHints.platformHeader.replace(/"/g,"").trim()||osName;if(deviceType==="unknown"&&clientHints?.mobileHeader==="?1")deviceType="mobile";return{deviceName:browserName&&osName?`${browserName} on ${osName}`:browserName?browserName:osName?osName:deviceType!=="unknown"?deviceType.charAt(0).toUpperCase()+deviceType.slice(1):labelFromRawUserAgent(userAgent)??"Unknown Device",deviceType,browserName,browserVersion,osName,osVersion,ipAddress,userAgent,deviceHint,locationCountry:void 0,locationCity:void 0,isHeadless,isBot,isSuspicious,suspiciousPatterns}}var init_utils7=()=>{};function deviceContextFromRequest(request){let rawFwd=request.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),isPrivate=(ip)=>!ip||ip==="127.0.0.1"||ip==="::1"||ip==="localhost"||ip.startsWith("10.")||ip.startsWith("192.168.")||ip.startsWith("172.");return{ipAddress:request.headers.get("cf-connecting-ip")?.trim()||request.headers.get("true-client-ip")?.trim()||(!isPrivate(rawFwd)?rawFwd:void 0)||request.headers.get("x-real-ip")?.trim()||rawFwd||"127.0.0.1",userAgent:request.headers.get("user-agent")||"",clientHints:{uaHeader:request.headers.get("sec-ch-ua")??void 0,platformHeader:request.headers.get("sec-ch-ua-platform")??void 0,mobileHeader:request.headers.get("sec-ch-ua-mobile")??void 0}}}function ensureDeviceInfo(info,clientHints){if(info.browserName&&info.osName&&info.deviceName)return info;let parsed=info.userAgent?parseUserAgentForLogin(info.userAgent,info.ipAddress,info.deviceHint,clientHints):void 0;return{ipAddress:info.ipAddress,userAgent:info.userAgent,deviceHint:info.deviceHint,deviceName:info.deviceName??parsed?.deviceName??"Unknown Device",deviceType:info.deviceType&&info.deviceType!=="unknown"?info.deviceType:parsed?.deviceType??info.deviceType??"unknown",browserName:info.browserName??parsed?.browserName,browserVersion:info.browserVersion??parsed?.browserVersion,osName:info.osName??parsed?.osName,osVersion:info.osVersion??parsed?.osVersion,locationCountry:info.locationCountry,locationCity:info.locationCity}}var init_deviceInfo=__esm(()=>{init_utils7()});function boundedStream(source,limit){if(limit<=0)return new ReadableStream({start(controller){controller.close()},cancel:()=>source.cancel().catch(()=>{})});let reader=source.getReader(),sent=0;return new ReadableStream({async pull(controller){while(sent<limit){let{done,value:value2}=await reader.read();if(done){controller.close();return}if(!value2||value2.byteLength===0)continue;let remaining=limit-sent;if(value2.byteLength<=remaining)sent+=value2.byteLength,controller.enqueue(value2);else controller.enqueue(value2.subarray(0,remaining)),sent=limit;if(sent>=limit){controller.close(),reader.cancel().catch(()=>{});return}return}controller.close()},cancel(reason){return reader.cancel(reason).catch(()=>{})}})}import{randomUUID as randomUUID5}from"crypto";import path from"path";function unboundedIfZero(value2){return Number.isFinite(value2)&&value2>0?value2:Number.POSITIVE_INFINITY}function mergeStorageConfig(config){if(!config)return DEFAULT_STORAGE_CONFIG;return{enabled:config.enabled??DEFAULT_STORAGE_CONFIG.enabled,basePath:config.basePath??DEFAULT_STORAGE_CONFIG.basePath,maxFileSizeBytes:unboundedIfZero(config.maxFileSizeBytes??DEFAULT_STORAGE_CONFIG.maxFileSizeBytes),allowedMimeTypes:config.allowedMimeTypes??DEFAULT_STORAGE_CONFIG.allowedMimeTypes,blockedMimeTypes:config.blockedMimeTypes??DEFAULT_STORAGE_CONFIG.blockedMimeTypes,formData:{filesField:config.formData?.filesField??DEFAULT_STORAGE_CONFIG.formData.filesField,dataField:config.formData?.dataField??DEFAULT_STORAGE_CONFIG.formData.dataField,maxFiles:unboundedIfZero(config.formData?.maxFiles??DEFAULT_STORAGE_CONFIG.formData.maxFiles)}}}function normalizeMimeType(mimeType){return(mimeType??"").split(";")[0]?.trim().toLowerCase()??""}function isMimeTypeListed(list2,mimeType){if(!list2||list2.length===0)return!1;let normalized=normalizeMimeType(mimeType);if(!normalized)return!1;return list2.some((entry)=>normalizeMimeType(entry)===normalized)}function parseFormDataBody(body,config){let result={data:{},files:[]};if(!body||typeof body!=="object")return result;let bodyObj=body,dataField=bodyObj[config.formData.dataField];if(dataField){if(typeof dataField==="string")try{result.data=JSON.parse(dataField)}catch{result.data={}}else if(typeof dataField==="object")result.data=dataField}let filesField=bodyObj[config.formData.filesField];if(filesField){if(filesField instanceof File)result.files=[filesField];else if(Array.isArray(filesField))result.files=filesField.filter((f)=>f instanceof File)}return result}function validateFile(file,config){if(file.size>config.maxFileSizeBytes)return{valid:!1,error:`File ${file.name} exceeds maximum size of ${config.maxFileSizeBytes} bytes`,rejected:!0};if(isMimeTypeListed(config.blockedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not allowed`,rejected:!0};if(config.allowedMimeTypes.length>0&&!isMimeTypeListed(config.allowedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not in allowed list`,rejected:!0};return{valid:!0}}function setStorageProvider(provider){activeStorageProvider=provider}function getStorageProvider(){return activeStorageProvider}async function uploadFile(file,config,subFolder){let id=randomUUID5(),ext=path.extname(file.name),uniqueName=`${id}${ext}`,folderPath=subFolder?path.join(config.basePath,subFolder):config.basePath,provider=activeStorageProvider;if(provider&&provider.kind!=="local"){let relative=subFolder?`${subFolder}/${uniqueName}`:uniqueName;await provider.write(relative,new Uint8Array(await file.arrayBuffer()))}else await fileManager.createFile({dir:folderPath,name:uniqueName,data:file,options:{type:file.type,createDir:!0}});return{id,name:uniqueName,originalName:file.name,path:folderPath,mimeType:file.type,size:file.size,createdAt:new Date}}async function uploadFiles(files,config,subFolder){let success=[],failed=[];for(let file of files.slice(0,config.formData.maxFiles)){let validation=validateFile(file,config);if(!validation.valid){failed.push({file:file.name,error:validation.error||"Unknown error",rejected:validation.rejected===!0});continue}try{let result=await uploadFile(file,config,subFolder);success.push(result)}catch(error3){failed.push({file:file.name,error:error3 instanceof Error?error3.message:"Upload failed"})}}return{success,failed}}function isPathWithinBase(base,target2){let resolvedBase=path.resolve(base),resolvedTarget=path.resolve(target2);return resolvedTarget===resolvedBase||resolvedTarget.startsWith(resolvedBase+path.sep)}async function deleteFile(filePath,fileName,storageBase){try{let fullPath=path.join(filePath,fileName);if(storageBase&&!isPathWithinBase(storageBase,fullPath))return!1;let provider=activeStorageProvider;if(provider&&provider.kind!=="local"&&storageBase)return await provider.delete(path.relative(storageBase,fullPath));return await fileManager.deleteFile(fullPath)}catch{return!1}}var DEFAULT_STORAGE_CONFIG,activeStorageProvider=null;var init_helpers3=__esm(()=>{init_File();DEFAULT_STORAGE_CONFIG={enabled:!1,basePath:"./uploads",maxFileSizeBytes:104857600,allowedMimeTypes:[],blockedMimeTypes:["application/x-executable","application/x-msdos-program","text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/x-httpd-php"],formData:{filesField:"files",dataField:"data",maxFiles:10}}});import{readFileSync as readFileSync4}from"fs";import*as os3 from"os";function parseCpuMax(raw){if(!raw)return null;let[quota,period]=raw.trim().split(/\s+/);if(!quota||quota==="max")return null;let q=Number(quota),p=Number(period??"100000");if(!Number.isFinite(q)||!Number.isFinite(p)||p<=0||q<=0)return null;return q/p}function parseCpuV1(quotaRaw,periodRaw){let q=Number((quotaRaw??"").trim()),p=Number((periodRaw??"").trim());if(!Number.isFinite(q)||q<=0||!Number.isFinite(p)||p<=0)return null;return q/p}function read(path2){try{return readFileSync4(path2,"utf8")}catch{return null}}function cpuBudget(sources={}){let cores=sources.cores??os3.cpus().length??1,limit=parseCpuMax(sources.cpuMax??read("/sys/fs/cgroup/cpu.max"))??parseCpuV1(sources.v1Quota??read("/sys/fs/cgroup/cpu/cpu.cfs_quota_us"),sources.v1Period??read("/sys/fs/cgroup/cpu/cpu.cfs_period_us"));if(limit===null)return Math.max(1,cores);return Math.max(1,Math.min(cores,Math.ceil(limit)))}var init_cpuBudget=()=>{};var require_is=__commonJS((exports,module3)=>{var defined=function(val){return typeof val<"u"&&val!==null},object3=function(val){return typeof val==="object"},plainObject=function(val){return Object.prototype.toString.call(val)==="[object Object]"},fn=function(val){return typeof val==="function"},bool=function(val){return typeof val==="boolean"},buffer=function(val){return val instanceof Buffer},typedArray=function(val){if(defined(val))switch(val.constructor){case Uint8Array:case Uint8ClampedArray:case Int8Array:case Uint16Array:case Int16Array:case Uint32Array:case Int32Array:case Float32Array:case Float64Array:return!0}return!1},arrayBuffer=function(val){return val instanceof ArrayBuffer},string3=function(val){return typeof val==="string"&&val.length>0},number3=function(val){return typeof val==="number"&&!Number.isNaN(val)},integer3=function(val){return Number.isInteger(val)},inRange=function(val,min,max){return val>=min&&val<=max},inArray11=function(val,list2){return list2.includes(val)},invalidParameterError=function(name2,expected,actual){return Error(`Expected ${expected} for ${name2} but received ${actual} of type ${typeof actual}`)},nativeError=function(native,context){return context.message=native.message,context};module3.exports={defined,object:object3,plainObject,fn,bool,buffer,typedArray,arrayBuffer,string:string3,number:number3,integer:integer3,inRange,inArray:inArray11,invalidParameterError,nativeError}});var require_process=__commonJS((exports,module3)=>{var isLinux=()=>process.platform==="linux",report=null,getReport=()=>{if(!report)if(isLinux()&&process.report){let orig=process.report.excludeNetwork;process.report.excludeNetwork=!0,report=process.report.getReport(),process.report.excludeNetwork=orig}else report={};return report};module3.exports={isLinux,getReport}});var require_filesystem=__commonJS((exports,module3)=>{var fs3=__require("fs"),readFileSync5=(path2)=>{let fd=fs3.openSync(path2,"r"),buffer=Buffer.alloc(2048),bytesRead=fs3.readSync(fd,buffer,0,2048,0);return fs3.close(fd,()=>{}),buffer.subarray(0,bytesRead)},readFile2=(path2)=>new Promise((resolve2,reject)=>{fs3.open(path2,"r",(err,fd)=>{if(err)reject(err);else{let buffer=Buffer.alloc(2048);fs3.read(fd,buffer,0,2048,0,(_,bytesRead)=>{resolve2(buffer.subarray(0,bytesRead)),fs3.close(fd,()=>{})})}})});module3.exports={LDD_PATH:"/usr/bin/ldd",SELF_PATH:"/proc/self/exe",readFileSync:readFileSync5,readFile:readFile2}});var require_elf=__commonJS((exports,module3)=>{var interpreterPath=(elf)=>{if(elf.length<64)return null;if(elf.readUInt32BE(0)!==2135247942)return null;if(elf.readUInt8(4)!==2)return null;if(elf.readUInt8(5)!==1)return null;let offset=elf.readUInt32LE(32),size=elf.readUInt16LE(54),count2=elf.readUInt16LE(56);for(let i=0;i<count2;i++){let headerOffset=offset+i*size;if(elf.readUInt32LE(headerOffset)===3){let fileOffset=elf.readUInt32LE(headerOffset+8),fileSize=elf.readUInt32LE(headerOffset+32);return elf.subarray(fileOffset,fileOffset+fileSize).toString().replace(/\0.*$/g,"")}}return null};module3.exports={interpreterPath}});var require_detect_libc=__commonJS((exports,module3)=>{var childProcess=__require("child_process"),{isLinux,getReport}=require_process(),{LDD_PATH,SELF_PATH,readFile:readFile2,readFileSync:readFileSync5}=require_filesystem(),{interpreterPath}=require_elf(),cachedFamilyInterpreter,cachedFamilyFilesystem,cachedVersionFilesystem,commandOut="",safeCommand=()=>{if(!commandOut)return new Promise((resolve2)=>{childProcess.exec("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",(err,out)=>{commandOut=err?" ":out,resolve2(commandOut)})});return commandOut},safeCommandSync=()=>{if(!commandOut)try{commandOut=childProcess.execSync("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",{encoding:"utf8"})}catch(_err){commandOut=" "}return commandOut},GLIBC="glibc",RE_GLIBC_VERSION=/LIBC[a-z0-9 \-).]*?(\d+\.\d+)/i,MUSL="musl",isFileMusl=(f)=>f.includes("libc.musl-")||f.includes("ld-musl-"),familyFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return GLIBC;if(Array.isArray(report.sharedObjects)){if(report.sharedObjects.some(isFileMusl))return MUSL}return null},familyFromCommand=(out)=>{let[getconf,ldd1]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return GLIBC;if(ldd1&&ldd1.includes(MUSL))return MUSL;return null},familyFromInterpreterPath=(path2)=>{if(path2){if(path2.includes("/ld-musl-"))return MUSL;else if(path2.includes("/ld-linux-"))return GLIBC}return null},getFamilyFromLddContent=(content)=>{if(content=content.toString(),content.includes("musl"))return MUSL;if(content.includes("GNU C Library"))return GLIBC;return null},familyFromFilesystem=async()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=await readFile2(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromFilesystemSync=()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=readFileSync5(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromInterpreter=async()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=await readFile2(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},familyFromInterpreterSync=()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=readFileSync5(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},family=async()=>{let family2=null;if(isLinux()){if(family2=await familyFromInterpreter(),!family2){if(family2=await familyFromFilesystem(),!family2)family2=familyFromReport();if(!family2){let out=await safeCommand();family2=familyFromCommand(out)}}}return family2},familySync=()=>{let family2=null;if(isLinux()){if(family2=familyFromInterpreterSync(),!family2){if(family2=familyFromFilesystemSync(),!family2)family2=familyFromReport();if(!family2){let out=safeCommandSync();family2=familyFromCommand(out)}}}return family2},isNonGlibcLinux=async()=>isLinux()&&await family()!==GLIBC,isNonGlibcLinuxSync=()=>isLinux()&&familySync()!==GLIBC,versionFromFilesystem=async()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=(await readFile2(LDD_PATH)).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromFilesystemSync=()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=readFileSync5(LDD_PATH).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return report.header.glibcVersionRuntime;return null},versionSuffix=(s)=>s.trim().split(/\s+/)[1],versionFromCommand=(out)=>{let[getconf,ldd1,ldd2]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return versionSuffix(getconf);if(ldd1&&ldd2&&ldd1.includes(MUSL))return versionSuffix(ldd2);return null},version=async()=>{let version2=null;if(isLinux()){if(version2=await versionFromFilesystem(),!version2)version2=versionFromReport();if(!version2){let out=await safeCommand();version2=versionFromCommand(out)}}return version2},versionSync=()=>{let version2=null;if(isLinux()){if(version2=versionFromFilesystemSync(),!version2)version2=versionFromReport();if(!version2){let out=safeCommandSync();version2=versionFromCommand(out)}}return version2};module3.exports={GLIBC,MUSL,family,familySync,isNonGlibcLinux,isNonGlibcLinuxSync,version,versionSync}});var require_debug=__commonJS((exports,module3)=>{var debug=typeof process==="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...args)=>console.error("SEMVER",...args):()=>{};module3.exports=debug});var require_constants2=__commonJS((exports,module3)=>{var MAX_SAFE_INTEGER=Number.MAX_SAFE_INTEGER||9007199254740991,RELEASE_TYPES=["major","premajor","minor","preminor","patch","prepatch","prerelease"];module3.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER,RELEASE_TYPES,SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var require_re=__commonJS((exports,module3)=>{var{MAX_SAFE_COMPONENT_LENGTH,MAX_SAFE_BUILD_LENGTH,MAX_LENGTH}=require_constants2(),debug=require_debug();exports=module3.exports={};var re=exports.re=[],safeRe=exports.safeRe=[],src=exports.src=[],safeSrc=exports.safeSrc=[],t=exports.t={},R=0,LETTERDASHNUMBER="[a-zA-Z0-9-]",safeRegexReplacements=[["\\s",1],["\\d",MAX_LENGTH],[LETTERDASHNUMBER,MAX_SAFE_BUILD_LENGTH]],makeSafeRegex=(value2)=>{for(let[token,max]of safeRegexReplacements)value2=value2.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);return value2},createToken=(name2,value2,isGlobal)=>{let safe=makeSafeRegex(value2),index=R++;debug(name2,index,value2),t[name2]=index,src[index]=value2,safeSrc[index]=safe,re[index]=new RegExp(value2,isGlobal?"g":void 0),safeRe[index]=new RegExp(safe,isGlobal?"g":void 0)};createToken("NUMERICIDENTIFIER","0|[1-9]\\d*");createToken("NUMERICIDENTIFIERLOOSE","\\d+");createToken("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);createToken("MAINVERSION",`(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);createToken("MAINVERSIONLOOSE",`(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASEIDENTIFIER",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);createToken("PRERELEASEIDENTIFIERLOOSE",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASE",`(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);createToken("PRERELEASELOOSE",`(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);createToken("BUILDIDENTIFIER",`${LETTERDASHNUMBER}+`);createToken("BUILD",`(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);createToken("FULLPLAIN",`v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);createToken("FULL",`^${src[t.FULLPLAIN]}$`);createToken("LOOSEPLAIN",`[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);createToken("LOOSE",`^${src[t.LOOSEPLAIN]}$`);createToken("GTLT","((?:<|>)?=?)");createToken("XRANGEIDENTIFIERLOOSE",`${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);createToken("XRANGEIDENTIFIER",`${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);createToken("XRANGEPLAIN",`[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGEPLAINLOOSE",`[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);createToken("XRANGELOOSE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);createToken("COERCEPLAIN",`(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);createToken("COERCE",`${src[t.COERCEPLAIN]}(?:$|[^\\d])`);createToken("COERCEFULL",src[t.COERCEPLAIN]+`(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);createToken("COERCERTL",src[t.COERCE],!0);createToken("COERCERTLFULL",src[t.COERCEFULL],!0);createToken("LONETILDE","(?:~>?)");createToken("TILDETRIM",`(\\s*)${src[t.LONETILDE]}\\s+`,!0);exports.tildeTrimReplace="$1~";createToken("TILDE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);createToken("TILDELOOSE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("LONECARET","(?:\\^)");createToken("CARETTRIM",`(\\s*)${src[t.LONECARET]}\\s+`,!0);exports.caretTrimReplace="$1^";createToken("CARET",`^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);createToken("CARETLOOSE",`^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("COMPARATORLOOSE",`^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);createToken("COMPARATOR",`^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);createToken("COMPARATORTRIM",`(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`,!0);exports.comparatorTrimReplace="$1$2$3";createToken("HYPHENRANGE",`^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);createToken("HYPHENRANGELOOSE",`^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);createToken("STAR","(<|>)?=?\\s*\\*");createToken("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");createToken("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var require_parse_options=__commonJS((exports,module3)=>{var looseOption=Object.freeze({loose:!0}),emptyOpts=Object.freeze({}),parseOptions=(options)=>{if(!options)return emptyOpts;if(typeof options!=="object")return looseOption;return options};module3.exports=parseOptions});var require_identifiers=__commonJS((exports,module3)=>{var numeric=/^[0-9]+$/,compareIdentifiers=(a,b)=>{if(typeof a==="number"&&typeof b==="number")return a===b?0:a<b?-1:1;let anum=numeric.test(a),bnum=numeric.test(b);if(anum&&bnum)a=+a,b=+b;return a===b?0:anum&&!bnum?-1:bnum&&!anum?1:a<b?-1:1},rcompareIdentifiers=(a,b)=>compareIdentifiers(b,a);module3.exports={compareIdentifiers,rcompareIdentifiers}});var require_semver=__commonJS((exports,module3)=>{var debug=require_debug(),{MAX_LENGTH,MAX_SAFE_INTEGER}=require_constants2(),{safeRe:re,t}=require_re(),parseOptions=require_parse_options(),{compareIdentifiers}=require_identifiers();class SemVer{constructor(version,options){if(options=parseOptions(options),version instanceof SemVer)if(version.loose===!!options.loose&&version.includePrerelease===!!options.includePrerelease)return version;else version=version.version;else if(typeof version!=="string")throw TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);if(version.length>MAX_LENGTH)throw TypeError(`version is longer than ${MAX_LENGTH} characters`);debug("SemVer",version,options),this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease;let m=version.trim().match(options.loose?re[t.LOOSE]:re[t.FULL]);if(!m)throw TypeError(`Invalid Version: ${version}`);if(this.raw=version,this.major=+m[1],this.minor=+m[2],this.patch=+m[3],this.major>MAX_SAFE_INTEGER||this.major<0)throw TypeError("Invalid major version");if(this.minor>MAX_SAFE_INTEGER||this.minor<0)throw TypeError("Invalid minor version");if(this.patch>MAX_SAFE_INTEGER||this.patch<0)throw TypeError("Invalid patch version");if(!m[4])this.prerelease=[];else this.prerelease=m[4].split(".").map((id)=>{if(/^[0-9]+$/.test(id)){let num3=+id;if(num3>=0&&num3<MAX_SAFE_INTEGER)return num3}return id});this.build=m[5]?m[5].split("."):[],this.format()}format(){if(this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length)this.version+=`-${this.prerelease.join(".")}`;return this.version}toString(){return this.version}compare(other){if(debug("SemVer.compare",this.version,this.options,other),!(other instanceof SemVer)){if(typeof other==="string"&&other===this.version)return 0;other=new SemVer(other,this.options)}if(other.version===this.version)return 0;return this.compareMain(other)||this.comparePre(other)}compareMain(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.major<other.major)return-1;if(this.major>other.major)return 1;if(this.minor<other.minor)return-1;if(this.minor>other.minor)return 1;if(this.patch<other.patch)return-1;if(this.patch>other.patch)return 1;return 0}comparePre(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.prerelease.length&&!other.prerelease.length)return-1;else if(!this.prerelease.length&&other.prerelease.length)return 1;else if(!this.prerelease.length&&!other.prerelease.length)return 0;let i=0;do{let a=this.prerelease[i],b=other.prerelease[i];if(debug("prerelease compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}compareBuild(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);let i=0;do{let a=this.build[i],b=other.build[i];if(debug("build compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}inc(release,identifier,identifierBase){if(release.startsWith("pre")){if(!identifier&&identifierBase===!1)throw Error("invalid increment argument: identifier is empty");if(identifier){let match=`-${identifier}`.match(this.options.loose?re[t.PRERELEASELOOSE]:re[t.PRERELEASE]);if(!match||match[1]!==identifier)throw Error(`invalid identifier: ${identifier}`)}}switch(release){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",identifier,identifierBase);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",identifier,identifierBase);break;case"prepatch":this.prerelease.length=0,this.inc("patch",identifier,identifierBase),this.inc("pre",identifier,identifierBase);break;case"prerelease":if(this.prerelease.length===0)this.inc("patch",identifier,identifierBase);this.inc("pre",identifier,identifierBase);break;case"release":if(this.prerelease.length===0)throw Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":if(this.minor!==0||this.patch!==0||this.prerelease.length===0)this.major++;this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":if(this.patch!==0||this.prerelease.length===0)this.minor++;this.patch=0,this.prerelease=[];break;case"patch":if(this.prerelease.length===0)this.patch++;this.prerelease=[];break;case"pre":{let base=Number(identifierBase)?1:0;if(this.prerelease.length===0)this.prerelease=[base];else{let i=this.prerelease.length;while(--i>=0)if(typeof this.prerelease[i]==="number")this.prerelease[i]++,i=-2;if(i===-1){if(identifier===this.prerelease.join(".")&&identifierBase===!1)throw Error("invalid increment argument: identifier already exists");this.prerelease.push(base)}}if(identifier){let prerelease=[identifier,base];if(identifierBase===!1)prerelease=[identifier];if(compareIdentifiers(this.prerelease[0],identifier)===0){if(isNaN(this.prerelease[1]))this.prerelease=prerelease}else this.prerelease=prerelease}break}default:throw Error(`invalid increment argument: ${release}`)}if(this.raw=this.format(),this.build.length)this.raw+=`+${this.build.join(".")}`;return this}}module3.exports=SemVer});var require_parse=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=(version,options,throwErrors=!1)=>{if(version instanceof SemVer)return version;try{return new SemVer(version,options)}catch(er){if(!throwErrors)return null;throw er}};module3.exports=parse3});var require_coerce=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=require_parse(),{safeRe:re,t}=require_re(),coerce2=(version,options)=>{if(version instanceof SemVer)return version;if(typeof version==="number")version=String(version);if(typeof version!=="string")return null;options=options||{};let match=null;if(!options.rtl)match=version.match(options.includePrerelease?re[t.COERCEFULL]:re[t.COERCE]);else{let coerceRtlRegex=options.includePrerelease?re[t.COERCERTLFULL]:re[t.COERCERTL],next;while((next=coerceRtlRegex.exec(version))&&(!match||match.index+match[0].length!==version.length)){if(!match||next.index+next[0].length!==match.index+match[0].length)match=next;coerceRtlRegex.lastIndex=next.index+next[1].length+next[2].length}coerceRtlRegex.lastIndex=-1}if(match===null)return null;let major=match[2],minor=match[3]||"0",patch=match[4]||"0",prerelease=options.includePrerelease&&match[5]?`-${match[5]}`:"",build=options.includePrerelease&&match[6]?`+${match[6]}`:"";return parse3(`${major}.${minor}.${patch}${prerelease}${build}`,options)};module3.exports=coerce2});var require_compare=__commonJS((exports,module3)=>{var SemVer=require_semver(),compare2=(a,b,loose)=>new SemVer(a,loose).compare(new SemVer(b,loose));module3.exports=compare2});var require_gte=__commonJS((exports,module3)=>{var compare2=require_compare(),gte=(a,b,loose)=>compare2(a,b,loose)>=0;module3.exports=gte});var require_lrucache=__commonJS((exports,module3)=>{class LRUCache{constructor(){this.max=1000,this.map=new Map}get(key2){let value2=this.map.get(key2);if(value2===void 0)return;else return this.map.delete(key2),this.map.set(key2,value2),value2}delete(key2){return this.map.delete(key2)}set(key2,value2){if(!this.delete(key2)&&value2!==void 0){if(this.map.size>=this.max){let firstKey=this.map.keys().next().value;this.delete(firstKey)}this.map.set(key2,value2)}return this}}module3.exports=LRUCache});var require_eq=__commonJS((exports,module3)=>{var compare2=require_compare(),eq31=(a,b,loose)=>compare2(a,b,loose)===0;module3.exports=eq31});var require_neq=__commonJS((exports,module3)=>{var compare2=require_compare(),neq=(a,b,loose)=>compare2(a,b,loose)!==0;module3.exports=neq});var require_gt=__commonJS((exports,module3)=>{var compare2=require_compare(),gt=(a,b,loose)=>compare2(a,b,loose)>0;module3.exports=gt});var require_lt=__commonJS((exports,module3)=>{var compare2=require_compare(),lt2=(a,b,loose)=>compare2(a,b,loose)<0;module3.exports=lt2});var require_lte=__commonJS((exports,module3)=>{var compare2=require_compare(),lte=(a,b,loose)=>compare2(a,b,loose)<=0;module3.exports=lte});var require_cmp=__commonJS((exports,module3)=>{var eq31=require_eq(),neq=require_neq(),gt=require_gt(),gte=require_gte(),lt2=require_lt(),lte=require_lte(),cmp=(a,op,b,loose)=>{switch(op){case"===":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a===b;case"!==":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a!==b;case"":case"=":case"==":return eq31(a,b,loose);case"!=":return neq(a,b,loose);case">":return gt(a,b,loose);case">=":return gte(a,b,loose);case"<":return lt2(a,b,loose);case"<=":return lte(a,b,loose);default:throw TypeError(`Invalid operator: ${op}`)}};module3.exports=cmp});var require_comparator=__commonJS((exports,module3)=>{var ANY=Symbol("SemVer ANY");class Comparator{static get ANY(){return ANY}constructor(comp,options){if(options=parseOptions(options),comp instanceof Comparator)if(comp.loose===!!options.loose)return comp;else comp=comp.value;if(comp=comp.trim().split(/\s+/).join(" "),debug("comparator",comp,options),this.options=options,this.loose=!!options.loose,this.parse(comp),this.semver===ANY)this.value="";else this.value=this.operator+this.semver.version;debug("comp",this)}parse(comp){let r=this.options.loose?re[t.COMPARATORLOOSE]:re[t.COMPARATOR],m=comp.match(r);if(!m)throw TypeError(`Invalid comparator: ${comp}`);if(this.operator=m[1]!==void 0?m[1]:"",this.operator==="=")this.operator="";if(!m[2])this.semver=ANY;else this.semver=new SemVer(m[2],this.options.loose)}toString(){return this.value}test(version){if(debug("Comparator.test",version,this.options.loose),this.semver===ANY||version===ANY)return!0;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}return cmp(version,this.operator,this.semver,this.options)}intersects(comp,options){if(!(comp instanceof Comparator))throw TypeError("a Comparator is required");if(this.operator===""){if(this.value==="")return!0;return new Range(comp.value,options).test(this.value)}else if(comp.operator===""){if(comp.value==="")return!0;return new Range(this.value,options).test(comp.semver)}if(options=parseOptions(options),options.includePrerelease&&(this.value==="<0.0.0-0"||comp.value==="<0.0.0-0"))return!1;if(!options.includePrerelease&&(this.value.startsWith("<0.0.0")||comp.value.startsWith("<0.0.0")))return!1;if(this.operator.startsWith(">")&&comp.operator.startsWith(">"))return!0;if(this.operator.startsWith("<")&&comp.operator.startsWith("<"))return!0;if(this.semver.version===comp.semver.version&&this.operator.includes("=")&&comp.operator.includes("="))return!0;if(cmp(this.semver,"<",comp.semver,options)&&this.operator.startsWith(">")&&comp.operator.startsWith("<"))return!0;if(cmp(this.semver,">",comp.semver,options)&&this.operator.startsWith("<")&&comp.operator.startsWith(">"))return!0;return!1}}module3.exports=Comparator;var parseOptions=require_parse_options(),{safeRe:re,t}=require_re(),cmp=require_cmp(),debug=require_debug(),SemVer=require_semver(),Range=require_range()});var require_range=__commonJS((exports,module3)=>{var SPACE_CHARACTERS=/\s+/g;class Range{constructor(range,options){if(options=parseOptions(options),range instanceof Range)if(range.loose===!!options.loose&&range.includePrerelease===!!options.includePrerelease)return range;else return new Range(range.raw,options);if(range instanceof Comparator)return this.raw=range.value,this.set=[[range]],this.formatted=void 0,this;if(this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease,this.raw=range.trim().replace(SPACE_CHARACTERS," "),this.set=this.raw.split("||").map((r)=>this.parseRange(r.trim())).filter((c)=>c.length),!this.set.length)throw TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let first=this.set[0];if(this.set=this.set.filter((c)=>!isNullSet(c[0])),this.set.length===0)this.set=[first];else if(this.set.length>1){for(let c of this.set)if(c.length===1&&isAny(c[0])){this.set=[c];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let i=0;i<this.set.length;i++){if(i>0)this.formatted+="||";let comps=this.set[i];for(let k=0;k<comps.length;k++){if(k>0)this.formatted+=" ";this.formatted+=comps[k].toString().trim()}}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(range){let memoKey=((this.options.includePrerelease&&FLAG_INCLUDE_PRERELEASE)|(this.options.loose&&FLAG_LOOSE))+":"+range,cached=cache.get(memoKey);if(cached)return cached;let loose=this.options.loose,hr=loose?re[t.HYPHENRANGELOOSE]:re[t.HYPHENRANGE];range=range.replace(hr,hyphenReplace(this.options.includePrerelease)),debug("hyphen replace",range),range=range.replace(re[t.COMPARATORTRIM],comparatorTrimReplace),debug("comparator trim",range),range=range.replace(re[t.TILDETRIM],tildeTrimReplace),debug("tilde trim",range),range=range.replace(re[t.CARETTRIM],caretTrimReplace),debug("caret trim",range);let rangeList=range.split(" ").map((comp)=>parseComparator(comp,this.options)).join(" ").split(/\s+/).map((comp)=>replaceGTE0(comp,this.options));if(loose)rangeList=rangeList.filter((comp)=>{return debug("loose invalid filter",comp,this.options),!!comp.match(re[t.COMPARATORLOOSE])});debug("range list",rangeList);let rangeMap=new Map,comparators=rangeList.map((comp)=>new Comparator(comp,this.options));for(let comp of comparators){if(isNullSet(comp))return[comp];rangeMap.set(comp.value,comp)}if(rangeMap.size>1&&rangeMap.has(""))rangeMap.delete("");let result=[...rangeMap.values()];return cache.set(memoKey,result),result}intersects(range,options){if(!(range instanceof Range))throw TypeError("a Range is required");return this.set.some((thisComparators)=>{return isSatisfiable(thisComparators,options)&&range.set.some((rangeComparators)=>{return isSatisfiable(rangeComparators,options)&&thisComparators.every((thisComparator)=>{return rangeComparators.every((rangeComparator)=>{return thisComparator.intersects(rangeComparator,options)})})})})}test(version){if(!version)return!1;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}for(let i=0;i<this.set.length;i++)if(testSet(this.set[i],version,this.options))return!0;return!1}}module3.exports=Range;var LRU=require_lrucache(),cache=new LRU,parseOptions=require_parse_options(),Comparator=require_comparator(),debug=require_debug(),SemVer=require_semver(),{safeRe:re,t,comparatorTrimReplace,tildeTrimReplace,caretTrimReplace}=require_re(),{FLAG_INCLUDE_PRERELEASE,FLAG_LOOSE}=require_constants2(),isNullSet=(c)=>c.value==="<0.0.0-0",isAny=(c)=>c.value==="",isSatisfiable=(comparators,options)=>{let result=!0,remainingComparators=comparators.slice(),testComparator=remainingComparators.pop();while(result&&remainingComparators.length)result=remainingComparators.every((otherComparator)=>{return testComparator.intersects(otherComparator,options)}),testComparator=remainingComparators.pop();return result},parseComparator=(comp,options)=>{return comp=comp.replace(re[t.BUILD],""),debug("comp",comp,options),comp=replaceCarets(comp,options),debug("caret",comp),comp=replaceTildes(comp,options),debug("tildes",comp),comp=replaceXRanges(comp,options),debug("xrange",comp),comp=replaceStars(comp,options),debug("stars",comp),comp},isX=(id)=>!id||id.toLowerCase()==="x"||id==="*",replaceTildes=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceTilde(c,options)).join(" ")},replaceTilde=(comp,options)=>{let r=options.loose?re[t.TILDELOOSE]:re[t.TILDE];return comp.replace(r,(_,M,m,p,pr)=>{debug("tilde",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0 <${+M+1}.0.0-0`;else if(isX(p))ret=`>=${M}.${m}.0 <${M}.${+m+1}.0-0`;else if(pr)debug("replaceTilde pr",pr),ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${M}.${+m+1}.0-0`;return debug("tilde return",ret),ret})},replaceCarets=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceCaret(c,options)).join(" ")},replaceCaret=(comp,options)=>{debug("caret",comp,options);let r=options.loose?re[t.CARETLOOSE]:re[t.CARET],z=options.includePrerelease?"-0":"";return comp.replace(r,(_,M,m,p,pr)=>{debug("caret",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0${z} <${+M+1}.0.0-0`;else if(isX(p))if(M==="0")ret=`>=${M}.${m}.0${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.0${z} <${+M+1}.0.0-0`;else if(pr)if(debug("replaceCaret pr",pr),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p}-${pr} <${+M+1}.0.0-0`;else if(debug("no pr"),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}${z} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${+M+1}.0.0-0`;return debug("caret return",ret),ret})},replaceXRanges=(comp,options)=>{return debug("replaceXRanges",comp,options),comp.split(/\s+/).map((c)=>replaceXRange(c,options)).join(" ")},replaceXRange=(comp,options)=>{comp=comp.trim();let r=options.loose?re[t.XRANGELOOSE]:re[t.XRANGE];return comp.replace(r,(ret,gtlt,M,m,p,pr)=>{debug("xRange",comp,ret,gtlt,M,m,p,pr);let xM=isX(M),xm=xM||isX(m),xp=xm||isX(p),anyX=xp;if(gtlt==="="&&anyX)gtlt="";if(pr=options.includePrerelease?"-0":"",xM)if(gtlt===">"||gtlt==="<")ret="<0.0.0-0";else ret="*";else if(gtlt&&anyX){if(xm)m=0;if(p=0,gtlt===">")if(gtlt=">=",xm)M=+M+1,m=0,p=0;else m=+m+1,p=0;else if(gtlt==="<=")if(gtlt="<",xm)M=+M+1;else m=+m+1;if(gtlt==="<")pr="-0";ret=`${gtlt+M}.${m}.${p}${pr}`}else if(xm)ret=`>=${M}.0.0${pr} <${+M+1}.0.0-0`;else if(xp)ret=`>=${M}.${m}.0${pr} <${M}.${+m+1}.0-0`;return debug("xRange return",ret),ret})},replaceStars=(comp,options)=>{return debug("replaceStars",comp,options),comp.trim().replace(re[t.STAR],"")},replaceGTE0=(comp,options)=>{return debug("replaceGTE0",comp,options),comp.trim().replace(re[options.includePrerelease?t.GTE0PRE:t.GTE0],"")},hyphenReplace=(incPr)=>($0,from,fM,fm,fp,fpr,fb,to,tM,tm,tp,tpr)=>{if(isX(fM))from="";else if(isX(fm))from=`>=${fM}.0.0${incPr?"-0":""}`;else if(isX(fp))from=`>=${fM}.${fm}.0${incPr?"-0":""}`;else if(fpr)from=`>=${from}`;else from=`>=${from}${incPr?"-0":""}`;if(isX(tM))to="";else if(isX(tm))to=`<${+tM+1}.0.0-0`;else if(isX(tp))to=`<${tM}.${+tm+1}.0-0`;else if(tpr)to=`<=${tM}.${tm}.${tp}-${tpr}`;else if(incPr)to=`<${tM}.${tm}.${+tp+1}-0`;else to=`<=${to}`;return`${from} ${to}`.trim()},testSet=(set2,version,options)=>{for(let i=0;i<set2.length;i++)if(!set2[i].test(version))return!1;if(version.prerelease.length&&!options.includePrerelease){for(let i=0;i<set2.length;i++){if(debug(set2[i].semver),set2[i].semver===Comparator.ANY)continue;if(set2[i].semver.prerelease.length>0){let allowed=set2[i].semver;if(allowed.major===version.major&&allowed.minor===version.minor&&allowed.patch===version.patch)return!0}}return!1}return!0}});var require_satisfies=__commonJS((exports,module3)=>{var Range=require_range(),satisfies=(version,range,options)=>{try{range=new Range(range,options)}catch(er){return!1}return range.test(version)};module3.exports=satisfies});var require_package=__commonJS((exports,module3)=>{module3.exports={name:"sharp",description:"High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",version:"0.33.5",author:"Lovell Fuller <npm@lovell.info>",homepage:"https://sharp.pixelplumbing.com",contributors:["Pierre Inglebert <pierre.inglebert@gmail.com>","Jonathan Ong <jonathanrichardong@gmail.com>","Chanon Sajjamanochai <chanon.s@gmail.com>","Juliano Julio <julianojulio@gmail.com>","Daniel Gasienica <daniel@gasienica.ch>","Julian Walker <julian@fiftythree.com>","Amit Pitaru <pitaru.amit@gmail.com>","Brandon Aaron <hello.brandon@aaron.sh>","Andreas Lind <andreas@one.com>","Maurus Cuelenaere <mcuelenaere@gmail.com>","Linus Unneb\xE4ck <linus@folkdatorn.se>","Victor Mateevitsi <mvictoras@gmail.com>","Alaric Holloway <alaric.holloway@gmail.com>","Bernhard K. Weisshuhn <bkw@codingforce.com>","Chris Riley <criley@primedia.com>","David Carley <dacarley@gmail.com>","John Tobin <john@limelightmobileinc.com>","Kenton Gray <kentongray@gmail.com>","Felix B\xFCnemann <Felix.Buenemann@gmail.com>","Samy Al Zahrani <samyalzahrany@gmail.com>","Chintan Thakkar <lemnisk8@gmail.com>","F. Orlando Galashan <frulo@gmx.de>","Kleis Auke Wolthuizen <info@kleisauke.nl>","Matt Hirsch <mhirsch@media.mit.edu>","Matthias Thoemmes <thoemmes@gmail.com>","Patrick Paskaris <patrick@paskaris.gr>","J\xE9r\xE9my Lal <kapouer@melix.org>","Rahul Nanwani <r.nanwani@gmail.com>","Alice Monday <alice0meta@gmail.com>","Kristo Jorgenson <kristo.jorgenson@gmail.com>","YvesBos <yves_bos@outlook.com>","Guy Maliar <guy@tailorbrands.com>","Nicolas Coden <nicolas@ncoden.fr>","Matt Parrish <matt.r.parrish@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Matthew McEachen <matthew+github@mceachen.org>","Jarda Kot\u011B\u0161ovec <jarda.kotesovec@gmail.com>","Kenric D'Souza <kenric.dsouza@gmail.com>","Oleh Aleinyk <oleg.aleynik@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Andrea Bianco <andrea.bianco@unibas.ch>","Rik Heywood <rik@rik.org>","Thomas Parisot <hi@oncletom.io>","Nathan Graves <nathanrgraves+github@gmail.com>","Tom Lokhorst <tom@lokhorst.eu>","Espen Hovlandsdal <espen@hovlandsdal.com>","Sylvain Dumont <sylvain.dumont35@gmail.com>","Alun Davies <alun.owain.davies@googlemail.com>","Aidan Hoolachan <ajhoolachan21@gmail.com>","Axel Eirola <axel.eirola@iki.fi>","Freezy <freezy@xbmc.org>","Daiz <taneli.vatanen@gmail.com>","Julian Aubourg <j@ubourg.net>","Keith Belovay <keith@picthrive.com>","Michael B. Klein <mbklein@gmail.com>","Jordan Prudhomme <jordan@raboland.fr>","Ilya Ovdin <iovdin@gmail.com>","Andargor <andargor@yahoo.com>","Paul Neave <paul.neave@gmail.com>","Brendan Kennedy <brenwken@gmail.com>","Brychan Bennett-Odlum <git@brychan.io>","Edward Silverton <e.silverton@gmail.com>","Roman Malieiev <aromaleev@gmail.com>","Tomas Szabo <tomas.szabo@deftomat.com>","Robert O'Rourke <robert@o-rourke.org>","Guillermo Alfonso Varela Chouci\xF1o <guillevch@gmail.com>","Christian Flintrup <chr@gigahost.dk>","Manan Jadhav <manan@motionden.com>","Leon Radley <leon@radley.se>","alza54 <alza54@thiocod.in>","Jacob Smith <jacob@frende.me>","Michael Nutt <michael@nutt.im>","Brad Parham <baparham@gmail.com>","Taneli Vatanen <taneli.vatanen@gmail.com>","Joris Dugu\xE9 <zaruike10@gmail.com>","Chris Banks <christopher.bradley.banks@gmail.com>","Ompal Singh <ompal.hitm09@gmail.com>","Brodan <christopher.hranj@gmail.com>","Ankur Parihar <ankur.github@gmail.com>","Brahim Ait elhaj <brahima@gmail.com>","Mart Jansink <m.jansink@gmail.com>","Lachlan Newman <lachnewman007@gmail.com>","Dennis Beatty <dennis@dcbeatty.com>","Ingvar Stepanyan <me@rreverser.com>","Don Denton <don@happycollision.com>"],scripts:{install:"node install/check",clean:"rm -rf src/build/ .nyc_output/ coverage/ test/fixtures/output.*",test:"npm run test-lint && npm run test-unit && npm run test-licensing && npm run test-types","test-lint":"semistandard && cpplint","test-unit":"nyc --reporter=lcov --reporter=text --check-coverage --branches=100 mocha","test-licensing":'license-checker --production --summary --onlyAllow="Apache-2.0;BSD;ISC;LGPL-3.0-or-later;MIT"',"test-leak":"./test/leak/leak.sh","test-types":"tsd","package-from-local-build":"node npm/from-local-build","package-from-github-release":"node npm/from-github-release","docs-build":"node docs/build && node docs/search-index/build","docs-serve":"cd docs && npx serve","docs-publish":"cd docs && npx firebase-tools deploy --project pixelplumbing --only hosting:pixelplumbing-sharp"},type:"commonjs",main:"lib/index.js",types:"lib/index.d.ts",files:["install","lib","src/*.{cc,h,gyp}"],repository:{type:"git",url:"git://github.com/lovell/sharp.git"},keywords:["jpeg","png","webp","avif","tiff","gif","svg","jp2","dzi","image","resize","thumbnail","crop","embed","libvips","vips"],dependencies:{color:"^4.2.3","detect-libc":"^2.0.3",semver:"^7.6.3"},optionalDependencies:{"@img/sharp-darwin-arm64":"0.33.5","@img/sharp-darwin-x64":"0.33.5","@img/sharp-libvips-darwin-arm64":"1.0.4","@img/sharp-libvips-darwin-x64":"1.0.4","@img/sharp-libvips-linux-arm":"1.0.5","@img/sharp-libvips-linux-arm64":"1.0.4","@img/sharp-libvips-linux-s390x":"1.0.4","@img/sharp-libvips-linux-x64":"1.0.4","@img/sharp-libvips-linuxmusl-arm64":"1.0.4","@img/sharp-libvips-linuxmusl-x64":"1.0.4","@img/sharp-linux-arm":"0.33.5","@img/sharp-linux-arm64":"0.33.5","@img/sharp-linux-s390x":"0.33.5","@img/sharp-linux-x64":"0.33.5","@img/sharp-linuxmusl-arm64":"0.33.5","@img/sharp-linuxmusl-x64":"0.33.5","@img/sharp-wasm32":"0.33.5","@img/sharp-win32-ia32":"0.33.5","@img/sharp-win32-x64":"0.33.5"},devDependencies:{"@emnapi/runtime":"^1.2.0","@img/sharp-libvips-dev":"1.0.4","@img/sharp-libvips-dev-wasm32":"1.0.5","@img/sharp-libvips-win32-ia32":"1.0.4","@img/sharp-libvips-win32-x64":"1.0.4","@types/node":"*",async:"^3.2.5",cc:"^3.0.1",emnapi:"^1.2.0","exif-reader":"^2.0.1","extract-zip":"^2.0.1",icc:"^3.0.0","jsdoc-to-markdown":"^8.0.3","license-checker":"^25.0.1",mocha:"^10.7.3","node-addon-api":"^8.1.0",nyc:"^17.0.0",prebuild:"^13.0.1",semistandard:"^17.0.0","tar-fs":"^3.0.6",tsd:"^0.31.1"},license:"Apache-2.0",engines:{node:"^18.17.0 || ^20.3.0 || >=21.0.0"},config:{libvips:">=8.15.3"},funding:{url:"https://opencollective.com/libvips"},binary:{napi_versions:[9]},semistandard:{env:["mocha"]},cc:{linelength:"120",filter:["build/include"]},nyc:{include:["lib"]},tsd:{directory:"test/types/"}}});var require_libvips=__commonJS((exports,module3)=>{var{spawnSync}=__require("child_process"),{createHash:createHash3}=__require("crypto"),semverCoerce=require_coerce(),semverGreaterThanOrEqualTo=require_gte(),semverSatisfies=require_satisfies(),detectLibc=require_detect_libc(),{config,engines,optionalDependencies}=require_package(),minimumLibvipsVersionLabelled=process.env.npm_package_config_libvips||config.libvips,minimumLibvipsVersion=semverCoerce(minimumLibvipsVersionLabelled).version,prebuiltPlatforms=["darwin-arm64","darwin-x64","linux-arm","linux-arm64","linux-s390x","linux-x64","linuxmusl-arm64","linuxmusl-x64","win32-ia32","win32-x64"],spawnSyncOptions={encoding:"utf8",shell:!0},log3=(item)=>{if(item instanceof Error)console.error(`sharp: Installation error: ${item.message}`);else console.log(`sharp: ${item}`)},runtimeLibc=()=>detectLibc.isNonGlibcLinuxSync()?detectLibc.familySync():"",runtimePlatformArch=()=>`${process.platform}${runtimeLibc()}-${process.arch}`,buildPlatformArch=()=>{if(isEmscripten())return"wasm32";let{npm_config_arch,npm_config_platform,npm_config_libc}=process.env,libc=typeof npm_config_libc==="string"?npm_config_libc:runtimeLibc();return`${npm_config_platform||process.platform}${libc}-${npm_config_arch||process.arch}`},buildSharpLibvipsIncludeDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/include`)}catch{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/include");})()}catch{}}return""},buildSharpLibvipsCPlusPlusDir=()=>{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/cplusplus");})()}catch{}return""},buildSharpLibvipsLibDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/lib`)}catch{try{return __require(`@img/sharp-libvips-${buildPlatformArch()}/lib`)}catch{}}return""},isUnsupportedNodeRuntime=()=>{if(process.release?.name==="node"&&process.versions){if(!semverSatisfies(process.versions.node,engines.node))return{found:process.versions.node,expected:engines.node}}},isEmscripten=()=>{let{CC}=process.env;return Boolean(CC&&CC.endsWith("/emcc"))},isRosetta=()=>{if(process.platform==="darwin"&&process.arch==="x64")return(spawnSync("sysctl sysctl.proc_translated",spawnSyncOptions).stdout||"").trim()==="sysctl.proc_translated: 1";return!1},sha5122=(s)=>createHash3("sha512").update(s).digest("hex"),yarnLocator=()=>{try{let identHash=sha5122(`imgsharp-libvips-${buildPlatformArch()}`),npmVersion=semverCoerce(optionalDependencies[`@img/sharp-libvips-${buildPlatformArch()}`]).version;return sha5122(`${identHash}npm:${npmVersion}`).slice(0,10)}catch{}return""},spawnRebuild=()=>spawnSync(`node-gyp rebuild --directory=src ${isEmscripten()?"--nodedir=emscripten":""}`,{...spawnSyncOptions,stdio:"inherit"}).status,globalLibvipsVersion=()=>{if(process.platform!=="win32")return(spawnSync("pkg-config --modversion vips-cpp",{...spawnSyncOptions,env:{...process.env,PKG_CONFIG_PATH:pkgConfigPath()}}).stdout||"").trim();else return""},pkgConfigPath=()=>{if(process.platform!=="win32")return[(spawnSync('which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',spawnSyncOptions).stdout||"").trim(),process.env.PKG_CONFIG_PATH,"/usr/local/lib/pkgconfig","/usr/lib/pkgconfig","/usr/local/libdata/pkgconfig","/usr/libdata/pkgconfig"].filter(Boolean).join(":");else return""},skipSearch=(status,reason,logger2)=>{if(logger2)logger2(`Detected ${reason}, skipping search for globally-installed libvips`);return status},useGlobalLibvips=(logger2)=>{if(Boolean(process.env.SHARP_IGNORE_GLOBAL_LIBVIPS)===!0)return skipSearch(!1,"SHARP_IGNORE_GLOBAL_LIBVIPS",logger2);if(Boolean(process.env.SHARP_FORCE_GLOBAL_LIBVIPS)===!0)return skipSearch(!0,"SHARP_FORCE_GLOBAL_LIBVIPS",logger2);if(isRosetta())return skipSearch(!1,"Rosetta",logger2);let globalVipsVersion=globalLibvipsVersion();return!!globalVipsVersion&&semverGreaterThanOrEqualTo(globalVipsVersion,minimumLibvipsVersion)};module3.exports={minimumLibvipsVersion,prebuiltPlatforms,buildPlatformArch,buildSharpLibvipsIncludeDir,buildSharpLibvipsCPlusPlusDir,buildSharpLibvipsLibDir,isUnsupportedNodeRuntime,runtimePlatformArch,log:log3,yarnLocator,spawnRebuild,globalLibvipsVersion,pkgConfigPath,useGlobalLibvips}});var require_sharp=__commonJS((exports,module3)=>{var{familySync,versionSync}=require_detect_libc(),{runtimePlatformArch,isUnsupportedNodeRuntime,prebuiltPlatforms,minimumLibvipsVersion}=require_libvips(),runtimePlatform=runtimePlatformArch(),paths=[`../src/build/Release/sharp-${runtimePlatform}.node`,"../src/build/Release/sharp-wasm32.node",`@img/sharp-${runtimePlatform}/sharp.node`,"@img/sharp-wasm32/sharp.node"],sharp,errors2=[];for(let path2 of paths)try{sharp=__require(path2);break}catch(err){errors2.push(err)}if(sharp)module3.exports=sharp;else{let[isLinux,isMacOs,isWindows]=["linux","darwin","win32"].map((os4)=>runtimePlatform.startsWith(os4)),help=[`Could not load the "sharp" module using the ${runtimePlatform} runtime`];errors2.forEach((err)=>{if(err.code!=="MODULE_NOT_FOUND")help.push(`${err.code}: ${err.message}`)});let messages=errors2.map((err)=>err.message).join(" ");if(help.push("Possible solutions:"),isUnsupportedNodeRuntime()){let{found,expected}=isUnsupportedNodeRuntime();help.push("- Please upgrade Node.js:",`    Found ${found}`,`    Requires ${expected}`)}else if(prebuiltPlatforms.includes(runtimePlatform)){let[os4,cpu]=runtimePlatform.split("-"),libc=os4.endsWith("musl")?" --libc=musl":"";help.push("- Ensure optional dependencies can be installed:","    npm install --include=optional sharp","- Ensure your package manager supports multi-platform installation:","    See https://sharp.pixelplumbing.com/install#cross-platform","- Add platform-specific dependencies:",`    npm install --os=${os4.replace("musl","")}${libc} --cpu=${cpu} sharp`)}else help.push(`- Manually install libvips >= ${minimumLibvipsVersion}`,"- Add experimental WebAssembly-based dependencies:","    npm install --cpu=wasm32 sharp","    npm install @img/sharp-wasm32");if(isLinux&&/(symbol not found|CXXABI_)/i.test(messages))try{let{config}=__require(`@img/sharp-libvips-${runtimePlatform}/package`),libcFound=`${familySync()} ${versionSync()}`,libcRequires=`${config.musl?"musl":"glibc"} ${config.musl||config.glibc}`;help.push("- Update your OS:",`    Found ${libcFound}`,`    Requires ${libcRequires}`)}catch(errEngines){}if(isLinux&&/\/snap\/core[0-9]{2}/.test(messages))help.push("- Remove the Node.js Snap, which does not support native modules","    snap remove node");if(isMacOs&&/Incompatible library version/.test(messages))help.push("- Update Homebrew:","    brew update && brew upgrade vips");if(errors2.some((err)=>err.code==="ERR_DLOPEN_DISABLED"))help.push("- Run Node.js without using the --no-addons flag");if(isWindows&&/The specified procedure could not be found/.test(messages))help.push("- Using the canvas package on Windows?","    See https://sharp.pixelplumbing.com/install#canvas-and-windows","- Check for outdated versions of sharp in the dependency tree:","    npm ls sharp");throw help.push("- Consult the installation documentation:","    See https://sharp.pixelplumbing.com/install"),Error(help.join(`
 `))}});var require_constructor=__commonJS((exports,module3)=>{var util=__require("util"),stream=__require("stream"),is2=require_is();require_sharp();var debuglog=util.debuglog("sharp"),Sharp=function(input,options){if(arguments.length===1&&!is2.defined(input))throw Error("Invalid input");if(!(this instanceof Sharp))return new Sharp(input,options);return stream.Duplex.call(this),this.options={topOffsetPre:-1,leftOffsetPre:-1,widthPre:-1,heightPre:-1,topOffsetPost:-1,leftOffsetPost:-1,widthPost:-1,heightPost:-1,width:-1,height:-1,canvas:"crop",position:0,resizeBackground:[0,0,0,255],useExifOrientation:!1,angle:0,rotationAngle:0,rotationBackground:[0,0,0,255],rotateBeforePreExtract:!1,flip:!1,flop:!1,extendTop:0,extendBottom:0,extendLeft:0,extendRight:0,extendBackground:[0,0,0,255],extendWith:"background",withoutEnlargement:!1,withoutReduction:!1,affineMatrix:[],affineBackground:[0,0,0,255],affineIdx:0,affineIdy:0,affineOdx:0,affineOdy:0,affineInterpolator:this.constructor.interpolators.bilinear,kernel:"lanczos3",fastShrinkOnLoad:!0,tint:[-1,0,0,0],flatten:!1,flattenBackground:[0,0,0],unflatten:!1,negate:!1,negateAlpha:!0,medianSize:0,blurSigma:0,precision:"integer",minAmpl:0.2,sharpenSigma:0,sharpenM1:1,sharpenM2:2,sharpenX1:2,sharpenY2:10,sharpenY3:20,threshold:0,thresholdGrayscale:!0,trimBackground:[],trimThreshold:-1,trimLineArt:!1,gamma:0,gammaOut:0,greyscale:!1,normalise:!1,normaliseLower:1,normaliseUpper:99,claheWidth:0,claheHeight:0,claheMaxSlope:3,brightness:1,saturation:1,hue:0,lightness:0,booleanBufferIn:null,booleanFileIn:"",joinChannelIn:[],extractChannel:-1,removeAlpha:!1,ensureAlpha:-1,colourspace:"srgb",colourspacePipeline:"last",composite:[],fileOut:"",formatOut:"input",streamOut:!1,keepMetadata:0,withMetadataOrientation:-1,withMetadataDensity:0,withIccProfile:"",withExif:{},withExifMerge:!0,resolveWithObject:!1,jpegQuality:80,jpegProgressive:!1,jpegChromaSubsampling:"4:2:0",jpegTrellisQuantisation:!1,jpegOvershootDeringing:!1,jpegOptimiseScans:!1,jpegOptimiseCoding:!0,jpegQuantisationTable:0,pngProgressive:!1,pngCompressionLevel:6,pngAdaptiveFiltering:!1,pngPalette:!1,pngQuality:100,pngEffort:7,pngBitdepth:8,pngDither:1,jp2Quality:80,jp2TileHeight:512,jp2TileWidth:512,jp2Lossless:!1,jp2ChromaSubsampling:"4:4:4",webpQuality:80,webpAlphaQuality:100,webpLossless:!1,webpNearLossless:!1,webpSmartSubsample:!1,webpPreset:"default",webpEffort:4,webpMinSize:!1,webpMixed:!1,gifBitdepth:8,gifEffort:7,gifDither:1,gifInterFrameMaxError:0,gifInterPaletteMaxError:3,gifReuse:!0,gifProgressive:!1,tiffQuality:80,tiffCompression:"jpeg",tiffPredictor:"horizontal",tiffPyramid:!1,tiffMiniswhite:!1,tiffBitdepth:8,tiffTile:!1,tiffTileHeight:256,tiffTileWidth:256,tiffXres:1,tiffYres:1,tiffResolutionUnit:"inch",heifQuality:50,heifLossless:!1,heifCompression:"av1",heifEffort:4,heifChromaSubsampling:"4:4:4",heifBitdepth:8,jxlDistance:1,jxlDecodingTier:0,jxlEffort:7,jxlLossless:!1,rawDepth:"uchar",tileSize:256,tileOverlap:0,tileContainer:"fs",tileLayout:"dz",tileFormat:"last",tileDepth:"last",tileAngle:0,tileSkipBlanks:-1,tileBackground:[255,255,255,255],tileCentre:!1,tileId:"https://example.com/iiif",tileBasename:"",timeoutSeconds:0,linearA:[],linearB:[],debuglog:(warning)=>{this.emit("warning",warning),debuglog(warning)},queueListener:function(queueLength){Sharp.queue.emit("change",queueLength)}},this.options.input=this._createInputDescriptor(input,options,{allowStream:!0}),this};Object.setPrototypeOf(Sharp.prototype,stream.Duplex.prototype);Object.setPrototypeOf(Sharp,stream.Duplex);function clone2(){let clone3=this.constructor.call(),{debuglog:debuglog2,queueListener,...options}=this.options;if(clone3.options=structuredClone(options),clone3.options.debuglog=debuglog2,clone3.options.queueListener=queueListener,this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),clone3.options.input.buffer=this.options.input.buffer,clone3.emit("finish")});return clone3}Object.assign(Sharp.prototype,{clone:clone2});module3.exports=Sharp});var require_color_name=__commonJS((exports,module3)=>{module3.exports={aliceblue:[240,248,255],antiquewhite:[250,235,215],aqua:[0,255,255],aquamarine:[127,255,212],azure:[240,255,255],beige:[245,245,220],bisque:[255,228,196],black:[0,0,0],blanchedalmond:[255,235,205],blue:[0,0,255],blueviolet:[138,43,226],brown:[165,42,42],burlywood:[222,184,135],cadetblue:[95,158,160],chartreuse:[127,255,0],chocolate:[210,105,30],coral:[255,127,80],cornflowerblue:[100,149,237],cornsilk:[255,248,220],crimson:[220,20,60],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgoldenrod:[184,134,11],darkgray:[169,169,169],darkgreen:[0,100,0],darkgrey:[169,169,169],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkseagreen:[143,188,143],darkslateblue:[72,61,139],darkslategray:[47,79,79],darkslategrey:[47,79,79],darkturquoise:[0,206,209],darkviolet:[148,0,211],deeppink:[255,20,147],deepskyblue:[0,191,255],dimgray:[105,105,105],dimgrey:[105,105,105],dodgerblue:[30,144,255],firebrick:[178,34,34],floralwhite:[255,250,240],forestgreen:[34,139,34],fuchsia:[255,0,255],gainsboro:[220,220,220],ghostwhite:[248,248,255],gold:[255,215,0],goldenrod:[218,165,32],gray:[128,128,128],green:[0,128,0],greenyellow:[173,255,47],grey:[128,128,128],honeydew:[240,255,240],hotpink:[255,105,180],indianred:[205,92,92],indigo:[75,0,130],ivory:[255,255,240],khaki:[240,230,140],lavender:[230,230,250],lavenderblush:[255,240,245],lawngreen:[124,252,0],lemonchiffon:[255,250,205],lightblue:[173,216,230],lightcoral:[240,128,128],lightcyan:[224,255,255],lightgoldenrodyellow:[250,250,210],lightgray:[211,211,211],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightsalmon:[255,160,122],lightseagreen:[32,178,170],lightskyblue:[135,206,250],lightslategray:[119,136,153],lightslategrey:[119,136,153],lightsteelblue:[176,196,222],lightyellow:[255,255,224],lime:[0,255,0],limegreen:[50,205,50],linen:[250,240,230],magenta:[255,0,255],maroon:[128,0,0],mediumaquamarine:[102,205,170],mediumblue:[0,0,205],mediumorchid:[186,85,211],mediumpurple:[147,112,219],mediumseagreen:[60,179,113],mediumslateblue:[123,104,238],mediumspringgreen:[0,250,154],mediumturquoise:[72,209,204],mediumvioletred:[199,21,133],midnightblue:[25,25,112],mintcream:[245,255,250],mistyrose:[255,228,225],moccasin:[255,228,181],navajowhite:[255,222,173],navy:[0,0,128],oldlace:[253,245,230],olive:[128,128,0],olivedrab:[107,142,35],orange:[255,165,0],orangered:[255,69,0],orchid:[218,112,214],palegoldenrod:[238,232,170],palegreen:[152,251,152],paleturquoise:[175,238,238],palevioletred:[219,112,147],papayawhip:[255,239,213],peachpuff:[255,218,185],peru:[205,133,63],pink:[255,192,203],plum:[221,160,221],powderblue:[176,224,230],purple:[128,0,128],rebeccapurple:[102,51,153],red:[255,0,0],rosybrown:[188,143,143],royalblue:[65,105,225],saddlebrown:[139,69,19],salmon:[250,128,114],sandybrown:[244,164,96],seagreen:[46,139,87],seashell:[255,245,238],sienna:[160,82,45],silver:[192,192,192],skyblue:[135,206,235],slateblue:[106,90,205],slategray:[112,128,144],slategrey:[112,128,144],snow:[255,250,250],springgreen:[0,255,127],steelblue:[70,130,180],tan:[210,180,140],teal:[0,128,128],thistle:[216,191,216],tomato:[255,99,71],turquoise:[64,224,208],violet:[238,130,238],wheat:[245,222,179],white:[255,255,255],whitesmoke:[245,245,245],yellow:[255,255,0],yellowgreen:[154,205,50]}});var require_is_arrayish=__commonJS((exports,module3)=>{module3.exports=function(obj){if(!obj||typeof obj==="string")return!1;return obj instanceof Array||Array.isArray(obj)||obj.length>=0&&(obj.splice instanceof Function||Object.getOwnPropertyDescriptor(obj,obj.length-1)&&obj.constructor.name!=="String")}});var require_simple_swizzle=__commonJS((exports,module3)=>{var isArrayish=require_is_arrayish(),concat4=Array.prototype.concat,slice2=Array.prototype.slice,swizzle=module3.exports=function(args){var results=[];for(var i=0,len=args.length;i<len;i++){var arg=args[i];if(isArrayish(arg))results=concat4.call(results,slice2.call(arg));else results.push(arg)}return results};swizzle.wrap=function(fn){return function(){return fn(swizzle(arguments))}}});var require_color_string=__commonJS((exports,module3)=>{var colorNames=require_color_name(),swizzle=require_simple_swizzle(),hasOwnProperty=Object.hasOwnProperty,reverseNames=Object.create(null);for(name2 in colorNames)if(hasOwnProperty.call(colorNames,name2))reverseNames[colorNames[name2]]=name2;var name2,cs=module3.exports={to:{},get:{}};cs.get=function(string3){var prefix=string3.substring(0,3).toLowerCase(),val,model;switch(prefix){case"hsl":val=cs.get.hsl(string3),model="hsl";break;case"hwb":val=cs.get.hwb(string3),model="hwb";break;default:val=cs.get.rgb(string3),model="rgb";break}if(!val)return null;return{model,value:val}};cs.get.rgb=function(string3){if(!string3)return null;var abbr=/^#([a-f0-9]{3,4})$/i,hex2=/^#([a-f0-9]{6})([a-f0-9]{2})?$/i,rgba=/^rgba?\(\s*([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,per=/^rgba?\(\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,keyword=/^(\w+)$/,rgb=[0,0,0,1],match,i,hexAlpha;if(match=string3.match(hex2)){hexAlpha=match[2],match=match[1];for(i=0;i<3;i++){var i2=i*2;rgb[i]=parseInt(match.slice(i2,i2+2),16)}if(hexAlpha)rgb[3]=parseInt(hexAlpha,16)/255}else if(match=string3.match(abbr)){match=match[1],hexAlpha=match[3];for(i=0;i<3;i++)rgb[i]=parseInt(match[i]+match[i],16);if(hexAlpha)rgb[3]=parseInt(hexAlpha+hexAlpha,16)/255}else if(match=string3.match(rgba)){for(i=0;i<3;i++)rgb[i]=parseInt(match[i+1],0);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(per)){for(i=0;i<3;i++)rgb[i]=Math.round(parseFloat(match[i+1])*2.55);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(keyword)){if(match[1]==="transparent")return[0,0,0,0];if(!hasOwnProperty.call(colorNames,match[1]))return null;return rgb=colorNames[match[1]],rgb[3]=1,rgb}else return null;for(i=0;i<3;i++)rgb[i]=clamp(rgb[i],0,255);return rgb[3]=clamp(rgb[3],0,1),rgb};cs.get.hsl=function(string3){if(!string3)return null;var hsl=/^hsla?\(\s*([+-]?(?:\d{0,3}\.)?\d+)(?:deg)?\s*,?\s*([+-]?[\d\.]+)%\s*,?\s*([+-]?[\d\.]+)%\s*(?:[,|\/]\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hsl);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,s=clamp(parseFloat(match[2]),0,100),l=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,s,l,a]}return null};cs.get.hwb=function(string3){if(!string3)return null;var hwb=/^hwb\(\s*([+-]?\d{0,3}(?:\.\d+)?)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hwb);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,w=clamp(parseFloat(match[2]),0,100),b=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,w,b,a]}return null};cs.to.hex=function(){var rgba=swizzle(arguments);return"#"+hexDouble(rgba[0])+hexDouble(rgba[1])+hexDouble(rgba[2])+(rgba[3]<1?hexDouble(Math.round(rgba[3]*255)):"")};cs.to.rgb=function(){var rgba=swizzle(arguments);return rgba.length<4||rgba[3]===1?"rgb("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+")":"rgba("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+", "+rgba[3]+")"};cs.to.rgb.percent=function(){var rgba=swizzle(arguments),r=Math.round(rgba[0]/255*100),g=Math.round(rgba[1]/255*100),b=Math.round(rgba[2]/255*100);return rgba.length<4||rgba[3]===1?"rgb("+r+"%, "+g+"%, "+b+"%)":"rgba("+r+"%, "+g+"%, "+b+"%, "+rgba[3]+")"};cs.to.hsl=function(){var hsla=swizzle(arguments);return hsla.length<4||hsla[3]===1?"hsl("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%)":"hsla("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%, "+hsla[3]+")"};cs.to.hwb=function(){var hwba=swizzle(arguments),a="";if(hwba.length>=4&&hwba[3]!==1)a=", "+hwba[3];return"hwb("+hwba[0]+", "+hwba[1]+"%, "+hwba[2]+"%"+a+")"};cs.to.keyword=function(rgb){return reverseNames[rgb.slice(0,3)]};function clamp(num3,min,max){return Math.min(Math.max(min,num3),max)}function hexDouble(num3){var str4=Math.round(num3).toString(16).toUpperCase();return str4.length<2?"0"+str4:str4}});var require_conversions=__commonJS((exports,module3)=>{var cssKeywords=require_color_name(),reverseKeywords={};for(let key2 of Object.keys(cssKeywords))reverseKeywords[cssKeywords[key2]]=key2;var convert2={rgb:{channels:3,labels:"rgb"},hsl:{channels:3,labels:"hsl"},hsv:{channels:3,labels:"hsv"},hwb:{channels:3,labels:"hwb"},cmyk:{channels:4,labels:"cmyk"},xyz:{channels:3,labels:"xyz"},lab:{channels:3,labels:"lab"},lch:{channels:3,labels:"lch"},hex:{channels:1,labels:["hex"]},keyword:{channels:1,labels:["keyword"]},ansi16:{channels:1,labels:["ansi16"]},ansi256:{channels:1,labels:["ansi256"]},hcg:{channels:3,labels:["h","c","g"]},apple:{channels:3,labels:["r16","g16","b16"]},gray:{channels:1,labels:["gray"]}};module3.exports=convert2;for(let model of Object.keys(convert2)){if(!("channels"in convert2[model]))throw Error("missing channels property: "+model);if(!("labels"in convert2[model]))throw Error("missing channel labels property: "+model);if(convert2[model].labels.length!==convert2[model].channels)throw Error("channel and label counts mismatch: "+model);let{channels,labels}=convert2[model];delete convert2[model].channels,delete convert2[model].labels,Object.defineProperty(convert2[model],"channels",{value:channels}),Object.defineProperty(convert2[model],"labels",{value:labels})}convert2.rgb.hsl=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,min=Math.min(r,g,b),max=Math.max(r,g,b),delta=max-min,h,s;if(max===min)h=0;else if(r===max)h=(g-b)/delta;else if(g===max)h=2+(b-r)/delta;else if(b===max)h=4+(r-g)/delta;if(h=Math.min(h*60,360),h<0)h+=360;let l=(min+max)/2;if(max===min)s=0;else if(l<=0.5)s=delta/(max+min);else s=delta/(2-max-min);return[h,s*100,l*100]};convert2.rgb.hsv=function(rgb){let rdif,gdif,bdif,h,s,r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,v=Math.max(r,g,b),diff=v-Math.min(r,g,b),diffc=function(c){return(v-c)/6/diff+0.5};if(diff===0)h=0,s=0;else{if(s=diff/v,rdif=diffc(r),gdif=diffc(g),bdif=diffc(b),r===v)h=bdif-gdif;else if(g===v)h=0.3333333333333333+rdif-bdif;else if(b===v)h=0.6666666666666666+gdif-rdif;if(h<0)h+=1;else if(h>1)h-=1}return[h*360,s*100,v*100]};convert2.rgb.hwb=function(rgb){let r=rgb[0],g=rgb[1],b=rgb[2],h=convert2.rgb.hsl(rgb)[0],w=0.00392156862745098*Math.min(r,Math.min(g,b));return b=1-0.00392156862745098*Math.max(r,Math.max(g,b)),[h,w*100,b*100]};convert2.rgb.cmyk=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,k=Math.min(1-r,1-g,1-b),c=(1-r-k)/(1-k)||0,m=(1-g-k)/(1-k)||0,y=(1-b-k)/(1-k)||0;return[c*100,m*100,y*100,k*100]};function comparativeDistance(x,y){return(x[0]-y[0])**2+(x[1]-y[1])**2+(x[2]-y[2])**2}convert2.rgb.keyword=function(rgb){let reversed=reverseKeywords[rgb];if(reversed)return reversed;let currentClosestDistance=1/0,currentClosestKeyword;for(let keyword of Object.keys(cssKeywords)){let value2=cssKeywords[keyword],distance=comparativeDistance(rgb,value2);if(distance<currentClosestDistance)currentClosestDistance=distance,currentClosestKeyword=keyword}return currentClosestKeyword};convert2.keyword.rgb=function(keyword){return cssKeywords[keyword]};convert2.rgb.xyz=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255;r=r>0.04045?((r+0.055)/1.055)**2.4:r/12.92,g=g>0.04045?((g+0.055)/1.055)**2.4:g/12.92,b=b>0.04045?((b+0.055)/1.055)**2.4:b/12.92;let x=r*0.4124+g*0.3576+b*0.1805,y=r*0.2126+g*0.7152+b*0.0722,z=r*0.0193+g*0.1192+b*0.9505;return[x*100,y*100,z*100]};convert2.rgb.lab=function(rgb){let xyz=convert2.rgb.xyz(rgb),x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.hsl.rgb=function(hsl){let h=hsl[0]/360,s=hsl[1]/100,l=hsl[2]/100,t2,t3,val;if(s===0)return val=l*255,[val,val,val];if(l<0.5)t2=l*(1+s);else t2=l+s-l*s;let t1=2*l-t2,rgb=[0,0,0];for(let i=0;i<3;i++){if(t3=h+0.3333333333333333*-(i-1),t3<0)t3++;if(t3>1)t3--;if(6*t3<1)val=t1+(t2-t1)*6*t3;else if(2*t3<1)val=t2;else if(3*t3<2)val=t1+(t2-t1)*(0.6666666666666666-t3)*6;else val=t1;rgb[i]=val*255}return rgb};convert2.hsl.hsv=function(hsl){let h=hsl[0],s=hsl[1]/100,l=hsl[2]/100,smin=s,lmin=Math.max(l,0.01);l*=2,s*=l<=1?l:2-l,smin*=lmin<=1?lmin:2-lmin;let v=(l+s)/2,sv=l===0?2*smin/(lmin+smin):2*s/(l+s);return[h,sv*100,v*100]};convert2.hsv.rgb=function(hsv){let h=hsv[0]/60,s=hsv[1]/100,v=hsv[2]/100,hi=Math.floor(h)%6,f=h-Math.floor(h),p=255*v*(1-s),q=255*v*(1-s*f),t=255*v*(1-s*(1-f));switch(v*=255,hi){case 0:return[v,t,p];case 1:return[q,v,p];case 2:return[p,v,t];case 3:return[p,q,v];case 4:return[t,p,v];case 5:return[v,p,q]}};convert2.hsv.hsl=function(hsv){let h=hsv[0],s=hsv[1]/100,v=hsv[2]/100,vmin=Math.max(v,0.01),sl,l;l=(2-s)*v;let lmin=(2-s)*vmin;return sl=s*vmin,sl/=lmin<=1?lmin:2-lmin,sl=sl||0,l/=2,[h,sl*100,l*100]};convert2.hwb.rgb=function(hwb){let h=hwb[0]/360,wh=hwb[1]/100,bl=hwb[2]/100,ratio=wh+bl,f;if(ratio>1)wh/=ratio,bl/=ratio;let i=Math.floor(6*h),v=1-bl;if(f=6*h-i,(i&1)!==0)f=1-f;let n=wh+f*(v-wh),r,g,b;switch(i){default:case 6:case 0:r=v,g=n,b=wh;break;case 1:r=n,g=v,b=wh;break;case 2:r=wh,g=v,b=n;break;case 3:r=wh,g=n,b=v;break;case 4:r=n,g=wh,b=v;break;case 5:r=v,g=wh,b=n;break}return[r*255,g*255,b*255]};convert2.cmyk.rgb=function(cmyk){let c=cmyk[0]/100,m=cmyk[1]/100,y=cmyk[2]/100,k=cmyk[3]/100,r=1-Math.min(1,c*(1-k)+k),g=1-Math.min(1,m*(1-k)+k),b=1-Math.min(1,y*(1-k)+k);return[r*255,g*255,b*255]};convert2.xyz.rgb=function(xyz){let x=xyz[0]/100,y=xyz[1]/100,z=xyz[2]/100,r,g,b;return r=x*3.2406+y*-1.5372+z*-0.4986,g=x*-0.9689+y*1.8758+z*0.0415,b=x*0.0557+y*-0.204+z*1.057,r=r>0.0031308?1.055*r**0.4166666666666667-0.055:r*12.92,g=g>0.0031308?1.055*g**0.4166666666666667-0.055:g*12.92,b=b>0.0031308?1.055*b**0.4166666666666667-0.055:b*12.92,r=Math.min(Math.max(0,r),1),g=Math.min(Math.max(0,g),1),b=Math.min(Math.max(0,b),1),[r*255,g*255,b*255]};convert2.xyz.lab=function(xyz){let x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.lab.xyz=function(lab){let l=lab[0],a=lab[1],b=lab[2],x,y,z;y=(l+16)/116,x=a/500+y,z=y-b/200;let y2=y**3,x2=x**3,z2=z**3;return y=y2>0.008856?y2:(y-0.13793103448275862)/7.787,x=x2>0.008856?x2:(x-0.13793103448275862)/7.787,z=z2>0.008856?z2:(z-0.13793103448275862)/7.787,x*=95.047,y*=100,z*=108.883,[x,y,z]};convert2.lab.lch=function(lab){let l=lab[0],a=lab[1],b=lab[2],h;if(h=Math.atan2(b,a)*360/2/Math.PI,h<0)h+=360;let c=Math.sqrt(a*a+b*b);return[l,c,h]};convert2.lch.lab=function(lch){let l=lch[0],c=lch[1],hr=lch[2]/360*2*Math.PI,a=c*Math.cos(hr),b=c*Math.sin(hr);return[l,a,b]};convert2.rgb.ansi16=function(args,saturation=null){let[r,g,b]=args,value2=saturation===null?convert2.rgb.hsv(args)[2]:saturation;if(value2=Math.round(value2/50),value2===0)return 30;let ansi=30+(Math.round(b/255)<<2|Math.round(g/255)<<1|Math.round(r/255));if(value2===2)ansi+=60;return ansi};convert2.hsv.ansi16=function(args){return convert2.rgb.ansi16(convert2.hsv.rgb(args),args[2])};convert2.rgb.ansi256=function(args){let r=args[0],g=args[1],b=args[2];if(r===g&&g===b){if(r<8)return 16;if(r>248)return 231;return Math.round((r-8)/247*24)+232}return 16+36*Math.round(r/255*5)+6*Math.round(g/255*5)+Math.round(b/255*5)};convert2.ansi16.rgb=function(args){let color=args%10;if(color===0||color===7){if(args>50)color+=3.5;return color=color/10.5*255,[color,color,color]}let mult=(~~(args>50)+1)*0.5,r=(color&1)*mult*255,g=(color>>1&1)*mult*255,b=(color>>2&1)*mult*255;return[r,g,b]};convert2.ansi256.rgb=function(args){if(args>=232){let c=(args-232)*10+8;return[c,c,c]}args-=16;let rem,r=Math.floor(args/36)/5*255,g=Math.floor((rem=args%36)/6)/5*255,b=rem%6/5*255;return[r,g,b]};convert2.rgb.hex=function(args){let string3=(((Math.round(args[0])&255)<<16)+((Math.round(args[1])&255)<<8)+(Math.round(args[2])&255)).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.hex.rgb=function(args){let match=args.toString(16).match(/[a-f0-9]{6}|[a-f0-9]{3}/i);if(!match)return[0,0,0];let colorString=match[0];if(match[0].length===3)colorString=colorString.split("").map((char)=>{return char+char}).join("");let integer3=parseInt(colorString,16),r=integer3>>16&255,g=integer3>>8&255,b=integer3&255;return[r,g,b]};convert2.rgb.hcg=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,max=Math.max(Math.max(r,g),b),min=Math.min(Math.min(r,g),b),chroma=max-min,grayscale,hue;if(chroma<1)grayscale=min/(1-chroma);else grayscale=0;if(chroma<=0)hue=0;else if(max===r)hue=(g-b)/chroma%6;else if(max===g)hue=2+(b-r)/chroma;else hue=4+(r-g)/chroma;return hue/=6,hue%=1,[hue*360,chroma*100,grayscale*100]};convert2.hsl.hcg=function(hsl){let s=hsl[1]/100,l=hsl[2]/100,c=l<0.5?2*s*l:2*s*(1-l),f=0;if(c<1)f=(l-0.5*c)/(1-c);return[hsl[0],c*100,f*100]};convert2.hsv.hcg=function(hsv){let s=hsv[1]/100,v=hsv[2]/100,c=s*v,f=0;if(c<1)f=(v-c)/(1-c);return[hsv[0],c*100,f*100]};convert2.hcg.rgb=function(hcg){let h=hcg[0]/360,c=hcg[1]/100,g=hcg[2]/100;if(c===0)return[g*255,g*255,g*255];let pure=[0,0,0],hi=h%1*6,v=hi%1,w=1-v,mg=0;switch(Math.floor(hi)){case 0:pure[0]=1,pure[1]=v,pure[2]=0;break;case 1:pure[0]=w,pure[1]=1,pure[2]=0;break;case 2:pure[0]=0,pure[1]=1,pure[2]=v;break;case 3:pure[0]=0,pure[1]=w,pure[2]=1;break;case 4:pure[0]=v,pure[1]=0,pure[2]=1;break;default:pure[0]=1,pure[1]=0,pure[2]=w}return mg=(1-c)*g,[(c*pure[0]+mg)*255,(c*pure[1]+mg)*255,(c*pure[2]+mg)*255]};convert2.hcg.hsv=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c),f=0;if(v>0)f=c/v;return[hcg[0],f*100,v*100]};convert2.hcg.hsl=function(hcg){let c=hcg[1]/100,l=hcg[2]/100*(1-c)+0.5*c,s=0;if(l>0&&l<0.5)s=c/(2*l);else if(l>=0.5&&l<1)s=c/(2*(1-l));return[hcg[0],s*100,l*100]};convert2.hcg.hwb=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c);return[hcg[0],(v-c)*100,(1-v)*100]};convert2.hwb.hcg=function(hwb){let w=hwb[1]/100,v=1-hwb[2]/100,c=v-w,g=0;if(c<1)g=(v-c)/(1-c);return[hwb[0],c*100,g*100]};convert2.apple.rgb=function(apple){return[apple[0]/65535*255,apple[1]/65535*255,apple[2]/65535*255]};convert2.rgb.apple=function(rgb){return[rgb[0]/255*65535,rgb[1]/255*65535,rgb[2]/255*65535]};convert2.gray.rgb=function(args){return[args[0]/100*255,args[0]/100*255,args[0]/100*255]};convert2.gray.hsl=function(args){return[0,0,args[0]]};convert2.gray.hsv=convert2.gray.hsl;convert2.gray.hwb=function(gray){return[0,100,gray[0]]};convert2.gray.cmyk=function(gray){return[0,0,0,gray[0]]};convert2.gray.lab=function(gray){return[gray[0],0,0]};convert2.gray.hex=function(gray){let val=Math.round(gray[0]/100*255)&255,string3=((val<<16)+(val<<8)+val).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.rgb.gray=function(rgb){return[(rgb[0]+rgb[1]+rgb[2])/3/255*100]}});var require_route=__commonJS((exports,module3)=>{var conversions=require_conversions();function buildGraph(){let graph={},models=Object.keys(conversions);for(let len=models.length,i=0;i<len;i++)graph[models[i]]={distance:-1,parent:null};return graph}function deriveBFS(fromModel){let graph=buildGraph(),queue=[fromModel];graph[fromModel].distance=0;while(queue.length){let current=queue.pop(),adjacents=Object.keys(conversions[current]);for(let len=adjacents.length,i=0;i<len;i++){let adjacent=adjacents[i],node=graph[adjacent];if(node.distance===-1)node.distance=graph[current].distance+1,node.parent=current,queue.unshift(adjacent)}}return graph}function link(from,to){return function(args){return to(from(args))}}function wrapConversion(toModel,graph){let path2=[graph[toModel].parent,toModel],fn=conversions[graph[toModel].parent][toModel],cur=graph[toModel].parent;while(graph[cur].parent)path2.unshift(graph[cur].parent),fn=link(conversions[graph[cur].parent][cur],fn),cur=graph[cur].parent;return fn.conversion=path2,fn}module3.exports=function(fromModel){let graph=deriveBFS(fromModel),conversion={},models=Object.keys(graph);for(let len=models.length,i=0;i<len;i++){let toModel=models[i];if(graph[toModel].parent===null)continue;conversion[toModel]=wrapConversion(toModel,graph)}return conversion}});var require_color_convert=__commonJS((exports,module3)=>{var conversions=require_conversions(),route=require_route(),convert2={},models=Object.keys(conversions);function wrapRaw(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;return fn(args)};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}function wrapRounded(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;let result=fn(args);if(typeof result==="object")for(let len=result.length,i=0;i<len;i++)result[i]=Math.round(result[i]);return result};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}models.forEach((fromModel)=>{convert2[fromModel]={},Object.defineProperty(convert2[fromModel],"channels",{value:conversions[fromModel].channels}),Object.defineProperty(convert2[fromModel],"labels",{value:conversions[fromModel].labels});let routes=route(fromModel);Object.keys(routes).forEach((toModel)=>{let fn=routes[toModel];convert2[fromModel][toModel]=wrapRounded(fn),convert2[fromModel][toModel].raw=wrapRaw(fn)})});module3.exports=convert2});var require_color=__commonJS((exports,module3)=>{var colorString=require_color_string(),convert2=require_color_convert(),skippedModels=["keyword","gray","hex"],hashedModelKeys={};for(let model of Object.keys(convert2))hashedModelKeys[[...convert2[model].labels].sort().join("")]=model;var limiters={};function Color(object3,model){if(!(this instanceof Color))return new Color(object3,model);if(model&&model in skippedModels)model=null;if(model&&!(model in convert2))throw Error("Unknown model: "+model);let i,channels;if(object3==null)this.model="rgb",this.color=[0,0,0],this.valpha=1;else if(object3 instanceof Color)this.model=object3.model,this.color=[...object3.color],this.valpha=object3.valpha;else if(typeof object3==="string"){let result=colorString.get(object3);if(result===null)throw Error("Unable to parse color from string: "+object3);this.model=result.model,channels=convert2[this.model].channels,this.color=result.value.slice(0,channels),this.valpha=typeof result.value[channels]==="number"?result.value[channels]:1}else if(object3.length>0){this.model=model||"rgb",channels=convert2[this.model].channels;let newArray=Array.prototype.slice.call(object3,0,channels);this.color=zeroArray(newArray,channels),this.valpha=typeof object3[channels]==="number"?object3[channels]:1}else if(typeof object3==="number")this.model="rgb",this.color=[object3>>16&255,object3>>8&255,object3&255],this.valpha=1;else{this.valpha=1;let keys=Object.keys(object3);if("alpha"in object3)keys.splice(keys.indexOf("alpha"),1),this.valpha=typeof object3.alpha==="number"?object3.alpha:0;let hashedKeys=keys.sort().join("");if(!(hashedKeys in hashedModelKeys))throw Error("Unable to parse color from object: "+JSON.stringify(object3));this.model=hashedModelKeys[hashedKeys];let{labels}=convert2[this.model],color=[];for(i=0;i<labels.length;i++)color.push(object3[labels[i]]);this.color=zeroArray(color)}if(limiters[this.model]){channels=convert2[this.model].channels;for(i=0;i<channels;i++){let limit=limiters[this.model][i];if(limit)this.color[i]=limit(this.color[i])}}if(this.valpha=Math.max(0,Math.min(1,this.valpha)),Object.freeze)Object.freeze(this)}Color.prototype={toString(){return this.string()},toJSON(){return this[this.model]()},string(places){let self2=this.model in colorString.to?this:this.rgb();self2=self2.round(typeof places==="number"?places:1);let args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to[self2.model](args)},percentString(places){let self2=this.rgb().round(typeof places==="number"?places:1),args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to.rgb.percent(args)},array(){return this.valpha===1?[...this.color]:[...this.color,this.valpha]},object(){let result={},{channels}=convert2[this.model],{labels}=convert2[this.model];for(let i=0;i<channels;i++)result[labels[i]]=this.color[i];if(this.valpha!==1)result.alpha=this.valpha;return result},unitArray(){let rgb=this.rgb().color;if(rgb[0]/=255,rgb[1]/=255,rgb[2]/=255,this.valpha!==1)rgb.push(this.valpha);return rgb},unitObject(){let rgb=this.rgb().object();if(rgb.r/=255,rgb.g/=255,rgb.b/=255,this.valpha!==1)rgb.alpha=this.valpha;return rgb},round(places){return places=Math.max(places||0,0),new Color([...this.color.map(roundToPlace(places)),this.valpha],this.model)},alpha(value2){if(value2!==void 0)return new Color([...this.color,Math.max(0,Math.min(1,value2))],this.model);return this.valpha},red:getset("rgb",0,maxfn(255)),green:getset("rgb",1,maxfn(255)),blue:getset("rgb",2,maxfn(255)),hue:getset(["hsl","hsv","hsl","hwb","hcg"],0,(value2)=>(value2%360+360)%360),saturationl:getset("hsl",1,maxfn(100)),lightness:getset("hsl",2,maxfn(100)),saturationv:getset("hsv",1,maxfn(100)),value:getset("hsv",2,maxfn(100)),chroma:getset("hcg",1,maxfn(100)),gray:getset("hcg",2,maxfn(100)),white:getset("hwb",1,maxfn(100)),wblack:getset("hwb",2,maxfn(100)),cyan:getset("cmyk",0,maxfn(100)),magenta:getset("cmyk",1,maxfn(100)),yellow:getset("cmyk",2,maxfn(100)),black:getset("cmyk",3,maxfn(100)),x:getset("xyz",0,maxfn(95.047)),y:getset("xyz",1,maxfn(100)),z:getset("xyz",2,maxfn(108.833)),l:getset("lab",0,maxfn(100)),a:getset("lab",1),b:getset("lab",2),keyword(value2){if(value2!==void 0)return new Color(value2);return convert2[this.model].keyword(this.color)},hex(value2){if(value2!==void 0)return new Color(value2);return colorString.to.hex(this.rgb().round().color)},hexa(value2){if(value2!==void 0)return new Color(value2);let rgbArray=this.rgb().round().color,alphaHex=Math.round(this.valpha*255).toString(16).toUpperCase();if(alphaHex.length===1)alphaHex="0"+alphaHex;return colorString.to.hex(rgbArray)+alphaHex},rgbNumber(){let rgb=this.rgb().color;return(rgb[0]&255)<<16|(rgb[1]&255)<<8|rgb[2]&255},luminosity(){let rgb=this.rgb().color,lum=[];for(let[i,element]of rgb.entries()){let chan=element/255;lum[i]=chan<=0.04045?chan/12.92:((chan+0.055)/1.055)**2.4}return 0.2126*lum[0]+0.7152*lum[1]+0.0722*lum[2]},contrast(color2){let lum1=this.luminosity(),lum2=color2.luminosity();if(lum1>lum2)return(lum1+0.05)/(lum2+0.05);return(lum2+0.05)/(lum1+0.05)},level(color2){let contrastRatio=this.contrast(color2);if(contrastRatio>=7)return"AAA";return contrastRatio>=4.5?"AA":""},isDark(){let rgb=this.rgb().color;return(rgb[0]*2126+rgb[1]*7152+rgb[2]*722)/1e4<128},isLight(){return!this.isDark()},negate(){let rgb=this.rgb();for(let i=0;i<3;i++)rgb.color[i]=255-rgb.color[i];return rgb},lighten(ratio){let hsl=this.hsl();return hsl.color[2]+=hsl.color[2]*ratio,hsl},darken(ratio){let hsl=this.hsl();return hsl.color[2]-=hsl.color[2]*ratio,hsl},saturate(ratio){let hsl=this.hsl();return hsl.color[1]+=hsl.color[1]*ratio,hsl},desaturate(ratio){let hsl=this.hsl();return hsl.color[1]-=hsl.color[1]*ratio,hsl},whiten(ratio){let hwb=this.hwb();return hwb.color[1]+=hwb.color[1]*ratio,hwb},blacken(ratio){let hwb=this.hwb();return hwb.color[2]+=hwb.color[2]*ratio,hwb},grayscale(){let rgb=this.rgb().color,value2=rgb[0]*0.3+rgb[1]*0.59+rgb[2]*0.11;return Color.rgb(value2,value2,value2)},fade(ratio){return this.alpha(this.valpha-this.valpha*ratio)},opaquer(ratio){return this.alpha(this.valpha+this.valpha*ratio)},rotate(degrees){let hsl=this.hsl(),hue=hsl.color[0];return hue=(hue+degrees)%360,hue=hue<0?360+hue:hue,hsl.color[0]=hue,hsl},mix(mixinColor,weight){if(!mixinColor||!mixinColor.rgb)throw Error('Argument to "mix" was not a Color instance, but rather an instance of '+typeof mixinColor);let color1=mixinColor.rgb(),color2=this.rgb(),p=weight===void 0?0.5:weight,w=2*p-1,a=color1.alpha()-color2.alpha(),w1=((w*a===-1?w:(w+a)/(1+w*a))+1)/2,w2=1-w1;return Color.rgb(w1*color1.red()+w2*color2.red(),w1*color1.green()+w2*color2.green(),w1*color1.blue()+w2*color2.blue(),color1.alpha()*p+color2.alpha()*(1-p))}};for(let model of Object.keys(convert2)){if(skippedModels.includes(model))continue;let{channels}=convert2[model];Color.prototype[model]=function(...args){if(this.model===model)return new Color(this);if(args.length>0)return new Color(args,model);return new Color([...assertArray(convert2[this.model][model].raw(this.color)),this.valpha],model)},Color[model]=function(...args){let color=args[0];if(typeof color==="number")color=zeroArray(args,channels);return new Color(color,model)}}function roundTo(number3,places){return Number(number3.toFixed(places))}function roundToPlace(places){return function(number3){return roundTo(number3,places)}}function getset(model,channel,modifier){model=Array.isArray(model)?model:[model];for(let m of model)(limiters[m]||(limiters[m]=[]))[channel]=modifier;return model=model[0],function(value2){let result;if(value2!==void 0){if(modifier)value2=modifier(value2);return result=this[model](),result.color[channel]=value2,result}if(result=this[model]().color[channel],modifier)result=modifier(result);return result}}function maxfn(max){return function(v){return Math.max(0,Math.min(max,v))}}function assertArray(value2){return Array.isArray(value2)?value2:[value2]}function zeroArray(array3,length){for(let i=0;i<length;i++)if(typeof array3[i]!=="number")array3[i]=0;return array3}module3.exports=Color});var require_input=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),sharp=require_sharp(),align={left:"low",center:"centre",centre:"centre",right:"high"};function _inputOptionsFromObject(obj){let{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}=obj;return[raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd].some(is2.defined)?{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}:void 0}function _createInputDescriptor(input,inputOptions,containerOptions){let inputDescriptor={failOn:"warning",limitInputPixels:Math.pow(16383,2),ignoreIcc:!1,unlimited:!1,sequentialRead:!0};if(is2.string(input))inputDescriptor.file=input;else if(is2.buffer(input)){if(input.length===0)throw Error("Input Buffer is empty");inputDescriptor.buffer=input}else if(is2.arrayBuffer(input)){if(input.byteLength===0)throw Error("Input bit Array is empty");inputDescriptor.buffer=Buffer.from(input,0,input.byteLength)}else if(is2.typedArray(input)){if(input.length===0)throw Error("Input Bit Array is empty");inputDescriptor.buffer=Buffer.from(input.buffer,input.byteOffset,input.byteLength)}else if(is2.plainObject(input)&&!is2.defined(inputOptions)){if(inputOptions=input,_inputOptionsFromObject(inputOptions))inputDescriptor.buffer=[]}else if(!is2.defined(input)&&!is2.defined(inputOptions)&&is2.object(containerOptions)&&containerOptions.allowStream)inputDescriptor.buffer=[];else throw Error(`Unsupported input '${input}' of type ${typeof input}${is2.defined(inputOptions)?` when also providing options of type ${typeof inputOptions}`:""}`);if(is2.object(inputOptions)){if(is2.defined(inputOptions.failOnError))if(is2.bool(inputOptions.failOnError))inputDescriptor.failOn=inputOptions.failOnError?"warning":"none";else throw is2.invalidParameterError("failOnError","boolean",inputOptions.failOnError);if(is2.defined(inputOptions.failOn))if(is2.string(inputOptions.failOn)&&is2.inArray(inputOptions.failOn,["none","truncated","error","warning"]))inputDescriptor.failOn=inputOptions.failOn;else throw is2.invalidParameterError("failOn","one of: none, truncated, error, warning",inputOptions.failOn);if(is2.defined(inputOptions.density))if(is2.inRange(inputOptions.density,1,1e5))inputDescriptor.density=inputOptions.density;else throw is2.invalidParameterError("density","number between 1 and 100000",inputOptions.density);if(is2.defined(inputOptions.ignoreIcc))if(is2.bool(inputOptions.ignoreIcc))inputDescriptor.ignoreIcc=inputOptions.ignoreIcc;else throw is2.invalidParameterError("ignoreIcc","boolean",inputOptions.ignoreIcc);if(is2.defined(inputOptions.limitInputPixels))if(is2.bool(inputOptions.limitInputPixels))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels?Math.pow(16383,2):0;else if(is2.integer(inputOptions.limitInputPixels)&&is2.inRange(inputOptions.limitInputPixels,0,Number.MAX_SAFE_INTEGER))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels;else throw is2.invalidParameterError("limitInputPixels","positive integer",inputOptions.limitInputPixels);if(is2.defined(inputOptions.unlimited))if(is2.bool(inputOptions.unlimited))inputDescriptor.unlimited=inputOptions.unlimited;else throw is2.invalidParameterError("unlimited","boolean",inputOptions.unlimited);if(is2.defined(inputOptions.sequentialRead))if(is2.bool(inputOptions.sequentialRead))inputDescriptor.sequentialRead=inputOptions.sequentialRead;else throw is2.invalidParameterError("sequentialRead","boolean",inputOptions.sequentialRead);if(is2.defined(inputOptions.raw))if(is2.object(inputOptions.raw)&&is2.integer(inputOptions.raw.width)&&inputOptions.raw.width>0&&is2.integer(inputOptions.raw.height)&&inputOptions.raw.height>0&&is2.integer(inputOptions.raw.channels)&&is2.inRange(inputOptions.raw.channels,1,4))switch(inputDescriptor.rawWidth=inputOptions.raw.width,inputDescriptor.rawHeight=inputOptions.raw.height,inputDescriptor.rawChannels=inputOptions.raw.channels,inputDescriptor.rawPremultiplied=!!inputOptions.raw.premultiplied,input.constructor){case Uint8Array:case Uint8ClampedArray:inputDescriptor.rawDepth="uchar";break;case Int8Array:inputDescriptor.rawDepth="char";break;case Uint16Array:inputDescriptor.rawDepth="ushort";break;case Int16Array:inputDescriptor.rawDepth="short";break;case Uint32Array:inputDescriptor.rawDepth="uint";break;case Int32Array:inputDescriptor.rawDepth="int";break;case Float32Array:inputDescriptor.rawDepth="float";break;case Float64Array:inputDescriptor.rawDepth="double";break;default:inputDescriptor.rawDepth="uchar";break}else throw Error("Expected width, height and channels for raw pixel input");if(is2.defined(inputOptions.animated))if(is2.bool(inputOptions.animated))inputDescriptor.pages=inputOptions.animated?-1:1;else throw is2.invalidParameterError("animated","boolean",inputOptions.animated);if(is2.defined(inputOptions.pages))if(is2.integer(inputOptions.pages)&&is2.inRange(inputOptions.pages,-1,1e5))inputDescriptor.pages=inputOptions.pages;else throw is2.invalidParameterError("pages","integer between -1 and 100000",inputOptions.pages);if(is2.defined(inputOptions.page))if(is2.integer(inputOptions.page)&&is2.inRange(inputOptions.page,0,1e5))inputDescriptor.page=inputOptions.page;else throw is2.invalidParameterError("page","integer between 0 and 100000",inputOptions.page);if(is2.defined(inputOptions.level))if(is2.integer(inputOptions.level)&&is2.inRange(inputOptions.level,0,256))inputDescriptor.level=inputOptions.level;else throw is2.invalidParameterError("level","integer between 0 and 256",inputOptions.level);if(is2.defined(inputOptions.subifd))if(is2.integer(inputOptions.subifd)&&is2.inRange(inputOptions.subifd,-1,1e5))inputDescriptor.subifd=inputOptions.subifd;else throw is2.invalidParameterError("subifd","integer between -1 and 100000",inputOptions.subifd);if(is2.defined(inputOptions.create))if(is2.object(inputOptions.create)&&is2.integer(inputOptions.create.width)&&inputOptions.create.width>0&&is2.integer(inputOptions.create.height)&&inputOptions.create.height>0&&is2.integer(inputOptions.create.channels)){if(inputDescriptor.createWidth=inputOptions.create.width,inputDescriptor.createHeight=inputOptions.create.height,inputDescriptor.createChannels=inputOptions.create.channels,is2.defined(inputOptions.create.noise)){if(!is2.object(inputOptions.create.noise))throw Error("Expected noise to be an object");if(!is2.inArray(inputOptions.create.noise.type,["gaussian"]))throw Error("Only gaussian noise is supported at the moment");if(!is2.inRange(inputOptions.create.channels,1,4))throw is2.invalidParameterError("create.channels","number between 1 and 4",inputOptions.create.channels);if(inputDescriptor.createNoiseType=inputOptions.create.noise.type,is2.number(inputOptions.create.noise.mean)&&is2.inRange(inputOptions.create.noise.mean,0,1e4))inputDescriptor.createNoiseMean=inputOptions.create.noise.mean;else throw is2.invalidParameterError("create.noise.mean","number between 0 and 10000",inputOptions.create.noise.mean);if(is2.number(inputOptions.create.noise.sigma)&&is2.inRange(inputOptions.create.noise.sigma,0,1e4))inputDescriptor.createNoiseSigma=inputOptions.create.noise.sigma;else throw is2.invalidParameterError("create.noise.sigma","number between 0 and 10000",inputOptions.create.noise.sigma)}else if(is2.defined(inputOptions.create.background)){if(!is2.inRange(inputOptions.create.channels,3,4))throw is2.invalidParameterError("create.channels","number between 3 and 4",inputOptions.create.channels);let background=color(inputOptions.create.background);inputDescriptor.createBackground=[background.red(),background.green(),background.blue(),Math.round(background.alpha()*255)]}else throw Error("Expected valid noise or background to create a new input image");delete inputDescriptor.buffer}else throw Error("Expected valid width, height and channels to create a new input image");if(is2.defined(inputOptions.text))if(is2.object(inputOptions.text)&&is2.string(inputOptions.text.text)){if(inputDescriptor.textValue=inputOptions.text.text,is2.defined(inputOptions.text.height)&&is2.defined(inputOptions.text.dpi))throw Error("Expected only one of dpi or height");if(is2.defined(inputOptions.text.font))if(is2.string(inputOptions.text.font))inputDescriptor.textFont=inputOptions.text.font;else throw is2.invalidParameterError("text.font","string",inputOptions.text.font);if(is2.defined(inputOptions.text.fontfile))if(is2.string(inputOptions.text.fontfile))inputDescriptor.textFontfile=inputOptions.text.fontfile;else throw is2.invalidParameterError("text.fontfile","string",inputOptions.text.fontfile);if(is2.defined(inputOptions.text.width))if(is2.integer(inputOptions.text.width)&&inputOptions.text.width>0)inputDescriptor.textWidth=inputOptions.text.width;else throw is2.invalidParameterError("text.width","positive integer",inputOptions.text.width);if(is2.defined(inputOptions.text.height))if(is2.integer(inputOptions.text.height)&&inputOptions.text.height>0)inputDescriptor.textHeight=inputOptions.text.height;else throw is2.invalidParameterError("text.height","positive integer",inputOptions.text.height);if(is2.defined(inputOptions.text.align))if(is2.string(inputOptions.text.align)&&is2.string(this.constructor.align[inputOptions.text.align]))inputDescriptor.textAlign=this.constructor.align[inputOptions.text.align];else throw is2.invalidParameterError("text.align","valid alignment",inputOptions.text.align);if(is2.defined(inputOptions.text.justify))if(is2.bool(inputOptions.text.justify))inputDescriptor.textJustify=inputOptions.text.justify;else throw is2.invalidParameterError("text.justify","boolean",inputOptions.text.justify);if(is2.defined(inputOptions.text.dpi))if(is2.integer(inputOptions.text.dpi)&&is2.inRange(inputOptions.text.dpi,1,1e6))inputDescriptor.textDpi=inputOptions.text.dpi;else throw is2.invalidParameterError("text.dpi","integer between 1 and 1000000",inputOptions.text.dpi);if(is2.defined(inputOptions.text.rgba))if(is2.bool(inputOptions.text.rgba))inputDescriptor.textRgba=inputOptions.text.rgba;else throw is2.invalidParameterError("text.rgba","bool",inputOptions.text.rgba);if(is2.defined(inputOptions.text.spacing))if(is2.integer(inputOptions.text.spacing)&&is2.inRange(inputOptions.text.spacing,-1e6,1e6))inputDescriptor.textSpacing=inputOptions.text.spacing;else throw is2.invalidParameterError("text.spacing","integer between -1000000 and 1000000",inputOptions.text.spacing);if(is2.defined(inputOptions.text.wrap))if(is2.string(inputOptions.text.wrap)&&is2.inArray(inputOptions.text.wrap,["word","char","word-char","none"]))inputDescriptor.textWrap=inputOptions.text.wrap;else throw is2.invalidParameterError("text.wrap","one of: word, char, word-char, none",inputOptions.text.wrap);delete inputDescriptor.buffer}else throw Error("Expected a valid string to create an image with text.")}else if(is2.defined(inputOptions))throw Error("Invalid input options "+inputOptions);return inputDescriptor}function _write(chunk,encoding,callback){if(Array.isArray(this.options.input.buffer))if(is2.buffer(chunk)){if(this.options.input.buffer.length===0)this.on("finish",()=>{this.streamInFinished=!0});this.options.input.buffer.push(chunk),callback()}else callback(Error("Non-Buffer data on Writable Stream"));else callback(Error("Unexpected data on Writable Stream"))}function _flattenBufferIn(){if(this._isStreamInput())this.options.input.buffer=Buffer.concat(this.options.input.buffer)}function _isStreamInput(){return Array.isArray(this.options.input.buffer)}function metadata(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)})});else sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{let finished=()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})};if(this.writableFinished)finished();else this.once("finish",finished)});else return new Promise((resolve2,reject)=>{sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})})}function stats(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)})});else sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.on("finish",function(){this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})});else return new Promise((resolve2,reject)=>{sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{_inputOptionsFromObject,_createInputDescriptor,_write,_flattenBufferIn,_isStreamInput,metadata,stats}),Sharp.align=align}});var require_resize=__commonJS((exports,module3)=>{var is2=require_is(),gravity={center:0,centre:0,north:1,east:2,south:3,west:4,northeast:5,southeast:6,southwest:7,northwest:8},position={top:1,right:2,bottom:3,left:4,"right top":5,"right bottom":6,"left bottom":7,"left top":8},extendWith={background:"background",copy:"copy",repeat:"repeat",mirror:"mirror"},strategy={entropy:16,attention:17},kernel={nearest:"nearest",linear:"linear",cubic:"cubic",mitchell:"mitchell",lanczos2:"lanczos2",lanczos3:"lanczos3"},fit={contain:"contain",cover:"cover",fill:"fill",inside:"inside",outside:"outside"},mapFitToCanvas={contain:"embed",cover:"crop",fill:"ignore_aspect",inside:"max",outside:"min"};function isRotationExpected(options){return options.angle%360!==0||options.useExifOrientation===!0||options.rotationAngle!==0}function isResizeExpected(options){return options.width!==-1||options.height!==-1}function resize(widthOrOptions,height,options){if(isResizeExpected(this.options))this.options.debuglog("ignoring previous resize options");if(this.options.widthPost!==-1)this.options.debuglog("operation order will be: extract, resize, extract");if(is2.defined(widthOrOptions))if(is2.object(widthOrOptions)&&!is2.defined(options))options=widthOrOptions;else if(is2.integer(widthOrOptions)&&widthOrOptions>0)this.options.width=widthOrOptions;else throw is2.invalidParameterError("width","positive integer",widthOrOptions);else this.options.width=-1;if(is2.defined(height))if(is2.integer(height)&&height>0)this.options.height=height;else throw is2.invalidParameterError("height","positive integer",height);else this.options.height=-1;if(is2.object(options)){if(is2.defined(options.width))if(is2.integer(options.width)&&options.width>0)this.options.width=options.width;else throw is2.invalidParameterError("width","positive integer",options.width);if(is2.defined(options.height))if(is2.integer(options.height)&&options.height>0)this.options.height=options.height;else throw is2.invalidParameterError("height","positive integer",options.height);if(is2.defined(options.fit)){let canvas=mapFitToCanvas[options.fit];if(is2.string(canvas))this.options.canvas=canvas;else throw is2.invalidParameterError("fit","valid fit",options.fit)}if(is2.defined(options.position)){let pos=is2.integer(options.position)?options.position:strategy[options.position]||position[options.position]||gravity[options.position];if(is2.integer(pos)&&(is2.inRange(pos,0,8)||is2.inRange(pos,16,17)))this.options.position=pos;else throw is2.invalidParameterError("position","valid position/gravity/strategy",options.position)}if(this._setBackgroundColourOption("resizeBackground",options.background),is2.defined(options.kernel))if(is2.string(kernel[options.kernel]))this.options.kernel=kernel[options.kernel];else throw is2.invalidParameterError("kernel","valid kernel name",options.kernel);if(is2.defined(options.withoutEnlargement))this._setBooleanOption("withoutEnlargement",options.withoutEnlargement);if(is2.defined(options.withoutReduction))this._setBooleanOption("withoutReduction",options.withoutReduction);if(is2.defined(options.fastShrinkOnLoad))this._setBooleanOption("fastShrinkOnLoad",options.fastShrinkOnLoad)}if(isRotationExpected(this.options)&&isResizeExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}function extend(extend2){if(is2.integer(extend2)&&extend2>0)this.options.extendTop=extend2,this.options.extendBottom=extend2,this.options.extendLeft=extend2,this.options.extendRight=extend2;else if(is2.object(extend2)){if(is2.defined(extend2.top))if(is2.integer(extend2.top)&&extend2.top>=0)this.options.extendTop=extend2.top;else throw is2.invalidParameterError("top","positive integer",extend2.top);if(is2.defined(extend2.bottom))if(is2.integer(extend2.bottom)&&extend2.bottom>=0)this.options.extendBottom=extend2.bottom;else throw is2.invalidParameterError("bottom","positive integer",extend2.bottom);if(is2.defined(extend2.left))if(is2.integer(extend2.left)&&extend2.left>=0)this.options.extendLeft=extend2.left;else throw is2.invalidParameterError("left","positive integer",extend2.left);if(is2.defined(extend2.right))if(is2.integer(extend2.right)&&extend2.right>=0)this.options.extendRight=extend2.right;else throw is2.invalidParameterError("right","positive integer",extend2.right);if(this._setBackgroundColourOption("extendBackground",extend2.background),is2.defined(extend2.extendWith))if(is2.string(extendWith[extend2.extendWith]))this.options.extendWith=extendWith[extend2.extendWith];else throw is2.invalidParameterError("extendWith","one of: background, copy, repeat, mirror",extend2.extendWith)}else throw is2.invalidParameterError("extend","integer or object",extend2);return this}function extract3(options){let suffix=isResizeExpected(this.options)||this.options.widthPre!==-1?"Post":"Pre";if(this.options[`width${suffix}`]!==-1)this.options.debuglog("ignoring previous extract options");if(["left","top","width","height"].forEach(function(name2){let value2=options[name2];if(is2.integer(value2)&&value2>=0)this.options[name2+(name2==="left"||name2==="top"?"Offset":"")+suffix]=value2;else throw is2.invalidParameterError(name2,"integer",value2)},this),isRotationExpected(this.options)&&!isResizeExpected(this.options)){if(this.options.widthPre===-1||this.options.widthPost===-1)this.options.rotateBeforePreExtract=!0}return this}function trim(options){if(this.options.trimThreshold=10,is2.defined(options))if(is2.object(options)){if(is2.defined(options.background))this._setBackgroundColourOption("trimBackground",options.background);if(is2.defined(options.threshold))if(is2.number(options.threshold)&&options.threshold>=0)this.options.trimThreshold=options.threshold;else throw is2.invalidParameterError("threshold","positive number",options.threshold);if(is2.defined(options.lineArt))this._setBooleanOption("trimLineArt",options.lineArt)}else throw is2.invalidParameterError("trim","object",options);if(isRotationExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{resize,extend,extract:extract3,trim}),Sharp.gravity=gravity,Sharp.strategy=strategy,Sharp.kernel=kernel,Sharp.fit=fit,Sharp.position=position}});var require_composite=__commonJS((exports,module3)=>{var is2=require_is(),blend={clear:"clear",source:"source",over:"over",in:"in",out:"out",atop:"atop",dest:"dest","dest-over":"dest-over","dest-in":"dest-in","dest-out":"dest-out","dest-atop":"dest-atop",xor:"xor",add:"add",saturate:"saturate",multiply:"multiply",screen:"screen",overlay:"overlay",darken:"darken",lighten:"lighten","colour-dodge":"colour-dodge","color-dodge":"colour-dodge","colour-burn":"colour-burn","color-burn":"colour-burn","hard-light":"hard-light","soft-light":"soft-light",difference:"difference",exclusion:"exclusion"};function composite3(images){if(!Array.isArray(images))throw is2.invalidParameterError("images to composite","array",images);return this.options.composite=images.map((image)=>{if(!is2.object(image))throw is2.invalidParameterError("image to composite","object",image);let inputOptions=this._inputOptionsFromObject(image),composite4={input:this._createInputDescriptor(image.input,inputOptions,{allowStream:!1}),blend:"over",tile:!1,left:0,top:0,hasOffset:!1,gravity:0,premultiplied:!1};if(is2.defined(image.blend))if(is2.string(blend[image.blend]))composite4.blend=blend[image.blend];else throw is2.invalidParameterError("blend","valid blend name",image.blend);if(is2.defined(image.tile))if(is2.bool(image.tile))composite4.tile=image.tile;else throw is2.invalidParameterError("tile","boolean",image.tile);if(is2.defined(image.left))if(is2.integer(image.left))composite4.left=image.left;else throw is2.invalidParameterError("left","integer",image.left);if(is2.defined(image.top))if(is2.integer(image.top))composite4.top=image.top;else throw is2.invalidParameterError("top","integer",image.top);if(is2.defined(image.top)!==is2.defined(image.left))throw Error("Expected both left and top to be set");else composite4.hasOffset=is2.integer(image.top)&&is2.integer(image.left);if(is2.defined(image.gravity))if(is2.integer(image.gravity)&&is2.inRange(image.gravity,0,8))composite4.gravity=image.gravity;else if(is2.string(image.gravity)&&is2.integer(this.constructor.gravity[image.gravity]))composite4.gravity=this.constructor.gravity[image.gravity];else throw is2.invalidParameterError("gravity","valid gravity",image.gravity);if(is2.defined(image.premultiplied))if(is2.bool(image.premultiplied))composite4.premultiplied=image.premultiplied;else throw is2.invalidParameterError("premultiplied","boolean",image.premultiplied);return composite4}),this}module3.exports=function(Sharp){Sharp.prototype.composite=composite3,Sharp.blend=blend}});var require_operation=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),vipsPrecision={integer:"integer",float:"float",approximate:"approximate"};function rotate(angle,options){if(this.options.useExifOrientation||this.options.angle||this.options.rotationAngle)this.options.debuglog("ignoring previous rotate options");if(!is2.defined(angle))this.options.useExifOrientation=!0;else if(is2.integer(angle)&&!(angle%90))this.options.angle=angle;else if(is2.number(angle)){if(this.options.rotationAngle=angle,is2.object(options)&&options.background){let backgroundColour=color(options.background);this.options.rotationBackground=[backgroundColour.red(),backgroundColour.green(),backgroundColour.blue(),Math.round(backgroundColour.alpha()*255)]}}else throw is2.invalidParameterError("angle","numeric",angle);return this}function flip(flip2){return this.options.flip=is2.bool(flip2)?flip2:!0,this}function flop(flop2){return this.options.flop=is2.bool(flop2)?flop2:!0,this}function affine(matrix,options){let flatMatrix=[].concat(...matrix);if(flatMatrix.length===4&&flatMatrix.every(is2.number))this.options.affineMatrix=flatMatrix;else throw is2.invalidParameterError("matrix","1x4 or 2x2 array",matrix);if(is2.defined(options))if(is2.object(options)){if(this._setBackgroundColourOption("affineBackground",options.background),is2.defined(options.idx))if(is2.number(options.idx))this.options.affineIdx=options.idx;else throw is2.invalidParameterError("options.idx","number",options.idx);if(is2.defined(options.idy))if(is2.number(options.idy))this.options.affineIdy=options.idy;else throw is2.invalidParameterError("options.idy","number",options.idy);if(is2.defined(options.odx))if(is2.number(options.odx))this.options.affineOdx=options.odx;else throw is2.invalidParameterError("options.odx","number",options.odx);if(is2.defined(options.ody))if(is2.number(options.ody))this.options.affineOdy=options.ody;else throw is2.invalidParameterError("options.ody","number",options.ody);if(is2.defined(options.interpolator))if(is2.inArray(options.interpolator,Object.values(this.constructor.interpolators)))this.options.affineInterpolator=options.interpolator;else throw is2.invalidParameterError("options.interpolator","valid interpolator name",options.interpolator)}else throw is2.invalidParameterError("options","object",options);return this}function sharpen(options,flat,jagged){if(!is2.defined(options))this.options.sharpenSigma=-1;else if(is2.bool(options))this.options.sharpenSigma=options?-1:0;else if(is2.number(options)&&is2.inRange(options,0.01,1e4)){if(this.options.sharpenSigma=options,is2.defined(flat))if(is2.number(flat)&&is2.inRange(flat,0,1e4))this.options.sharpenM1=flat;else throw is2.invalidParameterError("flat","number between 0 and 10000",flat);if(is2.defined(jagged))if(is2.number(jagged)&&is2.inRange(jagged,0,1e4))this.options.sharpenM2=jagged;else throw is2.invalidParameterError("jagged","number between 0 and 10000",jagged)}else if(is2.plainObject(options)){if(is2.number(options.sigma)&&is2.inRange(options.sigma,0.000001,10))this.options.sharpenSigma=options.sigma;else throw is2.invalidParameterError("options.sigma","number between 0.000001 and 10",options.sigma);if(is2.defined(options.m1))if(is2.number(options.m1)&&is2.inRange(options.m1,0,1e6))this.options.sharpenM1=options.m1;else throw is2.invalidParameterError("options.m1","number between 0 and 1000000",options.m1);if(is2.defined(options.m2))if(is2.number(options.m2)&&is2.inRange(options.m2,0,1e6))this.options.sharpenM2=options.m2;else throw is2.invalidParameterError("options.m2","number between 0 and 1000000",options.m2);if(is2.defined(options.x1))if(is2.number(options.x1)&&is2.inRange(options.x1,0,1e6))this.options.sharpenX1=options.x1;else throw is2.invalidParameterError("options.x1","number between 0 and 1000000",options.x1);if(is2.defined(options.y2))if(is2.number(options.y2)&&is2.inRange(options.y2,0,1e6))this.options.sharpenY2=options.y2;else throw is2.invalidParameterError("options.y2","number between 0 and 1000000",options.y2);if(is2.defined(options.y3))if(is2.number(options.y3)&&is2.inRange(options.y3,0,1e6))this.options.sharpenY3=options.y3;else throw is2.invalidParameterError("options.y3","number between 0 and 1000000",options.y3)}else throw is2.invalidParameterError("sigma","number between 0.01 and 10000",options);return this}function median2(size){if(!is2.defined(size))this.options.medianSize=3;else if(is2.integer(size)&&is2.inRange(size,1,1000))this.options.medianSize=size;else throw is2.invalidParameterError("size","integer between 1 and 1000",size);return this}function blur(options){let sigma;if(is2.number(options))sigma=options;else if(is2.plainObject(options)){if(!is2.number(options.sigma))throw is2.invalidParameterError("options.sigma","number between 0.3 and 1000",sigma);if(sigma=options.sigma,"precision"in options)if(is2.string(vipsPrecision[options.precision]))this.options.precision=vipsPrecision[options.precision];else throw is2.invalidParameterError("precision","one of: integer, float, approximate",options.precision);if("minAmplitude"in options)if(is2.number(options.minAmplitude)&&is2.inRange(options.minAmplitude,0.001,1))this.options.minAmpl=options.minAmplitude;else throw is2.invalidParameterError("minAmplitude","number between 0.001 and 1",options.minAmplitude)}if(!is2.defined(options))this.options.blurSigma=-1;else if(is2.bool(options))this.options.blurSigma=options?-1:0;else if(is2.number(sigma)&&is2.inRange(sigma,0.3,1000))this.options.blurSigma=sigma;else throw is2.invalidParameterError("sigma","number between 0.3 and 1000",sigma);return this}function flatten(options){if(this.options.flatten=is2.bool(options)?options:!0,is2.object(options))this._setBackgroundColourOption("flattenBackground",options.background);return this}function unflatten(){return this.options.unflatten=!0,this}function gamma(gamma2,gammaOut){if(!is2.defined(gamma2))this.options.gamma=2.2;else if(is2.number(gamma2)&&is2.inRange(gamma2,1,3))this.options.gamma=gamma2;else throw is2.invalidParameterError("gamma","number between 1.0 and 3.0",gamma2);if(!is2.defined(gammaOut))this.options.gammaOut=this.options.gamma;else if(is2.number(gammaOut)&&is2.inRange(gammaOut,1,3))this.options.gammaOut=gammaOut;else throw is2.invalidParameterError("gammaOut","number between 1.0 and 3.0",gammaOut);return this}function negate(options){if(this.options.negate=is2.bool(options)?options:!0,is2.plainObject(options)&&"alpha"in options)if(!is2.bool(options.alpha))throw is2.invalidParameterError("alpha","should be boolean value",options.alpha);else this.options.negateAlpha=options.alpha;return this}function normalise(options){if(is2.plainObject(options)){if(is2.defined(options.lower))if(is2.number(options.lower)&&is2.inRange(options.lower,0,99))this.options.normaliseLower=options.lower;else throw is2.invalidParameterError("lower","number between 0 and 99",options.lower);if(is2.defined(options.upper))if(is2.number(options.upper)&&is2.inRange(options.upper,1,100))this.options.normaliseUpper=options.upper;else throw is2.invalidParameterError("upper","number between 1 and 100",options.upper)}if(this.options.normaliseLower>=this.options.normaliseUpper)throw is2.invalidParameterError("range","lower to be less than upper",`${this.options.normaliseLower} >= ${this.options.normaliseUpper}`);return this.options.normalise=!0,this}function normalize3(options){return this.normalise(options)}function clahe(options){if(is2.plainObject(options)){if(is2.integer(options.width)&&options.width>0)this.options.claheWidth=options.width;else throw is2.invalidParameterError("width","integer greater than zero",options.width);if(is2.integer(options.height)&&options.height>0)this.options.claheHeight=options.height;else throw is2.invalidParameterError("height","integer greater than zero",options.height);if(is2.defined(options.maxSlope))if(is2.integer(options.maxSlope)&&is2.inRange(options.maxSlope,0,100))this.options.claheMaxSlope=options.maxSlope;else throw is2.invalidParameterError("maxSlope","integer between 0 and 100",options.maxSlope)}else throw is2.invalidParameterError("options","plain object",options);return this}function convolve(kernel){if(!is2.object(kernel)||!Array.isArray(kernel.kernel)||!is2.integer(kernel.width)||!is2.integer(kernel.height)||!is2.inRange(kernel.width,3,1001)||!is2.inRange(kernel.height,3,1001)||kernel.height*kernel.width!==kernel.kernel.length)throw Error("Invalid convolution kernel");if(!is2.integer(kernel.scale))kernel.scale=kernel.kernel.reduce(function(a,b){return a+b},0);if(kernel.scale<1)kernel.scale=1;if(!is2.integer(kernel.offset))kernel.offset=0;return this.options.convKernel=kernel,this}function threshold(threshold2,options){if(!is2.defined(threshold2))this.options.threshold=128;else if(is2.bool(threshold2))this.options.threshold=threshold2?128:0;else if(is2.integer(threshold2)&&is2.inRange(threshold2,0,255))this.options.threshold=threshold2;else throw is2.invalidParameterError("threshold","integer between 0 and 255",threshold2);if(!is2.object(options)||options.greyscale===!0||options.grayscale===!0)this.options.thresholdGrayscale=!0;else this.options.thresholdGrayscale=!1;return this}function boolean3(operand,operator,options){if(this.options.boolean=this._createInputDescriptor(operand,options),is2.string(operator)&&is2.inArray(operator,["and","or","eor"]))this.options.booleanOp=operator;else throw is2.invalidParameterError("operator","one of: and, or, eor",operator);return this}function linear(a,b){if(!is2.defined(a)&&is2.number(b))a=1;else if(is2.number(a)&&!is2.defined(b))b=0;if(!is2.defined(a))this.options.linearA=[];else if(is2.number(a))this.options.linearA=[a];else if(Array.isArray(a)&&a.length&&a.every(is2.number))this.options.linearA=a;else throw is2.invalidParameterError("a","number or array of numbers",a);if(!is2.defined(b))this.options.linearB=[];else if(is2.number(b))this.options.linearB=[b];else if(Array.isArray(b)&&b.length&&b.every(is2.number))this.options.linearB=b;else throw is2.invalidParameterError("b","number or array of numbers",b);if(this.options.linearA.length!==this.options.linearB.length)throw Error("Expected a and b to be arrays of the same length");return this}function recomb(inputMatrix){if(!Array.isArray(inputMatrix))throw is2.invalidParameterError("inputMatrix","array",inputMatrix);if(inputMatrix.length!==3&&inputMatrix.length!==4)throw is2.invalidParameterError("inputMatrix","3x3 or 4x4 array",inputMatrix.length);let recombMatrix=inputMatrix.flat().map(Number);if(recombMatrix.length!==9&&recombMatrix.length!==16)throw is2.invalidParameterError("inputMatrix","cardinality of 9 or 16",recombMatrix.length);return this.options.recombMatrix=recombMatrix,this}function modulate(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","plain object",options);if("brightness"in options)if(is2.number(options.brightness)&&options.brightness>=0)this.options.brightness=options.brightness;else throw is2.invalidParameterError("brightness","number above zero",options.brightness);if("saturation"in options)if(is2.number(options.saturation)&&options.saturation>=0)this.options.saturation=options.saturation;else throw is2.invalidParameterError("saturation","number above zero",options.saturation);if("hue"in options)if(is2.integer(options.hue))this.options.hue=options.hue%360;else throw is2.invalidParameterError("hue","number",options.hue);if("lightness"in options)if(is2.number(options.lightness))this.options.lightness=options.lightness;else throw is2.invalidParameterError("lightness","number",options.lightness);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{rotate,flip,flop,affine,sharpen,median:median2,blur,flatten,unflatten,gamma,negate,normalise,normalize:normalize3,clahe,convolve,threshold,boolean:boolean3,linear,recomb,modulate})}});var require_colour=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),colourspace={multiband:"multiband","b-w":"b-w",bw:"b-w",cmyk:"cmyk",srgb:"srgb"};function tint(tint2){return this._setBackgroundColourOption("tint",tint2),this}function greyscale(greyscale2){return this.options.greyscale=is2.bool(greyscale2)?greyscale2:!0,this}function grayscale(grayscale2){return this.greyscale(grayscale2)}function pipelineColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspacePipeline=colourspace2,this}function pipelineColorspace(colorspace){return this.pipelineColourspace(colorspace)}function toColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspace=colourspace2,this}function toColorspace(colorspace){return this.toColourspace(colorspace)}function _setBackgroundColourOption(key2,value2){if(is2.defined(value2))if(is2.object(value2)||is2.string(value2)){let colour=color(value2);this.options[key2]=[colour.red(),colour.green(),colour.blue(),Math.round(colour.alpha()*255)]}else throw is2.invalidParameterError("background","object or string",value2)}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{tint,greyscale,grayscale,pipelineColourspace,pipelineColorspace,toColourspace,toColorspace,_setBackgroundColourOption}),Sharp.colourspace=colourspace,Sharp.colorspace=colourspace}});var require_channel=__commonJS((exports,module3)=>{var is2=require_is(),bool={and:"and",or:"or",eor:"eor"};function removeAlpha(){return this.options.removeAlpha=!0,this}function ensureAlpha(alpha){if(is2.defined(alpha))if(is2.number(alpha)&&is2.inRange(alpha,0,1))this.options.ensureAlpha=alpha;else throw is2.invalidParameterError("alpha","number between 0 and 1",alpha);else this.options.ensureAlpha=1;return this}function extractChannel(channel){let channelMap={red:0,green:1,blue:2,alpha:3};if(Object.keys(channelMap).includes(channel))channel=channelMap[channel];if(is2.integer(channel)&&is2.inRange(channel,0,4))this.options.extractChannel=channel;else throw is2.invalidParameterError("channel","integer or one of: red, green, blue, alpha",channel);return this}function joinChannel(images,options){if(Array.isArray(images))images.forEach(function(image){this.options.joinChannelIn.push(this._createInputDescriptor(image,options))},this);else this.options.joinChannelIn.push(this._createInputDescriptor(images,options));return this}function bandbool(boolOp){if(is2.string(boolOp)&&is2.inArray(boolOp,["and","or","eor"]))this.options.bandBoolOp=boolOp;else throw is2.invalidParameterError("boolOp","one of: and, or, eor",boolOp);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{removeAlpha,ensureAlpha,extractChannel,joinChannel,bandbool}),Sharp.bool=bool}});var require_output=__commonJS((exports,module3)=>{var path2=__require("path"),is2=require_is(),sharp=require_sharp(),formats2=new Map([["heic","heif"],["heif","heif"],["avif","avif"],["jpeg","jpeg"],["jpg","jpeg"],["jpe","jpeg"],["tile","tile"],["dz","tile"],["png","png"],["raw","raw"],["tiff","tiff"],["tif","tiff"],["webp","webp"],["gif","gif"],["jp2","jp2"],["jpx","jp2"],["j2k","jp2"],["j2c","jp2"],["jxl","jxl"]]),jp2Regex=/\.(jp[2x]|j2[kc])$/i,errJp2Save=()=>Error("JP2 output requires libvips with support for OpenJPEG"),bitdepthFromColourCount=(colours)=>1<<31-Math.clz32(Math.ceil(Math.log2(colours)));function toFile(fileOut,callback){let err;if(!is2.string(fileOut))err=Error("Missing output file path");else if(is2.string(this.options.input.file)&&path2.resolve(this.options.input.file)===path2.resolve(fileOut))err=Error("Cannot use same file for input and output");else if(jp2Regex.test(path2.extname(fileOut))&&!this.constructor.format.jp2k.output.file)err=errJp2Save();if(err)if(is2.fn(callback))callback(err);else return Promise.reject(err);else{this.options.fileOut=fileOut;let stack=Error();return this._pipeline(callback,stack)}return this}function toBuffer2(options,callback){if(is2.object(options))this._setBooleanOption("resolveWithObject",options.resolveWithObject);else if(this.options.resolveWithObject)this.options.resolveWithObject=!1;this.options.fileOut="";let stack=Error();return this._pipeline(is2.fn(options)?options:callback,stack)}function keepExif(){return this.options.keepMetadata|=1,this}function withExif(exif){if(is2.object(exif))for(let[ifd,entries]of Object.entries(exif))if(is2.object(entries))for(let[k,v]of Object.entries(entries))if(is2.string(v))this.options.withExif[`exif-${ifd.toLowerCase()}-${k}`]=v;else throw is2.invalidParameterError(`${ifd}.${k}`,"string",v);else throw is2.invalidParameterError(ifd,"object",entries);else throw is2.invalidParameterError("exif","object",exif);return this.options.withExifMerge=!1,this.keepExif()}function withExifMerge(exif){return this.withExif(exif),this.options.withExifMerge=!0,this}function keepIccProfile(){return this.options.keepMetadata|=8,this}function withIccProfile(icc,options){if(is2.string(icc))this.options.withIccProfile=icc;else throw is2.invalidParameterError("icc","string",icc);if(this.keepIccProfile(),is2.object(options)){if(is2.defined(options.attach))if(is2.bool(options.attach)){if(!options.attach)this.options.keepMetadata&=-9}else throw is2.invalidParameterError("attach","boolean",options.attach)}return this}function keepMetadata(){return this.options.keepMetadata=31,this}function withMetadata(options){if(this.keepMetadata(),this.withIccProfile("srgb"),is2.object(options)){if(is2.defined(options.orientation))if(is2.integer(options.orientation)&&is2.inRange(options.orientation,1,8))this.options.withMetadataOrientation=options.orientation;else throw is2.invalidParameterError("orientation","integer between 1 and 8",options.orientation);if(is2.defined(options.density))if(is2.number(options.density)&&options.density>0)this.options.withMetadataDensity=options.density;else throw is2.invalidParameterError("density","positive number",options.density);if(is2.defined(options.icc))this.withIccProfile(options.icc);if(is2.defined(options.exif))this.withExifMerge(options.exif)}return this}function toFormat(format2,options){let actualFormat=formats2.get((is2.object(format2)&&is2.string(format2.id)?format2.id:format2).toLowerCase());if(!actualFormat)throw is2.invalidParameterError("format",`one of: ${[...formats2.keys()].join(", ")}`,format2);return this[actualFormat](options)}function jpeg(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jpegQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.progressive))this._setBooleanOption("jpegProgressive",options.progressive);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jpegChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);let optimiseCoding=is2.bool(options.optimizeCoding)?options.optimizeCoding:options.optimiseCoding;if(is2.defined(optimiseCoding))this._setBooleanOption("jpegOptimiseCoding",optimiseCoding);if(is2.defined(options.mozjpeg))if(is2.bool(options.mozjpeg)){if(options.mozjpeg)this.options.jpegTrellisQuantisation=!0,this.options.jpegOvershootDeringing=!0,this.options.jpegOptimiseScans=!0,this.options.jpegProgressive=!0,this.options.jpegQuantisationTable=3}else throw is2.invalidParameterError("mozjpeg","boolean",options.mozjpeg);let trellisQuantisation=is2.bool(options.trellisQuantization)?options.trellisQuantization:options.trellisQuantisation;if(is2.defined(trellisQuantisation))this._setBooleanOption("jpegTrellisQuantisation",trellisQuantisation);if(is2.defined(options.overshootDeringing))this._setBooleanOption("jpegOvershootDeringing",options.overshootDeringing);let optimiseScans=is2.bool(options.optimizeScans)?options.optimizeScans:options.optimiseScans;if(is2.defined(optimiseScans)){if(this._setBooleanOption("jpegOptimiseScans",optimiseScans),optimiseScans)this.options.jpegProgressive=!0}let quantisationTable=is2.number(options.quantizationTable)?options.quantizationTable:options.quantisationTable;if(is2.defined(quantisationTable))if(is2.integer(quantisationTable)&&is2.inRange(quantisationTable,0,8))this.options.jpegQuantisationTable=quantisationTable;else throw is2.invalidParameterError("quantisationTable","integer between 0 and 8",quantisationTable)}return this._updateFormatOut("jpeg",options)}function png(options){if(is2.object(options)){if(is2.defined(options.progressive))this._setBooleanOption("pngProgressive",options.progressive);if(is2.defined(options.compressionLevel))if(is2.integer(options.compressionLevel)&&is2.inRange(options.compressionLevel,0,9))this.options.pngCompressionLevel=options.compressionLevel;else throw is2.invalidParameterError("compressionLevel","integer between 0 and 9",options.compressionLevel);if(is2.defined(options.adaptiveFiltering))this._setBooleanOption("pngAdaptiveFiltering",options.adaptiveFiltering);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.pngBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.palette))this._setBooleanOption("pngPalette",options.palette);else if([options.quality,options.effort,options.colours,options.colors,options.dither].some(is2.defined))this._setBooleanOption("pngPalette",!0);if(this.options.pngPalette){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,0,100))this.options.pngQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 0 and 100",options.quality);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,1,10))this.options.pngEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.pngDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither)}}return this._updateFormatOut("png",options)}function webp(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.webpQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.alphaQuality))if(is2.integer(options.alphaQuality)&&is2.inRange(options.alphaQuality,0,100))this.options.webpAlphaQuality=options.alphaQuality;else throw is2.invalidParameterError("alphaQuality","integer between 0 and 100",options.alphaQuality);if(is2.defined(options.lossless))this._setBooleanOption("webpLossless",options.lossless);if(is2.defined(options.nearLossless))this._setBooleanOption("webpNearLossless",options.nearLossless);if(is2.defined(options.smartSubsample))this._setBooleanOption("webpSmartSubsample",options.smartSubsample);if(is2.defined(options.preset))if(is2.string(options.preset)&&is2.inArray(options.preset,["default","photo","picture","drawing","icon","text"]))this.options.webpPreset=options.preset;else throw is2.invalidParameterError("preset","one of: default, photo, picture, drawing, icon, text",options.preset);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,6))this.options.webpEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 6",options.effort);if(is2.defined(options.minSize))this._setBooleanOption("webpMinSize",options.minSize);if(is2.defined(options.mixed))this._setBooleanOption("webpMixed",options.mixed)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("webp",options)}function gif(options){if(is2.object(options)){if(is2.defined(options.reuse))this._setBooleanOption("gifReuse",options.reuse);if(is2.defined(options.progressive))this._setBooleanOption("gifProgressive",options.progressive);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.gifBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.effort))if(is2.number(options.effort)&&is2.inRange(options.effort,1,10))this.options.gifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.gifDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither);if(is2.defined(options.interFrameMaxError))if(is2.number(options.interFrameMaxError)&&is2.inRange(options.interFrameMaxError,0,32))this.options.gifInterFrameMaxError=options.interFrameMaxError;else throw is2.invalidParameterError("interFrameMaxError","number between 0.0 and 32.0",options.interFrameMaxError);if(is2.defined(options.interPaletteMaxError))if(is2.number(options.interPaletteMaxError)&&is2.inRange(options.interPaletteMaxError,0,256))this.options.gifInterPaletteMaxError=options.interPaletteMaxError;else throw is2.invalidParameterError("interPaletteMaxError","number between 0.0 and 256.0",options.interPaletteMaxError)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("gif",options)}function jp2(options){if(!this.constructor.format.jp2k.output.buffer)throw errJp2Save();if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jp2Quality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jp2Lossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&is2.inRange(options.tileWidth,1,32768))this.options.jp2TileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer between 1 and 32768",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&is2.inRange(options.tileHeight,1,32768))this.options.jp2TileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer between 1 and 32768",options.tileHeight);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jp2ChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling)}return this._updateFormatOut("jp2",options)}function trySetAnimationOptions(source,target2){if(is2.object(source)&&is2.defined(source.loop))if(is2.integer(source.loop)&&is2.inRange(source.loop,0,65535))target2.loop=source.loop;else throw is2.invalidParameterError("loop","integer between 0 and 65535",source.loop);if(is2.object(source)&&is2.defined(source.delay))if(is2.integer(source.delay)&&is2.inRange(source.delay,0,65535))target2.delay=[source.delay];else if(Array.isArray(source.delay)&&source.delay.every(is2.integer)&&source.delay.every((v)=>is2.inRange(v,0,65535)))target2.delay=source.delay;else throw is2.invalidParameterError("delay","integer or an array of integers between 0 and 65535",source.delay)}function tiff(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.tiffQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[1,2,4,8]))this.options.tiffBitdepth=options.bitdepth;else throw is2.invalidParameterError("bitdepth","1, 2, 4 or 8",options.bitdepth);if(is2.defined(options.tile))this._setBooleanOption("tiffTile",options.tile);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&options.tileWidth>0)this.options.tiffTileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer greater than zero",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&options.tileHeight>0)this.options.tiffTileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer greater than zero",options.tileHeight);if(is2.defined(options.miniswhite))this._setBooleanOption("tiffMiniswhite",options.miniswhite);if(is2.defined(options.pyramid))this._setBooleanOption("tiffPyramid",options.pyramid);if(is2.defined(options.xres))if(is2.number(options.xres)&&options.xres>0)this.options.tiffXres=options.xres;else throw is2.invalidParameterError("xres","number greater than zero",options.xres);if(is2.defined(options.yres))if(is2.number(options.yres)&&options.yres>0)this.options.tiffYres=options.yres;else throw is2.invalidParameterError("yres","number greater than zero",options.yres);if(is2.defined(options.compression))if(is2.string(options.compression)&&is2.inArray(options.compression,["none","jpeg","deflate","packbits","ccittfax4","lzw","webp","zstd","jp2k"]))this.options.tiffCompression=options.compression;else throw is2.invalidParameterError("compression","one of: none, jpeg, deflate, packbits, ccittfax4, lzw, webp, zstd, jp2k",options.compression);if(is2.defined(options.predictor))if(is2.string(options.predictor)&&is2.inArray(options.predictor,["none","horizontal","float"]))this.options.tiffPredictor=options.predictor;else throw is2.invalidParameterError("predictor","one of: none, horizontal, float",options.predictor);if(is2.defined(options.resolutionUnit))if(is2.string(options.resolutionUnit)&&is2.inArray(options.resolutionUnit,["inch","cm"]))this.options.tiffResolutionUnit=options.resolutionUnit;else throw is2.invalidParameterError("resolutionUnit","one of: inch, cm",options.resolutionUnit)}return this._updateFormatOut("tiff",options)}function avif(options){return this.heif({...options,compression:"av1"})}function heif(options){if(is2.object(options)){if(is2.string(options.compression)&&is2.inArray(options.compression,["av1","hevc"]))this.options.heifCompression=options.compression;else throw is2.invalidParameterError("compression","one of: av1, hevc",options.compression);if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.heifQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.heifLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,9))this.options.heifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 9",options.effort);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.heifChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[8,10,12])){if(options.bitdepth!==8&&this.constructor.versions.heif)throw is2.invalidParameterError("bitdepth when using prebuilt binaries",8,options.bitdepth);this.options.heifBitdepth=options.bitdepth}else throw is2.invalidParameterError("bitdepth","8, 10 or 12",options.bitdepth)}else throw is2.invalidParameterError("options","Object",options);return this._updateFormatOut("heif",options)}function jxl(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jxlDistance=options.quality>=30?0.1+(100-options.quality)*0.09:0.017666666666666667*options.quality*options.quality-1.15*options.quality+25;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);else if(is2.defined(options.distance))if(is2.number(options.distance)&&is2.inRange(options.distance,0,15))this.options.jxlDistance=options.distance;else throw is2.invalidParameterError("distance","number between 0.0 and 15.0",options.distance);if(is2.defined(options.decodingTier))if(is2.integer(options.decodingTier)&&is2.inRange(options.decodingTier,0,4))this.options.jxlDecodingTier=options.decodingTier;else throw is2.invalidParameterError("decodingTier","integer between 0 and 4",options.decodingTier);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jxlLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,3,9))this.options.jxlEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 3 and 9",options.effort)}return this._updateFormatOut("jxl",options)}function raw(options){if(is2.object(options)){if(is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["char","uchar","short","ushort","int","uint","float","complex","double","dpcomplex"]))this.options.rawDepth=options.depth;else throw is2.invalidParameterError("depth","one of: char, uchar, short, ushort, int, uint, float, complex, double, dpcomplex",options.depth)}return this._updateFormatOut("raw")}function tile(options){if(is2.object(options)){if(is2.defined(options.size))if(is2.integer(options.size)&&is2.inRange(options.size,1,8192))this.options.tileSize=options.size;else throw is2.invalidParameterError("size","integer between 1 and 8192",options.size);if(is2.defined(options.overlap))if(is2.integer(options.overlap)&&is2.inRange(options.overlap,0,8192)){if(options.overlap>this.options.tileSize)throw is2.invalidParameterError("overlap",`<= size (${this.options.tileSize})`,options.overlap);this.options.tileOverlap=options.overlap}else throw is2.invalidParameterError("overlap","integer between 0 and 8192",options.overlap);if(is2.defined(options.container))if(is2.string(options.container)&&is2.inArray(options.container,["fs","zip"]))this.options.tileContainer=options.container;else throw is2.invalidParameterError("container","one of: fs, zip",options.container);if(is2.defined(options.layout))if(is2.string(options.layout)&&is2.inArray(options.layout,["dz","google","iiif","iiif3","zoomify"]))this.options.tileLayout=options.layout;else throw is2.invalidParameterError("layout","one of: dz, google, iiif, iiif3, zoomify",options.layout);if(is2.defined(options.angle))if(is2.integer(options.angle)&&!(options.angle%90))this.options.tileAngle=options.angle;else throw is2.invalidParameterError("angle","positive/negative multiple of 90",options.angle);if(this._setBackgroundColourOption("tileBackground",options.background),is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["onepixel","onetile","one"]))this.options.tileDepth=options.depth;else throw is2.invalidParameterError("depth","one of: onepixel, onetile, one",options.depth);if(is2.defined(options.skipBlanks))if(is2.integer(options.skipBlanks)&&is2.inRange(options.skipBlanks,-1,65535))this.options.tileSkipBlanks=options.skipBlanks;else throw is2.invalidParameterError("skipBlanks","integer between -1 and 255/65535",options.skipBlanks);else if(is2.defined(options.layout)&&options.layout==="google")this.options.tileSkipBlanks=5;let centre=is2.bool(options.center)?options.center:options.centre;if(is2.defined(centre))this._setBooleanOption("tileCentre",centre);if(is2.defined(options.id))if(is2.string(options.id))this.options.tileId=options.id;else throw is2.invalidParameterError("id","string",options.id);if(is2.defined(options.basename))if(is2.string(options.basename))this.options.tileBasename=options.basename;else throw is2.invalidParameterError("basename","string",options.basename)}if(is2.inArray(this.options.formatOut,["jpeg","png","webp"]))this.options.tileFormat=this.options.formatOut;else if(this.options.formatOut!=="input")throw is2.invalidParameterError("format","one of: jpeg, png, webp",this.options.formatOut);return this._updateFormatOut("dz")}function timeout(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","object",options);if(is2.integer(options.seconds)&&is2.inRange(options.seconds,0,3600))this.options.timeoutSeconds=options.seconds;else throw is2.invalidParameterError("seconds","integer between 0 and 3600",options.seconds);return this}function _updateFormatOut(formatOut,options){if(!(is2.object(options)&&options.force===!1))this.options.formatOut=formatOut;return this}function _setBooleanOption(key2,val){if(is2.bool(val))this.options[key2]=val;else throw is2.invalidParameterError(key2,"boolean",val)}function _read(){if(!this.options.streamOut){this.options.streamOut=!0;let stack=Error();this._pipeline(void 0,stack)}}function _pipeline(callback,stack){if(typeof callback==="function"){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)})});else sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)});return this}else if(this.options.streamOut){if(this._isStreamInput()){if(this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))})}),this.streamInFinished)this.emit("finish")}else sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})});else return new Promise((resolve2,reject)=>{sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{toFile,toBuffer:toBuffer2,keepExif,withExif,withExifMerge,keepIccProfile,withIccProfile,keepMetadata,withMetadata,toFormat,jpeg,jp2,png,webp,tiff,avif,heif,jxl,gif,raw,tile,timeout,_updateFormatOut,_setBooleanOption,_read,_pipeline})}});var require_utility=__commonJS((exports,module3)=>{var events=__require("events"),detectLibc=require_detect_libc(),is2=require_is(),{runtimePlatformArch}=require_libvips(),sharp=require_sharp(),runtimePlatform=runtimePlatformArch(),libvipsVersion=sharp.libvipsVersion(),format2=sharp.format();format2.heif.output.alias=["avif","heic"];format2.jpeg.output.alias=["jpe","jpg"];format2.tiff.output.alias=["tif"];format2.jp2k.output.alias=["j2c","j2k","jp2","jpx"];var interpolators={nearest:"nearest",bilinear:"bilinear",bicubic:"bicubic",locallyBoundedBicubic:"lbb",nohalo:"nohalo",vertexSplitQuadraticBasisSpline:"vsqbs"},versions={vips:libvipsVersion.semver};if(!libvipsVersion.isGlobal)if(!libvipsVersion.isWasm)try{versions=__require(`@img/sharp-${runtimePlatform}/versions`)}catch(_){try{versions=__require(`@img/sharp-libvips-${runtimePlatform}/versions`)}catch(_2){}}else try{versions=(()=>{throw new Error("Cannot require module "+"@img/sharp-wasm32/versions");})()}catch(_){}versions.sharp=require_package().version;if(versions.heif&&format2.heif)format2.heif.input.fileSuffix=[".avif"],format2.heif.output.alias=["avif"];function cache(options){if(is2.bool(options))if(options)return sharp.cache(50,20,100);else return sharp.cache(0,0,0);else if(is2.object(options))return sharp.cache(options.memory,options.files,options.items);else return sharp.cache()}cache(!0);function concurrency(concurrency2){return sharp.concurrency(is2.integer(concurrency2)?concurrency2:null)}if(detectLibc.familySync()===detectLibc.GLIBC&&!sharp._isUsingJemalloc())sharp.concurrency(1);else if(detectLibc.familySync()===detectLibc.MUSL&&sharp.concurrency()===1024)sharp.concurrency(__require("os").availableParallelism());var queue=new events.EventEmitter;function counters(){return sharp.counters()}function simd(simd2){return sharp.simd(is2.bool(simd2)?simd2:null)}function block(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!0);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}function unblock(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!1);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}module3.exports=function(Sharp){Sharp.cache=cache,Sharp.concurrency=concurrency,Sharp.counters=counters,Sharp.simd=simd,Sharp.format=format2,Sharp.interpolators=interpolators,Sharp.versions=versions,Sharp.queue=queue,Sharp.block=block,Sharp.unblock=unblock}});var require_lib=__commonJS((exports,module3)=>{var Sharp=require_constructor();require_input()(Sharp);require_resize()(Sharp);require_composite()(Sharp);require_operation()(Sharp);require_colour()(Sharp);require_channel()(Sharp);require_output()(Sharp);require_utility()(Sharp);module3.exports=Sharp});import{randomUUID as randomUUID6}from"crypto";import{mkdir as mkdir5,rename as rename3,stat as stat5,unlink as unlink5}from"fs/promises";import path2 from"path";function mergeTransformConfig(config){if(!config)return DEFAULT_TRANSFORM;return{enabled:config.enabled??DEFAULT_TRANSFORM.enabled,maxWidth:config.maxWidth??DEFAULT_TRANSFORM.maxWidth,maxHeight:config.maxHeight??DEFAULT_TRANSFORM.maxHeight,defaultQuality:config.defaultQuality??DEFAULT_TRANSFORM.defaultQuality,allowedFormats:config.allowedFormats??DEFAULT_TRANSFORM.allowedFormats,cacheSubdir:config.cacheSubdir??DEFAULT_TRANSFORM.cacheSubdir,maxInputPixels:config.maxInputPixels??DEFAULT_TRANSFORM.maxInputPixels,pregenerate:{enabled:config.pregenerate?.enabled??DEFAULT_PREGENERATE.enabled,widths:config.pregenerate?.widths??DEFAULT_PREGENERATE.widths,formats:config.pregenerate?.formats??DEFAULT_PREGENERATE.formats,quality:config.pregenerate?.quality}}}function isTransformableImage(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")in MIME_TO_FORMAT}function clampInt(raw,min,max){if(raw===void 0)return;let n=Number.parseInt(raw,10);if(!Number.isFinite(n))return;return Math.min(max,Math.max(min,n))}function preferredOutputFormat(input){let{requested,allowedFormats}=input;if(requested)return requested;let sourceFormat=MIME_TO_FORMAT[input.mimeType.split(";")[0]?.trim().toLowerCase()??""];if(!sourceFormat)return;if((input.accept??"").toLowerCase().includes("image/webp")&&(sourceFormat==="jpeg"||sourceFormat==="png")&&allowedFormats.includes("webp"))return"webp";return sourceFormat}function parseTransformParams(query,config){let width=clampInt(query.w,1,config.maxWidth),height=clampInt(query.h,1,config.maxHeight),qualityRaw=clampInt(query.q,1,100),requestedFormat=query.format?.trim().toLowerCase(),format2=requestedFormat&&config.allowedFormats.includes(requestedFormat)?requestedFormat:void 0;if(width===void 0&&height===void 0&&qualityRaw===void 0&&!format2)return null;return{width,height,quality:qualityRaw??config.defaultQuality,format:format2}}function deriveCacheKey(mtimeMs,params,outputFormat){return[`m${Math.floor(mtimeMs)}`,params.width?`w${params.width}`:"w0",params.height?`h${params.height}`:"h0",`q${params.quality}`,outputFormat].join("-")}async function loadSharp(logger2){if(sharpModule!==void 0)return sharpModule;try{let mod=await Promise.resolve().then(() => __toESM(require_lib(),1));sharpModule=mod.default??mod;try{let budget=cpuBudget();sharpModule.concurrency(budget),logger2.info(`[CDN] sharp thread pool set to ${budget} (CPU allowance, not host cores)`)}catch(error3){logger2.warn(`[CDN] could not set sharp concurrency: ${error3 instanceof Error?error3.message:String(error3)}`)}try{sharpModule.cache(!1),logger2.info("[CDN] libvips operation cache disabled (derivatives are cached on disk)")}catch(error3){logger2.warn(`[CDN] could not disable the libvips cache: ${error3 instanceof Error?error3.message:String(error3)}`)}}catch{sharpModule=null,logger2.error('[CDN] storage.cdn.transform.enabled is true but the optional "sharp" dependency is not installed. Run `npm i sharp` to enable image transforms. Serving original files untouched.')}return sharpModule}async function ensureDerivative(args){let{sourcePath,mimeType,params,storagePath,config,logger:logger2}=args;if(!isTransformableImage(mimeType))return null;let outputFormat=preferredOutputFormat({mimeType,requested:params.format,accept:args.accept,allowedFormats:config.allowedFormats});if(!outputFormat)return null;let sharp=await loadSharp(logger2);if(!sharp)return null;let idPart=path2.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f",srcStat=await stat5(sourcePath).catch(()=>null);if(!srcStat)return null;let key2=deriveCacheKey(srcStat.mtimeMs,params,outputFormat),cacheDir=path2.join(storagePath,config.cacheSubdir,idPart),cachePath=path2.join(cacheDir,`${key2}.${outputFormat}`);if(!isPathWithinBase(storagePath,cachePath))return null;let contentType=FORMAT_TO_MIME[outputFormat],etag=`"${idPart}-${key2}"`,cached=await stat5(cachePath).catch(()=>null);if(cached?.isFile()&&cached.size>0)return{path:cachePath,contentType,etag};let pending=inFlightDerivatives.get(cachePath);if(pending)return pending;let task=(async()=>{let tmpPath=null;try{let pipeline=sharp(sourcePath,{limitInputPixels:config.maxInputPixels,failOn:"none"});if(pipeline.rotate().keepIccProfile(),params.width||params.height)pipeline.resize({width:params.width,height:params.height,fit:"inside",withoutEnlargement:!0});switch(outputFormat){case"webp":pipeline.webp({quality:params.quality});break;case"avif":pipeline.avif({quality:params.quality});break;case"jpeg":pipeline.jpeg({quality:params.quality});break;case"png":pipeline.png({quality:params.quality});break}let buffer=await pipeline.toBuffer();if(buffer.length===0)return logger2.error(`[CDN] image transform produced an empty buffer for ${idPart}; serving original.`),null;return await mkdir5(cacheDir,{recursive:!0}),tmpPath=`${cachePath}.${randomUUID6()}.tmp`,await Bun.write(tmpPath,buffer),await rename3(tmpPath,cachePath),tmpPath=null,{path:cachePath,contentType,etag}}catch(err){if(tmpPath)await unlink5(tmpPath).catch(()=>{});return logger2.error(`[CDN] image transform failed for ${idPart}; serving original. ${String(err)}`),null}})();inFlightDerivatives.set(cachePath,task);try{return await task}finally{inFlightDerivatives.delete(cachePath)}}async function pregenerateImageVariants(args){let{sourcePath,mimeType,storagePath,config,logger:logger2}=args,pg=config.pregenerate;if(!config.enabled||!pg.enabled||!isTransformableImage(mimeType))return 0;if(pg.widths.length===0||pg.formats.length===0)return 0;let quality=pg.quality??config.defaultQuality,made=0;for(let width of pg.widths)for(let format2 of pg.formats)if(await ensureDerivative({sourcePath,mimeType,params:{width,quality,format:format2},storagePath,config,logger:logger2}))made+=1;return made}var DEFAULT_PREGENERATE,DEFAULT_TRANSFORM,MIME_TO_FORMAT,FORMAT_TO_MIME,sharpModule,inFlightDerivatives;var init_imageTransform=__esm(()=>{init_cpuBudget();init_helpers3();DEFAULT_PREGENERATE={enabled:!1,widths:[],formats:["webp"]},DEFAULT_TRANSFORM={enabled:!1,maxWidth:3840,maxHeight:3840,defaultQuality:80,allowedFormats:["webp","avif","jpeg","png"],cacheSubdir:".cache/cdn",maxInputPixels:1e8,pregenerate:DEFAULT_PREGENERATE};MIME_TO_FORMAT={"image/webp":"webp","image/avif":"avif","image/jpeg":"jpeg","image/jpg":"jpeg","image/png":"png"},FORMAT_TO_MIME={webp:"image/webp",avif:"image/avif",jpeg:"image/jpeg",png:"image/png"};inFlightDerivatives=new Map});import{randomUUID as randomUUID7}from"crypto";import{mkdir as mkdir6,rename as rename4,stat as stat6,unlink as unlink6}from"fs/promises";import path3 from"path";function mergePdfConfig(config){if(!config)return DEFAULT_PDF;return{enabled:config.enabled??DEFAULT_PDF.enabled,coverFormat:config.coverFormat??DEFAULT_PDF.coverFormat,dpi:config.dpi??DEFAULT_PDF.dpi,pdftoppmPath:config.pdftoppmPath??DEFAULT_PDF.pdftoppmPath}}function isTransformablePdf(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")==="application/pdf"}function idPartOf(sourcePath){return path3.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function coverPath(storagePath,cacheSubdir,sourcePath,mtimeMs,ext){return path3.join(storagePath,cacheSubdir,idPartOf(sourcePath),`pdf-m${Math.floor(mtimeMs)}-cover.${ext}`)}async function checkPoppler(pdftoppmPath,logger2){if(popplerAvailable!==void 0)return popplerAvailable;try{await Bun.spawn({cmd:[pdftoppmPath,"-v"],stdout:"ignore",stderr:"ignore"}).exited,popplerAvailable=!0}catch{popplerAvailable=!1}if(!popplerAvailable)logger2.error(`[CDN] storage.cdn.pdf.enabled is true but pdftoppm ("${pdftoppmPath}") was not found on PATH. Install poppler-utils to enable PDF cover generation. Serving PDFs without covers.`);return popplerAvailable}async function resolvePdfCover(args){let{sourcePath,storagePath,cacheSubdir,coverFormat}=args,srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return null;let ext=coverFormat==="png"?"png":"jpg",p=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,p))return null;let cover=await stat6(p).catch(()=>null);if(!cover?.isFile())return null;if(cover.size<MIN_PLAUSIBLE_COVER_BYTES)return await unlink6(p).catch(()=>{}),null;return{path:p,contentType:COVER_MIME[coverFormat]}}async function processPdfOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformablePdf(mimeType))return;if(!await checkPoppler(config.pdftoppmPath,logger2))return;let srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return;let ext=config.coverFormat==="png"?"png":"jpg",out=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,out))return;if(await Bun.file(out).exists())return;await mkdir6(path3.dirname(out),{recursive:!0}).catch(()=>{});let prefix=`${out}.${randomUUID7()}.tmp`,tmp=`${prefix}.${ext}`;if(await runPdftoppm(config.pdftoppmPath,[config.coverFormat==="png"?"-png":"-jpeg","-f","1","-l","1","-r",String(config.dpi),"-singlefile",sourcePath,prefix])&&await Bun.file(tmp).exists()){await rename4(tmp,out).catch(()=>{});return}await unlink6(tmp).catch(()=>{}),logger2.error(`[CDN] pdf cover failed for ${idPartOf(sourcePath)}`)}async function runPdftoppm(pdftoppmPath,args){try{return await Bun.spawn({cmd:[pdftoppmPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}var DEFAULT_PDF,MIN_PLAUSIBLE_COVER_BYTES=2048,COVER_MIME,popplerAvailable;var init_pdfTransform=__esm(()=>{init_helpers3();DEFAULT_PDF={enabled:!1,coverFormat:"jpeg",dpi:150,pdftoppmPath:"pdftoppm"};COVER_MIME={jpeg:"image/jpeg",png:"image/png"}});import{randomUUID as randomUUID8}from"crypto";import{mkdir as mkdir7,rename as rename5,stat as stat7,unlink as unlink7}from"fs/promises";import path4 from"path";function mergeVideoConfig(config){if(!config)return DEFAULT_VIDEO;return{enabled:config.enabled??DEFAULT_VIDEO.enabled,transcode:config.transcode??DEFAULT_VIDEO.transcode,poster:config.poster??DEFAULT_VIDEO.poster,posterFormat:config.posterFormat??DEFAULT_VIDEO.posterFormat,crf:config.crf??DEFAULT_VIDEO.crf,maxWidth:config.maxWidth??DEFAULT_VIDEO.maxWidth,ffmpegPath:config.ffmpegPath??DEFAULT_VIDEO.ffmpegPath}}function isTransformableVideo(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"").startsWith("video/")}function idPartOf2(sourcePath){return path4.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function variantPath(storagePath,cacheSubdir,sourcePath,mtimeMs,suffix){return path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath),`video-m${Math.floor(mtimeMs)}-${suffix}`)}async function checkFfmpeg(ffmpegPath,logger2){if(ffmpegAvailable!==void 0)return ffmpegAvailable;try{ffmpegAvailable=await Bun.spawn({cmd:[ffmpegPath,"-version"],stdout:"ignore",stderr:"ignore"}).exited===0}catch{ffmpegAvailable=!1}if(!ffmpegAvailable)logger2.error(`[CDN] storage.cdn.video.enabled is true but ffmpeg ("${ffmpegPath}") was not found on PATH. Install ffmpeg to enable video transcode/poster. Serving original videos untouched.`);return ffmpegAvailable}async function runFfmpeg(ffmpegPath,args){try{return await Bun.spawn({cmd:[ffmpegPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}async function resolveVideoVariant(args){let{sourcePath,storagePath,cacheSubdir,posterFormat,kind}=args,srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return null;let suffix=kind==="web"?"web.mp4":`poster.${posterFormat==="webp"?"webp":"jpg"}`,p=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,suffix);if(!isPathWithinBase(storagePath,p))return null;let variant=await stat7(p).catch(()=>null);if(!variant?.isFile())return null;if(variant.size<MIN_PLAUSIBLE_VARIANT_BYTES[kind])return await unlink7(p).catch(()=>{}),null;let contentType=kind==="web"?"video/mp4":POSTER_MIME[posterFormat];return{path:p,contentType}}async function processVideoOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformableVideo(mimeType))return;if(!await checkFfmpeg(config.ffmpegPath,logger2))return;let srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return;let dir=path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath));if(await mkdir7(dir,{recursive:!0}).catch(()=>{}),config.transcode){let out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,"web.mp4");if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let tmp=`${out}.${randomUUID8()}.tmp.mp4`;if(await runFfmpeg(config.ffmpegPath,["-y","-i",sourcePath,"-vf",`scale='min(${config.maxWidth},iw)':-2`,"-c:v","libx264","-crf",String(config.crf),"-preset","medium","-c:a","aac","-movflags","+faststart",tmp]))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video transcode failed for ${idPartOf2(sourcePath)}`)}}if(config.poster){let ext=config.posterFormat==="webp"?"webp":"jpg",out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,`poster.${ext}`);if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let posterArgs=["-y","-i",sourcePath,"-frames:v","1"];if(config.posterFormat==="webp")posterArgs.push("-c:v","libwebp");else posterArgs.push("-q:v","3");let tmp=`${out}.${randomUUID8()}.tmp.${ext}`;if(posterArgs.push(tmp),await runFfmpeg(config.ffmpegPath,posterArgs))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video poster failed for ${idPartOf2(sourcePath)}`)}}}var DEFAULT_VIDEO,MIN_PLAUSIBLE_VARIANT_BYTES,POSTER_MIME,ffmpegAvailable;var init_videoTransform=__esm(()=>{init_helpers3();DEFAULT_VIDEO={enabled:!1,transcode:!0,poster:!0,posterFormat:"jpeg",crf:23,maxWidth:1920,ffmpegPath:"ffmpeg"};MIN_PLAUSIBLE_VARIANT_BYTES={web:4096,poster:128},POSTER_MIME={jpeg:"image/jpeg",webp:"image/webp"}});import path5 from"path";function mergeCdnConfig(config){if(!config)return DEFAULT_CDN_CONFIG;return{enabled:config.enabled??DEFAULT_CDN_CONFIG.enabled,basePath:config.basePath??DEFAULT_CDN_CONFIG.basePath,cacheMaxAge:config.cacheMaxAge??DEFAULT_CDN_CONFIG.cacheMaxAge,enableRangeRequests:config.enableRangeRequests??DEFAULT_CDN_CONFIG.enableRangeRequests,enableEtag:config.enableEtag??DEFAULT_CDN_CONFIG.enableEtag,corsOrigins:config.corsOrigins??DEFAULT_CDN_CONFIG.corsOrigins,transform:mergeTransformConfig(config.transform),video:mergeVideoConfig(config.video),pdf:mergePdfConfig(config.pdf)}}function getMimeTypeDisposition(mimeType,forceDownload=!1){let normalized=mimeType.split(";")[0]?.trim().toLowerCase()??"";if(NEVER_INLINE.has(normalized))return"attachment";if(forceDownload)return"attachment";let inlineTypes=["image/","video/","audio/","text/","application/pdf"];for(let type4 of inlineTypes)if(normalized.startsWith(type4)||normalized===type4)return"inline";return"attachment"}function sanitizeFilename(filename){return filename.replace(/[^A-Za-z0-9._-]+/g,"_").replace(/_{2,}/g,"_").slice(0,200)}function buildContentDisposition(type4,fileName){return`${type4}; filename="${sanitizeFilename(fileName)}"; filename*=UTF-8''${encodeURIComponent(fileName)}`}function isTraversalId(id){return id.includes("/")||id.includes("\\")||id.includes("..")||id.includes("\x00")}function resolveTenantSchema(request){return request.headers.get("x-tenant-schema")||void 0}function createCdnRoutes(config){let{cdn,storagePath,logger:logger2,getFileRecord,getStorageProvider:getStorageProvider2,authorizeFile}=config,materialize=async(absolutePath)=>{let provider=getStorageProvider2?.();if(!provider||provider.kind==="local")return absolutePath;let relative=path5.relative(storagePath,absolutePath);if(!relative||relative.startsWith(".."))return absolutePath;return await provider.localPath(relative)??absolutePath};if(!cdn.enabled)return collectRoutes();let routeGetId=defineRoute({method:"GET",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file by ID",description:"Serve file with streaming, range requests, and caching support"},handler:async({params,request,set:set2,query})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,{success:!1,message:"Invalid file id"};let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,{success:!1,message:"You are not allowed to access this file"};let filePath,fileName,mimeType;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,{success:!1,message:"File not found"};filePath=path5.join(fileRecord.path,fileRecord.name),fileName=fileRecord.original_name?.trim()||fileRecord.name,mimeType=fileRecord.mimeType||fileRecord.mime_type||"application/octet-stream"}else filePath=path5.join(storagePath,id),fileName=id,mimeType="application/octet-stream";if(!isPathWithinBase(storagePath,filePath))return set2.status=404,{success:!1,message:"File not found"};if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,{success:!1,message:"Physical file not found"};if(cdn.video.enabled&&isTransformableVideo(mimeType)){let wantPoster=query.poster!==void 0&&query.poster!=="0"&&query.poster!=="false",variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:wantPoster?"poster":"web"});if(variant)filePath=variant.path,mimeType=variant.contentType;else if(wantPoster)return set2.status=404,{success:!1,message:"Poster not generated"}}if(cdn.pdf.enabled&&isTransformablePdf(mimeType)){if(query.cover!==void 0&&query.cover!=="0"&&query.cover!=="false"){let coverArgs={sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,coverFormat:cdn.pdf.coverFormat},cover=await resolvePdfCover(coverArgs);if(!cover)await processPdfOnUpload({sourcePath:filePath,mimeType,storagePath,cacheSubdir:cdn.transform.cacheSubdir,config:cdn.pdf,logger:logger2}),cover=await resolvePdfCover(coverArgs);if(!cover)return set2.status=404,{success:!1,message:"Cover not generated"};filePath=cover.path,mimeType=cover.contentType}}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,cacheHeaders={"Cache-Control":mimeType.startsWith("video/")?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)cacheHeaders.ETag=etag;if(cdn.corsOrigins.length>0)cacheHeaders["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),cacheHeaders["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";if(cdn.transform.enabled&&isTransformableImage(mimeType)){let transformParams=parseTransformParams(query,cdn.transform);if(transformParams){let derivative=await ensureDerivative({sourcePath:filePath,mimeType,params:transformParams,storagePath,config:cdn.transform,logger:logger2,accept:request.headers.get("accept")??void 0});if(derivative){let derivativeInfo=await fileManager.getFileInfo(derivative.path),derivativeHeaders={...cacheHeaders,"Content-Type":derivative.contentType,"Content-Disposition":`inline; filename="${sanitizeFilename(fileName)}"`,"X-Content-Type-Options":"nosniff",Vary:"Accept"};if(cdn.enableEtag)derivativeHeaders.ETag=derivative.etag;if(cdn.enableEtag&&request.headers.get("if-none-match")===derivative.etag)return new Response(null,{status:304,headers:derivativeHeaders});return new Response(Bun.file(derivative.path),{status:200,headers:{"Content-Length":derivativeInfo.size.toString(),...derivativeHeaders}})}}}let forceDownload=query.download!==void 0&&query.download!=="0"&&query.download!=="false",dispositionType=getMimeTypeDisposition(mimeType,forceDownload),contentDisposition=buildContentDisposition(dispositionType,fileName),ifNoneMatch=request.headers.get("if-none-match");if(etag&&ifNoneMatch===etag)return new Response(null,{status:304,headers:cacheHeaders});let bunFile=Bun.file(filePath),range=request.headers.get("range");if(cdn.enableRangeRequests&&range){let rangeMatch=range.match(/bytes=(\d*)-(\d*)/);if(!rangeMatch)return set2.status=416,new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let startStr=rangeMatch[1]??"",endStr=rangeMatch[2]??"",isSuffix=startStr===""&&endStr!=="",start=isSuffix?Math.max(0,fileInfo.size-parseInt(endStr,10)):parseInt(startStr||"0",10),end=isSuffix||!endStr?fileInfo.size-1:parseInt(endStr,10);if(isSuffix&&parseInt(endStr,10)===0)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});if(start>=fileInfo.size||end>=fileInfo.size||start>end)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let chunkSize=end-start+1,chunkStream=boundedStream(bunFile.slice(start,end+1).stream(),chunkSize);return new Response(chunkStream,{status:206,headers:{"Content-Range":`bytes ${start}-${end}/${fileInfo.size}`,"Accept-Ranges":"bytes","Content-Length":chunkSize.toString(),"Content-Type":mimeType,"Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}return new Response(bunFile,{status:200,headers:{"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}}),routeHeadId=defineRoute({method:"HEAD",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file metadata",description:"Get file headers without body for preflight checks"},handler:async({params,request,set:set2})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,new Response(null,{status:400});let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,new Response(null,{status:403});let filePath,mimeType,fileName;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,new Response(null,{status:404});filePath=path5.join(fileRecord.path,fileRecord.name),mimeType=fileRecord.mime_type||"application/octet-stream",fileName=fileRecord.original_name?.trim()||fileRecord.name}else filePath=path5.join(storagePath,id),mimeType="application/octet-stream",fileName=id;if(!isPathWithinBase(storagePath,filePath))return set2.status=404,new Response(null,{status:404});if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,new Response(null,{status:404});if(cdn.video.enabled&&isTransformableVideo(mimeType)){let variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:"web"});if(variant)filePath=variant.path,mimeType=variant.contentType}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,isVideo=mimeType.startsWith("video/"),headers={"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Content-Disposition":buildContentDisposition(getMimeTypeDisposition(mimeType),fileName),"X-Content-Type-Options":"nosniff","Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Cache-Control":isVideo?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)headers.ETag=etag;if(cdn.corsOrigins.length>0)headers["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),headers["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";return new Response(null,{status:200,headers})}});logger2.info(`[CDN] Routes enabled at ${cdn.basePath}`);let declared=[routeGetId,routeHeadId];return collectRoutes([{prefix:cdn.basePath,routes:declared}])}var DEFAULT_CDN_CONFIG,NEVER_INLINE;var init_cdn=__esm(()=>{init_esm3();init_File();init_routeCollector();init_helpers3();init_imageTransform();init_pdfTransform();init_videoTransform();DEFAULT_CDN_CONFIG={enabled:!0,basePath:"/cdn",cacheMaxAge:86400,enableRangeRequests:!0,enableEtag:!0,corsOrigins:["*"],transform:mergeTransformConfig(),video:mergeVideoConfig(),pdf:mergePdfConfig()};NEVER_INLINE=new Set(["text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/ecmascript","text/ecmascript","application/x-httpd-php"])});function buildFileRecordPayload(upload,userId){return{id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:upload.originalName.split(".").pop()||"",uploadedBy:userId??null}}async function persistUploadedFiles(args){let{db,filesTable,files,storageConfig,subFolder,userId}=args,uploaded=await uploadFiles(files,storageConfig,subFolder),records=[];for(let upload of uploaded.success){let payload=buildFileRecordPayload(upload,userId);payload.createdBy=userId??null,await db.insert(filesTable).values(payload),records.push({id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:payload.extension})}return{records,failed:uploaded.failed}}var init_file_record=__esm(()=>{init_helpers3()});import path6 from"path";function scheduleUploadMediaProcessing(records,opts){let{storagePath,media,logger:logger2}=opts,{transform:transform3,video,pdf}=media,imagesOn=transform3.enabled&&transform3.pregenerate.enabled,videoOn=video.enabled,pdfOn=pdf.enabled;if(!imagesOn&&!videoOn&&!pdfOn)return;for(let record3 of records){let sourcePath=path6.join(record3.path,record3.name);if(imagesOn&&isTransformableImage(record3.mimeType))pregenerateImageVariants({sourcePath,mimeType:record3.mimeType,storagePath,config:transform3,logger:logger2}).catch(()=>{});if(pdfOn&&isTransformablePdf(record3.mimeType))processPdfOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:pdf,logger:logger2}).catch(()=>{});if(videoOn&&isTransformableVideo(record3.mimeType))processVideoOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:video,logger:logger2}).catch(()=>{})}}var init_mediaPostProcess=__esm(()=>{init_imageTransform();init_pdfTransform();init_videoTransform()});var exports_storage={};__export(exports_storage,{validateFile:()=>validateFile,uploadFiles:()=>uploadFiles,uploadFile:()=>uploadFile,setStorageProvider:()=>setStorageProvider,scheduleUploadMediaProcessing:()=>scheduleUploadMediaProcessing,resolvePdfCover:()=>resolvePdfCover,processPdfOnUpload:()=>processPdfOnUpload,persistUploadedFiles:()=>persistUploadedFiles,parseFormDataBody:()=>parseFormDataBody,normalizeMimeType:()=>normalizeMimeType,mergeVideoConfig:()=>mergeVideoConfig,mergeTransformConfig:()=>mergeTransformConfig,mergeStorageConfig:()=>mergeStorageConfig,mergePdfConfig:()=>mergePdfConfig,mergeCdnConfig:()=>mergeCdnConfig,isTransformablePdf:()=>isTransformablePdf,isMimeTypeListed:()=>isMimeTypeListed,getStorageProvider:()=>getStorageProvider,deleteFile:()=>deleteFile,createCdnRoutes:()=>createCdnRoutes,buildFileRecordPayload:()=>buildFileRecordPayload});var init_storage2=__esm(()=>{init_cdn();init_file_record();init_helpers3();init_imageTransform();init_mediaPostProcess();init_videoTransform();init_pdfTransform()});function createGodminGuard(deps){let{logger:logger2,db,schemaTables,area}=deps,allowedRoles=new Set((deps.allowedRoles??[]).map((role)=>role.toLowerCase()));return async({request,set:set2})=>{let roles=decodeHeaderList(request.headers.get("x-user-roles")),headerGrants=roles.includes(GODMIN_ROLE_NAME)||allowedRoles.size>0&&roles.some((role)=>allowedRoles.has(role.toLowerCase())),userId=request.headers.get("x-user-id"),caller;if(userId&&db&&schemaTables.users)try{let{eq:eq31}=await import("drizzle-orm"),usersTable=schemaTables.users;caller=(await db.select().from(usersTable).where(eq31(usersTable.id,userId)).limit(1))[0]}catch(err){logger2.warn(`[${area}] Failed to check isGod from DB`,{error:err instanceof Error?err.message:String(err)})}if(!headerGrants&&caller?.isGod!==!0)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:allowedRoles.size>0?`${area} requires godmin or one of: ${[...allowedRoles].join(", ")}`:`Only godmin users can access ${area}`,data:null}));if(caller){let refusal=accountStateRefusal(caller);if(refusal)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:refusal,data:null}))}return}}var init_godminGuard=__esm(()=>{init_Authorization();init_response();init_requireGodmin()});var exports_helpers={};__export(exports_helpers,{scanUndeclaredEnv:()=>scanUndeclaredEnv,scanEnvVars:()=>scanEnvVars,restoreMaskedEchoes:()=>restoreMaskedEchoes,readOverridesFromRedis:()=>readOverridesFromRedis,persistSectionToRedis:()=>persistSectionToRedis,persistConfigToDisk:()=>persistConfigToDisk,maskUrlCredentials:()=>maskUrlCredentials,maskSensitiveFields:()=>maskSensitiveFields,looksSecretValue:()=>looksSecretValue,loadOverridesFromRedis:()=>loadOverridesFromRedis,isRestartRequired:()=>isRestartRequired,hasSection:()=>hasSection,extractSection:()=>extractSection,deepMerge:()=>deepMerge,clearOverridesFromRedis:()=>clearOverridesFromRedis,buildSectionsMeta:()=>buildSectionsMeta,applySectionUpdate:()=>applySectionUpdate});var SENSITIVE_KEY_PATTERNS,FORBIDDEN_SECTION_KEYS,isSensitiveKey=(key2)=>SENSITIVE_KEY_PATTERNS.some((pattern2)=>pattern2.test(key2)),HEADER_MAP_KEYS,maskHeaderMap=(value2)=>{let masked={};for(let name2 of Object.keys(value2))masked[name2]="***";return masked},URL_CREDENTIALS,maskUrlCredentials=(value2)=>value2.replace(URL_CREDENTIALS,"$1***$2"),B64ISH_VALUE,looksSecretValue=(value2)=>{if(!value2)return!1;let v=value2.trim();if(v.length>=60&&B64ISH_VALUE.test(v))return!0;return v.includes("PRIVATE KEY")||v.includes("BEGIN ")||v.includes('"private_key"')},RESTART_REQUIRED_KEYS,asRecord=(config)=>config,maskSensitiveFields=(obj)=>{let result={};for(let[key2,value2]of Object.entries(obj)){if(isSensitiveKey(key2)&&typeof value2==="string"){result[key2]="***";continue}if(Array.isArray(value2)){result[key2]=value2.map((item)=>typeof item==="object"&&item!==null?maskSensitiveFields(item):item);continue}if(typeof value2==="object"&&value2!==null){result[key2]=HEADER_MAP_KEYS.test(key2)?maskHeaderMap(value2):maskSensitiveFields(value2);continue}result[key2]=typeof value2==="string"?maskUrlCredentials(value2):value2}return result},MASK="***",isPlainObject2=(value2)=>typeof value2==="object"&&value2!==null&&!Array.isArray(value2),restoreMaskedEchoes=(section,current,incoming)=>restoreAgainst(current,maskSensitiveFields({[section]:current})[section],incoming),restoreAgainst=(current,masked,incoming,everyValueMasked=!1)=>{if(isPlainObject2(incoming)&&isPlainObject2(current)&&isPlainObject2(masked)){let result={};for(let[key2,value2]of Object.entries(incoming)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;if(Object.hasOwn(current,key2)){result[key2]=restoreAgainst(current[key2],masked[key2],value2,HEADER_MAP_KEYS.test(key2));continue}if(value2===MASK&&(everyValueMasked||isSensitiveKey(key2)))continue;result[key2]=value2}return result}if(Array.isArray(incoming)&&Array.isArray(current)&&Array.isArray(masked)&&incoming.length===current.length)return incoming.map((item,index)=>restoreAgainst(current[index],masked[index],item));if(typeof incoming==="string"&&incoming===masked&&masked!==current)return current;return incoming},buildSectionsMeta=(config)=>{let record3=asRecord(config);return Object.keys(record3).filter((key2)=>record3[key2]!==void 0).map((key2)=>{let value2=record3[key2],type4=Array.isArray(value2)?"array":typeof value2==="object"&&value2!==null?"object":"primitive";return{key:key2,type:type4,restartRequired:RESTART_REQUIRED_KEYS.has(key2)}})},extractSection=(config,section)=>asRecord(config)[section],hasSection=(config,section)=>Object.hasOwn(asRecord(config),section),applySectionUpdate=(config,section,value2)=>{if(FORBIDDEN_SECTION_KEYS.has(section))return;asRecord(config)[section]=value2},isRestartRequired=(section)=>RESTART_REQUIRED_KEYS.has(section),ENV_VAR_PATTERN,scanEnvVars=(obj,parentPath="")=>{let entries=[];for(let[key2,value2]of Object.entries(obj)){let currentPath=parentPath?`${parentPath}.${key2}`:key2;if(typeof value2==="string"&&ENV_VAR_PATTERN.test(value2)){let envValue=process.env[value2],valueIsSecret=envValue!==void 0&&looksSecretValue(envValue);entries.push({configPath:currentPath,envName:value2,resolved:envValue!==void 0,value:envValue!==void 0?isSensitiveKey(key2)||valueIsSecret?"***":maskUrlCredentials(envValue):null,isSecret:isSensitiveKey(key2)||valueIsSecret,recognized:!0});continue}if(Array.isArray(value2)){for(let i=0;i<value2.length;i++){let item=value2[i];if(typeof item==="object"&&item!==null)entries.push(...scanEnvVars(item,`${currentPath}[${i}]`))}continue}if(typeof value2==="object"&&value2!==null)entries.push(...scanEnvVars(value2,currentPath))}return entries},K8S_LINK_RE,SYSTEM_ENV,SYSTEM_PREFIXES,PROVIDER_KEY_TOKENS,isProviderApiKey=(name2)=>{let upper=name2.toUpperCase();return upper.endsWith("_API_KEY")&&PROVIDER_KEY_TOKENS.some((token)=>upper.includes(token))},isInfraNoise=(name2,value2)=>{if(SYSTEM_ENV.has(name2))return!0;if(SYSTEM_PREFIXES.some((prefix)=>name2.startsWith(prefix)))return!0;if(K8S_LINK_RE.test(name2))return!0;if(name2.endsWith("_PORT")&&value2.startsWith("tcp://"))return!0;return!1},scanUndeclaredEnv=(declaredNames)=>{let entries=[];for(let[name2,rawValue]of Object.entries(process.env)){if(declaredNames.has(name2))continue;let value2=rawValue??"";if(isInfraNoise(name2,value2))continue;if(isProviderApiKey(name2))continue;let resolved=value2!=="";entries.push({configPath:name2,envName:name2,resolved,value:resolved?"***":null,isSecret:resolved,recognized:!1})}return entries},buildRedisKey=(appId)=>`nucleus:config:overrides:${appId}`,persistConfigToDisk=async(configFilePath,config)=>{let fs3=__require("fs"),content=JSON.stringify(asRecord(config),null,2);fs3.writeFileSync(configFilePath,content,"utf-8")},decodeOverrides=(stored)=>{let value2=parseStoredJson(stored);if(value2===null||typeof value2!=="object"||Array.isArray(value2))return null;return value2},persistSectionToRedis=async(redis,appId,section,value2)=>{let redisKey=buildRedisKey(appId),existing=await redis.read(redisKey),overrides=(existing.success?decodeOverrides(existing.data):null)??{};overrides[section]=value2,await redis.create(redisKey,overrides)},readOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey);if(!result.success)return null;return decodeOverrides(result.data)},clearOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId);await redis.create(redisKey,{})},loadOverridesFromRedis=async(redis,appId,config)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey),overrides=result.success?decodeOverrides(result.data):null;if(!overrides)return{applied:[],ignored:[]};let applied=[],ignored=[],record3=asRecord(config);for(let[section,value2]of Object.entries(overrides)){if(FORBIDDEN_SECTION_KEYS.has(section))continue;if(!Object.hasOwn(record3,section)){ignored.push(section);continue}let current=record3[section];if(typeof value2==="object"&&value2!==null&&!Array.isArray(value2)&&typeof current==="object"&&current!==null&&!Array.isArray(current))record3[section]=deepMerge(current,value2);else record3[section]=value2;applied.push(section)}return{applied,ignored}},deepMerge=(target2,source)=>{let result={...target2};for(let[key2,sourceValue]of Object.entries(source)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;let targetValue=target2[key2];if(typeof sourceValue==="object"&&sourceValue!==null&&!Array.isArray(sourceValue)&&typeof targetValue==="object"&&targetValue!==null&&!Array.isArray(targetValue))result[key2]=deepMerge(targetValue,sourceValue);else result[key2]=sourceValue}return result};var init_helpers4=__esm(()=>{SENSITIVE_KEY_PATTERNS=[/secret/i,/password/i,/token/i,/^apiKey$/i,/^secretKey$/i,/^webhookSecret$/i,/connection_string/i,/connectionString/i,/^clientSecret$/i,/json_file_path/i,/key$/i,/salt/i,/passphrase/i,/credential/i,/^authorization$/i,/^cookie$/i,/^x-api-key$/i],FORBIDDEN_SECTION_KEYS=new Set(["__proto__","constructor","prototype"]),HEADER_MAP_KEYS=/^(headers|extraHeaders|defaultHeaders|requestHeaders)$/i,URL_CREDENTIALS=/^([a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:)[^/\s@]+(@)/i,B64ISH_VALUE=/^[A-Za-z0-9+/=_-]{60,}$/,RESTART_REQUIRED_KEYS=new Set(["appId","mode","database","redis","authentication","authorization","email","payment","entities"]),ENV_VAR_PATTERN=/^[A-Z][A-Z0-9_]{2,}$/,K8S_LINK_RE=/(_SERVICE_HOST|_SERVICE_PORT.*|_PORT_\d+_TCP.*)$/,SYSTEM_ENV=new Set(["PATH","HOME","HOSTNAME","PWD","OLDPWD","TERM","SHLVL","_","LANG","TZ","container","VIRTUAL_ENV","DEBIAN_FRONTEND"]),SYSTEM_PREFIXES=["LC_","GPG_","PYTHON","SSL_CERT","KUBERNETES_"],PROVIDER_KEY_TOKENS=["OPENAI","CLAUDE","ANTHROPIC","GEMINI","GOOGLE","XAI","GROQ","COHERE","ZAI","OLLAMA","KIE","DEEPGRAM","ELEVENLABS","AZURE_OPENAI","MISTRAL","PERPLEXITY","TOGETHER","FIREWORKS","REPLICATE","STABILITY","RUNWAY","HUGGINGFACE","VOYAGE","JINA"]});function hasGodminRole(request){return decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r))}async function userHasGodminRoleInDb(db,schemaTables,userId,logger2){if(!userId||!db)return!1;let userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!userRolesTable||!rolesTable)return!1;try{let{eq:eq31}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq31(ur.roleId,r.id)).where(eq31(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[AdminGuard] Failed to check godmin role from DB",{error:err instanceof Error?err.message:String(err)}),!1}}async function isGodminRequest(request,deps){if(decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r)))return!0;let userId=request.headers.get("x-user-id"),{db,schemaTables,logger:logger2}=deps;if(userId&&db&&schemaTables.users)try{let{eq:eq31}=await import("drizzle-orm"),usersTable=schemaTables.users;if((await db.select().from(usersTable).where(eq31(usersTable.id,userId)).limit(1))[0]?.isGod===!0)return!0}catch(err){logger2.warn("[AdminGuard] Failed to check isGod from DB",{error:err instanceof Error?err.message:String(err)})}return!1}function createGodminGuard2(deps,label="this operation"){return createPrivilegedGuard(deps,label)}function createPrivilegedGuard(deps,label="this operation",options={}){let allowed=new Set((options.allowRoles??[]).map((role)=>role.trim().toLowerCase()));return async({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,Response.json({isSuccess:!1,success:!1,message:"Authentication required",data:null});if(allowed.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowed.has(role.trim().toLowerCase())))return}if(!await isGodminRequest(request,deps)){set2.status=403;let needs=allowed.size>0?`godmin privileges or one of: ${[...allowed].join(", ")}`:"godmin privileges";return Response.json({isSuccess:!1,success:!1,message:`Forbidden: ${label} requires ${needs}`,data:null})}return}}var init_adminGuard=__esm(()=>{init_Authorization();init_types3()});function toCamel4(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function registerSensitiveColumns(names2){for(let name2 of names2)registry2.add(name2),registry2.add(toCamel4(name2))}function isConfigSensitiveKey(key2){return registry2.has(key2)}function sensitiveColumnNames(){return[...registry2]}function sensitiveFieldQueryable(field,opts){if(!isConfigSensitiveKey(field))return!0;if(!opts.authEnabled)return!1;return opts.allowedFields?.includes(field)===!0}function stripUnclaimedSensitive(row,allowedFields){if(allowedFields&&allowedFields.length>0)return row;if(registry2.size===0)return row;return scrub(row)}function scrub(value2){if(value2===null||typeof value2!=="object")return value2;if(Array.isArray(value2))return value2.map(scrub);let proto=Object.getPrototypeOf(value2);if(proto!==Object.prototype&&proto!==null)return value2;let out={};for(let[k,v]of Object.entries(value2)){if(registry2.has(k))continue;out[k]=scrub(v)}return out}var registry2;var init_sensitiveColumns=__esm(()=>{registry2=new Set});var exports_ack_manager={};__export(exports_ack_manager,{storePendingMessage:()=>storePendingMessage,removePendingMessage:()=>removePendingMessage,recordSent:()=>recordSent,recordFailed:()=>recordFailed,recordAcked:()=>recordAcked,initAckCleanup:()=>initAckCleanup,incrementRetryCount:()=>incrementRetryCount,getPendingMessagesForUser:()=>getPendingMessagesForUser,getPendingMessageCount:()=>getPendingMessageCount,getDeliveryStats:()=>getDeliveryStats,generateMessageId:()=>generateMessageId,destroyAckCleanup:()=>destroyAckCleanup,acknowledgeMessage:()=>acknowledgeMessage});function cleanupRecentAcks(){let now=Date.now();for(let[key2,timestamp]of recentAcks)if(now-timestamp>1e4)recentAcks.delete(key2)}function initAckCleanup(){if(cleanupInterval)return;cleanupInterval=setInterval(cleanupRecentAcks,30000),cleanupInterval.unref?.()}function destroyAckCleanup(){if(cleanupInterval)clearInterval(cleanupInterval),cleanupInterval=null}function generateMessageId(){return`msg_${Date.now()}_${Math.random().toString(36).substring(2,11)}`}async function storePendingMessage(redis,message,ttlSeconds){if(!message.userId)return;let key2=`pubsub:pending:user:${message.userId}:${message.messageId}`,setKey=`pubsub:user:pending-set:${message.userId}`;await redis.create(key2,message,ttlSeconds);let existingResult=await redis.read(setKey),existingSet=existingResult.success&&existingResult.data?existingResult.data:[];if(!existingSet.includes(message.messageId))existingSet.push(message.messageId),await redis.create(setKey,existingSet,ttlSeconds)}async function acknowledgeMessage(redis,userId,messageId,ttlSeconds){let dedupKey=`${userId}:${messageId}`;if(recentAcks.has(dedupKey))return!1;let pendingKey=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`,ackKey=`pubsub:ack:${userId}:${messageId}`,pendingResult=await redis.read(pendingKey);if(!pendingResult.success||!pendingResult.data)return recentAcks.set(dedupKey,Date.now()),!1;recentAcks.set(dedupKey,Date.now());let pending=pendingResult.data,ack={messageId,clientId:pending.clientId,ackedAt:Date.now()};await redis.create(ackKey,ack,60),await redis.remove(pendingKey);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,ttlSeconds);else await redis.remove(setKey);let latencyMs=Date.now()-pending.sentAt;return recordAcked(latencyMs),!0}async function getPendingMessagesForUser(redis,userId){if(!userId)return[];let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey),messageIds=setResult.success&&setResult.data?setResult.data:[],messages=[];for(let messageId of messageIds){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(msgResult.success&&msgResult.data)messages.push(msgResult.data)}return messages.sort((a,b)=>a.sentAt-b.sentAt),messages}async function getPendingMessageCount(redis,userId){if(!userId)return 0;let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey);return(setResult.success&&setResult.data?setResult.data:[]).length}async function incrementRetryCount(redis,userId,messageId,ttlSeconds,maxRetries){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(!msgResult.success||!msgResult.data)return!1;let message={...msgResult.data,retryCount:msgResult.data.retryCount+1};if(message.retryCount>=maxRetries)return await removePendingMessage(redis,userId,messageId),recordFailed(),!1;return await redis.create(key2,message,ttlSeconds),!0}async function removePendingMessage(redis,userId,messageId){let key2=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`;await redis.remove(key2);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,300);else await redis.remove(setKey)}function recordSent(){stats.totalSent++}function recordAcked(latencyMs){stats.totalAcked++,stats.averageLatencyMs=(stats.averageLatencyMs*(stats.totalAcked-1)+latencyMs)/stats.totalAcked}function recordFailed(){stats.totalFailed++}function getDeliveryStats(){return{...stats}}var recentAcks,cleanupInterval=null,stats;var init_ack_manager=__esm(()=>{recentAcks=new Map;stats={totalSent:0,totalAcked:0,totalFailed:0,averageLatencyMs:0}});import{eq as eq35}from"drizzle-orm";async function revocationReason(params){let{db,sessionsTable}=params;if(!db||!sessionsTable)return null;let row=(await db.select().from(sessionsTable).where(eq35(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return null;let reason=row.revokedReason??row.revoked_reason;return typeof reason==="string"&&reason.length>0?reason:null}async function refreshSessionIsAlive(params){if(!params.sessionId)return{alive:!1,reason:"no session bound to the token"};let record3=await readSession({sessionId:params.sessionId}).catch(()=>null);if(!record3){let cause=await revocationReason(params).catch(()=>null);return{alive:!1,reason:cause?`session revoked: ${cause}`:"session not found"}}let{userId:sessionUserId,rememberMe:sessionRememberMe}=record3,reuseState={refreshTokenHash:record3.refreshTokenHash,previousRefreshTokenHash:record3.previousRefreshTokenHash,previousRefreshTokenAt:record3.previousRefreshTokenAt},{db,sessionsTable}=params;if(!db||!sessionsTable)return{alive:!0,userId:sessionUserId,rememberMe:sessionRememberMe,...reuseState};let row=(await db.select().from(sessionsTable).where(eq35(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return{alive:!1,reason:"session row missing"};let revokedAtVal=row.revokedAt,isRevoked=revokedAtVal!=null&&!(typeof revokedAtVal==="object"&&!(revokedAtVal instanceof Date)&&Object.keys(revokedAtVal).length===0);if(row.isActive===!1||isRevoked)return{alive:!1,reason:"session revoked"};let expiresAt=row.expiresAt;if(expiresAt&&new Date(expiresAt)<new Date)return{alive:!1,reason:"session expired"};let rowRememberMe=typeof row.rememberMe==="boolean"?row.rememberMe:void 0;return{alive:!0,userId:sessionUserId,rememberMe:rowRememberMe??sessionRememberMe,...reuseState}}var init_sessionBinding=__esm(()=>{init_SessionStore()});function resolveMutationSchema(staticSchema,tenantHeader,registry3){let schema3=staticSchema;if(registry3&&tenantHeader){let tctx=registry3.getSchemaContext(tenantHeader);if(!tctx)return{ok:!1,reason:"unknown"};schema3=tctx.schemaName}if(!SQL_IDENT.test(schema3))return{ok:!1,reason:"invalid"};return{ok:!0,schema:schema3}}var SQL_IDENT;var init_resolveMutationSchema=__esm(()=>{SQL_IDENT=/^[a-zA-Z_][a-zA-Z0-9_]*$/});import{eq as eq40,sql as sql9}from"drizzle-orm";function createChangeUserIdRoute(config,schemaName="public"){let{db,logger:logger2}=config,requireGodmin2=createRequireGodmin(config),declared=[defineRoute({method:"POST",path:"/auth/admin/change-user-id",body:Type.Object({currentId:Type.String(),newId:Type.String()}),detail:{tags:["Authentication"],summary:"Change User ID",description:"Godmin: change a user's UUID while preserving all FK relations, audit columns, and polymorphic references"},handler:async(ctx)=>{let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let registry3=config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry,schemaResult=resolveMutationSchema(schemaName,ctx.request.headers.get("x-tenant-schema"),registry3);if(!schemaResult.ok)return ctx.set.status=400,{success:!1,message:schemaResult.reason==="unknown"?"Unknown tenant schema":"Invalid tenant schema"};let effectiveSchema=schemaResult.schema,gate=await requireGodmin2(ctx.request);if(!gate.ok)return ctx.set.status=gate.status,{success:!1,message:gate.message};let requestingUserId=gate.callerId,{currentId,newId}=ctx.body;if(!currentId||!newId)return ctx.set.status=400,{success:!1,message:"currentId and newId are required"};if(currentId===newId)return ctx.set.status=400,{success:!1,message:"New ID must be different from current ID"};let uuidRegex=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;if(!uuidRegex.test(newId))return ctx.set.status=400,{success:!1,message:"newId must be a valid UUID"};if(!uuidRegex.test(currentId))return ctx.set.status=400,{success:!1,message:"currentId must be a valid UUID"};let targetUser=(await db.select().from(usersTable).where(eq40(usersTable.id,currentId)).limit(1))[0];if(!targetUser)return ctx.set.status=404,{success:!1,message:"User not found"};if((await db.select().from(usersTable).where(eq40(usersTable.id,newId)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"A user with this ID already exists"};try{let fkResult=await db.execute(sql9`
 					SELECT
 						tc.constraint_name,
@@ -540,14 +540,19 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
       where table_schema = ${schemaName}
         and table_name = ${tableName}
         and column_name = 'expires_at'
-    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql14.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch){let url=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,res=await fetchImpl(url);if(!res.ok)throw Error(`endpointDiscovery: OpenAPI fetch failed ${res.status} for ${url}`);return await res.json()}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest});import{eq as eq65,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq65(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq65(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var init_seed=__esm(()=>{init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let policy=parseGuardPolicy(c.policy);if(policy)guardByClaimId.set(String(c.id),{action:String(c.action??""),policy})}if(guardByClaimId.size===0)return EMPTY;let urRows=await db.select().from(userRolesTable),roleIds=new Set(urRows.filter((r)=>r.isActive!==!1&&String(r.userId??r.user_id)===userId).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let rcRows=await db.select().from(roleClaimsTable),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let rc of rcRows){if(rc.isActive===!1)continue;if(!roleIds.has(String(rc.roleId??rc.role_id)))continue;let guard4=guardByClaimId.get(String(rc.claimId??rc.claim_id));if(!guard4)continue;let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;let key2=resolveGuardKey(guard4.policy.keyTemplate,{userId,tenant:ctx.tenant}),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,guard4.policy.valueType,condition),current=normalizeCurrent(value2,guard4.policy.valueType);if(guards.push({action:guard4.action,key:key2,valueType:guard4.policy.valueType,op:condition.op,threshold:condition.value,current,invalidates:condition.invalidates,holds}),holds&&condition.invalidates.length>0){for(let a of condition.invalidates)suppressed.add(a);firedGuards.push({action:guard4.action,key:key2,invalidates:condition.invalidates})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq66}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq66(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq66(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and27,eq as eq67,isNull as isNull6}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and27(eq67(col17(table,"challenge"),challenge),eq67(col17(table,"challengeType"),challengeType),isNull6(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq67(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq67(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq67(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and27(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and27(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard2(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard2(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard2,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg,token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{createHash as createHash6,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and28,desc as desc7,eq as eq68,lt as lt3,ne as ne4,sql as sql14}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb"},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"removal_scope_column",type:"varchar",length:120,comment:"Target column carrying whatever the fan-out varies \u2014 a company code, a branch, a tenant. Set it when one mapping reads its source through several calls: removal is then confined to the values actually read, so a call that answers HTTP 500 costs that slice its cleanup instead of costing the whole run. Without it a single failing call refuses every removal, and a source whose one bad endpoint fails every night is never cleaned at all."},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column}of ownership){let columns=required.get(table)??new Set;columns.add(column),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column of columns){let entry=perTable.get(column)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and11,eq as eq16,inArray as inArray3,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq16(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and11(inArray3(getCol(participants,"conversationId"),conversationIds),eq16(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and13,desc as desc3,eq as eq18,inArray as inArray5}from"drizzle-orm";import{and as and12,eq as eq17,inArray as inArray4}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq17(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and12(eq17(getCol(tables.participants,"conversationId"),conversationId),eq17(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq17(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray4(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq18(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and13(inArray5(getCol(tables.conversations,"id"),conversationIds),eq18(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray5(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq18(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq18(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and14,desc as desc4,eq as eq19,inArray as inArray6,isNull as isNull3,lt,ne,sql as sql6}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null;return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size:fileRow.size??input.size??null,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq19(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq19(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql6`${getCol(tables.participants,"unreadCount")} + 1`}).where(and14(eq19(getCol(tables.participants,"conversationId"),params.conversationId),ne(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq19(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and14(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and14(eq19(getCol(tables.messages,"id"),targetMessageId),eq19(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq19(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq19(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq19(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray6(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}init_SystemCollector();init_lifecycle();init_Notification();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column){return column.default!==void 0||column.defaultRaw!==void 0||column.generatedAlwaysAs!==void 0||column.generatedAlwaysAsIdentity===!0||column.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column of config.columns??[]){if(builtInNames.has(column.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column.notNull===!0&&column.nullable!==!0&&!hasDbDefault(column))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables,basePath,schema){return buildEntityPublicRoutes(systemTables,basePath,schema)}function buildPublicRoutes(config,systemTables,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_routeCollector();import{eq as eq22}from"drizzle-orm";init_requireGodmin();import{eq as eq21}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId){let user=(await db.select().from(usersTable).where(eq21(col7(usersTable,"id"),userId)).limit(1))[0];if(!user?.isGod)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128,needUpper=policy?.requireUppercase??!0,needLower=policy?.requireLowercase??!0,needDigit=policy?.requireNumber??!0,needSpecial=policy?.requireSpecialChar??!1;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if(needUpper&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if(needLower&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if(needDigit&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if(needSpecial&&!/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd))errors2.push("Password must contain a special character");return{valid:errors2.length===0,errors:errors2}}var handleActivateUsers=(db,usersTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq22(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq24,inArray as inArray7}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq24(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray7(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray7(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq24(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq24(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq25}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq25(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq26,inArray as inArray10}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray10(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray10(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray10(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq27}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq27(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq27(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq28}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
+    `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql14.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch){let url=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,res=await fetchImpl(url);if(!res.ok)throw Error(`endpointDiscovery: OpenAPI fetch failed ${res.status} for ${url}`);return await res.json()}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest});import{eq as eq65,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq65(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq65(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var init_seed=__esm(()=>{init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let policy=parseGuardPolicy(c.policy);if(policy)guardByClaimId.set(String(c.id),{action:String(c.action??""),policy})}if(guardByClaimId.size===0)return EMPTY;let urRows=await db.select().from(userRolesTable),roleIds=new Set(urRows.filter((r)=>r.isActive!==!1&&String(r.userId??r.user_id)===userId).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let rcRows=await db.select().from(roleClaimsTable),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let rc of rcRows){if(rc.isActive===!1)continue;if(!roleIds.has(String(rc.roleId??rc.role_id)))continue;let guard4=guardByClaimId.get(String(rc.claimId??rc.claim_id));if(!guard4)continue;let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;let key2=resolveGuardKey(guard4.policy.keyTemplate,{userId,tenant:ctx.tenant}),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,guard4.policy.valueType,condition),current=normalizeCurrent(value2,guard4.policy.valueType);if(guards.push({action:guard4.action,key:key2,valueType:guard4.policy.valueType,op:condition.op,threshold:condition.value,current,invalidates:condition.invalidates,holds}),holds&&condition.invalidates.length>0){for(let a of condition.invalidates)suppressed.add(a);firedGuards.push({action:guard4.action,key:key2,invalidates:condition.invalidates})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq66}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq66(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq66(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and27,eq as eq67,isNull as isNull6}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and27(eq67(col17(table,"challenge"),challenge),eq67(col17(table,"challengeType"),challengeType),isNull6(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq67(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq67(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq67(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and27(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and27(eq67(col17(table,"credentialId"),credentialId),eq67(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard2(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard2(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard2,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg,token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{createHash as createHash6,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and28,desc as desc7,eq as eq68,lt as lt3,ne as ne4,sql as sql14}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb"},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"removal_scope_column",type:"varchar",length:120,comment:"Target column carrying whatever the fan-out varies \u2014 a company code, a branch, a tenant. Set it when one mapping reads its source through several calls: removal is then confined to the values actually read, so a call that answers HTTP 500 costs that slice its cleanup instead of costing the whole run. Without it a single failing call refuses every removal, and a source whose one bad endpoint fails every night is never cleaned at all."},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column}of ownership){let columns=required.get(table)??new Set;columns.add(column),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column of columns){let entry=perTable.get(column)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and11,eq as eq16,inArray as inArray3,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq16(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and11(inArray3(getCol(participants,"conversationId"),conversationIds),eq16(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and13,desc as desc3,eq as eq18,inArray as inArray5}from"drizzle-orm";import{and as and12,eq as eq17,inArray as inArray4}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq17(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and12(eq17(getCol(tables.participants,"conversationId"),conversationId),eq17(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq17(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray4(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq18(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and13(inArray5(getCol(tables.conversations,"id"),conversationIds),eq18(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray5(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq18(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq18(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and14,desc as desc4,eq as eq19,inArray as inArray6,isNull as isNull3,lt,ne,sql as sql6}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null;return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size:fileRow.size??input.size??null,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq19(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq19(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql6`${getCol(tables.participants,"unreadCount")} + 1`}).where(and14(eq19(getCol(tables.participants,"conversationId"),params.conversationId),ne(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq19(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and14(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and14(eq19(getCol(tables.messages,"id"),targetMessageId),eq19(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq19(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq19(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq19(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray6(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}init_SystemCollector();init_lifecycle();init_Notification();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column){return column.default!==void 0||column.defaultRaw!==void 0||column.generatedAlwaysAs!==void 0||column.generatedAlwaysAsIdentity===!0||column.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column of config.columns??[]){if(builtInNames.has(column.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column.notNull===!0&&column.nullable!==!0&&!hasDbDefault(column))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables,basePath,schema){return buildEntityPublicRoutes(systemTables,basePath,schema)}function buildPublicRoutes(config,systemTables,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_routeCollector();import{eq as eq22}from"drizzle-orm";init_passwordPolicy();init_requireGodmin();import{eq as eq21}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId){let user=(await db.select().from(usersTable).where(eq21(col7(usersTable,"id"),userId)).limit(1))[0];if(!user?.isGod)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq22(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq24,inArray as inArray7}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq24(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray7(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray7(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq24(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq24(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq25}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq25(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq26,inArray as inArray10}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray10(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray10(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray10(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq27}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq27(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq27(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq28}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
 `)};var handleListCohorts=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq29}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq29(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq30}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq30(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_Authorization();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(roles.includes(GODMIN_ROLE_NAME))return!0;if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and17,arrayContains,arrayOverlaps,asc,createTableRelationsHelpers,desc as desc5,eq as eq31,getTableName,gt,gte,ilike,inArray as inArray11,isNotNull,isNull as isNull4,like,lt as lt2,lte,ne as ne2,notInArray,or as or4,sql as sql8}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column=rule.column;if(!column)return!1;let value2=payload[column]??payload[toCamelCase2(column)]??payload[toSnakeCase2(column)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase2(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}import{and as and16,or as or3,sql as sql7}from"drizzle-orm";var MAX_SEARCH_TOKENS=10,TURKISH_LETTERS="\u0130\u0131\u015E\u015F\u011E\u011F\xDC\xFC\xD6\xF6\xC7\xE7",ASCII_EQUIVALENTS="IiSsGgUuOoCc";function searchTokens(term){return term.split(/\s+/).filter(Boolean).slice(0,MAX_SEARCH_TOKENS)}function foldForSearch(value2){let folded="";for(let character of value2){let index=TURKISH_LETTERS.indexOf(character);folded+=index===-1?character:ASCII_EQUIVALENTS[index]}return folded.toLowerCase()}function asRegexLiteral(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,(character)=>`\\${character}`)}var WORD_START="(^|[^[:alnum:]])";function folded(column){return sql7`lower(translate(cast(${column} as text), ${TURKISH_LETTERS}, ${ASCII_EQUIVALENTS}))`}function buildSearchCondition(columns,term){let tokens=searchTokens(term);if(tokens.length===0||columns.length===0)return null;let perToken=tokens.map((token)=>{let pattern2=`${WORD_START}${asRegexLiteral(foldForSearch(token))}`;return or3(...columns.map((column)=>sql7`${folded(column)} ~ ${pattern2}`))}).filter((condition)=>condition!==void 0);if(perToken.length===0)return null;return and16(...perToken)??null}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq31(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text(row.userId??row.user_id),roleId:text(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq31(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq31}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq31(ur.roleId,r.id)).where(eq31(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or4(...subs):and17(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v;switch(filter.operator){case"eq":return eq31(sqlCol,coerce2(filter.value));case"neq":return ne2(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray11(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql8`cardinality(${sqlCol}) = 0`;case"isNull":return isNull4(sqlCol);case"isNotNull":return isNotNull(sqlCol);default:return null}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq31(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`;entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchColumns=q.searchFields.map((f)=>resolveCol2(f.trim())).filter((c)=>c!==null),searchCondition=buildSearchCondition(searchColumns,q.search);if(searchCondition)conditions.push(searchCondition)}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and17(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and17(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql8`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql8`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql8`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and17(...conditions):void 0,countResult=await database.select({n:sql8`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and17(eq31(idCol2,params.id),...getScope):eq31(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql8`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and17(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}};if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and17(eq31(cols.userId,payload.userId),eq31(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable){let roleName=(await database.select().from(rolesTable).where(eq31(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!0}).where(eq31(usersTable.id,payload.userId));if(roleName)config.onRoleChanged?.({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole create")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and17(eq31(idCol2,params.id),...putFormScope):eq31(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,putFormAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and17(eq31(idCol2,params.id),...putScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,putAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and17(eq31(idCol2,params.id),...patchScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and17(eq31(idCol2,params.id),...deleteScope):eq31(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq31(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!1}).where(eq31(usersTable.id,deletedUserRole.userId));if(roleName)config.onRoleChanged?.({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole delete")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw;if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data;if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray11(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and17(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and17(eq31(idCol2,id),...bulkPutScope):eq31(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row})));let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),removed=[];await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and17(eq31(idCol2,id),...bulkDeleteScope):eq31(idCol2,id)).returning();removed.push(...r)}});{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash3}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text=await response.text().catch(()=>""),body=null;if(text)try{body=JSON.parse(text)}catch{body=text}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash3("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text=await response.text().catch(()=>""),json={};try{json=text?JSON.parse(text):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and18,eq as eq32,inArray as inArray12}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray12(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and18(eq32(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text)=>text.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder2=claimedUnique.get(field)?.get(value2);if(holder2===void 0)continue;if(holder2!==null&&holder2===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column,records){if(!column)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column,readValues:[...readValues]}}init_AccountLink();import{and as and19,eq as eq33,inArray as inArray13}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column,value2,extra){let row={...extra,[column]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and19(inArray13(idCol,chunk),...scope):inArray13(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and19(eq33(idCol,op.id),...scope):eq33(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and19(inArray13(idCol,chunk),...scope):inArray13(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and19(eq33(matchCol,link.matchValue),...scope):eq33(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
 
 ${fetchWarnings.join(`
 `)}`:verdict.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"mapping",total:rootRecords.length});let mapped3=buildMappedRecords(rootRecords.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,rootRecords.map((r)=>r.parent));if(await refreshCancelFlag(),isCancelled())return finish({...empty,externalCalls,status:"cancelled",failure:{kind:"cancelled",message:"Cancelled before anything was written."}});let existing=await deps.repo.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>deps.repo.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>deps.repo.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await deps.repo.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,removalScope:removalScopeFor(mapping.removalScopeColumn,mapped3.records),originColumn:mapping.originColumn,originValue:mapping.originValue,requiredFields:deps.repo.requiredFields(mapping.targetEntity),uniqueFields:deps.repo.uniqueFields(mapping.targetEntity),createDefaults:context.createDefaults??{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous)),ops.warnings.unshift(...fetchWarnings);let plan=summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:rootRecords.length,reportedTotal:reportedTotal2,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)}),volume=checkPlanVolume({removing:ops.deletes.length+ops.deactivates.length,existing:existing.length,maxShare:mapping.maxRemovalShare??0});if(!volume.allowed)return finish({...empty,externalCalls,failure:{kind:volume.kind,message:volume.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"writing",total:ops.creates.length+ops.updates.length});let applied=await applyWrites(deps.writer,{ops,targetEntity:mapping.targetEntity,userId:context.userId,account:mapping.accountRule&&context.accountPasswordHash?{idColumn:mapping.accountRule.idColumn,matchColumn:mapping.accountRule.matchColumn,matchFrom:mapping.accountRule.matchFrom,passwordColumn:mapping.accountRule.passwordColumn,passwordHash:context.accountPasswordHash}:null,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,isCancelled});if(!applied.ok){let failureIssues=applied.failure.kind==="validation_failed"?applied.failure.issues:[];return finish({...empty,plan,externalCalls,issues:[...ops.issues,...failureIssues],status:applied.failure.kind==="cancelled"?"cancelled":"failed",failure:applied.failure})}return preImagesStored=await deps.repo.savePreImages(runId,applied.preImages),deps.logger.info("[Integrations] Run finished",{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,cancelChecks:cancelChecked}),finish({...empty,status:"succeeded",plan,failure:null,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,issues:[...ops.issues,...applied.issues,...orphanIssues(applied)]})}function orphanIssues(applied){let note=orphanLinkNote({made:applied.linksMade,unresolved:applied.linksUnresolved});return note?[{sourceIndex:-1,kind:"parent_unresolved",message:note}]:[]}var RANGES=[[0,59],[0,23],[1,31],[1,12],[0,6]],NAMES=["minute","hour","day of month","month","day of week"];function expandField(raw,[min,max]){let values=new Set;for(let part of raw.split(",")){let[spec,stepText]=part.split("/"),step=stepText===void 0?1:Number(stepText);if(!Number.isInteger(step)||step<1)return null;let from,to;if(spec==="*")from=min,to=max;else if(spec?.includes("-")){let[a,b]=spec.split("-").map(Number);if(!Number.isInteger(a)||!Number.isInteger(b))return null;from=a,to=b}else{let one=Number(spec);if(!Number.isInteger(one))return null;from=one,to=stepText===void 0?one:max}if(from<min||to>max||from>to)return null;for(let v=from;v<=to;v+=step)values.add(v)}return values.size>0?values:null}function parseCron2(expression){let parts=expression.trim().split(/\s+/);if(parts.length!==5)return{ok:!1,error:`A schedule has five parts \u2014 minute hour day-of-month month day-of-week \u2014 and this has ${parts.length}. "0 2 * * *" is every night at 02:00.`};let sets2=[];for(let i=0;i<5;i++){let field=expandField(parts[i],RANGES[i]);if(!field)return{ok:!1,error:`The ${NAMES[i]} part ("${parts[i]}") is not something I can read.`};sets2.push(field)}return{ok:!0,fields:{minutes:sets2[0],hours:sets2[1],daysOfMonth:sets2[2],months:sets2[3],daysOfWeek:sets2[4],anyDayOfMonth:parts[2]==="*",anyDayOfWeek:parts[4]==="*"}}}function partsIn2(when,timeZone){let formatter=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",weekday:"short"}),parts={};for(let part of formatter.formatToParts(when))parts[part.type]=part.value;let weekdays=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{year:Number(parts.year),month:Number(parts.month),day:Number(parts.day),hour:Number(parts.hour)%24,minute:Number(parts.minute),weekday:Math.max(0,weekdays.indexOf(parts.weekday??"Sun"))}}function matchesCron(fields,when,timeZone){let at=partsIn2(when,timeZone);if(!fields.minutes.has(at.minute))return!1;if(!fields.hours.has(at.hour))return!1;if(!fields.months.has(at.month))return!1;let dayOfMonthMatches=fields.daysOfMonth.has(at.day),dayOfWeekMatches=fields.daysOfWeek.has(at.weekday);if(fields.anyDayOfMonth&&fields.anyDayOfWeek)return!0;if(fields.anyDayOfMonth)return dayOfWeekMatches;if(fields.anyDayOfWeek)return dayOfMonthMatches;return dayOfMonthMatches||dayOfWeekMatches}var CATCH_UP_MINUTES=1500,MINUTE_MS=60000;function isDue(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{due:!1,error:parsed.error};let zone=input.timeZone?.trim()||"UTC",nowMinute=Math.floor(input.now.getTime()/MINUTE_MS),lookBack=0;if(input.lastRunAt){let lastMinute=Math.floor(input.lastRunAt.getTime()/MINUTE_MS);if(lastMinute>=nowMinute)return{due:!1};lookBack=Math.min(nowMinute-lastMinute-1,CATCH_UP_MINUTES)}try{for(let back=0;back<=lookBack;back++){let at=new Date((nowMinute-back)*MINUTE_MS);if(matchesCron(parsed.fields,at,zone))return{due:!0}}}catch{return{due:!1,error:`"${zone}" is not a timezone this system knows.`}}return{due:!1}}function describeCron(expression,timeZone){let parsed=parseCron2(expression);if(!parsed.ok)return parsed.error;let zone=timeZone?.trim()||"UTC",parts=expression.trim().split(/\s+/),[minute,hour,dayOfMonth,month,dayOfWeek]=parts,everyMinutes=minute?.startsWith("*/")?Number(minute.slice(2)):null;if(everyMinutes&&hour==="*"&&dayOfMonth==="*"&&month==="*"&&dayOfWeek==="*")return`Every ${everyMinutes} minutes.`;let time2=minute!==void 0&&hour!==void 0&&!minute.includes("*")&&!hour.includes("*")?`${hour.padStart(2,"0")}:${minute.padStart(2,"0")}`:null,DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"];if(time2&&dayOfWeek!=="*"&&dayOfMonth==="*")return`Every ${[...parsed.fields.daysOfWeek??[]].map((d)=>DAYS[d]).join(", ")} at ${time2} (${zone}).`;if(time2&&dayOfMonth!=="*")return`On day ${dayOfMonth} of the month at ${time2} (${zone}).`;if(time2)return`Every day at ${time2} (${zone}).`;return`On the schedule "${expression}" (${zone}).`}function nextFireTimes(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{times:[],error:parsed.error};let zone=input.timeZone?.trim()||"UTC",count2=Math.max(1,Math.min(input.count??5,50)),horizon=Math.max(1,Math.min(input.horizonDays??400,400)),times=[],startMinute=Math.floor(input.from.getTime()/MINUTE_MS)+1,limit=horizon*24*60;try{for(let offset=0;offset<limit&&times.length<count2;offset+=1){let when=new Date((startMinute+offset)*MINUTE_MS);if(matchesCron(parsed.fields,when,zone))times.push(when)}}catch{return{times:[],error:`"${zone}" is not a timezone this system knows.`}}return{times}}var MINUTE2=60000;function dueMappings(mappings,now){let due=[],problems=[];for(let mapping of mappings){if(!mapping.scheduleCron?.trim())continue;let answer=isDue({expression:mapping.scheduleCron,timeZone:mapping.scheduleTimezone,now,lastRunAt:mapping.lastRunAt??null});if(answer.error){problems.push({mapping,error:answer.error});continue}if(answer.due)due.push(mapping)}return{due,problems}}function startScheduler(deps){let now=deps.now??(()=>new Date),reported=new Set,stopped=!1,tick=async()=>{if(stopped)return;let mappings;try{mappings=await deps.listScheduled()}catch(error3){deps.logger.error("[Integrations] Could not read the schedules",{error:error3 instanceof Error?error3.message:String(error3)});return}let{due,problems}=dueMappings(mappings,now());for(let problem of problems){let token=`${problem.mapping.id}:${problem.error}`;if(reported.has(token))continue;reported.add(token),deps.logger.error(`[Integrations] "${problem.mapping.name}" has a schedule that cannot run: ${problem.error}`)}for(let mapping of due)try{if(await deps.startRun(mapping.id))deps.logger.info(`[Integrations] Scheduled import started: ${mapping.name}`)}catch(error3){deps.logger.error(`[Integrations] Scheduled import failed to start: ${mapping.name}`,{error:error3 instanceof Error?error3.message:String(error3)})}},timer=setInterval(()=>{tick()},MINUTE2);if(typeof timer==="object"&&timer&&"unref"in timer)timer.unref();return{stop:()=>{stopped=!0,clearInterval(timer)}}}var asObject=(value2)=>value2&&typeof value2==="object"&&!Array.isArray(value2)?value2:null,asArray=(value2)=>Array.isArray(value2)?value2:[],text=(value2)=>{if(value2==null)return null;let s=String(value2);return s===""?null:s};function buildTransferDocument(input){let{source,endpoints,mappings}=input,nameById=new Map;for(let endpoint of endpoints){let id=text(endpoint.id),name2=text(endpoint.name);if(id&&name2)nameById.set(id,name2)}return{version:1,exportedAt:input.exportedAt,secretsExcluded:!0,connection:{name:String(source.name??""),slug:String(source.slug??""),baseUrl:String(source.baseUrl??""),description:text(source.description),authType:String(source.authType??"none"),authHeaderName:text(source.authHeaderName),authQueryParam:text(source.authQueryParam),extraHeaders:asObject(source.extraHeaders),tokenUrl:text(source.tokenUrl),oauthGrantType:text(source.oauthGrantType),oauthClientId:text(source.oauthClientId),oauthUsername:text(source.oauthUsername),oauthScope:text(source.oauthScope),oauthClientAuth:text(source.oauthClientAuth),tlsVerify:source.tlsVerify!==!1,timeoutMs:typeof source.timeoutMs==="number"?source.timeoutMs:null,enabled:source.enabled!==!1},endpoints:endpoints.map((endpoint)=>({name:String(endpoint.name??""),tag:String(endpoint.tag??""),method:String(endpoint.method??"GET"),path:String(endpoint.path??""),description:text(endpoint.description),queryParams:asObject(endpoint.queryParams),requestBody:asObject(endpoint.requestBody),responseRootPath:text(endpoint.responseRootPath),treeChildrenPath:text(endpoint.treeChildrenPath),pagination:asObject(endpoint.pagination),paramBindings:asArray(endpoint.paramBindings).map((binding)=>{if(binding.from!=="endpoint")return{...binding};let{endpointId,...rest3}=binding;return{...rest3,endpointName:nameById.get(String(endpointId))??null}}),enabled:endpoint.enabled!==!1})),mappings:mappings.map((mapping)=>({name:String(mapping.name??""),endpointName:nameById.get(String(mapping.endpointId))??null,targetEntity:String(mapping.targetEntity??""),fieldMappings:asArray(mapping.fieldMappings),referenceChecks:asArray(mapping.referenceChecks),dedupSourceField:text(mapping.dedupSourceField),dedupTargetField:text(mapping.dedupTargetField),writeMode:String(mapping.writeMode??"upsert")??"upsert",missingRecordPolicy:String(mapping.missingRecordPolicy??"ignore")??"ignore",missingRecordColumn:text(mapping.missingRecordColumn),missingRecordValue:text(mapping.missingRecordValue),removalScopeColumn:text(mapping.removalScopeColumn),passwordTargetColumn:text(mapping.passwordTargetColumn),accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:text(mapping.scheduleCron),scheduleTimezone:text(mapping.scheduleTimezone),enabled:mapping.enabled!==!1}))}}function validateTransferDocument(value2){let problems=[],doc=asObject(value2);if(!doc)return{ok:!1,document:null,problems:[{path:"",message:"This is not an integration export file."}]};if(typeof doc.version!=="number")problems.push({path:"version",message:"The file does not say which format it is in."});else if(doc.version>1)problems.push({path:"version",message:`This file was written by a newer version (${doc.version}); this one understands up to 1.`});let connection=asObject(doc.connection);if(!connection)problems.push({path:"connection",message:"The file has no connection."});else{if(!text(connection.name))problems.push({path:"connection.name",message:"Missing name."});if(!text(connection.slug))problems.push({path:"connection.slug",message:"Missing slug."});if(!text(connection.baseUrl))problems.push({path:"connection.baseUrl",message:"Missing base URL."})}let endpoints=asArray(doc.endpoints),endpointNames=new Set;return endpoints.forEach((endpoint,index)=>{let name2=text(endpoint.name);if(!name2){problems.push({path:`endpoints[${index}].name`,message:"Missing name."});return}if(endpointNames.has(name2))problems.push({path:`endpoints[${index}].name`,message:`Two endpoints are called "${name2}"; names are how the rest of the file refers to them.`});if(endpointNames.add(name2),!text(endpoint.path))problems.push({path:`endpoints[${index}].path`,message:"Missing path."});if(!text(endpoint.tag))problems.push({path:`endpoints[${index}].tag`,message:"Missing tag."})}),endpoints.forEach((endpoint,index)=>{asArray(endpoint.paramBindings).forEach((binding,bindingIndex)=>{if(binding.from!=="endpoint")return;let target2=text(binding.endpointName);if(!target2||!endpointNames.has(target2))problems.push({path:`endpoints[${index}].paramBindings[${bindingIndex}]`,message:`Takes its value from an endpoint called "${target2??"?"}", which is not in this file.`})})}),asArray(doc.mappings).forEach((mapping,index)=>{if(!text(mapping.name))problems.push({path:`mappings[${index}].name`,message:"Missing name."});if(!text(mapping.targetEntity))problems.push({path:`mappings[${index}].targetEntity`,message:"Missing target table."});let endpointName=text(mapping.endpointName);if(!endpointName||!endpointNames.has(endpointName))problems.push({path:`mappings[${index}].endpointName`,message:`Reads from an endpoint called "${endpointName??"?"}", which is not in this file.`})}),{ok:problems.length===0,document:problems.length===0?doc:null,problems}}init_crypto();init_routeCollector();init_utils5();init_utils6();init_godminGuard();init_esm3();init_utils5();async function testConnection(chain,tokenCache,deps={}){let{source,oauth}=chain,fetchImpl=deps.fetchImpl;if(oauth){tokenCache.invalidate(source.id);let token=await getAccessToken(oauth,tokenCache,{fetchImpl});return token.ok?{ok:!0,detail:`A token was issued (${token.accessToken.length} characters). The credentials and token address are valid.`}:{ok:!1,error:token.error}}let built=buildUrl(source.baseUrl,"");if(!built.ok)return{ok:!1,error:built.error};let{headers}=applyAuth(source,built.url),outcome=await fetchOnce(source,{method:"GET",url:built.url,headers},{fetchImpl});if(outcome.status===0)return{ok:!1,error:outcome.error};return{ok:outcome.status<500,detail:`The address answered: HTTP ${outcome.status}.`,error:outcome.status>=500?outcome.error:void 0}}var PREVIEW_LIMIT=1500;async function sampleEndpoint(source,endpoint,pathParams,tokenCache,oauth,deps={}){let fetchImpl=deps.fetchImpl,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return blank({error:token.error});bearerToken=token.accessToken}let values={...endpoint.queryParams??{},...pathParams??{}},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return blank({error:`This endpoint needs a value for ${resolved.missing.map((m)=>`{${m}}`).join(", ")}. Enter an example value to test it (e.g. ${resolved.missing[0]} = 12345).`});let query={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;query[key2]=value2}let built=buildUrl(source.baseUrl,resolved.path,query);if(!built.ok)return blank({error:built.error});let{headers}=applyAuth({...source,token:bearerToken??source.token},built.url);if(bearerToken)headers.Authorization=`Bearer ${bearerToken}`;let outcome=await fetchOnce(source,{method:endpoint.method,url:built.url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl}),bodyKeys=outcome.body&&typeof outcome.body==="object"&&!Array.isArray(outcome.body)?Object.keys(outcome.body).slice(0,40):[];if(!outcome.ok)return blank({status:outcome.status,error:outcome.error??`HTTP ${outcome.status}`,bodyKeys,bodyPreview:previewBody(outcome.body)});let childrenPath=treeChildrenPath(endpoint.treeChildrenPath),extracted=extractRecords(outcome.body,endpoint.responseRootPath),flattened=childrenPath?flattenTree(extracted,childrenPath):null;if(flattened?.truncated)return blank({status:outcome.status,error:"This source answered with a structure that nests into itself, so it cannot be walked. Check the field named as the children.",bodyKeys,bodyPreview:previewBody(outcome.body)});let records=flattened?flattened.records:extracted;return{ok:!0,status:outcome.status,error:records.length===0?bodyKeys.length>0?`No record array was found. The response's top-level keys are: ${bodyKeys.join(", ")} \u2014 set the response root path to whichever holds the list.`:"No record array was found in the response.":null,recordCount:records.length,sample:records.slice(0,5),fields:records.length>0?flattenKeys(records[0]):[],bodyKeys,bodyPreview:previewBody(outcome.body)}}function blank(over){return{ok:!1,status:0,error:null,recordCount:0,sample:[],fields:[],bodyKeys:[],bodyPreview:null,...over}}function previewBody(body){if(body==null)return null;try{let text2=typeof body==="string"?body:JSON.stringify(body);return text2.length>PREVIEW_LIMIT?`${text2.slice(0,PREVIEW_LIMIT)}\u2026`:text2}catch{return null}}async function previewRun(chain,tokenCache,lookups,deps={}){let fetchImpl=deps.fetchImpl,{mapping,source,oauth}=chain,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return{ok:!1,error:token.error};bearerToken=token.accessToken}let root=chain.endpoints.find((e)=>e.id===chain.rootEndpointId);if(!root)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};let parents={},entityValues={},externalCalls=0;for(let binding of root.paramBindings??[]){if(binding.from==="endpoint"&&!parents[binding.endpointId]){let parentSpec=chain.endpoints.find((e)=>e.id===binding.endpointId);if(!parentSpec)continue;let collected2=await collectEndpoint(source,parentSpec,{},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected2.callCount,!collected2.ok)return{ok:!1,error:collected2.error};parents[binding.endpointId]=collected2.records.map((r)=>r.record)}if(binding.from==="entity"){let key2=`${binding.entity}.${binding.field}`;if(!entityValues[key2])entityValues[key2]=await lookups.readEntityColumn(binding.entity,binding.field)}}let collected=await collectEndpoint(source,root,{parents,entityValues},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected.callCount,!collected.ok)return{ok:!1,error:collected.error};let mapped3=buildMappedRecords(collected.records.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,collected.records.map((r)=>r.parent)),existing=await lookups.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>lookups.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>lookups.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await lookups.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,requiredFields:lookups.requiredFields(mapping.targetEntity),uniqueFields:lookups.uniqueFields(mapping.targetEntity),createDefaults:mapping.passwordColumn?{[mapping.passwordColumn]:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"}:{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous));let invalid=lookups.validateRows?.(ops.creates)??[];for(let problem of invalid){let create4=ops.creates.find((c)=>c.sourceIndex===problem.sourceIndex);ops.issues.push({sourceIndex:problem.sourceIndex,kind:"invalid_value",message:problem.message,row:create4?.data})}if(invalid.length>0){let refused=new Set(invalid.map((problem)=>problem.sourceIndex));ops.creates=ops.creates.filter((create4)=>!refused.has(create4.sourceIndex))}return{ok:!0,externalCalls,plan:summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:collected.records.length,reportedTotal:collected.reportedTotal,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)})}}init_crypto();import{and as and20,eq as eq34,inArray as inArray14}from"drizzle-orm";var camel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function tableFor(deps,entity){return deps.schemaTables[camel2(entity)]??null}var col8=(table,field)=>table?.[field]??table?.[camel2(field)];function open(deps,envelope,where){if(typeof envelope!=="string"||envelope==="")return"";let key2=deps.getEncryptionKey();if(!key2)return deps.logger.error("[Integrations] A stored credential cannot be read: no encryption key",{column:where}),"";try{return decryptSecret(envelope,key2)}catch{return deps.logger.error("[Integrations] A stored credential could not be decrypted \u2014 the encryption key has changed since it was saved. Re-enter it in the panel.",{column:where}),""}}async function resolveChain(deps,mappingId){let mappings=tableFor(deps,"integration_mappings"),endpoints=tableFor(deps,"integration_endpoints"),sources=tableFor(deps,"integration_sources");if(!mappings||!endpoints||!sources)return{ok:!1,error:"The integration tables are not present in this schema."};let[mappingRow]=await deps.db.select().from(mappings).where(eq34(col8(mappings,"id"),mappingId)).limit(1);if(!mappingRow)return{ok:!1,error:"This mapping no longer exists."};let row=mappingRow,[endpointRow]=await deps.db.select().from(endpoints).where(eq34(col8(endpoints,"id"),String(row.endpointId))).limit(1);if(!endpointRow)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};if(endpointRow.enabled===!1)return{ok:!1,error:"The call this mapping reads is switched off."};if(row.enabled===!1)return{ok:!1,error:"This mapping is switched off."};let sourceId=String(endpointRow.sourceId),siblingRows=await deps.db.select().from(endpoints).where(eq34(col8(endpoints,"sourceId"),sourceId)),[sourceRow]=await deps.db.select().from(sources).where(eq34(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"The source this mapping reads no longer exists."};let s=sourceRow;if(s.enabled===!1)return{ok:!1,error:"This source is switched off."};let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{ok:!0,chain:{mapping:toMappingSpec(row),endpoints:siblingRows.map((e)=>toEndpointSpec(e)),rootEndpointId:String(endpointRow.id),source,oauth}}}async function resolveEndpointContext(deps,by){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints");if(!sources||!endpoints)return{ok:!1,error:"The integration tables are not present in this schema."};let endpointRow=null,sourceId=by.sourceId;if(by.endpointId){let[row]=await deps.db.select().from(endpoints).where(eq34(col8(endpoints,"id"),by.endpointId)).limit(1);if(!row)return{ok:!1,error:"This endpoint no longer exists."};endpointRow=row,sourceId=String(endpointRow.sourceId)}if(!sourceId)return{ok:!1,error:"No source was named."};let[sourceRow]=await deps.db.select().from(sources).where(eq34(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"This source no longer exists."};let{source,oauth}=toConnection(deps,sourceRow);return{ok:!0,context:{source,oauth,endpoint:endpointRow?toEndpointSpec(endpointRow):null}}}async function cacheEndpointSample(deps,endpointId,records){let endpoints=tableFor(deps,"integration_endpoints");if(!endpoints||records.length===0)return;try{await deps.db.update(endpoints).set({sampleResponse:{records:records.slice(0,3)},updatedAt:new Date}).where(eq34(col8(endpoints,"id"),endpointId))}catch(error3){deps.logger.warn("[Integrations] Could not cache the endpoint sample",{endpointId,error:error3 instanceof Error?error3.message:String(error3)})}}function toConnection(deps,s){let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{source,oauth}}function toMappingSpec(row){return{id:String(row.id),name:String(row.name??""),targetEntity:String(row.targetEntity??""),fieldMappings:Array.isArray(row.fieldMappings)?row.fieldMappings:[],references:Array.isArray(row.referenceChecks)?row.referenceChecks:[],dedupTargetField:row.dedupTargetField||null,writeMode:String(row.writeMode??"upsert")??"upsert",missingPolicy:String(row.missingRecordPolicy??"ignore")??"ignore",missingColumn:row.missingRecordColumn??null,removalScopeColumn:row.removalScopeColumn||null,missingValue:row.missingRecordValue??null,originColumn:row.originColumn??null,originValue:row.originValue??null,maxRemovalShare:Number(row.maxRemovalShare??0)||0,passwordColumn:row.passwordTargetColumn||null,accountRule:row.accountRule??null}}function toEndpointSpec(row){let pagination=row.pagination;return{id:String(row.id),method:String(row.method??"GET"),path:String(row.path??""),queryParams:row.queryParams??null,requestBody:row.requestBody??null,responseRootPath:row.responseRootPath||null,treeChildrenPath:row.treeChildrenPath||null,pagination:pagination&&typeof pagination==="object"&&"kind"in pagination?pagination:{kind:"none"},paramBindings:Array.isArray(row.paramBindings)?row.paramBindings:null}}async function readConnectionBundle(deps,sourceId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return null;let[sourceRow]=await deps.db.select().from(sources).where(eq34(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return null;let endpointRows=await deps.db.select().from(endpoints).where(eq34(col8(endpoints,"sourceId"),sourceId)),ids=new Set(endpointRows.map((row)=>String(row.id))),allMappings=await deps.db.select().from(mappings);return{source:sourceRow,endpoints:endpointRows,mappings:allMappings.filter((row)=>ids.has(String(row.endpointId)))}}async function applyTransferDocument(deps,document,userId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return{ok:!1,error:"The integration tables are not present in this schema."};return deps.db.transaction(async(tx)=>{let now=new Date,c=document.connection,connectionValues={name:c.name,slug:c.slug,baseUrl:c.baseUrl,description:c.description??null,authType:c.authType,authHeaderName:c.authHeaderName??null,authQueryParam:c.authQueryParam??null,extraHeaders:c.extraHeaders??null,tokenUrl:c.tokenUrl??null,oauthGrantType:c.oauthGrantType??null,oauthClientId:c.oauthClientId??null,oauthUsername:c.oauthUsername??null,oauthScope:c.oauthScope??null,oauthClientAuth:c.oauthClientAuth??null,tlsVerify:c.tlsVerify!==!1,timeoutMs:c.timeoutMs??null,enabled:c.enabled!==!1,updatedAt:now,updatedBy:userId},[existingSource]=await tx.select().from(sources).where(eq34(col8(sources,"slug"),c.slug)).limit(1),sourceId,created=!1;if(existingSource)sourceId=String(existingSource.id),await tx.update(sources).set(connectionValues).where(eq34(col8(sources,"id"),sourceId));else{let[row]=await tx.insert(sources).values({...connectionValues,createdAt:now,createdBy:userId}).returning();if(!row?.id)return{ok:!1,error:"The connection could not be created."};sourceId=String(row.id),created=!0}let existingEndpoints=await tx.select().from(endpoints).where(eq34(col8(endpoints,"sourceId"),sourceId)),endpointIdByName=new Map;for(let row of existingEndpoints)endpointIdByName.set(String(row.name),String(row.id));for(let endpoint of document.endpoints){let values={sourceId,name:endpoint.name,tag:endpoint.tag,method:endpoint.method,path:endpoint.path,description:endpoint.description??null,queryParams:endpoint.queryParams??null,requestBody:endpoint.requestBody??null,responseRootPath:endpoint.responseRootPath??null,treeChildrenPath:endpoint.treeChildrenPath??null,pagination:endpoint.pagination??null,enabled:endpoint.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=endpointIdByName.get(endpoint.name);if(existingId)await tx.update(endpoints).set(values).where(eq34(col8(endpoints,"id"),existingId));else{let[row]=await tx.insert(endpoints).values({...values,paramBindings:[],createdAt:now,createdBy:userId}).returning();if(row?.id)endpointIdByName.set(endpoint.name,String(row.id))}}for(let endpoint of document.endpoints){let id=endpointIdByName.get(endpoint.name);if(!id)continue;let bindings=(endpoint.paramBindings??[]).map((binding)=>{if(binding.from!=="endpoint")return binding;let{endpointName,...rest3}=binding;return{...rest3,endpointId:endpointIdByName.get(String(endpointName))??""}});await tx.update(endpoints).set({paramBindings:bindings,updatedAt:now}).where(eq34(col8(endpoints,"id"),id))}let allMappings=await tx.select().from(mappings),ownIds=new Set(endpointIdByName.values()),mappingIdByName=new Map;for(let row of allMappings)if(ownIds.has(String(row.endpointId)))mappingIdByName.set(String(row.name),String(row.id));let mappingCount=0;for(let mapping of document.mappings){let endpointId=mapping.endpointName?endpointIdByName.get(mapping.endpointName):void 0;if(!endpointId)continue;let values={endpointId,name:mapping.name,targetEntity:mapping.targetEntity,fieldMappings:mapping.fieldMappings??[],referenceChecks:mapping.referenceChecks??[],dedupSourceField:mapping.dedupSourceField??null,dedupTargetField:mapping.dedupTargetField??null,writeMode:mapping.writeMode,missingRecordPolicy:mapping.missingRecordPolicy,missingRecordColumn:mapping.missingRecordColumn??null,missingRecordValue:mapping.missingRecordValue??null,removalScopeColumn:mapping.removalScopeColumn??null,passwordTargetColumn:mapping.passwordTargetColumn??null,accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:mapping.scheduleCron??null,scheduleTimezone:mapping.scheduleTimezone??null,enabled:mapping.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=mappingIdByName.get(mapping.name);if(existingId)await tx.update(mappings).set(values).where(eq34(col8(mappings,"id"),existingId));else await tx.insert(mappings).values({...values,createdAt:now,createdBy:userId});mappingCount++}return{ok:!0,sourceId,created,endpoints:endpointIdByName.size,mappings:mappingCount}})}async function readScheduledMappings(deps){let mappings=tableFor(deps,"integration_mappings");if(!mappings)return[];return(await deps.db.select().from(mappings)).filter((row)=>row.scheduleEnabled===!0&&row.enabled!==!1).filter((row)=>typeof row.scheduleCron==="string"&&row.scheduleCron.trim()!=="").map((row)=>({id:String(row.id),name:String(row.name??""),scheduleCron:String(row.scheduleCron),scheduleTimezone:row.scheduleTimezone??null,lastRunAt:row.lastRunAt?new Date(row.lastRunAt):null,needsPassword:Boolean(row.passwordTargetColumn)||row.accountRule!=null}))}function requiredFieldsOf(entities,targetEntity){return(entities.find((e)=>e.table_name===targetEntity)?.columns??[]).filter((c)=>c.notNull===!0&&c.default===void 0&&!c.defaultRaw&&!c.nullable).map((c)=>camel2(c.name))}function uniqueFieldsOf(entities,targetEntity){let entity=entities.find((e)=>e.table_name===targetEntity),columns=entity?.columns??[],fields=new Set;for(let column of columns)if(column.unique===!0||column.primaryKey===!0)fields.add(camel2(column.name));for(let index of entity?.indexes??[])if(index.unique===!0&&index.columns.length===1&&index.columns[0])fields.add(camel2(index.columns[0]));return fields.delete("id"),[...fields]}function createRunRepository(deps,entities){let runs=()=>tableFor(deps,"integration_runs"),runItems=()=>tableFor(deps,"integration_run_items");return{async openRun(input){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let id=(await deps.db.insert(table).values({mappingId:input.mappingId,targetEntity:input.targetEntity,writeMode:input.writeMode,trigger:input.trigger,status:"running",startedAt:new Date,createdBy:input.userId??null}).returning())[0]?.id;return id?{ok:!0,runId:String(id)}:{ok:!1,error:"The run record was created but returned no identifier."}}catch(error3){return{ok:!1,error:error3 instanceof Error?error3.message:String(error3)}}},async closeRun(runId,patch){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let mappingId=(await deps.db.update(table).set({...patch,updatedAt:new Date}).where(eq34(col8(table,"id"),runId)).returning())[0]?.mappingId,finishedAt=patch.finishedAt,mappings=tableFor(deps,"integration_mappings");if(mappings&&mappingId&&finishedAt)await deps.db.update(mappings).set({lastRunAt:finishedAt,updatedAt:new Date}).where(eq34(col8(mappings,"id"),String(mappingId)));return{ok:!0}}catch(error3){return deps.logger.error("[Integrations] Could not close the run record",{runId,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,error:"Could not write the run record."}}},async savePreImages(runId,images){let table=runItems();if(!table)return!1;if(images.length===0)return!0;let CHUNK2=500;try{return await deps.db.transaction(async(tx)=>{for(let i=0;i<images.length;i+=CHUNK2)await tx.insert(table).values(images.slice(i,i+CHUNK2).map((image)=>({runId,targetEntity:image.targetEntity,rowId:image.rowId,action:image.action,before:image.before,after:image.after})))}),!0}catch(error3){return deps.logger.error("[Integrations] The run succeeded but its before-images could not be stored; it cannot be undone",{runId,error:error3 instanceof Error?error3.message:String(error3)}),!1}},async isCancelRequested(runId){let table=runs();if(!table)return!1;try{let[row]=await deps.db.select().from(table).where(eq34(col8(table,"id"),runId)).limit(1);return row?.cancelRequested===!0}catch{return!1}},async readExistingRows(targetEntity){let table=tableFor(deps,targetEntity);if(!table)return[];return(await deps.db.select().from(table)).map((row)=>({id:String(row.id),row}))},async readEntityColumn(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0;if(!table||!column)return[];return(await deps.db.selectDistinct({v:column}).from(table)).map((r)=>r.v).filter((v)=>v!=null&&v!=="")},async readEntityIdsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return{};let rows=await deps.db.select({v:column,id:idColumn}).from(table),map3={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!map3[key2])map3[key2]=String(row.id)}return map3},async readEntityPairsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return[];return await deps.db.select({value:column,id:idColumn}).from(table)},requiredFields:(targetEntity)=>requiredFieldsOf(entities,targetEntity),uniqueFields:(targetEntity)=>uniqueFieldsOf(entities,targetEntity)}}async function readRowsById(deps,targetEntity,ids){let table=tableFor(deps,targetEntity),result=new Map;if(!table||ids.length===0)return result;let CHUNK2=1000;for(let i=0;i<ids.length;i+=CHUNK2){let rows=await deps.db.select().from(table).where(inArray14(col8(table,"id"),ids.slice(i,i+CHUNK2)));for(let row of rows)result.set(String(row.id),row)}return result}async function readPreImages(deps,runId){let table=tableFor(deps,"integration_run_items");if(!table)return[];return(await deps.db.select().from(table).where(eq34(col8(table,"runId"),runId))).map((row)=>({targetEntity:String(row.targetEntity),rowId:row.rowId?String(row.rowId):null,action:String(row.action),before:row.before??null,after:row.after??null}))}async function readRun(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return null;let[row]=await deps.db.select().from(table).where(eq34(col8(table,"id"),runId)).limit(1);return row??null}async function requestCancel(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return!1;return(await deps.db.update(table).set({cancelRequested:!0,updatedAt:new Date}).where(and20(eq34(col8(table,"id"),runId),eq34(col8(table,"status"),"running"))).returning()).length>0}var fail3=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createInspectRoutes(routeConfig,deps,tokenCache){let settings=routeConfig.resolvedOptions.integrations??{};return[defineRoute({method:"POST",path:"/sources/:id/test",detail:{tags:["Integrations"],summary:"Check a source is reachable and its credentials are accepted"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{sourceId:params.id});if(!context.ok)return fail3(set2,404,context.error);let result=await testConnection(context.context,tokenCache);return{isSuccess:result.ok,message:result.ok?result.detail??"Connected.":result.error??"Could not connect.",data:result}}}),defineRoute({method:"POST",path:"/endpoints/:id/sample",body:Type.Optional(Type.Object({pathParams:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})),detail:{tags:["Integrations"],summary:"Call one endpoint once and report its real shape"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{endpointId:params.id});if(!context.ok)return fail3(set2,404,context.error);let{source,oauth,endpoint}=context.context;if(!endpoint)return fail3(set2,404,"This endpoint no longer exists.");let result=await sampleEndpoint(source,endpoint,body?.pathParams,tokenCache,oauth);if(result.ok&&result.sample.length>0)await cacheEndpointSample(repoDeps,params.id,result.sample);return{isSuccess:result.ok,message:result.error??"Sampled.",data:result}}}),defineRoute({method:"POST",path:"/preview",body:Type.Object({mappingId:Type.String()}),detail:{tags:["Integrations"],summary:"Dry-run an import: counts, warnings and a sample, with no writes"},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let repo=createRunRepository(repoDeps,repoDeps.entities),result=await previewRun(chain.chain,tokenCache,{readExistingRows:repo.readExistingRows,readEntityColumn:repo.readEntityColumn,requiredFields:repo.requiredFields,uniqueFields:repo.uniqueFields,readEntityIdsBy:repo.readEntityIdsBy,readEntityPairsBy:repo.readEntityPairsBy,validateRows:(rows)=>{let columns=repoDeps.entities.find((e)=>e.table_name===chain.chain.mapping.targetEntity)?.columns??[],problems=[];for(let row of rows){let result2=validatePayload(row.data,columns,!1);if(!result2.valid)problems.push({sourceIndex:row.sourceIndex,message:result2.errors.map((e)=>`${e.field}: ${e.message}`).join("; ")})}return problems}},{maxRecords:settings.maxRecordsPerRun,maxConcurrent:settings.maxConcurrentFanout});if(!result.ok)return fail3(set2,422,result.error);return{isSuccess:!0,message:"Nothing was written.",data:{plan:result.plan,externalCalls:result.externalCalls}}}}),defineRoute({method:"POST",path:"/schedule-check",body:Type.Object({mappingId:Type.String(),at:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Simulate the schedule: the next firings, and whether a given moment is one",description:"Writes nothing and starts nothing. Answers the question a schedule cannot otherwise be asked until the night it runs: does this expression name the minute I meant, in the clock I meant."},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let raw=chain.chain.mapping,expression=String(raw.scheduleCron??"").trim(),timeZone=String(raw.scheduleTimezone??"").trim()||"UTC";if(expression==="")return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression:"",timeZone,times:[]}};let at=body.at?new Date(body.at):new Date;if(Number.isNaN(at.getTime()))return fail3(set2,400,"That is not a moment I can read.");let upcoming=nextFireTimes({expression,timeZone,from:at,count:5}),verdict=isDue({expression,timeZone,now:at,lastRunAt:null});return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression,timeZone,describes:describeCron(expression,timeZone),at:at.toISOString(),wouldFireAtThatMoment:verdict.due,error:verdict.error??upcoming.error??null,times:upcoming.times.map((t)=>t.toISOString())}}}})]}var fail4=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};async function closeAbandonedRuns(repoDeps,mappingId,logger2){try{let runsTable=tableFor(repoDeps,"integration_runs");if(!runsTable)return;let{and:and21,eq:eq35,inArray:inArray15}=await import("drizzle-orm"),closed=await repoDeps.db.update(runsTable).set({status:"failed",finishedAt:new Date,errors:["This import stopped without finishing \u2014 the process running it went away (a restart, a deploy, or a crash). Whatever it had already written is still there; run it again, or check the target table."],updatedAt:new Date}).where(and21(eq35(runsTable.mappingId,mappingId),inArray15(runsTable.status,["running","queued"]))).returning();if(closed.length>0)logger2.warn(`[Integrations] ${closed.length} run(s) of this mapping were left open by a process that went away; marked as failed.`)}catch(error3){logger2.error("[Integrations] Could not close abandoned runs",error3)}}var tokenCache=new TokenCache;function createIntegrationRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,resolvedOptions,getEncryptionKey,getLockStore,publish}=routeConfig,entities=resolveEntities(SYSTEM_TABLES,resolvedOptions.entities??[],{consumerMode:resolvedOptions.authentication?.mode==="consumer"}).entities,settings=resolvedOptions.integrations??{},topicPrefix=settings.realtimeTopicPrefix||"integrations",guard4=createGodminGuard({logger:logger2,db,schemaTables,area:"data integrations",allowedRoles:routeConfig.adminRoles??settings.adminRoles}),deps=()=>db?{db,schemaTables,entities,logger:logger2,getEncryptionKey}:null,inspectRoutes=createInspectRoutes(routeConfig,deps,tokenCache),writerFor=(repoDeps,targetEntity)=>{let table=tableFor(repoDeps,targetEntity);if(!table)return null;let entity=entities.find((e)=>e.table_name===targetEntity);return{db:repoDeps.db,drizzleTable:table,resolveCol:(field)=>table[field]??table[field.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase())],columns:entity?.columns??[],logger:logger2,validatePayload,resolveEntity:(name2)=>{let refTable=tableFor(repoDeps,name2);if(!refTable)return null;let refEntity=entities.find((e)=>e.table_name===name2);return{table:refTable,columns:refEntity?.columns??[]}},accountClosure:accountClosureFor(targetEntity)}};function accountClosureFor(targetEntity){let link=accountLinkFor(routeConfig.resolvedOptions.authentication?.accountLinks,targetEntity);if(!link)return null;let usersTable=schemaTables.users;if(!usersTable)return null;let sessionsTable=schemaTables.userSessions??schemaTables.sessions;return{userColumn:link.userColumn,accountEntity:"users",usersTable,sessionsTable:sessionsTable??null}}let routePostRuns=defineRoute({method:"POST",path:"/runs",body:Type.Object({mappingId:Type.String(),confirm:Type.Optional(Type.Boolean()),sharedPassword:Type.Optional(Type.String()),referenceMode:Type.Optional(Type.Union([Type.Literal("create"),Type.Literal("skipRecord")]))}),detail:{tags:["Integrations"],summary:"Start an import; answers 202 with the run identifier"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail4(set2,404,chain.error);let declared2=chain.chain.mapping,answer=body.referenceMode,mapping=answer?{...declared2,references:(declared2.references??[]).map((check)=>check.onMissing==="ignore"?check:{...check,onMissing:answer})}:declared2,wantsPassword=Boolean(mapping.passwordColumn||mapping.accountRule),createDefaults,accountPasswordHash=null;if(wantsPassword){let supplied=typeof body.sharedPassword==="string"?body.sharedPassword:"";if(supplied.length<8)return fail4(set2,422,mapping.accountRule?"This import creates a login for every new record, so it needs a password to create them with: send sharedPassword, at least 8 characters. It is used once, for this run, and is stored nowhere.":`This mapping writes a password into "${mapping.passwordColumn}", so it needs one to write: send sharedPassword, at least 8 characters. It is used for the accounts this run creates and is not stored anywhere.`);let hash=await hashPassword(supplied);if(accountPasswordHash=hash,mapping.passwordColumn)createDefaults={[mapping.passwordColumn]:hash}}if(isDestructive(mapping.writeMode,mapping.missingPolicy)&&body.confirm!==!0)return set2.status=428,{isSuccess:!1,message:mapping.writeMode==="replace"?"This mapping rebuilds the whole table. Send confirm: true to proceed.":mapping.missingPolicy==="deactivate"?"This mapping deactivates records the source no longer carries. Send confirm: true to proceed.":"This mapping deletes records the source no longer carries. Send confirm: true to proceed.",data:null};let lockStore=getLockStore();if(!lockStore)return fail4(set2,503,"The lock service is unavailable, so a second run of this mapping could not be prevented. Runs are refused until it is back.");let lock=await acquireRunLock(lockStore,mapping.id,{logger:logger2});if(!lock.ok){if(lock.reason==="unavailable")return fail4(set2,503,`The lock service is unavailable: ${lock.error}`);return set2.status=409,{isSuccess:!1,message:"This mapping is already importing. Wait for it to finish, or cancel it.",data:{heldSince:lock.heldSince}}}await closeAbandonedRuns(repoDeps,mapping.id,logger2);let writer=writerFor(repoDeps,mapping.targetEntity);if(!writer)return await lock.handle.release(),fail4(set2,422,`This mapping targets "${mapping.targetEntity}", which does not exist.`);let userId=request.headers.get("x-user-id")??"unknown",repo=createRunRepository(repoDeps,entities),announce=()=>{},runIdReady=new Promise((resolve2)=>{announce=resolve2}),started=executeRun({...chain.chain,mapping,userId,trigger:"manual",createDefaults,accountPasswordHash},{repo,writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),onRunOpened:(id)=>announce(id),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle),runId=await Promise.race([runIdReady,started.then((outcome)=>outcome.runId)]);return started.catch(async(error3)=>{let reason=error3 instanceof Error?error3.message:String(error3);logger2.error("[Integrations] Run threw outside its own error handling",{mappingId:mapping.id,error:reason});let openedId=await runIdReady.catch(()=>null);if(openedId)await repo.closeRun(openedId,{status:"failed",finishedAt:new Date,errors:[reason]}).catch(()=>{})}).finally(()=>lock.handle.release()),set2.status=202,{isSuccess:!0,message:"The import has started.",data:{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity}}}}),startScheduledRun=async(mappingId)=>{let repoDeps=deps();if(!repoDeps)return!1;let chain=await resolveChain(repoDeps,mappingId);if(!chain.ok)return logger2.error(`[Integrations] Scheduled import cannot run: ${chain.error}`),!1;let lockStore=getLockStore();if(!lockStore)return!1;let lock=await acquireRunLock(lockStore,mappingId,{logger:logger2});if(!lock.ok)return!1;let writer=writerFor(repoDeps,chain.chain.mapping.targetEntity);if(!writer)return await lock.handle.release(),logger2.error(`[Integrations] Scheduled import targets "${chain.chain.mapping.targetEntity}", which does not exist.`),!1;return executeRun({...chain.chain,userId:null,trigger:"schedule"},{repo:createRunRepository(repoDeps,entities),writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle).then((outcome)=>{if(outcome.status!=="succeeded")logger2.error(`[Integrations] Scheduled import "${chain.chain.mapping.name}" ${outcome.status}: ${outcome.failure?.message??"no reason recorded"}`)}).catch((error3)=>{logger2.error("[Integrations] Scheduled import threw outside its own error handling",{mappingId,error:error3 instanceof Error?error3.message:String(error3)})}).finally(()=>lock.handle.release()),!0},unattendable=new Set;if(settings.schedulesEnabled!==!1)startScheduler({logger:logger2,listScheduled:async()=>{let repoDeps=deps();if(!repoDeps)return[];return(await readScheduledMappings(repoDeps)).filter((row)=>{if(!row.needsPassword)return!0;if(!unattendable.has(row.id))unattendable.add(row.id),logger2.error(`[Integrations] "${row.name}" is scheduled but creates logins, which need a password nobody can type at that hour. It will not run on its own \u2014 start it by hand, or turn the login off.`);return!1})},startRun:(mappingId)=>startScheduledRun(mappingId)});let routeGetSourcesIdExport=defineRoute({method:"GET",path:"/sources/:id/export",detail:{tags:["Integrations"],summary:"Export a connection, its calls and its mappings \u2014 without any secret"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let bundle=await readConnectionBundle(repoDeps,params.id);if(!bundle)return fail4(set2,404,"This connection no longer exists.");let document=buildTransferDocument({...bundle,exportedAt:new Date().toISOString()});return{isSuccess:!0,message:`${document.endpoints.length} call(s) and ${document.mappings.length} mapping(s). Credentials are NOT included \u2014 they are asked for again on the other side.`,data:document}}}),routePostImport=defineRoute({method:"POST",path:"/import",body:Type.Object({document:Type.Unknown()}),detail:{tags:["Integrations"],summary:"Bring in an exported connection; re-running it updates rather than duplicates"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let checked=validateTransferDocument(body?.document);if(!checked.ok||!checked.document)return set2.status=422,{isSuccess:!1,message:"This file cannot be imported as it stands.",data:{problems:checked.problems}};let userId=request.headers.get("x-user-id")??"unknown",result=await applyTransferDocument(repoDeps,checked.document,userId);if(!result.ok)return fail4(set2,422,result.error);return{isSuccess:!0,message:`Connection "${checked.document.connection.name}" is here: ${result.endpoints} call(s) and ${result.mappings} mapping(s). Its credentials are not \u2014 enter them before running anything.`,data:result}}}),routePostRunsIdCancel=defineRoute({method:"POST",path:"/runs/:id/cancel",detail:{tags:["Integrations"],summary:"Ask a running import to stop"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");if(!await requestCancel(repoDeps,params.id))return fail4(set2,409,"This run is not running, so there is nothing to cancel.");return{isSuccess:!0,message:"Cancellation requested. The import stops at its next checkpoint and anything it had written is rolled back.",data:{runId:params.id}}}}),routePostRunsIdRevert=defineRoute({method:"POST",path:"/runs/:id/revert",body:Type.Optional(Type.Object({force:Type.Optional(Type.Boolean())})),detail:{tags:["Integrations"],summary:"Undo a run that succeeded"},handler:async({params,body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let run=await readRun(repoDeps,params.id);if(!run)return fail4(set2,404,"This run no longer exists.");if(run.status!=="succeeded")return fail4(set2,409,`Only a run that finished successfully can be undone; this one is "${String(run.status)}".`);let expiry=run.preImagesExpireAt?new Date(String(run.preImagesExpireAt)):null;if(expiry&&expiry.getTime()<Date.now())return fail4(set2,410,"This run is too old to undo: the records of what it replaced have been cleared.");let targetEntity=String(run.targetEntity??""),preImages=await readPreImages(repoDeps,params.id);if(preImages.length===0)return fail4(set2,410,"There is no record of what this run replaced, so it cannot be undone.");let groups=groupPreImagesByEntity(preImages).sort((a,b)=>a.targetEntity===targetEntity?-1:b.targetEntity===targetEntity?1:0),planned=[];for(let group of groups){let current=await readRowsById(repoDeps,group.targetEntity,touchedRowIds(group.preImages));planned.push({targetEntity:group.targetEntity,ops:planRevert({preImages:group.preImages,current,force:body?.force===!0})})}let ops={deletes:planned.flatMap((p)=>p.ops.deletes),restores:planned.flatMap((p)=>p.ops.restores),reinserts:planned.flatMap((p)=>p.ops.reinserts),conflicts:planned.flatMap((p)=>p.ops.conflicts)};if(ops.deletes.length===0&&ops.restores.length===0&&ops.reinserts.length===0&&ops.conflicts.length>0)return set2.status=409,{isSuccess:!1,message:"Every record this run touched has been edited since. Undoing would discard those edits; send force: true to overwrite them anyway.",data:{conflicts:ops.conflicts}};let userId=request.headers.get("x-user-id")??"unknown";for(let group of planned)if(!writerFor(repoDeps,group.targetEntity))return fail4(set2,422,`"${group.targetEntity}" no longer exists.`);let undone={deleted:0,restored:0,reinserted:0},failure=null;try{await repoDeps.db.transaction(async(tx)=>{for(let group of planned){let groupWriter=writerFor(repoDeps,group.targetEntity),result2=await applyRevert(groupWriter,group.ops,{targetEntity:group.targetEntity,userId,tx});if(!result2.ok)throw failure=result2.error??"The undo could not be completed.",Error(failure);undone={deleted:undone.deleted+(result2.deleted??0),restored:undone.restored+(result2.restored??0),reinserted:undone.reinserted+(result2.reinserted??0)}}})}catch(error3){let message=failure??(error3 instanceof Error?error3.message:"The undo could not be completed.");return fail4(set2,500,`${message} Nothing was undone \u2014 every table was rolled back together.`)}let result={ok:!0,...undone,conflicts:ops.conflicts.length},finished=ops.conflicts.length===0,runsTable=tableFor(repoDeps,"integration_runs");if(runsTable&&finished){let{eq:eq35}=await import("drizzle-orm");await repoDeps.db.update(runsTable).set({status:"reverted",revertedAt:new Date,revertedBy:userId}).where(eq35(runsTable.id,params.id))}return{isSuccess:!0,message:finished?"The import was undone.":`Undone except for ${ops.conflicts.length} record(s) edited since the import. They were left as they are \u2014 send force: true to overwrite them too.`,data:{deleted:result.deleted,restored:result.restored,reinserted:result.reinserted,conflicts:ops.conflicts}}}}),routePutSourcesIdCredentials=defineRoute({method:"PUT",path:"/sources/:id/credentials",body:Type.Object({token:Type.Optional(Type.String()),oauthClientSecret:Type.Optional(Type.String()),oauthPassword:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Store a source credential; only a masked preview is returned"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let key2=getEncryptionKey();if(!key2)return fail4(set2,503,"No encryption key is configured, so a credential stored now could never be read back.");let table=tableFor(repoDeps,"integration_sources");if(!table)return fail4(set2,503,"The integration tables are not present in this schema.");let patch={},hints={},apply=(value2,column,hintColumn,name2)=>{if(value2===void 0)return;let trimmed=value2.trim();if(trimmed===""){patch[column]=null,patch[hintColumn]=null,hints[name2]=null;return}patch[column]=encryptSecret(trimmed,key2),patch[hintColumn]=previewOf(trimmed),hints[name2]=previewOf(trimmed)};if(apply(body.token,"authTokenEncrypted","authTokenHint","token"),apply(body.oauthClientSecret,"oauthClientSecretEncrypted","oauthClientSecretHint","clientSecret"),apply(body.oauthPassword,"oauthPasswordEncrypted","oauthPasswordHint","password"),Object.keys(patch).length===0)return{isSuccess:!0,message:"Nothing to change.",data:{hints}};let{eq:eq35}=await import("drizzle-orm");return await repoDeps.db.update(table).set({...patch,updatedAt:new Date}).where(eq35(table.id,params.id)),tokenCache.invalidate(params.id),{isSuccess:!0,message:"Saved.",data:{hints}}}});logger2.info(`[Integrations] Routes enabled at ${basePath}`);let declared=[routePostRuns,routeGetSourcesIdExport,routePostImport,routePostRunsIdCancel,routePostRunsIdRevert,routePutSourcesIdCredentials,...inspectRoutes];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function parseDuration(value2){if(!value2)return;let match=value2.trim().match(/^(\d+)\s*([smhd])$/i);if(!match)return;let amount=Number(match[1]),unit=(match[2]??"d").toLowerCase();return amount*(unit==="s"?1000:unit==="m"?60000:unit==="h"?3600000:86400000)}init_esm3();init_routeCollector();init_adminGuard();var STREAM_HEADERS={"Content-Type":"text/event-stream; charset=utf-8","Cache-Control":"no-cache, no-transform",Connection:"keep-alive"},textEncoder=new TextEncoder,encodeEvent=(event,data)=>{let payload=typeof data==="string"?data:JSON.stringify(data);return textEncoder.encode(`event: ${event}
 data: ${payload}
 
-`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard2({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();var CHANNELS=["portal","email","telegram","webhook"];function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0,type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},body:Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))}),detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual3}from"crypto";init_ack_manager();var clients=new Map,presenceBroadcastDebounce=new Map,DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual3(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{logger2.info("[PubSub] Periodic cleanup running",{totalClients:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text2=await request.text();eventData=JSON.parse(text2)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text2=await response.text(),json={};try{json=JSON.parse(text2)}catch{json=Object.fromEntries(new URLSearchParams(text2))}return{status:response.status,json,text:text2}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;if(!(contentType||"").toLowerCase().includes("application/x-www-form-urlencoded"))return;try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}function requiredBodyCeiling(input){if(!input.storageEnabled)return null;let perFile=input.maxFileSizeBytes;if(!perFile||!Number.isFinite(perFile)||perFile<=0)return null;let files=Math.max(1,Math.floor(input.maxFiles??1));return perFile*files+8388608}function bodyCeilingComplaint(input){if(input.required===null)return null;if((input.configured??134217728)>=input.required)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,source=input.configured==null?`the host passed no \`serve.maxRequestBodySize\`, so Bun's default of ${mb2(134217728)} applies`:`the host passed ${mb2(input.configured)}`;return`Uploads are configured up to ${mb2(input.required)}, but ${source}. `+"Anything larger is refused by the server before this application sees it \u2014 "+`the upload appears to run and then fails with nothing to show. Fix: raise \`storage.maxFileSizeBytes\` / \`security.maxRequestBodyBytes\` in the config, or pass \`maxRequestBodyBytes\` to \`createNucleusServer\`. The server needs ${input.required} bytes of headroom.`}function bunBodyCeilingFor(input){let wanted=Math.max(input.storageRequired??0,input.guardCeiling??0);return wanted>134217728?wanted:void 0}var APP_BASELINE_BYTES=268435456,COPIES_IN_FLIGHT=2;function memoryCeilingComplaint(input){if(input.required===null||input.cgroupLimit===null||input.cgroupLimit<=0)return null;let needed=input.required*COPIES_IN_FLIGHT+APP_BASELINE_BYTES;if(input.cgroupLimit>=needed)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,affordable=Math.max(0,Math.floor((input.cgroupLimit-APP_BASELINE_BYTES)/COPIES_IN_FLIGHT));return`Uploads are configured up to ${mb2(input.required)}, but this container is capped at ${mb2(input.cgroupLimit)} and an upload is held in memory twice on top of the ~${mb2(APP_BASELINE_BYTES)} `+`the app already holds \u2014 it needs ~${mb2(needed)}. The kernel will kill the process mid-upload. Fix: raise the container's memory limit to at least ${mb2(needed)}, or lower storage.maxFileSizeBytes to about ${mb2(affordable)}.`}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=socketIp?.trim()||"",chain=(forwardedFor||"").split(",").map((s)=>s.trim()).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq36=trimmed.indexOf("=");if(eq36>0)out[trimmed.slice(0,eq36)]=trimmed.slice(eq36+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){let out={};return headers.forEach((value2,key2)=>{out[key2]=SENSITIVE_HEADER_NAMES.has(key2.toLowerCase())?"[REDACTED]":value2}),out}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq36}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq36(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();import{eq as eq37}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log3=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq37(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq37(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(db,tenantRegistry,userId)=>{let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq37(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry3)=>{let schemaNames=registry3.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry3.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();import{eq as eq38}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log3=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};if(!(await db.select().from(usersTable).where(eq38(col11(usersTable,"id"),requestingUserId)).limit(1))[0]?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq38(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log3.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq38(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_utils6();import{eq as eq39}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log3=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log3.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq39(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq39(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq39(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log3.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq39(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log3.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log3.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log3.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq39(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log3.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq39(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_Notification();init_Verification();init_routeCollector();init_adminGuard();function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,defaultVerificationService=new VerificationService({db,schemaTables,config,logger:logger2}),defaultNotificationService=new NotificationService({db,schemaTables,config:routeConfig.notificationConfig||{enabled:!1},logger:logger2,getEmailService:routeConfig.getEmailService}),wireNotificationHandler=(verSvc,notifSvc)=>{verSvc.setNotificationHandler(async(params)=>{if(!routeConfig.notificationConfig?.enabled)return;await notifSvc.triggerNotifications({trigger:params.trigger,flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:params.node_id,verifier_id:params.verifier_id,decision:params.decision,context:params.context})})};wireNotificationHandler(defaultVerificationService,defaultNotificationService);let getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let reqVerSvc=new VerificationService({db,schemaTables:ctx.schemaTables,config,logger:logger2}),reqNotifSvc=new NotificationService({db,schemaTables:ctx.schemaTables,config:routeConfig.notificationConfig||{enabled:!1},logger:logger2,getEmailService:routeConfig.getEmailService});return wireNotificationHandler(reqVerSvc,reqNotifSvc),{verificationService:reqVerSvc,notificationService:reqNotifSvc}},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff})},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request,set:set2})=>{if(!hasGodminRole(request))return set2.status=403,{success:!1,message:"Forbidden: operator privileges required"};let{verificationService}=getServicesForRequest(request);return{success:!0,data:await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0})}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[{prefix:basePath,guards:[requireUser],routes:verificationDeclared}];if(logger2.info(`[Verification] Routes registered at ${basePath}`),config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,message:"Flow not found"};return{success:!0,data:result}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())})})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard2({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text2=asText(path7);if(!text2)return;return text2.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text2=asText(raw);if(!text2)return"Invalid request";let payload;try{payload=JSON.parse(text2)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column)=>({name:column.name,type:column.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})});if(mountRoutes(plugin,[{routes:[routeGetHealth]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
+`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard2({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();var CHANNELS=["portal","email","telegram","webhook"];function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0,type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},body:Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))}),detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual3}from"crypto";init_ack_manager();var clients=new Map,presenceBroadcastDebounce=new Map,DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual3(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{logger2.info("[PubSub] Periodic cleanup running",{totalClients:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text2=await request.text();eventData=JSON.parse(text2)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text2=await response.text(),json={};try{json=JSON.parse(text2)}catch{json=Object.fromEntries(new URLSearchParams(text2))}return{status:response.status,json,text:text2}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;let type4=(contentType||"").toLowerCase();if(type4.includes("application/x-www-form-urlencoded"))try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}if(type4.includes("multipart/form-data")&&rawBodyText.length<=MAX_SCANNED_BODY)return readMultipartField(rawBodyText,"email");return}var MAX_SCANNED_BODY=65536;function readMultipartField(body,field){let marker=`name="${field}"`,at=body.indexOf(marker);if(at<0)return;let separator=body.indexOf(`\r
+\r
+`,at),start=separator>=0?separator+4:body.indexOf(`
+
+`,at)+2;if(start<=1)return;let end=body.indexOf(`\r
+`,start),value2=(end>=0?body.slice(start,end):body.slice(start)).trim();return value2?value2:void 0}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}function requiredBodyCeiling(input){if(!input.storageEnabled)return null;let perFile=input.maxFileSizeBytes;if(!perFile||!Number.isFinite(perFile)||perFile<=0)return null;let files=Math.max(1,Math.floor(input.maxFiles??1));return perFile*files+8388608}function bodyCeilingComplaint(input){if(input.required===null)return null;if((input.configured??134217728)>=input.required)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,source=input.configured==null?`the host passed no \`serve.maxRequestBodySize\`, so Bun's default of ${mb2(134217728)} applies`:`the host passed ${mb2(input.configured)}`;return`Uploads are configured up to ${mb2(input.required)}, but ${source}. `+"Anything larger is refused by the server before this application sees it \u2014 "+`the upload appears to run and then fails with nothing to show. Fix: raise \`storage.maxFileSizeBytes\` / \`security.maxRequestBodyBytes\` in the config, or pass \`maxRequestBodyBytes\` to \`createNucleusServer\`. The server needs ${input.required} bytes of headroom.`}function bunBodyCeilingFor(input){let wanted=Math.max(input.storageRequired??0,input.guardCeiling??0);return wanted>134217728?wanted:void 0}var APP_BASELINE_BYTES=268435456,COPIES_IN_FLIGHT=2;function memoryCeilingComplaint(input){if(input.required===null||input.cgroupLimit===null||input.cgroupLimit<=0)return null;let needed=input.required*COPIES_IN_FLIGHT+APP_BASELINE_BYTES;if(input.cgroupLimit>=needed)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,affordable=Math.max(0,Math.floor((input.cgroupLimit-APP_BASELINE_BYTES)/COPIES_IN_FLIGHT));return`Uploads are configured up to ${mb2(input.required)}, but this container is capped at ${mb2(input.cgroupLimit)} and an upload is held in memory twice on top of the ~${mb2(APP_BASELINE_BYTES)} `+`the app already holds \u2014 it needs ~${mb2(needed)}. The kernel will kill the process mid-upload. Fix: raise the container's memory limit to at least ${mb2(needed)}, or lower storage.maxFileSizeBytes to about ${mb2(affordable)}.`}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=socketIp?.trim()||"",chain=(forwardedFor||"").split(",").map((s)=>s.trim()).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq36=trimmed.indexOf("=");if(eq36>0)out[trimmed.slice(0,eq36)]=trimmed.slice(eq36+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){let out={};return headers.forEach((value2,key2)=>{out[key2]=SENSITIVE_HEADER_NAMES.has(key2.toLowerCase())?"[REDACTED]":value2}),out}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq36}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq36(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();import{eq as eq37}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log3=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq37(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq37(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(db,tenantRegistry,userId)=>{let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq37(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry3)=>{let schemaNames=registry3.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry3.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();import{eq as eq38}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log3=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};if(!(await db.select().from(usersTable).where(eq38(col11(usersTable,"id"),requestingUserId)).limit(1))[0]?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq38(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log3.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq38(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_utils6();import{eq as eq39}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log3=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log3.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq39(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq39(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq39(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log3.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq39(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log3.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log3.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log3.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq39(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log3.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq39(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_Notification();init_Verification();init_routeCollector();init_adminGuard();function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,defaultVerificationService=new VerificationService({db,schemaTables,config,logger:logger2}),defaultNotificationService=new NotificationService({db,schemaTables,config:routeConfig.notificationConfig||{enabled:!1},logger:logger2,getEmailService:routeConfig.getEmailService}),wireNotificationHandler=(verSvc,notifSvc)=>{verSvc.setNotificationHandler(async(params)=>{if(!routeConfig.notificationConfig?.enabled)return;await notifSvc.triggerNotifications({trigger:params.trigger,flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:params.node_id,verifier_id:params.verifier_id,decision:params.decision,context:params.context})})};wireNotificationHandler(defaultVerificationService,defaultNotificationService);let getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let reqVerSvc=new VerificationService({db,schemaTables:ctx.schemaTables,config,logger:logger2}),reqNotifSvc=new NotificationService({db,schemaTables:ctx.schemaTables,config:routeConfig.notificationConfig||{enabled:!1},logger:logger2,getEmailService:routeConfig.getEmailService});return wireNotificationHandler(reqVerSvc,reqNotifSvc),{verificationService:reqVerSvc,notificationService:reqNotifSvc}},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff})},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request,set:set2})=>{if(!hasGodminRole(request))return set2.status=403,{success:!1,message:"Forbidden: operator privileges required"};let{verificationService}=getServicesForRequest(request);return{success:!0,data:await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0})}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[{prefix:basePath,guards:[requireUser],routes:verificationDeclared}];if(logger2.info(`[Verification] Routes registered at ${basePath}`),config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,message:"Flow not found"};return{success:!0,data:result}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())})})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard2({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text2=asText(path7);if(!text2)return;return text2.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text2=asText(raw);if(!text2)return"Invalid request";let payload;try{payload=JSON.parse(text2)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column)=>({name:column.name,type:column.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})});if(mountRoutes(plugin,[{routes:[routeGetHealth]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
 `);throw Error(`Invalid Nucleus config:
 ${detail}`)}let sensitiveNames=resolvedForBoot.flatMap((e)=>e.columns??[]).filter((c)=>c.sensitive===!0).map((c)=>c.name);{registerSensitiveColumns(sensitiveNames);let redactUnion=[...loggingConfig?.redactKeys||[],...sensitiveColumnNames()];if(logger2.configure({redactKeys:redactUnion}),Logger.getInstance().configure({redactKeys:redactUnion}),sensitiveNames.length>0)logger2.info("[Schema] Sensitive columns registered",{columns:sensitiveNames})}}let requestLogConfig={enabled:loggingConfig?.requests?.enabled!==!1,logArrival:loggingConfig?.requests?.logArrival===!0,includeQuery:loggingConfig?.requests?.includeQuery!==!1,slowThresholdMs:loggingConfig?.requests?.slowThresholdMs??3000,excludePaths:loggingConfig?.requests?.excludePaths??["/health"]},isRequestLogExcluded=(pathname)=>requestLogConfig.excludePaths.some((p)=>p.endsWith("*")?pathname.startsWith(p.slice(0,-1)):pathname===p),envValidation=validateEnvVariables(resolvedOptions);if(!envValidation.valid){for(let error3 of envValidation.errors)logger2.error(`[CONFIG] ${error3.message}`,{field:error3.field,envName:error3.envName});throw Error("Nucleus configuration error: Missing required environment variables. Check logs for details.")}let{resolved:envResolved}=envValidation;{let secretEntries=[["accessToken",envResolved.accessTokenSecret],["refreshToken",envResolved.refreshTokenSecret],["sessionToken",envResolved.sessionTokenSecret]];for(let[name2,value2]of secretEntries)if(value2&&value2.length<32)logger2.warn(`[Security] authentication.${name2}.secret is only ${value2.length} chars \u2014 use at least ${"32"} random bytes.`);let present=secretEntries.map(([,v])=>v).filter((v)=>!!v);if(present.length>1&&new Set(present).size<present.length)logger2.warn("[Security] Two or more of the access/refresh/session token secrets are identical \u2014 use a distinct secret for each.")}let tokenNames={access_token:authentication?.accessToken?.name||"access_token",refresh_token:authentication?.refreshToken?.name||"refresh_token",session_token:authentication?.sessionToken?.name||"session_token"},csrfConfig=resolveCsrfConfig(authentication?.csrf),csrfAuthCookieNames=[tokenNames.session_token,tokenNames.access_token],targetSchemaName=database?.sharedSchema||database?.schemas?.[0]||"main",targetSchema=pgSchema2(targetSchemaName);if(envResolved.databaseUrl)await ensureDatabaseExists(envResolved.databaseUrl,logger2,envResolved.databaseAuthMode);let db=null,dbPool=null,dbAuthMode=envResolved.databaseAuthMode||"password",backgroundIntervals=[],trackInterval=(timer)=>{timer.unref?.(),backgroundIntervals.push(timer)};if(envResolved.databaseUrl){let{Pool:Pool2}=await import("pg"),poolOptions=resolveDbPoolConfig(database?.pool);if(dbAuthMode==="password")dbPool=new Pool2({connectionString:envResolved.databaseUrl,...poolOptions});else{let{getPostgresToken:getPostgresToken2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure));await getPostgresToken2(),dbPool=new Pool2({connectionString:envResolved.databaseUrl,password:getPostgresToken2,ssl:{rejectUnauthorized:!0},...poolOptions}),logger2.info(`[Database] Using Entra ID auth mode: ${dbAuthMode}`)}db=drizzle2(dbPool),dbPool.on("error",(err)=>{logger2.warn("[Database] idle pool client error",{error:err instanceof Error?err.message:String(err)})})}let isMultiTenant=database?.isMultiTenant===!0,tenantRegistry=null,schemaTables={},schemaRelations={},claimsCache=null;if(config.schema){let schemasPath=__require("path").resolve(process.cwd(),config.schema),schemas=__require(schemasPath);schemaTables=schemas.createAllTablesForSchema?schemas.createAllTablesForSchema(targetSchema):{}}if(config.relations){let relationsPath=__require("path").resolve(process.cwd(),config.relations);schemaRelations=__require(relationsPath)}let secretsService=null;if(resolvedOptions.secrets?.enabled){let masterKey=resolveMasterKey(resolvedOptions.secrets.encryptionKey);if(!db)logger2.warn("[Secrets] secrets.enabled=true but no database is configured \u2014 disabled");else if(!masterKey)logger2.error("[Secrets] secrets.enabled=true but no encryption key resolved \u2014 set secrets.encryptionKey or NUCLEUS_SECRETS_KEY. Credential storage is disabled; env and literal values still work.");else if(!schemaTables[SECRETS_TABLE])logger2.error(`[Secrets] secrets.enabled=true but the "${SECRETS_TABLE}" table is missing from the generated schema \u2014 re-run schema generation. Credential storage is disabled.`);else{secretsService=new SecretsService({store:new SecretsStore({db,resolveTable:(tableName)=>schemaTables[tableName],masterKey}),logger:logger2,refreshIntervalMs:resolvedOptions.secrets.refreshIntervalMs,getRedis:()=>getRedisManager()}),logger2.info("[Secrets] Credential store enabled");try{if(await secretsService.refresh(),secretsService.isReady())logger2.info("[Secrets] Credentials preloaded for boot-time resolution",{storedCredentials:secretsService.size()})}catch(error3){logger2.warn("[Secrets] Preload failed \u2014 env and literal values still resolve",{error:error3 instanceof Error?error3.message:String(error3)})}}}let resolveCredential=(scope,key2,configValue)=>{if(secretsService)return secretsService.value(scope,key2,configValue);if(!configValue)return;let fromEnv=process.env[configValue];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(configValue)?void 0:configValue},resolveRedirectUrl=(value2)=>{if(!value2)return;let fromEnv=process.env[value2];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(value2)?void 0:value2},withResolvedRedirects=(node,keys)=>{if(!node)return node;let resolved={...node};for(let key2 of keys)if(typeof node[key2]==="string")resolved[key2]=resolveRedirectUrl(node[key2]);return resolved},trustedAppOrigins=()=>{let configured=normalizeTrustedOrigins(resolvedOptions.authentication?.trustedAppOrigins);if(!secretsService)return configured;let resolved=secretsService.listValue("authentication","trustedAppOrigins",configured);return resolved.length>0?resolved:configured},liveOAuthProviders=(resolvedProviders)=>{if(!secretsService)return resolvedProviders;let declared=resolvedOptions.authentication?.oauth?.providers??{},live={};for(let[providerName,providerConfig]of Object.entries(resolvedProviders)){let declaredConfig=declared[providerName]??{},entry={...providerConfig};for(let key2 of["clientId","clientSecret","tenantId","redirectUri"]){let declaredValue=declaredConfig[key2],bootValue=providerConfig[key2];Object.defineProperty(entry,key2,{get:()=>{let resolved=secretsService?.value(`authentication.oauth.providers.${providerName}`,key2,typeof declaredValue==="string"?declaredValue:void 0);if(resolved!==void 0)return resolved;return looksLikeEnvName(typeof bootValue==="string"?bootValue:void 0)?void 0:bootValue},enumerable:!0,configurable:!0})}live[providerName]=entry}return live},storageProvider=null;if(resolvedOptions.storage?.enabled){let storageBase=resolvedOptions.storage.basePath||"./uploads";storageProvider=createStorageProvider({provider:resolvedOptions.storage.provider,basePath:storageBase,smb:resolvedOptions.storage.smb,resolveCredential},{logger:logger2}),setStorageProvider(storageProvider)}let buildStorageProvider=(kind)=>{if(!resolvedOptions.storage?.enabled)return null;return createStorageProvider({provider:kind,basePath:resolvedOptions.storage.basePath||"./uploads",smb:resolvedOptions.storage.smb,resolveCredential:(scope,key2,configValue)=>scope==="storage"&&key2==="provider"?kind:resolveCredential(scope,key2,configValue)},{logger:logger2})};recordSwagger(config.swagger);let systemTables=config.systemTables||[];publicRoutes=buildPublicRoutes(resolvedOptions,systemTables,"",targetSchemaName),logger2.info(`[AUTH] Built ${publicRoutes.length} public routes`);let rateLimiter=null,warnedSharedRateLimitBucket=!1,peerDiversity=createPeerDiversityWatcher(),monitoringService=null,liveMonitoringService=null,lifecycleRecorder=null,LIFECYCLE_BEAT_MS=1e4,activeEmailProvider=()=>{let declared=resolveCredential("email","provider",resolvedOptions.email?.provider);if(declared==="azure"||declared==="gmail"||declared==="smtp")return emailProviderOn(declared)||resolvedOptions.email?.provider===declared?declared:null;if(emailProviderOn("azure"))return"azure";if(emailProviderOn("gmail"))return"gmail";if(emailProviderOn("smtp"))return"smtp";return null},emailProviderOn=(provider)=>{let configured=resolvedOptions.email?.[provider]?.enabled===!0;return secretsService?secretsService.flag(`email.${provider}`,"enabled",configured):configured},azureEmailCredentials=()=>{let azureConfig=resolvedOptions.email?.azure;return{enabled:!0,connectionString:resolveCredential("email.azure","connection_string",azureConfig?.connection_string)??"",senderAddress:resolveCredential("email.azure","sender_address",azureConfig?.sender_address)??"",fromName:resolveCredential("email.azure","from_name",azureConfig?.from_name)}},gmailCredentials=()=>{let gmailConfig=resolvedOptions.email?.gmail;return{enabled:!0,jsonFilePath:gmailConfig?.json_file_path,serviceAccountJson:resolveCredential("email.gmail","service_account_json",gmailConfig?.service_account_json),fromEmail:resolveCredential("email.gmail","from_email",gmailConfig?.from_email)??"",fromName:resolveCredential("email.gmail","from_name",gmailConfig?.from_name)}},smtpCredentials=()=>{let smtpConfig=resolvedOptions.email?.smtp,port=resolveCredential("email.smtp","port",smtpConfig?.port===void 0?void 0:String(smtpConfig.port)),secure=resolveCredential("email.smtp","secure",smtpConfig?.secure===void 0?void 0:String(smtpConfig.secure));return{enabled:!0,host:resolveCredential("email.smtp","host",smtpConfig?.host)??"",port:port?Number(port):void 0,secure:secure===void 0?void 0:String(secure)==="true",user:resolveCredential("email.smtp","user",smtpConfig?.user)??"",password:resolveCredential("email.smtp","password",smtpConfig?.password)??"",senderAddress:resolveCredential("email.smtp","sender_address",smtpConfig?.sender_address)??"",fromName:resolveCredential("email.smtp","from_name",smtpConfig?.from_name)}},azureService=null,gmailService=null,smtpService=null,getEmailService=()=>{let provider=activeEmailProvider();if(!provider)return null;if(provider==="azure"){if(!azureService)azureService=new AzureEmailService(azureEmailCredentials(),logger2),logger2.info("[AzureEmailService] Initialized",{available:azureService.isAvailable()});else azureService.reconfigure(azureEmailCredentials());return azureService}if(provider==="smtp"){if(!smtpService)smtpService=new SmtpEmailService(smtpCredentials(),logger2),logger2.info("[SmtpEmailService] Initialized",{available:smtpService.isAvailable()});else smtpService.applyConfig(smtpCredentials());return smtpService}if(!gmailService)gmailService=new GmailService(gmailCredentials(),logger2),logger2.info("[GmailService] Initialized",{available:gmailService.isAvailable()});else gmailService.reconfigure(gmailCredentials());return gmailService},nucleusRuntime=createNucleusRuntime({getEmailService,activeEmailProvider});if(recordRuntime(nucleusRuntime),resolvedOptions.liveMonitoring?.enabled){let liveBasePath=resolvedOptions.liveMonitoring.basePath||"/monitoring",liveStreamInterval=resolvedOptions.liveMonitoring.streamInterval||150;useRoutes(plugin,createLiveMonitoringRoutes({getService:()=>liveMonitoringService,getLifecycleRecorder:()=>lifecycleRecorder,logger:logger2,basePath:liveBasePath,streamInterval:liveStreamInterval,db,schemaTables}))}if(resolvedOptions.monitoring?.enabled&&resolvedOptions.monitoring.endpoints?.enabled){let monitoringEndpoints=resolvedOptions.monitoring.endpoints;useRoutes(plugin,createMonitoringRoutes({getService:()=>monitoringService,logger:logger2,endpoints:{enabled:!0,basePath:monitoringEndpoints.basePath||"/monitoring",allowRoles:monitoringEndpoints.allowRoles,stream:{enabled:monitoringEndpoints.stream?.enabled!==!1,path:monitoringEndpoints.stream?.path||"/stream",interval:monitoringEndpoints.stream?.interval||"5s"},snapshot:{enabled:monitoringEndpoints.snapshot?.enabled!==!1,path:monitoringEndpoints.snapshot?.path||"/snapshot"},history:{enabled:monitoringEndpoints.history?.enabled!==!1,path:monitoringEndpoints.history?.path||"/history",maxMinutes:monitoringEndpoints.history?.maxMinutes||60},alerts:{enabled:monitoringEndpoints.alerts?.enabled!==!1,path:monitoringEndpoints.alerts?.path||"/alerts"}},db,schemaTables}))}if(serverLogBuffer)useRoutes(plugin,createServerLogRoutes({buffer:serverLogBuffer,logger:logger2,basePath:serverLogsConfig?.basePath||resolvedOptions.monitoring?.endpoints?.basePath||"/monitoring",path:serverLogsConfig?.path||"/server-logs",allowRoles:serverLogsConfig?.allowRoles,streamEnabled:serverLogsConfig?.stream!==!1,clearEnabled:serverLogsConfig?.allowClear!==!1,db,schemaTables}));let bootStep=async(name2,run)=>{try{return await run()}catch(error3){logger2.error(`[Boot] Step "${name2}" failed \u2014 continuing in a degraded state rather than crashing`,{error:error3 instanceof Error?error3.message:String(error3)});return}},inboundGuard=createInboundGuard({maxRequestBodyBytes:resolvedOptions.security?.maxRequestBodyBytes});recordBootStep(async()=>{await bootStep("redis",()=>initiateRedisManager(resolvedOptions));let redis=getRedisManager();if(redis&&resolvedOptions.configManagement?.enabled)try{let{loadOverridesFromRedis:loadOverridesFromRedis2}=await Promise.resolve().then(() => (init_helpers4(),exports_helpers)),redisAdapter={read:async(key2)=>{let r=await redis.read(key2);return{success:r.success,data:r.success?r.data:null}}},{applied,ignored}=await loadOverridesFromRedis2(redisAdapter,resolvedOptions.appId||"nucleus",resolvedOptions);if(applied.length>0)logger2.info(`[ConfigManagement] Loaded ${applied.length} override(s) from Redis`,{sections:applied});if(ignored.length>0)logger2.warn(`[ConfigManagement] Ignored ${ignored.length} Redis override(s) naming no config section`,{sections:ignored})}catch(err){logger2.warn("[ConfigManagement] Failed to load overrides from Redis",{error:err instanceof Error?err.message:String(err)})}if(redis&&resolvedOptions.rateLimit?.enabled!==!1)rateLimiter=new RateLimiter({redis,logger:logger2,config:resolvedOptions.rateLimit||{}}),logger2.info(`[RateLimit] Enabled with strategy: ${resolvedOptions.rateLimit?.strategy||"sliding-window"}`);{let channels=resolvedOptions.notification?.channels;if(channels?.telegram?.enabled&&(!channels.telegram.botToken||!channels.telegram.chatId))logger2.warn("[Notification] telegram channel is enabled but botToken/chatId is missing \u2014 telegram deliveries will be skipped");if(channels?.webhook?.enabled&&!channels.webhook.url)logger2.warn("[Notification] webhook channel is enabled but url is missing \u2014 webhook deliveries will be skipped")}if(redis&&resolvedOptions.monitoring?.enabled){let monitoringDb=db,monitoringMetricsTable=schemaTables.monitoringMetrics,monitoringPersistenceEnabled=resolvedOptions.monitoring.persistence?.enabled!==!1,monitoringRetentionDays=resolvedOptions.monitoring.persistence?.retentionDays??30,lastMetricsCleanupAt=0,monitoringDbQuery=monitoringDb?async(sqlText)=>{return(await monitoringDb.execute(sql14.raw(sqlText))).rows}:void 0,monitoringLoadPeaks=monitoringDb&&monitoringPersistenceEnabled&&monitoringMetricsTable?async()=>{let t=monitoringMetricsTable;return(await monitoringDb.select({metricName:t.metricName,value:t.value,recordedAt:t.recordedAt,tags:t.tags}).from(t).where(eq68(t.metricType,"peak")).orderBy(desc7(t.value))).map((r)=>({metricName:String(r.metricName),value:Number(r.value??0),at:r.recordedAt?new Date(r.recordedAt).getTime():0,context:r.tags??void 0}))}:void 0;if(monitoringPersistenceEnabled&&monitoringDb&&!monitoringMetricsTable)logger2.warn("[Monitoring] monitoring.persistence is enabled but the monitoring_metrics table is missing from the generated schema \u2014 re-run nucleus-generate to add it");let monitoringFlushToDb=monitoringDb&&monitoringPersistenceEnabled&&monitoringMetricsTable?async(metrics)=>{if(metrics.length===0)return;let metricsTable=monitoringMetricsTable;await monitoringDb.insert(metricsTable).values(metrics.map((m)=>({metricType:m.metricType,metricName:m.metricName,value:m.value,tags:m.tags??null,recordedAt:new Date(m.timestamp)})));let nowMs=Date.now();if(nowMs-lastMetricsCleanupAt>86400000){lastMetricsCleanupAt=nowMs;let cutoff=new Date(nowMs-monitoringRetentionDays*24*60*60*1000);await monitoringDb.delete(metricsTable).where(and28(lt3(metricsTable.recordedAt,cutoff),ne4(metricsTable.metricType,"peak")))}}:void 0;monitoringService=new MonitoringService({redis,logger:logger2,getEmailService,config:resolvedOptions.monitoring,appId:resolvedOptions.appId,dbQuery:monitoringDbQuery,flushToDb:monitoringFlushToDb,loadPeaks:monitoringLoadPeaks}),monitoringService.start(),logger2.info("[Monitoring] Service started")}if(resolvedOptions.liveMonitoring?.enabled)liveMonitoringService=new LiveMonitoringService(resolvedOptions.liveMonitoring),liveMonitoringService.start(),logger2.info("[LiveMonitoring] Service started");let lifecycleRedis=getRedisManager()?.getDirectClient?.();if(lifecycleRedis){lifecycleRecorder=new LifecycleRecorder({backend:redisLifecycleBackend(lifecycleRedis),labels:{...process.env.HOSTNAME?{host:process.env.HOSTNAME}:{},...process.env.APP_VERSION?{version:process.env.APP_VERSION}:{}},logger:logger2}),lifecycleRecorder.claim();let beat=setInterval(()=>{(async()=>{let memory=(await monitoringService?.getLatestSnapshot?.())?.system?.memory;await lifecycleRecorder?.touch(memory?{rss:memory.rss??0,heapUsed:memory.heapUsed,external:memory.external??0,total:memory.total,usagePercent:memory.usagePercent,scope:memory.scope}:void 0)})()},LIFECYCLE_BEAT_MS);backgroundIntervals.push(beat),process.on("uncaughtException",(error3)=>{lifecycleRecorder?.recordFatal(error3,"uncaughtException"),logger2.error("[Lifecycle] Uncaught exception",error3)}),process.on("unhandledRejection",(reason)=>{lifecycleRecorder?.recordFatal(reason,"unhandledRejection"),logger2.error("[Lifecycle] Unhandled rejection",reason)})}let isConsumerModeOnStart=authentication?.mode==="consumer",consumerAllowedTableKeys=isConsumerModeOnStart&&entities?new Set(entities.map((e)=>e.table_name.replace(/_([a-z])/g,(_,c)=>c.toUpperCase()))):null;if(consumerAllowedTableKeys){let opts=resolvedOptions,verificationEnabled=opts.verification?.enabled===!0,notificationEnabled=opts.notification?.enabled===!0,auditEnabled=opts.audit?.enabled===!0,chatEnabled=opts.chat?.enabled===!0,storageEnabled=opts.storage?.enabled===!0,paymentEnabled=opts.payment?.enabled===!0,backupEnabled=opts.backup?.enabled===!0,monitoringPersistenceOn=resolvedOptions.monitoring?.enabled===!0&&resolvedOptions.monitoring?.persistence?.enabled!==!1,featureEnabled={verification:verificationEnabled,notification:notificationEnabled,audit:auditEnabled,chat:chatEnabled,storage:storageEnabled,payment:paymentEnabled,backup:backupEnabled,monitoring:monitoringPersistenceOn,secrets:resolvedOptions.secrets?.enabled===!0,domains:resolvedOptions.domains?.enabled===!0,"multi-tenant":isMultiTenant};for(let sysTable of SYSTEM_TABLES)if(sysTable.feature_set.some((f)=>{if(f==="authentication"||f==="authorization")return!1;if(!(f in featureEnabled))return logger2.warn(`[Schema] Consumer mode has no rule for feature "${f}" (table "${sysTable.table_name}") \u2014 `+"its table will NOT be synced. Add it to featureEnabled in Nucleus/index.ts."),!1;return featureEnabled[f]===!0})){let camelKey=sysTable.table_name.replace(/_([a-z])/g,(_,c)=>c.toUpperCase());consumerAllowedTableKeys.add(camelKey)}}if(db&&config.schema){let schemas=await import(__require("path").resolve(process.cwd(),config.schema)),auditLogsTable=schemaTables.auditLogs||schemas.auditLogs;if(audit?.enabled&&auditLogsTable)logger2.addAuditTransport(new DatabaseAuditTransport({db,table:auditLogsTable,enabled:!0,dedup:audit.dedup}));let{ensureSchemaExists:ensureSchemaExists2,applySchemaPush:applySchemaPush2}=await Promise.resolve().then(() => (init_schema(),exports_schema)),{reconcileMissingColumns:reconcileMissingColumns2,expectedFromTables:expectedFromTables2,readActualSchema:readActualSchema2,undeclaredTables:undeclaredTables2}=await Promise.resolve().then(() => (init_schemaReconcile(),exports_schemaReconcile));try{logger2.info(`Syncing schema to database (target: ${targetSchemaName})...`),await ensureSchemaExists2(db,targetSchemaName);let filteredTables={};try{filteredTables=Object.fromEntries(Object.entries(schemaTables).filter(([key2,v])=>{if(v===void 0||v===null)return!1;if(consumerAllowedTableKeys&&!consumerAllowedTableKeys.has(key2))return!1;if(typeof v==="object"&&v!==null)return Object.getOwnPropertySymbols(v).length>0||v._!==void 0;return!1}));let tableNames=Object.keys(filteredTables);if(logger2.info("[Schema] Tables to sync:",{tables:tableNames,count:tableNames.length,mode:isConsumerModeOnStart?"consumer":"full"}),!isConsumerModeOnStart){let usersTableDef=filteredTables.users;if(usersTableDef){let columnSymbols=Object.getOwnPropertyNames(usersTableDef).filter((k)=>!k.startsWith("_"));logger2.info("[Schema] Users table columns:",{columns:columnSymbols})}}let realExit=process.exit,push;try{process.exit=(code)=>{throw Error(`drizzle-kit called process.exit(${code??0}) during pushSchema \u2014 `+"suppressed so the app can keep booting")};let excluded=await(async()=>{try{let actual=await readActualSchema2((statement)=>db.execute(sql14.raw(statement)),targetSchemaName);return undeclaredTables2(expectedFromTables2(filteredTables),actual)}catch{return[]}})();if(excluded.length>0)logger2.info(`[Schema] Excluding tables the model does not declare, so the push is not asked to resolve a rename it cannot: ${excluded.join(", ")}`);let timeoutMs=database?.schemaPushTimeoutMs??120000;push=await withDeadline(pushSchema({schema:targetSchema,...filteredTables},db,[targetSchemaName],excluded.length>0?excluded.map((name2)=>`!${name2}`):void 0),timeoutMs,`pushSchema did not finish within ${timeoutMs}ms. drizzle-kit most likely hit its `+"interactive rename prompt, which cannot be answered without a TTY \u2014 it appears "+"when a push adds a new table while another table exists in the database but not in the schema. Drop the stale table, or split the change across two deploys.")}finally{process.exit=realExit}if(await applySchemaPush2(push,{schemaName:targetSchemaName,allowDataLoss:database?.allowDataLoss===!0,logger:logger2,execute:(statement)=>db.execute(sql14.raw(statement))}))logger2.info("[Schema] pushSchema completed successfully")}catch(pushError){let msg=pushError instanceof Error?pushError.message:String(pushError),repair=await reconcileMissingColumns2({db,schema:targetSchemaName,tables:filteredTables,logger:logger2,schemaObject:targetSchema});if(!repair||repair.applied>0||repair.plan.createdTables.length>0||repair.plan.missingTables.length>0||repair.plan.unsafe.length>0)logger2.error(`[Schema] pushSchema applied NOTHING: ${msg}`);else logger2.info(`[Schema] pushSchema applied nothing, and nothing was needed \u2014 the database already matches the model. (${msg})`)}logger2.info("[Schema] Schema sync completed",{schema:targetSchemaName})}catch(error3){logger2.error("[Schema] Schema sync failed",error3,{schema:targetSchemaName})}try{let{relaxSessionExpiryIfNever:relaxSessionExpiryIfNever2}=await Promise.resolve().then(() => (init_relaxSessionExpiry(),exports_relaxSessionExpiry)),{sql:sql15}=await import("drizzle-orm");await relaxSessionExpiryIfNever2({db,sql:sql15,schemaName:targetSchemaName,lifetimeSeconds:lifetimeSeconds(authentication?.sessionToken?.expiresIn,2592000),logger:logger2})}catch(error3){logger2.warn("[Schema] Session expiry relaxation skipped",{error:String(error3)})}if(secretsService)try{await secretsService.start(),logger2.info("[Secrets] Credential store ready",{storedCredentials:secretsService.size()})}catch(error3){logger2.error("[Secrets] Credential store failed to start \u2014 env and literal values still resolve",{error:error3 instanceof Error?error3.message:String(error3)})}if(logger2.info("[Database] Connection established"),await bootStep("multi-tenant schemas",async()=>{if(isMultiTenant&&db&&config.schema){let schemasForTenant={};try{let schemaPath=__require("path").resolve(process.cwd(),config.schema);logger2.info("[MultiTenant] Loading schema for tenant registry",{schemaPath}),schemasForTenant=await import(schemaPath),logger2.info("[MultiTenant] Schema loaded",{keys:Object.keys(schemasForTenant).slice(0,10),hasCreateAll:!!schemasForTenant.createAllTablesForSchema})}catch(err){let msg=err instanceof Error?err.message:String(err);logger2.error("[MultiTenant] Failed to load schema for tenant registry",{error:msg})}let createAllFn=schemasForTenant.createAllTablesForSchema;if(createAllFn){let idpUrl=isConsumerModeOnStart?authentication?.idpUrl?String(process.env[authentication.idpUrl]||authentication.idpUrl):void 0:void 0;if(tenantRegistry=new TenantRegistry({db,logger:logger2,mainSchemaName:targetSchemaName,mainSchemaTables:schemaTables,mainSchemaRelations:schemaRelations,createAllTablesForSchema:createAllFn,createAllRelationsForSchema:schemasForTenant.createAllRelationsForSchema,appId:resolvedOptions.appId,authMode:authentication?.mode,tenantResolution:database?.tenantResolution||"both",tenantHeader:database?.tenantHeader||"x-tenant-id",redisCacheTtlSeconds:300,defaultTrustedSources:database?.defaultTrustedSources,idpUrl,allowDataLoss:database?.allowDataLoss===!0,onTenantProvisioned:resolvedOptions.authorization?.enabled&&!isConsumerModeOnStart?async(context)=>{let authConfig={...DEFAULT_AUTHORIZATION_CONFIG,...resolvedOptions.authorization};if(authConfig.autoSeedClaims&&db){let claimEntities=mergeEntitiesByName([...extractSchemaTableEntities(context.schemaTables),...SYSTEM_TABLES.map((table)=>normalizeSystemTable(table)),...effectiveConfigEntities(resolvedOptions.entities||[]),...config.systemTables||[],...resolvedOptions.authorization?.externalEntities||[]]);await seedClaims(db,context.schemaTables,context.schemaRelations,claimEntities,authConfig,logger2)}let seedConfig=resolvedOptions.authorization?.seed;if(seedConfig&&db){let{runSeed:runSeed2}=await Promise.resolve().then(() => (init_SeedRunner(),exports_SeedRunner));await runSeed2(db,context.schemaTables,seedConfig,logger2)}logger2.info(`[Authorization] New tenant schema seeded: ${context.schemaName}`)}:void 0}),isConsumerModeOnStart&&idpUrl){await tenantRegistry.initializeFromIdp(),logger2.info("[MultiTenant] Consumer mode: tenants fetched from IDP");let tenantSyncTimer=setInterval(()=>{tenantRegistry?.syncFromIdp().then((result)=>{if(result.added.length>0||result.removed.length>0)logger2.info(`[MultiTenant] Tenant sync: +${result.added.length} / -${result.removed.length} (total ${result.total})`)}).catch((err)=>{let msg=err instanceof Error?err.message:String(err);logger2.warn(`[MultiTenant] Tenant sync failed: ${msg}`)})},60000);trackInterval(tenantSyncTimer)}else await tenantRegistry.initialize();for(let schemaName of tenantRegistry.getAllSchemaNames()){if(schemaName===targetSchemaName)continue;let ctx=tenantRegistry.getSchemaContext(schemaName);if(ctx){await ensureSchemaExists2(db,schemaName);try{let tenantFilteredTables=Object.fromEntries(Object.entries(ctx.schemaTables).filter(([key2,v])=>{if(v===void 0||v===null)return!1;if(consumerAllowedTableKeys&&!consumerAllowedTableKeys.has(key2))return!1;if(typeof v==="object"&&v!==null)return Object.getOwnPropertySymbols(v).length>0||v._!==void 0;return!1})),tenantSchema=pgSchema2(schemaName),tenantPush=await pushSchema({schema:tenantSchema,...tenantFilteredTables},db,[schemaName]);if(await applySchemaPush2(tenantPush,{schemaName,allowDataLoss:database?.allowDataLoss===!0,logger:logger2,execute:(statement)=>db.execute(sql14.raw(statement))}))logger2.info(`[Schema] Tenant schema synced: ${schemaName}`)}catch(tenantPushError){let msg=tenantPushError instanceof Error?tenantPushError.message:String(tenantPushError);logger2.warn(`[Schema] Tenant schema sync warning for ${schemaName}: ${msg}`)}}}logger2.info(`[MultiTenant] Registry initialized with ${tenantRegistry.getAllSchemaNames().length} schemas`),logger2.info("[MultiTenant] Tenant registry ready, routes were pre-registered")}}}),resolvedOptions.authorization?.enabled&&!isConsumerModeOnStart){let authConfig={...DEFAULT_AUTHORIZATION_CONFIG,...resolvedOptions.authorization,godminEmail:resolveConfigCredential(resolvedOptions.authorization?.godminEmail),godminPassword:resolveConfigCredential(resolvedOptions.authorization?.godminPassword)};if(authConfig.autoSeedClaims){let schemaEntities=extractSchemaTableEntities(schemaTables),systemEntities=SYSTEM_TABLES.map((table)=>normalizeSystemTable(table)),configEntities=effectiveConfigEntities(resolvedOptions.entities||[]),externalEntities=resolvedOptions.authorization?.externalEntities||[],claimEntities=mergeEntitiesByName([...schemaEntities,...configEntities,...systemEntities,...config.systemTables||[],...externalEntities]);logger2.info("[Authorization] Seeding claims...",{schemaEntities:schemaEntities.length,systemEntities:systemEntities.length,configEntities:configEntities.length,externalEntities:externalEntities.length,totalEntities:claimEntities.length}),await seedClaims(db,schemaTables,schemaRelations,claimEntities,authConfig,logger2)}let discoveryConfig=resolvedOptions.authorization?.endpointDiscovery;if(discoveryConfig?.enabled&&(discoveryConfig.runOnBoot??!0)&&db)try{let{runEndpointDiscovery:runEndpointDiscovery2}=await Promise.resolve().then(() => (init_seed(),exports_seed)),discoveryResult=await runEndpointDiscovery2(db,schemaTables,discoveryConfig,logger2);logger2.info("[Authorization] Endpoint discovery completed",{services:discoveryResult.services})}catch(discoveryErr){logger2.error("[Authorization] Endpoint discovery failed",{error:discoveryErr instanceof Error?discoveryErr.message:String(discoveryErr)})}if(authConfig.godminEmail&&authConfig.godminPassword)logger2.info("[Authorization] Setting up godmin..."),await setupGodmin(db,schemaTables,authConfig,logger2);let seedConfig=resolvedOptions.authorization?.seed;if(seedConfig){let{runSeed:runSeed2}=await Promise.resolve().then(() => (init_SeedRunner(),exports_SeedRunner));logger2.info("[Authorization] Running custom seed...");let seedResult=await bootStep("authorization.seed",()=>runSeed2(db,schemaTables,seedConfig,logger2));if(seedResult)logger2.info("[Authorization] Custom seed completed",{rolesCreated:seedResult.rolesCreated,rolesExisting:seedResult.rolesExisting,claimsCreated:seedResult.claimsCreated,claimsExisting:seedResult.claimsExisting,assignmentsCreated:seedResult.assignmentsCreated,assignmentsExisting:seedResult.assignmentsExisting,assignmentsUpdated:seedResult.assignmentsUpdated})}let claimGuardsCfg=resolvedOptions.authorization?.claimGuards;if(claimGuardsCfg?.length){let{seedClaimGuards:seedClaimGuards2}=await Promise.resolve().then(() => (init_ClaimGuard(),exports_ClaimGuard));await bootStep("authorization.claimGuards",()=>seedClaimGuards2(db,schemaTables,claimGuardsCfg,logger2))}let jwtClaimsMode=resolvedOptions.authorization?.jwtClaimsMode||"embed",claimsCacheRedis=getRedisManager();if(jwtClaimsMode==="resolve"&&db&&claimsCacheRedis){let{ClaimsCache:ClaimsCache3}=await Promise.resolve().then(() => (init_ClaimsCache(),exports_ClaimsCache));claimsCache=new ClaimsCache3({prefix:resolvedOptions.authorization?.claimsCachePrefix||"nucleus:claims",redis:{get:async(key2)=>{let r=await claimsCacheRedis.read(key2);return r.success?r.data:null},set:async(key2,value2)=>{await claimsCacheRedis.create(key2,value2)},delete:async(key2)=>{await claimsCacheRedis.remove(key2)}},db,schemaTables,logger:logger2});let cacheInstance=claimsCache,cacheResult=await bootStep("authorization.claimsCache",()=>cacheInstance.buildCache());if(cacheResult)logger2.info("[Authorization] Claims cache built (resolve mode)",{version:cacheResult.version,roleCount:cacheResult.roleCount,totalMappings:cacheResult.totalMappings})}else if(jwtClaimsMode==="resolve"&&!claimsCacheRedis)logger2.warn("[Authorization] jwtClaimsMode=resolve requires Redis. Falling back to embed mode.");if(logger2.info("[Authorization] Enabled"),isMultiTenant&&tenantRegistry){let tenantSchemas=tenantRegistry.getAllSchemaNames().filter((name2)=>name2!==targetSchemaName);for(let tenantSchemaName of tenantSchemas){let tenantCtx=tenantRegistry.getSchemaContext(tenantSchemaName);if(!tenantCtx)continue;try{if(authConfig.autoSeedClaims){let tenantSchemaEntities=extractSchemaTableEntities(tenantCtx.schemaTables),tenantClaimEntities=mergeEntitiesByName([...tenantSchemaEntities,...SYSTEM_TABLES.map((table)=>normalizeSystemTable(table)),...effectiveConfigEntities(resolvedOptions.entities||[]),...config.systemTables||[],...resolvedOptions.authorization?.externalEntities||[]]);await seedClaims(db,tenantCtx.schemaTables,tenantCtx.schemaRelations,tenantClaimEntities,authConfig,logger2)}if(tenantCtx.tenant?.godAdminEmail&&authConfig.godminPassword)await setupGodmin(db,tenantCtx.schemaTables,{...authConfig,godminEmail:tenantCtx.tenant.godAdminEmail},logger2);if(seedConfig){let{runSeed:runSeed2}=await Promise.resolve().then(() => (init_SeedRunner(),exports_SeedRunner));await runSeed2(db,tenantCtx.schemaTables,seedConfig,logger2)}logger2.info(`[Authorization] Tenant schema seeded: ${tenantSchemaName}`)}catch(err){let msg=err instanceof Error?err.message:String(err);logger2.warn(`[Authorization] Failed to seed tenant ${tenantSchemaName}: ${msg}`)}}logger2.info(`[Authorization] Multi-tenant seeding complete for ${tenantSchemas.length} schemas`)}}let sessionsTableRef=schemaTables.userSessions;if(!isConsumerModeOnStart&&sessionsTableRef&&resolvedOptions.authentication?.sessions?.enabled){let{lt:lt4}=await import("drizzle-orm"),expiredCount=await bootStep("auth.expiredSessionCleanup",()=>db.update(sessionsTableRef).set({isActive:!1,revokedAt:new Date,revokedReason:"expired"}).where(and28(eq68(sessionsTableRef.isActive,!0),lt4(sessionsTableRef.expiresAt,new Date))));if(expiredCount!==void 0)logger2.info("[AUTH] Expired sessions cleanup completed",{expiredCount});let sessionCleanupInterval=setInterval(async()=>{try{await db.update(sessionsTableRef).set({isActive:!1,revokedAt:new Date,revokedReason:"expired"}).where(and28(eq68(sessionsTableRef.isActive,!0),lt4(sessionsTableRef.expiresAt,new Date)));let approvalTtlMs=86400000,approvalCutoff=new Date(Date.now()-approvalTtlMs);await db.update(sessionsTableRef).set({isActive:!1,revokedAt:new Date,revokedReason:"approval_token_expired",approvalStatus:"rejected",approvalToken:null}).where(and28(eq68(sessionsTableRef.approvalStatus,"pending"),lt4(sessionsTableRef.approvalRequestedAt,approvalCutoff)))}catch(err){logger2.warn("[AUTH] Session cleanup failed",{error:err})}},3600000);trackInterval(sessionCleanupInterval)}if(isMultiTenant&&tenantRegistry&&resolvedOptions.authentication?.sessions?.enabled){let{lt:lt4}=await import("drizzle-orm"),tenantSchemaNames=tenantRegistry.getAllSchemaNames().filter((name2)=>name2!==targetSchemaName);for(let tenantSchemaName of tenantSchemaNames){let tenantCtx=tenantRegistry.getSchemaContext(tenantSchemaName);if(!tenantCtx)continue;let tenantSessionsTable=tenantCtx.schemaTables.userSessions||tenantCtx.schemaTables.user_sessions||tenantCtx.schemaTables.sessions;if(!tenantSessionsTable)continue;try{await db.update(tenantSessionsTable).set({isActive:!1,revokedAt:new Date,revokedReason:"expired"}).where(and28(eq68(tenantSessionsTable.isActive,!0),lt4(tenantSessionsTable.expiresAt,new Date))),logger2.info(`[AUTH] Tenant session cleanup completed: ${tenantSchemaName}`)}catch(err){let msg=err instanceof Error?err.message:String(err);logger2.warn(`[AUTH] Tenant session cleanup failed for ${tenantSchemaName}: ${msg}`)}}}}});let authMiddleware=async({request,set:set2,server})=>{let refusal=inboundGuard({request,set:set2,body:void 0,params:{},query:{}});if(refusal!==void 0)return refusal;let requestStartTime=Date.now(),requestSchemaTables=schemaTables;if(tenantRegistry){let tenantVettedClientIp=resolveClientIp(server?.requestIP?.(request)?.address??null,request.headers.get("x-forwarded-for")??request.headers.get("x-real-ip"),resolvedOptions.rateLimit?.trustedProxies??[]),tenantResult=tenantRegistry.resolveFromRequest(request,tenantVettedClientIp);if(tenantResult.resolved)requestSchemaTables=tenantResult.context.schemaTables,request.headers.set("x-tenant-schema",tenantResult.context.schemaName);else if(new URL(request.url).pathname!=="/health")return set2.status=tenantResult.statusCode,Response.json(withEnvelopeFlags({isSuccess:!1,message:tenantResult.error,status:tenantResult.statusCode,errors:[{message:tenantResult.error}],data:null}))}request.headers.set("x-request-start-time",String(requestStartTime));let requestId=randomUUID11();if(request.headers.set("x-request-id",requestId),set2.headers["x-request-id"]=requestId,resolvedOptions.security?.disableDefaultHeaders!==!0){set2.headers["X-Content-Type-Options"]="nosniff",set2.headers["X-Frame-Options"]="SAMEORIGIN",set2.headers["Referrer-Policy"]="strict-origin-when-cross-origin";let hstsMaxAge=resolvedOptions.security?.hstsMaxAge??15552000;if(hstsMaxAge>0)set2.headers["Strict-Transport-Security"]=`max-age=${hstsMaxAge}; includeSubDomains`}let url=new URL(request.url),pathname=url.pathname,method=request.method,query=url.search;if(csrfConfig.enabled){let csrfSecure=request.headers.get("x-forwarded-proto")==="https"||url.protocol==="https:"?"; Secure":"",issueCsrfCookie=()=>`${csrfConfig.cookieName}=${randomUUID11()}; Path=/; SameSite=Lax${csrfSecure}`,csrfCookies=parseCookies(request.headers.get("cookie"));if(requiresCsrf({method,cookies:csrfCookies,hasAuthorizationHeader:!!request.headers.get("authorization"),authCookieNames:csrfAuthCookieNames})&&!csrfTokenMatches(csrfCookies[csrfConfig.cookieName],request.headers.get(csrfConfig.headerName)))return set2.headers["Set-Cookie"]=issueCsrfCookie(),set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:"CSRF token missing or invalid",status:403,errors:[{message:"CSRF token missing or invalid"}],data:null}));else if(!isStateChanging(method)&&!csrfCookies[csrfConfig.cookieName])set2.headers["Set-Cookie"]=issueCsrfCookie()}let socketIp=server?.requestIP?.(request)?.address??null,clientIp=resolveClientIp(socketIp,request.headers.get("x-forwarded-for")??request.headers.get("x-real-ip"),resolvedOptions.rateLimit?.trustedProxies??[]);request.headers.set("x-client-ip",clientIp);let userAgent=request.headers.get("user-agent")||"unknown";if(requestLogConfig.enabled&&requestLogConfig.logArrival&&!isRequestLogExcluded(pathname))logger2.log("debug",`\u2192 ${method} ${pathname}`,{requestId,method,path:pathname,query:requestLogConfig.includeQuery&&query?query:void 0,ip:clientIp,tenant:request.headers.get("x-tenant-schema")||void 0},void 0,void 0,"middleware.request");let tokens,parsedBody={},rawBodyText="";if(request.method!=="GET"&&request.method!=="HEAD")try{rawBodyText=await request.clone().text();let parsed=rawBodyText?JSON.parse(rawBodyText):{};parsedBody=parsed&&typeof parsed==="object"?parsed:{}}catch{parsedBody={}}let auditPayload=audit?.enabled?{id:randomUUID11(),user_id:"unknown",entity_name:pathname.split("/").filter(Boolean)[0]||"root",entity_id:null,operation_type:method,summary:"",old_values:{},new_values:parsedBody,ip_address:clientIp,user_agent:userAgent,timestamp:new Date().toISOString(),path:pathname,query}:null,isPublic=isPublicRoute(publicRoutes,pathname,method,{headers:request.headers,credentialed:()=>{let presented=parseTokenValuesFromHeaders(request.headers,tokenNames);return!!(presented.session_token||presented.access_token)}}),rateLimiterUserBudgetPending=!1,refuseRateLimited=(budget,retryAfter,subject)=>{if(set2.status=429,retryAfter)set2.headers["Retry-After"]=String(retryAfter);if(logger2.warn(`[RateLimit] Blocked ${pathname}: the ${budget} budget is spent (${budget==="address"?clientIp:subject||clientIp})`+(retryAfter?`, retry after ${retryAfter}s`:"")),monitoringService)monitoringService.recordRateLimitBlock();return new Response(JSON.stringify({isSuccess:!1,success:!1,message:"Too Many Requests",status:429,errors:[{message:"Too Many Requests"}],data:null,retryAfter}),{status:429,headers:{"Content-Type":"application/json"}})};if(rateLimiter){let routeCategory=isPublic?"public":"private",authType=resolveAuthType(pathname,resolvedOptions.authentication),category=authType?"auth":routeCategory,sharedPeer=!warnedSharedRateLimitBucket&&(resolvedOptions.rateLimit?.trustedProxies??[]).length===0&&(isNonDiscriminatingPeer(clientIp)?clientIp:peerDiversity.observe(clientIp));if(sharedPeer)warnedSharedRateLimitBucket=!0,logger2.warn(`[RateLimit] Every request so far has arrived from ${sharedPeer}, which cannot tell callers apart: every user shares ONE rate-limit bucket and one person can exhaust it for everybody. Set rateLimit.trustedProxies to the proxy address so X-Forwarded-For is honored, or raise rateLimit.privateRoutes/publicRoutes/authRoutes to values shared traffic cannot reach.`);rateLimiterUserBudgetPending=category==="private";let rateLimitResult=await rateLimiter.check({ip:clientIp,endpoint:pathname,category,authType}),headers=rateLimiter.getHeaders(rateLimitResult);for(let[key2,value2]of Object.entries(headers))set2.headers[key2]=value2;if(!rateLimitResult.allowed)return refuseRateLimited("address",rateLimitResult.retryAfter);let attempted=authType?readAttemptedIdentity(parsedBody,rawBodyText,request.headers.get("content-type")):void 0;if(attempted){let perIdentity=await rateLimiter.check({ip:clientIp,endpoint:pathname,category,authType,identity:attempted});if(!perIdentity.allowed)return refuseRateLimited("account",perIdentity.retryAfter,"the account being attempted")}}if(pathname==="/health")return;if(authentication?.enabled&&!isPublic){let apiKeyRaw=extractApiKeyFromHeader(request.headers),apiKeysTableRef=requestSchemaTables.apiKeys;if(apiKeyRaw&&authentication.apiKeys?.enabled&&apiKeysTableRef&&db){let keyHash=hashApiKey(apiKeyRaw),apiKeyRecord=(await db.select().from(apiKeysTableRef).where(eq68(apiKeysTableRef.keyHash,keyHash)).limit(1))[0];if(!apiKeyRecord)return set2.status=401,logger2.traceSync({message:"Invalid API key",level:"warn",context:{path:pathname,method},audit:toAudit(auditPayload,"Invalid API key")}),Error("Invalid API key");let validation=validateApiKeyRecord(apiKeyRecord);if(!validation.valid)return set2.status=401,logger2.traceSync({message:`API key rejected: ${validation.reason}`,level:"warn",context:{path:pathname,method,keyId:apiKeyRecord.id},audit:toAudit(auditPayload,`API key rejected: ${validation.reason}`)}),Error(validation.reason);let apiKeyUserId=apiKeyRecord.userId,apiKeyUserData;{let ksTable=requestSchemaTables.users;if(ksTable&&db){apiKeyUserData=(await db.select().from(ksTable).where(eq68(ksTable.id,apiKeyUserId)).limit(1))[0];let{evaluateAccountState:evaluateAccountState2}=await Promise.resolve().then(() => exports_accountState),ksState=apiKeyUserData?evaluateAccountState2(apiKeyUserData):{allowed:!1,reason:"inactive",message:"Account is not active"};if(!ksState.allowed)return set2.status=401,logger2.traceSync({message:`API key rejected: account ${ksState.reason}`,level:"warn",context:{path:pathname,method,keyId:apiKeyRecord.id},audit:toAudit(auditPayload,`API key rejected: account ${ksState.reason}`,{userId:apiKeyUserId})}),Error(ksState.message)}}let keyAllowedRoles=apiKeyRecord.allowedRoles||[],keyAllowedClaims=apiKeyRecord.allowedClaims||[],effectiveRoles=keyAllowedRoles,effectiveClaims=keyAllowedClaims,apiKeyClaimScopes={},userRolesTable=requestSchemaTables.userRoles,rolesTable=requestSchemaTables.roles,roleClaimsTable=requestSchemaTables.roleClaims,claimsTable=requestSchemaTables.claims;if(userRolesTable&&rolesTable){let currentUserRoles=(await db.select({name:rolesTable.name}).from(userRolesTable).innerJoin(rolesTable,eq68(rolesTable.id,userRolesTable.roleId)).where(eq68(userRolesTable.userId,apiKeyUserId))).map((r)=>r.name).filter((n)=>n!==void 0);effectiveRoles=intersectPermissions(currentUserRoles,keyAllowedRoles)}if(userRolesTable&&roleClaimsTable&&claimsTable){let userClaimRows=await db.select({action:claimsTable.action,scope:roleClaimsTable.scope}).from(userRolesTable).innerJoin(roleClaimsTable,eq68(roleClaimsTable.roleId,userRolesTable.roleId)).innerJoin(claimsTable,eq68(claimsTable.id,roleClaimsTable.claimId)).where(eq68(userRolesTable.userId,apiKeyUserId)),currentUserClaims=[...new Set(userClaimRows.map((r)=>r.action).filter((a)=>a!==void 0))];effectiveClaims=intersectPermissions(currentUserClaims,keyAllowedClaims);let effectiveClaimSet=new Set(effectiveClaims),apiScopedRows=userClaimRows.filter((r)=>typeof r.action==="string"&&effectiveClaimSet.has(r.action)).map((r)=>({action:r.action,scope:r.scope??null}));if(apiScopedRows.some((r)=>!!r.scope)){let{claimScopes,dropped}=resolveClaimScopes(apiScopedRows,apiKeyUserData,logger2);if(apiKeyClaimScopes=claimScopes,dropped.length>0){let droppedSet=new Set(dropped);effectiveClaims=effectiveClaims.filter((a)=>!droppedSet.has(a))}}}if(db.update(apiKeysTableRef).set({lastUsedAt:new Date,lastUsedIp:clientIp,usageCount:apiKeyRecord.usageCount+1}).where(eq68(apiKeysTableRef.id,apiKeyRecord.id)).catch(()=>{}),effectiveRoles=effectiveRoles.filter((r)=>r!==GODMIN_ROLE_NAME),request.headers.set("x-user-id",apiKeyUserId),request.headers.set("x-auth-type","api_key"),request.headers.set("x-api-key-id",apiKeyRecord.id),request.headers.set("x-api-key-owner-type",apiKeyRecord.ownerType||"personal"),effectiveRoles.length>0)request.headers.set("x-user-roles",encodeHeaderList(effectiveRoles));if(effectiveClaims.length>0)request.headers.set("x-user-claims",encodeHeaderList(effectiveClaims));{let apiEncodedScopes=encodeClaimScopesHeader(apiKeyClaimScopes);if(apiEncodedScopes)request.headers.set("x-user-claim-scopes",apiEncodedScopes)}logger2.info("[AUTH] API key authenticated",{userId:apiKeyUserId,keyId:apiKeyRecord.id,ownerType:apiKeyRecord.ownerType,path:pathname,method,effectiveRoles:effectiveRoles.length,effectiveClaims:effectiveClaims.length});return}if(!authentication.accessToken?.secret)return set2.status=500,logger2.traceSync({message:"Authentication secrets not defined",level:"error",context:{path:pathname,method},audit:toAudit(auditPayload,"Authentication secrets not defined")}),Error("One or more authentication secrets are not defined");if(authentication.mode==="consumer"){tokens=parseTokenValuesFromHeaders(request.headers,tokenNames);let jwtResult=verifyJWT(tokens.access_token||"",envResolved.accessTokenSecret||"",{issuer:authentication.accessToken?.issuer,audience:authentication.accessToken?.audience});if(!jwtResult.valid)return set2.status=401,logger2.traceSync({message:"Invalid or missing access token",level:"warn",context:{path:pathname,method},audit:toAudit(auditPayload,"Invalid or missing access token",{userId:decodeUnverifiedSubject(tokens.access_token)})}),Error("Unauthenticated");let consumerBinding=verifyTenantBinding(jwtResult.payload[TENANT_CLAIM],request.headers.get("x-tenant-schema"),resolvedOptions.authentication?.tenantBinding??"lenient");if(!consumerBinding.ok)return set2.status=401,logger2.traceSync({message:"Access token tenant binding failed",level:"warn",context:{path:pathname,method,reason:consumerBinding.reason},audit:toAudit(auditPayload,"Access token tenant binding failed",{userId:decodeUnverifiedSubject(tokens.access_token)})}),Error("Unauthenticated");let userId=jwtResult.payload.sub,roles=jwtResult.payload.roles,claimsFromToken=jwtResult.payload.claims;if(request.headers.set("x-access-token",tokens.access_token||""),request.headers.set("x-user-id",userId||""),roles&&roles.length>0)request.headers.set("x-user-roles",encodeHeaderList(roles));if(claimsFromToken&&claimsFromToken.length>0)request.headers.set("x-user-claims",encodeHeaderList(claimsFromToken));{let encodedScopes=encodeClaimScopesHeader(jwtResult.payload.claimScopes);if(encodedScopes)request.headers.set("x-user-claim-scopes",encodedScopes)}}else{if(!authentication.refreshToken?.secret||!authentication.sessionToken?.secret)return set2.status=500,logger2.traceSync({message:"Authentication secrets not defined",level:"error",context:{path:pathname,method},audit:toAudit(auditPayload,"Authentication secrets not defined")}),Error("One or more authentication secrets are not defined");if(tokens=parseTokenValuesFromHeaders(request.headers,tokenNames),!tokens.session_token)return set2.status=401,logger2.traceSync({message:"No session token",level:"debug",context:{path:pathname,method},audit:toAudit(auditPayload,"No session token")}),Error("Unauthenticated");let sessionData=await readSession({sessionId:tokens.session_token});if(!sessionData)return set2.status=401,logger2.traceSync({message:"Invalid session",level:"debug",context:{path:pathname,method,sessionId:tokens.session_token},audit:toAudit(auditPayload,"Invalid session")}),Error("Unauthenticated");let sessionsTableCheck=requestSchemaTables.userSessions;if(sessionsTableCheck&&db){let session=(await db.select().from(sessionsTableCheck).where(eq68(sessionsTableCheck.id,tokens.session_token)).limit(1))[0],revokedAtVal=session?.revokedAt,isRevoked=revokedAtVal!=null&&!(typeof revokedAtVal==="object"&&!(revokedAtVal instanceof Date)&&Object.keys(revokedAtVal).length===0);if(!session||session.isActive===!1||isRevoked)return set2.status=401,logger2.traceSync({message:"Session revoked or inactive",level:"warn",context:{path:pathname,method,sessionId:tokens.session_token,isActive:session?.isActive,revokedAt:session?.revokedAt},audit:toAudit(auditPayload,"Session revoked",{userId:sessionData.userId??null})}),Error("Session has been revoked");if(session.expiresAt&&new Date(session.expiresAt)<new Date)return set2.status=401,logger2.traceSync({message:"Session expired",level:"debug",context:{path:pathname,method,sessionId:tokens.session_token,expiresAt:session.expiresAt},audit:toAudit(auditPayload,"Session expired",{userId:sessionData.userId??null})}),Error("Session has expired")}if(isIdleExpired({lastActiveAt:sessionData.lastActiveAt,inactivityTimeout:authentication.sessions?.inactivityTimeout}))return set2.status=401,logger2.traceSync({message:"Session inactive timeout",level:"debug",context:{path:pathname,method,sessionId:tokens.session_token,lastActiveAt:sessionData.lastActiveAt},audit:toAudit(auditPayload,"Session inactive timeout",{userId:sessionData.userId??null})}),Error("Session expired due to inactivity");updateLastActiveAt(tokens.session_token).catch(()=>{});let sessionsTableRef=requestSchemaTables.userSessions;if(sessionsTableRef&&db)db.update(sessionsTableRef).set({lastActivityAt:new Date}).where(eq68(sessionsTableRef.id,tokens.session_token)).catch(()=>{});let jwtResult=verifyJWT(tokens.access_token||"",envResolved.accessTokenSecret||"",{issuer:authentication.accessToken?.issuer,audience:authentication.accessToken?.audience}),isAccessTokenValid=tokens.access_token?jwtResult.valid:!1,isRefreshTokenValid=tokens.refresh_token?verifyJWT(tokens.refresh_token,envResolved.refreshTokenSecret||"",{issuer:authentication.refreshToken?.issuer,audience:authentication.refreshToken?.audience}).valid:!1;if(!isAccessTokenValid&&isRefreshTokenValid&&tokens.refresh_token&&sessionData.rememberMe===!0){let killSwitchUsersTable=requestSchemaTables.users;if(db&&killSwitchUsersTable){let ksUser=(await db.select().from(killSwitchUsersTable).where(eq68(killSwitchUsersTable.id,sessionData.userId)).limit(1))[0],{evaluateAccountState:evaluateAccountState2}=await Promise.resolve().then(() => exports_accountState),ksState=ksUser?evaluateAccountState2(ksUser):{allowed:!1,reason:"inactive",message:"Account is not active"};if(!ksState.allowed)return set2.status=401,logger2.traceSync({message:`Silent refresh blocked - account ${ksState.reason}`,level:"warn",context:{path:pathname,method},audit:toAudit(auditPayload,`Silent refresh blocked - account ${ksState.reason}`,{userId:sessionData.userId??null})}),Error(ksState.message)}let refreshRoles=[],refreshClaims=[],refreshClaimScopes={},refreshUserRolesTable=requestSchemaTables.userRoles,refreshRolesTable=requestSchemaTables.roles,refreshRoleClaimsTable=requestSchemaTables.roleClaims,refreshClaimsTable=requestSchemaTables.claims;if(db&&refreshUserRolesTable&&refreshRolesTable)try{let{fetchUserRolesAndClaims:fetchUserRolesAndClaims2}=await Promise.resolve().then(() => (init_fetchUserRolesAndClaims(),exports_fetchUserRolesAndClaims)),rc=await fetchUserRolesAndClaims2(db,sessionData.userId,{usersTable:killSwitchUsersTable??null,sessionsTable:null,userRolesTable:refreshUserRolesTable,rolesTable:refreshRolesTable,roleClaimsTable:refreshRoleClaimsTable,claimsTable:refreshClaimsTable,oauthAccountsTable:void 0,apiKeysTable:void 0,schemaTables:requestSchemaTables});refreshRoles=rc.roles,refreshClaims=rc.claims,refreshClaimScopes=rc.claimScopes}catch{}let refreshResult=await refreshAccessTokenWithLock(sessionData.userId,sessionData.id,()=>signNewAccessToken({refreshTokenId:tokens.refresh_token,options:resolvedOptions,sessionData,roles:refreshRoles.length>0?refreshRoles:void 0,claims:refreshClaims.length>0?refreshClaims:void 0,claimScopes:refreshClaimScopes,tenant:request.headers.get("x-tenant-schema")??void 0,resolveMode:resolvedOptions.authorization?.jwtClaimsMode==="resolve"&&!!claimsCache}));if(refreshResult.success&&refreshResult.accessToken){tokens.access_token=refreshResult.accessToken;let rawDomain=authentication.cookieDomain,resolvedDomainRaw=rawDomain?process.env[rawDomain]??rawDomain:void 0,resolvedDomain=resolvedDomainRaw==="localhost"||resolvedDomainRaw===".localhost"?void 0:resolvedDomainRaw,domainPart=resolvedDomain?`; Domain=${resolvedDomain}`:"",bufferSeconds=authentication.cookieMaxAgeBufferSeconds??0,maxAge=Math.max(0,parseTimeToSeconds2(authentication.accessToken.expiresIn??"15m")-bufferSeconds),securePart=!resolvedDomain?"":"; Secure",cookieValue=`${tokenNames.access_token}=${refreshResult.accessToken}; Path=/; HttpOnly; SameSite=Lax${securePart}; Max-Age=${maxAge}${domainPart}`;set2.headers["Set-Cookie"]=cookieValue}}if(jwtResult.valid){let fullBinding=verifyTenantBinding(jwtResult.payload[TENANT_CLAIM],request.headers.get("x-tenant-schema"),resolvedOptions.authentication?.tenantBinding??"lenient");if(!fullBinding.ok)return set2.status=401,logger2.traceSync({message:"Access token tenant binding failed",level:"warn",context:{path:pathname,method,reason:fullBinding.reason},audit:toAudit(auditPayload,"Access token tenant binding failed",{userId:jwtResult.payload.sub??null})}),Error("Unauthenticated")}if(jwtResult.valid&&jwtResult.payload.sub&&String(jwtResult.payload.sub)!==String(sessionData.userId))return set2.status=401,logger2.traceSync({message:"Access token subject does not match session",level:"warn",context:{path:pathname,method,sessionUserId:sessionData.userId,tokenSub:jwtResult.payload.sub},audit:toAudit(auditPayload,"Access token/session subject mismatch",{userId:sessionData.userId??null})}),Error("Unauthenticated");let userId=jwtResult.valid?jwtResult.payload.sub:sessionData.userId,roles=jwtResult.valid?jwtResult.payload.roles:void 0,claimsFromToken=jwtResult.valid?jwtResult.payload.claims:void 0;if(!claimsFromToken?.length&&claimsCache&&roles&&roles.length>0)try{let resolvedClaims=await claimsCache.resolveClaimsForRoles(roles);if(resolvedClaims.length>0)claimsFromToken=resolvedClaims}catch{}if(userId&&db&&authentication.cohorts?.enabled){let mwUsersTable=requestSchemaTables.users;if(mwUsersTable)try{let mwCohortId=(await db.select().from(mwUsersTable).where(eq68(mwUsersTable.id,userId)).limit(1))[0]?.cohortId;if(mwCohortId){let mwCohortsTable=requestSchemaTables.userCohorts??requestSchemaTables.user_cohorts;if(mwCohortsTable){let mwExpiresAt=(await db.select().from(mwCohortsTable).where(eq68(mwCohortsTable.id,mwCohortId)).limit(1))[0]?.expiresAt;if(mwExpiresAt&&new Date(mwExpiresAt)<new Date)return set2.status=403,logger2.traceSync({message:"Cohort expired - access denied",level:"warn",context:{path:pathname,method,userId,cohortId:mwCohortId},audit:toAudit(auditPayload,"Cohort expired",{userId:userId??null})}),Error("Your access has expired. Please contact your administrator.")}}}catch{}}if(request.headers.set("x-access-token",tokens.access_token||""),request.headers.set("x-refresh-token",tokens.refresh_token||""),request.headers.set("x-session-id",tokens.session_token||""),request.headers.set("x-user-id",userId||""),roles&&roles.length>0)request.headers.set("x-user-roles",encodeHeaderList(roles));if(claimsFromToken&&claimsFromToken.length>0)request.headers.set("x-user-claims",encodeHeaderList(claimsFromToken));{let encodedScopes=encodeClaimScopesHeader(jwtResult.valid?jwtResult.payload.claimScopes:void 0);if(encodedScopes)request.headers.set("x-user-claim-scopes",encodedScopes)}}}if(rateLimiter&&!isPublic&&rateLimiterUserBudgetPending){let resolvedUserId=request.headers.get("x-user-id");if(resolvedUserId){let perUser=await rateLimiter.check({ip:clientIp,userId:resolvedUserId,endpoint:pathname,category:"private"}),perUserHeaders=rateLimiter.getHeaders(perUser);for(let[key2,value2]of Object.entries(perUserHeaders))set2.headers[key2]=value2;if(!perUser.allowed)return refuseRateLimited("user",perUser.retryAfter,`user ${resolvedUserId}`)}}},afterHandler=({request,set:set2})=>{let afterUrl=new URL(request.url),afterStatus=typeof set2.status==="number"?set2.status:200,afterStartStr=request.headers.get("x-request-start-time"),afterDuration=afterStartStr?Date.now()-parseInt(afterStartStr,10):0;if(requestLogConfig.enabled&&!isRequestLogExcluded(afterUrl.pathname)){let isSlow=afterDuration>=requestLogConfig.slowThresholdMs,level=afterStatus>=500?"error":afterStatus>=400||isSlow?"warn":"info";logger2.log(level,`\u2190 ${request.method} ${afterUrl.pathname} ${afterStatus} (${afterDuration}ms)`,{requestId:request.headers.get("x-request-id")||void 0,method:request.method,path:afterUrl.pathname,query:requestLogConfig.includeQuery&&afterUrl.search?afterUrl.search:void 0,statusCode:afterStatus,durationMs:afterDuration,slow:isSlow||void 0,userId:request.headers.get("x-user-id")||void 0,authType:request.headers.get("x-auth-type")||void 0,tenant:request.headers.get("x-tenant-schema")||void 0,ip:request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||request.headers.get("x-real-ip")||void 0},void 0,void 0,"middleware.request")}if(monitoringService){let startTimeStr=request.headers.get("x-request-start-time"),startTime=startTimeStr?parseInt(startTimeStr,10):Date.now(),responseTimeMs=Date.now()-startTime,url=new URL(request.url),status=typeof set2.status==="number"?set2.status:200;monitoringService.recordRequest({endpoint:url.pathname,method:request.method,status,responseTimeMs,isError:status>=500,errorType:status>=500?"server_error":status>=400?"client_error":void 0})}if(liveMonitoringService){let url=new URL(request.url),headersObj=redactSensitiveHeaders(request.headers);liveMonitoringService.recordRequest({path:url.pathname,method:request.method,timestamp:Date.now(),headers:headersObj})}};recordAdapterStep((app)=>{app.onRequest(authMiddleware).onAfterHandle(afterHandler)});let errorResponder=(ctx)=>{let{set:set2,code,error:error3,request}=ctx,status=statusOfError(code,error3),message="Internal Server Error",pgCode,clientSafe=!1;if(error3 instanceof Error){let cause=error3.cause;if(pgCode=cause?.code,pgCode==="23505")message="A record with this value already exists",clientSafe=!0,status=409;else if(pgCode==="23503")message="Referenced record does not exist",clientSafe=!0,status=400;else if(pgCode==="23502")message=`Missing required field: ${cause?.column||"a required field is empty"}`,clientSafe=!0,status=400;else if(pgCode==="22P02")message=cause?.routine==="string_to_uuid"?"Invalid ID format":"Invalid data format",clientSafe=!0,status=400;else if(pgCode)message=`Database error (${pgCode}): ${cause?.detail||cause?.message||error3.message}`;else if(code==="VALIDATION")message=describeValidationError(error3)??error3.message,clientSafe=!0;else message=error3.message,clientSafe=status<500}try{let errUrl=new URL(request.url),errStartStr=request.headers.get("x-request-start-time");logger2.log(status>=500?"error":"warn",`\u2716 ${request.method} ${errUrl.pathname} ${status}: ${message}`,{requestId:request.headers.get("x-request-id")||void 0,method:request.method,path:errUrl.pathname,statusCode:status,elysiaCode:typeof code==="string"?code:void 0,pgCode,durationMs:errStartStr?Date.now()-parseInt(errStartStr,10):void 0,userId:request.headers.get("x-user-id")||void 0,tenant:request.headers.get("x-tenant-schema")||void 0},status>=500?error3:void 0)}catch(logErr){logger2.error("Failed to log request error",logErr)}set2.status=status;let clientMessage=clientSafe?message:"Internal Server Error",requestId=request.headers.get("x-request-id")||void 0;if(requestId)set2.headers["x-request-id"]=requestId;return Response.json(withEnvelopeFlags({isSuccess:!1,message:clientMessage,status,requestId,errors:[{message:clientMessage}],data:null}))};recordAdapterStep((app)=>{app.onError(errorResponder)});let featureAdminRoles={};for(let[feature,section]of Object.entries(resolvedOptions)){if(!section||typeof section!=="object")continue;let roles=section.adminRoles;if(!Array.isArray(roles))continue;let named=roles.filter((role)=>typeof role==="string"&&role.length>0);if(named.length>0)featureAdminRoles[feature]=named}logger2.info("Creating routes for entities"),createEntityRoutes(plugin,{db,schemaTables,schemaRelations,entities,logger:logger2,databaseUrl:envResolved.databaseUrl,dbPool,storage:resolvedOptions.storage,cdnMedia:{transform:mergeTransformConfig(resolvedOptions.storage?.cdn?.transform),video:mergeVideoConfig(resolvedOptions.storage?.cdn?.video),pdf:mergePdfConfig(resolvedOptions.storage?.cdn?.pdf)},authorization:resolvedOptions.authorization,featureAdminRoles,accountLinks:authentication?.accountLinks,authMode:authentication?.mode,idpUrl:authentication?.idpUrl?process.env[authentication.idpUrl]||authentication.idpUrl:void 0,isEmailServiceAvailable:()=>!!getEmailService()?.isAvailable(),onRoleChanged:({userId:subjectId,roleName,assigned})=>{if(!db)return;let service=new NotificationService({db,schemaTables,config:resolvedOptions.notification??{},logger:logger2,getEmailService}),title=assigned?`New role: ${roleName}`:`Role removed: ${roleName}`,body=assigned?`You have been given the "${roleName}" role in the portal. New sections will appear in your menu.`:`Your "${roleName}" role in the portal has been removed. The sections it opened will no longer appear.`;service.send({user_id:subjectId,title,body,type:"system",source:"authorization",channels:["portal","email"]}).catch(()=>{})},tenantRegistry,getTenantRegistry:()=>tenantRegistry,claimsCache});let isConsumerMode=authentication?.mode==="consumer";if(isMultiTenant&&!isConsumerMode)createTenantRoutes(plugin,{getDb:()=>db,logger:logger2,getTenantRegistry:()=>tenantRegistry,schemaName:targetSchemaName}),logger2.info("[MultiTenant] Tenant routes pre-registered (handlers check runtime readiness)");else if(isMultiTenant&&isConsumerMode){let routePostTenantsRefresh=defineRoute({method:"POST",path:"/tenants/refresh",handler:async(ctx)=>{if(!tenantRegistry||!tenantRegistry.isConsumerMode())return ctx.set.status=503,{success:!1,message:"Tenant registry not ready"};try{return{success:!0,data:await tenantRegistry.syncFromIdp()}}catch(err){let msg=err instanceof Error?err.message:String(err);return ctx.set.status=500,{success:!1,message:`Tenant sync failed: ${msg}`}}}});mountRoutes(plugin,[{routes:[routePostTenantsRefresh]}]),logger2.info("[MultiTenant] Consumer tenant refresh route registered (/tenants/refresh)")}let domainServices=null;if(resolvedOptions.domains?.enabled){if(domainServices=createDomainServices({options:resolvedOptions,logger:logger2,getDb:()=>db,getTenantRegistry:()=>tenantRegistry}),domainServices)createDomainRoutes(plugin,{getDomainService:()=>domainServices?.domainService??null,getRegistrationService:()=>domainServices?.registrationService??null,logger:logger2,basePath:resolvedOptions.domains.basePath||"/domains",resolveTenantIdForSchema:(schema3)=>schema3&&tenantRegistry?tenantRegistry.getTenantBySchemaName(schema3)?.id??null:null}),logger2.info("[Domains] Custom domain routes registered",{provider:domainServices.domainService.config.provider,basePath:resolvedOptions.domains.basePath||"/domains"})}if(authentication?.enabled&&!isConsumerMode&&db){let resolveTableForTenant=(tableName,reqSchemaName)=>{if(reqSchemaName&&tenantRegistry){let ctx=tenantRegistry.getSchemaContext(reqSchemaName);if(ctx?.schemaTables[tableName])return ctx.schemaTables[tableName]}return schemaTables[tableName]},usersTable=schemaTables.users,sessionsTable=schemaTables.userSessions||schemaTables.user_sessions||schemaTables.sessions;if(!sessionsTable&&authentication.sessions?.enabled)logger2.warn("[AUTH] sessions is enabled but user_sessions table not found in schema. Disabling sessions.");if(usersTable){await initiateRedisManager(resolvedOptions);let{createAuthRoutes:createAuthRoutes2}=(init_auth(),__toCommonJS(exports_auth)),{signJWT:signJWT2,verifyJWT:verifyJWT3}=(init_JWT(),__toCommonJS(exports_JWT)),{generateSession:generateSession2,deleteSession:deleteSession2}=(init_SessionStore(),__toCommonJS(exports_SessionStore));createAuthRoutes2(plugin,{authConfig:{db,logger:logger2,usersTable,sessionsTable,userRolesTable:schemaTables.userRoles,rolesTable:schemaTables.roles,roleClaimsTable:schemaTables.roleClaims,claimsTable:schemaTables.claims,authentication:{enabled:authentication.enabled,mode:authentication.mode,get defaultRole(){return resolvedOptions.authentication?.defaultRole||process.env.AUTH_DEFAULT_ROLE},get defaultRoles(){return resolvedOptions.authentication?.defaultRoles},cookieDomain:resolvedOptions.authentication?.cookieDomain,get trustedAppOrigins(){return trustedAppOrigins()},emailExemptDomains:authentication?.emailExemptDomains,accessToken:authentication.accessToken,refreshToken:authentication.refreshToken,sessionToken:authentication.sessionToken,rememberMe:authentication.rememberMe,deviceTrust:authentication.sessions?.deviceTrust}},features:{login:authentication.login,register:authentication.register,logout:authentication.logout,refresh:authentication.refresh,passwordReset:withResolvedRedirects(authentication.passwordReset,["redirectUrl"]),passwordChange:authentication.passwordChange,passwordSet:authentication.passwordSet,sessions:withResolvedRedirects(authentication.sessions,["approvalRedirectUrl"]),magicLink:withResolvedRedirects(authentication.magicLink,["redirectUrl"]),me:authentication.me||{enabled:!0,route:"/auth/me"},invite:withResolvedRedirects(authentication.invite,["redirectUrl"]),captcha:authentication.captcha,oauth:authentication.oauth?.enabled&&envResolved.oauthProviders?{...withResolvedRedirects(authentication.oauth,["successRedirectUrl","errorRedirectUrl"]),providers:liveOAuthProviders(envResolved.oauthProviders)}:void 0,apiKeys:authentication.apiKeys?.enabled?{enabled:!0,route:authentication.apiKeys.route,keyPrefix:authentication.apiKeys.keyPrefix,maxKeysPerUser:authentication.apiKeys.maxKeysPerUser,defaultExpiresIn:authentication.apiKeys.defaultExpiresIn,allowApplicationKeys:authentication.apiKeys.allowApplicationKeys,preventApiKeyManagement:authentication.apiKeys.preventApiKeyManagement}:void 0,webauthn:authentication.webauthn},sessionsTable,oauthAccountsTable:schemaTables.oauthAccounts,oauthStateStore:(()=>{let oauthRedis=getRedisManager();if(!oauthRedis)return;let{createRedisOAuthStateStore:createRedisOAuthStateStore2}=__toCommonJS(exports_stateStore);return createRedisOAuthStateStore2(oauthRedis)})(),apiKeysTable:schemaTables.apiKeys,schemaTables,schemaRelations,tenantRegistry,getTenantRegistry:()=>tenantRegistry,databaseUrl:envResolved.databaseUrl,dbPool,admin:(()=>{let adminCfg=resolvedOptions.authentication?.admin;return{impersonate:{enabled:!0},changeUserId:{enabled:!0},createUser:adminCfg?.createUser??{enabled:!0},passwordTools:adminCfg?.passwordTools??{enabled:!1}}})(),schemaName:targetSchemaName,getEmailService,appName:resolvedOptions.appId,webauthnService:(()=>{if(!authentication.webauthn?.enabled||!db)return null;let{WebAuthnService:WebAuthnService2}=(init_WebAuthn(),__toCommonJS(exports_WebAuthn)),{createDbWebAuthnStorage:createDbWebAuthnStorage2}=(init_dbStorage(),__toCommonJS(exports_dbStorage)),rpName=authentication.webauthn.rpName||resolvedOptions.appId||"Nucleus",rpID=authentication.webauthn.rpID||"localhost",expectedOrigins=authentication.webauthn.expectedOrigins||[`http://${rpID}`,`https://${rpID}`],challengeTtlMs=authentication.webauthn.challengeTtl?parseTimeToSeconds2(authentication.webauthn.challengeTtl)*1000:300000,storage=createDbWebAuthnStorage2({db,resolveTable:resolveTableForTenant});return new WebAuthnService2({rp:{rpName,rpID,expectedOrigins},challengeTtlMs,storage,userVerification:authentication.webauthn?.userVerification,logger:logger2})})(),captchaService:(()=>{let redisManager=getRedisManager();if(!authentication.captcha?.enabled||!redisManager)return null;return new CaptchaService({redis:{get:async(key2)=>{let result=await redisManager.read(key2);return result.success?result.data:null},set:async(key2,value2,options)=>{await redisManager.create(key2,value2,options?.ex)},del:async(key2)=>{await redisManager.remove(key2)},incrementCounter:(key2,delta,ttlSeconds)=>redisManager.incrementCounter(key2,delta,ttlSeconds)},logger:logger2,config:{enabled:!0,type:authentication.captcha.type||"math",difficulty:authentication.captcha.difficulty||"medium",expiresIn:authentication.captcha.expiresIn||"5m",maxAttempts:authentication.captcha.maxAttempts||3,caseSensitive:authentication.captcha.caseSensitive??!1}})})(),tokenResponseConfig:{accessToken:{setHeadersEnabled:authentication.accessToken?.setHeadersEnabled??!0,returnJson:authentication.accessToken?.returnJson??!0},refreshToken:{setHeadersEnabled:authentication.refreshToken?.setHeadersEnabled??!0,returnJson:authentication.refreshToken?.returnJson??!0},sessionToken:{setHeadersEnabled:authentication.sessionToken?.setHeadersEnabled??!0,returnJson:authentication.sessionToken?.returnJson??!0}},helpers:{signAccessToken:(userId,roles,claims,tenant,claimScopes,sessionId)=>{let resolveMode=resolvedOptions.authorization?.jwtClaimsMode==="resolve"&&claimsCache,hasClaimScopes=!resolveMode&&!!claimScopes&&Object.keys(claimScopes).length>0,token=signJWT2({subject:userId,expiresInSeconds:parseTimeToSeconds2(authentication.accessToken?.expiresIn||"15m"),issuer:authentication.accessToken?.issuer,audience:authentication.accessToken?.audience,sessionId,customClaims:{...roles&&roles.length>0?{roles}:{},...!resolveMode&&claims&&claims.length>0?{claims}:{},...hasClaimScopes?{claimScopes}:{},...tenant?{tenant}:{}}},envResolved.accessTokenSecret||"",authentication.accessToken?.algorithm||"HS256");return warnIfAccessTokenTooLargeForCookie(token,resolveMode?"resolve":resolvedOptions.authorization?.jwtClaimsMode),token},signRefreshToken:(userId,rememberMe,sessionId)=>signJWT2({subject:userId,expiresInSeconds:longerLifetime(rememberMe?authentication.rememberMe?.expiresIn:void 0,authentication.refreshToken?.expiresIn,604800),issuer:authentication.refreshToken?.issuer,audience:authentication.refreshToken?.audience,sessionId},envResolved.refreshTokenSecret||"",authentication.refreshToken?.algorithm||"HS256"),verifyRefreshToken:(token)=>verifyJWT3(token,envResolved.refreshTokenSecret||"",{issuer:authentication.refreshToken?.issuer,audience:authentication.refreshToken?.audience}),createSession:async(params)=>{let sessionTtlSeconds=longerLifetime(params.rememberMe?authentication.rememberMe?.expiresIn:void 0,authentication.sessionToken?.expiresIn,2592000),result=await generateSession2({userId:params.userId,deviceInfo:params.deviceInfo,rememberMe:params.rememberMe,loginMethod:params.loginMethod,expiresInSeconds:sessionTtlSeconds});if(!result.success)throw logger2.error("[createSession] failed to create session",{userId:params.userId,error:result.error}),Error(`Session storage unavailable: ${result.error||"unknown error"}`);return result.session.id},destroySession:async(sessionId)=>deleteSession2({sessionId}),saveSessionToDb:async(sessionId,params,reqSchemaName)=>{let resolvedSessionsTable=resolveTableForTenant("userSessions",reqSchemaName)||resolveTableForTenant("user_sessions",reqSchemaName)||resolveTableForTenant("sessions",reqSchemaName)||sessionsTable;if(!resolvedSessionsTable||!db)return;let sessionsConfig=authentication.sessions,deviceInfo=ensureDeviceInfo(params.deviceInfo||{ipAddress:""}),resolvedUsersTableForExempt=resolveTableForTenant("users",reqSchemaName),sessionUserEmail=null;if(resolvedUsersTableForExempt)sessionUserEmail=(await db.select().from(resolvedUsersTableForExempt).where(eq68(resolvedUsersTableForExempt.id,params.userId)).limit(1))[0]?.email??null;let userIsEmailExempt=sessionUserEmail?isEmailExempt(sessionUserEmail,authentication?.emailExemptDomains):!1,deviceFingerprint=deviceInfo.deviceHint?`${deviceInfo.browserName||""}-${deviceInfo.osName||""}-${deviceInfo.deviceType||""}-${deviceInfo.deviceHint}`:`${deviceInfo.browserName||""}-${deviceInfo.osName||""}-${deviceInfo.deviceType||""}`,existingSessions=await db.select().from(resolvedSessionsTable).where(and28(eq68(resolvedSessionsTable.userId,params.userId),eq68(resolvedSessionsTable.isActive,!0))),hasValidFingerprint=deviceFingerprint&&!deviceFingerprint.includes("--unknown")&&!deviceFingerprint.includes("Bot/Crawler")&&!deviceFingerprint.includes("Headless")&&deviceFingerprint!=="--"&&deviceFingerprint!=="--unknown",allUserSessions=await db.select().from(resolvedSessionsTable).where(eq68(resolvedSessionsTable.userId,params.userId)),isNewDevice=hasValidFingerprint?!existingSessions.some((s)=>s.deviceFingerprint===deviceFingerprint):!1,wasPreviouslyApproved=hasValidFingerprint?allUserSessions.some((s)=>{let sess=s;return sess.deviceFingerprint===deviceFingerprint&&sess.approvalStatus==="approved"}):!1,hasAnyApprovedSession=existingSessions.some((s)=>s.approvalStatus==="approved"),isImpersonationLogin=params.loginMethod==="impersonation"||params.loginMethod==="impersonation_stop",isOAuthLogin=params.loginMethod?.startsWith("oauth:"),requiresApproval=!isImpersonationLogin&&!userIsEmailExempt&&sessionsConfig?.trustNewDevices===!1&&isNewDevice&&!wasPreviouslyApproved&&hasValidFingerprint&&hasAnyApprovedSession,deviceTrustCfg=sessionsConfig?.deviceTrust,dtTable=deviceTrustCfg?.enabled?resolveTableForTenant("trustedDevices",reqSchemaName)||resolveTableForTenant("trusted_devices",reqSchemaName):void 0,deviceTrustMint=null,deviceTokenToSet=null;if(deviceTrustCfg?.enabled&&dtTable){let DT=await Promise.resolve().then(() => (init_DeviceTrust(),exports_DeviceTrust)),DTStore=await Promise.resolve().then(() => (init_store3(),exports_store)),dtNow=new Date,dtRows=params.deviceToken?await DTStore.findDeviceRowsByRawToken(db,dtTable,params.deviceToken):[],knownRow=DT.selectUsableDeviceRow(dtRows,params.userId,dtNow),pendingRow=dtRows.find((r)=>(r.userId??r.user_id)===params.userId&&r.status==="pending"),isFirstEver=allUserSessions.length===0&&await DTStore.userHasNoTrustedDevices(db,dtTable,params.userId),decision=DT.decideDeviceApproval({knownDevice:!!knownRow,trustNewDevices:sessionsConfig?.trustNewDevices??!0,hasValidFingerprint:!!hasValidFingerprint,isFirstEverDevice:isFirstEver,loginMethod:params.loginMethod,approvalMethods:deviceTrustCfg.approvalMethods??["password","magic_link","sso","webauthn","oauth:*","register"],onUnidentifiable:deviceTrustCfg.onUnidentifiable??"require_approval",isImpersonation:isImpersonationLogin,isEmailExempt:userIsEmailExempt});if(knownRow)await DTStore.touchDevice(db,dtTable,knownRow.id,deviceInfo.ipAddress).catch(()=>{});if(decision.deny)return logger2.warn("[AUTH] Device-trust denied unidentifiable device",{userId:params.userId}),{requiresApproval:!1,denied:!0};let reuseSessionId=pendingRow?.originSessionId??pendingRow?.origin_session_id;if(decision.requiresApproval&&reuseSessionId)return{requiresApproval:!0,sessionId:reuseSessionId};requiresApproval=decision.requiresApproval,deviceTrustMint=decision.mintToken?decision.trustImmediately?"trusted":"pending":null}logger2.info("[AUTH] Device fingerprint analysis",{userId:params.userId,deviceFingerprint,hasValidFingerprint,isNewDevice,wasPreviouslyApproved,loginMethod:params.loginMethod,isImpersonationLogin,isOAuthLogin,existingSessionCount:existingSessions.length,hasAnyApprovedSession,requiresApproval});let approvalToken=null,approvalStatus="approved";if(requiresApproval){let existingPending=deviceTrustCfg?.enabled?void 0:allUserSessions.find((s)=>{let sess=s;return sess.deviceFingerprint===deviceFingerprint&&(sess.approvalStatus==="pending"||sess.approval_status==="pending")&&sess.approvalToken});if(existingPending){let pendingSess=existingPending,pendingRequestedAt=pendingSess.approvalRequestedAt||pendingSess.approval_requested_at;if(pendingRequestedAt?Date.now()-new Date(pendingRequestedAt).getTime()<86400000:!0)return logger2.info("[AUTH] Reusing existing pending session for same device",{userId:params.userId,deviceFingerprint,existingSessionId:pendingSess.id}),{requiresApproval:!0,sessionId:pendingSess.id}}let{randomBytes:randomBytes8}=await import("crypto");approvalToken=randomBytes8(32).toString("hex"),approvalStatus="pending",logger2.info("[AUTH] New device requires approval",{userId:params.userId,deviceFingerprint,ipAddress:deviceInfo.ipAddress})}let staleBotSessions=existingSessions.filter((s)=>{let sess=s,fp=(sess.deviceFingerprint||"").toLowerCase(),ip=sess.ipAddress||"",ua=(sess.userAgent||"").toLowerCase(),isBotFingerprint=!fp||fp==="--"||fp==="--unknown"||fp.includes("bot/crawler")||fp.includes("headless")||fp.includes("unknown-unknown"),isServerAction=ua.includes("nucleusserveraction")||ua.includes("serveraction")||ua.includes("node-fetch")||ua.includes("undici");return isBotFingerprint&&(ip==="127.0.0.1"||ip==="::1"||ip==="localhost"||!ip)||isServerAction});if(staleBotSessions.length>0){for(let botSession of staleBotSessions)await db.update(resolvedSessionsTable).set({isActive:!1,revokedAt:new Date,revokedReason:"bot_session_cleanup"}).where(eq68(resolvedSessionsTable.id,botSession.id));logger2.info("[AUTH] Cleaned up stale bot/crawler sessions",{userId:params.userId,cleanedCount:staleBotSessions.length})}if(hasValidFingerprint&&!requiresApproval){let sameDeviceOldSessions=existingSessions.filter((s)=>s.deviceFingerprint===deviceFingerprint);for(let oldSession of sameDeviceOldSessions)await db.update(resolvedSessionsTable).set({isActive:!1,revokedAt:new Date,revokedReason:"same_device_relogin"}).where(eq68(resolvedSessionsTable.id,oldSession.id));if(sameDeviceOldSessions.length>0)logger2.info("[AUTH] Revoked old same-device sessions",{userId:params.userId,deviceFingerprint,revokedCount:sameDeviceOldSessions.length})}if(!sessionsConfig?.allowMultipleDevices&&existingSessions.length>0){if((hasValidFingerprint?existingSessions.filter((s)=>s.deviceFingerprint===deviceFingerprint):[]).length===0)for(let oldSession of existingSessions)await db.update(resolvedSessionsTable).set({isActive:!1,revokedAt:new Date,revokedReason:"new_device_login"}).where(eq68(resolvedSessionsTable.id,oldSession.id))}if(sessionsConfig?.maxActiveSessions){let{count:count3}=await import("drizzle-orm"),currentCount=(await db.select({count:count3()}).from(resolvedSessionsTable).where(and28(eq68(resolvedSessionsTable.userId,params.userId),eq68(resolvedSessionsTable.isActive,!0))))[0]?.count||0;if(currentCount>=sessionsConfig.maxActiveSessions){let{asc:asc2}=await import("drizzle-orm"),oldestSessions=await db.select().from(resolvedSessionsTable).where(and28(eq68(resolvedSessionsTable.userId,params.userId),eq68(resolvedSessionsTable.isActive,!0))).orderBy(asc2(resolvedSessionsTable.createdAt)).limit(currentCount-sessionsConfig.maxActiveSessions+1);for(let oldSession of oldestSessions)await db.update(resolvedSessionsTable).set({isActive:!1,revokedAt:new Date,revokedReason:"max_sessions_exceeded"}).where(eq68(resolvedSessionsTable.id,oldSession.id))}}let trustScore=100;if(deviceInfo.isHeadless)trustScore-=50;if(deviceInfo.isBot)trustScore-=40;if(deviceInfo.isSuspicious)logger2.warn("[AUTH] Suspicious login detected",{userId:params.userId,suspiciousPatterns:deviceInfo.suspiciousPatterns,userAgent:deviceInfo.userAgent,ipAddress:deviceInfo.ipAddress});if(isNewDevice)trustScore-=25;if(!deviceInfo.ipAddress||deviceInfo.ipAddress==="unknown")trustScore-=20;if(!deviceInfo.browserName)trustScore-=15;if(!deviceInfo.osName)trustScore-=15;if(!deviceInfo.deviceType||deviceInfo.deviceType==="unknown")trustScore-=10;if(!deviceInfo.deviceName||deviceInfo.deviceName==="Unknown Device")trustScore-=5;let validFingerprint=deviceFingerprint&&!deviceFingerprint.includes("--unknown")&&deviceFingerprint!=="--",validIp=deviceInfo.ipAddress&&deviceInfo.ipAddress!=="unknown";if(validFingerprint){if(existingSessions.filter((s)=>s.deviceFingerprint===deviceFingerprint).length>0)trustScore+=20}if(validIp){if(existingSessions.filter((s)=>s.ipAddress===deviceInfo.ipAddress).length>0)trustScore+=15}trustScore=Math.max(0,Math.min(100,trustScore));let LOW_TRUST_THRESHOLD=50;if(await db.insert(resolvedSessionsTable).values({id:sessionId,userId:params.userId,tokenHash:sessionId,deviceFingerprint,deviceName:deviceInfo.deviceName,deviceType:deviceInfo.deviceType,browserName:deviceInfo.browserName,browserVersion:deviceInfo.browserVersion,osName:deviceInfo.osName,osVersion:deviceInfo.osVersion,ipAddress:deviceInfo.ipAddress,locationCountry:deviceInfo.locationCountry,locationCity:deviceInfo.locationCity,loginMethod:params.loginMethod||"password",rememberMe:params.rememberMe??!1,trustScore,lastActivityAt:new Date,createdAt:new Date,expiresAt:(()=>{let ttl=lifetimeSeconds(authentication.sessionToken?.expiresIn,2592000);return ttl===null?null:new Date(Date.now()+ttl*1000)})(),isActive:approvalStatus==="approved",approvalStatus,approvalToken,approvalRequestedAt:requiresApproval?new Date:null}),shouldNotifyDevice({emailAvailable:Boolean(getEmailService()?.isAvailable()),isImpersonationLogin:Boolean(isImpersonationLogin),notifyOnNewDevice:Boolean(sessionsConfig?.notifyOnNewDevice),isNewDevice,trustScore,lowTrustThreshold:LOW_TRUST_THRESHOLD,requiresApproval:Boolean(requiresApproval)})){let resolvedUsersTable=resolveTableForTenant("users",reqSchemaName);if(resolvedUsersTable){let user=(await db.select().from(resolvedUsersTable).where(eq68(resolvedUsersTable.id,params.userId)).limit(1))[0];if(user?.email&&!isEmailExempt(user.email,authentication?.emailExemptDomains)){let isLowTrust=trustScore<LOW_TRUST_THRESHOLD,sessionsRoute=authentication.sessions?.route||"/auth/sessions",configuredUrl=authentication.sessions?.approvalRedirectUrl||"",isLegacyFrontendUrl=!configuredUrl||configuredUrl.endsWith("/devices"),approvalBase;if(!isLegacyFrontendUrl)approvalBase=configuredUrl;else{let origin=pickTrustedOrigin(params.requestOrigin,configuredUrl,trustedAppOrigins());if(params.requestOrigin&&origin!==params.requestOrigin)logger2.warn("[AUTH] Device-approval link origin refused \u2014 not in trustedAppOrigins",{requested:params.requestOrigin,used:origin||"(none)"});approvalBase=`${origin||"http://localhost:9000"}${sessionsRoute}`}let approveUrl=approvalToken?`${approvalBase}/approve-page?token=${approvalToken}`:"",rejectUrl=approvalToken?`${approvalBase}/reject-page?token=${approvalToken}`:"",subject,emailHtml,brandName=resolvedOptions.appId||"Nucleus",loginTime=new Date().toLocaleString("en-US",{dateStyle:"medium",timeStyle:"short"}),deviceSummary=`${deviceInfo.browserName||"Unknown"} ${deviceInfo.browserVersion||""} on ${deviceInfo.osName||"Unknown"} ${deviceInfo.osVersion||""}`,emailWrapper=(content)=>`
 <!DOCTYPE html>