npm - nucleus-core-ts - Versions diffs - 0.10.76 → 0.10.77 - Mend

nucleus-core-ts 0.10.76 → 0.10.77

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/server.js CHANGED Viewed

@@ -402,8 +402,8 @@ Mx86OyXShkDOOyyGeMlhLxS67ttVb9+E7gUJTb0o2HLO02JQZR7rkpeDMdmztcpH
 WD9f
 -----END CERTIFICATE-----
  `;class BaseSettingsService{constructor(){Object.defineProperty(this,"pemCertificates",{enumerable:!0,configurable:!0,writable:!0,value:void 0}),this.pemCertificates=new Map}setRootCertificates(opts){let{identifier,certificates}=opts,newCertificates=[];for(let cert of certificates)if(cert instanceof Uint8Array)newCertificates.push(convertCertBufferToPEM(cert));else newCertificates.push(cert);this.pemCertificates.set(identifier,newCertificates)}getRootCertificates(opts){let{identifier}=opts;return this.pemCertificates.get(identifier)??[]}}var SettingsService;var init_settingsService=__esm(()=>{init_convertCertBufferToPEM();SettingsService=new BaseSettingsService;SettingsService.setRootCertificates({identifier:"android-key",certificates:[Google_Hardware_Attestation_Root_1,Google_Hardware_Attestation_Root_2,Google_Hardware_Attestation_Root_3,Google_Hardware_Attestation_Root_4]});SettingsService.setRootCertificates({identifier:"android-safetynet",certificates:[GlobalSign_Root_CA]});SettingsService.setRootCertificates({identifier:"apple",certificates:[Apple_WebAuthn_Root_CA]});SettingsService.setRootCertificates({identifier:"mds",certificates:[GlobalSign_Root_CA_R3]})});async function verifyMDSBlob(blob){let parsedJWT=parseJWT(blob),header=parsedJWT[0],payload=parsedJWT[1],headerCertsPEM=header.x5c.map(convertCertBufferToPEM);try{let rootCerts=SettingsService.getRootCertificates({identifier:"mds"});await validateCertificatePath(headerCertsPEM,rootCerts)}catch(error){throw Error("BLOB certificate path could not be validated",{cause:error})}let leafCert=headerCertsPEM[0];if(!await verifyJWT2(blob,convertPEMToBytes(leafCert)))throw Error("BLOB signature could not be verified");let statements=[];for(let entry of payload.entries)if(entry.aaguid&&entry.metadataStatement)statements.push(entry.metadataStatement);let[year,month,day]=payload.nextUpdate.split("-"),parsedNextUpdate=new Date(parseInt(year,10),parseInt(month,10)-1,parseInt(day,10));return{statements,parsedNextUpdate,payload}}var init_verifyMDSBlob=__esm(()=>{init_parseJWT();init_verifyJWT();init_validateCertificatePath();init_convertCertBufferToPEM();init_convertPEMToBytes();init_settingsService()});var init_helpers=__esm(()=>{init_cose();init_convertAAGUIDToString();init_convertCertBufferToPEM();init_convertCOSEtoPKCS();init_decodeAttestationObject();init_decodeClientDataJSON();init_decodeCredentialPublicKey();init_generateChallenge();init_generateUserID();init_getCertificateInfo();init_isCertRevoked();init_parseAuthenticatorData();init_toHash();init_validateCertificatePath();init_verifySignature();init_iso();init_verifyMDSBlob()});async function verifyOKP(opts){let{cosePublicKey,signature,data}=opts,WebCrypto=await getWebCrypto(),alg=cosePublicKey.get(COSEKEYS.alg),crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x);if(!alg)throw Error("Public key was missing alg (OKP)");if(!isCOSEAlg(alg))throw Error(`Public key had invalid alg ${alg} (OKP)`);if(!crv)throw Error("Public key was missing crv (OKP)");if(!x)throw Error("Public key was missing x (OKP)");let _crv;if(crv===COSECRV.ED25519)_crv="Ed25519";else throw Error(`Unexpected COSE crv value of ${crv} (OKP)`);let keyData={kty:"OKP",crv:_crv,alg:"EdDSA",x:exports_isoBase64URL.fromBuffer(x),ext:!1},key2=await importKey({keyData,algorithm:{name:_crv,namedCurve:_crv}}),verifyAlgorithm={name:_crv};return WebCrypto.subtle.verify(verifyAlgorithm,key2,signature,data)}var init_verifyOKP=__esm(()=>{init_cose();init_helpers();init_importKey();init_getWebCrypto()});function unwrapEC2Signature(signature,crv){let parsedSignature=AsnParser.parse(signature,ECDSASigValue),rBytes=new Uint8Array(parsedSignature.r),sBytes=new Uint8Array(parsedSignature.s),componentLength=getSignatureComponentLength(crv),rNormalizedBytes=toNormalizedBytes(rBytes,componentLength),sNormalizedBytes=toNormalizedBytes(sBytes,componentLength);return exports_isoUint8Array.concat([rNormalizedBytes,sNormalizedBytes])}function getSignatureComponentLength(crv){switch(crv){case COSECRV.P256:return 32;case COSECRV.P384:return 48;case COSECRV.P521:return 66;default:throw Error(`Unexpected COSE crv value of ${crv} (EC2)`)}}function toNormalizedBytes(bytes,componentLength){let normalizedBytes;if(bytes.length<componentLength)normalizedBytes=new Uint8Array(componentLength),normalizedBytes.set(bytes,componentLength-bytes.length);else if(bytes.length===componentLength)normalizedBytes=bytes;else if(bytes.length===componentLength+1&&bytes[0]===0&&(bytes[1]&128)===128)normalizedBytes=bytes.subarray(1);else throw Error(`Invalid signature component length ${bytes.length}, expected ${componentLength}`);return normalizedBytes}var init_unwrapEC2Signature=__esm(()=>{init_es2015();init_es20155();init_cose();init_iso()});function verify(opts){let{cosePublicKey,signature,data,shaHashOverride}=opts;if(isCOSEPublicKeyEC2(cosePublicKey)){let crv=cosePublicKey.get(COSEKEYS.crv);if(!isCOSECrv(crv))throw Error(`unknown COSE curve ${crv}`);let unwrappedSignature=unwrapEC2Signature(signature,crv);return verifyEC2({cosePublicKey,signature:unwrappedSignature,data,shaHashOverride})}else if(isCOSEPublicKeyRSA(cosePublicKey))return verifyRSA({cosePublicKey,signature,data,shaHashOverride});else if(isCOSEPublicKeyOKP(cosePublicKey))return verifyOKP({cosePublicKey,signature,data});let kty=cosePublicKey.get(COSEKEYS.kty);throw Error(`Signature verification with public key of kty ${kty} is not supported by this method`)}var init_verify=__esm(()=>{init_cose();init_verifyEC2();init_verifyRSA();init_verifyOKP();init_unwrapEC2Signature()});var exports_isoCrypto={};__export(exports_isoCrypto,{verify:()=>verify,getRandomValues:()=>getRandomValues,digest:()=>digest});var init_isoCrypto=__esm(()=>{init_digest();init_getRandomValues();init_verify()});var exports_isoUint8Array={};__export(exports_isoUint8Array,{toUTF8String:()=>toUTF8String2,toHex:()=>toHex,toDataView:()=>toDataView,fromUTF8String:()=>fromUTF8String2,fromHex:()=>fromHex,fromASCIIString:()=>fromASCIIString,concat:()=>concat3,areEqual:()=>areEqual});function areEqual(array1,array2){if(array1.length!=array2.length)return!1;return array1.every((val,i)=>val===array2[i])}function toHex(array){return Array.from(array,(i)=>i.toString(16).padStart(2,"0")).join("")}function fromHex(hex2){if(!hex2)return Uint8Array.from([]);if(!(hex2.length!==0&&hex2.length%2===0&&!/[^a-fA-F0-9]/u.test(hex2)))throw Error("Invalid hex string");let byteStrings=hex2.match(/.{1,2}/g)??[];return Uint8Array.from(byteStrings.map((byte)=>parseInt(byte,16)))}function concat3(arrays){let pointer=0,totalLength=arrays.reduce((prev,curr)=>prev+curr.length,0),toReturn=new Uint8Array(totalLength);return arrays.forEach((arr)=>{toReturn.set(arr,pointer),pointer+=arr.length}),toReturn}function toUTF8String2(array){return new globalThis.TextDecoder("utf-8").decode(array)}function fromUTF8String2(utf8String){return new globalThis.TextEncoder().encode(utf8String)}function fromASCIIString(value){return Uint8Array.from(value.split("").map((x)=>x.charCodeAt(0)))}function toDataView(array){return new DataView(array.buffer,array.byteOffset,array.length)}var init_iso=__esm(()=>{init_isoBase64URL();init_isoCBOR();init_isoCrypto()});async function generateChallenge2(){let challenge=new Uint8Array(32);return await exports_isoCrypto.getRandomValues(challenge),_generateChallengeInternals.stubThis(challenge)}var _generateChallengeInternals;var init_generateChallenge=__esm(()=>{init_iso();_generateChallengeInternals={stubThis:(value)=>value}});async function generateRegistrationOptions(options){let{rpName,rpID,userName,userID,challenge=await generateChallenge2(),userDisplayName="",timeout=60000,attestationType="none",excludeCredentials=[],authenticatorSelection=defaultAuthenticatorSelection,extensions:extensions2,supportedAlgorithmIDs=defaultSupportedAlgorithmIDs,preferredAuthenticatorType}=options,pubKeyCredParams=supportedAlgorithmIDs.map((id)=>({alg:id,type:"public-key"}));if(authenticatorSelection.residentKey===void 0){if(authenticatorSelection.requireResidentKey)authenticatorSelection.residentKey="required"}else authenticatorSelection.requireResidentKey=authenticatorSelection.residentKey==="required";let _challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);if(typeof userID==="string")throw Error("String values for `userID` are no longer supported. See https://simplewebauthn.dev/docs/advanced/server/custom-user-ids");let _userID=userID;if(!_userID)_userID=await generateUserID();let hints=[];if(preferredAuthenticatorType){if(preferredAuthenticatorType==="securityKey")hints.push("security-key"),authenticatorSelection.authenticatorAttachment="cross-platform";else if(preferredAuthenticatorType==="localDevice")hints.push("client-device"),authenticatorSelection.authenticatorAttachment="platform";else if(preferredAuthenticatorType==="remoteDevice")hints.push("hybrid"),authenticatorSelection.authenticatorAttachment="cross-platform"}return{challenge:exports_isoBase64URL.fromBuffer(_challenge),rp:{name:rpName,id:rpID},user:{id:exports_isoBase64URL.fromBuffer(_userID),name:userName,displayName:userDisplayName},pubKeyCredParams,timeout,attestation:attestationType,excludeCredentials:excludeCredentials.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`excludeCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),authenticatorSelection,extensions:{...extensions2,credProps:!0},hints}}var supportedCOSEAlgorithmIdentifiers,defaultAuthenticatorSelection,defaultSupportedAlgorithmIDs;var init_generateRegistrationOptions=__esm(()=>{init_generateChallenge();init_generateUserID();init_iso();supportedCOSEAlgorithmIdentifiers=[-8,-7,-36,-37,-38,-39,-257,-258,-259,-65535],defaultAuthenticatorSelection={residentKey:"preferred",userVerification:"preferred"},defaultSupportedAlgorithmIDs=[-8,-7,-257]});function parseBackupFlags({be,bs}){let credentialBackedUp=bs,credentialDeviceType="singleDevice";if(be)credentialDeviceType="multiDevice";if(credentialDeviceType==="singleDevice"&&credentialBackedUp)throw new InvalidBackupFlags("Single-device credential indicated that it was backed up, which should be impossible.");return{credentialDeviceType,credentialBackedUp}}var InvalidBackupFlags;var init_parseBackupFlags=__esm(()=>{InvalidBackupFlags=class InvalidBackupFlags extends Error{constructor(message){super(message);this.name="InvalidBackupFlags"}}});async function matchExpectedRPID(rpIDHash,expectedRPIDs){try{return await Promise.any(expectedRPIDs.map((expected)=>{return new Promise((resolve2,reject)=>{toHash(exports_isoUint8Array.fromASCIIString(expected)).then((expectedRPIDHash)=>{if(exports_isoUint8Array.areEqual(rpIDHash,expectedRPIDHash))resolve2(expected);else reject()})})}))}catch(err){if(err.name==="AggregateError")throw new UnexpectedRPIDHash;throw err}}var UnexpectedRPIDHash;var init_matchExpectedRPID=__esm(()=>{init_toHash();init_iso();UnexpectedRPIDHash=class UnexpectedRPIDHash extends Error{constructor(){super("Unexpected RP ID hash");this.name="UnexpectedRPIDHash"}}});async function verifyAttestationFIDOU2F(options){let{attStmt,clientDataHash,rpIdHash,credentialID,credentialPublicKey,aaguid,rootCertificates}=options,reservedByte=Uint8Array.from([0]),publicKey=convertCOSEtoPKCS(credentialPublicKey),signatureBase=exports_isoUint8Array.concat([reservedByte,rpIdHash,clientDataHash,credentialID,publicKey]),sig=attStmt.get("sig"),x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (FIDOU2F)");if(!sig)throw Error("No attestation signature provided in attestation statement (FIDOU2F)");let aaguidToHex=Number.parseInt(exports_isoUint8Array.toHex(aaguid),16);if(aaguidToHex!==0)throw Error(`AAGUID "${aaguidToHex}" was not expected value`);try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (FIDOU2F)`)}return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:COSEALG.ES256})}var init_verifyAttestationFIDOU2F=__esm(()=>{init_convertCOSEtoPKCS();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_iso();init_cose()});function validateExtFIDOGenCEAAGUID(certExtensions,aaguid){if(!certExtensions)return!0;let extFIDOGenCEAAGUID=certExtensions.find((ext)=>ext.extnID===id_fido_gen_ce_aaguid);if(!extFIDOGenCEAAGUID)return!0;let parsedExtFIDOGenCEAAGUID=AsnParser.parse(extFIDOGenCEAAGUID.extnValue,OctetString2),extValue=new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);if(!exports_isoUint8Array.areEqual(aaguid,extValue)){let _debugExtHex=exports_isoUint8Array.toHex(extValue),_debugAAGUIDHex=exports_isoUint8Array.toHex(aaguid);throw Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`)}return!0}var id_fido_gen_ce_aaguid="1.3.6.1.4.1.45724.1.1.4";var init_validateExtFIDOGenCEAAGUID=__esm(()=>{init_es2015();init_iso()});function getLogger(_name){return(_message,..._rest)=>{}}class BaseMetadataService{constructor(){Object.defineProperty(this,"mdsCache",{enumerable:!0,configurable:!0,writable:!0,value:{}}),Object.defineProperty(this,"statementCache",{enumerable:!0,configurable:!0,writable:!0,value:{}}),Object.defineProperty(this,"state",{enumerable:!0,configurable:!0,writable:!0,value:SERVICE_STATE.DISABLED}),Object.defineProperty(this,"verificationMode",{enumerable:!0,configurable:!0,writable:!0,value:"strict"})}async initialize(opts={}){this.statementCache={};let{mdsServers=[defaultURLMDS],statements,verificationMode}=opts;if(this.setState(SERVICE_STATE.REFRESHING),statements?.length){let statementsAdded=0;statements.forEach((statement)=>{if(statement.aaguid)this.statementCache[statement.aaguid]={entry:{metadataStatement:statement,statusReports:[],timeOfLastStatusChange:"1970-01-01"},url:NonRefreshingMDS.url},statementsAdded+=1}),log(`Cached ${statementsAdded} local statements`)}if(mdsServers?.length){let currentCacheCount=Object.keys(this.statementCache).length,numServers=mdsServers.length;for(let url of mdsServers)try{let cachedMDS={url,no:0,nextUpdate:new Date(0)},blob=await this.downloadBlob(cachedMDS);await this.verifyBlob(blob,cachedMDS)}catch(err){log(`Could not download BLOB from ${url}:`,err),numServers-=1}let cacheDiff=Object.keys(this.statementCache).length-currentCacheCount;log(`Cached ${cacheDiff} statements from ${numServers} metadata server(s)`)}if(verificationMode)this.verificationMode=verificationMode;this.setState(SERVICE_STATE.READY)}async getStatement(aaguid){if(this.state===SERVICE_STATE.DISABLED)return;if(!aaguid)return;if(aaguid instanceof Uint8Array)aaguid=convertAAGUIDToString(aaguid);await this.pauseUntilReady();let cachedStatement=this.statementCache[aaguid];if(!cachedStatement){if(this.verificationMode==="strict")throw Error(`No metadata statement found for aaguid "${aaguid}"`);return}if(cachedStatement.url){let mds=this.mdsCache[cachedStatement.url];if(new Date>mds.nextUpdate)try{this.setState(SERVICE_STATE.REFRESHING);let blob=await this.downloadBlob(mds);await this.verifyBlob(blob,mds)}finally{this.setState(SERVICE_STATE.READY)}}let{entry}=cachedStatement;for(let report of entry.statusReports){let{status}=report;if(status==="USER_VERIFICATION_BYPASS"||status==="ATTESTATION_KEY_COMPROMISE"||status==="USER_KEY_REMOTE_COMPROMISE"||status==="USER_KEY_PHYSICAL_COMPROMISE")throw Error(`Detected compromised aaguid "${aaguid}"`)}return entry.metadataStatement}async downloadBlob(cachedMDS){let{url}=cachedMDS;return await(await fetch2(url)).text()}async verifyBlob(blob,cachedMDS){let{url,no}=cachedMDS,{payload,parsedNextUpdate}=await verifyMDSBlob(blob);if(payload.no<=no)throw Error(`Latest BLOB no. ${payload.no} is not greater than previous no. ${no}`);for(let entry of payload.entries)if(entry.aaguid)this.statementCache[entry.aaguid]={entry,url};if(url)this.mdsCache[url]={...cachedMDS,no:payload.no,nextUpdate:parsedNextUpdate};else if(parsedNextUpdate<new Date)log(`\u26A0\uFE0F This MDS blob (serial: ${payload.no}) contains stale data as of ${parsedNextUpdate.toISOString()}. Please consider re-initializing MetadataService with a newer MDS blob.`)}pauseUntilReady(){if(this.state===SERVICE_STATE.READY)return new Promise((resolve2)=>{resolve2()});return new Promise((resolve2,reject)=>{let iterations=700,intervalID=globalThis.setInterval(()=>{if(iterations<1)clearInterval(intervalID),reject("State did not become ready in 70 seconds");else if(this.state===SERVICE_STATE.READY)clearInterval(intervalID),resolve2();iterations-=1},100)})}setState(newState){if(this.state=newState,newState===SERVICE_STATE.DISABLED)log("MetadataService is DISABLED");else if(newState===SERVICE_STATE.REFRESHING)log("MetadataService is REFRESHING");else if(newState===SERVICE_STATE.READY)log("MetadataService is READY")}}var NonRefreshingMDS,defaultURLMDS="https://mds.fidoalliance.org/",SERVICE_STATE,log,MetadataService;var init_metadataService=__esm(()=>{init_convertAAGUIDToString();init_verifyMDSBlob();init_fetch();NonRefreshingMDS={url:"",no:0,nextUpdate:new Date(0)};(function(SERVICE_STATE2){SERVICE_STATE2[SERVICE_STATE2.DISABLED=0]="DISABLED",SERVICE_STATE2[SERVICE_STATE2.REFRESHING=1]="REFRESHING",SERVICE_STATE2[SERVICE_STATE2.READY=2]="READY"})(SERVICE_STATE||(SERVICE_STATE={}));log=getLogger("MetadataService");MetadataService=new BaseMetadataService});async function verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg}){let{authenticationAlgorithms,authenticatorGetInfo,attestationRootCertificates}=statement,keypairCOSEAlgs=new Set;authenticationAlgorithms.forEach((algSign)=>{let algSignCOSEINFO=algSignToCOSEInfoMap[algSign];if(algSignCOSEINFO)keypairCOSEAlgs.add(algSignCOSEINFO)});let decodedPublicKey=decodeCredentialPublicKey(credentialPublicKey),kty=decodedPublicKey.get(COSEKEYS.kty),alg=decodedPublicKey.get(COSEKEYS.alg);if(!kty)throw Error("Credential public key was missing kty");if(!alg)throw Error("Credential public key was missing alg");if(!kty)throw Error("Credential public key was missing kty");let publicKeyCOSEInfo={kty,alg};if(isCOSEPublicKeyEC2(decodedPublicKey)){let crv=decodedPublicKey.get(COSEKEYS.crv);publicKeyCOSEInfo.crv=crv}let foundMatch=!1;for(let keypairAlg of keypairCOSEAlgs){if(keypairAlg.alg===publicKeyCOSEInfo.alg&&keypairAlg.kty===publicKeyCOSEInfo.kty)if((keypairAlg.kty===COSEKTY.EC2||keypairAlg.kty===COSEKTY.OKP)&&keypairAlg.crv===publicKeyCOSEInfo.crv)foundMatch=!0;else foundMatch=!0;if(foundMatch)break}if(!foundMatch){let debugMDSAlgs=authenticationAlgorithms.map((algSign)=>`'${algSign}' (COSE info: ${stringifyCOSEInfo(algSignToCOSEInfoMap[algSign])})`),strMDSAlgs=JSON.stringify(debugMDSAlgs,null,2).replace(/"/g,""),strPubKeyAlg=stringifyCOSEInfo(publicKeyCOSEInfo);throw Error(`Public key parameters ${strPubKeyAlg} did not match any of the following metadata algorithms:
-${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algorithms!==void 0){let getInfoAlgs=authenticatorGetInfo.algorithms.map((_alg)=>_alg.alg);if(getInfoAlgs.indexOf(attestationStatementAlg)<0)throw Error(`Attestation statement alg ${attestationStatementAlg} did not match one of ${getInfoAlgs}`)}let authenticatorCerts=x5c.map(convertCertBufferToPEM),statementRootCerts=attestationRootCertificates.map(convertCertBufferToPEM),authenticatorIsSelfReferencing=!1;if(authenticatorCerts.length===1&&statementRootCerts.indexOf(authenticatorCerts[0])>=0)authenticatorIsSelfReferencing=!0;if(!authenticatorIsSelfReferencing)try{await validateCertificatePath(authenticatorCerts,statementRootCerts)}catch(err){throw Error(`Could not validate certificate path with any metadata root certificates: ${err.message}`)}return!0}function stringifyCOSEInfo(info){let{kty,alg,crv}=info,toReturn="";if(kty!==COSEKTY.RSA)toReturn=`{ kty: ${kty}, alg: ${alg}, crv: ${crv} }`;else toReturn=`{ kty: ${kty}, alg: ${alg} }`;return toReturn}var algSignToCOSEInfoMap;var init_verifyAttestationWithMetadata=__esm(()=>{init_convertCertBufferToPEM();init_validateCertificatePath();init_decodeCredentialPublicKey();init_cose();algSignToCOSEInfoMap={secp256r1_ecdsa_sha256_raw:{kty:2,alg:-7,crv:1},secp256r1_ecdsa_sha256_der:{kty:2,alg:-7,crv:1},rsassa_pss_sha256_raw:{kty:3,alg:-37},rsassa_pss_sha256_der:{kty:3,alg:-37},secp256k1_ecdsa_sha256_raw:{kty:2,alg:-47,crv:8},secp256k1_ecdsa_sha256_der:{kty:2,alg:-47,crv:8},rsassa_pss_sha384_raw:{kty:3,alg:-38},rsassa_pkcsv15_sha256_raw:{kty:3,alg:-257},rsassa_pkcsv15_sha384_raw:{kty:3,alg:-258},rsassa_pkcsv15_sha512_raw:{kty:3,alg:-259},rsassa_pkcsv15_sha1_raw:{kty:3,alg:-65535},secp384r1_ecdsa_sha384_raw:{kty:2,alg:-35,crv:2},secp512r1_ecdsa_sha256_raw:{kty:2,alg:-36,crv:3},ed25519_eddsa_sha512_raw:{kty:1,alg:-8,crv:6}}});async function verifyAttestationPacked(options){let{attStmt,clientDataHash,authData,credentialPublicKey,aaguid,rootCertificates}=options,sig=attStmt.get("sig"),x5c=attStmt.get("x5c"),alg=attStmt.get("alg");if(!sig)throw Error("No attestation signature provided in attestation statement (Packed)");if(!alg)throw Error("Attestation statement did not contain alg (Packed)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Packed)`);let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]),verified=!1;if(x5c){let{subject,basicConstraintsCA,version,notBefore,notAfter,parsedCertificate}=getCertificateInfo(x5c[0]),{OU,CN,O,C}=subject;if(OU!=="Authenticator Attestation")throw Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');if(!CN)throw Error("Certificate CN was empty (Packed|Full)");if(!O)throw Error("Certificate O was empty (Packed|Full)");if(!C||C.length!==2)throw Error("Certificate C was not two-character ISO 3166 code (Packed|Full)");if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (Packed|Full)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (Packed|Full)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (Packed|Full)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);try{await validateExtFIDOGenCEAAGUID(parsedCertificate.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (Packed|Full)`)}let statement=await MetadataService.getStatement(aaguid);if(statement){if(statement.attestationTypes.indexOf("basic_full")<0)throw Error("Metadata does not indicate support for full attestations (Packed|Full)");try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (Packed|Full)`)}}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Packed|Full)`)}verified=await verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0]})}else verified=await verifySignature2({signature:sig,data:signatureBase,credentialPublicKey,hashAlgorithm:alg});return verified}var init_verifyAttestationPacked=__esm(()=>{init_cose();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationAndroidSafetyNet(options){let{attStmt,clientDataHash,authData,aaguid,rootCertificates,verifyTimestampMS=!0,credentialPublicKey,attestationSafetyNetEnforceCTSCheck}=options,alg=attStmt.get("alg"),response=attStmt.get("response");if(!attStmt.get("ver"))throw Error("No ver value in attestation (SafetyNet)");if(!response)throw Error("No response was included in attStmt by authenticator (SafetyNet)");let jwtParts=exports_isoUint8Array.toUTF8String(response).split("."),HEADER=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[0])),PAYLOAD=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[1])),SIGNATURE=jwtParts[2],{nonce,ctsProfileMatch,timestampMs}=PAYLOAD;if(verifyTimestampMS){let now=Date.now();if(timestampMs>Date.now())throw Error(`Payload timestamp "${timestampMs}" was later than "${now}" (SafetyNet)`);let timestampPlusDelay=timestampMs+60000;if(now=Date.now(),timestampPlusDelay<now)throw Error(`Payload timestamp "${timestampPlusDelay}" has expired (SafetyNet)`)}let nonceBase=exports_isoUint8Array.concat([authData,clientDataHash]),nonceBuffer=await toHash(nonceBase),expectedNonce=exports_isoBase64URL.fromBuffer(nonceBuffer,"base64");if(nonce!==expectedNonce)throw Error("Could not verify payload nonce (SafetyNet)");if(attestationSafetyNetEnforceCTSCheck&&!ctsProfileMatch)throw Error("Could not verify device integrity (SafetyNet)");let leafCertBuffer=exports_isoBase64URL.toBuffer(HEADER.x5c[0],"base64"),leafCertInfo=getCertificateInfo(leafCertBuffer),{subject}=leafCertInfo;if(subject.CN!=="attest.android.com")throw Error('Certificate common name was not "attest.android.com" (SafetyNet)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c:HEADER.x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (SafetyNet)`)}else try{await validateCertificatePath(HEADER.x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (SafetyNet)`)}let signatureBaseBuffer=exports_isoUint8Array.fromUTF8String(`${jwtParts[0]}.${jwtParts[1]}`),signatureBuffer=exports_isoBase64URL.toBuffer(SIGNATURE);return await verifySignature2({signature:signatureBuffer,data:signatureBaseBuffer,x509Certificate:leafCertBuffer})}var init_verifyAttestationAndroidSafetyNet=__esm(()=>{init_toHash();init_verifySignature();init_getCertificateInfo();init_validateCertificatePath();init_convertCertBufferToPEM();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});var TPM_ST,TPM_ALG,TPM_ECC_CURVE,TPM_MANUFACTURERS,TPM_ECC_CURVE_COSE_CRV_MAP;var init_constants2=__esm(()=>{TPM_ST={196:"TPM_ST_RSP_COMMAND",32768:"TPM_ST_NULL",32769:"TPM_ST_NO_SESSIONS",32770:"TPM_ST_SESSIONS",32788:"TPM_ST_ATTEST_NV",32789:"TPM_ST_ATTEST_COMMAND_AUDIT",32790:"TPM_ST_ATTEST_SESSION_AUDIT",32791:"TPM_ST_ATTEST_CERTIFY",32792:"TPM_ST_ATTEST_QUOTE",32793:"TPM_ST_ATTEST_TIME",32794:"TPM_ST_ATTEST_CREATION",32801:"TPM_ST_CREATION",32802:"TPM_ST_VERIFIED",32803:"TPM_ST_AUTH_SECRET",32804:"TPM_ST_HASHCHECK",32805:"TPM_ST_AUTH_SIGNED",32809:"TPM_ST_FU_MANIFEST"},TPM_ALG={0:"TPM_ALG_ERROR",1:"TPM_ALG_RSA",4:"TPM_ALG_SHA",4:"TPM_ALG_SHA1",5:"TPM_ALG_HMAC",6:"TPM_ALG_AES",7:"TPM_ALG_MGF1",8:"TPM_ALG_KEYEDHASH",10:"TPM_ALG_XOR",11:"TPM_ALG_SHA256",12:"TPM_ALG_SHA384",13:"TPM_ALG_SHA512",16:"TPM_ALG_NULL",18:"TPM_ALG_SM3_256",19:"TPM_ALG_SM4",20:"TPM_ALG_RSASSA",21:"TPM_ALG_RSAES",22:"TPM_ALG_RSAPSS",23:"TPM_ALG_OAEP",24:"TPM_ALG_ECDSA",25:"TPM_ALG_ECDH",26:"TPM_ALG_ECDAA",27:"TPM_ALG_SM2",28:"TPM_ALG_ECSCHNORR",29:"TPM_ALG_ECMQV",32:"TPM_ALG_KDF1_SP800_56A",33:"TPM_ALG_KDF2",34:"TPM_ALG_KDF1_SP800_108",35:"TPM_ALG_ECC",37:"TPM_ALG_SYMCIPHER",38:"TPM_ALG_CAMELLIA",64:"TPM_ALG_CTR",65:"TPM_ALG_OFB",66:"TPM_ALG_CBC",67:"TPM_ALG_CFB",68:"TPM_ALG_ECB"},TPM_ECC_CURVE={0:"TPM_ECC_NONE",1:"TPM_ECC_NIST_P192",2:"TPM_ECC_NIST_P224",3:"TPM_ECC_NIST_P256",4:"TPM_ECC_NIST_P384",5:"TPM_ECC_NIST_P521",16:"TPM_ECC_BN_P256",17:"TPM_ECC_BN_P638",32:"TPM_ECC_SM2_P256"},TPM_MANUFACTURERS={"id:414D4400":{name:"AMD",id:"AMD"},"id:414E5400":{name:"Ant Group",id:"ANT"},"id:41544D4C":{name:"Atmel",id:"ATML"},"id:4252434D":{name:"Broadcom",id:"BRCM"},"id:4353434F":{name:"Cisco",id:"CSCO"},"id:464C5953":{name:"Flyslice Technologies",id:"FLYS"},"id:524F4343":{name:"Fuzhou Rockchip",id:"ROCC"},"id:474F4F47":{name:"Google",id:"GOOG"},"id:48504900":{name:"HPI",id:"HPI"},"id:48504500":{name:"HPE",id:"HPE"},"id:48495349":{name:"Huawei",id:"HISI"},"id:49424d00":{name:"IBM",id:"IBM"},"id:49424D00":{name:"IBM",id:"IBM"},"id:49465800":{name:"Infineon",id:"IFX"},"id:494E5443":{name:"Intel",id:"INTC"},"id:4C454E00":{name:"Lenovo",id:"LEN"},"id:4D534654":{name:"Microsoft",id:"MSFT"},"id:4E534D20":{name:"National Semiconductor",id:"NSM"},"id:4E545A00":{name:"Nationz",id:"NTZ"},"id:4E534700":{name:"NSING",id:"NSG"},"id:4E544300":{name:"Nuvoton Technology",id:"NTC"},"id:51434F4D":{name:"Qualcomm",id:"QCOM"},"id:534D534E":{name:"Samsung",id:"SMSN"},"id:53454345":{name:"SecEdge",id:"SECE"},"id:534E5300":{name:"Sinosun",id:"SNS"},"id:534D5343":{name:"SMSC",id:"SMSC"},"id:53544D20":{name:"STMicroelectronics",id:"STM"},"id:54584E00":{name:"Texas Instruments",id:"TXN"},"id:57454300":{name:"Winbond",id:"WEC"},"id:5345414C":{name:"Wisekey",id:"SEAL"},"id:FFFFF1D0":{name:"FIDO Alliance",id:"FIDO"}},TPM_ECC_CURVE_COSE_CRV_MAP={TPM_ECC_NIST_P256:1,TPM_ECC_NIST_P384:2,TPM_ECC_NIST_P521:3,TPM_ECC_BN_P256:1,TPM_ECC_SM2_P256:1}});function parseCertInfo(certInfo){let pointer=0,dataView=exports_isoUint8Array.toDataView(certInfo),magic=dataView.getUint32(pointer);pointer+=4;let typeBuffer=dataView.getUint16(pointer);pointer+=2;let type=TPM_ST[typeBuffer],qualifiedSignerLength=dataView.getUint16(pointer);pointer+=2;let qualifiedSigner=certInfo.slice(pointer,pointer+=qualifiedSignerLength),extraDataLength=dataView.getUint16(pointer);pointer+=2;let extraData=certInfo.slice(pointer,pointer+=extraDataLength),clock=certInfo.slice(pointer,pointer+=8),resetCount=dataView.getUint32(pointer);pointer+=4;let restartCount=dataView.getUint32(pointer);pointer+=4;let safe=!!certInfo.slice(pointer,pointer+=1),clockInfo={clock,resetCount,restartCount,safe},firmwareVersion=certInfo.slice(pointer,pointer+=8),attestedNameLength=dataView.getUint16(pointer);pointer+=2;let attestedName=certInfo.slice(pointer,pointer+=attestedNameLength),attestedNameDataView=exports_isoUint8Array.toDataView(attestedName),qualifiedNameLength=dataView.getUint16(pointer);pointer+=2;let qualifiedName=certInfo.slice(pointer,pointer+=qualifiedNameLength),attested={nameAlg:TPM_ALG[attestedNameDataView.getUint16(0)],nameAlgBuffer:attestedName.slice(0,2),name:attestedName,qualifiedName};return{magic,type,qualifiedSigner,extraData,clockInfo,firmwareVersion,attested}}var init_parseCertInfo=__esm(()=>{init_constants2();init_iso()});function parsePubArea(pubArea){let pointer=0,dataView=exports_isoUint8Array.toDataView(pubArea),type=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let nameAlg=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let objectAttributesInt=dataView.getUint32(pointer);pointer+=4;let objectAttributes={fixedTPM:!!(objectAttributesInt&1),stClear:!!(objectAttributesInt&2),fixedParent:!!(objectAttributesInt&8),sensitiveDataOrigin:!!(objectAttributesInt&16),userWithAuth:!!(objectAttributesInt&32),adminWithPolicy:!!(objectAttributesInt&64),noDA:!!(objectAttributesInt&512),encryptedDuplication:!!(objectAttributesInt&1024),restricted:!!(objectAttributesInt&32768),decrypt:!!(objectAttributesInt&65536),signOrEncrypt:!!(objectAttributesInt&131072)},authPolicyLength=dataView.getUint16(pointer);pointer+=2;let authPolicy=pubArea.slice(pointer,pointer+=authPolicyLength),parameters2={},unique=Uint8Array.from([]);if(type==="TPM_ALG_RSA"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let keyBits=dataView.getUint16(pointer);pointer+=2;let exponent=dataView.getUint32(pointer);pointer+=4,parameters2.rsa={symmetric,scheme,keyBits,exponent};let uniqueLength=dataView.getUint16(pointer);pointer+=2,unique=pubArea.slice(pointer,pointer+=uniqueLength)}else if(type==="TPM_ALG_ECC"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let curveID=TPM_ECC_CURVE[dataView.getUint16(pointer)];pointer+=2;let kdf=TPM_ALG[dataView.getUint16(pointer)];pointer+=2,parameters2.ecc={symmetric,scheme,curveID,kdf};let uniqueXLength=dataView.getUint16(pointer);pointer+=2;let uniqueX=pubArea.slice(pointer,pointer+=uniqueXLength),uniqueYLength=dataView.getUint16(pointer);pointer+=2;let uniqueY=pubArea.slice(pointer,pointer+=uniqueYLength);unique=exports_isoUint8Array.concat([uniqueX,uniqueY])}else throw Error(`Unexpected type "${type}" (TPM)`);return{type,nameAlg,objectAttributes,authPolicy,parameters:parameters2,unique}}var init_parsePubArea=__esm(()=>{init_constants2();init_iso()});async function verifyAttestationTPM(options){let{aaguid,attStmt,authData,credentialPublicKey,clientDataHash,rootCertificates}=options,ver=attStmt.get("ver"),sig=attStmt.get("sig"),alg=attStmt.get("alg"),x5c=attStmt.get("x5c"),pubArea=attStmt.get("pubArea"),certInfo=attStmt.get("certInfo");if(ver!=="2.0")throw Error(`Unexpected ver "${ver}", expected "2.0" (TPM)`);if(!sig)throw Error("No attestation signature provided in attestation statement (TPM)");if(!alg)throw Error("Attestation statement did not contain alg (TPM)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (TPM)`);if(!x5c)throw Error("No attestation certificate provided in attestation statement (TPM)");if(!pubArea)throw Error("Attestation statement did not contain pubArea (TPM)");if(!certInfo)throw Error("Attestation statement did not contain certInfo (TPM)");let parsedPubArea=parsePubArea(pubArea),{unique,type:pubType,parameters:parameters2}=parsedPubArea,cosePublicKey=decodeCredentialPublicKey(credentialPublicKey);if(pubType==="TPM_ALG_RSA"){if(!isCOSEPublicKeyRSA(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!n)throw Error("COSE public key missing n (TPM|RSA)");if(!e)throw Error("COSE public key missing e (TPM|RSA)");if(!exports_isoUint8Array.areEqual(unique,n))throw Error("PubArea unique is not same as credentialPublicKey (TPM|RSA)");if(!parameters2.rsa)throw Error("Parsed pubArea type is RSA, but missing parameters.rsa (TPM|RSA)");let eBuffer=e,pubAreaExponent=parameters2.rsa.exponent||65537,eSum=eBuffer[0]+(eBuffer[1]<<8)+(eBuffer[2]<<16);if(pubAreaExponent!==eSum)throw Error(`Unexpected public key exp ${eSum}, expected ${pubAreaExponent} (TPM|RSA)`)}else if(pubType==="TPM_ALG_ECC"){if(!isCOSEPublicKeyEC2(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!crv)throw Error("COSE public key missing crv (TPM|ECC)");if(!x)throw Error("COSE public key missing x (TPM|ECC)");if(!y)throw Error("COSE public key missing y (TPM|ECC)");if(!exports_isoUint8Array.areEqual(unique,exports_isoUint8Array.concat([x,y])))throw Error("PubArea unique is not same as public key x and y (TPM|ECC)");if(!parameters2.ecc)throw Error("Parsed pubArea type is ECC, but missing parameters.ecc (TPM|ECC)");let pubAreaCurveID=parameters2.ecc.curveID,pubAreaCurveIDMapToCOSECRV=TPM_ECC_CURVE_COSE_CRV_MAP[pubAreaCurveID];if(pubAreaCurveIDMapToCOSECRV!==crv)throw Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${crv}" (TPM|ECC)`)}else throw Error(`Unsupported pubArea.type "${pubType}"`);let parsedCertInfo=parseCertInfo(certInfo),{magic,type:certType,attested,extraData}=parsedCertInfo;if(magic!==4283712327)throw Error(`Unexpected magic value "${magic}", expected "0xff544347" (TPM)`);if(certType!=="TPM_ST_ATTEST_CERTIFY")throw Error(`Unexpected type "${certType}", expected "TPM_ST_ATTEST_CERTIFY" (TPM)`);let pubAreaHash=await toHash(pubArea,attestedNameAlgToCOSEAlg(attested.nameAlg)),attestedName=exports_isoUint8Array.concat([attested.nameAlgBuffer,pubAreaHash]);if(!exports_isoUint8Array.areEqual(attested.name,attestedName))throw Error("Attested name comparison failed (TPM)");let attToBeSigned=exports_isoUint8Array.concat([authData,clientDataHash]),attToBeSignedHash=await toHash(attToBeSigned,alg);if(!exports_isoUint8Array.areEqual(extraData,attToBeSignedHash))throw Error("CertInfo extra data did not equal hashed attestation (TPM)");if(x5c.length<1)throw Error("No certificates present in x5c array (TPM)");let leafCertInfo=getCertificateInfo(x5c[0]),{basicConstraintsCA,version,subject,notAfter,notBefore}=leafCertInfo;if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (TPM)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (TPM)");if(subject.combined.length>0)throw Error("Certificate subject was not empty (TPM)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (TPM)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (TPM)`);let parsedCert=AsnParser.parse(x5c[0],Certificate);if(!parsedCert.tbsCertificate.extensions)throw Error("Certificate was missing extensions (TPM)");let subjectAltNamePresent,extKeyUsage;if(parsedCert.tbsCertificate.extensions.forEach((ext)=>{if(ext.extnID===id_ce_subjectAltName)subjectAltNamePresent=AsnParser.parse(ext.extnValue,SubjectAlternativeName);else if(ext.extnID===id_ce_extKeyUsage)extKeyUsage=AsnParser.parse(ext.extnValue,ExtendedKeyUsage)}),!subjectAltNamePresent)throw Error("Certificate did not contain subjectAltName extension (TPM)");if(!subjectAltNamePresent[0].directoryName?.[0].length)throw Error("Certificate subjectAltName extension directoryName was empty (TPM)");let{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}=getTcgAtTpmValues(subjectAltNamePresent[0].directoryName);if(!tcgAtTpmManufacturer||!tcgAtTpmModel||!tcgAtTpmVersion)throw Error("Certificate contained incomplete subjectAltName data (TPM)");if(!extKeyUsage)throw Error("Certificate did not contain ExtendedKeyUsage extension (TPM)");if(!TPM_MANUFACTURERS[tcgAtTpmManufacturer])throw Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);if(extKeyUsage[0]!=="2.23.133.8.3")throw Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);try{await validateExtFIDOGenCEAAGUID(parsedCert.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (TPM)`)}let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (TPM)`)}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (TPM)`)}return verifySignature2({signature:sig,data:certInfo,x509Certificate:x5c[0],hashAlgorithm:alg})}function getTcgAtTpmValues(root){let tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion;return root.forEach((relName)=>{relName.forEach((attr)=>{if(attr.type==="2.23.133.2.1")tcgAtTpmManufacturer=attr.value.toString();else if(attr.type==="2.23.133.2.2")tcgAtTpmModel=attr.value.toString();else if(attr.type==="2.23.133.2.3")tcgAtTpmVersion=attr.value.toString()})}),{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}}function attestedNameAlgToCOSEAlg(alg){if(alg==="TPM_ALG_SHA256")return COSEALG.ES256;else if(alg==="TPM_ALG_SHA384")return COSEALG.ES384;else if(alg==="TPM_ALG_SHA512")return COSEALG.ES512;throw Error(`Unexpected TPM attested name alg ${alg}`)}var init_verifyAttestationTPM=__esm(()=>{init_es2015();init_es20152();init_decodeCredentialPublicKey();init_cose();init_toHash();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata();init_constants2();init_parseCertInfo();init_parsePubArea()});class RootOfTrust{verifiedBootKey=new OctetString2;deviceLocked=!1;verifiedBootState=VerifiedBootState.verified;verifiedBootHash;constructor(params={}){Object.assign(this,params)}}class AuthorizationList{purpose;algorithm;keySize;digest;padding;ecCurve;rsaPublicExponent;mgfDigest;rollbackResistance;earlyBootOnly;activeDateTime;originationExpireDateTime;usageExpireDateTime;usageCountLimit;noAuthRequired;userAuthType;authTimeout;allowWhileOnBody;trustedUserPresenceRequired;trustedConfirmationRequired;unlockedDeviceRequired;allApplications;applicationId;creationDateTime;origin;rollbackResistant;rootOfTrust;osVersion;osPatchLevel;attestationApplicationId;attestationIdBrand;attestationIdDevice;attestationIdProduct;attestationIdSerial;attestationIdImei;attestationIdMeid;attestationIdManufacturer;attestationIdModel;vendorPatchLevel;bootPatchLevel;deviceUniqueAttestation;attestationIdSecondImei;moduleHash;constructor(params={}){Object.assign(this,params)}}class KeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;teeEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}}class KeyMintKeyDescription{attestationVersion=Version3.keyMint4;attestationSecurityLevel=SecurityLevel.software;keyMintVersion=0;keyMintSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;hardwareEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}toLegacyKeyDescription(){return new KeyDescription({attestationVersion:this.attestationVersion,attestationSecurityLevel:this.attestationSecurityLevel,keymasterVersion:this.keyMintVersion,keymasterSecurityLevel:this.keyMintSecurityLevel,attestationChallenge:this.attestationChallenge,uniqueId:this.uniqueId,softwareEnforced:this.softwareEnforced,teeEnforced:this.hardwareEnforced})}static fromLegacyKeyDescription(keyDesc){return new KeyMintKeyDescription({attestationVersion:keyDesc.attestationVersion,attestationSecurityLevel:keyDesc.attestationSecurityLevel,keyMintVersion:keyDesc.keymasterVersion,keyMintSecurityLevel:keyDesc.keymasterSecurityLevel,attestationChallenge:keyDesc.attestationChallenge,uniqueId:keyDesc.uniqueId,softwareEnforced:keyDesc.softwareEnforced,hardwareEnforced:keyDesc.teeEnforced})}}var IntegerSet_1,id_ce_keyDescription="1.3.6.1.4.1.11129.2.1.17",VerifiedBootState,IntegerSet,SecurityLevel,Version3;var init_key_description=__esm(()=>{init_modules();init_es2015();(function(VerifiedBootState2){VerifiedBootState2[VerifiedBootState2.verified=0]="verified",VerifiedBootState2[VerifiedBootState2.selfSigned=1]="selfSigned",VerifiedBootState2[VerifiedBootState2.unverified=2]="unverified",VerifiedBootState2[VerifiedBootState2.failed=3]="failed"})(VerifiedBootState||(VerifiedBootState={}));__decorate([AsnProp({type:OctetString2})],RootOfTrust.prototype,"verifiedBootKey",void 0);__decorate([AsnProp({type:AsnPropTypes.Boolean})],RootOfTrust.prototype,"deviceLocked",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],RootOfTrust.prototype,"verifiedBootState",void 0);__decorate([AsnProp({type:OctetString2,optional:!0})],RootOfTrust.prototype,"verifiedBootHash",void 0);IntegerSet=IntegerSet_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,IntegerSet_1.prototype)}};IntegerSet=IntegerSet_1=__decorate([AsnType({type:AsnTypeTypes.Set,itemType:AsnPropTypes.Integer})],IntegerSet);__decorate([AsnProp({context:1,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"purpose",void 0);__decorate([AsnProp({context:2,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"algorithm",void 0);__decorate([AsnProp({context:3,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"keySize",void 0);__decorate([AsnProp({context:5,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"digest",void 0);__decorate([AsnProp({context:6,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"padding",void 0);__decorate([AsnProp({context:10,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"ecCurve",void 0);__decorate([AsnProp({context:200,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"rsaPublicExponent",void 0);__decorate([AsnProp({context:203,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"mgfDigest",void 0);__decorate([AsnProp({context:303,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistance",void 0);__decorate([AsnProp({context:305,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"earlyBootOnly",void 0);__decorate([AsnProp({context:400,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"activeDateTime",void 0);__decorate([AsnProp({context:401,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"originationExpireDateTime",void 0);__decorate([AsnProp({context:402,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageExpireDateTime",void 0);__decorate([AsnProp({context:405,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageCountLimit",void 0);__decorate([AsnProp({context:503,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"noAuthRequired",void 0);__decorate([AsnProp({context:504,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"userAuthType",void 0);__decorate([AsnProp({context:505,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"authTimeout",void 0);__decorate([AsnProp({context:506,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allowWhileOnBody",void 0);__decorate([AsnProp({context:507,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedUserPresenceRequired",void 0);__decorate([AsnProp({context:508,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedConfirmationRequired",void 0);__decorate([AsnProp({context:509,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"unlockedDeviceRequired",void 0);__decorate([AsnProp({context:600,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allApplications",void 0);__decorate([AsnProp({context:601,type:OctetString2,optional:!0})],AuthorizationList.prototype,"applicationId",void 0);__decorate([AsnProp({context:701,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"creationDateTime",void 0);__decorate([AsnProp({context:702,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"origin",void 0);__decorate([AsnProp({context:703,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistant",void 0);__decorate([AsnProp({context:704,type:RootOfTrust,optional:!0})],AuthorizationList.prototype,"rootOfTrust",void 0);__decorate([AsnProp({context:705,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osVersion",void 0);__decorate([AsnProp({context:706,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osPatchLevel",void 0);__decorate([AsnProp({context:709,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationApplicationId",void 0);__decorate([AsnProp({context:710,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdBrand",void 0);__decorate([AsnProp({context:711,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdDevice",void 0);__decorate([AsnProp({context:712,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdProduct",void 0);__decorate([AsnProp({context:713,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSerial",void 0);__decorate([AsnProp({context:714,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdImei",void 0);__decorate([AsnProp({context:715,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdMeid",void 0);__decorate([AsnProp({context:716,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdManufacturer",void 0);__decorate([AsnProp({context:717,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdModel",void 0);__decorate([AsnProp({context:718,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"vendorPatchLevel",void 0);__decorate([AsnProp({context:719,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"bootPatchLevel",void 0);__decorate([AsnProp({context:720,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"deviceUniqueAttestation",void 0);__decorate([AsnProp({context:723,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSecondImei",void 0);__decorate([AsnProp({context:724,type:OctetString2,optional:!0})],AuthorizationList.prototype,"moduleHash",void 0);(function(SecurityLevel2){SecurityLevel2[SecurityLevel2.software=0]="software",SecurityLevel2[SecurityLevel2.trustedEnvironment=1]="trustedEnvironment",SecurityLevel2[SecurityLevel2.strongBox=2]="strongBox"})(SecurityLevel||(SecurityLevel={}));(function(Version4){Version4[Version4.KM2=1]="KM2",Version4[Version4.KM3=2]="KM3",Version4[Version4.KM4=3]="KM4",Version4[Version4.KM4_1=4]="KM4_1",Version4[Version4.keyMint1=100]="keyMint1",Version4[Version4.keyMint2=200]="keyMint2",Version4[Version4.keyMint3=300]="keyMint3",Version4[Version4.keyMint4=400]="keyMint4"})(Version3||(Version3={}));__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"teeEnforced",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"keyMintVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"keyMintSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"hardwareEnforced",void 0)});class NonStandardKeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new NonStandardAuthorizationList;teeEnforced=new NonStandardAuthorizationList;get keyMintVersion(){return this.keymasterVersion}set keyMintVersion(value){this.keymasterVersion=value}get keyMintSecurityLevel(){return this.keymasterSecurityLevel}set keyMintSecurityLevel(value){this.keymasterSecurityLevel=value}get hardwareEnforced(){return this.teeEnforced}set hardwareEnforced(value){this.teeEnforced=value}constructor(params={}){Object.assign(this,params)}}var NonStandardAuthorizationList_1,NonStandardAuthorization,NonStandardAuthorizationList,NonStandardKeyMintKeyDescription;var init_nonstandard=__esm(()=>{init_modules();init_es2015();init_key_description();NonStandardAuthorization=class extends AuthorizationList{};NonStandardAuthorization=__decorate([AsnType({type:AsnTypeTypes.Choice})],NonStandardAuthorization);NonStandardAuthorizationList=NonStandardAuthorizationList_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,NonStandardAuthorizationList_1.prototype)}findProperty(key2){let prop=this.find((o)=>o[key2]!==void 0);if(prop)return prop[key2];return}};NonStandardAuthorizationList=NonStandardAuthorizationList_1=__decorate([AsnType({type:AsnTypeTypes.Sequence,itemType:NonStandardAuthorization})],NonStandardAuthorizationList);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"teeEnforced",void 0);NonStandardKeyMintKeyDescription=class extends NonStandardKeyDescription{constructor(params={}){if("keymasterVersion"in params&&!("keyMintVersion"in params))params.keyMintVersion=params.keymasterVersion;if("keymasterSecurityLevel"in params&&!("keyMintSecurityLevel"in params))params.keyMintSecurityLevel=params.keymasterSecurityLevel;if("teeEnforced"in params&&!("hardwareEnforced"in params))params.hardwareEnforced=params.teeEnforced;super(params)}};NonStandardKeyMintKeyDescription=__decorate([AsnType({type:AsnTypeTypes.Sequence})],NonStandardKeyMintKeyDescription)});class AttestationPackageInfo{packageName;version;constructor(params={}){Object.assign(this,params)}}class AttestationApplicationId{packageInfos;signatureDigests;constructor(params={}){Object.assign(this,params)}}var init_attestation=__esm(()=>{init_modules();init_es2015();__decorate([AsnProp({type:AsnPropTypes.OctetString})],AttestationPackageInfo.prototype,"packageName",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],AttestationPackageInfo.prototype,"version",void 0);__decorate([AsnProp({type:AttestationPackageInfo,repeated:"set"})],AttestationApplicationId.prototype,"packageInfos",void 0);__decorate([AsnProp({type:AsnPropTypes.OctetString,repeated:"set"})],AttestationApplicationId.prototype,"signatureDigests",void 0)});var init_es201511=__esm(()=>{init_key_description();init_nonstandard();init_attestation()});async function verifyAttestationAndroidKey(options){let{authData,clientDataHash,attStmt,credentialPublicKey,aaguid,rootCertificates}=options,x5c=attStmt.get("x5c"),sig=attStmt.get("sig"),alg=attStmt.get("alg");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Android Key)");if(!sig)throw Error("No attestation signature provided in attestation statement (Android Key)");if(!alg)throw Error("Attestation statement did not contain alg (Android Key)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Android Key)`);let parsedCert=AsnParser.parse(x5c[0],Certificate),parsedCertPubKey=new Uint8Array(parsedCert.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey),credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,parsedCertPubKey))throw Error("Credential public key does not equal leaf cert public key (Android Key)");let extKeyStore=parsedCert.tbsCertificate.extensions?.find((ext)=>ext.extnID===id_ce_keyDescription);if(!extKeyStore)throw Error("Certificate did not contain extKeyStore (Android Key)");let parsedExtKeyStore=AsnParser.parse(extKeyStore.extnValue,KeyDescription),{attestationChallenge,teeEnforced,softwareEnforced}=parsedExtKeyStore;if(!exports_isoUint8Array.areEqual(new Uint8Array(attestationChallenge.buffer),clientDataHash))throw Error("Attestation challenge was not equal to client data hash (Android Key)");if(teeEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');if(softwareEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}else{let x5cNoRootPEM=x5c.slice(0,-1).map(convertCertBufferToPEM),x5cRootPEM=x5c.slice(-1).map(convertCertBufferToPEM);try{await validateCertificatePath(x5cNoRootPEM,x5cRootPEM)}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}if(rootCertificates.length>0&&rootCertificates.indexOf(x5cRootPEM[0])<0)throw Error("x5c root certificate was not a known root certificate (Android Key)")}let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]);return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:alg})}var init_verifyAttestationAndroidKey=__esm(()=>{init_es2015();init_es20152();init_es201511();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_convertCOSEtoPKCS();init_cose();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationApple(options){let{attStmt,authData,clientDataHash,credentialPublicKey,rootCertificates}=options,x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Apple)");try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Apple)`)}let parsedCredCert=AsnParser.parse(x5c[0],Certificate),{extensions:extensions2,subjectPublicKeyInfo}=parsedCredCert.tbsCertificate;if(!extensions2)throw Error("credCert missing extensions (Apple)");let extCertNonce=extensions2.find((ext)=>ext.extnID==="1.2.840.113635.100.8.2");if(!extCertNonce)throw Error('credCert missing "1.2.840.113635.100.8.2" extension (Apple)');let nonceToHash=exports_isoUint8Array.concat([authData,clientDataHash]),nonce=await toHash(nonceToHash),extNonce=new Uint8Array(extCertNonce.extnValue.buffer).slice(6);if(!exports_isoUint8Array.areEqual(nonce,extNonce))throw Error("credCert nonce was not expected value (Apple)");let credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey),credCertSubjectPublicKey=new Uint8Array(subjectPublicKeyInfo.subjectPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,credCertSubjectPublicKey))throw Error("Credential public key does not equal credCert public key (Apple)");return!0}var init_verifyAttestationApple=__esm(()=>{init_es2015();init_es20152();init_validateCertificatePath();init_convertCertBufferToPEM();init_toHash();init_convertCOSEtoPKCS();init_iso()});async function verifyRegistrationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,requireUserPresence=!0,requireUserVerification=!0,supportedAlgorithmIDs=supportedCOSEAlgorithmIdentifiers,attestationSafetyNetEnforceCTSCheck=!0}=options,{id,rawId,type:credentialType,response:attestationResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);let clientDataJSON=decodeClientDataJSON(attestationResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected registration response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected registration response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.create")throw Error(`Unexpected registration response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin))throw Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`)}else if(origin!==expectedOrigin)throw Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);if(tokenBinding){if(typeof tokenBinding!=="object")throw Error(`Unexpected value for TokenBinding "${tokenBinding}"`);if(["present","supported","not-supported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`)}let attestationObject=exports_isoBase64URL.toBuffer(attestationResponse.attestationObject),decodedAttestationObject=decodeAttestationObject(attestationObject),fmt=decodedAttestationObject.get("fmt"),authData=decodedAttestationObject.get("authData"),attStmt=decodedAttestationObject.get("attStmt"),parsedAuthData=parseAuthenticatorData(authData),{aaguid,rpIdHash,flags,credentialID,counter,credentialPublicKey,extensionsData}=parsedAuthData,matchedRPID;if(expectedRPID){let expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs)}if(requireUserPresence&&!flags.up)throw Error("User presence was required, but user was not present");if(requireUserVerification&&!flags.uv)throw Error("User verification was required, but user could not be verified");if(!credentialID)throw Error("No credential ID was provided by authenticator");if(!credentialPublicKey)throw Error("No public key was provided by authenticator");if(!aaguid)throw Error("No AAGUID was present during registration");let alg=decodeCredentialPublicKey(credentialPublicKey).get(COSEKEYS.alg);if(typeof alg!=="number")throw Error("Credential public key was missing numeric alg");if(!supportedAlgorithmIDs.includes(alg)){let supported=supportedAlgorithmIDs.join(", ");throw Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`)}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(attestationResponse.clientDataJSON)),rootCertificates=SettingsService.getRootCertificates({identifier:fmt}),verifierOpts={aaguid,attStmt,authData,clientDataHash,credentialID,credentialPublicKey,rootCertificates,rpIdHash,attestationSafetyNetEnforceCTSCheck},verified=!1;if(fmt==="fido-u2f")verified=await verifyAttestationFIDOU2F(verifierOpts);else if(fmt==="packed")verified=await verifyAttestationPacked(verifierOpts);else if(fmt==="android-safetynet")verified=await verifyAttestationAndroidSafetyNet(verifierOpts);else if(fmt==="android-key")verified=await verifyAttestationAndroidKey(verifierOpts);else if(fmt==="tpm")verified=await verifyAttestationTPM(verifierOpts);else if(fmt==="apple")verified=await verifyAttestationApple(verifierOpts);else if(fmt==="none"){if(attStmt.size>0)throw Error("None attestation had unexpected attestation statement");verified=!0}else throw Error(`Unsupported Attestation Format: ${fmt}`);if(!verified)return{verified:!1};let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:!0,registrationInfo:{fmt,aaguid:convertAAGUIDToString(aaguid),credentialType,credential:{id:exports_isoBase64URL.fromBuffer(credentialID),publicKey:credentialPublicKey,counter,transports:response.response.transports},attestationObject,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,origin:clientDataJSON.origin,rpID:matchedRPID,authenticatorExtensionResults:extensionsData}}}var init_verifyRegistrationResponse=__esm(()=>{init_decodeAttestationObject();init_decodeClientDataJSON();init_parseAuthenticatorData();init_toHash();init_decodeCredentialPublicKey();init_cose();init_convertAAGUIDToString();init_parseBackupFlags();init_matchExpectedRPID();init_iso();init_settingsService();init_generateRegistrationOptions();init_verifyAttestationFIDOU2F();init_verifyAttestationPacked();init_verifyAttestationAndroidSafetyNet();init_verifyAttestationTPM();init_verifyAttestationAndroidKey();init_verifyAttestationApple()});async function generateAuthenticationOptions(options){let{allowCredentials,challenge=await generateChallenge2(),timeout=60000,userVerification="preferred",extensions:extensions2,rpID}=options,_challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);return{rpId:rpID,challenge:exports_isoBase64URL.fromBuffer(_challenge),allowCredentials:allowCredentials?.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`allowCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),timeout,userVerification,extensions:extensions2}}var init_generateAuthenticationOptions=__esm(()=>{init_iso();init_generateChallenge()});async function verifyAuthenticationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,credential,requireUserVerification=!0,advancedFIDOConfig}=options,{id,rawId,type:credentialType,response:assertionResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);if(!response)throw Error("Credential missing response");if(typeof assertionResponse?.clientDataJSON!=="string")throw Error("Credential response clientDataJSON was not a string");let clientDataJSON=decodeClientDataJSON(assertionResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.get")throw Error(`Unexpected authentication response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin)){let joinedExpectedOrigin=expectedOrigin.join(", ");throw Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`)}}else if(origin!==expectedOrigin)throw Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);if(!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData))throw Error("Credential response authenticatorData was not a base64url string");if(!exports_isoBase64URL.isBase64URL(assertionResponse.signature))throw Error("Credential response signature was not a base64url string");if(assertionResponse.userHandle&&typeof assertionResponse.userHandle!=="string")throw Error("Credential response userHandle was not a string");if(tokenBinding){if(typeof tokenBinding!=="object")throw Error("ClientDataJSON tokenBinding was not an object");if(["present","supported","notSupported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding status ${tokenBinding.status}`)}let authDataBuffer=exports_isoBase64URL.toBuffer(assertionResponse.authenticatorData),parsedAuthData=parseAuthenticatorData(authDataBuffer),{rpIdHash,flags,counter,extensionsData}=parsedAuthData,expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;let matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs);if(advancedFIDOConfig!==void 0){let{userVerification:fidoUserVerification}=advancedFIDOConfig;if(fidoUserVerification==="required"){if(!flags.uv)throw Error("User verification required, but user could not be verified")}}else{if(!flags.up)throw Error("User not present during authentication");if(requireUserVerification&&!flags.uv)throw Error("User verification required, but user could not be verified")}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(assertionResponse.clientDataJSON)),signatureBase=exports_isoUint8Array.concat([authDataBuffer,clientDataHash]),signature=exports_isoBase64URL.toBuffer(assertionResponse.signature);if((counter>0||credential.counter>0)&&counter<=credential.counter)throw Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:await verifySignature2({signature,data:signatureBase,credentialPublicKey:credential.publicKey}),authenticationInfo:{newCounter:counter,credentialID:credential.id,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,authenticatorExtensionResults:extensionsData,origin:clientDataJSON.origin,rpID:matchedRPID}}}var init_verifyAuthenticationResponse=__esm(()=>{init_decodeClientDataJSON();init_toHash();init_verifySignature();init_parseAuthenticatorData();init_parseBackupFlags();init_matchExpectedRPID();init_iso()});var init_mdsTypes=()=>{};var init_types11=()=>{};var init_esm2=__esm(()=>{init_generateRegistrationOptions();init_verifyRegistrationResponse();init_generateAuthenticationOptions();init_verifyAuthenticationResponse();init_metadataService();init_settingsService();init_mdsTypes();init_types11()});function base64UrlEncode2(buffer){let binary="";for(let byte of buffer)binary+=String.fromCharCode(byte);return(typeof btoa<"u"?btoa(binary):Buffer.from(binary,"binary").toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function base64UrlDecode2(value){let padded=value.replace(/-/g,"+").replace(/_/g,"/").padEnd(value.length+(4-value.length%4)%4,"="),binary=typeof atob<"u"?atob(padded):Buffer.from(padded,"base64").toString("binary"),buffer=new ArrayBuffer(binary.length),out=new Uint8Array(buffer);for(let i=0;i<binary.length;i+=1)out[i]=binary.charCodeAt(i);return out}function parseTransports(value){if(!value)return null;if(Array.isArray(value))return value;if(typeof value==="string")try{let parsed=JSON.parse(value);return Array.isArray(parsed)?parsed:null}catch{return null}return null}function parseDeviceType(value){if(value==="singleDevice"||value==="multiDevice")return value;return null}var exports_WebAuthn={};__export(exports_WebAuthn,{WebAuthnService:()=>WebAuthnService});class WebAuthnService{config;challengeTtlMs;constructor(config){this.config=config,this.challengeTtlMs=config.challengeTtlMs??DEFAULT_CHALLENGE_TTL_MS}async createRegistrationOptions(params){let existing=await this.config.storage.listCredentialsByUser(params.userId,params.schemaName),options=await generateRegistrationOptions({rpName:this.config.rp.rpName,rpID:this.config.rp.rpID,userID:new TextEncoder().encode(params.userId),userName:params.userName,userDisplayName:params.userDisplayName??params.userName,attestationType:"none",authenticatorSelection:{residentKey:"preferred",userVerification:this.config.userVerification??"preferred"},excludeCredentials:existing.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"registration",userId:params.userId,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyRegistration(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"registration",params.schemaName);if(!stored||stored.userId!==params.userId)return null;if(stored.expiresAt.getTime()<Date.now())return null;let verification;try{verification=await verifyRegistrationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Registration attestation rejected",{userId:params.userId,reason:error instanceof Error?error.message:String(error)}),null}if(!verification.verified||!verification.registrationInfo)return null;let info=verification.registrationInfo,publicKey=base64UrlEncode2(info.credential.publicKey),attachment=params.response.authenticatorAttachment==="platform"||params.response.authenticatorAttachment==="cross-platform"?params.response.authenticatorAttachment:null;return this.config.storage.insertCredential({userId:params.userId,credentialId:info.credential.id,publicKey,counter:info.credential.counter,transports:info.credential.transports??null,deviceType:info.credentialDeviceType,backedUp:info.credentialBackedUp,aaguid:info.aaguid??null,authenticatorAttachment:attachment,nickname:params.nickname??null,lastUsedAt:null,revokedAt:null},params.schemaName)}async createAuthenticationOptions(params){let credentials=params.userId?await this.config.storage.listCredentialsByUser(params.userId,params.schemaName):[],options=await generateAuthenticationOptions({rpID:this.config.rp.rpID,userVerification:this.config.userVerification??"preferred",allowCredentials:credentials.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"authentication",userId:params.userId??null,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyAuthentication(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"authentication",params.schemaName);if(!stored)return{verified:!1,userId:null,credentialId:null};if(stored.expiresAt.getTime()<Date.now())return{verified:!1,userId:null,credentialId:null};let credential=await this.config.storage.findCredentialById(params.response.id,params.schemaName);if(!credential||credential.revokedAt)return{verified:!1,userId:null,credentialId:null};let verification;try{verification=await verifyAuthenticationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,credential:{id:credential.credentialId,publicKey:base64UrlDecode2(credential.publicKey),counter:credential.counter,transports:credential.transports??void 0},requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Authentication assertion rejected",{userId:credential.userId,credentialId:credential.credentialId,reason:error instanceof Error?error.message:String(error)}),{verified:!1,userId:null,credentialId:null}}if(!verification.verified)return{verified:!1,userId:null,credentialId:null};return await this.config.storage.updateCredentialCounter(credential.credentialId,verification.authenticationInfo.newCounter,params.schemaName),{verified:!0,userId:credential.userId,credentialId:credential.credentialId}}listUserCredentials(userId,schemaName){return this.config.storage.listCredentialsByUser(userId,schemaName)}revokeCredential(credentialId,userId,schemaName){return this.config.storage.revokeCredential(credentialId,userId,schemaName)}renameCredential(credentialId,userId,nickname,schemaName){return this.config.storage.renameCredential(credentialId,userId,nickname,schemaName)}}var DEFAULT_CHALLENGE_TTL_MS=300000;var init_WebAuthn=__esm(()=>{init_esm2()});var init_Services=__esm(()=>{init_ApiKey();init_Auth();init_Authorization();init_Backup();init_Captcha();init_Domain();init_Email();init_Gmail();init_Logger2();init_Monitoring();init_Notification();init_OAuth();init_Payment();init_RateLimiter();init_Secrets();init_Tenant();init_Verification();init_WebAuthn()});function encodeHeaderList(items){return items.map((v)=>encodeURIComponent(v)).join(",")}function decodeHeaderList(header){if(!header)return[];return header.split(",").map((v)=>v.trim()).filter(Boolean).map((v)=>{try{return decodeURIComponent(v)}catch{return v}})}function encodeClaimScopesHeader(claimScopes){if(!claimScopes||Object.keys(claimScopes).length===0)return"";return encodeURIComponent(JSON.stringify(claimScopes))}function decodeClaimScopesHeader(header){if(!header)return;try{let parsed=JSON.parse(decodeURIComponent(header));if(parsed&&typeof parsed==="object"&&!Array.isArray(parsed))return parsed;return}catch{return}}async function withDeadline(promise,timeoutMs,message){promise.catch(()=>{});let timer,deadline=new Promise((_resolve,reject)=>{timer=setTimeout(()=>reject(Error(message)),timeoutMs)});try{return await Promise.race([promise,deadline])}finally{if(timer)clearTimeout(timer)}}function defineRoute(declaration){return{...declaration,toClientEndpoint(){return{method:declaration.method,path:declaration.path,isPublic:declaration.isPublic,isFormData:declaration.isFormData,serviceId:declaration.serviceId,_payload:void 0,_success:void 0,_error:void 0}}}}var INTERNAL_HEADERS;var init_internalHeaders=__esm(()=>{INTERNAL_HEADERS=["x-user-id","x-request-id","x-auth-type","x-api-key-id","x-api-key-owner-type","x-user-roles","x-user-claims","x-user-claim-scopes","x-session-id","x-access-token","x-refresh-token","x-tenant-schema"]});function createResponseSet(){return{headers:{}}}function withEnvelopeFlags(body){let hasSuccess=Object.hasOwn(body,"success")&&typeof body.success==="boolean",hasIsSuccess=Object.hasOwn(body,"isSuccess")&&typeof body.isSuccess==="boolean";if(hasSuccess===hasIsSuccess)return body;let mirrored={};for(let[key2,value]of Object.entries(body))if(mirrored[key2]=value,key2==="success")mirrored.isSuccess=value;else if(key2==="isSuccess")mirrored.success=value;return mirrored}function mirrorFlags(result){if(Array.isArray(result))return result;let proto=Object.getPrototypeOf(result);if(proto!==Object.prototype&&proto!==null)return result;return withEnvelopeFlags(result)}function usableStatus(status){if(typeof status!=="number"||!Number.isInteger(status))return;if(status!==101&&(status<200||status>599))return;return status}function applySetHeaders(target2,set){for(let[key2,value]of Object.entries(set.headers))target2.set(key2,value)}function finalizeResponse(result,set){let setStatus=usableStatus(set.status),setTouched=setStatus!==void 0||Object.keys(set.headers).length>0;if(result instanceof Response){if(!setTouched)return result;let status2=result.status!==200?result.status:setStatus??200,headers2=new Headers;applySetHeaders(headers2,set);for(let cookie of result.headers.getSetCookie())headers2.append("set-cookie",cookie);if(result.headers.forEach((value,key2)=>{if(key2.toLowerCase()==="set-cookie")return;headers2.set(key2,value)}),BODILESS.has(status2))return new Response(null,{status:status2,headers:headers2});return new Response(result.body,{status:status2,headers:headers2})}if(result instanceof Error){let errorStatus=setStatus??500,errorHeaders=new Headers;if(applySetHeaders(errorHeaders,set),!errorHeaders.has("content-type"))errorHeaders.set("content-type","application/json");if(BODILESS.has(errorStatus))return new Response(null,{status:errorStatus,headers:errorHeaders});return new Response(JSON.stringify(withEnvelopeFlags({isSuccess:!1,message:result.message,status:errorStatus,errors:[{message:result.message}],data:null})),{status:errorStatus,headers:errorHeaders})}let status=setStatus??200,headers=new Headers;if(applySetHeaders(headers,set),result===void 0||result===null)return new Response(null,{status,headers});let isScalar=typeof result==="string"||typeof result==="number"||typeof result==="boolean";if(!headers.has("content-type"))headers.set("content-type",isScalar?"text/plain;charset=utf-8":"application/json");if(BODILESS.has(status))return new Response(null,{status,headers});return new Response(isScalar?String(result):JSON.stringify(mirrorFlags(result)),{status,headers})}var BODILESS;var init_response=__esm(()=>{BODILESS=new Set([204,304])});function beginRouteRecording(){if(recordingDepth===0)recording=[],recordedSocket=null,recordedAdapterSteps=[],recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedBootSteps=[],recordedShutdownSteps=[];recordingDepth+=1}function endRouteRecording(){if(recordingDepth===0)throw Error("endRouteRecording() without a matching beginRouteRecording()");if(recordingDepth-=1,recordingDepth>0)return recording??[];let collected=recording??[];return recording=null,collected}function recordRouteGroups(groups){if(recording){recording.push(...groups);return}console.warn(`[nucleus] recordRouteGroups: ${groups.length} route group(s) were recorded while no recording was open, so they were DISCARDED. A host must pass its groups as \`createNucleusServer({ routes: [...] })\`; collecting them outside \`buildNucleus\` records nothing, and if you rely on it alone those routes will answer 404.`)}function recordSocket(route){if(recording)recordedSocket=route}function getRecordedSocket(){return recordedSocket}function recordAdapterStep(step){if(recording)recordedAdapterSteps.push(step)}function recordSwagger(config){if(recording)recordedSwagger=config}function recordRuntime(runtime){recordedRuntime=runtime}function getMountedRuntime(){return recordedRuntime}function recordResolvedOptions(options){recordedResolvedOptions=options}function getResolvedOptions(){return recordedResolvedOptions}function recordStaticAssets(assetsPath){if(recording)recordedStaticAssets=assetsPath}function getRecordedStaticAssets(){return recordedStaticAssets}function recordBootStep(step){if(recording)recordedBootSteps.push(step)}function recordShutdownStep(step){if(recording)recordedShutdownSteps.push(step)}function getRecordedBootSteps(){return recordedBootSteps}function getRecordedShutdownSteps(){return recordedShutdownSteps}var recording=null,recordingDepth=0,recordedSocket=null,recordedAdapterSteps,recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedResolvedOptions=null,recordedBootSteps,recordedShutdownSteps;var init_routeRecording=__esm(()=>{recordedAdapterSteps=[],recordedBootSteps=[],recordedShutdownSteps=[]});function isRouteCollector(value){return typeof value==="object"&&value!==null&&COLLECTOR in value}function collectRoutes(groups=[]){let collected=[],collector={[COLLECTOR]:!0,groups:collected,use(other){return collected.push(...other.groups),collector}};if(groups.length>0)collected.push(...groups),recordRouteGroups(groups);return collector}var COLLECTOR;var init_routeCollector=__esm(()=>{init_routeRecording();COLLECTOR=Symbol.for("nucleus.routeCollector")});function defineWebSocketRoute(route){return route}function eraseSocketData(route){return route}function headersOf(request){let out={};request.headers.forEach((value,key2)=>{out[key2]=value});for(let header of INTERNAL_HEADERS)delete out[header];return out}function upgradeFor(route,request,server){let url=new URL(request.url);if(url.pathname!==route.path)return null;let data={query:Object.fromEntries(url.searchParams),headers:headersOf(request)};if(server.upgrade(request,{data}))return new Response(null,{status:101});return new Response("NOT_FOUND",{status:404})}function websocketHandlers(route){return{idleTimeout:route.idleTimeout,open:(ws)=>route.open?.(ws),message:(ws,message)=>route.message?.(ws,message),close:(ws,code,reason)=>route.close?.(ws,code,reason)}}var init_websocket=__esm(()=>{init_internalHeaders()});function joinPath(prefix,path){if(!prefix)return path;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path==="/"||path==="")return left||"/";let right=path.startsWith("/")?path:`/${path}`;return`${left}${right}`||"/"}function elysiaSchema(route){let schema={};if(route.body)schema.body=route.body;if(route.query)schema.query=route.query;if(route.params)schema.params=route.params;if(route.detail)schema.detail=route.detail;if(route.type)schema.type=route.type;return schema}function mountWebSocketRoute(app,route){let erased=eraseSocketData(route);recordSocket(erased),app.ws(erased.path,{idleTimeout:erased.idleTimeout,open:erased.open,message:erased.message,close:erased.close})}function useRoutes(app,child){if(isRouteCollector(app)){if(isRouteCollector(child))return app.use(child),app;throw Error("useRoutes: a RouteCollector cannot absorb an Elysia plugin. Record it as an "+"adapter step instead \u2014 only the adapter has an Elysia to mount it on.")}if(isRouteCollector(child))return mountGroups(app,child.groups),app;return app.use(child),app}function mountRoutes(app,groups,options={}){if(isRouteCollector(app))return app.use(collectRoutes(groups)),app;return recordRouteGroups(groups),mountGroups(app,groups,options),app}function mountGroups(app,groups,options={}){for(let group of groups)for(let route of group.routes){let method=METHODS[route.method];if(!method)throw Error(`${route.method} ${route.path}: no Elysia method for it. A WebSocket does not `+"belong in an HTTP group \u2014 declare it with defineWebSocketRoute and mount it with "+"mountWebSocketRoute, as routes/pubsub does.");let path=joinPath(group.prefix,route.path),guards=[...group.guards??[],...route.guards??[]];app[method](path,async(context)=>{let set=createResponseSet(),request=context.request,guardContext={request,set,body:context.body,params:context.params??{},query:context.query??{}};if(options.onRequest){let early=await options.onRequest(guardContext);if(early!==void 0)return finalizeResponse(early,set)}for(let guard of guards){let early=await guard(guardContext);if(early!==void 0)return finalizeResponse(early,set)}let result=await route.handler({request,params:context.params??{},query:context.query??{},body:context.body,set});return finalizeResponse(result,set)},elysiaSchema(route))}return app}var METHODS;var init_routeMount=__esm(()=>{init_response();init_routeCollector();init_routeRecording();init_websocket();METHODS={GET:"get",POST:"post",PUT:"put",PATCH:"patch",DELETE:"delete",HEAD:"head",OPTIONS:"options"}});function toCamel3(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function readColumn(row,column){if(column in row)return row[column];let camel=toCamel3(column);return camel in row?row[camel]:void 0}function isBlank(value){if(value===null||value===void 0)return!0;if(typeof value==="string")return value.trim().length===0;if(Array.isArray(value))return value.length===0;return!1}function coerce(value){if(isBlank(value))return;if(Array.isArray(value))return coerce(value[0]);if(typeof value==="string")return value.trim();if(typeof value==="number"||typeof value==="boolean")return String(value);return}function readClaim(profile,claim){if(claim in profile)return profile[claim];if(!claim.includes("."))return;let cursor=profile;for(let segment of claim.split(".")){if(cursor===null||typeof cursor!=="object")return;cursor=cursor[segment]}return cursor}function splitTarget(target2){let i=target2.indexOf(".");if(i===-1)return{table:"",column:""};return{table:target2.slice(0,i),column:target2.slice(i+1)}}function resolveProfileSyncUpdates(input){let users={},profiles={},errors2=[];for(let mapping of input.mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let target2=table==="users"?users:profiles;if(column in target2)continue;let incoming=coerce(readClaim(input.rawProfile,mapping.claim));if(incoming===void 0)continue;let currentRow=table==="users"?input.currentUser:input.currentProfile,current=readColumn(currentRow,column);if(mapping.overwrite===!1&&!isBlank(current))continue;if(current===incoming)continue;target2[column]=incoming}return{users,profiles,errors:errors2}}function validateProfileSyncTargets(mappings,columnsByTable){let errors2=[];for(let mapping of mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let columns=columnsByTable[table]??[],known=new Set(columns.flatMap((c)=>[c,toCamel3(c)]));if(!known.has(column)&&!known.has(toCamel3(column)))errors2.push(`profileSync maps "${mapping.claim}" to "${mapping.target}", but "${table}" has no column "${column}". Add it via a config entity with "extends": true.`)}return errors2}function isCommonPassword(pwd){let bare=foldAccents(pwd.trim());if(COMMON_PASSWORDS.has(bare))return!0;let stripped=normalizeForListCheck(pwd);return stripped.length>0&&COMMON_PASSWORDS.has(stripped)}function containsUserInfo(pwd,identity){if(!identity)return!1;let lowered=foldAccents(pwd.trim());if(!lowered)return!1;let id=foldAccents(identity.trim());if(!id)return!1;let parts=new Set([id]),at=id.indexOf("@");if(at>0){parts.add(id.slice(0,at));let domain=id.slice(at+1).split(".")[0];if(domain)parts.add(domain)}if(lowered.includes(id))return!0;for(let part of parts){if(part===id)continue;if(part.length>=4&&lowered.includes(part))return!0}return!1}function validateAgainstPolicy(pwd,policy,identity){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if((policy?.requireUppercase??!0)&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if((policy?.requireLowercase??!0)&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if((policy?.requireNumber??!0)&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if(policy?.requireSpecialChar??!1){let allowed=policy?.specialChars?.trim();if(!(allowed?[...pwd].some((ch)=>allowed.includes(ch)):/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd)))errors2.push(allowed?`Password must contain one of these characters: ${allowed}`:"Password must contain a special character")}if(policy?.preventCommonPasswords&&isCommonPassword(pwd))errors2.push("Password is too common");if(policy?.preventUserInfoInPassword&&containsUserInfo(pwd,identity))errors2.push("Password must not contain your email or username");return{valid:errors2.length===0,errors:errors2}}function identityRuleError(pwd,policy,identity){if(!policy?.preventUserInfoInPassword)return null;return containsUserInfo(pwd,identity)?"Password must not contain your email or username":null}var COMMON_PASSWORDS,foldAccents=(value)=>value.replace(/[\u0130I\u0131]/g,"i").replace(/[\u015E\u015F]/g,"s").replace(/[\u011E\u011F]/g,"g").replace(/[\u00C7\u00E7]/g,"c").replace(/[\u00D6\u00F6]/g,"o").replace(/[\u00DC\u00FC]/g,"u").toLowerCase(),normalizeForListCheck=(pwd)=>foldAccents(pwd.trim()).replace(/[0-9]+$/,"").replace(/[!@#$%^&*._-]+$/,"");var init_passwordPolicy=__esm(()=>{COMMON_PASSWORDS=new Set(["password","passwort","parola","sifre","qwerty","qwertyui","azerty","asdfgh","zxcvbn","qazwsx","qweasd","letmein","welcome","admin","administrator","root","toor","guest","test","demo","login","pass","secret","master","dragon","monkey","sunshine","princess","football","baseball","superman","batman","trustno","iloveyou","starwars","whatever","freedom","shadow","michael","jennifer","jordan","harley","ranger","hunter","buster","thomas","robert","soccer","hockey","killer","george","charlie","andrew","tigger","joshua","pepper","daniel","ginger","summer","ashley","bailey","banana","chelsea","diamond","yellow","orange","purple","silver","cookie","maggie","nicole","hannah","jessica","matthew","access","flower","hello","hellothere","changeme","default","temporary","temppass","newpass","passpass","system","manager","service","oracle","postgres","mysql","redis","server","database","internet","computer","samsung","google","facebook","twitter","linkedin","company","business","office","work","school","student","teacher","abcdef","abcabc","aaaaaa","zzzzzz","asdfasdf","qwerqwer","iloveu","princess1","letmein1","trustno1","passw0rd","p@ssword","p@ssw0rd","qwerty1","admin1","welcome1","password1","abc","abcd","abcde","ankara","istanbul","izmir","galatasaray","fenerbahce","besiktas","trabzonspor","turkiye","merhaba","deneme","sifrem","gizli","kullanici","yonetici"])});var resolveAuthTablesForRequest=(request,authConfig)=>{let defaults={usersTable:authConfig.usersTable,sessionsTable:authConfig.sessionsTable??null,userRolesTable:authConfig.userRolesTable??void 0,rolesTable:authConfig.rolesTable??void 0,roleClaimsTable:authConfig.roleClaimsTable??void 0,claimsTable:authConfig.claimsTable??void 0,oauthAccountsTable:authConfig.oauthAccountsTable??void 0,apiKeysTable:authConfig.apiKeysTable??void 0,schemaTables:authConfig.schemaTables||{}},registry=authConfig.getTenantRegistry?authConfig.getTenantRegistry():authConfig.tenantRegistry;if(!registry)return defaults;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaults;let ctx=registry.getSchemaContext(schemaName);if(!ctx)return defaults;let tables=ctx.schemaTables;return{usersTable:tables.users??defaults.usersTable,sessionsTable:tables.userSessions??tables.user_sessions??tables.sessions??defaults.sessionsTable,userRolesTable:tables.userRoles??defaults.userRolesTable,rolesTable:tables.roles??defaults.rolesTable,roleClaimsTable:tables.roleClaims??defaults.roleClaimsTable,claimsTable:tables.claims??defaults.claimsTable,oauthAccountsTable:tables.oauthAccounts??defaults.oauthAccountsTable,apiKeysTable:tables.apiKeys??defaults.apiKeysTable,schemaTables:tables}};import{eq as eq20}from"drizzle-orm";function accountStateRefusal(caller){if(caller.isActive===!1)return"Account is not active";let lockedUntil=caller.lockedUntil?new Date(caller.lockedUntil):null;return(lockedUntil!==null&&lockedUntil<=new Date?!1:lockedUntil!==null||caller.isLocked===!0)?"Account is locked":null}function createRequireGodmin(config){let{db}=config;return async function(request){let{usersTable}=resolveAuthTablesForRequest(request,config);if(!db||!usersTable)return{ok:!1,status:500,message:"Database not configured"};let callerId=request.headers.get("x-user-id");if(!callerId)return{ok:!1,status:401,message:"Unauthorized"};let caller=(await db.select().from(usersTable).where(eq20(usersTable.id,callerId)).limit(1))[0];if(!caller||!caller.isGod)return{ok:!1,status:403,message:"Forbidden: godmin privileges required"};let refusal=accountStateRefusal(caller);if(refusal)return{ok:!1,status:403,message:refusal};return{ok:!0,callerId,caller}}}var init_requireGodmin=()=>{};import{and as and15,eq as eq23}from"drizzle-orm";function resolveDefaultRoleNames(authentication){let names2=new Set,single=authentication?.defaultRole?.trim();if(single)names2.add(single);for(let name2 of authentication?.defaultRoles??[]){let trimmed=String(name2??"").trim();if(trimmed)names2.add(trimmed)}return[...names2]}async function assignDefaultRoles(params){let{roleNames,...rest}=params;for(let roleName of roleNames)await assignDefaultRole({...rest,roleName})}async function assignDefaultRole(params){let{db,userId,roleName,rolesTable,userRolesTable,logger:logger2}=params;if(!rolesTable||!userRolesTable){logger2.warn("[AUTH] assignDefaultRole called without rolesTable or userRolesTable \u2014 skipping",{userId,roleName});return}try{let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await db.select().from(rolesTable).where(eq23(rolesCols.name,roleName)).limit(1))[0];if(!role){logger2.warn(`[AUTH] Default role "${roleName}" not found in roles table \u2014 skipping assignment`,{userId});return}let roleId=role.id;if((await db.select().from(userRolesTable).where(and15(eq23(userRolesCols.userId,userId),eq23(userRolesCols.roleId,roleId))).limit(1)).length>0){logger2.debug("[AUTH] User already has default role \u2014 skipping",{userId,roleName});return}await db.insert(userRolesTable).values({userId,roleId}),logger2.info("[AUTH] Default role assigned to new user",{userId,roleName})}catch(err){logger2.warn("[AUTH] Failed to assign default role \u2014 continuing",{userId,roleName,error:err instanceof Error?err.message:String(err)})}}var init_assignDefaultRole=()=>{};import crypto6 from"crypto";var{password:password2}=globalThis.Bun;async function hashPassword(plainPassword){return await password2.hash(plainPassword,{algorithm:"bcrypt",cost:10})}function generateVerificationToken(){return crypto6.randomBytes(32).toString("hex")}function hashVerificationToken(token){return crypto6.createHash("sha256").update(token).digest("hex")}function parseTimeToMs(time2){let match=time2.match(/^(\d+)(s|m|h|d)$/);if(!match?.[1]||!match[2])return 86400000;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value*1000;case"m":return value*60*1000;case"h":return value*60*60*1000;case"d":return value*24*60*60*1000;default:return 86400000}}function validatePasswordStrength(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var init_utils6=__esm(()=>{init_passwordPolicy()});function pickByName(bag,name2){if(!name2)return;let camel=name2.replace(/_([a-z0-9])/g,(_,c)=>c.toUpperCase()),snake=name2.replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase();for(let key2 of[name2,camel,snake]){let found=bag[key2];if(found!==void 0)return found}return}import{inArray as inArray8}from"drizzle-orm";function accountLinkFor(links,table){if(!links?.length||!table)return null;let byTable={};for(let link of links)if(link?.table)byTable[link.table]=link;return pickByName(byTable,table)??null}function accountIdsIn(rows,userColumn){if(!userColumn)return[];let ids=new Set;for(let row of rows){let value=pickByName(row,userColumn),id=String(value??"").trim();if(id)ids.add(id)}return[...ids]}async function closeAccounts(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))];if(ids.length===0||!deps.usersTable)return{closed:0,signedOut:!0,closedIds:[]};let idColumn=pickByName(deps.usersTable,"id"),activeColumn=pickByName(deps.usersTable,"is_active");if(!idColumn||!activeColumn)return{closed:0,signedOut:!1,closedIds:[]};try{await deps.db.update(deps.usersTable).set({isActive:!1}).where(inArray8(idColumn,ids))}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:0,signedOut:!1,closedIds:[]}}let sessionUser=deps.sessionsTable?pickByName(deps.sessionsTable,"user_id"):void 0;if(!deps.sessionsTable||!sessionUser)return{closed:ids.length,signedOut:!1,closedIds:ids};try{return await deps.db.delete(deps.sessionsTable).where(inArray8(sessionUser,ids)),{closed:ids.length,signedOut:!0,closedIds:ids}}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:ids.length,signedOut:!1,closedIds:ids}}}var init_AccountLink=()=>{};import{inArray as inArray9}from"drizzle-orm";async function revokeUserSessions(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))],sessions=deps.sessionsTable;if(!deps.db||!sessions||ids.length===0)return 0;let sessionUser=pickByName(sessions,"user_id");if(!sessionUser)return 0;try{return(await deps.db.delete(sessions).where(inArray9(sessionUser,ids)))?.rowCount??ids.length}catch(error){return deps.onError?.(error),0}}var init_revokeUserSessions=__esm(()=>{init_AccountLink()});var exports_value={};__export(exports_value,{IsUndefined:()=>IsUndefined,IsUint8Array:()=>IsUint8Array,IsSymbol:()=>IsSymbol,IsString:()=>IsString,IsRegExp:()=>IsRegExp,IsObject:()=>IsObject,IsNumber:()=>IsNumber,IsNull:()=>IsNull,IsIterator:()=>IsIterator,IsFunction:()=>IsFunction,IsDate:()=>IsDate,IsBoolean:()=>IsBoolean,IsBigInt:()=>IsBigInt,IsAsyncIterator:()=>IsAsyncIterator,IsArray:()=>IsArray,HasPropertyKey:()=>HasPropertyKey});function HasPropertyKey(value,key2){return key2 in value}function IsAsyncIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.asyncIterator in value}function IsArray(value){return Array.isArray(value)}function IsBigInt(value){return typeof value==="bigint"}function IsBoolean(value){return typeof value==="boolean"}function IsDate(value){return value instanceof globalThis.Date}function IsFunction(value){return typeof value==="function"}function IsIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.iterator in value}function IsNull(value){return value===null}function IsNumber(value){return typeof value==="number"}function IsObject(value){return typeof value==="object"&&value!==null}function IsRegExp(value){return value instanceof globalThis.RegExp}function IsString(value){return typeof value==="string"}function IsSymbol(value){return typeof value==="symbol"}function IsUint8Array(value){return value instanceof globalThis.Uint8Array}function IsUndefined(value){return value===void 0}function ArrayType(value){return value.map((value2)=>Visit(value2))}function DateType(value){return new Date(value.getTime())}function Uint8ArrayType(value){return new Uint8Array(value)}function RegExpType(value){return new RegExp(value.source,value.flags)}function ObjectType(value){let result={};for(let key2 of Object.getOwnPropertyNames(value))result[key2]=Visit(value[key2]);for(let key2 of Object.getOwnPropertySymbols(value))result[key2]=Visit(value[key2]);return result}function Visit(value){return IsArray(value)?ArrayType(value):IsDate(value)?DateType(value):IsUint8Array(value)?Uint8ArrayType(value):IsRegExp(value)?RegExpType(value):IsObject(value)?ObjectType(value):value}function Clone(value){return Visit(value)}var init_value=()=>{};function CloneType(schema,options){return options===void 0?Clone(schema):Clone({...options,...schema})}var init_type=__esm(()=>{init_value()});var init_clone=__esm(()=>{init_type();init_value()});function IsAsyncIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.asyncIterator in value2}function IsIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.iterator in value2}function IsStandardObject(value2){return IsObject2(value2)&&(globalThis.Object.getPrototypeOf(value2)===Object.prototype||globalThis.Object.getPrototypeOf(value2)===null)}function IsPromise(value2){return value2 instanceof globalThis.Promise}function IsDate2(value2){return value2 instanceof Date&&globalThis.Number.isFinite(value2.getTime())}function IsMap(value2){return value2 instanceof globalThis.Map}function IsSet(value2){return value2 instanceof globalThis.Set}function IsTypedArray(value2){return globalThis.ArrayBuffer.isView(value2)}function IsUint8Array2(value2){return value2 instanceof globalThis.Uint8Array}function HasPropertyKey2(value2,key2){return key2 in value2}function IsObject2(value2){return value2!==null&&typeof value2==="object"}function IsArray2(value2){return globalThis.Array.isArray(value2)&&!globalThis.ArrayBuffer.isView(value2)}function IsUndefined2(value2){return value2===void 0}function IsNull2(value2){return value2===null}function IsBoolean2(value2){return typeof value2==="boolean"}function IsNumber2(value2){return typeof value2==="number"}function IsInteger(value2){return globalThis.Number.isInteger(value2)}function IsBigInt2(value2){return typeof value2==="bigint"}function IsString2(value2){return typeof value2==="string"}function IsFunction2(value2){return typeof value2==="function"}function IsSymbol2(value2){return typeof value2==="symbol"}function IsValueType(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNull2(value2)||IsNumber2(value2)||IsString2(value2)||IsSymbol2(value2)||IsUndefined2(value2)}var init_guard=()=>{};var TypeSystemPolicy;var init_policy=__esm(()=>{init_guard();(function(TypeSystemPolicy2){TypeSystemPolicy2.InstanceMode="default",TypeSystemPolicy2.ExactOptionalPropertyTypes=!1,TypeSystemPolicy2.AllowArrayObject=!1,TypeSystemPolicy2.AllowNaN=!1,TypeSystemPolicy2.AllowNullVoid=!1;function IsExactOptionalProperty(value2,key2){return TypeSystemPolicy2.ExactOptionalPropertyTypes?key2 in value2:value2[key2]!==void 0}TypeSystemPolicy2.IsExactOptionalProperty=IsExactOptionalProperty;function IsObjectLike(value2){let isObject=IsObject2(value2);return TypeSystemPolicy2.AllowArrayObject?isObject:isObject&&!IsArray2(value2)}TypeSystemPolicy2.IsObjectLike=IsObjectLike;function IsRecordLike(value2){return IsObjectLike(value2)&&!(value2 instanceof Date)&&!(value2 instanceof Uint8Array)}TypeSystemPolicy2.IsRecordLike=IsRecordLike;function IsNumberLike(value2){return TypeSystemPolicy2.AllowNaN?IsNumber2(value2):Number.isFinite(value2)}TypeSystemPolicy2.IsNumberLike=IsNumberLike;function IsVoidLike(value2){let isUndefined=IsUndefined2(value2);return TypeSystemPolicy2.AllowNullVoid?isUndefined||value2===null:isUndefined}TypeSystemPolicy2.IsVoidLike=IsVoidLike})(TypeSystemPolicy||(TypeSystemPolicy={}))});function ImmutableArray(value2){return globalThis.Object.freeze(value2).map((value3)=>Immutable(value3))}function ImmutableDate(value2){return value2}function ImmutableUint8Array(value2){return value2}function ImmutableRegExp(value2){return value2}function ImmutableObject(value2){let result={};for(let key2 of Object.getOwnPropertyNames(value2))result[key2]=Immutable(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))result[key2]=Immutable(value2[key2]);return globalThis.Object.freeze(result)}function Immutable(value2){return IsArray(value2)?ImmutableArray(value2):IsDate(value2)?ImmutableDate(value2):IsUint8Array(value2)?ImmutableUint8Array(value2):IsRegExp(value2)?ImmutableRegExp(value2):IsObject(value2)?ImmutableObject(value2):value2}var init_immutable=()=>{};function CreateType(schema,options){let result=options!==void 0?{...options,...schema}:schema;switch(TypeSystemPolicy.InstanceMode){case"freeze":return Immutable(result);case"clone":return Clone(result);default:return result}}var init_type2=__esm(()=>{init_policy();init_immutable();init_value()});var init_create=__esm(()=>{init_type2()});var TypeBoxError;var init_error=__esm(()=>{TypeBoxError=class TypeBoxError extends Error{constructor(message){super(message)}}});var init_error2=__esm(()=>{init_error()});var TransformKind,ReadonlyKind,OptionalKind,Hint,Kind;var init_symbols=__esm(()=>{TransformKind=Symbol.for("TypeBox.Transform"),ReadonlyKind=Symbol.for("TypeBox.Readonly"),OptionalKind=Symbol.for("TypeBox.Optional"),Hint=Symbol.for("TypeBox.Hint"),Kind=Symbol.for("TypeBox.Kind")});var init_symbols2=__esm(()=>{init_symbols()});function IsReadonly(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny(value2){return IsKindOf(value2,"Any")}function IsArgument(value2){return IsKindOf(value2,"Argument")}function IsArray3(value2){return IsKindOf(value2,"Array")}function IsAsyncIterator3(value2){return IsKindOf(value2,"AsyncIterator")}function IsBigInt3(value2){return IsKindOf(value2,"BigInt")}function IsBoolean3(value2){return IsKindOf(value2,"Boolean")}function IsComputed(value2){return IsKindOf(value2,"Computed")}function IsConstructor(value2){return IsKindOf(value2,"Constructor")}function IsDate3(value2){return IsKindOf(value2,"Date")}function IsFunction3(value2){return IsKindOf(value2,"Function")}function IsInteger2(value2){return IsKindOf(value2,"Integer")}function IsIntersect(value2){return IsKindOf(value2,"Intersect")}function IsIterator3(value2){return IsKindOf(value2,"Iterator")}function IsKindOf(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralValue(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsLiteral(value2){return IsKindOf(value2,"Literal")}function IsMappedKey(value2){return IsKindOf(value2,"MappedKey")}function IsMappedResult(value2){return IsKindOf(value2,"MappedResult")}function IsNever(value2){return IsKindOf(value2,"Never")}function IsNot(value2){return IsKindOf(value2,"Not")}function IsNull3(value2){return IsKindOf(value2,"Null")}function IsNumber3(value2){return IsKindOf(value2,"Number")}function IsObject3(value2){return IsKindOf(value2,"Object")}function IsPromise2(value2){return IsKindOf(value2,"Promise")}function IsRecord(value2){return IsKindOf(value2,"Record")}function IsRef(value2){return IsKindOf(value2,"Ref")}function IsRegExp2(value2){return IsKindOf(value2,"RegExp")}function IsString3(value2){return IsKindOf(value2,"String")}function IsSymbol3(value2){return IsKindOf(value2,"Symbol")}function IsTemplateLiteral(value2){return IsKindOf(value2,"TemplateLiteral")}function IsThis(value2){return IsKindOf(value2,"This")}function IsTransform(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple(value2){return IsKindOf(value2,"Tuple")}function IsUndefined3(value2){return IsKindOf(value2,"Undefined")}function IsUnion(value2){return IsKindOf(value2,"Union")}function IsUint8Array3(value2){return IsKindOf(value2,"Uint8Array")}function IsUnknown(value2){return IsKindOf(value2,"Unknown")}function IsUnsafe(value2){return IsKindOf(value2,"Unsafe")}function IsVoid(value2){return IsKindOf(value2,"Void")}function IsKind(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])}function IsSchema(value2){return IsAny(value2)||IsArgument(value2)||IsArray3(value2)||IsBoolean3(value2)||IsBigInt3(value2)||IsAsyncIterator3(value2)||IsComputed(value2)||IsConstructor(value2)||IsDate3(value2)||IsFunction3(value2)||IsInteger2(value2)||IsIntersect(value2)||IsIterator3(value2)||IsLiteral(value2)||IsMappedKey(value2)||IsMappedResult(value2)||IsNever(value2)||IsNot(value2)||IsNull3(value2)||IsNumber3(value2)||IsObject3(value2)||IsPromise2(value2)||IsRecord(value2)||IsRef(value2)||IsRegExp2(value2)||IsString3(value2)||IsSymbol3(value2)||IsTemplateLiteral(value2)||IsThis(value2)||IsTuple(value2)||IsUndefined3(value2)||IsUnion(value2)||IsUint8Array3(value2)||IsUnknown(value2)||IsUnsafe(value2)||IsVoid(value2)||IsKind(value2)}var init_kind=__esm(()=>{init_symbols2()});var exports_type={};__export(exports_type,{TypeGuardUnknownTypeError:()=>TypeGuardUnknownTypeError,IsVoid:()=>IsVoid2,IsUnsafe:()=>IsUnsafe2,IsUnknown:()=>IsUnknown2,IsUnionLiteral:()=>IsUnionLiteral,IsUnion:()=>IsUnion2,IsUndefined:()=>IsUndefined4,IsUint8Array:()=>IsUint8Array4,IsTuple:()=>IsTuple2,IsTransform:()=>IsTransform2,IsThis:()=>IsThis2,IsTemplateLiteral:()=>IsTemplateLiteral2,IsSymbol:()=>IsSymbol4,IsString:()=>IsString4,IsSchema:()=>IsSchema2,IsRegExp:()=>IsRegExp3,IsRef:()=>IsRef2,IsRecursive:()=>IsRecursive,IsRecord:()=>IsRecord2,IsReadonly:()=>IsReadonly2,IsProperties:()=>IsProperties,IsPromise:()=>IsPromise3,IsOptional:()=>IsOptional2,IsObject:()=>IsObject4,IsNumber:()=>IsNumber4,IsNull:()=>IsNull4,IsNot:()=>IsNot2,IsNever:()=>IsNever2,IsMappedResult:()=>IsMappedResult2,IsMappedKey:()=>IsMappedKey2,IsLiteralValue:()=>IsLiteralValue2,IsLiteralString:()=>IsLiteralString,IsLiteralNumber:()=>IsLiteralNumber,IsLiteralBoolean:()=>IsLiteralBoolean,IsLiteral:()=>IsLiteral2,IsKindOf:()=>IsKindOf2,IsKind:()=>IsKind2,IsIterator:()=>IsIterator4,IsIntersect:()=>IsIntersect2,IsInteger:()=>IsInteger3,IsImport:()=>IsImport,IsFunction:()=>IsFunction4,IsDate:()=>IsDate4,IsConstructor:()=>IsConstructor2,IsComputed:()=>IsComputed2,IsBoolean:()=>IsBoolean4,IsBigInt:()=>IsBigInt4,IsAsyncIterator:()=>IsAsyncIterator4,IsArray:()=>IsArray4,IsArgument:()=>IsArgument2,IsAny:()=>IsAny2});function IsPattern(value2){try{return new RegExp(value2),!0}catch{return!1}}function IsControlCharacterFree(value2){if(!IsString(value2))return!1;for(let i=0;i<value2.length;i++){let code=value2.charCodeAt(i);if(code>=7&&code<=13||code===27||code===127)return!1}return!0}function IsAdditionalProperties(value2){return IsOptionalBoolean(value2)||IsSchema2(value2)}function IsOptionalBigInt(value2){return IsUndefined(value2)||IsBigInt(value2)}function IsOptionalNumber(value2){return IsUndefined(value2)||IsNumber(value2)}function IsOptionalBoolean(value2){return IsUndefined(value2)||IsBoolean(value2)}function IsOptionalString(value2){return IsUndefined(value2)||IsString(value2)}function IsOptionalPattern(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)&&IsPattern(value2)}function IsOptionalFormat(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)}function IsOptionalSchema(value2){return IsUndefined(value2)||IsSchema2(value2)}function IsReadonly2(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional2(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny2(value2){return IsKindOf2(value2,"Any")&&IsOptionalString(value2.$id)}function IsArgument2(value2){return IsKindOf2(value2,"Argument")&&IsNumber(value2.index)}function IsArray4(value2){return IsKindOf2(value2,"Array")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)&&IsOptionalNumber(value2.minItems)&&IsOptionalNumber(value2.maxItems)&&IsOptionalBoolean(value2.uniqueItems)&&IsOptionalSchema(value2.contains)&&IsOptionalNumber(value2.minContains)&&IsOptionalNumber(value2.maxContains)}function IsAsyncIterator4(value2){return IsKindOf2(value2,"AsyncIterator")&&value2.type==="AsyncIterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsBigInt4(value2){return IsKindOf2(value2,"BigInt")&&value2.type==="bigint"&&IsOptionalString(value2.$id)&&IsOptionalBigInt(value2.exclusiveMaximum)&&IsOptionalBigInt(value2.exclusiveMinimum)&&IsOptionalBigInt(value2.maximum)&&IsOptionalBigInt(value2.minimum)&&IsOptionalBigInt(value2.multipleOf)}function IsBoolean4(value2){return IsKindOf2(value2,"Boolean")&&value2.type==="boolean"&&IsOptionalString(value2.$id)}function IsComputed2(value2){return IsKindOf2(value2,"Computed")&&IsString(value2.target)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))}function IsConstructor2(value2){return IsKindOf2(value2,"Constructor")&&value2.type==="Constructor"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsDate4(value2){return IsKindOf2(value2,"Date")&&value2.type==="Date"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximumTimestamp)&&IsOptionalNumber(value2.exclusiveMinimumTimestamp)&&IsOptionalNumber(value2.maximumTimestamp)&&IsOptionalNumber(value2.minimumTimestamp)&&IsOptionalNumber(value2.multipleOfTimestamp)}function IsFunction4(value2){return IsKindOf2(value2,"Function")&&value2.type==="Function"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsImport(value2){return IsKindOf2(value2,"Import")&&HasPropertyKey(value2,"$defs")&&IsObject(value2.$defs)&&IsProperties(value2.$defs)&&HasPropertyKey(value2,"$ref")&&IsString(value2.$ref)&&value2.$ref in value2.$defs}function IsInteger3(value2){return IsKindOf2(value2,"Integer")&&value2.type==="integer"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsProperties(value2){return IsObject(value2)&&Object.entries(value2).every(([key2,schema])=>IsControlCharacterFree(key2)&&IsSchema2(schema))}function IsIntersect2(value2){return IsKindOf2(value2,"Intersect")&&(IsString(value2.type)&&value2.type!=="object"?!1:!0)&&IsArray(value2.allOf)&&value2.allOf.every((schema)=>IsSchema2(schema)&&!IsTransform2(schema))&&IsOptionalString(value2.type)&&(IsOptionalBoolean(value2.unevaluatedProperties)||IsOptionalSchema(value2.unevaluatedProperties))&&IsOptionalString(value2.$id)}function IsIterator4(value2){return IsKindOf2(value2,"Iterator")&&value2.type==="Iterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsKindOf2(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralString(value2){return IsLiteral2(value2)&&IsString(value2.const)}function IsLiteralNumber(value2){return IsLiteral2(value2)&&IsNumber(value2.const)}function IsLiteralBoolean(value2){return IsLiteral2(value2)&&IsBoolean(value2.const)}function IsLiteral2(value2){return IsKindOf2(value2,"Literal")&&IsOptionalString(value2.$id)&&IsLiteralValue2(value2.const)}function IsLiteralValue2(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsMappedKey2(value2){return IsKindOf2(value2,"MappedKey")&&IsArray(value2.keys)&&value2.keys.every((key2)=>IsNumber(key2)||IsString(key2))}function IsMappedResult2(value2){return IsKindOf2(value2,"MappedResult")&&IsProperties(value2.properties)}function IsNever2(value2){return IsKindOf2(value2,"Never")&&IsObject(value2.not)&&Object.getOwnPropertyNames(value2.not).length===0}function IsNot2(value2){return IsKindOf2(value2,"Not")&&IsSchema2(value2.not)}function IsNull4(value2){return IsKindOf2(value2,"Null")&&value2.type==="null"&&IsOptionalString(value2.$id)}function IsNumber4(value2){return IsKindOf2(value2,"Number")&&value2.type==="number"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsObject4(value2){return IsKindOf2(value2,"Object")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsProperties(value2.properties)&&IsAdditionalProperties(value2.additionalProperties)&&IsOptionalNumber(value2.minProperties)&&IsOptionalNumber(value2.maxProperties)}function IsPromise3(value2){return IsKindOf2(value2,"Promise")&&value2.type==="Promise"&&IsOptionalString(value2.$id)&&IsSchema2(value2.item)}function IsRecord2(value2){return IsKindOf2(value2,"Record")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsAdditionalProperties(value2.additionalProperties)&&IsObject(value2.patternProperties)&&((schema)=>{let keys=Object.getOwnPropertyNames(schema.patternProperties);return keys.length===1&&IsPattern(keys[0])&&IsObject(schema.patternProperties)&&IsSchema2(schema.patternProperties[keys[0]])})(value2)}function IsRecursive(value2){return IsObject(value2)&&Hint in value2&&value2[Hint]==="Recursive"}function IsRef2(value2){return IsKindOf2(value2,"Ref")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsRegExp3(value2){return IsKindOf2(value2,"RegExp")&&IsOptionalString(value2.$id)&&IsString(value2.source)&&IsString(value2.flags)&&IsOptionalNumber(value2.maxLength)&&IsOptionalNumber(value2.minLength)}function IsString4(value2){return IsKindOf2(value2,"String")&&value2.type==="string"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minLength)&&IsOptionalNumber(value2.maxLength)&&IsOptionalPattern(value2.pattern)&&IsOptionalFormat(value2.format)}function IsSymbol4(value2){return IsKindOf2(value2,"Symbol")&&value2.type==="symbol"&&IsOptionalString(value2.$id)}function IsTemplateLiteral2(value2){return IsKindOf2(value2,"TemplateLiteral")&&value2.type==="string"&&IsString(value2.pattern)&&value2.pattern[0]==="^"&&value2.pattern[value2.pattern.length-1]==="$"}function IsThis2(value2){return IsKindOf2(value2,"This")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsTransform2(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple2(value2){return IsKindOf2(value2,"Tuple")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsNumber(value2.minItems)&&IsNumber(value2.maxItems)&&value2.minItems===value2.maxItems&&(IsUndefined(value2.items)&&IsUndefined(value2.additionalItems)&&value2.minItems===0||IsArray(value2.items)&&value2.items.every((schema)=>IsSchema2(schema)))}function IsUndefined4(value2){return IsKindOf2(value2,"Undefined")&&value2.type==="undefined"&&IsOptionalString(value2.$id)}function IsUnionLiteral(value2){return IsUnion2(value2)&&value2.anyOf.every((schema)=>IsLiteralString(schema)||IsLiteralNumber(schema))}function IsUnion2(value2){return IsKindOf2(value2,"Union")&&IsOptionalString(value2.$id)&&IsObject(value2)&&IsArray(value2.anyOf)&&value2.anyOf.every((schema)=>IsSchema2(schema))}function IsUint8Array4(value2){return IsKindOf2(value2,"Uint8Array")&&value2.type==="Uint8Array"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minByteLength)&&IsOptionalNumber(value2.maxByteLength)}function IsUnknown2(value2){return IsKindOf2(value2,"Unknown")&&IsOptionalString(value2.$id)}function IsUnsafe2(value2){return IsKindOf2(value2,"Unsafe")}function IsVoid2(value2){return IsKindOf2(value2,"Void")&&value2.type==="void"&&IsOptionalString(value2.$id)}function IsKind2(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])&&!KnownTypes.includes(value2[Kind])}function IsSchema2(value2){return IsObject(value2)&&(IsAny2(value2)||IsArgument2(value2)||IsArray4(value2)||IsBoolean4(value2)||IsBigInt4(value2)||IsAsyncIterator4(value2)||IsComputed2(value2)||IsConstructor2(value2)||IsDate4(value2)||IsFunction4(value2)||IsInteger3(value2)||IsIntersect2(value2)||IsIterator4(value2)||IsLiteral2(value2)||IsMappedKey2(value2)||IsMappedResult2(value2)||IsNever2(value2)||IsNot2(value2)||IsNull4(value2)||IsNumber4(value2)||IsObject4(value2)||IsPromise3(value2)||IsRecord2(value2)||IsRef2(value2)||IsRegExp3(value2)||IsString4(value2)||IsSymbol4(value2)||IsTemplateLiteral2(value2)||IsThis2(value2)||IsTuple2(value2)||IsUndefined4(value2)||IsUnion2(value2)||IsUint8Array4(value2)||IsUnknown2(value2)||IsUnsafe2(value2)||IsVoid2(value2)||IsKind2(value2))}var TypeGuardUnknownTypeError,KnownTypes;var init_type3=__esm(()=>{init_symbols2();init_error2();TypeGuardUnknownTypeError=class TypeGuardUnknownTypeError extends TypeBoxError{};KnownTypes=["Argument","Any","Array","AsyncIterator","BigInt","Boolean","Computed","Constructor","Date","Enum","Function","Integer","Intersect","Iterator","Literal","MappedKey","MappedResult","Not","Null","Number","Object","Promise","Record","Ref","RegExp","String","Symbol","TemplateLiteral","This","Tuple","Undefined","Union","Uint8Array","Unknown","Void"]});var init_guard2=__esm(()=>{init_kind();init_type3()});var init_helpers2=()=>{};var PatternBoolean="(true|false)",PatternNumber="(0|[1-9][0-9]*)",PatternString="(.*)",PatternNumberExact="^(0|[1-9][0-9]*)$",PatternStringExact="^(.*)$",PatternNeverExact="^(?!.*)$";var init_patterns=()=>{};var exports_format={};__export(exports_format,{Set:()=>Set3,Has:()=>Has,Get:()=>Get,Entries:()=>Entries,Delete:()=>Delete3,Clear:()=>Clear});function Entries(){return new Map(map)}function Clear(){return map.clear()}function Delete3(format2){return map.delete(format2)}function Has(format2){return map.has(format2)}function Set3(format2,func){map.set(format2,func)}function Get(format2){return map.get(format2)}var map;var init_format=__esm(()=>{map=new Map});var exports_type2={};__export(exports_type2,{Set:()=>Set4,Has:()=>Has2,Get:()=>Get2,Entries:()=>Entries2,Delete:()=>Delete4,Clear:()=>Clear2});function Entries2(){return new Map(map2)}function Clear2(){return map2.clear()}function Delete4(kind){return map2.delete(kind)}function Has2(kind){return map2.has(kind)}function Set4(kind,func){map2.set(kind,func)}function Get2(kind){return map2.get(kind)}var map2;var init_type4=__esm(()=>{map2=new Map});var init_registry4=__esm(()=>{init_format();init_type4()});function SetIncludes(T,S){return T.includes(S)}function SetDistinct(T){return[...new Set(T)]}function SetIntersect(T,S){return T.filter((L)=>S.includes(L))}function SetIntersectManyResolve(T,Init){return T.reduce((Acc,L)=>{return SetIntersect(Acc,L)},Init)}function SetIntersectMany(T){return T.length===1?T[0]:T.length>1?SetIntersectManyResolve(T.slice(1),T[0]):[]}function SetUnionMany(T){let Acc=[];for(let L of T)Acc.push(...L);return Acc}var init_sets=()=>{};function Any2(options){return CreateType({[Kind]:"Any"},options)}var init_any=__esm(()=>{init_create();init_symbols2()});var init_any2=__esm(()=>{init_any()});function Array2(items,options){return CreateType({[Kind]:"Array",type:"array",items},options)}var init_array=__esm(()=>{init_type2();init_symbols2()});var init_array2=__esm(()=>{init_array()});function Argument(index){return CreateType({[Kind]:"Argument",index})}var init_argument=__esm(()=>{init_type2();init_symbols2()});var init_argument2=__esm(()=>{init_argument()});function AsyncIterator2(items,options){return CreateType({[Kind]:"AsyncIterator",type:"AsyncIterator",items},options)}var init_async_iterator=__esm(()=>{init_symbols2();init_type2()});var init_async_iterator2=__esm(()=>{init_async_iterator()});function Computed(target2,parameters2,options){return CreateType({[Kind]:"Computed",target:target2,parameters:parameters2},options)}var init_computed=__esm(()=>{init_create();init_symbols()});var init_computed2=__esm(()=>{init_computed()});function DiscardKey(value2,key2){let{[key2]:_,...rest}=value2;return rest}function Discard(value2,keys){return keys.reduce((acc,key2)=>DiscardKey(acc,key2),value2)}var init_discard=()=>{};function Never(options){return CreateType({[Kind]:"Never",not:{}},options)}var init_never=__esm(()=>{init_type2();init_symbols2()});var init_never2=__esm(()=>{init_never()});var init_mapped_key=()=>{};function MappedResult(properties){return CreateType({[Kind]:"MappedResult",properties})}var init_mapped_result=__esm(()=>{init_type2();init_symbols2()});function Constructor(parameters2,returns,options){return CreateType({[Kind]:"Constructor",type:"Constructor",parameters:parameters2,returns},options)}var init_constructor=__esm(()=>{init_type2();init_symbols2()});var init_constructor2=__esm(()=>{init_constructor()});function Function2(parameters2,returns,options){return CreateType({[Kind]:"Function",type:"Function",parameters:parameters2,returns},options)}var init_function=__esm(()=>{init_type2();init_symbols2()});var init_function2=__esm(()=>{init_function()});function UnionCreate(T,options){return CreateType({[Kind]:"Union",anyOf:T},options)}var init_union_create=__esm(()=>{init_type2();init_symbols2()});function IsUnionOptional(types17){return types17.some((type3)=>IsOptional(type3))}function RemoveOptionalFromRest(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType(left):left)}function RemoveOptionalFromType(T){return Discard(T,[OptionalKind])}function ResolveUnion(types17,options){return IsUnionOptional(types17)?Optional(UnionCreate(RemoveOptionalFromRest(types17),options)):UnionCreate(RemoveOptionalFromRest(types17),options)}function UnionEvaluated(T,options){return T.length===1?CreateType(T[0],options):T.length===0?Never(options):ResolveUnion(T,options)}var init_union_evaluated=__esm(()=>{init_type2();init_symbols2();init_discard();init_never2();init_optional2();init_union_create();init_kind()});var init_union_type=()=>{};function Union(types17,options){return types17.length===0?Never(options):types17.length===1?CreateType(types17[0],options):UnionCreate(types17,options)}var init_union=__esm(()=>{init_never2();init_type2();init_union_create()});var init_union2=__esm(()=>{init_union_evaluated();init_union_type();init_union()});function Unescape(pattern){return pattern.replace(/\\\$/g,"$").replace(/\\\*/g,"*").replace(/\\\^/g,"^").replace(/\\\|/g,"|").replace(/\\\(/g,"(").replace(/\\\)/g,")")}function IsNonEscaped(pattern,index,char){return pattern[index]===char&&pattern.charCodeAt(index-1)!==92}function IsOpenParen(pattern,index){return IsNonEscaped(pattern,index,"(")}function IsCloseParen(pattern,index){return IsNonEscaped(pattern,index,")")}function IsSeparator(pattern,index){return IsNonEscaped(pattern,index,"|")}function IsGroup(pattern){if(!(IsOpenParen(pattern,0)&&IsCloseParen(pattern,pattern.length-1)))return!1;let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(count2===0&&index!==pattern.length-1)return!1}return!0}function InGroup(pattern){return pattern.slice(1,pattern.length-1)}function IsPrecedenceOr(pattern){let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0)return!0}return!1}function IsPrecedenceAnd(pattern){for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index))return!0;return!1}function Or(pattern){let[count2,start]=[0,0],expressions=[];for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0){let range2=pattern.slice(start,index);if(range2.length>0)expressions.push(TemplateLiteralParse(range2));start=index+1}}let range=pattern.slice(start);if(range.length>0)expressions.push(TemplateLiteralParse(range));if(expressions.length===0)return{type:"const",const:""};if(expressions.length===1)return expressions[0];return{type:"or",expr:expressions}}function And(pattern){function Group(value2,index){if(!IsOpenParen(value2,index))throw new TemplateLiteralParserError("TemplateLiteralParser: Index must point to open parens");let count2=0;for(let scan=index;scan<value2.length;scan++){if(IsOpenParen(value2,scan))count2+=1;if(IsCloseParen(value2,scan))count2-=1;if(count2===0)return[index,scan]}throw new TemplateLiteralParserError("TemplateLiteralParser: Unclosed group parens in expression")}function Range(pattern2,index){for(let scan=index;scan<pattern2.length;scan++)if(IsOpenParen(pattern2,scan))return[index,scan];return[index,pattern2.length]}let expressions=[];for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index)){let[start,end]=Group(pattern,index),range=pattern.slice(start,end+1);expressions.push(TemplateLiteralParse(range)),index=end}else{let[start,end]=Range(pattern,index),range=pattern.slice(start,end);if(range.length>0)expressions.push(TemplateLiteralParse(range));index=end-1}return expressions.length===0?{type:"const",const:""}:expressions.length===1?expressions[0]:{type:"and",expr:expressions}}function TemplateLiteralParse(pattern){return IsGroup(pattern)?TemplateLiteralParse(InGroup(pattern)):IsPrecedenceOr(pattern)?Or(pattern):IsPrecedenceAnd(pattern)?And(pattern):{type:"const",const:Unescape(pattern)}}function TemplateLiteralParseExact(pattern){return TemplateLiteralParse(pattern.slice(1,pattern.length-1))}var TemplateLiteralParserError;var init_parse=__esm(()=>{init_error2();TemplateLiteralParserError=class TemplateLiteralParserError extends TypeBoxError{}});function IsNumberExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="0"&&expression.expr[1].type==="const"&&expression.expr[1].const==="[1-9][0-9]*"}function IsBooleanExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="true"&&expression.expr[1].type==="const"&&expression.expr[1].const==="false"}function IsStringExpression(expression){return expression.type==="const"&&expression.const===".*"}function IsTemplateLiteralExpressionFinite(expression){return IsNumberExpression(expression)||IsStringExpression(expression)?!1:IsBooleanExpression(expression)?!0:expression.type==="and"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="or"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="const"?!0:(()=>{throw new TemplateLiteralFiniteError("Unknown expression type")})()}function IsTemplateLiteralFinite(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)}var TemplateLiteralFiniteError;var init_finite=__esm(()=>{init_parse();init_error2();TemplateLiteralFiniteError=class TemplateLiteralFiniteError extends TypeBoxError{}});function*GenerateReduce(buffer){if(buffer.length===1)return yield*buffer[0];for(let left of buffer[0])for(let right of GenerateReduce(buffer.slice(1)))yield`${left}${right}`}function*GenerateAnd(expression){return yield*GenerateReduce(expression.expr.map((expr)=>[...TemplateLiteralExpressionGenerate(expr)]))}function*GenerateOr(expression){for(let expr of expression.expr)yield*TemplateLiteralExpressionGenerate(expr)}function*GenerateConst(expression){return yield expression.const}function*TemplateLiteralExpressionGenerate(expression){return expression.type==="and"?yield*GenerateAnd(expression):expression.type==="or"?yield*GenerateOr(expression):expression.type==="const"?yield*GenerateConst(expression):(()=>{throw new TemplateLiteralGenerateError("Unknown expression")})()}function TemplateLiteralGenerate(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)?[...TemplateLiteralExpressionGenerate(expression)]:[]}var TemplateLiteralGenerateError;var init_generate=__esm(()=>{init_finite();init_parse();init_error2();TemplateLiteralGenerateError=class TemplateLiteralGenerateError extends TypeBoxError{}});function Literal(value2,options){return CreateType({[Kind]:"Literal",const:value2,type:typeof value2},options)}var init_literal=__esm(()=>{init_type2();init_symbols2()});var init_literal2=__esm(()=>{init_literal()});function Boolean3(options){return CreateType({[Kind]:"Boolean",type:"boolean"},options)}var init_boolean=__esm(()=>{init_symbols2();init_create()});var init_boolean2=__esm(()=>{init_boolean()});function BigInt2(options){return CreateType({[Kind]:"BigInt",type:"bigint"},options)}var init_bigint=__esm(()=>{init_symbols2();init_create()});var init_bigint2=__esm(()=>{init_bigint()});function Number2(options){return CreateType({[Kind]:"Number",type:"number"},options)}var init_number=__esm(()=>{init_type2();init_symbols2()});var init_number2=__esm(()=>{init_number()});function String2(options){return CreateType({[Kind]:"String",type:"string"},options)}var init_string=__esm(()=>{init_type2();init_symbols2()});var init_string2=__esm(()=>{init_string()});function*FromUnion(syntax){let trim=syntax.trim().replace(/"|'/g,"");return trim==="boolean"?yield Boolean3():trim==="number"?yield Number2():trim==="bigint"?yield BigInt2():trim==="string"?yield String2():yield(()=>{let literals=trim.split("|").map((literal2)=>Literal(literal2.trim()));return literals.length===0?Never():literals.length===1?literals[0]:UnionEvaluated(literals)})()}function*FromTerminal(syntax){if(syntax[1]!=="{"){let L=Literal("$"),R=FromSyntax(syntax.slice(1));return yield*[L,...R]}for(let i=2;i<syntax.length;i++)if(syntax[i]==="}"){let L=FromUnion(syntax.slice(2,i)),R=FromSyntax(syntax.slice(i+1));return yield*[...L,...R]}yield Literal(syntax)}function*FromSyntax(syntax){for(let i=0;i<syntax.length;i++)if(syntax[i]==="$"){let L=Literal(syntax.slice(0,i)),R=FromTerminal(syntax.slice(i));return yield*[L,...R]}yield Literal(syntax)}function TemplateLiteralSyntax(syntax){return[...FromSyntax(syntax)]}var init_syntax=__esm(()=>{init_literal2();init_boolean2();init_bigint2();init_number2();init_string2();init_union2();init_never2()});function Escape(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Visit2(schema,acc){return IsTemplateLiteral(schema)?schema.pattern.slice(1,schema.pattern.length-1):IsUnion(schema)?`(${schema.anyOf.map((schema2)=>Visit2(schema2,acc)).join("|")})`:IsNumber3(schema)?`${acc}${PatternNumber}`:IsInteger2(schema)?`${acc}${PatternNumber}`:IsBigInt3(schema)?`${acc}${PatternNumber}`:IsString3(schema)?`${acc}${PatternString}`:IsLiteral(schema)?`${acc}${Escape(schema.const.toString())}`:IsBoolean3(schema)?`${acc}${PatternBoolean}`:(()=>{throw new TemplateLiteralPatternError(`Unexpected Kind '${schema[Kind]}'`)})()}function TemplateLiteralPattern(kinds){return`^${kinds.map((schema)=>Visit2(schema,"")).join("")}$`}var TemplateLiteralPatternError;var init_pattern=__esm(()=>{init_patterns();init_symbols2();init_error2();init_kind();TemplateLiteralPatternError=class TemplateLiteralPatternError extends TypeBoxError{}});function TemplateLiteralToUnion(schema){let L=TemplateLiteralGenerate(schema).map((S)=>Literal(S));return UnionEvaluated(L)}var init_union3=__esm(()=>{init_union2();init_literal2();init_generate()});function TemplateLiteral(unresolved,options){let pattern=IsString(unresolved)?TemplateLiteralPattern(TemplateLiteralSyntax(unresolved)):TemplateLiteralPattern(unresolved);return CreateType({[Kind]:"TemplateLiteral",type:"string",pattern},options)}var init_template_literal=__esm(()=>{init_type2();init_syntax();init_pattern();init_symbols2()});var init_template_literal2=__esm(()=>{init_finite();init_generate();init_syntax();init_parse();init_pattern();init_union3();init_template_literal()});function FromTemplateLiteral(templateLiteral){return TemplateLiteralGenerate(templateLiteral).map((key2)=>key2.toString())}function FromUnion2(types17){let result=[];for(let type3 of types17)result.push(...IndexPropertyKeys(type3));return result}function FromLiteral(literalValue){return[literalValue.toString()]}function IndexPropertyKeys(type3){return[...new Set(IsTemplateLiteral(type3)?FromTemplateLiteral(type3):IsUnion(type3)?FromUnion2(type3.anyOf):IsLiteral(type3)?FromLiteral(type3.const):IsNumber3(type3)?["[number]"]:IsInteger2(type3)?["[number]"]:[])]}var init_indexed_property_keys=__esm(()=>{init_template_literal2();init_kind()});function FromProperties(type3,properties,options){let result={};for(let K2 of Object.getOwnPropertyNames(properties))result[K2]=Index(type3,IndexPropertyKeys(properties[K2]),options);return result}function FromMappedResult(type3,mappedResult,options){return FromProperties(type3,mappedResult.properties,options)}function IndexFromMappedResult(type3,mappedResult,options){let properties=FromMappedResult(type3,mappedResult,options);return MappedResult(properties)}var init_indexed_from_mapped_result=__esm(()=>{init_mapped2();init_indexed_property_keys();init_indexed2()});function FromRest(types17,key2){return types17.map((type3)=>IndexFromPropertyKey(type3,key2))}function FromIntersectRest(types17){return types17.filter((type3)=>!IsNever(type3))}function FromIntersect(types17,key2){return IntersectEvaluated(FromIntersectRest(FromRest(types17,key2)))}function FromUnionRest(types17){return types17.some((L)=>IsNever(L))?[]:types17}function FromUnion3(types17,key2){return UnionEvaluated(FromUnionRest(FromRest(types17,key2)))}function FromTuple(types17,key2){return key2 in types17?types17[key2]:key2==="[number]"?UnionEvaluated(types17):Never()}function FromArray(type3,key2){return key2==="[number]"?type3:Never()}function FromProperty(properties,propertyKey){return propertyKey in properties?properties[propertyKey]:Never()}function IndexFromPropertyKey(type3,propertyKey){return IsIntersect(type3)?FromIntersect(type3.allOf,propertyKey):IsUnion(type3)?FromUnion3(type3.anyOf,propertyKey):IsTuple(type3)?FromTuple(type3.items??[],propertyKey):IsArray3(type3)?FromArray(type3.items,propertyKey):IsObject3(type3)?FromProperty(type3.properties,propertyKey):Never()}function IndexFromPropertyKeys(type3,propertyKeys){return propertyKeys.map((propertyKey)=>IndexFromPropertyKey(type3,propertyKey))}function FromSchema(type3,propertyKeys){return UnionEvaluated(IndexFromPropertyKeys(type3,propertyKeys))}function Index(type3,key2,options){if(IsRef(type3)||IsRef(key2)){if(!IsSchema(type3)||!IsSchema(key2))throw new TypeBoxError("Index types using Ref parameters require both Type and Key to be of TSchema");return Computed("Index",[type3,key2])}if(IsMappedResult(key2))return IndexFromMappedResult(type3,key2,options);if(IsMappedKey(key2))return IndexFromMappedKey(type3,key2,options);return CreateType(IsSchema(key2)?FromSchema(type3,IndexPropertyKeys(key2)):FromSchema(type3,key2),options)}var init_indexed=__esm(()=>{init_type2();init_error2();init_computed2();init_never2();init_intersect2();init_union2();init_indexed_property_keys();init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_kind()});function MappedIndexPropertyKey(type3,key2,options){return{[key2]:Index(type3,[key2],Clone(options))}}function MappedIndexPropertyKeys(type3,propertyKeys,options){return propertyKeys.reduce((result,left)=>{return{...result,...MappedIndexPropertyKey(type3,left,options)}},{})}function MappedIndexProperties(type3,mappedKey,options){return MappedIndexPropertyKeys(type3,mappedKey.keys,options)}function IndexFromMappedKey(type3,mappedKey,options){let properties=MappedIndexProperties(type3,mappedKey,options);return MappedResult(properties)}var init_indexed_from_mapped_key=__esm(()=>{init_indexed();init_mapped2();init_value()});var init_indexed2=__esm(()=>{init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_indexed_property_keys();init_indexed()});function Iterator2(items,options){return CreateType({[Kind]:"Iterator",type:"Iterator",items},options)}var init_iterator=__esm(()=>{init_type2();init_symbols2()});var init_iterator2=__esm(()=>{init_iterator()});function RequiredArray(properties){return globalThis.Object.keys(properties).filter((key2)=>!IsOptional(properties[key2]))}function _Object(properties,options){let required=RequiredArray(properties),schema=required.length>0?{[Kind]:"Object",type:"object",required,properties}:{[Kind]:"Object",type:"object",properties};return CreateType(schema,options)}var Object2;var init_object=__esm(()=>{init_type2();init_symbols2();init_kind();Object2=_Object});var init_object2=__esm(()=>{init_object()});function Promise2(item,options){return CreateType({[Kind]:"Promise",type:"Promise",item},options)}var init_promise=__esm(()=>{init_type2();init_symbols2()});var init_promise2=__esm(()=>{init_promise()});function RemoveReadonly(schema){return CreateType(Discard(schema,[ReadonlyKind]))}function AddReadonly(schema){return CreateType({...schema,[ReadonlyKind]:"Readonly"})}function ReadonlyWithFlag(schema,F){return F===!1?RemoveReadonly(schema):AddReadonly(schema)}function Readonly(schema,enable){let F=enable??!0;return IsMappedResult(schema)?ReadonlyFromMappedResult(schema,F):ReadonlyWithFlag(schema,F)}var init_readonly=__esm(()=>{init_type2();init_symbols2();init_discard();init_readonly_from_mapped_result();init_kind()});function FromProperties2(K,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Readonly(K[K2],F);return Acc}function FromMappedResult2(R,F){return FromProperties2(R.properties,F)}function ReadonlyFromMappedResult(R,F){let P=FromMappedResult2(R,F);return MappedResult(P)}var init_readonly_from_mapped_result=__esm(()=>{init_mapped2();init_readonly()});var init_readonly2=__esm(()=>{init_readonly_from_mapped_result();init_readonly()});function Tuple(types17,options){return CreateType(types17.length>0?{[Kind]:"Tuple",type:"array",items:types17,additionalItems:!1,minItems:types17.length,maxItems:types17.length}:{[Kind]:"Tuple",type:"array",minItems:types17.length,maxItems:types17.length},options)}var init_tuple=__esm(()=>{init_type2();init_symbols2()});var init_tuple2=__esm(()=>{init_tuple()});function FromMappedResult3(K,P){return K in P?FromSchemaType(K,P[K]):MappedResult(P)}function MappedKeyToKnownMappedResultProperties(K){return{[K]:Literal(K)}}function MappedKeyToUnknownMappedResultProperties(P){let Acc={};for(let L of P)Acc[L]=Literal(L);return Acc}function MappedKeyToMappedResultProperties(K,P){return SetIncludes(P,K)?MappedKeyToKnownMappedResultProperties(K):MappedKeyToUnknownMappedResultProperties(P)}function FromMappedKey(K,P){let R=MappedKeyToMappedResultProperties(K,P);return FromMappedResult3(K,R)}function FromRest2(K,T){return T.map((L)=>FromSchemaType(K,L))}function FromProperties3(K,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(T))Acc[K2]=FromSchemaType(K,T[K2]);return Acc}function FromSchemaType(K,T){let options={...T};return IsOptional(T)?Optional(FromSchemaType(K,Discard(T,[OptionalKind]))):IsReadonly(T)?Readonly(FromSchemaType(K,Discard(T,[ReadonlyKind]))):IsMappedResult(T)?FromMappedResult3(K,T.properties):IsMappedKey(T)?FromMappedKey(K,T.keys):IsConstructor(T)?Constructor(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsFunction3(T)?Function2(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsAsyncIterator3(T)?AsyncIterator2(FromSchemaType(K,T.items),options):IsIterator3(T)?Iterator2(FromSchemaType(K,T.items),options):IsIntersect(T)?Intersect(FromRest2(K,T.allOf),options):IsUnion(T)?Union(FromRest2(K,T.anyOf),options):IsTuple(T)?Tuple(FromRest2(K,T.items??[]),options):IsObject3(T)?Object2(FromProperties3(K,T.properties),options):IsArray3(T)?Array2(FromSchemaType(K,T.items),options):IsPromise2(T)?Promise2(FromSchemaType(K,T.item),options):T}function MappedFunctionReturnType(K,T){let Acc={};for(let L of K)Acc[L]=FromSchemaType(L,T);return Acc}function Mapped(key2,map3,options){let K=IsSchema(key2)?IndexPropertyKeys(key2):key2,RT=map3({[Kind]:"MappedKey",keys:K}),R=MappedFunctionReturnType(K,RT);return Object2(R,options)}var init_mapped=__esm(()=>{init_symbols2();init_discard();init_array2();init_async_iterator2();init_constructor2();init_function2();init_indexed2();init_intersect2();init_iterator2();init_literal2();init_object2();init_optional2();init_promise2();init_readonly2();init_tuple2();init_union2();init_sets();init_mapped_result();init_kind()});var init_mapped2=__esm(()=>{init_mapped_key();init_mapped_result();init_mapped()});function RemoveOptional(schema){return CreateType(Discard(schema,[OptionalKind]))}function AddOptional(schema){return CreateType({...schema,[OptionalKind]:"Optional"})}function OptionalWithFlag(schema,F){return F===!1?RemoveOptional(schema):AddOptional(schema)}function Optional(schema,enable){let F=enable??!0;return IsMappedResult(schema)?OptionalFromMappedResult(schema,F):OptionalWithFlag(schema,F)}var init_optional=__esm(()=>{init_type2();init_symbols2();init_discard();init_optional_from_mapped_result();init_kind()});function FromProperties4(P,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Optional(P[K2],F);return Acc}function FromMappedResult4(R,F){return FromProperties4(R.properties,F)}function OptionalFromMappedResult(R,F){let P=FromMappedResult4(R,F);return MappedResult(P)}var init_optional_from_mapped_result=__esm(()=>{init_mapped2();init_optional()});var init_optional2=__esm(()=>{init_optional_from_mapped_result();init_optional()});function IntersectCreate(T,options={}){let allObjects=T.every((schema)=>IsObject3(schema)),clonedUnevaluatedProperties=IsSchema(options.unevaluatedProperties)?{unevaluatedProperties:options.unevaluatedProperties}:{};return CreateType(options.unevaluatedProperties===!1||IsSchema(options.unevaluatedProperties)||allObjects?{...clonedUnevaluatedProperties,[Kind]:"Intersect",type:"object",allOf:T}:{...clonedUnevaluatedProperties,[Kind]:"Intersect",allOf:T},options)}var init_intersect_create=__esm(()=>{init_type2();init_symbols2();init_kind()});function IsIntersectOptional(types17){return types17.every((left)=>IsOptional(left))}function RemoveOptionalFromType2(type3){return Discard(type3,[OptionalKind])}function RemoveOptionalFromRest2(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType2(left):left)}function ResolveIntersect(types17,options){return IsIntersectOptional(types17)?Optional(IntersectCreate(RemoveOptionalFromRest2(types17),options)):IntersectCreate(RemoveOptionalFromRest2(types17),options)}function IntersectEvaluated(types17,options={}){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return ResolveIntersect(types17,options)}var init_intersect_evaluated=__esm(()=>{init_symbols2();init_type2();init_discard();init_never2();init_optional2();init_intersect_create();init_kind()});var init_intersect_type=()=>{};function Intersect(types17,options){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return IntersectCreate(types17,options)}var init_intersect=__esm(()=>{init_type2();init_never2();init_intersect_create();init_kind()});var init_intersect2=__esm(()=>{init_intersect_evaluated();init_intersect_type();init_intersect()});function Ref(...args){let[$ref,options]=typeof args[0]==="string"?[args[0],args[1]]:[args[0].$id,args[1]];if(typeof $ref!=="string")throw new TypeBoxError("Ref: $ref must be a string");return CreateType({[Kind]:"Ref",$ref},options)}var init_ref=__esm(()=>{init_error2();init_type2();init_symbols2()});var init_ref2=__esm(()=>{init_ref()});function FromComputed(target2,parameters2){return Computed("Awaited",[Computed(target2,parameters2)])}function FromRef($ref){return Computed("Awaited",[Ref($ref)])}function FromIntersect2(types17){return Intersect(FromRest3(types17))}function FromUnion4(types17){return Union(FromRest3(types17))}function FromPromise(type3){return Awaited(type3)}function FromRest3(types17){return types17.map((type3)=>Awaited(type3))}function Awaited(type3,options){return CreateType(IsComputed(type3)?FromComputed(type3.target,type3.parameters):IsIntersect(type3)?FromIntersect2(type3.allOf):IsUnion(type3)?FromUnion4(type3.anyOf):IsPromise2(type3)?FromPromise(type3.item):IsRef(type3)?FromRef(type3.$ref):type3,options)}var init_awaited=__esm(()=>{init_type2();init_computed2();init_intersect2();init_union2();init_ref2();init_kind()});var init_awaited2=__esm(()=>{init_awaited()});function FromRest4(types17){let result=[];for(let L of types17)result.push(KeyOfPropertyKeys(L));return result}function FromIntersect3(types17){let propertyKeysArray=FromRest4(types17);return SetUnionMany(propertyKeysArray)}function FromUnion5(types17){let propertyKeysArray=FromRest4(types17);return SetIntersectMany(propertyKeysArray)}function FromTuple2(types17){return types17.map((_,indexer)=>indexer.toString())}function FromArray2(_){return["[number]"]}function FromProperties5(T){return globalThis.Object.getOwnPropertyNames(T)}function FromPatternProperties(patternProperties){if(!includePatternProperties)return[];return globalThis.Object.getOwnPropertyNames(patternProperties).map((key2)=>{return key2[0]==="^"&&key2[key2.length-1]==="$"?key2.slice(1,key2.length-1):key2})}function KeyOfPropertyKeys(type3){return IsIntersect(type3)?FromIntersect3(type3.allOf):IsUnion(type3)?FromUnion5(type3.anyOf):IsTuple(type3)?FromTuple2(type3.items??[]):IsArray3(type3)?FromArray2(type3.items):IsObject3(type3)?FromProperties5(type3.properties):IsRecord(type3)?FromPatternProperties(type3.patternProperties):[]}function KeyOfPattern(schema){includePatternProperties=!0;let keys=KeyOfPropertyKeys(schema);return includePatternProperties=!1,`^(${keys.map((key2)=>`(${key2})`).join("|")})$`}var includePatternProperties=!1;var init_keyof_property_keys=__esm(()=>{init_sets();init_kind()});function FromComputed2(target2,parameters2){return Computed("KeyOf",[Computed(target2,parameters2)])}function FromRef2($ref){return Computed("KeyOf",[Ref($ref)])}function KeyOfFromType(type3,options){let propertyKeys=KeyOfPropertyKeys(type3),propertyKeyTypes=KeyOfPropertyKeysToRest(propertyKeys),result=UnionEvaluated(propertyKeyTypes);return CreateType(result,options)}function KeyOfPropertyKeysToRest(propertyKeys){return propertyKeys.map((L)=>L==="[number]"?Number2():Literal(L))}function KeyOf(type3,options){return IsComputed(type3)?FromComputed2(type3.target,type3.parameters):IsRef(type3)?FromRef2(type3.$ref):IsMappedResult(type3)?KeyOfFromMappedResult(type3,options):KeyOfFromType(type3,options)}var init_keyof=__esm(()=>{init_type2();init_literal2();init_number2();init_computed2();init_ref2();init_keyof_property_keys();init_union2();init_keyof_from_mapped_result();init_kind()});function FromProperties6(properties,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=KeyOf(properties[K2],Clone(options));return result}function FromMappedResult5(mappedResult,options){return FromProperties6(mappedResult.properties,options)}function KeyOfFromMappedResult(mappedResult,options){let properties=FromMappedResult5(mappedResult,options);return MappedResult(properties)}var init_keyof_from_mapped_result=__esm(()=>{init_mapped2();init_keyof();init_value()});function KeyOfPropertyEntries(schema){let keys=KeyOfPropertyKeys(schema),schemas=IndexFromPropertyKeys(schema,keys);return keys.map((_,index)=>[keys[index],schemas[index]])}var init_keyof_property_entries=__esm(()=>{init_indexed();init_keyof_property_keys()});var init_keyof2=__esm(()=>{init_keyof_from_mapped_result();init_keyof_property_entries();init_keyof_property_keys();init_keyof()});function CompositeKeys(T){let Acc=[];for(let L of T)Acc.push(...KeyOfPropertyKeys(L));return SetDistinct(Acc)}function FilterNever(T){return T.filter((L)=>!IsNever(L))}function CompositeProperty(T,K){let Acc=[];for(let L of T)Acc.push(...IndexFromPropertyKeys(L,[K]));return FilterNever(Acc)}function CompositeProperties(T,K){let Acc={};for(let L of K)Acc[L]=IntersectEvaluated(CompositeProperty(T,L));return Acc}function Composite(T,options){let K=CompositeKeys(T),P=CompositeProperties(T,K);return Object2(P,options)}var init_composite=__esm(()=>{init_intersect2();init_indexed2();init_keyof2();init_object2();init_sets();init_kind()});var init_composite2=__esm(()=>{init_composite()});function Date2(options){return CreateType({[Kind]:"Date",type:"Date"},options)}var init_date=__esm(()=>{init_symbols2();init_type2()});var init_date2=__esm(()=>{init_date()});function Null2(options){return CreateType({[Kind]:"Null",type:"null"},options)}var init_null=__esm(()=>{init_type2();init_symbols2()});var init_null2=__esm(()=>{init_null()});function Symbol2(options){return CreateType({[Kind]:"Symbol",type:"symbol"},options)}var init_symbol=__esm(()=>{init_type2();init_symbols2()});var init_symbol2=__esm(()=>{init_symbol()});function Undefined(options){return CreateType({[Kind]:"Undefined",type:"undefined"},options)}var init_undefined=__esm(()=>{init_type2();init_symbols2()});var init_undefined2=__esm(()=>{init_undefined()});function Uint8Array2(options){return CreateType({[Kind]:"Uint8Array",type:"Uint8Array"},options)}var init_uint8array=__esm(()=>{init_type2();init_symbols2()});var init_uint8array2=__esm(()=>{init_uint8array()});function Unknown(options){return CreateType({[Kind]:"Unknown"},options)}var init_unknown=__esm(()=>{init_type2();init_symbols2()});var init_unknown2=__esm(()=>{init_unknown()});function FromArray3(T){return T.map((L)=>FromValue(L,!1))}function FromProperties7(value2){let Acc={};for(let K of globalThis.Object.getOwnPropertyNames(value2))Acc[K]=Readonly(FromValue(value2[K],!1));return Acc}function ConditionalReadonly(T,root){return root===!0?T:Readonly(T)}function FromValue(value2,root){return IsAsyncIterator(value2)?ConditionalReadonly(Any2(),root):IsIterator(value2)?ConditionalReadonly(Any2(),root):IsArray(value2)?Readonly(Tuple(FromArray3(value2))):IsUint8Array(value2)?Uint8Array2():IsDate(value2)?Date2():IsObject(value2)?ConditionalReadonly(Object2(FromProperties7(value2)),root):IsFunction(value2)?ConditionalReadonly(Function2([],Unknown()),root):IsUndefined(value2)?Undefined():IsNull(value2)?Null2():IsSymbol(value2)?Symbol2():IsBigInt(value2)?BigInt2():IsNumber(value2)?Literal(value2):IsBoolean(value2)?Literal(value2):IsString(value2)?Literal(value2):Object2({})}function Const(T,options){return CreateType(FromValue(T,!0),options)}var init_const=__esm(()=>{init_any2();init_bigint2();init_date2();init_function2();init_literal2();init_null2();init_object2();init_symbol2();init_tuple2();init_readonly2();init_undefined2();init_uint8array2();init_unknown2();init_create()});var init_const2=__esm(()=>{init_const()});function ConstructorParameters(schema,options){return IsConstructor(schema)?Tuple(schema.parameters,options):Never(options)}var init_constructor_parameters=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_constructor_parameters2=__esm(()=>{init_constructor_parameters()});function Enum(item,options){if(IsUndefined(item))throw Error("Enum undefined or empty");let values1=globalThis.Object.getOwnPropertyNames(item).filter((key2)=>isNaN(key2)).map((key2)=>item[key2]),anyOf=[...new Set(values1)].map((value2)=>Literal(value2));return Union(anyOf,{...options,[Hint]:"Enum"})}var init_enum=__esm(()=>{init_literal2();init_symbols2();init_union2()});var init_enum2=__esm(()=>{init_enum()});function IntoBooleanResult(result){return result===ExtendsResult.False?result:ExtendsResult.True}function Throw(message){throw new ExtendsResolverError(message)}function IsStructuralRight(right){return exports_type.IsNever(right)||exports_type.IsIntersect(right)||exports_type.IsUnion(right)||exports_type.IsUnknown(right)||exports_type.IsAny(right)}function StructuralRight(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):Throw("StructuralRight")}function FromAnyRight(left,right){return ExtendsResult.True}function FromAny(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)&&right.anyOf.some((schema)=>exports_type.IsAny(schema)||exports_type.IsUnknown(schema))?ExtendsResult.True:exports_type.IsUnion(right)?ExtendsResult.Union:exports_type.IsUnknown(right)?ExtendsResult.True:exports_type.IsAny(right)?ExtendsResult.True:ExtendsResult.Union}function FromArrayRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)?ExtendsResult.True:ExtendsResult.False}function FromArray4(left,right){return exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsArray(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromAsyncIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsAsyncIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromBigInt(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBigInt(right)?ExtendsResult.True:ExtendsResult.False}function FromBooleanRight(left,right){return exports_type.IsLiteralBoolean(left)?ExtendsResult.True:exports_type.IsBoolean(left)?ExtendsResult.True:ExtendsResult.False}function FromBoolean(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBoolean(right)?ExtendsResult.True:ExtendsResult.False}function FromConstructor(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsConstructor(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromDate(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsDate(right)?ExtendsResult.True:ExtendsResult.False}function FromFunction(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsFunction(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromIntegerRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsNumber(left.const)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromInteger(left,right){return exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):ExtendsResult.False}function FromIntersectRight(left,right){return right.allOf.every((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIntersect4(left,right){return left.allOf.some((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromLiteral2(left,right){return exports_type.IsLiteral(right)&&right.const===left.const?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):ExtendsResult.False}function FromNeverRight(left,right){return ExtendsResult.False}function FromNever(left,right){return ExtendsResult.True}function UnwrapTNot(schema){let[current,depth]=[schema,0];while(!0){if(!exports_type.IsNot(current))break;current=current.not,depth+=1}return depth%2===0?current:Unknown()}function FromNot(left,right){return exports_type.IsNot(left)?Visit3(UnwrapTNot(left),right):exports_type.IsNot(right)?Visit3(left,UnwrapTNot(right)):Throw("Invalid fallthrough for Not")}function FromNull(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsNull(right)?ExtendsResult.True:ExtendsResult.False}function FromNumberRight(left,right){return exports_type.IsLiteralNumber(left)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromNumber(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:ExtendsResult.False}function IsObjectPropertyCount(schema,count2){return Object.getOwnPropertyNames(schema.properties).length===count2}function IsObjectStringLike(schema){return IsObjectArrayLike(schema)}function IsObjectSymbolLike(schema){return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"description"in schema.properties&&exports_type.IsUnion(schema.properties.description)&&schema.properties.description.anyOf.length===2&&(exports_type.IsString(schema.properties.description.anyOf[0])&&exports_type.IsUndefined(schema.properties.description.anyOf[1])||exports_type.IsString(schema.properties.description.anyOf[1])&&exports_type.IsUndefined(schema.properties.description.anyOf[0]))}function IsObjectNumberLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBooleanLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBigIntLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectDateLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectUint8ArrayLike(schema){return IsObjectArrayLike(schema)}function IsObjectFunctionLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectConstructorLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectArrayLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectPromiseLike(schema){let then=Function2([Any2()],Any2());return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"then"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.then,then))===ExtendsResult.True}function Property(left,right){return Visit3(left,right)===ExtendsResult.False?ExtendsResult.False:exports_type.IsOptional(left)&&!exports_type.IsOptional(right)?ExtendsResult.False:ExtendsResult.True}function FromObjectRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)||exports_type.IsLiteralString(left)&&IsObjectStringLike(right)||exports_type.IsLiteralNumber(left)&&IsObjectNumberLike(right)||exports_type.IsLiteralBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsBigInt(left)&&IsObjectBigIntLike(right)||exports_type.IsString(left)&&IsObjectStringLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsNumber(left)&&IsObjectNumberLike(right)||exports_type.IsInteger(left)&&IsObjectNumberLike(right)||exports_type.IsBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsUint8Array(left)&&IsObjectUint8ArrayLike(right)||exports_type.IsDate(left)&&IsObjectDateLike(right)||exports_type.IsConstructor(left)&&IsObjectConstructorLike(right)||exports_type.IsFunction(left)&&IsObjectFunctionLike(right)?ExtendsResult.True:exports_type.IsRecord(left)&&exports_type.IsString(RecordKey(left))?(()=>{return right[Hint]==="Record"?ExtendsResult.True:ExtendsResult.False})():exports_type.IsRecord(left)&&exports_type.IsNumber(RecordKey(left))?(()=>{return IsObjectPropertyCount(right,0)?ExtendsResult.True:ExtendsResult.False})():ExtendsResult.False}function FromObject(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):!exports_type.IsObject(right)?ExtendsResult.False:(()=>{for(let key2 of Object.getOwnPropertyNames(right.properties)){if(!(key2 in left.properties)&&!exports_type.IsOptional(right.properties[key2]))return ExtendsResult.False;if(exports_type.IsOptional(right.properties[key2]))return ExtendsResult.True;if(Property(left.properties[key2],right.properties[key2])===ExtendsResult.False)return ExtendsResult.False}return ExtendsResult.True})()}function FromPromise2(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectPromiseLike(right)?ExtendsResult.True:!exports_type.IsPromise(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.item,right.item))}function RecordKey(schema){return PatternNumberExact in schema.patternProperties?Number2():(PatternStringExact in schema.patternProperties)?String2():Throw("Unknown record key pattern")}function RecordValue(schema){return PatternNumberExact in schema.patternProperties?schema.patternProperties[PatternNumberExact]:(PatternStringExact in schema.patternProperties)?schema.patternProperties[PatternStringExact]:Throw("Unable to get record value schema")}function FromRecordRight(left,right){let[Key,Value]=[RecordKey(right),RecordValue(right)];return exports_type.IsLiteralString(left)&&exports_type.IsNumber(Key)&&IntoBooleanResult(Visit3(left,Value))===ExtendsResult.True?ExtendsResult.True:exports_type.IsUint8Array(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsString(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsArray(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsObject(left)?(()=>{for(let key2 of Object.getOwnPropertyNames(left.properties))if(Property(Value,left.properties[key2])===ExtendsResult.False)return ExtendsResult.False;return ExtendsResult.True})():ExtendsResult.False}function FromRecord(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsRecord(right)?ExtendsResult.False:Visit3(RecordValue(left),RecordValue(right))}function FromRegExp(left,right){let L=exports_type.IsRegExp(left)?String2():left,R=exports_type.IsRegExp(right)?String2():right;return Visit3(L,R)}function FromStringRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsString(left.const)?ExtendsResult.True:exports_type.IsString(left)?ExtendsResult.True:ExtendsResult.False}function FromString(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?ExtendsResult.True:ExtendsResult.False}function FromSymbol(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsSymbol(right)?ExtendsResult.True:ExtendsResult.False}function FromTemplateLiteral2(left,right){return exports_type.IsTemplateLiteral(left)?Visit3(TemplateLiteralToUnion(left),right):exports_type.IsTemplateLiteral(right)?Visit3(left,TemplateLiteralToUnion(right)):Throw("Invalid fallthrough for TemplateLiteral")}function IsArrayOfTuple(left,right){return exports_type.IsArray(right)&&left.items!==void 0&&left.items.every((schema)=>Visit3(schema,right.items)===ExtendsResult.True)}function FromTupleRight(left,right){return exports_type.IsNever(left)?ExtendsResult.True:exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:ExtendsResult.False}function FromTuple3(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:exports_type.IsArray(right)&&IsArrayOfTuple(left,right)?ExtendsResult.True:!exports_type.IsTuple(right)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)||!exports_value.IsUndefined(left.items)&&exports_value.IsUndefined(right.items)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)?ExtendsResult.True:left.items.every((schema,index)=>Visit3(schema,right.items[index])===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUint8Array(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsUint8Array(right)?ExtendsResult.True:ExtendsResult.False}function FromUndefined(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsVoid(right)?FromVoidRight(left,right):exports_type.IsUndefined(right)?ExtendsResult.True:ExtendsResult.False}function FromUnionRight(left,right){return right.anyOf.some((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnion6(left,right){return left.anyOf.every((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnknownRight(left,right){return ExtendsResult.True}function FromUnknown(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):exports_type.IsArray(right)?FromArrayRight(left,right):exports_type.IsTuple(right)?FromTupleRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsUnknown(right)?ExtendsResult.True:ExtendsResult.False}function FromVoidRight(left,right){return exports_type.IsUndefined(left)?ExtendsResult.True:exports_type.IsUndefined(left)?ExtendsResult.True:ExtendsResult.False}function FromVoid(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsVoid(right)?ExtendsResult.True:ExtendsResult.False}function Visit3(left,right){return exports_type.IsTemplateLiteral(left)||exports_type.IsTemplateLiteral(right)?FromTemplateLiteral2(left,right):exports_type.IsRegExp(left)||exports_type.IsRegExp(right)?FromRegExp(left,right):exports_type.IsNot(left)||exports_type.IsNot(right)?FromNot(left,right):exports_type.IsAny(left)?FromAny(left,right):exports_type.IsArray(left)?FromArray4(left,right):exports_type.IsBigInt(left)?FromBigInt(left,right):exports_type.IsBoolean(left)?FromBoolean(left,right):exports_type.IsAsyncIterator(left)?FromAsyncIterator(left,right):exports_type.IsConstructor(left)?FromConstructor(left,right):exports_type.IsDate(left)?FromDate(left,right):exports_type.IsFunction(left)?FromFunction(left,right):exports_type.IsInteger(left)?FromInteger(left,right):exports_type.IsIntersect(left)?FromIntersect4(left,right):exports_type.IsIterator(left)?FromIterator(left,right):exports_type.IsLiteral(left)?FromLiteral2(left,right):exports_type.IsNever(left)?FromNever(left,right):exports_type.IsNull(left)?FromNull(left,right):exports_type.IsNumber(left)?FromNumber(left,right):exports_type.IsObject(left)?FromObject(left,right):exports_type.IsRecord(left)?FromRecord(left,right):exports_type.IsString(left)?FromString(left,right):exports_type.IsSymbol(left)?FromSymbol(left,right):exports_type.IsTuple(left)?FromTuple3(left,right):exports_type.IsPromise(left)?FromPromise2(left,right):exports_type.IsUint8Array(left)?FromUint8Array(left,right):exports_type.IsUndefined(left)?FromUndefined(left,right):exports_type.IsUnion(left)?FromUnion6(left,right):exports_type.IsUnknown(left)?FromUnknown(left,right):exports_type.IsVoid(left)?FromVoid(left,right):Throw(`Unknown left type operand '${left[Kind]}'`)}function ExtendsCheck(left,right){return Visit3(left,right)}var ExtendsResolverError,ExtendsResult;var init_extends_check=__esm(()=>{init_any2();init_function2();init_number2();init_string2();init_unknown2();init_template_literal2();init_patterns();init_symbols2();init_error2();init_guard2();ExtendsResolverError=class ExtendsResolverError extends TypeBoxError{};(function(ExtendsResult2){ExtendsResult2[ExtendsResult2.Union=0]="Union",ExtendsResult2[ExtendsResult2.True=1]="True",ExtendsResult2[ExtendsResult2.False=2]="False"})(ExtendsResult||(ExtendsResult={}))});function FromProperties8(P,Right,True,False,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extends(P[K2],Right,True,False,Clone(options));return Acc}function FromMappedResult6(Left,Right,True,False,options){return FromProperties8(Left.properties,Right,True,False,options)}function ExtendsFromMappedResult(Left,Right,True,False,options){let P=FromMappedResult6(Left,Right,True,False,options);return MappedResult(P)}var init_extends_from_mapped_result=__esm(()=>{init_mapped2();init_extends();init_value()});function ExtendsResolve(left,right,trueType,falseType){let R=ExtendsCheck(left,right);return R===ExtendsResult.Union?Union([trueType,falseType]):R===ExtendsResult.True?trueType:falseType}function Extends(L,R,T,F,options){return IsMappedResult(L)?ExtendsFromMappedResult(L,R,T,F,options):IsMappedKey(L)?CreateType(ExtendsFromMappedKey(L,R,T,F,options)):CreateType(ExtendsResolve(L,R,T,F),options)}var init_extends=__esm(()=>{init_type2();init_union2();init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_kind()});function FromPropertyKey(K,U,L,R,options){return{[K]:Extends(Literal(K),U,L,R,Clone(options))}}function FromPropertyKeys(K,U,L,R,options){return K.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey(LK,U,L,R,options)}},{})}function FromMappedKey2(K,U,L,R,options){return FromPropertyKeys(K.keys,U,L,R,options)}function ExtendsFromMappedKey(T,U,L,R,options){let P=FromMappedKey2(T,U,L,R,options);return MappedResult(P)}var init_extends_from_mapped_key=__esm(()=>{init_mapped2();init_literal2();init_extends();init_value()});function Intersect2(schema){return schema.allOf.every((schema2)=>ExtendsUndefinedCheck(schema2))}function Union2(schema){return schema.anyOf.some((schema2)=>ExtendsUndefinedCheck(schema2))}function Not(schema){return!ExtendsUndefinedCheck(schema.not)}function ExtendsUndefinedCheck(schema){return schema[Kind]==="Intersect"?Intersect2(schema):schema[Kind]==="Union"?Union2(schema):schema[Kind]==="Not"?Not(schema):schema[Kind]==="Undefined"?!0:!1}var init_extends_undefined=__esm(()=>{init_symbols2()});var init_extends2=__esm(()=>{init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_extends_undefined();init_extends()});function ExcludeFromTemplateLiteral(L,R){return Exclude(TemplateLiteralToUnion(L),R)}var init_exclude_from_template_literal=__esm(()=>{init_exclude();init_template_literal2()});function ExcludeRest(L,R){let excluded=L.filter((inner)=>ExtendsCheck(inner,R)===ExtendsResult.False);return excluded.length===1?excluded[0]:Union(excluded)}function Exclude(L,R,options={}){if(IsTemplateLiteral(L))return CreateType(ExcludeFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExcludeFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExcludeRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?Never():L,options)}var init_exclude=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_exclude_from_mapped_result();init_exclude_from_template_literal();init_kind()});function FromProperties9(P,U){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Exclude(P[K2],U);return Acc}function FromMappedResult7(R,T){return FromProperties9(R.properties,T)}function ExcludeFromMappedResult(R,T){let P=FromMappedResult7(R,T);return MappedResult(P)}var init_exclude_from_mapped_result=__esm(()=>{init_mapped2();init_exclude()});var init_exclude2=__esm(()=>{init_exclude_from_mapped_result();init_exclude_from_template_literal();init_exclude()});function ExtractFromTemplateLiteral(L,R){return Extract(TemplateLiteralToUnion(L),R)}var init_extract_from_template_literal=__esm(()=>{init_extract();init_template_literal2()});function ExtractRest(L,R){let extracted=L.filter((inner)=>ExtendsCheck(inner,R)!==ExtendsResult.False);return extracted.length===1?extracted[0]:Union(extracted)}function Extract(L,R,options){if(IsTemplateLiteral(L))return CreateType(ExtractFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExtractFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExtractRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?L:Never(),options)}var init_extract=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_extract_from_mapped_result();init_extract_from_template_literal();init_kind()});function FromProperties10(P,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extract(P[K2],T);return Acc}function FromMappedResult8(R,T){return FromProperties10(R.properties,T)}function ExtractFromMappedResult(R,T){let P=FromMappedResult8(R,T);return MappedResult(P)}var init_extract_from_mapped_result=__esm(()=>{init_mapped2();init_extract()});var init_extract2=__esm(()=>{init_extract_from_mapped_result();init_extract_from_template_literal();init_extract()});function InstanceType(schema,options){return IsConstructor(schema)?CreateType(schema.returns,options):Never(options)}var init_instance_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_instance_type2=__esm(()=>{init_instance_type()});function ReadonlyOptional(schema){return Readonly(Optional(schema))}var init_readonly_optional=__esm(()=>{init_readonly2();init_optional2()});var init_readonly_optional2=__esm(()=>{init_readonly_optional()});function RecordCreateFromPattern(pattern2,T,options){return CreateType({[Kind]:"Record",type:"object",patternProperties:{[pattern2]:T}},options)}function RecordCreateFromKeys(K,T,options){let result={};for(let K2 of K)result[K2]=T;return Object2(result,{...options,[Hint]:"Record"})}function FromTemplateLiteralKey(K,T,options){return IsTemplateLiteralFinite(K)?RecordCreateFromKeys(IndexPropertyKeys(K),T,options):RecordCreateFromPattern(K.pattern,T,options)}function FromUnionKey(key2,type3,options){return RecordCreateFromKeys(IndexPropertyKeys(Union(key2)),type3,options)}function FromLiteralKey(key2,type3,options){return RecordCreateFromKeys([key2.toString()],type3,options)}function FromRegExpKey(key2,type3,options){return RecordCreateFromPattern(key2.source,type3,options)}function FromStringKey(key2,type3,options){let pattern2=IsUndefined(key2.pattern)?PatternStringExact:key2.pattern;return RecordCreateFromPattern(pattern2,type3,options)}function FromAnyKey(_,type3,options){return RecordCreateFromPattern(PatternStringExact,type3,options)}function FromNeverKey(_key,type3,options){return RecordCreateFromPattern(PatternNeverExact,type3,options)}function FromBooleanKey(_key,type3,options){return Object2({true:type3,false:type3},options)}function FromIntegerKey(_key,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function FromNumberKey(_,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function Record(key2,type3,options={}){return IsUnion(key2)?FromUnionKey(key2.anyOf,type3,options):IsTemplateLiteral(key2)?FromTemplateLiteralKey(key2,type3,options):IsLiteral(key2)?FromLiteralKey(key2.const,type3,options):IsBoolean3(key2)?FromBooleanKey(key2,type3,options):IsInteger2(key2)?FromIntegerKey(key2,type3,options):IsNumber3(key2)?FromNumberKey(key2,type3,options):IsRegExp2(key2)?FromRegExpKey(key2,type3,options):IsString3(key2)?FromStringKey(key2,type3,options):IsAny(key2)?FromAnyKey(key2,type3,options):IsNever(key2)?FromNeverKey(key2,type3,options):Never(options)}function RecordPattern(record){return globalThis.Object.getOwnPropertyNames(record.patternProperties)[0]}function RecordKey2(type3){let pattern2=RecordPattern(type3);return pattern2===PatternStringExact?String2():pattern2===PatternNumberExact?Number2():String2({pattern:pattern2})}function RecordValue2(type3){return type3.patternProperties[RecordPattern(type3)]}var init_record=__esm(()=>{init_type2();init_symbols2();init_never2();init_number2();init_object2();init_string2();init_union2();init_template_literal2();init_patterns();init_indexed2();init_kind()});var init_record2=__esm(()=>{init_record()});function FromConstructor2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromFunction2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromIntersect5(args,type3){return type3.allOf=FromTypes(args,type3.allOf),type3}function FromUnion7(args,type3){return type3.anyOf=FromTypes(args,type3.anyOf),type3}function FromTuple4(args,type3){if(IsUndefined(type3.items))return type3;return type3.items=FromTypes(args,type3.items),type3}function FromArray5(args,type3){return type3.items=FromType(args,type3.items),type3}function FromAsyncIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromPromise3(args,type3){return type3.item=FromType(args,type3.item),type3}function FromObject2(args,type3){let mappedProperties=FromProperties11(args,type3.properties);return{...type3,...Object2(mappedProperties)}}function FromRecord2(args,type3){let mappedKey=FromType(args,RecordKey2(type3)),mappedValue=FromType(args,RecordValue2(type3)),result=Record(mappedKey,mappedValue);return{...type3,...result}}function FromArgument(args,argument2){return argument2.index in args?args[argument2.index]:Unknown()}function FromProperty2(args,type3){let isReadonly=IsReadonly(type3),isOptional=IsOptional(type3),mapped2=FromType(args,type3);return isReadonly&&isOptional?ReadonlyOptional(mapped2):isReadonly&&!isOptional?Readonly(mapped2):!isReadonly&&isOptional?Optional(mapped2):mapped2}function FromProperties11(args,properties){return globalThis.Object.getOwnPropertyNames(properties).reduce((result,key2)=>{return{...result,[key2]:FromProperty2(args,properties[key2])}},{})}function FromTypes(args,types17){return types17.map((type3)=>FromType(args,type3))}function FromType(args,type3){return IsConstructor(type3)?FromConstructor2(args,type3):IsFunction3(type3)?FromFunction2(args,type3):IsIntersect(type3)?FromIntersect5(args,type3):IsUnion(type3)?FromUnion7(args,type3):IsTuple(type3)?FromTuple4(args,type3):IsArray3(type3)?FromArray5(args,type3):IsAsyncIterator3(type3)?FromAsyncIterator2(args,type3):IsIterator3(type3)?FromIterator2(args,type3):IsPromise2(type3)?FromPromise3(args,type3):IsObject3(type3)?FromObject2(args,type3):IsRecord(type3)?FromRecord2(args,type3):IsArgument(type3)?FromArgument(args,type3):type3}function Instantiate(type3,args){return FromType(args,CloneType(type3))}var init_instantiate=__esm(()=>{init_type();init_unknown2();init_readonly_optional2();init_readonly2();init_optional2();init_object2();init_record2();init_kind()});var init_instantiate2=__esm(()=>{init_instantiate()});function Integer2(options){return CreateType({[Kind]:"Integer",type:"integer"},options)}var init_integer=__esm(()=>{init_type2();init_symbols2()});var init_integer2=__esm(()=>{init_integer()});function MappedIntrinsicPropertyKey(K,M,options){return{[K]:Intrinsic(Literal(K),M,Clone(options))}}function MappedIntrinsicPropertyKeys(K,M,options){return K.reduce((Acc,L)=>{return{...Acc,...MappedIntrinsicPropertyKey(L,M,options)}},{})}function MappedIntrinsicProperties(T,M,options){return MappedIntrinsicPropertyKeys(T.keys,M,options)}function IntrinsicFromMappedKey(T,M,options){let P=MappedIntrinsicProperties(T,M,options);return MappedResult(P)}var init_intrinsic_from_mapped_key=__esm(()=>{init_mapped2();init_intrinsic();init_literal2();init_value()});function ApplyUncapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toLowerCase(),rest].join("")}function ApplyCapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toUpperCase(),rest].join("")}function ApplyUppercase(value2){return value2.toUpperCase()}function ApplyLowercase(value2){return value2.toLowerCase()}function FromTemplateLiteral3(schema,mode,options){let expression=TemplateLiteralParseExact(schema.pattern);if(!IsTemplateLiteralExpressionFinite(expression))return{...schema,pattern:FromLiteralValue(schema.pattern,mode)};let literals=[...TemplateLiteralExpressionGenerate(expression)].map((value2)=>Literal(value2)),mapped2=FromRest5(literals,mode),union3=Union(mapped2);return TemplateLiteral([union3],options)}function FromLiteralValue(value2,mode){return typeof value2==="string"?mode==="Uncapitalize"?ApplyUncapitalize(value2):mode==="Capitalize"?ApplyCapitalize(value2):mode==="Uppercase"?ApplyUppercase(value2):mode==="Lowercase"?ApplyLowercase(value2):value2:value2.toString()}function FromRest5(T,M){return T.map((L)=>Intrinsic(L,M))}function Intrinsic(schema,mode,options={}){return IsMappedKey(schema)?IntrinsicFromMappedKey(schema,mode,options):IsTemplateLiteral(schema)?FromTemplateLiteral3(schema,mode,options):IsUnion(schema)?Union(FromRest5(schema.anyOf,mode),options):IsLiteral(schema)?Literal(FromLiteralValue(schema.const,mode),options):CreateType(schema,options)}var init_intrinsic=__esm(()=>{init_type2();init_template_literal2();init_intrinsic_from_mapped_key();init_literal2();init_union2();init_kind()});function Capitalize(T,options={}){return Intrinsic(T,"Capitalize",options)}var init_capitalize=__esm(()=>{init_intrinsic()});function Lowercase(T,options={}){return Intrinsic(T,"Lowercase",options)}var init_lowercase=__esm(()=>{init_intrinsic()});function Uncapitalize(T,options={}){return Intrinsic(T,"Uncapitalize",options)}var init_uncapitalize=__esm(()=>{init_intrinsic()});function Uppercase(T,options={}){return Intrinsic(T,"Uppercase",options)}var init_uppercase=__esm(()=>{init_intrinsic()});var init_intrinsic2=__esm(()=>{init_capitalize();init_intrinsic_from_mapped_key();init_intrinsic();init_lowercase();init_uncapitalize();init_uppercase()});function FromProperties12(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Omit(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult9(mappedResult,propertyKeys,options){return FromProperties12(mappedResult.properties,propertyKeys,options)}function OmitFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult9(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_omit_from_mapped_result=__esm(()=>{init_mapped2();init_omit();init_value()});function FromIntersect6(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromUnion8(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromProperty3(properties,key2){let{[key2]:_,...R}=properties;return R}function FromProperties13(properties,propertyKeys){return propertyKeys.reduce((T,K2)=>FromProperty3(T,K2),properties)}function FromObject3(type3,propertyKeys,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties13(properties,propertyKeys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function OmitResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect6(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion8(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject3(type3,propertyKeys,type3.properties):Object2({})}function Omit(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?OmitFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?OmitFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Omit",[type3,typeKey],options):CreateType({...OmitResolve(type3,propertyKeys),...options})}var init_omit=__esm(()=>{init_type2();init_symbols();init_computed2();init_literal2();init_indexed2();init_intersect2();init_union2();init_object2();init_omit_from_mapped_key();init_omit_from_mapped_result();init_kind()});function FromPropertyKey2(type3,key2,options){return{[key2]:Omit(type3,[key2],Clone(options))}}function FromPropertyKeys2(type3,propertyKeys,options){return propertyKeys.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey2(type3,LK,options)}},{})}function FromMappedKey3(type3,mappedKey,options){return FromPropertyKeys2(type3,mappedKey.keys,options)}function OmitFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey3(type3,mappedKey,options);return MappedResult(properties)}var init_omit_from_mapped_key=__esm(()=>{init_mapped2();init_omit();init_value()});var init_omit2=__esm(()=>{init_omit_from_mapped_key();init_omit_from_mapped_result();init_omit()});function FromProperties14(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Pick(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult10(mappedResult,propertyKeys,options){return FromProperties14(mappedResult.properties,propertyKeys,options)}function PickFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult10(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_pick_from_mapped_result=__esm(()=>{init_mapped2();init_pick();init_value()});function FromIntersect7(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromUnion9(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromProperties15(properties,propertyKeys){let result={};for(let K2 of propertyKeys)if(K2 in properties)result[K2]=properties[K2];return result}function FromObject4(Type,keys,properties){let options=Discard(Type,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties15(properties,keys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys2(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function PickResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect7(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion9(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject4(type3,propertyKeys,type3.properties):Object2({})}function Pick(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys2(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?PickFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?PickFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Pick",[type3,typeKey],options):CreateType({...PickResolve(type3,propertyKeys),...options})}var init_pick=__esm(()=>{init_type2();init_computed2();init_intersect2();init_literal2();init_object2();init_union2();init_indexed2();init_symbols();init_kind();init_pick_from_mapped_key();init_pick_from_mapped_result()});function FromPropertyKey3(type3,key2,options){return{[key2]:Pick(type3,[key2],Clone(options))}}function FromPropertyKeys3(type3,propertyKeys,options){return propertyKeys.reduce((result,leftKey)=>{return{...result,...FromPropertyKey3(type3,leftKey,options)}},{})}function FromMappedKey4(type3,mappedKey,options){return FromPropertyKeys3(type3,mappedKey.keys,options)}function PickFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey4(type3,mappedKey,options);return MappedResult(properties)}var init_pick_from_mapped_key=__esm(()=>{init_mapped2();init_pick();init_value()});var init_pick2=__esm(()=>{init_pick_from_mapped_key();init_pick_from_mapped_result();init_pick()});function FromComputed3(target2,parameters2){return Computed("Partial",[Computed(target2,parameters2)])}function FromRef3($ref){return Computed("Partial",[Ref($ref)])}function FromProperties16(properties){let partialProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))partialProperties[K]=Optional(properties[K]);return partialProperties}function FromObject5(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties16(properties);return Object2(mappedProperties,options)}function FromRest6(types17){return types17.map((type3)=>PartialResolve(type3))}function PartialResolve(type3){return IsComputed(type3)?FromComputed3(type3.target,type3.parameters):IsRef(type3)?FromRef3(type3.$ref):IsIntersect(type3)?Intersect(FromRest6(type3.allOf)):IsUnion(type3)?Union(FromRest6(type3.anyOf)):IsObject3(type3)?FromObject5(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Partial(type3,options){if(IsMappedResult(type3))return PartialFromMappedResult(type3,options);else return CreateType({...PartialResolve(type3),...options})}var init_partial=__esm(()=>{init_type2();init_computed2();init_optional2();init_object2();init_intersect2();init_union2();init_ref2();init_discard();init_symbols2();init_partial_from_mapped_result();init_kind()});function FromProperties17(K,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Partial(K[K2],Clone(options));return Acc}function FromMappedResult11(R,options){return FromProperties17(R.properties,options)}function PartialFromMappedResult(R,options){let P=FromMappedResult11(R,options);return MappedResult(P)}var init_partial_from_mapped_result=__esm(()=>{init_mapped2();init_partial();init_value()});var init_partial2=__esm(()=>{init_partial_from_mapped_result();init_partial()});function FromComputed4(target2,parameters2){return Computed("Required",[Computed(target2,parameters2)])}function FromRef4($ref){return Computed("Required",[Ref($ref)])}function FromProperties18(properties){let requiredProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))requiredProperties[K]=Discard(properties[K],[OptionalKind]);return requiredProperties}function FromObject6(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties18(properties);return Object2(mappedProperties,options)}function FromRest7(types17){return types17.map((type3)=>RequiredResolve(type3))}function RequiredResolve(type3){return IsComputed(type3)?FromComputed4(type3.target,type3.parameters):IsRef(type3)?FromRef4(type3.$ref):IsIntersect(type3)?Intersect(FromRest7(type3.allOf)):IsUnion(type3)?Union(FromRest7(type3.anyOf)):IsObject3(type3)?FromObject6(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Required(type3,options){if(IsMappedResult(type3))return RequiredFromMappedResult(type3,options);else return CreateType({...RequiredResolve(type3),...options})}var init_required=__esm(()=>{init_type2();init_computed2();init_object2();init_intersect2();init_union2();init_ref2();init_symbols2();init_discard();init_required_from_mapped_result();init_kind()});function FromProperties19(P,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Required(P[K2],options);return Acc}function FromMappedResult12(R,options){return FromProperties19(R.properties,options)}function RequiredFromMappedResult(R,options){let P=FromMappedResult12(R,options);return MappedResult(P)}var init_required_from_mapped_result=__esm(()=>{init_mapped2();init_required()});var init_required2=__esm(()=>{init_required_from_mapped_result();init_required()});function DereferenceParameters(moduleProperties,types17){return types17.map((type3)=>{return IsRef(type3)?Dereference(moduleProperties,type3.$ref):FromType2(moduleProperties,type3)})}function Dereference(moduleProperties,ref2){return ref2 in moduleProperties?IsRef(moduleProperties[ref2])?Dereference(moduleProperties,moduleProperties[ref2].$ref):FromType2(moduleProperties,moduleProperties[ref2]):Never()}function FromAwaited(parameters2){return Awaited(parameters2[0])}function FromIndex(parameters2){return Index(parameters2[0],parameters2[1])}function FromKeyOf(parameters2){return KeyOf(parameters2[0])}function FromPartial(parameters2){return Partial(parameters2[0])}function FromOmit(parameters2){return Omit(parameters2[0],parameters2[1])}function FromPick(parameters2){return Pick(parameters2[0],parameters2[1])}function FromRequired(parameters2){return Required(parameters2[0])}function FromComputed5(moduleProperties,target2,parameters2){let dereferenced=DereferenceParameters(moduleProperties,parameters2);return target2==="Awaited"?FromAwaited(dereferenced):target2==="Index"?FromIndex(dereferenced):target2==="KeyOf"?FromKeyOf(dereferenced):target2==="Partial"?FromPartial(dereferenced):target2==="Omit"?FromOmit(dereferenced):target2==="Pick"?FromPick(dereferenced):target2==="Required"?FromRequired(dereferenced):Never()}function FromArray6(moduleProperties,type3){return Array2(FromType2(moduleProperties,type3))}function FromAsyncIterator3(moduleProperties,type3){return AsyncIterator2(FromType2(moduleProperties,type3))}function FromConstructor3(moduleProperties,parameters2,instanceType){return Constructor(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,instanceType))}function FromFunction3(moduleProperties,parameters2,returnType){return Function2(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,returnType))}function FromIntersect8(moduleProperties,types17){return Intersect(FromTypes2(moduleProperties,types17))}function FromIterator3(moduleProperties,type3){return Iterator2(FromType2(moduleProperties,type3))}function FromObject7(moduleProperties,properties){return Object2(globalThis.Object.keys(properties).reduce((result,key2)=>{return{...result,[key2]:FromType2(moduleProperties,properties[key2])}},{}))}function FromRecord3(moduleProperties,type3){let[value2,pattern2]=[FromType2(moduleProperties,RecordValue2(type3)),RecordPattern(type3)],result=CloneType(type3);return result.patternProperties[pattern2]=value2,result}function FromTransform(moduleProperties,transform){return IsRef(transform)?{...Dereference(moduleProperties,transform.$ref),[TransformKind]:transform[TransformKind]}:transform}function FromTuple5(moduleProperties,types17){return Tuple(FromTypes2(moduleProperties,types17))}function FromUnion10(moduleProperties,types17){return Union(FromTypes2(moduleProperties,types17))}function FromTypes2(moduleProperties,types17){return types17.map((type3)=>FromType2(moduleProperties,type3))}function FromType2(moduleProperties,type3){return IsOptional(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[OptionalKind])),type3):IsReadonly(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[ReadonlyKind])),type3):IsTransform(type3)?CreateType(FromTransform(moduleProperties,type3),type3):IsArray3(type3)?CreateType(FromArray6(moduleProperties,type3.items),type3):IsAsyncIterator3(type3)?CreateType(FromAsyncIterator3(moduleProperties,type3.items),type3):IsComputed(type3)?CreateType(FromComputed5(moduleProperties,type3.target,type3.parameters)):IsConstructor(type3)?CreateType(FromConstructor3(moduleProperties,type3.parameters,type3.returns),type3):IsFunction3(type3)?CreateType(FromFunction3(moduleProperties,type3.parameters,type3.returns),type3):IsIntersect(type3)?CreateType(FromIntersect8(moduleProperties,type3.allOf),type3):IsIterator3(type3)?CreateType(FromIterator3(moduleProperties,type3.items),type3):IsObject3(type3)?CreateType(FromObject7(moduleProperties,type3.properties),type3):IsRecord(type3)?CreateType(FromRecord3(moduleProperties,type3)):IsTuple(type3)?CreateType(FromTuple5(moduleProperties,type3.items||[]),type3):IsUnion(type3)?CreateType(FromUnion10(moduleProperties,type3.anyOf),type3):type3}function ComputeType(moduleProperties,key2){return key2 in moduleProperties?FromType2(moduleProperties,moduleProperties[key2]):Never()}function ComputeModuleProperties(moduleProperties){return globalThis.Object.getOwnPropertyNames(moduleProperties).reduce((result,key2)=>{return{...result,[key2]:ComputeType(moduleProperties,key2)}},{})}var init_compute=__esm(()=>{init_create();init_clone();init_discard();init_array2();init_awaited2();init_async_iterator2();init_constructor2();init_indexed2();init_function2();init_intersect2();init_iterator2();init_keyof2();init_object2();init_omit2();init_pick2();init_never2();init_partial2();init_record2();init_required2();init_tuple2();init_union2();init_symbols2();init_kind()});class TModule{constructor($defs){let computed2=ComputeModuleProperties($defs),identified=this.WithIdentifiers(computed2);this.$defs=identified}Import(key2,options){let $defs={...this.$defs,[key2]:CreateType(this.$defs[key2],options)};return CreateType({[Kind]:"Import",$defs,$ref:key2})}WithIdentifiers($defs){return globalThis.Object.getOwnPropertyNames($defs).reduce((result,key2)=>{return{...result,[key2]:{...$defs[key2],$id:key2}}},{})}}function Module(properties){return new TModule(properties)}var init_module=__esm(()=>{init_create();init_symbols2();init_compute()});var init_module2=__esm(()=>{init_module()});function Not2(type3,options){return CreateType({[Kind]:"Not",not:type3},options)}var init_not=__esm(()=>{init_type2();init_symbols2()});var init_not2=__esm(()=>{init_not()});function Parameters(schema,options){return IsFunction3(schema)?Tuple(schema.parameters,options):Never()}var init_parameters2=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_parameters3=__esm(()=>{init_parameters2()});function Recursive(callback,options={}){if(IsUndefined(options.$id))options.$id=`T${Ordinal++}`;let thisType=CloneType(callback({[Kind]:"This",$ref:`${options.$id}`}));return thisType.$id=options.$id,CreateType({[Hint]:"Recursive",...thisType},options)}var Ordinal=0;var init_recursive=__esm(()=>{init_type();init_type2();init_symbols2()});var init_recursive2=__esm(()=>{init_recursive()});function RegExp2(unresolved,options){let expr=IsString(unresolved)?new globalThis.RegExp(unresolved):unresolved;return CreateType({[Kind]:"RegExp",type:"RegExp",source:expr.source,flags:expr.flags},options)}var init_regexp=__esm(()=>{init_type2();init_symbols2()});var init_regexp2=__esm(()=>{init_regexp()});function RestResolve(T){return IsIntersect(T)?T.allOf:IsUnion(T)?T.anyOf:IsTuple(T)?T.items??[]:[]}function Rest(T){return RestResolve(T)}var init_rest=__esm(()=>{init_kind()});var init_rest2=__esm(()=>{init_rest()});function ReturnType(schema,options){return IsFunction3(schema)?CreateType(schema.returns,options):Never(options)}var init_return_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_return_type2=__esm(()=>{init_return_type()});var init_anyschema=()=>{};var init_schema3=()=>{};var init_schema4=__esm(()=>{init_anyschema();init_schema3()});var init_static=()=>{};var init_static2=__esm(()=>{init_static()});class TransformDecodeBuilder{constructor(schema2){this.schema=schema2}Decode(decode3){return new TransformEncodeBuilder(this.schema,decode3)}}class TransformEncodeBuilder{constructor(schema2,decode3){this.schema=schema2,this.decode=decode3}EncodeTransform(encode4,schema2){let Codec={Encode:(value2)=>schema2[TransformKind].Encode(encode4(value2)),Decode:(value2)=>this.decode(schema2[TransformKind].Decode(value2))};return{...schema2,[TransformKind]:Codec}}EncodeSchema(encode4,schema2){let Codec={Decode:this.decode,Encode:encode4};return{...schema2,[TransformKind]:Codec}}Encode(encode4){return IsTransform(this.schema)?this.EncodeTransform(encode4,this.schema):this.EncodeSchema(encode4,this.schema)}}function Transform(schema2){return new TransformDecodeBuilder(schema2)}var init_transform=__esm(()=>{init_symbols2();init_kind()});var init_transform2=__esm(()=>{init_transform()});function Unsafe(options={}){return CreateType({[Kind]:options[Kind]??"Unsafe"},options)}var init_unsafe=__esm(()=>{init_type2();init_symbols2()});var init_unsafe2=__esm(()=>{init_unsafe()});function Void(options){return CreateType({[Kind]:"Void",type:"void"},options)}var init_void=__esm(()=>{init_type2();init_symbols2()});var init_void2=__esm(()=>{init_void()});var exports_type3={};__export(exports_type3,{Void:()=>Void,Uppercase:()=>Uppercase,Unsafe:()=>Unsafe,Unknown:()=>Unknown,Union:()=>Union,Undefined:()=>Undefined,Uncapitalize:()=>Uncapitalize,Uint8Array:()=>Uint8Array2,Tuple:()=>Tuple,Transform:()=>Transform,TemplateLiteral:()=>TemplateLiteral,Symbol:()=>Symbol2,String:()=>String2,ReturnType:()=>ReturnType,Rest:()=>Rest,Required:()=>Required,RegExp:()=>RegExp2,Ref:()=>Ref,Recursive:()=>Recursive,Record:()=>Record,ReadonlyOptional:()=>ReadonlyOptional,Readonly:()=>Readonly,Promise:()=>Promise2,Pick:()=>Pick,Partial:()=>Partial,Parameters:()=>Parameters,Optional:()=>Optional,Omit:()=>Omit,Object:()=>Object2,Number:()=>Number2,Null:()=>Null2,Not:()=>Not2,Never:()=>Never,Module:()=>Module,Mapped:()=>Mapped,Lowercase:()=>Lowercase,Literal:()=>Literal,KeyOf:()=>KeyOf,Iterator:()=>Iterator2,Intersect:()=>Intersect,Integer:()=>Integer2,Instantiate:()=>Instantiate,InstanceType:()=>InstanceType,Index:()=>Index,Function:()=>Function2,Extract:()=>Extract,Extends:()=>Extends,Exclude:()=>Exclude,Enum:()=>Enum,Date:()=>Date2,ConstructorParameters:()=>ConstructorParameters,Constructor:()=>Constructor,Const:()=>Const,Composite:()=>Composite,Capitalize:()=>Capitalize,Boolean:()=>Boolean3,BigInt:()=>BigInt2,Awaited:()=>Awaited,AsyncIterator:()=>AsyncIterator2,Array:()=>Array2,Argument:()=>Argument,Any:()=>Any2});var init_type5=__esm(()=>{init_any2();init_argument2();init_array2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_intrinsic2();init_iterator2();init_keyof2();init_literal2();init_mapped2();init_module2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2()});var Type;var init_type6=__esm(()=>{init_type5();Type=exports_type3});var init_esm3=__esm(()=>{init_clone();init_create();init_error2();init_guard2();init_helpers2();init_patterns();init_registry4();init_sets();init_symbols2();init_any2();init_array2();init_argument2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_iterator2();init_intrinsic2();init_keyof2();init_literal2();init_module2();init_mapped2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_schema4();init_static2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2();init_type6()});function isEmailExempt(email,exemptDomains){if(!exemptDomains||exemptDomains.length===0)return!1;let domain=email.split("@")[1]?.toLowerCase();if(!domain)return!1;return exemptDomains.some((d)=>domain===d.toLowerCase()||domain.endsWith(`.${d.toLowerCase()}`))}function normalizeTrustedOrigins(raw,env=process.env){if(Array.isArray(raw))return raw.length>0?raw:void 0;if(typeof raw!=="string"||!raw.trim())return;let trimmed=raw.trim(),fromEnv=env[trimmed],isEnvName=/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed),list2=(fromEnv??(isEnvName?"":trimmed)).split(/[,;\s]+/).map((entry)=>entry.trim().replace(/\/+$/,"")).filter(Boolean);return list2.length>0?list2:void 0}function pickTrustedOrigin(candidate,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]];if(candidate&&isOriginTrusted(candidate.replace(/\/+$/,""),trusted))return candidate.replace(/\/+$/,"");return fallbackOrigin}function resolveAppOrigin(request,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]],candidates=[],appOrigin=request.headers.get("x-app-origin");if(appOrigin)candidates.push(appOrigin.replace(/\/+$/,""));let origin=request.headers.get("origin");if(origin)candidates.push(origin.replace(/\/+$/,""));let forwardedHost=request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();if(forwardedHost){let proto=request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()||"https";candidates.push(`${proto}://${forwardedHost}`)}for(let candidate of candidates)if(isOriginTrusted(candidate,trusted))return candidate;return fallbackOrigin}function extractConfiguredPath(configuredUrl,defaultPath){if(!configuredUrl)return defaultPath;try{return new URL(configuredUrl).pathname}catch{return configuredUrl.startsWith("/")?configuredUrl:defaultPath}}function buildEmailActionLink(params){let{request,configuredUrl,path,query,allowedOrigins}=params,origin=resolveAppOrigin(request,configuredUrl,allowedOrigins),normalizedPath=path.startsWith("/")?path:`/${path}`,queryString=new URLSearchParams(query).toString();return`${origin}${normalizedPath}${queryString?`?${queryString}`:""}`}var originHost=(value2)=>{try{return new URL(value2).host.toLowerCase()}catch{return value2.includes("://")?null:value2.toLowerCase().replace(/[/?#].*$/,"")||null}},isOriginTrusted=(candidate,trusted)=>{let candHost=originHost(candidate);if(!candHost)return!1;for(let entry of trusted){let tHost=originHost(entry);if(!tHost)continue;if(tHost.startsWith("*.")){let base=tHost.slice(2);if(candHost===base||candHost.endsWith(`.${base}`))return!0}else if(candHost===tHost)return!0}return!1};var{password:password3}=globalThis.Bun;async function verifyPassword(plainPassword,hashedPassword){try{return await password3.verify(plainPassword,hashedPassword)}catch{return!1}}function labelFromRawUserAgent(userAgent){let ua=(userAgent??"").trim(),lower=ua.toLowerCase();if(!ua||lower==="unknown"||lower==="unknown browser")return;let meaningful=(ua.match(/[A-Za-z][A-Za-z0-9._-]*\/[0-9][^\s;)]*/g)??[]).find((t)=>!/^mozilla\//i.test(t));if(meaningful)return meaningful.split("/")[0];return ua.match(/[A-Za-z][A-Za-z0-9 ._-]{2,}/)?.[0]?.trim()||void 0}function parseUserAgentForLogin(userAgent,ipAddress,deviceHint,clientHints){let ua=userAgent.toLowerCase(),headlessIndicators=["headlesschrome","headless","phantomjs","nightmare","selenium","webdriver","puppeteer","playwright"],botIndicators=["bot","crawler","spider","scraper","curl","wget","python-requests","python-urllib","java/","httpclient","go-http-client","node-fetch","axios","postman","insomnia","httpie"],isHeadless=headlessIndicators.some((indicator)=>ua.includes(indicator)),isBot=botIndicators.some((indicator)=>ua.includes(indicator)),isSuspicious=isHeadless||isBot,suspiciousPatterns=[];if(isHeadless)suspiciousPatterns.push("headless_browser");if(isBot)suspiciousPatterns.push("bot_user_agent");if(!ua||ua.length<10)suspiciousPatterns.push("missing_or_short_ua");if(ua==="mozilla/5.0")suspiciousPatterns.push("generic_ua");if(ua.includes("nucleusserveraction")||ua.includes("serveraction"))suspiciousPatterns.push("server_action");let deviceType="unknown";if(ua.includes("ipad"))deviceType="tablet";else if(ua.includes("iphone"))deviceType="mobile";else if(ua.includes("macintosh")||ua.includes("windows")&&!ua.includes("windows phone")||ua.includes("linux")&&!ua.includes("android"))deviceType="desktop";else if(ua.includes("tablet")||ua.includes("android")&&ua.includes("tablet"))deviceType="tablet";else if(ua.includes("mobile")||ua.includes("android"))deviceType="mobile";let browserName,browserVersion;if(isHeadless)browserName="Headless Browser";else if(isBot)browserName="Bot/Crawler";else if(ua.includes("edg")){browserName="Edge";let match=userAgent.match(/Edg\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("opr/")||ua.includes("opera")){browserName="Opera";let match=userAgent.match(/OPR\/(\d+\.\d+)/i)||userAgent.match(/Opera\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("samsungbrowser")){browserName="Samsung Internet";let match=userAgent.match(/SamsungBrowser\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("crios")){browserName="Chrome";let match=userAgent.match(/CriOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("fxios")){browserName="Firefox";let match=userAgent.match(/FxiOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("chrome")){browserName="Chrome";let match=userAgent.match(/Chrome\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("firefox")){browserName="Firefox";let match=userAgent.match(/Firefox\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("safari")){browserName="Safari";let match=userAgent.match(/Version\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}let osName,osVersion;if(ua.includes("windows nt 10"))osName="Windows",osVersion="10/11";else if(ua.includes("windows nt"))osName="Windows";else if(ua.includes("iphone")||ua.includes("ipad")){osName="iOS";let match=userAgent.match(/OS (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("mac os x")){osName="macOS";let match=userAgent.match(/Mac OS X (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("android")){osName="Android";let match=userAgent.match(/Android (\d+\.?\d*)/i);if(match?.[1])osVersion=match[1]}else if(ua.includes("linux"))osName="Linux";if(!browserName&&clientHints?.uaHeader){let brands=[...clientHints.uaHeader.matchAll(/"([^"]+)";v="([^"]+)"/g)].map((m)=>({brand:m[1]??"",version:m[2]??""})).filter((b)=>b.brand&&!/not.?a.?brand/i.test(b.brand)),preferred=brands.find((b)=>/google chrome|microsoft edge|opera|firefox|safari/i.test(b.brand))??brands.find((b)=>!/chromium/i.test(b.brand))??brands[0];if(preferred)browserName=preferred.brand.replace(/^Google /,"").replace(/^Microsoft /,""),browserVersion=preferred.version}if(!osName&&clientHints?.platformHeader)osName=clientHints.platformHeader.replace(/"/g,"").trim()||osName;if(deviceType==="unknown"&&clientHints?.mobileHeader==="?1")deviceType="mobile";return{deviceName:browserName&&osName?`${browserName} on ${osName}`:browserName?browserName:osName?osName:deviceType!=="unknown"?deviceType.charAt(0).toUpperCase()+deviceType.slice(1):labelFromRawUserAgent(userAgent)??"Unknown Device",deviceType,browserName,browserVersion,osName,osVersion,ipAddress,userAgent,deviceHint,locationCountry:void 0,locationCity:void 0,isHeadless,isBot,isSuspicious,suspiciousPatterns}}var init_utils7=()=>{};function deviceContextFromRequest(request){let rawFwd=request.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),isPrivate=(ip)=>!ip||ip==="127.0.0.1"||ip==="::1"||ip==="localhost"||ip.startsWith("10.")||ip.startsWith("192.168.")||ip.startsWith("172.");return{ipAddress:request.headers.get("cf-connecting-ip")?.trim()||request.headers.get("true-client-ip")?.trim()||(!isPrivate(rawFwd)?rawFwd:void 0)||request.headers.get("x-real-ip")?.trim()||rawFwd||"127.0.0.1",userAgent:request.headers.get("user-agent")||"",clientHints:{uaHeader:request.headers.get("sec-ch-ua")??void 0,platformHeader:request.headers.get("sec-ch-ua-platform")??void 0,mobileHeader:request.headers.get("sec-ch-ua-mobile")??void 0}}}function ensureDeviceInfo(info,clientHints){if(info.browserName&&info.osName&&info.deviceName)return info;let parsed=info.userAgent?parseUserAgentForLogin(info.userAgent,info.ipAddress,info.deviceHint,clientHints):void 0;return{ipAddress:info.ipAddress,userAgent:info.userAgent,deviceHint:info.deviceHint,deviceName:info.deviceName??parsed?.deviceName??"Unknown Device",deviceType:info.deviceType&&info.deviceType!=="unknown"?info.deviceType:parsed?.deviceType??info.deviceType??"unknown",browserName:info.browserName??parsed?.browserName,browserVersion:info.browserVersion??parsed?.browserVersion,osName:info.osName??parsed?.osName,osVersion:info.osVersion??parsed?.osVersion,locationCountry:info.locationCountry,locationCity:info.locationCity}}var init_deviceInfo=__esm(()=>{init_utils7()});function boundedStream(source,limit){if(limit<=0)return new ReadableStream({start(controller){controller.close()},cancel:()=>source.cancel().catch(()=>{})});let reader=source.getReader(),sent=0;return new ReadableStream({async pull(controller){while(sent<limit){let{done,value:value2}=await reader.read();if(done){controller.close();return}if(!value2||value2.byteLength===0)continue;let remaining=limit-sent;if(value2.byteLength<=remaining)sent+=value2.byteLength,controller.enqueue(value2);else controller.enqueue(value2.subarray(0,remaining)),sent=limit;if(sent>=limit){controller.close(),reader.cancel().catch(()=>{});return}return}controller.close()},cancel(reason){return reader.cancel(reason).catch(()=>{})}})}import{randomUUID as randomUUID5}from"crypto";import path from"path";function unboundedIfZero(value2){return Number.isFinite(value2)&&value2>0?value2:Number.POSITIVE_INFINITY}function mergeStorageConfig(config){if(!config)return DEFAULT_STORAGE_CONFIG;return{enabled:config.enabled??DEFAULT_STORAGE_CONFIG.enabled,basePath:config.basePath??DEFAULT_STORAGE_CONFIG.basePath,maxFileSizeBytes:unboundedIfZero(config.maxFileSizeBytes??DEFAULT_STORAGE_CONFIG.maxFileSizeBytes),allowedMimeTypes:config.allowedMimeTypes??DEFAULT_STORAGE_CONFIG.allowedMimeTypes,blockedMimeTypes:config.blockedMimeTypes??DEFAULT_STORAGE_CONFIG.blockedMimeTypes,formData:{filesField:config.formData?.filesField??DEFAULT_STORAGE_CONFIG.formData.filesField,dataField:config.formData?.dataField??DEFAULT_STORAGE_CONFIG.formData.dataField,maxFiles:unboundedIfZero(config.formData?.maxFiles??DEFAULT_STORAGE_CONFIG.formData.maxFiles)}}}function normalizeMimeType(mimeType){return(mimeType??"").split(";")[0]?.trim().toLowerCase()??""}function isMimeTypeListed(list2,mimeType){if(!list2||list2.length===0)return!1;let normalized=normalizeMimeType(mimeType);if(!normalized)return!1;return list2.some((entry)=>normalizeMimeType(entry)===normalized)}function parseFormDataBody(body,config){let result={data:{},files:[]};if(!body||typeof body!=="object")return result;let bodyObj=body,dataField=bodyObj[config.formData.dataField];if(dataField){if(typeof dataField==="string")try{result.data=JSON.parse(dataField)}catch{result.data={}}else if(typeof dataField==="object")result.data=dataField}let filesField=bodyObj[config.formData.filesField];if(filesField){if(filesField instanceof File)result.files=[filesField];else if(Array.isArray(filesField))result.files=filesField.filter((f)=>f instanceof File)}return result}function validateFile(file,config){if(file.size>config.maxFileSizeBytes)return{valid:!1,error:`File ${file.name} exceeds maximum size of ${config.maxFileSizeBytes} bytes`,rejected:!0};if(isMimeTypeListed(config.blockedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not allowed`,rejected:!0};if(config.allowedMimeTypes.length>0&&!isMimeTypeListed(config.allowedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not in allowed list`,rejected:!0};return{valid:!0}}function setStorageProvider(provider){activeStorageProvider=provider}function getStorageProvider(){return activeStorageProvider}async function uploadFile(file,config,subFolder){let id=randomUUID5(),ext=path.extname(file.name),uniqueName=`${id}${ext}`,folderPath=subFolder?path.join(config.basePath,subFolder):config.basePath,provider=activeStorageProvider;if(provider&&provider.kind!=="local"){let relative=subFolder?`${subFolder}/${uniqueName}`:uniqueName;await provider.write(relative,new Uint8Array(await file.arrayBuffer()))}else await fileManager.createFile({dir:folderPath,name:uniqueName,data:file,options:{type:file.type,createDir:!0}});return{id,name:uniqueName,originalName:file.name,path:folderPath,mimeType:file.type,size:file.size,createdAt:new Date}}async function uploadFiles(files,config,subFolder){let success=[],failed=[];for(let file of files.slice(0,config.formData.maxFiles)){let validation=validateFile(file,config);if(!validation.valid){failed.push({file:file.name,error:validation.error||"Unknown error",rejected:validation.rejected===!0});continue}try{let result=await uploadFile(file,config,subFolder);success.push(result)}catch(error3){failed.push({file:file.name,error:error3 instanceof Error?error3.message:"Upload failed"})}}return{success,failed}}function isPathWithinBase(base,target2){let resolvedBase=path.resolve(base),resolvedTarget=path.resolve(target2);return resolvedTarget===resolvedBase||resolvedTarget.startsWith(resolvedBase+path.sep)}async function deleteFile(filePath,fileName,storageBase){try{let fullPath=path.join(filePath,fileName);if(storageBase&&!isPathWithinBase(storageBase,fullPath))return!1;let provider=activeStorageProvider;if(provider&&provider.kind!=="local"&&storageBase)return await provider.delete(path.relative(storageBase,fullPath));return await fileManager.deleteFile(fullPath)}catch{return!1}}var DEFAULT_STORAGE_CONFIG,activeStorageProvider=null;var init_helpers3=__esm(()=>{init_File();DEFAULT_STORAGE_CONFIG={enabled:!1,basePath:"./uploads",maxFileSizeBytes:104857600,allowedMimeTypes:[],blockedMimeTypes:["application/x-executable","application/x-msdos-program","text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/x-httpd-php"],formData:{filesField:"files",dataField:"data",maxFiles:10}}});import{readFileSync as readFileSync4}from"fs";import*as os3 from"os";function parseCpuMax(raw){if(!raw)return null;let[quota,period]=raw.trim().split(/\s+/);if(!quota||quota==="max")return null;let q=Number(quota),p=Number(period??"100000");if(!Number.isFinite(q)||!Number.isFinite(p)||p<=0||q<=0)return null;return q/p}function parseCpuV1(quotaRaw,periodRaw){let q=Number((quotaRaw??"").trim()),p=Number((periodRaw??"").trim());if(!Number.isFinite(q)||q<=0||!Number.isFinite(p)||p<=0)return null;return q/p}function read(path2){try{return readFileSync4(path2,"utf8")}catch{return null}}function cpuBudget(sources={}){let cores=sources.cores??os3.cpus().length??1,limit=parseCpuMax(sources.cpuMax??read("/sys/fs/cgroup/cpu.max"))??parseCpuV1(sources.v1Quota??read("/sys/fs/cgroup/cpu/cpu.cfs_quota_us"),sources.v1Period??read("/sys/fs/cgroup/cpu/cpu.cfs_period_us"));if(limit===null)return Math.max(1,cores);return Math.max(1,Math.min(cores,Math.ceil(limit)))}var init_cpuBudget=()=>{};var require_is=__commonJS((exports,module3)=>{var defined=function(val){return typeof val<"u"&&val!==null},object3=function(val){return typeof val==="object"},plainObject=function(val){return Object.prototype.toString.call(val)==="[object Object]"},fn=function(val){return typeof val==="function"},bool=function(val){return typeof val==="boolean"},buffer=function(val){return val instanceof Buffer},typedArray=function(val){if(defined(val))switch(val.constructor){case Uint8Array:case Uint8ClampedArray:case Int8Array:case Uint16Array:case Int16Array:case Uint32Array:case Int32Array:case Float32Array:case Float64Array:return!0}return!1},arrayBuffer=function(val){return val instanceof ArrayBuffer},string3=function(val){return typeof val==="string"&&val.length>0},number3=function(val){return typeof val==="number"&&!Number.isNaN(val)},integer3=function(val){return Number.isInteger(val)},inRange=function(val,min,max){return val>=min&&val<=max},inArray11=function(val,list2){return list2.includes(val)},invalidParameterError=function(name2,expected,actual){return Error(`Expected ${expected} for ${name2} but received ${actual} of type ${typeof actual}`)},nativeError=function(native,context){return context.message=native.message,context};module3.exports={defined,object:object3,plainObject,fn,bool,buffer,typedArray,arrayBuffer,string:string3,number:number3,integer:integer3,inRange,inArray:inArray11,invalidParameterError,nativeError}});var require_process=__commonJS((exports,module3)=>{var isLinux=()=>process.platform==="linux",report=null,getReport=()=>{if(!report)if(isLinux()&&process.report){let orig=process.report.excludeNetwork;process.report.excludeNetwork=!0,report=process.report.getReport(),process.report.excludeNetwork=orig}else report={};return report};module3.exports={isLinux,getReport}});var require_filesystem=__commonJS((exports,module3)=>{var fs3=__require("fs"),readFileSync5=(path2)=>{let fd=fs3.openSync(path2,"r"),buffer=Buffer.alloc(2048),bytesRead=fs3.readSync(fd,buffer,0,2048,0);return fs3.close(fd,()=>{}),buffer.subarray(0,bytesRead)},readFile2=(path2)=>new Promise((resolve2,reject)=>{fs3.open(path2,"r",(err,fd)=>{if(err)reject(err);else{let buffer=Buffer.alloc(2048);fs3.read(fd,buffer,0,2048,0,(_,bytesRead)=>{resolve2(buffer.subarray(0,bytesRead)),fs3.close(fd,()=>{})})}})});module3.exports={LDD_PATH:"/usr/bin/ldd",SELF_PATH:"/proc/self/exe",readFileSync:readFileSync5,readFile:readFile2}});var require_elf=__commonJS((exports,module3)=>{var interpreterPath=(elf)=>{if(elf.length<64)return null;if(elf.readUInt32BE(0)!==2135247942)return null;if(elf.readUInt8(4)!==2)return null;if(elf.readUInt8(5)!==1)return null;let offset=elf.readUInt32LE(32),size=elf.readUInt16LE(54),count2=elf.readUInt16LE(56);for(let i=0;i<count2;i++){let headerOffset=offset+i*size;if(elf.readUInt32LE(headerOffset)===3){let fileOffset=elf.readUInt32LE(headerOffset+8),fileSize=elf.readUInt32LE(headerOffset+32);return elf.subarray(fileOffset,fileOffset+fileSize).toString().replace(/\0.*$/g,"")}}return null};module3.exports={interpreterPath}});var require_detect_libc=__commonJS((exports,module3)=>{var childProcess=__require("child_process"),{isLinux,getReport}=require_process(),{LDD_PATH,SELF_PATH,readFile:readFile2,readFileSync:readFileSync5}=require_filesystem(),{interpreterPath}=require_elf(),cachedFamilyInterpreter,cachedFamilyFilesystem,cachedVersionFilesystem,commandOut="",safeCommand=()=>{if(!commandOut)return new Promise((resolve2)=>{childProcess.exec("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",(err,out)=>{commandOut=err?" ":out,resolve2(commandOut)})});return commandOut},safeCommandSync=()=>{if(!commandOut)try{commandOut=childProcess.execSync("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",{encoding:"utf8"})}catch(_err){commandOut=" "}return commandOut},GLIBC="glibc",RE_GLIBC_VERSION=/LIBC[a-z0-9 \-).]*?(\d+\.\d+)/i,MUSL="musl",isFileMusl=(f)=>f.includes("libc.musl-")||f.includes("ld-musl-"),familyFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return GLIBC;if(Array.isArray(report.sharedObjects)){if(report.sharedObjects.some(isFileMusl))return MUSL}return null},familyFromCommand=(out)=>{let[getconf,ldd1]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return GLIBC;if(ldd1&&ldd1.includes(MUSL))return MUSL;return null},familyFromInterpreterPath=(path2)=>{if(path2){if(path2.includes("/ld-musl-"))return MUSL;else if(path2.includes("/ld-linux-"))return GLIBC}return null},getFamilyFromLddContent=(content)=>{if(content=content.toString(),content.includes("musl"))return MUSL;if(content.includes("GNU C Library"))return GLIBC;return null},familyFromFilesystem=async()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=await readFile2(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromFilesystemSync=()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=readFileSync5(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromInterpreter=async()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=await readFile2(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},familyFromInterpreterSync=()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=readFileSync5(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},family=async()=>{let family2=null;if(isLinux()){if(family2=await familyFromInterpreter(),!family2){if(family2=await familyFromFilesystem(),!family2)family2=familyFromReport();if(!family2){let out=await safeCommand();family2=familyFromCommand(out)}}}return family2},familySync=()=>{let family2=null;if(isLinux()){if(family2=familyFromInterpreterSync(),!family2){if(family2=familyFromFilesystemSync(),!family2)family2=familyFromReport();if(!family2){let out=safeCommandSync();family2=familyFromCommand(out)}}}return family2},isNonGlibcLinux=async()=>isLinux()&&await family()!==GLIBC,isNonGlibcLinuxSync=()=>isLinux()&&familySync()!==GLIBC,versionFromFilesystem=async()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=(await readFile2(LDD_PATH)).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromFilesystemSync=()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=readFileSync5(LDD_PATH).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return report.header.glibcVersionRuntime;return null},versionSuffix=(s)=>s.trim().split(/\s+/)[1],versionFromCommand=(out)=>{let[getconf,ldd1,ldd2]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return versionSuffix(getconf);if(ldd1&&ldd2&&ldd1.includes(MUSL))return versionSuffix(ldd2);return null},version=async()=>{let version2=null;if(isLinux()){if(version2=await versionFromFilesystem(),!version2)version2=versionFromReport();if(!version2){let out=await safeCommand();version2=versionFromCommand(out)}}return version2},versionSync=()=>{let version2=null;if(isLinux()){if(version2=versionFromFilesystemSync(),!version2)version2=versionFromReport();if(!version2){let out=safeCommandSync();version2=versionFromCommand(out)}}return version2};module3.exports={GLIBC,MUSL,family,familySync,isNonGlibcLinux,isNonGlibcLinuxSync,version,versionSync}});var require_debug=__commonJS((exports,module3)=>{var debug=typeof process==="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...args)=>console.error("SEMVER",...args):()=>{};module3.exports=debug});var require_constants2=__commonJS((exports,module3)=>{var MAX_SAFE_INTEGER=Number.MAX_SAFE_INTEGER||9007199254740991,RELEASE_TYPES=["major","premajor","minor","preminor","patch","prepatch","prerelease"];module3.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER,RELEASE_TYPES,SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var require_re=__commonJS((exports,module3)=>{var{MAX_SAFE_COMPONENT_LENGTH,MAX_SAFE_BUILD_LENGTH,MAX_LENGTH}=require_constants2(),debug=require_debug();exports=module3.exports={};var re=exports.re=[],safeRe=exports.safeRe=[],src=exports.src=[],safeSrc=exports.safeSrc=[],t=exports.t={},R=0,LETTERDASHNUMBER="[a-zA-Z0-9-]",safeRegexReplacements=[["\\s",1],["\\d",MAX_LENGTH],[LETTERDASHNUMBER,MAX_SAFE_BUILD_LENGTH]],makeSafeRegex=(value2)=>{for(let[token,max]of safeRegexReplacements)value2=value2.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);return value2},createToken=(name2,value2,isGlobal)=>{let safe=makeSafeRegex(value2),index=R++;debug(name2,index,value2),t[name2]=index,src[index]=value2,safeSrc[index]=safe,re[index]=new RegExp(value2,isGlobal?"g":void 0),safeRe[index]=new RegExp(safe,isGlobal?"g":void 0)};createToken("NUMERICIDENTIFIER","0|[1-9]\\d*");createToken("NUMERICIDENTIFIERLOOSE","\\d+");createToken("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);createToken("MAINVERSION",`(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);createToken("MAINVERSIONLOOSE",`(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASEIDENTIFIER",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);createToken("PRERELEASEIDENTIFIERLOOSE",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASE",`(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);createToken("PRERELEASELOOSE",`(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);createToken("BUILDIDENTIFIER",`${LETTERDASHNUMBER}+`);createToken("BUILD",`(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);createToken("FULLPLAIN",`v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);createToken("FULL",`^${src[t.FULLPLAIN]}$`);createToken("LOOSEPLAIN",`[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);createToken("LOOSE",`^${src[t.LOOSEPLAIN]}$`);createToken("GTLT","((?:<|>)?=?)");createToken("XRANGEIDENTIFIERLOOSE",`${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);createToken("XRANGEIDENTIFIER",`${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);createToken("XRANGEPLAIN",`[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGEPLAINLOOSE",`[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);createToken("XRANGELOOSE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);createToken("COERCEPLAIN",`(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);createToken("COERCE",`${src[t.COERCEPLAIN]}(?:$|[^\\d])`);createToken("COERCEFULL",src[t.COERCEPLAIN]+`(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);createToken("COERCERTL",src[t.COERCE],!0);createToken("COERCERTLFULL",src[t.COERCEFULL],!0);createToken("LONETILDE","(?:~>?)");createToken("TILDETRIM",`(\\s*)${src[t.LONETILDE]}\\s+`,!0);exports.tildeTrimReplace="$1~";createToken("TILDE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);createToken("TILDELOOSE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("LONECARET","(?:\\^)");createToken("CARETTRIM",`(\\s*)${src[t.LONECARET]}\\s+`,!0);exports.caretTrimReplace="$1^";createToken("CARET",`^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);createToken("CARETLOOSE",`^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("COMPARATORLOOSE",`^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);createToken("COMPARATOR",`^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);createToken("COMPARATORTRIM",`(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`,!0);exports.comparatorTrimReplace="$1$2$3";createToken("HYPHENRANGE",`^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);createToken("HYPHENRANGELOOSE",`^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);createToken("STAR","(<|>)?=?\\s*\\*");createToken("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");createToken("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var require_parse_options=__commonJS((exports,module3)=>{var looseOption=Object.freeze({loose:!0}),emptyOpts=Object.freeze({}),parseOptions=(options)=>{if(!options)return emptyOpts;if(typeof options!=="object")return looseOption;return options};module3.exports=parseOptions});var require_identifiers=__commonJS((exports,module3)=>{var numeric=/^[0-9]+$/,compareIdentifiers=(a,b)=>{if(typeof a==="number"&&typeof b==="number")return a===b?0:a<b?-1:1;let anum=numeric.test(a),bnum=numeric.test(b);if(anum&&bnum)a=+a,b=+b;return a===b?0:anum&&!bnum?-1:bnum&&!anum?1:a<b?-1:1},rcompareIdentifiers=(a,b)=>compareIdentifiers(b,a);module3.exports={compareIdentifiers,rcompareIdentifiers}});var require_semver=__commonJS((exports,module3)=>{var debug=require_debug(),{MAX_LENGTH,MAX_SAFE_INTEGER}=require_constants2(),{safeRe:re,t}=require_re(),parseOptions=require_parse_options(),{compareIdentifiers}=require_identifiers();class SemVer{constructor(version,options){if(options=parseOptions(options),version instanceof SemVer)if(version.loose===!!options.loose&&version.includePrerelease===!!options.includePrerelease)return version;else version=version.version;else if(typeof version!=="string")throw TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);if(version.length>MAX_LENGTH)throw TypeError(`version is longer than ${MAX_LENGTH} characters`);debug("SemVer",version,options),this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease;let m=version.trim().match(options.loose?re[t.LOOSE]:re[t.FULL]);if(!m)throw TypeError(`Invalid Version: ${version}`);if(this.raw=version,this.major=+m[1],this.minor=+m[2],this.patch=+m[3],this.major>MAX_SAFE_INTEGER||this.major<0)throw TypeError("Invalid major version");if(this.minor>MAX_SAFE_INTEGER||this.minor<0)throw TypeError("Invalid minor version");if(this.patch>MAX_SAFE_INTEGER||this.patch<0)throw TypeError("Invalid patch version");if(!m[4])this.prerelease=[];else this.prerelease=m[4].split(".").map((id)=>{if(/^[0-9]+$/.test(id)){let num3=+id;if(num3>=0&&num3<MAX_SAFE_INTEGER)return num3}return id});this.build=m[5]?m[5].split("."):[],this.format()}format(){if(this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length)this.version+=`-${this.prerelease.join(".")}`;return this.version}toString(){return this.version}compare(other){if(debug("SemVer.compare",this.version,this.options,other),!(other instanceof SemVer)){if(typeof other==="string"&&other===this.version)return 0;other=new SemVer(other,this.options)}if(other.version===this.version)return 0;return this.compareMain(other)||this.comparePre(other)}compareMain(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.major<other.major)return-1;if(this.major>other.major)return 1;if(this.minor<other.minor)return-1;if(this.minor>other.minor)return 1;if(this.patch<other.patch)return-1;if(this.patch>other.patch)return 1;return 0}comparePre(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.prerelease.length&&!other.prerelease.length)return-1;else if(!this.prerelease.length&&other.prerelease.length)return 1;else if(!this.prerelease.length&&!other.prerelease.length)return 0;let i=0;do{let a=this.prerelease[i],b=other.prerelease[i];if(debug("prerelease compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}compareBuild(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);let i=0;do{let a=this.build[i],b=other.build[i];if(debug("build compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}inc(release,identifier,identifierBase){if(release.startsWith("pre")){if(!identifier&&identifierBase===!1)throw Error("invalid increment argument: identifier is empty");if(identifier){let match=`-${identifier}`.match(this.options.loose?re[t.PRERELEASELOOSE]:re[t.PRERELEASE]);if(!match||match[1]!==identifier)throw Error(`invalid identifier: ${identifier}`)}}switch(release){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",identifier,identifierBase);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",identifier,identifierBase);break;case"prepatch":this.prerelease.length=0,this.inc("patch",identifier,identifierBase),this.inc("pre",identifier,identifierBase);break;case"prerelease":if(this.prerelease.length===0)this.inc("patch",identifier,identifierBase);this.inc("pre",identifier,identifierBase);break;case"release":if(this.prerelease.length===0)throw Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":if(this.minor!==0||this.patch!==0||this.prerelease.length===0)this.major++;this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":if(this.patch!==0||this.prerelease.length===0)this.minor++;this.patch=0,this.prerelease=[];break;case"patch":if(this.prerelease.length===0)this.patch++;this.prerelease=[];break;case"pre":{let base=Number(identifierBase)?1:0;if(this.prerelease.length===0)this.prerelease=[base];else{let i=this.prerelease.length;while(--i>=0)if(typeof this.prerelease[i]==="number")this.prerelease[i]++,i=-2;if(i===-1){if(identifier===this.prerelease.join(".")&&identifierBase===!1)throw Error("invalid increment argument: identifier already exists");this.prerelease.push(base)}}if(identifier){let prerelease=[identifier,base];if(identifierBase===!1)prerelease=[identifier];if(compareIdentifiers(this.prerelease[0],identifier)===0){if(isNaN(this.prerelease[1]))this.prerelease=prerelease}else this.prerelease=prerelease}break}default:throw Error(`invalid increment argument: ${release}`)}if(this.raw=this.format(),this.build.length)this.raw+=`+${this.build.join(".")}`;return this}}module3.exports=SemVer});var require_parse=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=(version,options,throwErrors=!1)=>{if(version instanceof SemVer)return version;try{return new SemVer(version,options)}catch(er){if(!throwErrors)return null;throw er}};module3.exports=parse3});var require_coerce=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=require_parse(),{safeRe:re,t}=require_re(),coerce2=(version,options)=>{if(version instanceof SemVer)return version;if(typeof version==="number")version=String(version);if(typeof version!=="string")return null;options=options||{};let match=null;if(!options.rtl)match=version.match(options.includePrerelease?re[t.COERCEFULL]:re[t.COERCE]);else{let coerceRtlRegex=options.includePrerelease?re[t.COERCERTLFULL]:re[t.COERCERTL],next;while((next=coerceRtlRegex.exec(version))&&(!match||match.index+match[0].length!==version.length)){if(!match||next.index+next[0].length!==match.index+match[0].length)match=next;coerceRtlRegex.lastIndex=next.index+next[1].length+next[2].length}coerceRtlRegex.lastIndex=-1}if(match===null)return null;let major=match[2],minor=match[3]||"0",patch=match[4]||"0",prerelease=options.includePrerelease&&match[5]?`-${match[5]}`:"",build=options.includePrerelease&&match[6]?`+${match[6]}`:"";return parse3(`${major}.${minor}.${patch}${prerelease}${build}`,options)};module3.exports=coerce2});var require_compare=__commonJS((exports,module3)=>{var SemVer=require_semver(),compare2=(a,b,loose)=>new SemVer(a,loose).compare(new SemVer(b,loose));module3.exports=compare2});var require_gte=__commonJS((exports,module3)=>{var compare2=require_compare(),gte=(a,b,loose)=>compare2(a,b,loose)>=0;module3.exports=gte});var require_lrucache=__commonJS((exports,module3)=>{class LRUCache{constructor(){this.max=1000,this.map=new Map}get(key2){let value2=this.map.get(key2);if(value2===void 0)return;else return this.map.delete(key2),this.map.set(key2,value2),value2}delete(key2){return this.map.delete(key2)}set(key2,value2){if(!this.delete(key2)&&value2!==void 0){if(this.map.size>=this.max){let firstKey=this.map.keys().next().value;this.delete(firstKey)}this.map.set(key2,value2)}return this}}module3.exports=LRUCache});var require_eq=__commonJS((exports,module3)=>{var compare2=require_compare(),eq31=(a,b,loose)=>compare2(a,b,loose)===0;module3.exports=eq31});var require_neq=__commonJS((exports,module3)=>{var compare2=require_compare(),neq=(a,b,loose)=>compare2(a,b,loose)!==0;module3.exports=neq});var require_gt=__commonJS((exports,module3)=>{var compare2=require_compare(),gt=(a,b,loose)=>compare2(a,b,loose)>0;module3.exports=gt});var require_lt=__commonJS((exports,module3)=>{var compare2=require_compare(),lt2=(a,b,loose)=>compare2(a,b,loose)<0;module3.exports=lt2});var require_lte=__commonJS((exports,module3)=>{var compare2=require_compare(),lte=(a,b,loose)=>compare2(a,b,loose)<=0;module3.exports=lte});var require_cmp=__commonJS((exports,module3)=>{var eq31=require_eq(),neq=require_neq(),gt=require_gt(),gte=require_gte(),lt2=require_lt(),lte=require_lte(),cmp=(a,op,b,loose)=>{switch(op){case"===":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a===b;case"!==":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a!==b;case"":case"=":case"==":return eq31(a,b,loose);case"!=":return neq(a,b,loose);case">":return gt(a,b,loose);case">=":return gte(a,b,loose);case"<":return lt2(a,b,loose);case"<=":return lte(a,b,loose);default:throw TypeError(`Invalid operator: ${op}`)}};module3.exports=cmp});var require_comparator=__commonJS((exports,module3)=>{var ANY=Symbol("SemVer ANY");class Comparator{static get ANY(){return ANY}constructor(comp,options){if(options=parseOptions(options),comp instanceof Comparator)if(comp.loose===!!options.loose)return comp;else comp=comp.value;if(comp=comp.trim().split(/\s+/).join(" "),debug("comparator",comp,options),this.options=options,this.loose=!!options.loose,this.parse(comp),this.semver===ANY)this.value="";else this.value=this.operator+this.semver.version;debug("comp",this)}parse(comp){let r=this.options.loose?re[t.COMPARATORLOOSE]:re[t.COMPARATOR],m=comp.match(r);if(!m)throw TypeError(`Invalid comparator: ${comp}`);if(this.operator=m[1]!==void 0?m[1]:"",this.operator==="=")this.operator="";if(!m[2])this.semver=ANY;else this.semver=new SemVer(m[2],this.options.loose)}toString(){return this.value}test(version){if(debug("Comparator.test",version,this.options.loose),this.semver===ANY||version===ANY)return!0;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}return cmp(version,this.operator,this.semver,this.options)}intersects(comp,options){if(!(comp instanceof Comparator))throw TypeError("a Comparator is required");if(this.operator===""){if(this.value==="")return!0;return new Range(comp.value,options).test(this.value)}else if(comp.operator===""){if(comp.value==="")return!0;return new Range(this.value,options).test(comp.semver)}if(options=parseOptions(options),options.includePrerelease&&(this.value==="<0.0.0-0"||comp.value==="<0.0.0-0"))return!1;if(!options.includePrerelease&&(this.value.startsWith("<0.0.0")||comp.value.startsWith("<0.0.0")))return!1;if(this.operator.startsWith(">")&&comp.operator.startsWith(">"))return!0;if(this.operator.startsWith("<")&&comp.operator.startsWith("<"))return!0;if(this.semver.version===comp.semver.version&&this.operator.includes("=")&&comp.operator.includes("="))return!0;if(cmp(this.semver,"<",comp.semver,options)&&this.operator.startsWith(">")&&comp.operator.startsWith("<"))return!0;if(cmp(this.semver,">",comp.semver,options)&&this.operator.startsWith("<")&&comp.operator.startsWith(">"))return!0;return!1}}module3.exports=Comparator;var parseOptions=require_parse_options(),{safeRe:re,t}=require_re(),cmp=require_cmp(),debug=require_debug(),SemVer=require_semver(),Range=require_range()});var require_range=__commonJS((exports,module3)=>{var SPACE_CHARACTERS=/\s+/g;class Range{constructor(range,options){if(options=parseOptions(options),range instanceof Range)if(range.loose===!!options.loose&&range.includePrerelease===!!options.includePrerelease)return range;else return new Range(range.raw,options);if(range instanceof Comparator)return this.raw=range.value,this.set=[[range]],this.formatted=void 0,this;if(this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease,this.raw=range.trim().replace(SPACE_CHARACTERS," "),this.set=this.raw.split("||").map((r)=>this.parseRange(r.trim())).filter((c)=>c.length),!this.set.length)throw TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let first=this.set[0];if(this.set=this.set.filter((c)=>!isNullSet(c[0])),this.set.length===0)this.set=[first];else if(this.set.length>1){for(let c of this.set)if(c.length===1&&isAny(c[0])){this.set=[c];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let i=0;i<this.set.length;i++){if(i>0)this.formatted+="||";let comps=this.set[i];for(let k=0;k<comps.length;k++){if(k>0)this.formatted+=" ";this.formatted+=comps[k].toString().trim()}}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(range){let memoKey=((this.options.includePrerelease&&FLAG_INCLUDE_PRERELEASE)|(this.options.loose&&FLAG_LOOSE))+":"+range,cached=cache.get(memoKey);if(cached)return cached;let loose=this.options.loose,hr=loose?re[t.HYPHENRANGELOOSE]:re[t.HYPHENRANGE];range=range.replace(hr,hyphenReplace(this.options.includePrerelease)),debug("hyphen replace",range),range=range.replace(re[t.COMPARATORTRIM],comparatorTrimReplace),debug("comparator trim",range),range=range.replace(re[t.TILDETRIM],tildeTrimReplace),debug("tilde trim",range),range=range.replace(re[t.CARETTRIM],caretTrimReplace),debug("caret trim",range);let rangeList=range.split(" ").map((comp)=>parseComparator(comp,this.options)).join(" ").split(/\s+/).map((comp)=>replaceGTE0(comp,this.options));if(loose)rangeList=rangeList.filter((comp)=>{return debug("loose invalid filter",comp,this.options),!!comp.match(re[t.COMPARATORLOOSE])});debug("range list",rangeList);let rangeMap=new Map,comparators=rangeList.map((comp)=>new Comparator(comp,this.options));for(let comp of comparators){if(isNullSet(comp))return[comp];rangeMap.set(comp.value,comp)}if(rangeMap.size>1&&rangeMap.has(""))rangeMap.delete("");let result=[...rangeMap.values()];return cache.set(memoKey,result),result}intersects(range,options){if(!(range instanceof Range))throw TypeError("a Range is required");return this.set.some((thisComparators)=>{return isSatisfiable(thisComparators,options)&&range.set.some((rangeComparators)=>{return isSatisfiable(rangeComparators,options)&&thisComparators.every((thisComparator)=>{return rangeComparators.every((rangeComparator)=>{return thisComparator.intersects(rangeComparator,options)})})})})}test(version){if(!version)return!1;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}for(let i=0;i<this.set.length;i++)if(testSet(this.set[i],version,this.options))return!0;return!1}}module3.exports=Range;var LRU=require_lrucache(),cache=new LRU,parseOptions=require_parse_options(),Comparator=require_comparator(),debug=require_debug(),SemVer=require_semver(),{safeRe:re,t,comparatorTrimReplace,tildeTrimReplace,caretTrimReplace}=require_re(),{FLAG_INCLUDE_PRERELEASE,FLAG_LOOSE}=require_constants2(),isNullSet=(c)=>c.value==="<0.0.0-0",isAny=(c)=>c.value==="",isSatisfiable=(comparators,options)=>{let result=!0,remainingComparators=comparators.slice(),testComparator=remainingComparators.pop();while(result&&remainingComparators.length)result=remainingComparators.every((otherComparator)=>{return testComparator.intersects(otherComparator,options)}),testComparator=remainingComparators.pop();return result},parseComparator=(comp,options)=>{return comp=comp.replace(re[t.BUILD],""),debug("comp",comp,options),comp=replaceCarets(comp,options),debug("caret",comp),comp=replaceTildes(comp,options),debug("tildes",comp),comp=replaceXRanges(comp,options),debug("xrange",comp),comp=replaceStars(comp,options),debug("stars",comp),comp},isX=(id)=>!id||id.toLowerCase()==="x"||id==="*",replaceTildes=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceTilde(c,options)).join(" ")},replaceTilde=(comp,options)=>{let r=options.loose?re[t.TILDELOOSE]:re[t.TILDE];return comp.replace(r,(_,M,m,p,pr)=>{debug("tilde",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0 <${+M+1}.0.0-0`;else if(isX(p))ret=`>=${M}.${m}.0 <${M}.${+m+1}.0-0`;else if(pr)debug("replaceTilde pr",pr),ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${M}.${+m+1}.0-0`;return debug("tilde return",ret),ret})},replaceCarets=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceCaret(c,options)).join(" ")},replaceCaret=(comp,options)=>{debug("caret",comp,options);let r=options.loose?re[t.CARETLOOSE]:re[t.CARET],z=options.includePrerelease?"-0":"";return comp.replace(r,(_,M,m,p,pr)=>{debug("caret",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0${z} <${+M+1}.0.0-0`;else if(isX(p))if(M==="0")ret=`>=${M}.${m}.0${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.0${z} <${+M+1}.0.0-0`;else if(pr)if(debug("replaceCaret pr",pr),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p}-${pr} <${+M+1}.0.0-0`;else if(debug("no pr"),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}${z} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${+M+1}.0.0-0`;return debug("caret return",ret),ret})},replaceXRanges=(comp,options)=>{return debug("replaceXRanges",comp,options),comp.split(/\s+/).map((c)=>replaceXRange(c,options)).join(" ")},replaceXRange=(comp,options)=>{comp=comp.trim();let r=options.loose?re[t.XRANGELOOSE]:re[t.XRANGE];return comp.replace(r,(ret,gtlt,M,m,p,pr)=>{debug("xRange",comp,ret,gtlt,M,m,p,pr);let xM=isX(M),xm=xM||isX(m),xp=xm||isX(p),anyX=xp;if(gtlt==="="&&anyX)gtlt="";if(pr=options.includePrerelease?"-0":"",xM)if(gtlt===">"||gtlt==="<")ret="<0.0.0-0";else ret="*";else if(gtlt&&anyX){if(xm)m=0;if(p=0,gtlt===">")if(gtlt=">=",xm)M=+M+1,m=0,p=0;else m=+m+1,p=0;else if(gtlt==="<=")if(gtlt="<",xm)M=+M+1;else m=+m+1;if(gtlt==="<")pr="-0";ret=`${gtlt+M}.${m}.${p}${pr}`}else if(xm)ret=`>=${M}.0.0${pr} <${+M+1}.0.0-0`;else if(xp)ret=`>=${M}.${m}.0${pr} <${M}.${+m+1}.0-0`;return debug("xRange return",ret),ret})},replaceStars=(comp,options)=>{return debug("replaceStars",comp,options),comp.trim().replace(re[t.STAR],"")},replaceGTE0=(comp,options)=>{return debug("replaceGTE0",comp,options),comp.trim().replace(re[options.includePrerelease?t.GTE0PRE:t.GTE0],"")},hyphenReplace=(incPr)=>($0,from,fM,fm,fp,fpr,fb,to,tM,tm,tp,tpr)=>{if(isX(fM))from="";else if(isX(fm))from=`>=${fM}.0.0${incPr?"-0":""}`;else if(isX(fp))from=`>=${fM}.${fm}.0${incPr?"-0":""}`;else if(fpr)from=`>=${from}`;else from=`>=${from}${incPr?"-0":""}`;if(isX(tM))to="";else if(isX(tm))to=`<${+tM+1}.0.0-0`;else if(isX(tp))to=`<${tM}.${+tm+1}.0-0`;else if(tpr)to=`<=${tM}.${tm}.${tp}-${tpr}`;else if(incPr)to=`<${tM}.${tm}.${+tp+1}-0`;else to=`<=${to}`;return`${from} ${to}`.trim()},testSet=(set2,version,options)=>{for(let i=0;i<set2.length;i++)if(!set2[i].test(version))return!1;if(version.prerelease.length&&!options.includePrerelease){for(let i=0;i<set2.length;i++){if(debug(set2[i].semver),set2[i].semver===Comparator.ANY)continue;if(set2[i].semver.prerelease.length>0){let allowed=set2[i].semver;if(allowed.major===version.major&&allowed.minor===version.minor&&allowed.patch===version.patch)return!0}}return!1}return!0}});var require_satisfies=__commonJS((exports,module3)=>{var Range=require_range(),satisfies=(version,range,options)=>{try{range=new Range(range,options)}catch(er){return!1}return range.test(version)};module3.exports=satisfies});var require_package=__commonJS((exports,module3)=>{module3.exports={name:"sharp",description:"High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",version:"0.33.5",author:"Lovell Fuller <npm@lovell.info>",homepage:"https://sharp.pixelplumbing.com",contributors:["Pierre Inglebert <pierre.inglebert@gmail.com>","Jonathan Ong <jonathanrichardong@gmail.com>","Chanon Sajjamanochai <chanon.s@gmail.com>","Juliano Julio <julianojulio@gmail.com>","Daniel Gasienica <daniel@gasienica.ch>","Julian Walker <julian@fiftythree.com>","Amit Pitaru <pitaru.amit@gmail.com>","Brandon Aaron <hello.brandon@aaron.sh>","Andreas Lind <andreas@one.com>","Maurus Cuelenaere <mcuelenaere@gmail.com>","Linus Unneb\xE4ck <linus@folkdatorn.se>","Victor Mateevitsi <mvictoras@gmail.com>","Alaric Holloway <alaric.holloway@gmail.com>","Bernhard K. Weisshuhn <bkw@codingforce.com>","Chris Riley <criley@primedia.com>","David Carley <dacarley@gmail.com>","John Tobin <john@limelightmobileinc.com>","Kenton Gray <kentongray@gmail.com>","Felix B\xFCnemann <Felix.Buenemann@gmail.com>","Samy Al Zahrani <samyalzahrany@gmail.com>","Chintan Thakkar <lemnisk8@gmail.com>","F. Orlando Galashan <frulo@gmx.de>","Kleis Auke Wolthuizen <info@kleisauke.nl>","Matt Hirsch <mhirsch@media.mit.edu>","Matthias Thoemmes <thoemmes@gmail.com>","Patrick Paskaris <patrick@paskaris.gr>","J\xE9r\xE9my Lal <kapouer@melix.org>","Rahul Nanwani <r.nanwani@gmail.com>","Alice Monday <alice0meta@gmail.com>","Kristo Jorgenson <kristo.jorgenson@gmail.com>","YvesBos <yves_bos@outlook.com>","Guy Maliar <guy@tailorbrands.com>","Nicolas Coden <nicolas@ncoden.fr>","Matt Parrish <matt.r.parrish@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Matthew McEachen <matthew+github@mceachen.org>","Jarda Kot\u011B\u0161ovec <jarda.kotesovec@gmail.com>","Kenric D'Souza <kenric.dsouza@gmail.com>","Oleh Aleinyk <oleg.aleynik@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Andrea Bianco <andrea.bianco@unibas.ch>","Rik Heywood <rik@rik.org>","Thomas Parisot <hi@oncletom.io>","Nathan Graves <nathanrgraves+github@gmail.com>","Tom Lokhorst <tom@lokhorst.eu>","Espen Hovlandsdal <espen@hovlandsdal.com>","Sylvain Dumont <sylvain.dumont35@gmail.com>","Alun Davies <alun.owain.davies@googlemail.com>","Aidan Hoolachan <ajhoolachan21@gmail.com>","Axel Eirola <axel.eirola@iki.fi>","Freezy <freezy@xbmc.org>","Daiz <taneli.vatanen@gmail.com>","Julian Aubourg <j@ubourg.net>","Keith Belovay <keith@picthrive.com>","Michael B. Klein <mbklein@gmail.com>","Jordan Prudhomme <jordan@raboland.fr>","Ilya Ovdin <iovdin@gmail.com>","Andargor <andargor@yahoo.com>","Paul Neave <paul.neave@gmail.com>","Brendan Kennedy <brenwken@gmail.com>","Brychan Bennett-Odlum <git@brychan.io>","Edward Silverton <e.silverton@gmail.com>","Roman Malieiev <aromaleev@gmail.com>","Tomas Szabo <tomas.szabo@deftomat.com>","Robert O'Rourke <robert@o-rourke.org>","Guillermo Alfonso Varela Chouci\xF1o <guillevch@gmail.com>","Christian Flintrup <chr@gigahost.dk>","Manan Jadhav <manan@motionden.com>","Leon Radley <leon@radley.se>","alza54 <alza54@thiocod.in>","Jacob Smith <jacob@frende.me>","Michael Nutt <michael@nutt.im>","Brad Parham <baparham@gmail.com>","Taneli Vatanen <taneli.vatanen@gmail.com>","Joris Dugu\xE9 <zaruike10@gmail.com>","Chris Banks <christopher.bradley.banks@gmail.com>","Ompal Singh <ompal.hitm09@gmail.com>","Brodan <christopher.hranj@gmail.com>","Ankur Parihar <ankur.github@gmail.com>","Brahim Ait elhaj <brahima@gmail.com>","Mart Jansink <m.jansink@gmail.com>","Lachlan Newman <lachnewman007@gmail.com>","Dennis Beatty <dennis@dcbeatty.com>","Ingvar Stepanyan <me@rreverser.com>","Don Denton <don@happycollision.com>"],scripts:{install:"node install/check",clean:"rm -rf src/build/ .nyc_output/ coverage/ test/fixtures/output.*",test:"npm run test-lint && npm run test-unit && npm run test-licensing && npm run test-types","test-lint":"semistandard && cpplint","test-unit":"nyc --reporter=lcov --reporter=text --check-coverage --branches=100 mocha","test-licensing":'license-checker --production --summary --onlyAllow="Apache-2.0;BSD;ISC;LGPL-3.0-or-later;MIT"',"test-leak":"./test/leak/leak.sh","test-types":"tsd","package-from-local-build":"node npm/from-local-build","package-from-github-release":"node npm/from-github-release","docs-build":"node docs/build && node docs/search-index/build","docs-serve":"cd docs && npx serve","docs-publish":"cd docs && npx firebase-tools deploy --project pixelplumbing --only hosting:pixelplumbing-sharp"},type:"commonjs",main:"lib/index.js",types:"lib/index.d.ts",files:["install","lib","src/*.{cc,h,gyp}"],repository:{type:"git",url:"git://github.com/lovell/sharp.git"},keywords:["jpeg","png","webp","avif","tiff","gif","svg","jp2","dzi","image","resize","thumbnail","crop","embed","libvips","vips"],dependencies:{color:"^4.2.3","detect-libc":"^2.0.3",semver:"^7.6.3"},optionalDependencies:{"@img/sharp-darwin-arm64":"0.33.5","@img/sharp-darwin-x64":"0.33.5","@img/sharp-libvips-darwin-arm64":"1.0.4","@img/sharp-libvips-darwin-x64":"1.0.4","@img/sharp-libvips-linux-arm":"1.0.5","@img/sharp-libvips-linux-arm64":"1.0.4","@img/sharp-libvips-linux-s390x":"1.0.4","@img/sharp-libvips-linux-x64":"1.0.4","@img/sharp-libvips-linuxmusl-arm64":"1.0.4","@img/sharp-libvips-linuxmusl-x64":"1.0.4","@img/sharp-linux-arm":"0.33.5","@img/sharp-linux-arm64":"0.33.5","@img/sharp-linux-s390x":"0.33.5","@img/sharp-linux-x64":"0.33.5","@img/sharp-linuxmusl-arm64":"0.33.5","@img/sharp-linuxmusl-x64":"0.33.5","@img/sharp-wasm32":"0.33.5","@img/sharp-win32-ia32":"0.33.5","@img/sharp-win32-x64":"0.33.5"},devDependencies:{"@emnapi/runtime":"^1.2.0","@img/sharp-libvips-dev":"1.0.4","@img/sharp-libvips-dev-wasm32":"1.0.5","@img/sharp-libvips-win32-ia32":"1.0.4","@img/sharp-libvips-win32-x64":"1.0.4","@types/node":"*",async:"^3.2.5",cc:"^3.0.1",emnapi:"^1.2.0","exif-reader":"^2.0.1","extract-zip":"^2.0.1",icc:"^3.0.0","jsdoc-to-markdown":"^8.0.3","license-checker":"^25.0.1",mocha:"^10.7.3","node-addon-api":"^8.1.0",nyc:"^17.0.0",prebuild:"^13.0.1",semistandard:"^17.0.0","tar-fs":"^3.0.6",tsd:"^0.31.1"},license:"Apache-2.0",engines:{node:"^18.17.0 || ^20.3.0 || >=21.0.0"},config:{libvips:">=8.15.3"},funding:{url:"https://opencollective.com/libvips"},binary:{napi_versions:[9]},semistandard:{env:["mocha"]},cc:{linelength:"120",filter:["build/include"]},nyc:{include:["lib"]},tsd:{directory:"test/types/"}}});var require_libvips=__commonJS((exports,module3)=>{var{spawnSync}=__require("child_process"),{createHash:createHash4}=__require("crypto"),semverCoerce=require_coerce(),semverGreaterThanOrEqualTo=require_gte(),semverSatisfies=require_satisfies(),detectLibc=require_detect_libc(),{config,engines,optionalDependencies}=require_package(),minimumLibvipsVersionLabelled=process.env.npm_package_config_libvips||config.libvips,minimumLibvipsVersion=semverCoerce(minimumLibvipsVersionLabelled).version,prebuiltPlatforms=["darwin-arm64","darwin-x64","linux-arm","linux-arm64","linux-s390x","linux-x64","linuxmusl-arm64","linuxmusl-x64","win32-ia32","win32-x64"],spawnSyncOptions={encoding:"utf8",shell:!0},log3=(item)=>{if(item instanceof Error)console.error(`sharp: Installation error: ${item.message}`);else console.log(`sharp: ${item}`)},runtimeLibc=()=>detectLibc.isNonGlibcLinuxSync()?detectLibc.familySync():"",runtimePlatformArch=()=>`${process.platform}${runtimeLibc()}-${process.arch}`,buildPlatformArch=()=>{if(isEmscripten())return"wasm32";let{npm_config_arch,npm_config_platform,npm_config_libc}=process.env,libc=typeof npm_config_libc==="string"?npm_config_libc:runtimeLibc();return`${npm_config_platform||process.platform}${libc}-${npm_config_arch||process.arch}`},buildSharpLibvipsIncludeDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/include`)}catch{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/include");})()}catch{}}return""},buildSharpLibvipsCPlusPlusDir=()=>{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/cplusplus");})()}catch{}return""},buildSharpLibvipsLibDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/lib`)}catch{try{return __require(`@img/sharp-libvips-${buildPlatformArch()}/lib`)}catch{}}return""},isUnsupportedNodeRuntime=()=>{if(process.release?.name==="node"&&process.versions){if(!semverSatisfies(process.versions.node,engines.node))return{found:process.versions.node,expected:engines.node}}},isEmscripten=()=>{let{CC}=process.env;return Boolean(CC&&CC.endsWith("/emcc"))},isRosetta=()=>{if(process.platform==="darwin"&&process.arch==="x64")return(spawnSync("sysctl sysctl.proc_translated",spawnSyncOptions).stdout||"").trim()==="sysctl.proc_translated: 1";return!1},sha5122=(s)=>createHash4("sha512").update(s).digest("hex"),yarnLocator=()=>{try{let identHash=sha5122(`imgsharp-libvips-${buildPlatformArch()}`),npmVersion=semverCoerce(optionalDependencies[`@img/sharp-libvips-${buildPlatformArch()}`]).version;return sha5122(`${identHash}npm:${npmVersion}`).slice(0,10)}catch{}return""},spawnRebuild=()=>spawnSync(`node-gyp rebuild --directory=src ${isEmscripten()?"--nodedir=emscripten":""}`,{...spawnSyncOptions,stdio:"inherit"}).status,globalLibvipsVersion=()=>{if(process.platform!=="win32")return(spawnSync("pkg-config --modversion vips-cpp",{...spawnSyncOptions,env:{...process.env,PKG_CONFIG_PATH:pkgConfigPath()}}).stdout||"").trim();else return""},pkgConfigPath=()=>{if(process.platform!=="win32")return[(spawnSync('which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',spawnSyncOptions).stdout||"").trim(),process.env.PKG_CONFIG_PATH,"/usr/local/lib/pkgconfig","/usr/lib/pkgconfig","/usr/local/libdata/pkgconfig","/usr/libdata/pkgconfig"].filter(Boolean).join(":");else return""},skipSearch=(status,reason,logger2)=>{if(logger2)logger2(`Detected ${reason}, skipping search for globally-installed libvips`);return status},useGlobalLibvips=(logger2)=>{if(Boolean(process.env.SHARP_IGNORE_GLOBAL_LIBVIPS)===!0)return skipSearch(!1,"SHARP_IGNORE_GLOBAL_LIBVIPS",logger2);if(Boolean(process.env.SHARP_FORCE_GLOBAL_LIBVIPS)===!0)return skipSearch(!0,"SHARP_FORCE_GLOBAL_LIBVIPS",logger2);if(isRosetta())return skipSearch(!1,"Rosetta",logger2);let globalVipsVersion=globalLibvipsVersion();return!!globalVipsVersion&&semverGreaterThanOrEqualTo(globalVipsVersion,minimumLibvipsVersion)};module3.exports={minimumLibvipsVersion,prebuiltPlatforms,buildPlatformArch,buildSharpLibvipsIncludeDir,buildSharpLibvipsCPlusPlusDir,buildSharpLibvipsLibDir,isUnsupportedNodeRuntime,runtimePlatformArch,log:log3,yarnLocator,spawnRebuild,globalLibvipsVersion,pkgConfigPath,useGlobalLibvips}});var require_sharp=__commonJS((exports,module3)=>{var{familySync,versionSync}=require_detect_libc(),{runtimePlatformArch,isUnsupportedNodeRuntime,prebuiltPlatforms,minimumLibvipsVersion}=require_libvips(),runtimePlatform=runtimePlatformArch(),paths=[`../src/build/Release/sharp-${runtimePlatform}.node`,"../src/build/Release/sharp-wasm32.node",`@img/sharp-${runtimePlatform}/sharp.node`,"@img/sharp-wasm32/sharp.node"],sharp,errors2=[];for(let path2 of paths)try{sharp=__require(path2);break}catch(err){errors2.push(err)}if(sharp)module3.exports=sharp;else{let[isLinux,isMacOs,isWindows]=["linux","darwin","win32"].map((os4)=>runtimePlatform.startsWith(os4)),help=[`Could not load the "sharp" module using the ${runtimePlatform} runtime`];errors2.forEach((err)=>{if(err.code!=="MODULE_NOT_FOUND")help.push(`${err.code}: ${err.message}`)});let messages=errors2.map((err)=>err.message).join(" ");if(help.push("Possible solutions:"),isUnsupportedNodeRuntime()){let{found,expected}=isUnsupportedNodeRuntime();help.push("- Please upgrade Node.js:",`    Found ${found}`,`    Requires ${expected}`)}else if(prebuiltPlatforms.includes(runtimePlatform)){let[os4,cpu]=runtimePlatform.split("-"),libc=os4.endsWith("musl")?" --libc=musl":"";help.push("- Ensure optional dependencies can be installed:","    npm install --include=optional sharp","- Ensure your package manager supports multi-platform installation:","    See https://sharp.pixelplumbing.com/install#cross-platform","- Add platform-specific dependencies:",`    npm install --os=${os4.replace("musl","")}${libc} --cpu=${cpu} sharp`)}else help.push(`- Manually install libvips >= ${minimumLibvipsVersion}`,"- Add experimental WebAssembly-based dependencies:","    npm install --cpu=wasm32 sharp","    npm install @img/sharp-wasm32");if(isLinux&&/(symbol not found|CXXABI_)/i.test(messages))try{let{config}=__require(`@img/sharp-libvips-${runtimePlatform}/package`),libcFound=`${familySync()} ${versionSync()}`,libcRequires=`${config.musl?"musl":"glibc"} ${config.musl||config.glibc}`;help.push("- Update your OS:",`    Found ${libcFound}`,`    Requires ${libcRequires}`)}catch(errEngines){}if(isLinux&&/\/snap\/core[0-9]{2}/.test(messages))help.push("- Remove the Node.js Snap, which does not support native modules","    snap remove node");if(isMacOs&&/Incompatible library version/.test(messages))help.push("- Update Homebrew:","    brew update && brew upgrade vips");if(errors2.some((err)=>err.code==="ERR_DLOPEN_DISABLED"))help.push("- Run Node.js without using the --no-addons flag");if(isWindows&&/The specified procedure could not be found/.test(messages))help.push("- Using the canvas package on Windows?","    See https://sharp.pixelplumbing.com/install#canvas-and-windows","- Check for outdated versions of sharp in the dependency tree:","    npm ls sharp");throw help.push("- Consult the installation documentation:","    See https://sharp.pixelplumbing.com/install"),Error(help.join(`
-`))}});var require_constructor=__commonJS((exports,module3)=>{var util=__require("util"),stream=__require("stream"),is2=require_is();require_sharp();var debuglog=util.debuglog("sharp"),Sharp=function(input,options){if(arguments.length===1&&!is2.defined(input))throw Error("Invalid input");if(!(this instanceof Sharp))return new Sharp(input,options);return stream.Duplex.call(this),this.options={topOffsetPre:-1,leftOffsetPre:-1,widthPre:-1,heightPre:-1,topOffsetPost:-1,leftOffsetPost:-1,widthPost:-1,heightPost:-1,width:-1,height:-1,canvas:"crop",position:0,resizeBackground:[0,0,0,255],useExifOrientation:!1,angle:0,rotationAngle:0,rotationBackground:[0,0,0,255],rotateBeforePreExtract:!1,flip:!1,flop:!1,extendTop:0,extendBottom:0,extendLeft:0,extendRight:0,extendBackground:[0,0,0,255],extendWith:"background",withoutEnlargement:!1,withoutReduction:!1,affineMatrix:[],affineBackground:[0,0,0,255],affineIdx:0,affineIdy:0,affineOdx:0,affineOdy:0,affineInterpolator:this.constructor.interpolators.bilinear,kernel:"lanczos3",fastShrinkOnLoad:!0,tint:[-1,0,0,0],flatten:!1,flattenBackground:[0,0,0],unflatten:!1,negate:!1,negateAlpha:!0,medianSize:0,blurSigma:0,precision:"integer",minAmpl:0.2,sharpenSigma:0,sharpenM1:1,sharpenM2:2,sharpenX1:2,sharpenY2:10,sharpenY3:20,threshold:0,thresholdGrayscale:!0,trimBackground:[],trimThreshold:-1,trimLineArt:!1,gamma:0,gammaOut:0,greyscale:!1,normalise:!1,normaliseLower:1,normaliseUpper:99,claheWidth:0,claheHeight:0,claheMaxSlope:3,brightness:1,saturation:1,hue:0,lightness:0,booleanBufferIn:null,booleanFileIn:"",joinChannelIn:[],extractChannel:-1,removeAlpha:!1,ensureAlpha:-1,colourspace:"srgb",colourspacePipeline:"last",composite:[],fileOut:"",formatOut:"input",streamOut:!1,keepMetadata:0,withMetadataOrientation:-1,withMetadataDensity:0,withIccProfile:"",withExif:{},withExifMerge:!0,resolveWithObject:!1,jpegQuality:80,jpegProgressive:!1,jpegChromaSubsampling:"4:2:0",jpegTrellisQuantisation:!1,jpegOvershootDeringing:!1,jpegOptimiseScans:!1,jpegOptimiseCoding:!0,jpegQuantisationTable:0,pngProgressive:!1,pngCompressionLevel:6,pngAdaptiveFiltering:!1,pngPalette:!1,pngQuality:100,pngEffort:7,pngBitdepth:8,pngDither:1,jp2Quality:80,jp2TileHeight:512,jp2TileWidth:512,jp2Lossless:!1,jp2ChromaSubsampling:"4:4:4",webpQuality:80,webpAlphaQuality:100,webpLossless:!1,webpNearLossless:!1,webpSmartSubsample:!1,webpPreset:"default",webpEffort:4,webpMinSize:!1,webpMixed:!1,gifBitdepth:8,gifEffort:7,gifDither:1,gifInterFrameMaxError:0,gifInterPaletteMaxError:3,gifReuse:!0,gifProgressive:!1,tiffQuality:80,tiffCompression:"jpeg",tiffPredictor:"horizontal",tiffPyramid:!1,tiffMiniswhite:!1,tiffBitdepth:8,tiffTile:!1,tiffTileHeight:256,tiffTileWidth:256,tiffXres:1,tiffYres:1,tiffResolutionUnit:"inch",heifQuality:50,heifLossless:!1,heifCompression:"av1",heifEffort:4,heifChromaSubsampling:"4:4:4",heifBitdepth:8,jxlDistance:1,jxlDecodingTier:0,jxlEffort:7,jxlLossless:!1,rawDepth:"uchar",tileSize:256,tileOverlap:0,tileContainer:"fs",tileLayout:"dz",tileFormat:"last",tileDepth:"last",tileAngle:0,tileSkipBlanks:-1,tileBackground:[255,255,255,255],tileCentre:!1,tileId:"https://example.com/iiif",tileBasename:"",timeoutSeconds:0,linearA:[],linearB:[],debuglog:(warning)=>{this.emit("warning",warning),debuglog(warning)},queueListener:function(queueLength){Sharp.queue.emit("change",queueLength)}},this.options.input=this._createInputDescriptor(input,options,{allowStream:!0}),this};Object.setPrototypeOf(Sharp.prototype,stream.Duplex.prototype);Object.setPrototypeOf(Sharp,stream.Duplex);function clone2(){let clone3=this.constructor.call(),{debuglog:debuglog2,queueListener,...options}=this.options;if(clone3.options=structuredClone(options),clone3.options.debuglog=debuglog2,clone3.options.queueListener=queueListener,this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),clone3.options.input.buffer=this.options.input.buffer,clone3.emit("finish")});return clone3}Object.assign(Sharp.prototype,{clone:clone2});module3.exports=Sharp});var require_color_name=__commonJS((exports,module3)=>{module3.exports={aliceblue:[240,248,255],antiquewhite:[250,235,215],aqua:[0,255,255],aquamarine:[127,255,212],azure:[240,255,255],beige:[245,245,220],bisque:[255,228,196],black:[0,0,0],blanchedalmond:[255,235,205],blue:[0,0,255],blueviolet:[138,43,226],brown:[165,42,42],burlywood:[222,184,135],cadetblue:[95,158,160],chartreuse:[127,255,0],chocolate:[210,105,30],coral:[255,127,80],cornflowerblue:[100,149,237],cornsilk:[255,248,220],crimson:[220,20,60],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgoldenrod:[184,134,11],darkgray:[169,169,169],darkgreen:[0,100,0],darkgrey:[169,169,169],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkseagreen:[143,188,143],darkslateblue:[72,61,139],darkslategray:[47,79,79],darkslategrey:[47,79,79],darkturquoise:[0,206,209],darkviolet:[148,0,211],deeppink:[255,20,147],deepskyblue:[0,191,255],dimgray:[105,105,105],dimgrey:[105,105,105],dodgerblue:[30,144,255],firebrick:[178,34,34],floralwhite:[255,250,240],forestgreen:[34,139,34],fuchsia:[255,0,255],gainsboro:[220,220,220],ghostwhite:[248,248,255],gold:[255,215,0],goldenrod:[218,165,32],gray:[128,128,128],green:[0,128,0],greenyellow:[173,255,47],grey:[128,128,128],honeydew:[240,255,240],hotpink:[255,105,180],indianred:[205,92,92],indigo:[75,0,130],ivory:[255,255,240],khaki:[240,230,140],lavender:[230,230,250],lavenderblush:[255,240,245],lawngreen:[124,252,0],lemonchiffon:[255,250,205],lightblue:[173,216,230],lightcoral:[240,128,128],lightcyan:[224,255,255],lightgoldenrodyellow:[250,250,210],lightgray:[211,211,211],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightsalmon:[255,160,122],lightseagreen:[32,178,170],lightskyblue:[135,206,250],lightslategray:[119,136,153],lightslategrey:[119,136,153],lightsteelblue:[176,196,222],lightyellow:[255,255,224],lime:[0,255,0],limegreen:[50,205,50],linen:[250,240,230],magenta:[255,0,255],maroon:[128,0,0],mediumaquamarine:[102,205,170],mediumblue:[0,0,205],mediumorchid:[186,85,211],mediumpurple:[147,112,219],mediumseagreen:[60,179,113],mediumslateblue:[123,104,238],mediumspringgreen:[0,250,154],mediumturquoise:[72,209,204],mediumvioletred:[199,21,133],midnightblue:[25,25,112],mintcream:[245,255,250],mistyrose:[255,228,225],moccasin:[255,228,181],navajowhite:[255,222,173],navy:[0,0,128],oldlace:[253,245,230],olive:[128,128,0],olivedrab:[107,142,35],orange:[255,165,0],orangered:[255,69,0],orchid:[218,112,214],palegoldenrod:[238,232,170],palegreen:[152,251,152],paleturquoise:[175,238,238],palevioletred:[219,112,147],papayawhip:[255,239,213],peachpuff:[255,218,185],peru:[205,133,63],pink:[255,192,203],plum:[221,160,221],powderblue:[176,224,230],purple:[128,0,128],rebeccapurple:[102,51,153],red:[255,0,0],rosybrown:[188,143,143],royalblue:[65,105,225],saddlebrown:[139,69,19],salmon:[250,128,114],sandybrown:[244,164,96],seagreen:[46,139,87],seashell:[255,245,238],sienna:[160,82,45],silver:[192,192,192],skyblue:[135,206,235],slateblue:[106,90,205],slategray:[112,128,144],slategrey:[112,128,144],snow:[255,250,250],springgreen:[0,255,127],steelblue:[70,130,180],tan:[210,180,140],teal:[0,128,128],thistle:[216,191,216],tomato:[255,99,71],turquoise:[64,224,208],violet:[238,130,238],wheat:[245,222,179],white:[255,255,255],whitesmoke:[245,245,245],yellow:[255,255,0],yellowgreen:[154,205,50]}});var require_is_arrayish=__commonJS((exports,module3)=>{module3.exports=function(obj){if(!obj||typeof obj==="string")return!1;return obj instanceof Array||Array.isArray(obj)||obj.length>=0&&(obj.splice instanceof Function||Object.getOwnPropertyDescriptor(obj,obj.length-1)&&obj.constructor.name!=="String")}});var require_simple_swizzle=__commonJS((exports,module3)=>{var isArrayish=require_is_arrayish(),concat4=Array.prototype.concat,slice2=Array.prototype.slice,swizzle=module3.exports=function(args){var results=[];for(var i=0,len=args.length;i<len;i++){var arg=args[i];if(isArrayish(arg))results=concat4.call(results,slice2.call(arg));else results.push(arg)}return results};swizzle.wrap=function(fn){return function(){return fn(swizzle(arguments))}}});var require_color_string=__commonJS((exports,module3)=>{var colorNames=require_color_name(),swizzle=require_simple_swizzle(),hasOwnProperty=Object.hasOwnProperty,reverseNames=Object.create(null);for(name2 in colorNames)if(hasOwnProperty.call(colorNames,name2))reverseNames[colorNames[name2]]=name2;var name2,cs=module3.exports={to:{},get:{}};cs.get=function(string3){var prefix=string3.substring(0,3).toLowerCase(),val,model;switch(prefix){case"hsl":val=cs.get.hsl(string3),model="hsl";break;case"hwb":val=cs.get.hwb(string3),model="hwb";break;default:val=cs.get.rgb(string3),model="rgb";break}if(!val)return null;return{model,value:val}};cs.get.rgb=function(string3){if(!string3)return null;var abbr=/^#([a-f0-9]{3,4})$/i,hex2=/^#([a-f0-9]{6})([a-f0-9]{2})?$/i,rgba=/^rgba?\(\s*([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,per=/^rgba?\(\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,keyword=/^(\w+)$/,rgb=[0,0,0,1],match,i,hexAlpha;if(match=string3.match(hex2)){hexAlpha=match[2],match=match[1];for(i=0;i<3;i++){var i2=i*2;rgb[i]=parseInt(match.slice(i2,i2+2),16)}if(hexAlpha)rgb[3]=parseInt(hexAlpha,16)/255}else if(match=string3.match(abbr)){match=match[1],hexAlpha=match[3];for(i=0;i<3;i++)rgb[i]=parseInt(match[i]+match[i],16);if(hexAlpha)rgb[3]=parseInt(hexAlpha+hexAlpha,16)/255}else if(match=string3.match(rgba)){for(i=0;i<3;i++)rgb[i]=parseInt(match[i+1],0);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(per)){for(i=0;i<3;i++)rgb[i]=Math.round(parseFloat(match[i+1])*2.55);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(keyword)){if(match[1]==="transparent")return[0,0,0,0];if(!hasOwnProperty.call(colorNames,match[1]))return null;return rgb=colorNames[match[1]],rgb[3]=1,rgb}else return null;for(i=0;i<3;i++)rgb[i]=clamp(rgb[i],0,255);return rgb[3]=clamp(rgb[3],0,1),rgb};cs.get.hsl=function(string3){if(!string3)return null;var hsl=/^hsla?\(\s*([+-]?(?:\d{0,3}\.)?\d+)(?:deg)?\s*,?\s*([+-]?[\d\.]+)%\s*,?\s*([+-]?[\d\.]+)%\s*(?:[,|\/]\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hsl);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,s=clamp(parseFloat(match[2]),0,100),l=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,s,l,a]}return null};cs.get.hwb=function(string3){if(!string3)return null;var hwb=/^hwb\(\s*([+-]?\d{0,3}(?:\.\d+)?)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hwb);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,w=clamp(parseFloat(match[2]),0,100),b=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,w,b,a]}return null};cs.to.hex=function(){var rgba=swizzle(arguments);return"#"+hexDouble(rgba[0])+hexDouble(rgba[1])+hexDouble(rgba[2])+(rgba[3]<1?hexDouble(Math.round(rgba[3]*255)):"")};cs.to.rgb=function(){var rgba=swizzle(arguments);return rgba.length<4||rgba[3]===1?"rgb("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+")":"rgba("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+", "+rgba[3]+")"};cs.to.rgb.percent=function(){var rgba=swizzle(arguments),r=Math.round(rgba[0]/255*100),g=Math.round(rgba[1]/255*100),b=Math.round(rgba[2]/255*100);return rgba.length<4||rgba[3]===1?"rgb("+r+"%, "+g+"%, "+b+"%)":"rgba("+r+"%, "+g+"%, "+b+"%, "+rgba[3]+")"};cs.to.hsl=function(){var hsla=swizzle(arguments);return hsla.length<4||hsla[3]===1?"hsl("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%)":"hsla("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%, "+hsla[3]+")"};cs.to.hwb=function(){var hwba=swizzle(arguments),a="";if(hwba.length>=4&&hwba[3]!==1)a=", "+hwba[3];return"hwb("+hwba[0]+", "+hwba[1]+"%, "+hwba[2]+"%"+a+")"};cs.to.keyword=function(rgb){return reverseNames[rgb.slice(0,3)]};function clamp(num3,min,max){return Math.min(Math.max(min,num3),max)}function hexDouble(num3){var str4=Math.round(num3).toString(16).toUpperCase();return str4.length<2?"0"+str4:str4}});var require_conversions=__commonJS((exports,module3)=>{var cssKeywords=require_color_name(),reverseKeywords={};for(let key2 of Object.keys(cssKeywords))reverseKeywords[cssKeywords[key2]]=key2;var convert2={rgb:{channels:3,labels:"rgb"},hsl:{channels:3,labels:"hsl"},hsv:{channels:3,labels:"hsv"},hwb:{channels:3,labels:"hwb"},cmyk:{channels:4,labels:"cmyk"},xyz:{channels:3,labels:"xyz"},lab:{channels:3,labels:"lab"},lch:{channels:3,labels:"lch"},hex:{channels:1,labels:["hex"]},keyword:{channels:1,labels:["keyword"]},ansi16:{channels:1,labels:["ansi16"]},ansi256:{channels:1,labels:["ansi256"]},hcg:{channels:3,labels:["h","c","g"]},apple:{channels:3,labels:["r16","g16","b16"]},gray:{channels:1,labels:["gray"]}};module3.exports=convert2;for(let model of Object.keys(convert2)){if(!("channels"in convert2[model]))throw Error("missing channels property: "+model);if(!("labels"in convert2[model]))throw Error("missing channel labels property: "+model);if(convert2[model].labels.length!==convert2[model].channels)throw Error("channel and label counts mismatch: "+model);let{channels,labels}=convert2[model];delete convert2[model].channels,delete convert2[model].labels,Object.defineProperty(convert2[model],"channels",{value:channels}),Object.defineProperty(convert2[model],"labels",{value:labels})}convert2.rgb.hsl=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,min=Math.min(r,g,b),max=Math.max(r,g,b),delta=max-min,h,s;if(max===min)h=0;else if(r===max)h=(g-b)/delta;else if(g===max)h=2+(b-r)/delta;else if(b===max)h=4+(r-g)/delta;if(h=Math.min(h*60,360),h<0)h+=360;let l=(min+max)/2;if(max===min)s=0;else if(l<=0.5)s=delta/(max+min);else s=delta/(2-max-min);return[h,s*100,l*100]};convert2.rgb.hsv=function(rgb){let rdif,gdif,bdif,h,s,r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,v=Math.max(r,g,b),diff=v-Math.min(r,g,b),diffc=function(c){return(v-c)/6/diff+0.5};if(diff===0)h=0,s=0;else{if(s=diff/v,rdif=diffc(r),gdif=diffc(g),bdif=diffc(b),r===v)h=bdif-gdif;else if(g===v)h=0.3333333333333333+rdif-bdif;else if(b===v)h=0.6666666666666666+gdif-rdif;if(h<0)h+=1;else if(h>1)h-=1}return[h*360,s*100,v*100]};convert2.rgb.hwb=function(rgb){let r=rgb[0],g=rgb[1],b=rgb[2],h=convert2.rgb.hsl(rgb)[0],w=0.00392156862745098*Math.min(r,Math.min(g,b));return b=1-0.00392156862745098*Math.max(r,Math.max(g,b)),[h,w*100,b*100]};convert2.rgb.cmyk=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,k=Math.min(1-r,1-g,1-b),c=(1-r-k)/(1-k)||0,m=(1-g-k)/(1-k)||0,y=(1-b-k)/(1-k)||0;return[c*100,m*100,y*100,k*100]};function comparativeDistance(x,y){return(x[0]-y[0])**2+(x[1]-y[1])**2+(x[2]-y[2])**2}convert2.rgb.keyword=function(rgb){let reversed=reverseKeywords[rgb];if(reversed)return reversed;let currentClosestDistance=1/0,currentClosestKeyword;for(let keyword of Object.keys(cssKeywords)){let value2=cssKeywords[keyword],distance=comparativeDistance(rgb,value2);if(distance<currentClosestDistance)currentClosestDistance=distance,currentClosestKeyword=keyword}return currentClosestKeyword};convert2.keyword.rgb=function(keyword){return cssKeywords[keyword]};convert2.rgb.xyz=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255;r=r>0.04045?((r+0.055)/1.055)**2.4:r/12.92,g=g>0.04045?((g+0.055)/1.055)**2.4:g/12.92,b=b>0.04045?((b+0.055)/1.055)**2.4:b/12.92;let x=r*0.4124+g*0.3576+b*0.1805,y=r*0.2126+g*0.7152+b*0.0722,z=r*0.0193+g*0.1192+b*0.9505;return[x*100,y*100,z*100]};convert2.rgb.lab=function(rgb){let xyz=convert2.rgb.xyz(rgb),x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.hsl.rgb=function(hsl){let h=hsl[0]/360,s=hsl[1]/100,l=hsl[2]/100,t2,t3,val;if(s===0)return val=l*255,[val,val,val];if(l<0.5)t2=l*(1+s);else t2=l+s-l*s;let t1=2*l-t2,rgb=[0,0,0];for(let i=0;i<3;i++){if(t3=h+0.3333333333333333*-(i-1),t3<0)t3++;if(t3>1)t3--;if(6*t3<1)val=t1+(t2-t1)*6*t3;else if(2*t3<1)val=t2;else if(3*t3<2)val=t1+(t2-t1)*(0.6666666666666666-t3)*6;else val=t1;rgb[i]=val*255}return rgb};convert2.hsl.hsv=function(hsl){let h=hsl[0],s=hsl[1]/100,l=hsl[2]/100,smin=s,lmin=Math.max(l,0.01);l*=2,s*=l<=1?l:2-l,smin*=lmin<=1?lmin:2-lmin;let v=(l+s)/2,sv=l===0?2*smin/(lmin+smin):2*s/(l+s);return[h,sv*100,v*100]};convert2.hsv.rgb=function(hsv){let h=hsv[0]/60,s=hsv[1]/100,v=hsv[2]/100,hi=Math.floor(h)%6,f=h-Math.floor(h),p=255*v*(1-s),q=255*v*(1-s*f),t=255*v*(1-s*(1-f));switch(v*=255,hi){case 0:return[v,t,p];case 1:return[q,v,p];case 2:return[p,v,t];case 3:return[p,q,v];case 4:return[t,p,v];case 5:return[v,p,q]}};convert2.hsv.hsl=function(hsv){let h=hsv[0],s=hsv[1]/100,v=hsv[2]/100,vmin=Math.max(v,0.01),sl,l;l=(2-s)*v;let lmin=(2-s)*vmin;return sl=s*vmin,sl/=lmin<=1?lmin:2-lmin,sl=sl||0,l/=2,[h,sl*100,l*100]};convert2.hwb.rgb=function(hwb){let h=hwb[0]/360,wh=hwb[1]/100,bl=hwb[2]/100,ratio=wh+bl,f;if(ratio>1)wh/=ratio,bl/=ratio;let i=Math.floor(6*h),v=1-bl;if(f=6*h-i,(i&1)!==0)f=1-f;let n=wh+f*(v-wh),r,g,b;switch(i){default:case 6:case 0:r=v,g=n,b=wh;break;case 1:r=n,g=v,b=wh;break;case 2:r=wh,g=v,b=n;break;case 3:r=wh,g=n,b=v;break;case 4:r=n,g=wh,b=v;break;case 5:r=v,g=wh,b=n;break}return[r*255,g*255,b*255]};convert2.cmyk.rgb=function(cmyk){let c=cmyk[0]/100,m=cmyk[1]/100,y=cmyk[2]/100,k=cmyk[3]/100,r=1-Math.min(1,c*(1-k)+k),g=1-Math.min(1,m*(1-k)+k),b=1-Math.min(1,y*(1-k)+k);return[r*255,g*255,b*255]};convert2.xyz.rgb=function(xyz){let x=xyz[0]/100,y=xyz[1]/100,z=xyz[2]/100,r,g,b;return r=x*3.2406+y*-1.5372+z*-0.4986,g=x*-0.9689+y*1.8758+z*0.0415,b=x*0.0557+y*-0.204+z*1.057,r=r>0.0031308?1.055*r**0.4166666666666667-0.055:r*12.92,g=g>0.0031308?1.055*g**0.4166666666666667-0.055:g*12.92,b=b>0.0031308?1.055*b**0.4166666666666667-0.055:b*12.92,r=Math.min(Math.max(0,r),1),g=Math.min(Math.max(0,g),1),b=Math.min(Math.max(0,b),1),[r*255,g*255,b*255]};convert2.xyz.lab=function(xyz){let x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.lab.xyz=function(lab){let l=lab[0],a=lab[1],b=lab[2],x,y,z;y=(l+16)/116,x=a/500+y,z=y-b/200;let y2=y**3,x2=x**3,z2=z**3;return y=y2>0.008856?y2:(y-0.13793103448275862)/7.787,x=x2>0.008856?x2:(x-0.13793103448275862)/7.787,z=z2>0.008856?z2:(z-0.13793103448275862)/7.787,x*=95.047,y*=100,z*=108.883,[x,y,z]};convert2.lab.lch=function(lab){let l=lab[0],a=lab[1],b=lab[2],h;if(h=Math.atan2(b,a)*360/2/Math.PI,h<0)h+=360;let c=Math.sqrt(a*a+b*b);return[l,c,h]};convert2.lch.lab=function(lch){let l=lch[0],c=lch[1],hr=lch[2]/360*2*Math.PI,a=c*Math.cos(hr),b=c*Math.sin(hr);return[l,a,b]};convert2.rgb.ansi16=function(args,saturation=null){let[r,g,b]=args,value2=saturation===null?convert2.rgb.hsv(args)[2]:saturation;if(value2=Math.round(value2/50),value2===0)return 30;let ansi=30+(Math.round(b/255)<<2|Math.round(g/255)<<1|Math.round(r/255));if(value2===2)ansi+=60;return ansi};convert2.hsv.ansi16=function(args){return convert2.rgb.ansi16(convert2.hsv.rgb(args),args[2])};convert2.rgb.ansi256=function(args){let r=args[0],g=args[1],b=args[2];if(r===g&&g===b){if(r<8)return 16;if(r>248)return 231;return Math.round((r-8)/247*24)+232}return 16+36*Math.round(r/255*5)+6*Math.round(g/255*5)+Math.round(b/255*5)};convert2.ansi16.rgb=function(args){let color=args%10;if(color===0||color===7){if(args>50)color+=3.5;return color=color/10.5*255,[color,color,color]}let mult=(~~(args>50)+1)*0.5,r=(color&1)*mult*255,g=(color>>1&1)*mult*255,b=(color>>2&1)*mult*255;return[r,g,b]};convert2.ansi256.rgb=function(args){if(args>=232){let c=(args-232)*10+8;return[c,c,c]}args-=16;let rem,r=Math.floor(args/36)/5*255,g=Math.floor((rem=args%36)/6)/5*255,b=rem%6/5*255;return[r,g,b]};convert2.rgb.hex=function(args){let string3=(((Math.round(args[0])&255)<<16)+((Math.round(args[1])&255)<<8)+(Math.round(args[2])&255)).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.hex.rgb=function(args){let match=args.toString(16).match(/[a-f0-9]{6}|[a-f0-9]{3}/i);if(!match)return[0,0,0];let colorString=match[0];if(match[0].length===3)colorString=colorString.split("").map((char)=>{return char+char}).join("");let integer3=parseInt(colorString,16),r=integer3>>16&255,g=integer3>>8&255,b=integer3&255;return[r,g,b]};convert2.rgb.hcg=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,max=Math.max(Math.max(r,g),b),min=Math.min(Math.min(r,g),b),chroma=max-min,grayscale,hue;if(chroma<1)grayscale=min/(1-chroma);else grayscale=0;if(chroma<=0)hue=0;else if(max===r)hue=(g-b)/chroma%6;else if(max===g)hue=2+(b-r)/chroma;else hue=4+(r-g)/chroma;return hue/=6,hue%=1,[hue*360,chroma*100,grayscale*100]};convert2.hsl.hcg=function(hsl){let s=hsl[1]/100,l=hsl[2]/100,c=l<0.5?2*s*l:2*s*(1-l),f=0;if(c<1)f=(l-0.5*c)/(1-c);return[hsl[0],c*100,f*100]};convert2.hsv.hcg=function(hsv){let s=hsv[1]/100,v=hsv[2]/100,c=s*v,f=0;if(c<1)f=(v-c)/(1-c);return[hsv[0],c*100,f*100]};convert2.hcg.rgb=function(hcg){let h=hcg[0]/360,c=hcg[1]/100,g=hcg[2]/100;if(c===0)return[g*255,g*255,g*255];let pure=[0,0,0],hi=h%1*6,v=hi%1,w=1-v,mg=0;switch(Math.floor(hi)){case 0:pure[0]=1,pure[1]=v,pure[2]=0;break;case 1:pure[0]=w,pure[1]=1,pure[2]=0;break;case 2:pure[0]=0,pure[1]=1,pure[2]=v;break;case 3:pure[0]=0,pure[1]=w,pure[2]=1;break;case 4:pure[0]=v,pure[1]=0,pure[2]=1;break;default:pure[0]=1,pure[1]=0,pure[2]=w}return mg=(1-c)*g,[(c*pure[0]+mg)*255,(c*pure[1]+mg)*255,(c*pure[2]+mg)*255]};convert2.hcg.hsv=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c),f=0;if(v>0)f=c/v;return[hcg[0],f*100,v*100]};convert2.hcg.hsl=function(hcg){let c=hcg[1]/100,l=hcg[2]/100*(1-c)+0.5*c,s=0;if(l>0&&l<0.5)s=c/(2*l);else if(l>=0.5&&l<1)s=c/(2*(1-l));return[hcg[0],s*100,l*100]};convert2.hcg.hwb=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c);return[hcg[0],(v-c)*100,(1-v)*100]};convert2.hwb.hcg=function(hwb){let w=hwb[1]/100,v=1-hwb[2]/100,c=v-w,g=0;if(c<1)g=(v-c)/(1-c);return[hwb[0],c*100,g*100]};convert2.apple.rgb=function(apple){return[apple[0]/65535*255,apple[1]/65535*255,apple[2]/65535*255]};convert2.rgb.apple=function(rgb){return[rgb[0]/255*65535,rgb[1]/255*65535,rgb[2]/255*65535]};convert2.gray.rgb=function(args){return[args[0]/100*255,args[0]/100*255,args[0]/100*255]};convert2.gray.hsl=function(args){return[0,0,args[0]]};convert2.gray.hsv=convert2.gray.hsl;convert2.gray.hwb=function(gray){return[0,100,gray[0]]};convert2.gray.cmyk=function(gray){return[0,0,0,gray[0]]};convert2.gray.lab=function(gray){return[gray[0],0,0]};convert2.gray.hex=function(gray){let val=Math.round(gray[0]/100*255)&255,string3=((val<<16)+(val<<8)+val).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.rgb.gray=function(rgb){return[(rgb[0]+rgb[1]+rgb[2])/3/255*100]}});var require_route=__commonJS((exports,module3)=>{var conversions=require_conversions();function buildGraph(){let graph={},models=Object.keys(conversions);for(let len=models.length,i=0;i<len;i++)graph[models[i]]={distance:-1,parent:null};return graph}function deriveBFS(fromModel){let graph=buildGraph(),queue=[fromModel];graph[fromModel].distance=0;while(queue.length){let current=queue.pop(),adjacents=Object.keys(conversions[current]);for(let len=adjacents.length,i=0;i<len;i++){let adjacent=adjacents[i],node=graph[adjacent];if(node.distance===-1)node.distance=graph[current].distance+1,node.parent=current,queue.unshift(adjacent)}}return graph}function link(from,to){return function(args){return to(from(args))}}function wrapConversion(toModel,graph){let path2=[graph[toModel].parent,toModel],fn=conversions[graph[toModel].parent][toModel],cur=graph[toModel].parent;while(graph[cur].parent)path2.unshift(graph[cur].parent),fn=link(conversions[graph[cur].parent][cur],fn),cur=graph[cur].parent;return fn.conversion=path2,fn}module3.exports=function(fromModel){let graph=deriveBFS(fromModel),conversion={},models=Object.keys(graph);for(let len=models.length,i=0;i<len;i++){let toModel=models[i];if(graph[toModel].parent===null)continue;conversion[toModel]=wrapConversion(toModel,graph)}return conversion}});var require_color_convert=__commonJS((exports,module3)=>{var conversions=require_conversions(),route=require_route(),convert2={},models=Object.keys(conversions);function wrapRaw(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;return fn(args)};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}function wrapRounded(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;let result=fn(args);if(typeof result==="object")for(let len=result.length,i=0;i<len;i++)result[i]=Math.round(result[i]);return result};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}models.forEach((fromModel)=>{convert2[fromModel]={},Object.defineProperty(convert2[fromModel],"channels",{value:conversions[fromModel].channels}),Object.defineProperty(convert2[fromModel],"labels",{value:conversions[fromModel].labels});let routes=route(fromModel);Object.keys(routes).forEach((toModel)=>{let fn=routes[toModel];convert2[fromModel][toModel]=wrapRounded(fn),convert2[fromModel][toModel].raw=wrapRaw(fn)})});module3.exports=convert2});var require_color=__commonJS((exports,module3)=>{var colorString=require_color_string(),convert2=require_color_convert(),skippedModels=["keyword","gray","hex"],hashedModelKeys={};for(let model of Object.keys(convert2))hashedModelKeys[[...convert2[model].labels].sort().join("")]=model;var limiters={};function Color(object3,model){if(!(this instanceof Color))return new Color(object3,model);if(model&&model in skippedModels)model=null;if(model&&!(model in convert2))throw Error("Unknown model: "+model);let i,channels;if(object3==null)this.model="rgb",this.color=[0,0,0],this.valpha=1;else if(object3 instanceof Color)this.model=object3.model,this.color=[...object3.color],this.valpha=object3.valpha;else if(typeof object3==="string"){let result=colorString.get(object3);if(result===null)throw Error("Unable to parse color from string: "+object3);this.model=result.model,channels=convert2[this.model].channels,this.color=result.value.slice(0,channels),this.valpha=typeof result.value[channels]==="number"?result.value[channels]:1}else if(object3.length>0){this.model=model||"rgb",channels=convert2[this.model].channels;let newArray=Array.prototype.slice.call(object3,0,channels);this.color=zeroArray(newArray,channels),this.valpha=typeof object3[channels]==="number"?object3[channels]:1}else if(typeof object3==="number")this.model="rgb",this.color=[object3>>16&255,object3>>8&255,object3&255],this.valpha=1;else{this.valpha=1;let keys=Object.keys(object3);if("alpha"in object3)keys.splice(keys.indexOf("alpha"),1),this.valpha=typeof object3.alpha==="number"?object3.alpha:0;let hashedKeys=keys.sort().join("");if(!(hashedKeys in hashedModelKeys))throw Error("Unable to parse color from object: "+JSON.stringify(object3));this.model=hashedModelKeys[hashedKeys];let{labels}=convert2[this.model],color=[];for(i=0;i<labels.length;i++)color.push(object3[labels[i]]);this.color=zeroArray(color)}if(limiters[this.model]){channels=convert2[this.model].channels;for(i=0;i<channels;i++){let limit=limiters[this.model][i];if(limit)this.color[i]=limit(this.color[i])}}if(this.valpha=Math.max(0,Math.min(1,this.valpha)),Object.freeze)Object.freeze(this)}Color.prototype={toString(){return this.string()},toJSON(){return this[this.model]()},string(places){let self2=this.model in colorString.to?this:this.rgb();self2=self2.round(typeof places==="number"?places:1);let args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to[self2.model](args)},percentString(places){let self2=this.rgb().round(typeof places==="number"?places:1),args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to.rgb.percent(args)},array(){return this.valpha===1?[...this.color]:[...this.color,this.valpha]},object(){let result={},{channels}=convert2[this.model],{labels}=convert2[this.model];for(let i=0;i<channels;i++)result[labels[i]]=this.color[i];if(this.valpha!==1)result.alpha=this.valpha;return result},unitArray(){let rgb=this.rgb().color;if(rgb[0]/=255,rgb[1]/=255,rgb[2]/=255,this.valpha!==1)rgb.push(this.valpha);return rgb},unitObject(){let rgb=this.rgb().object();if(rgb.r/=255,rgb.g/=255,rgb.b/=255,this.valpha!==1)rgb.alpha=this.valpha;return rgb},round(places){return places=Math.max(places||0,0),new Color([...this.color.map(roundToPlace(places)),this.valpha],this.model)},alpha(value2){if(value2!==void 0)return new Color([...this.color,Math.max(0,Math.min(1,value2))],this.model);return this.valpha},red:getset("rgb",0,maxfn(255)),green:getset("rgb",1,maxfn(255)),blue:getset("rgb",2,maxfn(255)),hue:getset(["hsl","hsv","hsl","hwb","hcg"],0,(value2)=>(value2%360+360)%360),saturationl:getset("hsl",1,maxfn(100)),lightness:getset("hsl",2,maxfn(100)),saturationv:getset("hsv",1,maxfn(100)),value:getset("hsv",2,maxfn(100)),chroma:getset("hcg",1,maxfn(100)),gray:getset("hcg",2,maxfn(100)),white:getset("hwb",1,maxfn(100)),wblack:getset("hwb",2,maxfn(100)),cyan:getset("cmyk",0,maxfn(100)),magenta:getset("cmyk",1,maxfn(100)),yellow:getset("cmyk",2,maxfn(100)),black:getset("cmyk",3,maxfn(100)),x:getset("xyz",0,maxfn(95.047)),y:getset("xyz",1,maxfn(100)),z:getset("xyz",2,maxfn(108.833)),l:getset("lab",0,maxfn(100)),a:getset("lab",1),b:getset("lab",2),keyword(value2){if(value2!==void 0)return new Color(value2);return convert2[this.model].keyword(this.color)},hex(value2){if(value2!==void 0)return new Color(value2);return colorString.to.hex(this.rgb().round().color)},hexa(value2){if(value2!==void 0)return new Color(value2);let rgbArray=this.rgb().round().color,alphaHex=Math.round(this.valpha*255).toString(16).toUpperCase();if(alphaHex.length===1)alphaHex="0"+alphaHex;return colorString.to.hex(rgbArray)+alphaHex},rgbNumber(){let rgb=this.rgb().color;return(rgb[0]&255)<<16|(rgb[1]&255)<<8|rgb[2]&255},luminosity(){let rgb=this.rgb().color,lum=[];for(let[i,element]of rgb.entries()){let chan=element/255;lum[i]=chan<=0.04045?chan/12.92:((chan+0.055)/1.055)**2.4}return 0.2126*lum[0]+0.7152*lum[1]+0.0722*lum[2]},contrast(color2){let lum1=this.luminosity(),lum2=color2.luminosity();if(lum1>lum2)return(lum1+0.05)/(lum2+0.05);return(lum2+0.05)/(lum1+0.05)},level(color2){let contrastRatio=this.contrast(color2);if(contrastRatio>=7)return"AAA";return contrastRatio>=4.5?"AA":""},isDark(){let rgb=this.rgb().color;return(rgb[0]*2126+rgb[1]*7152+rgb[2]*722)/1e4<128},isLight(){return!this.isDark()},negate(){let rgb=this.rgb();for(let i=0;i<3;i++)rgb.color[i]=255-rgb.color[i];return rgb},lighten(ratio){let hsl=this.hsl();return hsl.color[2]+=hsl.color[2]*ratio,hsl},darken(ratio){let hsl=this.hsl();return hsl.color[2]-=hsl.color[2]*ratio,hsl},saturate(ratio){let hsl=this.hsl();return hsl.color[1]+=hsl.color[1]*ratio,hsl},desaturate(ratio){let hsl=this.hsl();return hsl.color[1]-=hsl.color[1]*ratio,hsl},whiten(ratio){let hwb=this.hwb();return hwb.color[1]+=hwb.color[1]*ratio,hwb},blacken(ratio){let hwb=this.hwb();return hwb.color[2]+=hwb.color[2]*ratio,hwb},grayscale(){let rgb=this.rgb().color,value2=rgb[0]*0.3+rgb[1]*0.59+rgb[2]*0.11;return Color.rgb(value2,value2,value2)},fade(ratio){return this.alpha(this.valpha-this.valpha*ratio)},opaquer(ratio){return this.alpha(this.valpha+this.valpha*ratio)},rotate(degrees){let hsl=this.hsl(),hue=hsl.color[0];return hue=(hue+degrees)%360,hue=hue<0?360+hue:hue,hsl.color[0]=hue,hsl},mix(mixinColor,weight){if(!mixinColor||!mixinColor.rgb)throw Error('Argument to "mix" was not a Color instance, but rather an instance of '+typeof mixinColor);let color1=mixinColor.rgb(),color2=this.rgb(),p=weight===void 0?0.5:weight,w=2*p-1,a=color1.alpha()-color2.alpha(),w1=((w*a===-1?w:(w+a)/(1+w*a))+1)/2,w2=1-w1;return Color.rgb(w1*color1.red()+w2*color2.red(),w1*color1.green()+w2*color2.green(),w1*color1.blue()+w2*color2.blue(),color1.alpha()*p+color2.alpha()*(1-p))}};for(let model of Object.keys(convert2)){if(skippedModels.includes(model))continue;let{channels}=convert2[model];Color.prototype[model]=function(...args){if(this.model===model)return new Color(this);if(args.length>0)return new Color(args,model);return new Color([...assertArray(convert2[this.model][model].raw(this.color)),this.valpha],model)},Color[model]=function(...args){let color=args[0];if(typeof color==="number")color=zeroArray(args,channels);return new Color(color,model)}}function roundTo(number3,places){return Number(number3.toFixed(places))}function roundToPlace(places){return function(number3){return roundTo(number3,places)}}function getset(model,channel,modifier){model=Array.isArray(model)?model:[model];for(let m of model)(limiters[m]||(limiters[m]=[]))[channel]=modifier;return model=model[0],function(value2){let result;if(value2!==void 0){if(modifier)value2=modifier(value2);return result=this[model](),result.color[channel]=value2,result}if(result=this[model]().color[channel],modifier)result=modifier(result);return result}}function maxfn(max){return function(v){return Math.max(0,Math.min(max,v))}}function assertArray(value2){return Array.isArray(value2)?value2:[value2]}function zeroArray(array3,length){for(let i=0;i<length;i++)if(typeof array3[i]!=="number")array3[i]=0;return array3}module3.exports=Color});var require_input=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),sharp=require_sharp(),align={left:"low",center:"centre",centre:"centre",right:"high"};function _inputOptionsFromObject(obj){let{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}=obj;return[raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd].some(is2.defined)?{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}:void 0}function _createInputDescriptor(input,inputOptions,containerOptions){let inputDescriptor={failOn:"warning",limitInputPixels:Math.pow(16383,2),ignoreIcc:!1,unlimited:!1,sequentialRead:!0};if(is2.string(input))inputDescriptor.file=input;else if(is2.buffer(input)){if(input.length===0)throw Error("Input Buffer is empty");inputDescriptor.buffer=input}else if(is2.arrayBuffer(input)){if(input.byteLength===0)throw Error("Input bit Array is empty");inputDescriptor.buffer=Buffer.from(input,0,input.byteLength)}else if(is2.typedArray(input)){if(input.length===0)throw Error("Input Bit Array is empty");inputDescriptor.buffer=Buffer.from(input.buffer,input.byteOffset,input.byteLength)}else if(is2.plainObject(input)&&!is2.defined(inputOptions)){if(inputOptions=input,_inputOptionsFromObject(inputOptions))inputDescriptor.buffer=[]}else if(!is2.defined(input)&&!is2.defined(inputOptions)&&is2.object(containerOptions)&&containerOptions.allowStream)inputDescriptor.buffer=[];else throw Error(`Unsupported input '${input}' of type ${typeof input}${is2.defined(inputOptions)?` when also providing options of type ${typeof inputOptions}`:""}`);if(is2.object(inputOptions)){if(is2.defined(inputOptions.failOnError))if(is2.bool(inputOptions.failOnError))inputDescriptor.failOn=inputOptions.failOnError?"warning":"none";else throw is2.invalidParameterError("failOnError","boolean",inputOptions.failOnError);if(is2.defined(inputOptions.failOn))if(is2.string(inputOptions.failOn)&&is2.inArray(inputOptions.failOn,["none","truncated","error","warning"]))inputDescriptor.failOn=inputOptions.failOn;else throw is2.invalidParameterError("failOn","one of: none, truncated, error, warning",inputOptions.failOn);if(is2.defined(inputOptions.density))if(is2.inRange(inputOptions.density,1,1e5))inputDescriptor.density=inputOptions.density;else throw is2.invalidParameterError("density","number between 1 and 100000",inputOptions.density);if(is2.defined(inputOptions.ignoreIcc))if(is2.bool(inputOptions.ignoreIcc))inputDescriptor.ignoreIcc=inputOptions.ignoreIcc;else throw is2.invalidParameterError("ignoreIcc","boolean",inputOptions.ignoreIcc);if(is2.defined(inputOptions.limitInputPixels))if(is2.bool(inputOptions.limitInputPixels))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels?Math.pow(16383,2):0;else if(is2.integer(inputOptions.limitInputPixels)&&is2.inRange(inputOptions.limitInputPixels,0,Number.MAX_SAFE_INTEGER))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels;else throw is2.invalidParameterError("limitInputPixels","positive integer",inputOptions.limitInputPixels);if(is2.defined(inputOptions.unlimited))if(is2.bool(inputOptions.unlimited))inputDescriptor.unlimited=inputOptions.unlimited;else throw is2.invalidParameterError("unlimited","boolean",inputOptions.unlimited);if(is2.defined(inputOptions.sequentialRead))if(is2.bool(inputOptions.sequentialRead))inputDescriptor.sequentialRead=inputOptions.sequentialRead;else throw is2.invalidParameterError("sequentialRead","boolean",inputOptions.sequentialRead);if(is2.defined(inputOptions.raw))if(is2.object(inputOptions.raw)&&is2.integer(inputOptions.raw.width)&&inputOptions.raw.width>0&&is2.integer(inputOptions.raw.height)&&inputOptions.raw.height>0&&is2.integer(inputOptions.raw.channels)&&is2.inRange(inputOptions.raw.channels,1,4))switch(inputDescriptor.rawWidth=inputOptions.raw.width,inputDescriptor.rawHeight=inputOptions.raw.height,inputDescriptor.rawChannels=inputOptions.raw.channels,inputDescriptor.rawPremultiplied=!!inputOptions.raw.premultiplied,input.constructor){case Uint8Array:case Uint8ClampedArray:inputDescriptor.rawDepth="uchar";break;case Int8Array:inputDescriptor.rawDepth="char";break;case Uint16Array:inputDescriptor.rawDepth="ushort";break;case Int16Array:inputDescriptor.rawDepth="short";break;case Uint32Array:inputDescriptor.rawDepth="uint";break;case Int32Array:inputDescriptor.rawDepth="int";break;case Float32Array:inputDescriptor.rawDepth="float";break;case Float64Array:inputDescriptor.rawDepth="double";break;default:inputDescriptor.rawDepth="uchar";break}else throw Error("Expected width, height and channels for raw pixel input");if(is2.defined(inputOptions.animated))if(is2.bool(inputOptions.animated))inputDescriptor.pages=inputOptions.animated?-1:1;else throw is2.invalidParameterError("animated","boolean",inputOptions.animated);if(is2.defined(inputOptions.pages))if(is2.integer(inputOptions.pages)&&is2.inRange(inputOptions.pages,-1,1e5))inputDescriptor.pages=inputOptions.pages;else throw is2.invalidParameterError("pages","integer between -1 and 100000",inputOptions.pages);if(is2.defined(inputOptions.page))if(is2.integer(inputOptions.page)&&is2.inRange(inputOptions.page,0,1e5))inputDescriptor.page=inputOptions.page;else throw is2.invalidParameterError("page","integer between 0 and 100000",inputOptions.page);if(is2.defined(inputOptions.level))if(is2.integer(inputOptions.level)&&is2.inRange(inputOptions.level,0,256))inputDescriptor.level=inputOptions.level;else throw is2.invalidParameterError("level","integer between 0 and 256",inputOptions.level);if(is2.defined(inputOptions.subifd))if(is2.integer(inputOptions.subifd)&&is2.inRange(inputOptions.subifd,-1,1e5))inputDescriptor.subifd=inputOptions.subifd;else throw is2.invalidParameterError("subifd","integer between -1 and 100000",inputOptions.subifd);if(is2.defined(inputOptions.create))if(is2.object(inputOptions.create)&&is2.integer(inputOptions.create.width)&&inputOptions.create.width>0&&is2.integer(inputOptions.create.height)&&inputOptions.create.height>0&&is2.integer(inputOptions.create.channels)){if(inputDescriptor.createWidth=inputOptions.create.width,inputDescriptor.createHeight=inputOptions.create.height,inputDescriptor.createChannels=inputOptions.create.channels,is2.defined(inputOptions.create.noise)){if(!is2.object(inputOptions.create.noise))throw Error("Expected noise to be an object");if(!is2.inArray(inputOptions.create.noise.type,["gaussian"]))throw Error("Only gaussian noise is supported at the moment");if(!is2.inRange(inputOptions.create.channels,1,4))throw is2.invalidParameterError("create.channels","number between 1 and 4",inputOptions.create.channels);if(inputDescriptor.createNoiseType=inputOptions.create.noise.type,is2.number(inputOptions.create.noise.mean)&&is2.inRange(inputOptions.create.noise.mean,0,1e4))inputDescriptor.createNoiseMean=inputOptions.create.noise.mean;else throw is2.invalidParameterError("create.noise.mean","number between 0 and 10000",inputOptions.create.noise.mean);if(is2.number(inputOptions.create.noise.sigma)&&is2.inRange(inputOptions.create.noise.sigma,0,1e4))inputDescriptor.createNoiseSigma=inputOptions.create.noise.sigma;else throw is2.invalidParameterError("create.noise.sigma","number between 0 and 10000",inputOptions.create.noise.sigma)}else if(is2.defined(inputOptions.create.background)){if(!is2.inRange(inputOptions.create.channels,3,4))throw is2.invalidParameterError("create.channels","number between 3 and 4",inputOptions.create.channels);let background=color(inputOptions.create.background);inputDescriptor.createBackground=[background.red(),background.green(),background.blue(),Math.round(background.alpha()*255)]}else throw Error("Expected valid noise or background to create a new input image");delete inputDescriptor.buffer}else throw Error("Expected valid width, height and channels to create a new input image");if(is2.defined(inputOptions.text))if(is2.object(inputOptions.text)&&is2.string(inputOptions.text.text)){if(inputDescriptor.textValue=inputOptions.text.text,is2.defined(inputOptions.text.height)&&is2.defined(inputOptions.text.dpi))throw Error("Expected only one of dpi or height");if(is2.defined(inputOptions.text.font))if(is2.string(inputOptions.text.font))inputDescriptor.textFont=inputOptions.text.font;else throw is2.invalidParameterError("text.font","string",inputOptions.text.font);if(is2.defined(inputOptions.text.fontfile))if(is2.string(inputOptions.text.fontfile))inputDescriptor.textFontfile=inputOptions.text.fontfile;else throw is2.invalidParameterError("text.fontfile","string",inputOptions.text.fontfile);if(is2.defined(inputOptions.text.width))if(is2.integer(inputOptions.text.width)&&inputOptions.text.width>0)inputDescriptor.textWidth=inputOptions.text.width;else throw is2.invalidParameterError("text.width","positive integer",inputOptions.text.width);if(is2.defined(inputOptions.text.height))if(is2.integer(inputOptions.text.height)&&inputOptions.text.height>0)inputDescriptor.textHeight=inputOptions.text.height;else throw is2.invalidParameterError("text.height","positive integer",inputOptions.text.height);if(is2.defined(inputOptions.text.align))if(is2.string(inputOptions.text.align)&&is2.string(this.constructor.align[inputOptions.text.align]))inputDescriptor.textAlign=this.constructor.align[inputOptions.text.align];else throw is2.invalidParameterError("text.align","valid alignment",inputOptions.text.align);if(is2.defined(inputOptions.text.justify))if(is2.bool(inputOptions.text.justify))inputDescriptor.textJustify=inputOptions.text.justify;else throw is2.invalidParameterError("text.justify","boolean",inputOptions.text.justify);if(is2.defined(inputOptions.text.dpi))if(is2.integer(inputOptions.text.dpi)&&is2.inRange(inputOptions.text.dpi,1,1e6))inputDescriptor.textDpi=inputOptions.text.dpi;else throw is2.invalidParameterError("text.dpi","integer between 1 and 1000000",inputOptions.text.dpi);if(is2.defined(inputOptions.text.rgba))if(is2.bool(inputOptions.text.rgba))inputDescriptor.textRgba=inputOptions.text.rgba;else throw is2.invalidParameterError("text.rgba","bool",inputOptions.text.rgba);if(is2.defined(inputOptions.text.spacing))if(is2.integer(inputOptions.text.spacing)&&is2.inRange(inputOptions.text.spacing,-1e6,1e6))inputDescriptor.textSpacing=inputOptions.text.spacing;else throw is2.invalidParameterError("text.spacing","integer between -1000000 and 1000000",inputOptions.text.spacing);if(is2.defined(inputOptions.text.wrap))if(is2.string(inputOptions.text.wrap)&&is2.inArray(inputOptions.text.wrap,["word","char","word-char","none"]))inputDescriptor.textWrap=inputOptions.text.wrap;else throw is2.invalidParameterError("text.wrap","one of: word, char, word-char, none",inputOptions.text.wrap);delete inputDescriptor.buffer}else throw Error("Expected a valid string to create an image with text.")}else if(is2.defined(inputOptions))throw Error("Invalid input options "+inputOptions);return inputDescriptor}function _write(chunk,encoding,callback){if(Array.isArray(this.options.input.buffer))if(is2.buffer(chunk)){if(this.options.input.buffer.length===0)this.on("finish",()=>{this.streamInFinished=!0});this.options.input.buffer.push(chunk),callback()}else callback(Error("Non-Buffer data on Writable Stream"));else callback(Error("Unexpected data on Writable Stream"))}function _flattenBufferIn(){if(this._isStreamInput())this.options.input.buffer=Buffer.concat(this.options.input.buffer)}function _isStreamInput(){return Array.isArray(this.options.input.buffer)}function metadata(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)})});else sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{let finished=()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})};if(this.writableFinished)finished();else this.once("finish",finished)});else return new Promise((resolve2,reject)=>{sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})})}function stats(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)})});else sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.on("finish",function(){this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})});else return new Promise((resolve2,reject)=>{sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{_inputOptionsFromObject,_createInputDescriptor,_write,_flattenBufferIn,_isStreamInput,metadata,stats}),Sharp.align=align}});var require_resize=__commonJS((exports,module3)=>{var is2=require_is(),gravity={center:0,centre:0,north:1,east:2,south:3,west:4,northeast:5,southeast:6,southwest:7,northwest:8},position={top:1,right:2,bottom:3,left:4,"right top":5,"right bottom":6,"left bottom":7,"left top":8},extendWith={background:"background",copy:"copy",repeat:"repeat",mirror:"mirror"},strategy={entropy:16,attention:17},kernel={nearest:"nearest",linear:"linear",cubic:"cubic",mitchell:"mitchell",lanczos2:"lanczos2",lanczos3:"lanczos3"},fit={contain:"contain",cover:"cover",fill:"fill",inside:"inside",outside:"outside"},mapFitToCanvas={contain:"embed",cover:"crop",fill:"ignore_aspect",inside:"max",outside:"min"};function isRotationExpected(options){return options.angle%360!==0||options.useExifOrientation===!0||options.rotationAngle!==0}function isResizeExpected(options){return options.width!==-1||options.height!==-1}function resize(widthOrOptions,height,options){if(isResizeExpected(this.options))this.options.debuglog("ignoring previous resize options");if(this.options.widthPost!==-1)this.options.debuglog("operation order will be: extract, resize, extract");if(is2.defined(widthOrOptions))if(is2.object(widthOrOptions)&&!is2.defined(options))options=widthOrOptions;else if(is2.integer(widthOrOptions)&&widthOrOptions>0)this.options.width=widthOrOptions;else throw is2.invalidParameterError("width","positive integer",widthOrOptions);else this.options.width=-1;if(is2.defined(height))if(is2.integer(height)&&height>0)this.options.height=height;else throw is2.invalidParameterError("height","positive integer",height);else this.options.height=-1;if(is2.object(options)){if(is2.defined(options.width))if(is2.integer(options.width)&&options.width>0)this.options.width=options.width;else throw is2.invalidParameterError("width","positive integer",options.width);if(is2.defined(options.height))if(is2.integer(options.height)&&options.height>0)this.options.height=options.height;else throw is2.invalidParameterError("height","positive integer",options.height);if(is2.defined(options.fit)){let canvas=mapFitToCanvas[options.fit];if(is2.string(canvas))this.options.canvas=canvas;else throw is2.invalidParameterError("fit","valid fit",options.fit)}if(is2.defined(options.position)){let pos=is2.integer(options.position)?options.position:strategy[options.position]||position[options.position]||gravity[options.position];if(is2.integer(pos)&&(is2.inRange(pos,0,8)||is2.inRange(pos,16,17)))this.options.position=pos;else throw is2.invalidParameterError("position","valid position/gravity/strategy",options.position)}if(this._setBackgroundColourOption("resizeBackground",options.background),is2.defined(options.kernel))if(is2.string(kernel[options.kernel]))this.options.kernel=kernel[options.kernel];else throw is2.invalidParameterError("kernel","valid kernel name",options.kernel);if(is2.defined(options.withoutEnlargement))this._setBooleanOption("withoutEnlargement",options.withoutEnlargement);if(is2.defined(options.withoutReduction))this._setBooleanOption("withoutReduction",options.withoutReduction);if(is2.defined(options.fastShrinkOnLoad))this._setBooleanOption("fastShrinkOnLoad",options.fastShrinkOnLoad)}if(isRotationExpected(this.options)&&isResizeExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}function extend(extend2){if(is2.integer(extend2)&&extend2>0)this.options.extendTop=extend2,this.options.extendBottom=extend2,this.options.extendLeft=extend2,this.options.extendRight=extend2;else if(is2.object(extend2)){if(is2.defined(extend2.top))if(is2.integer(extend2.top)&&extend2.top>=0)this.options.extendTop=extend2.top;else throw is2.invalidParameterError("top","positive integer",extend2.top);if(is2.defined(extend2.bottom))if(is2.integer(extend2.bottom)&&extend2.bottom>=0)this.options.extendBottom=extend2.bottom;else throw is2.invalidParameterError("bottom","positive integer",extend2.bottom);if(is2.defined(extend2.left))if(is2.integer(extend2.left)&&extend2.left>=0)this.options.extendLeft=extend2.left;else throw is2.invalidParameterError("left","positive integer",extend2.left);if(is2.defined(extend2.right))if(is2.integer(extend2.right)&&extend2.right>=0)this.options.extendRight=extend2.right;else throw is2.invalidParameterError("right","positive integer",extend2.right);if(this._setBackgroundColourOption("extendBackground",extend2.background),is2.defined(extend2.extendWith))if(is2.string(extendWith[extend2.extendWith]))this.options.extendWith=extendWith[extend2.extendWith];else throw is2.invalidParameterError("extendWith","one of: background, copy, repeat, mirror",extend2.extendWith)}else throw is2.invalidParameterError("extend","integer or object",extend2);return this}function extract3(options){let suffix=isResizeExpected(this.options)||this.options.widthPre!==-1?"Post":"Pre";if(this.options[`width${suffix}`]!==-1)this.options.debuglog("ignoring previous extract options");if(["left","top","width","height"].forEach(function(name2){let value2=options[name2];if(is2.integer(value2)&&value2>=0)this.options[name2+(name2==="left"||name2==="top"?"Offset":"")+suffix]=value2;else throw is2.invalidParameterError(name2,"integer",value2)},this),isRotationExpected(this.options)&&!isResizeExpected(this.options)){if(this.options.widthPre===-1||this.options.widthPost===-1)this.options.rotateBeforePreExtract=!0}return this}function trim(options){if(this.options.trimThreshold=10,is2.defined(options))if(is2.object(options)){if(is2.defined(options.background))this._setBackgroundColourOption("trimBackground",options.background);if(is2.defined(options.threshold))if(is2.number(options.threshold)&&options.threshold>=0)this.options.trimThreshold=options.threshold;else throw is2.invalidParameterError("threshold","positive number",options.threshold);if(is2.defined(options.lineArt))this._setBooleanOption("trimLineArt",options.lineArt)}else throw is2.invalidParameterError("trim","object",options);if(isRotationExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{resize,extend,extract:extract3,trim}),Sharp.gravity=gravity,Sharp.strategy=strategy,Sharp.kernel=kernel,Sharp.fit=fit,Sharp.position=position}});var require_composite=__commonJS((exports,module3)=>{var is2=require_is(),blend={clear:"clear",source:"source",over:"over",in:"in",out:"out",atop:"atop",dest:"dest","dest-over":"dest-over","dest-in":"dest-in","dest-out":"dest-out","dest-atop":"dest-atop",xor:"xor",add:"add",saturate:"saturate",multiply:"multiply",screen:"screen",overlay:"overlay",darken:"darken",lighten:"lighten","colour-dodge":"colour-dodge","color-dodge":"colour-dodge","colour-burn":"colour-burn","color-burn":"colour-burn","hard-light":"hard-light","soft-light":"soft-light",difference:"difference",exclusion:"exclusion"};function composite3(images){if(!Array.isArray(images))throw is2.invalidParameterError("images to composite","array",images);return this.options.composite=images.map((image)=>{if(!is2.object(image))throw is2.invalidParameterError("image to composite","object",image);let inputOptions=this._inputOptionsFromObject(image),composite4={input:this._createInputDescriptor(image.input,inputOptions,{allowStream:!1}),blend:"over",tile:!1,left:0,top:0,hasOffset:!1,gravity:0,premultiplied:!1};if(is2.defined(image.blend))if(is2.string(blend[image.blend]))composite4.blend=blend[image.blend];else throw is2.invalidParameterError("blend","valid blend name",image.blend);if(is2.defined(image.tile))if(is2.bool(image.tile))composite4.tile=image.tile;else throw is2.invalidParameterError("tile","boolean",image.tile);if(is2.defined(image.left))if(is2.integer(image.left))composite4.left=image.left;else throw is2.invalidParameterError("left","integer",image.left);if(is2.defined(image.top))if(is2.integer(image.top))composite4.top=image.top;else throw is2.invalidParameterError("top","integer",image.top);if(is2.defined(image.top)!==is2.defined(image.left))throw Error("Expected both left and top to be set");else composite4.hasOffset=is2.integer(image.top)&&is2.integer(image.left);if(is2.defined(image.gravity))if(is2.integer(image.gravity)&&is2.inRange(image.gravity,0,8))composite4.gravity=image.gravity;else if(is2.string(image.gravity)&&is2.integer(this.constructor.gravity[image.gravity]))composite4.gravity=this.constructor.gravity[image.gravity];else throw is2.invalidParameterError("gravity","valid gravity",image.gravity);if(is2.defined(image.premultiplied))if(is2.bool(image.premultiplied))composite4.premultiplied=image.premultiplied;else throw is2.invalidParameterError("premultiplied","boolean",image.premultiplied);return composite4}),this}module3.exports=function(Sharp){Sharp.prototype.composite=composite3,Sharp.blend=blend}});var require_operation=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),vipsPrecision={integer:"integer",float:"float",approximate:"approximate"};function rotate(angle,options){if(this.options.useExifOrientation||this.options.angle||this.options.rotationAngle)this.options.debuglog("ignoring previous rotate options");if(!is2.defined(angle))this.options.useExifOrientation=!0;else if(is2.integer(angle)&&!(angle%90))this.options.angle=angle;else if(is2.number(angle)){if(this.options.rotationAngle=angle,is2.object(options)&&options.background){let backgroundColour=color(options.background);this.options.rotationBackground=[backgroundColour.red(),backgroundColour.green(),backgroundColour.blue(),Math.round(backgroundColour.alpha()*255)]}}else throw is2.invalidParameterError("angle","numeric",angle);return this}function flip(flip2){return this.options.flip=is2.bool(flip2)?flip2:!0,this}function flop(flop2){return this.options.flop=is2.bool(flop2)?flop2:!0,this}function affine(matrix,options){let flatMatrix=[].concat(...matrix);if(flatMatrix.length===4&&flatMatrix.every(is2.number))this.options.affineMatrix=flatMatrix;else throw is2.invalidParameterError("matrix","1x4 or 2x2 array",matrix);if(is2.defined(options))if(is2.object(options)){if(this._setBackgroundColourOption("affineBackground",options.background),is2.defined(options.idx))if(is2.number(options.idx))this.options.affineIdx=options.idx;else throw is2.invalidParameterError("options.idx","number",options.idx);if(is2.defined(options.idy))if(is2.number(options.idy))this.options.affineIdy=options.idy;else throw is2.invalidParameterError("options.idy","number",options.idy);if(is2.defined(options.odx))if(is2.number(options.odx))this.options.affineOdx=options.odx;else throw is2.invalidParameterError("options.odx","number",options.odx);if(is2.defined(options.ody))if(is2.number(options.ody))this.options.affineOdy=options.ody;else throw is2.invalidParameterError("options.ody","number",options.ody);if(is2.defined(options.interpolator))if(is2.inArray(options.interpolator,Object.values(this.constructor.interpolators)))this.options.affineInterpolator=options.interpolator;else throw is2.invalidParameterError("options.interpolator","valid interpolator name",options.interpolator)}else throw is2.invalidParameterError("options","object",options);return this}function sharpen(options,flat,jagged){if(!is2.defined(options))this.options.sharpenSigma=-1;else if(is2.bool(options))this.options.sharpenSigma=options?-1:0;else if(is2.number(options)&&is2.inRange(options,0.01,1e4)){if(this.options.sharpenSigma=options,is2.defined(flat))if(is2.number(flat)&&is2.inRange(flat,0,1e4))this.options.sharpenM1=flat;else throw is2.invalidParameterError("flat","number between 0 and 10000",flat);if(is2.defined(jagged))if(is2.number(jagged)&&is2.inRange(jagged,0,1e4))this.options.sharpenM2=jagged;else throw is2.invalidParameterError("jagged","number between 0 and 10000",jagged)}else if(is2.plainObject(options)){if(is2.number(options.sigma)&&is2.inRange(options.sigma,0.000001,10))this.options.sharpenSigma=options.sigma;else throw is2.invalidParameterError("options.sigma","number between 0.000001 and 10",options.sigma);if(is2.defined(options.m1))if(is2.number(options.m1)&&is2.inRange(options.m1,0,1e6))this.options.sharpenM1=options.m1;else throw is2.invalidParameterError("options.m1","number between 0 and 1000000",options.m1);if(is2.defined(options.m2))if(is2.number(options.m2)&&is2.inRange(options.m2,0,1e6))this.options.sharpenM2=options.m2;else throw is2.invalidParameterError("options.m2","number between 0 and 1000000",options.m2);if(is2.defined(options.x1))if(is2.number(options.x1)&&is2.inRange(options.x1,0,1e6))this.options.sharpenX1=options.x1;else throw is2.invalidParameterError("options.x1","number between 0 and 1000000",options.x1);if(is2.defined(options.y2))if(is2.number(options.y2)&&is2.inRange(options.y2,0,1e6))this.options.sharpenY2=options.y2;else throw is2.invalidParameterError("options.y2","number between 0 and 1000000",options.y2);if(is2.defined(options.y3))if(is2.number(options.y3)&&is2.inRange(options.y3,0,1e6))this.options.sharpenY3=options.y3;else throw is2.invalidParameterError("options.y3","number between 0 and 1000000",options.y3)}else throw is2.invalidParameterError("sigma","number between 0.01 and 10000",options);return this}function median2(size){if(!is2.defined(size))this.options.medianSize=3;else if(is2.integer(size)&&is2.inRange(size,1,1000))this.options.medianSize=size;else throw is2.invalidParameterError("size","integer between 1 and 1000",size);return this}function blur(options){let sigma;if(is2.number(options))sigma=options;else if(is2.plainObject(options)){if(!is2.number(options.sigma))throw is2.invalidParameterError("options.sigma","number between 0.3 and 1000",sigma);if(sigma=options.sigma,"precision"in options)if(is2.string(vipsPrecision[options.precision]))this.options.precision=vipsPrecision[options.precision];else throw is2.invalidParameterError("precision","one of: integer, float, approximate",options.precision);if("minAmplitude"in options)if(is2.number(options.minAmplitude)&&is2.inRange(options.minAmplitude,0.001,1))this.options.minAmpl=options.minAmplitude;else throw is2.invalidParameterError("minAmplitude","number between 0.001 and 1",options.minAmplitude)}if(!is2.defined(options))this.options.blurSigma=-1;else if(is2.bool(options))this.options.blurSigma=options?-1:0;else if(is2.number(sigma)&&is2.inRange(sigma,0.3,1000))this.options.blurSigma=sigma;else throw is2.invalidParameterError("sigma","number between 0.3 and 1000",sigma);return this}function flatten(options){if(this.options.flatten=is2.bool(options)?options:!0,is2.object(options))this._setBackgroundColourOption("flattenBackground",options.background);return this}function unflatten(){return this.options.unflatten=!0,this}function gamma(gamma2,gammaOut){if(!is2.defined(gamma2))this.options.gamma=2.2;else if(is2.number(gamma2)&&is2.inRange(gamma2,1,3))this.options.gamma=gamma2;else throw is2.invalidParameterError("gamma","number between 1.0 and 3.0",gamma2);if(!is2.defined(gammaOut))this.options.gammaOut=this.options.gamma;else if(is2.number(gammaOut)&&is2.inRange(gammaOut,1,3))this.options.gammaOut=gammaOut;else throw is2.invalidParameterError("gammaOut","number between 1.0 and 3.0",gammaOut);return this}function negate(options){if(this.options.negate=is2.bool(options)?options:!0,is2.plainObject(options)&&"alpha"in options)if(!is2.bool(options.alpha))throw is2.invalidParameterError("alpha","should be boolean value",options.alpha);else this.options.negateAlpha=options.alpha;return this}function normalise(options){if(is2.plainObject(options)){if(is2.defined(options.lower))if(is2.number(options.lower)&&is2.inRange(options.lower,0,99))this.options.normaliseLower=options.lower;else throw is2.invalidParameterError("lower","number between 0 and 99",options.lower);if(is2.defined(options.upper))if(is2.number(options.upper)&&is2.inRange(options.upper,1,100))this.options.normaliseUpper=options.upper;else throw is2.invalidParameterError("upper","number between 1 and 100",options.upper)}if(this.options.normaliseLower>=this.options.normaliseUpper)throw is2.invalidParameterError("range","lower to be less than upper",`${this.options.normaliseLower} >= ${this.options.normaliseUpper}`);return this.options.normalise=!0,this}function normalize3(options){return this.normalise(options)}function clahe(options){if(is2.plainObject(options)){if(is2.integer(options.width)&&options.width>0)this.options.claheWidth=options.width;else throw is2.invalidParameterError("width","integer greater than zero",options.width);if(is2.integer(options.height)&&options.height>0)this.options.claheHeight=options.height;else throw is2.invalidParameterError("height","integer greater than zero",options.height);if(is2.defined(options.maxSlope))if(is2.integer(options.maxSlope)&&is2.inRange(options.maxSlope,0,100))this.options.claheMaxSlope=options.maxSlope;else throw is2.invalidParameterError("maxSlope","integer between 0 and 100",options.maxSlope)}else throw is2.invalidParameterError("options","plain object",options);return this}function convolve(kernel){if(!is2.object(kernel)||!Array.isArray(kernel.kernel)||!is2.integer(kernel.width)||!is2.integer(kernel.height)||!is2.inRange(kernel.width,3,1001)||!is2.inRange(kernel.height,3,1001)||kernel.height*kernel.width!==kernel.kernel.length)throw Error("Invalid convolution kernel");if(!is2.integer(kernel.scale))kernel.scale=kernel.kernel.reduce(function(a,b){return a+b},0);if(kernel.scale<1)kernel.scale=1;if(!is2.integer(kernel.offset))kernel.offset=0;return this.options.convKernel=kernel,this}function threshold(threshold2,options){if(!is2.defined(threshold2))this.options.threshold=128;else if(is2.bool(threshold2))this.options.threshold=threshold2?128:0;else if(is2.integer(threshold2)&&is2.inRange(threshold2,0,255))this.options.threshold=threshold2;else throw is2.invalidParameterError("threshold","integer between 0 and 255",threshold2);if(!is2.object(options)||options.greyscale===!0||options.grayscale===!0)this.options.thresholdGrayscale=!0;else this.options.thresholdGrayscale=!1;return this}function boolean3(operand,operator,options){if(this.options.boolean=this._createInputDescriptor(operand,options),is2.string(operator)&&is2.inArray(operator,["and","or","eor"]))this.options.booleanOp=operator;else throw is2.invalidParameterError("operator","one of: and, or, eor",operator);return this}function linear(a,b){if(!is2.defined(a)&&is2.number(b))a=1;else if(is2.number(a)&&!is2.defined(b))b=0;if(!is2.defined(a))this.options.linearA=[];else if(is2.number(a))this.options.linearA=[a];else if(Array.isArray(a)&&a.length&&a.every(is2.number))this.options.linearA=a;else throw is2.invalidParameterError("a","number or array of numbers",a);if(!is2.defined(b))this.options.linearB=[];else if(is2.number(b))this.options.linearB=[b];else if(Array.isArray(b)&&b.length&&b.every(is2.number))this.options.linearB=b;else throw is2.invalidParameterError("b","number or array of numbers",b);if(this.options.linearA.length!==this.options.linearB.length)throw Error("Expected a and b to be arrays of the same length");return this}function recomb(inputMatrix){if(!Array.isArray(inputMatrix))throw is2.invalidParameterError("inputMatrix","array",inputMatrix);if(inputMatrix.length!==3&&inputMatrix.length!==4)throw is2.invalidParameterError("inputMatrix","3x3 or 4x4 array",inputMatrix.length);let recombMatrix=inputMatrix.flat().map(Number);if(recombMatrix.length!==9&&recombMatrix.length!==16)throw is2.invalidParameterError("inputMatrix","cardinality of 9 or 16",recombMatrix.length);return this.options.recombMatrix=recombMatrix,this}function modulate(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","plain object",options);if("brightness"in options)if(is2.number(options.brightness)&&options.brightness>=0)this.options.brightness=options.brightness;else throw is2.invalidParameterError("brightness","number above zero",options.brightness);if("saturation"in options)if(is2.number(options.saturation)&&options.saturation>=0)this.options.saturation=options.saturation;else throw is2.invalidParameterError("saturation","number above zero",options.saturation);if("hue"in options)if(is2.integer(options.hue))this.options.hue=options.hue%360;else throw is2.invalidParameterError("hue","number",options.hue);if("lightness"in options)if(is2.number(options.lightness))this.options.lightness=options.lightness;else throw is2.invalidParameterError("lightness","number",options.lightness);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{rotate,flip,flop,affine,sharpen,median:median2,blur,flatten,unflatten,gamma,negate,normalise,normalize:normalize3,clahe,convolve,threshold,boolean:boolean3,linear,recomb,modulate})}});var require_colour=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),colourspace={multiband:"multiband","b-w":"b-w",bw:"b-w",cmyk:"cmyk",srgb:"srgb"};function tint(tint2){return this._setBackgroundColourOption("tint",tint2),this}function greyscale(greyscale2){return this.options.greyscale=is2.bool(greyscale2)?greyscale2:!0,this}function grayscale(grayscale2){return this.greyscale(grayscale2)}function pipelineColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspacePipeline=colourspace2,this}function pipelineColorspace(colorspace){return this.pipelineColourspace(colorspace)}function toColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspace=colourspace2,this}function toColorspace(colorspace){return this.toColourspace(colorspace)}function _setBackgroundColourOption(key2,value2){if(is2.defined(value2))if(is2.object(value2)||is2.string(value2)){let colour=color(value2);this.options[key2]=[colour.red(),colour.green(),colour.blue(),Math.round(colour.alpha()*255)]}else throw is2.invalidParameterError("background","object or string",value2)}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{tint,greyscale,grayscale,pipelineColourspace,pipelineColorspace,toColourspace,toColorspace,_setBackgroundColourOption}),Sharp.colourspace=colourspace,Sharp.colorspace=colourspace}});var require_channel=__commonJS((exports,module3)=>{var is2=require_is(),bool={and:"and",or:"or",eor:"eor"};function removeAlpha(){return this.options.removeAlpha=!0,this}function ensureAlpha(alpha){if(is2.defined(alpha))if(is2.number(alpha)&&is2.inRange(alpha,0,1))this.options.ensureAlpha=alpha;else throw is2.invalidParameterError("alpha","number between 0 and 1",alpha);else this.options.ensureAlpha=1;return this}function extractChannel(channel){let channelMap={red:0,green:1,blue:2,alpha:3};if(Object.keys(channelMap).includes(channel))channel=channelMap[channel];if(is2.integer(channel)&&is2.inRange(channel,0,4))this.options.extractChannel=channel;else throw is2.invalidParameterError("channel","integer or one of: red, green, blue, alpha",channel);return this}function joinChannel(images,options){if(Array.isArray(images))images.forEach(function(image){this.options.joinChannelIn.push(this._createInputDescriptor(image,options))},this);else this.options.joinChannelIn.push(this._createInputDescriptor(images,options));return this}function bandbool(boolOp){if(is2.string(boolOp)&&is2.inArray(boolOp,["and","or","eor"]))this.options.bandBoolOp=boolOp;else throw is2.invalidParameterError("boolOp","one of: and, or, eor",boolOp);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{removeAlpha,ensureAlpha,extractChannel,joinChannel,bandbool}),Sharp.bool=bool}});var require_output=__commonJS((exports,module3)=>{var path2=__require("path"),is2=require_is(),sharp=require_sharp(),formats2=new Map([["heic","heif"],["heif","heif"],["avif","avif"],["jpeg","jpeg"],["jpg","jpeg"],["jpe","jpeg"],["tile","tile"],["dz","tile"],["png","png"],["raw","raw"],["tiff","tiff"],["tif","tiff"],["webp","webp"],["gif","gif"],["jp2","jp2"],["jpx","jp2"],["j2k","jp2"],["j2c","jp2"],["jxl","jxl"]]),jp2Regex=/\.(jp[2x]|j2[kc])$/i,errJp2Save=()=>Error("JP2 output requires libvips with support for OpenJPEG"),bitdepthFromColourCount=(colours)=>1<<31-Math.clz32(Math.ceil(Math.log2(colours)));function toFile(fileOut,callback){let err;if(!is2.string(fileOut))err=Error("Missing output file path");else if(is2.string(this.options.input.file)&&path2.resolve(this.options.input.file)===path2.resolve(fileOut))err=Error("Cannot use same file for input and output");else if(jp2Regex.test(path2.extname(fileOut))&&!this.constructor.format.jp2k.output.file)err=errJp2Save();if(err)if(is2.fn(callback))callback(err);else return Promise.reject(err);else{this.options.fileOut=fileOut;let stack=Error();return this._pipeline(callback,stack)}return this}function toBuffer2(options,callback){if(is2.object(options))this._setBooleanOption("resolveWithObject",options.resolveWithObject);else if(this.options.resolveWithObject)this.options.resolveWithObject=!1;this.options.fileOut="";let stack=Error();return this._pipeline(is2.fn(options)?options:callback,stack)}function keepExif(){return this.options.keepMetadata|=1,this}function withExif(exif){if(is2.object(exif))for(let[ifd,entries]of Object.entries(exif))if(is2.object(entries))for(let[k,v]of Object.entries(entries))if(is2.string(v))this.options.withExif[`exif-${ifd.toLowerCase()}-${k}`]=v;else throw is2.invalidParameterError(`${ifd}.${k}`,"string",v);else throw is2.invalidParameterError(ifd,"object",entries);else throw is2.invalidParameterError("exif","object",exif);return this.options.withExifMerge=!1,this.keepExif()}function withExifMerge(exif){return this.withExif(exif),this.options.withExifMerge=!0,this}function keepIccProfile(){return this.options.keepMetadata|=8,this}function withIccProfile(icc,options){if(is2.string(icc))this.options.withIccProfile=icc;else throw is2.invalidParameterError("icc","string",icc);if(this.keepIccProfile(),is2.object(options)){if(is2.defined(options.attach))if(is2.bool(options.attach)){if(!options.attach)this.options.keepMetadata&=-9}else throw is2.invalidParameterError("attach","boolean",options.attach)}return this}function keepMetadata(){return this.options.keepMetadata=31,this}function withMetadata(options){if(this.keepMetadata(),this.withIccProfile("srgb"),is2.object(options)){if(is2.defined(options.orientation))if(is2.integer(options.orientation)&&is2.inRange(options.orientation,1,8))this.options.withMetadataOrientation=options.orientation;else throw is2.invalidParameterError("orientation","integer between 1 and 8",options.orientation);if(is2.defined(options.density))if(is2.number(options.density)&&options.density>0)this.options.withMetadataDensity=options.density;else throw is2.invalidParameterError("density","positive number",options.density);if(is2.defined(options.icc))this.withIccProfile(options.icc);if(is2.defined(options.exif))this.withExifMerge(options.exif)}return this}function toFormat(format2,options){let actualFormat=formats2.get((is2.object(format2)&&is2.string(format2.id)?format2.id:format2).toLowerCase());if(!actualFormat)throw is2.invalidParameterError("format",`one of: ${[...formats2.keys()].join(", ")}`,format2);return this[actualFormat](options)}function jpeg(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jpegQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.progressive))this._setBooleanOption("jpegProgressive",options.progressive);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jpegChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);let optimiseCoding=is2.bool(options.optimizeCoding)?options.optimizeCoding:options.optimiseCoding;if(is2.defined(optimiseCoding))this._setBooleanOption("jpegOptimiseCoding",optimiseCoding);if(is2.defined(options.mozjpeg))if(is2.bool(options.mozjpeg)){if(options.mozjpeg)this.options.jpegTrellisQuantisation=!0,this.options.jpegOvershootDeringing=!0,this.options.jpegOptimiseScans=!0,this.options.jpegProgressive=!0,this.options.jpegQuantisationTable=3}else throw is2.invalidParameterError("mozjpeg","boolean",options.mozjpeg);let trellisQuantisation=is2.bool(options.trellisQuantization)?options.trellisQuantization:options.trellisQuantisation;if(is2.defined(trellisQuantisation))this._setBooleanOption("jpegTrellisQuantisation",trellisQuantisation);if(is2.defined(options.overshootDeringing))this._setBooleanOption("jpegOvershootDeringing",options.overshootDeringing);let optimiseScans=is2.bool(options.optimizeScans)?options.optimizeScans:options.optimiseScans;if(is2.defined(optimiseScans)){if(this._setBooleanOption("jpegOptimiseScans",optimiseScans),optimiseScans)this.options.jpegProgressive=!0}let quantisationTable=is2.number(options.quantizationTable)?options.quantizationTable:options.quantisationTable;if(is2.defined(quantisationTable))if(is2.integer(quantisationTable)&&is2.inRange(quantisationTable,0,8))this.options.jpegQuantisationTable=quantisationTable;else throw is2.invalidParameterError("quantisationTable","integer between 0 and 8",quantisationTable)}return this._updateFormatOut("jpeg",options)}function png(options){if(is2.object(options)){if(is2.defined(options.progressive))this._setBooleanOption("pngProgressive",options.progressive);if(is2.defined(options.compressionLevel))if(is2.integer(options.compressionLevel)&&is2.inRange(options.compressionLevel,0,9))this.options.pngCompressionLevel=options.compressionLevel;else throw is2.invalidParameterError("compressionLevel","integer between 0 and 9",options.compressionLevel);if(is2.defined(options.adaptiveFiltering))this._setBooleanOption("pngAdaptiveFiltering",options.adaptiveFiltering);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.pngBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.palette))this._setBooleanOption("pngPalette",options.palette);else if([options.quality,options.effort,options.colours,options.colors,options.dither].some(is2.defined))this._setBooleanOption("pngPalette",!0);if(this.options.pngPalette){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,0,100))this.options.pngQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 0 and 100",options.quality);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,1,10))this.options.pngEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.pngDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither)}}return this._updateFormatOut("png",options)}function webp(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.webpQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.alphaQuality))if(is2.integer(options.alphaQuality)&&is2.inRange(options.alphaQuality,0,100))this.options.webpAlphaQuality=options.alphaQuality;else throw is2.invalidParameterError("alphaQuality","integer between 0 and 100",options.alphaQuality);if(is2.defined(options.lossless))this._setBooleanOption("webpLossless",options.lossless);if(is2.defined(options.nearLossless))this._setBooleanOption("webpNearLossless",options.nearLossless);if(is2.defined(options.smartSubsample))this._setBooleanOption("webpSmartSubsample",options.smartSubsample);if(is2.defined(options.preset))if(is2.string(options.preset)&&is2.inArray(options.preset,["default","photo","picture","drawing","icon","text"]))this.options.webpPreset=options.preset;else throw is2.invalidParameterError("preset","one of: default, photo, picture, drawing, icon, text",options.preset);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,6))this.options.webpEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 6",options.effort);if(is2.defined(options.minSize))this._setBooleanOption("webpMinSize",options.minSize);if(is2.defined(options.mixed))this._setBooleanOption("webpMixed",options.mixed)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("webp",options)}function gif(options){if(is2.object(options)){if(is2.defined(options.reuse))this._setBooleanOption("gifReuse",options.reuse);if(is2.defined(options.progressive))this._setBooleanOption("gifProgressive",options.progressive);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.gifBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.effort))if(is2.number(options.effort)&&is2.inRange(options.effort,1,10))this.options.gifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.gifDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither);if(is2.defined(options.interFrameMaxError))if(is2.number(options.interFrameMaxError)&&is2.inRange(options.interFrameMaxError,0,32))this.options.gifInterFrameMaxError=options.interFrameMaxError;else throw is2.invalidParameterError("interFrameMaxError","number between 0.0 and 32.0",options.interFrameMaxError);if(is2.defined(options.interPaletteMaxError))if(is2.number(options.interPaletteMaxError)&&is2.inRange(options.interPaletteMaxError,0,256))this.options.gifInterPaletteMaxError=options.interPaletteMaxError;else throw is2.invalidParameterError("interPaletteMaxError","number between 0.0 and 256.0",options.interPaletteMaxError)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("gif",options)}function jp2(options){if(!this.constructor.format.jp2k.output.buffer)throw errJp2Save();if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jp2Quality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jp2Lossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&is2.inRange(options.tileWidth,1,32768))this.options.jp2TileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer between 1 and 32768",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&is2.inRange(options.tileHeight,1,32768))this.options.jp2TileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer between 1 and 32768",options.tileHeight);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jp2ChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling)}return this._updateFormatOut("jp2",options)}function trySetAnimationOptions(source,target2){if(is2.object(source)&&is2.defined(source.loop))if(is2.integer(source.loop)&&is2.inRange(source.loop,0,65535))target2.loop=source.loop;else throw is2.invalidParameterError("loop","integer between 0 and 65535",source.loop);if(is2.object(source)&&is2.defined(source.delay))if(is2.integer(source.delay)&&is2.inRange(source.delay,0,65535))target2.delay=[source.delay];else if(Array.isArray(source.delay)&&source.delay.every(is2.integer)&&source.delay.every((v)=>is2.inRange(v,0,65535)))target2.delay=source.delay;else throw is2.invalidParameterError("delay","integer or an array of integers between 0 and 65535",source.delay)}function tiff(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.tiffQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[1,2,4,8]))this.options.tiffBitdepth=options.bitdepth;else throw is2.invalidParameterError("bitdepth","1, 2, 4 or 8",options.bitdepth);if(is2.defined(options.tile))this._setBooleanOption("tiffTile",options.tile);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&options.tileWidth>0)this.options.tiffTileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer greater than zero",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&options.tileHeight>0)this.options.tiffTileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer greater than zero",options.tileHeight);if(is2.defined(options.miniswhite))this._setBooleanOption("tiffMiniswhite",options.miniswhite);if(is2.defined(options.pyramid))this._setBooleanOption("tiffPyramid",options.pyramid);if(is2.defined(options.xres))if(is2.number(options.xres)&&options.xres>0)this.options.tiffXres=options.xres;else throw is2.invalidParameterError("xres","number greater than zero",options.xres);if(is2.defined(options.yres))if(is2.number(options.yres)&&options.yres>0)this.options.tiffYres=options.yres;else throw is2.invalidParameterError("yres","number greater than zero",options.yres);if(is2.defined(options.compression))if(is2.string(options.compression)&&is2.inArray(options.compression,["none","jpeg","deflate","packbits","ccittfax4","lzw","webp","zstd","jp2k"]))this.options.tiffCompression=options.compression;else throw is2.invalidParameterError("compression","one of: none, jpeg, deflate, packbits, ccittfax4, lzw, webp, zstd, jp2k",options.compression);if(is2.defined(options.predictor))if(is2.string(options.predictor)&&is2.inArray(options.predictor,["none","horizontal","float"]))this.options.tiffPredictor=options.predictor;else throw is2.invalidParameterError("predictor","one of: none, horizontal, float",options.predictor);if(is2.defined(options.resolutionUnit))if(is2.string(options.resolutionUnit)&&is2.inArray(options.resolutionUnit,["inch","cm"]))this.options.tiffResolutionUnit=options.resolutionUnit;else throw is2.invalidParameterError("resolutionUnit","one of: inch, cm",options.resolutionUnit)}return this._updateFormatOut("tiff",options)}function avif(options){return this.heif({...options,compression:"av1"})}function heif(options){if(is2.object(options)){if(is2.string(options.compression)&&is2.inArray(options.compression,["av1","hevc"]))this.options.heifCompression=options.compression;else throw is2.invalidParameterError("compression","one of: av1, hevc",options.compression);if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.heifQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.heifLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,9))this.options.heifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 9",options.effort);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.heifChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[8,10,12])){if(options.bitdepth!==8&&this.constructor.versions.heif)throw is2.invalidParameterError("bitdepth when using prebuilt binaries",8,options.bitdepth);this.options.heifBitdepth=options.bitdepth}else throw is2.invalidParameterError("bitdepth","8, 10 or 12",options.bitdepth)}else throw is2.invalidParameterError("options","Object",options);return this._updateFormatOut("heif",options)}function jxl(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jxlDistance=options.quality>=30?0.1+(100-options.quality)*0.09:0.017666666666666667*options.quality*options.quality-1.15*options.quality+25;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);else if(is2.defined(options.distance))if(is2.number(options.distance)&&is2.inRange(options.distance,0,15))this.options.jxlDistance=options.distance;else throw is2.invalidParameterError("distance","number between 0.0 and 15.0",options.distance);if(is2.defined(options.decodingTier))if(is2.integer(options.decodingTier)&&is2.inRange(options.decodingTier,0,4))this.options.jxlDecodingTier=options.decodingTier;else throw is2.invalidParameterError("decodingTier","integer between 0 and 4",options.decodingTier);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jxlLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,3,9))this.options.jxlEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 3 and 9",options.effort)}return this._updateFormatOut("jxl",options)}function raw(options){if(is2.object(options)){if(is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["char","uchar","short","ushort","int","uint","float","complex","double","dpcomplex"]))this.options.rawDepth=options.depth;else throw is2.invalidParameterError("depth","one of: char, uchar, short, ushort, int, uint, float, complex, double, dpcomplex",options.depth)}return this._updateFormatOut("raw")}function tile(options){if(is2.object(options)){if(is2.defined(options.size))if(is2.integer(options.size)&&is2.inRange(options.size,1,8192))this.options.tileSize=options.size;else throw is2.invalidParameterError("size","integer between 1 and 8192",options.size);if(is2.defined(options.overlap))if(is2.integer(options.overlap)&&is2.inRange(options.overlap,0,8192)){if(options.overlap>this.options.tileSize)throw is2.invalidParameterError("overlap",`<= size (${this.options.tileSize})`,options.overlap);this.options.tileOverlap=options.overlap}else throw is2.invalidParameterError("overlap","integer between 0 and 8192",options.overlap);if(is2.defined(options.container))if(is2.string(options.container)&&is2.inArray(options.container,["fs","zip"]))this.options.tileContainer=options.container;else throw is2.invalidParameterError("container","one of: fs, zip",options.container);if(is2.defined(options.layout))if(is2.string(options.layout)&&is2.inArray(options.layout,["dz","google","iiif","iiif3","zoomify"]))this.options.tileLayout=options.layout;else throw is2.invalidParameterError("layout","one of: dz, google, iiif, iiif3, zoomify",options.layout);if(is2.defined(options.angle))if(is2.integer(options.angle)&&!(options.angle%90))this.options.tileAngle=options.angle;else throw is2.invalidParameterError("angle","positive/negative multiple of 90",options.angle);if(this._setBackgroundColourOption("tileBackground",options.background),is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["onepixel","onetile","one"]))this.options.tileDepth=options.depth;else throw is2.invalidParameterError("depth","one of: onepixel, onetile, one",options.depth);if(is2.defined(options.skipBlanks))if(is2.integer(options.skipBlanks)&&is2.inRange(options.skipBlanks,-1,65535))this.options.tileSkipBlanks=options.skipBlanks;else throw is2.invalidParameterError("skipBlanks","integer between -1 and 255/65535",options.skipBlanks);else if(is2.defined(options.layout)&&options.layout==="google")this.options.tileSkipBlanks=5;let centre=is2.bool(options.center)?options.center:options.centre;if(is2.defined(centre))this._setBooleanOption("tileCentre",centre);if(is2.defined(options.id))if(is2.string(options.id))this.options.tileId=options.id;else throw is2.invalidParameterError("id","string",options.id);if(is2.defined(options.basename))if(is2.string(options.basename))this.options.tileBasename=options.basename;else throw is2.invalidParameterError("basename","string",options.basename)}if(is2.inArray(this.options.formatOut,["jpeg","png","webp"]))this.options.tileFormat=this.options.formatOut;else if(this.options.formatOut!=="input")throw is2.invalidParameterError("format","one of: jpeg, png, webp",this.options.formatOut);return this._updateFormatOut("dz")}function timeout(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","object",options);if(is2.integer(options.seconds)&&is2.inRange(options.seconds,0,3600))this.options.timeoutSeconds=options.seconds;else throw is2.invalidParameterError("seconds","integer between 0 and 3600",options.seconds);return this}function _updateFormatOut(formatOut,options){if(!(is2.object(options)&&options.force===!1))this.options.formatOut=formatOut;return this}function _setBooleanOption(key2,val){if(is2.bool(val))this.options[key2]=val;else throw is2.invalidParameterError(key2,"boolean",val)}function _read(){if(!this.options.streamOut){this.options.streamOut=!0;let stack=Error();this._pipeline(void 0,stack)}}function _pipeline(callback,stack){if(typeof callback==="function"){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)})});else sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)});return this}else if(this.options.streamOut){if(this._isStreamInput()){if(this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))})}),this.streamInFinished)this.emit("finish")}else sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})});else return new Promise((resolve2,reject)=>{sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{toFile,toBuffer:toBuffer2,keepExif,withExif,withExifMerge,keepIccProfile,withIccProfile,keepMetadata,withMetadata,toFormat,jpeg,jp2,png,webp,tiff,avif,heif,jxl,gif,raw,tile,timeout,_updateFormatOut,_setBooleanOption,_read,_pipeline})}});var require_utility=__commonJS((exports,module3)=>{var events=__require("events"),detectLibc=require_detect_libc(),is2=require_is(),{runtimePlatformArch}=require_libvips(),sharp=require_sharp(),runtimePlatform=runtimePlatformArch(),libvipsVersion=sharp.libvipsVersion(),format2=sharp.format();format2.heif.output.alias=["avif","heic"];format2.jpeg.output.alias=["jpe","jpg"];format2.tiff.output.alias=["tif"];format2.jp2k.output.alias=["j2c","j2k","jp2","jpx"];var interpolators={nearest:"nearest",bilinear:"bilinear",bicubic:"bicubic",locallyBoundedBicubic:"lbb",nohalo:"nohalo",vertexSplitQuadraticBasisSpline:"vsqbs"},versions={vips:libvipsVersion.semver};if(!libvipsVersion.isGlobal)if(!libvipsVersion.isWasm)try{versions=__require(`@img/sharp-${runtimePlatform}/versions`)}catch(_){try{versions=__require(`@img/sharp-libvips-${runtimePlatform}/versions`)}catch(_2){}}else try{versions=(()=>{throw new Error("Cannot require module "+"@img/sharp-wasm32/versions");})()}catch(_){}versions.sharp=require_package().version;if(versions.heif&&format2.heif)format2.heif.input.fileSuffix=[".avif"],format2.heif.output.alias=["avif"];function cache(options){if(is2.bool(options))if(options)return sharp.cache(50,20,100);else return sharp.cache(0,0,0);else if(is2.object(options))return sharp.cache(options.memory,options.files,options.items);else return sharp.cache()}cache(!0);function concurrency(concurrency2){return sharp.concurrency(is2.integer(concurrency2)?concurrency2:null)}if(detectLibc.familySync()===detectLibc.GLIBC&&!sharp._isUsingJemalloc())sharp.concurrency(1);else if(detectLibc.familySync()===detectLibc.MUSL&&sharp.concurrency()===1024)sharp.concurrency(__require("os").availableParallelism());var queue=new events.EventEmitter;function counters(){return sharp.counters()}function simd(simd2){return sharp.simd(is2.bool(simd2)?simd2:null)}function block(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!0);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}function unblock(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!1);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}module3.exports=function(Sharp){Sharp.cache=cache,Sharp.concurrency=concurrency,Sharp.counters=counters,Sharp.simd=simd,Sharp.format=format2,Sharp.interpolators=interpolators,Sharp.versions=versions,Sharp.queue=queue,Sharp.block=block,Sharp.unblock=unblock}});var require_lib=__commonJS((exports,module3)=>{var Sharp=require_constructor();require_input()(Sharp);require_resize()(Sharp);require_composite()(Sharp);require_operation()(Sharp);require_colour()(Sharp);require_channel()(Sharp);require_output()(Sharp);require_utility()(Sharp);module3.exports=Sharp});import{randomUUID as randomUUID6}from"crypto";import{mkdir as mkdir5,rename as rename3,stat as stat5,unlink as unlink5}from"fs/promises";import path2 from"path";function mergeTransformConfig(config){if(!config)return DEFAULT_TRANSFORM;return{enabled:config.enabled??DEFAULT_TRANSFORM.enabled,maxWidth:config.maxWidth??DEFAULT_TRANSFORM.maxWidth,maxHeight:config.maxHeight??DEFAULT_TRANSFORM.maxHeight,defaultQuality:config.defaultQuality??DEFAULT_TRANSFORM.defaultQuality,allowedFormats:config.allowedFormats??DEFAULT_TRANSFORM.allowedFormats,cacheSubdir:config.cacheSubdir??DEFAULT_TRANSFORM.cacheSubdir,maxInputPixels:config.maxInputPixels??DEFAULT_TRANSFORM.maxInputPixels,pregenerate:{enabled:config.pregenerate?.enabled??DEFAULT_PREGENERATE.enabled,widths:config.pregenerate?.widths??DEFAULT_PREGENERATE.widths,formats:config.pregenerate?.formats??DEFAULT_PREGENERATE.formats,quality:config.pregenerate?.quality}}}function isTransformableImage(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")in MIME_TO_FORMAT}function clampInt(raw,min,max){if(raw===void 0)return;let n=Number.parseInt(raw,10);if(!Number.isFinite(n))return;return Math.min(max,Math.max(min,n))}function preferredOutputFormat(input){let{requested,allowedFormats}=input;if(requested)return requested;let sourceFormat=MIME_TO_FORMAT[input.mimeType.split(";")[0]?.trim().toLowerCase()??""];if(!sourceFormat)return;if((input.accept??"").toLowerCase().includes("image/webp")&&(sourceFormat==="jpeg"||sourceFormat==="png")&&allowedFormats.includes("webp"))return"webp";return sourceFormat}function parseTransformParams(query,config){let width=clampInt(query.w,1,config.maxWidth),height=clampInt(query.h,1,config.maxHeight),qualityRaw=clampInt(query.q,1,100),requestedFormat=query.format?.trim().toLowerCase(),format2=requestedFormat&&config.allowedFormats.includes(requestedFormat)?requestedFormat:void 0;if(width===void 0&&height===void 0&&qualityRaw===void 0&&!format2)return null;return{width,height,quality:qualityRaw??config.defaultQuality,format:format2}}function deriveCacheKey(mtimeMs,params,outputFormat){return[`m${Math.floor(mtimeMs)}`,params.width?`w${params.width}`:"w0",params.height?`h${params.height}`:"h0",`q${params.quality}`,outputFormat].join("-")}async function loadSharp(logger2){if(sharpModule!==void 0)return sharpModule;try{let mod=await Promise.resolve().then(() => __toESM(require_lib(),1));sharpModule=mod.default??mod;try{let budget=cpuBudget();sharpModule.concurrency(budget),logger2.info(`[CDN] sharp thread pool set to ${budget} (CPU allowance, not host cores)`)}catch(error3){logger2.warn(`[CDN] could not set sharp concurrency: ${error3 instanceof Error?error3.message:String(error3)}`)}try{sharpModule.cache(!1),logger2.info("[CDN] libvips operation cache disabled (derivatives are cached on disk)")}catch(error3){logger2.warn(`[CDN] could not disable the libvips cache: ${error3 instanceof Error?error3.message:String(error3)}`)}}catch{sharpModule=null,logger2.error('[CDN] storage.cdn.transform.enabled is true but the optional "sharp" dependency is not installed. Run `npm i sharp` to enable image transforms. Serving original files untouched.')}return sharpModule}async function ensureDerivative(args){let{sourcePath,mimeType,params,storagePath,config,logger:logger2}=args;if(!isTransformableImage(mimeType))return null;let outputFormat=preferredOutputFormat({mimeType,requested:params.format,accept:args.accept,allowedFormats:config.allowedFormats});if(!outputFormat)return null;let sharp=await loadSharp(logger2);if(!sharp)return null;let idPart=path2.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f",srcStat=await stat5(sourcePath).catch(()=>null);if(!srcStat)return null;let key2=deriveCacheKey(srcStat.mtimeMs,params,outputFormat),cacheDir=path2.join(storagePath,config.cacheSubdir,idPart),cachePath=path2.join(cacheDir,`${key2}.${outputFormat}`);if(!isPathWithinBase(storagePath,cachePath))return null;let contentType=FORMAT_TO_MIME[outputFormat],etag=`"${idPart}-${key2}"`,cached=await stat5(cachePath).catch(()=>null);if(cached?.isFile()&&cached.size>0)return{path:cachePath,contentType,etag};let pending=inFlightDerivatives.get(cachePath);if(pending)return pending;let task=(async()=>{let tmpPath=null;try{let pipeline=sharp(sourcePath,{limitInputPixels:config.maxInputPixels,failOn:"none"});if(pipeline.rotate().keepIccProfile(),params.width||params.height)pipeline.resize({width:params.width,height:params.height,fit:"inside",withoutEnlargement:!0});switch(outputFormat){case"webp":pipeline.webp({quality:params.quality});break;case"avif":pipeline.avif({quality:params.quality});break;case"jpeg":pipeline.jpeg({quality:params.quality});break;case"png":pipeline.png({quality:params.quality});break}let buffer=await pipeline.toBuffer();if(buffer.length===0)return logger2.error(`[CDN] image transform produced an empty buffer for ${idPart}; serving original.`),null;return await mkdir5(cacheDir,{recursive:!0}),tmpPath=`${cachePath}.${randomUUID6()}.tmp`,await Bun.write(tmpPath,buffer),await rename3(tmpPath,cachePath),tmpPath=null,{path:cachePath,contentType,etag}}catch(err){if(tmpPath)await unlink5(tmpPath).catch(()=>{});return logger2.error(`[CDN] image transform failed for ${idPart}; serving original. ${String(err)}`),null}})();inFlightDerivatives.set(cachePath,task);try{return await task}finally{inFlightDerivatives.delete(cachePath)}}async function pregenerateImageVariants(args){let{sourcePath,mimeType,storagePath,config,logger:logger2}=args,pg=config.pregenerate;if(!config.enabled||!pg.enabled||!isTransformableImage(mimeType))return 0;if(pg.widths.length===0||pg.formats.length===0)return 0;let quality=pg.quality??config.defaultQuality,made=0;for(let width of pg.widths)for(let format2 of pg.formats)if(await ensureDerivative({sourcePath,mimeType,params:{width,quality,format:format2},storagePath,config,logger:logger2}))made+=1;return made}var DEFAULT_PREGENERATE,DEFAULT_TRANSFORM,MIME_TO_FORMAT,FORMAT_TO_MIME,sharpModule,inFlightDerivatives;var init_imageTransform=__esm(()=>{init_cpuBudget();init_helpers3();DEFAULT_PREGENERATE={enabled:!1,widths:[],formats:["webp"]},DEFAULT_TRANSFORM={enabled:!1,maxWidth:3840,maxHeight:3840,defaultQuality:80,allowedFormats:["webp","avif","jpeg","png"],cacheSubdir:".cache/cdn",maxInputPixels:1e8,pregenerate:DEFAULT_PREGENERATE};MIME_TO_FORMAT={"image/webp":"webp","image/avif":"avif","image/jpeg":"jpeg","image/jpg":"jpeg","image/png":"png"},FORMAT_TO_MIME={webp:"image/webp",avif:"image/avif",jpeg:"image/jpeg",png:"image/png"};inFlightDerivatives=new Map});import{randomUUID as randomUUID7}from"crypto";import{mkdir as mkdir6,rename as rename4,stat as stat6,unlink as unlink6}from"fs/promises";import path3 from"path";function mergePdfConfig(config){if(!config)return DEFAULT_PDF;return{enabled:config.enabled??DEFAULT_PDF.enabled,coverFormat:config.coverFormat??DEFAULT_PDF.coverFormat,dpi:config.dpi??DEFAULT_PDF.dpi,pdftoppmPath:config.pdftoppmPath??DEFAULT_PDF.pdftoppmPath}}function isTransformablePdf(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")==="application/pdf"}function idPartOf(sourcePath){return path3.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function coverPath(storagePath,cacheSubdir,sourcePath,mtimeMs,ext){return path3.join(storagePath,cacheSubdir,idPartOf(sourcePath),`pdf-m${Math.floor(mtimeMs)}-cover.${ext}`)}async function checkPoppler(pdftoppmPath,logger2){if(popplerAvailable!==void 0)return popplerAvailable;try{await Bun.spawn({cmd:[pdftoppmPath,"-v"],stdout:"ignore",stderr:"ignore"}).exited,popplerAvailable=!0}catch{popplerAvailable=!1}if(!popplerAvailable)logger2.error(`[CDN] storage.cdn.pdf.enabled is true but pdftoppm ("${pdftoppmPath}") was not found on PATH. Install poppler-utils to enable PDF cover generation. Serving PDFs without covers.`);return popplerAvailable}async function resolvePdfCover(args){let{sourcePath,storagePath,cacheSubdir,coverFormat}=args,srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return null;let ext=coverFormat==="png"?"png":"jpg",p=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,p))return null;let cover=await stat6(p).catch(()=>null);if(!cover?.isFile())return null;if(cover.size<MIN_PLAUSIBLE_COVER_BYTES)return await unlink6(p).catch(()=>{}),null;return{path:p,contentType:COVER_MIME[coverFormat]}}async function processPdfOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformablePdf(mimeType))return;if(!await checkPoppler(config.pdftoppmPath,logger2))return;let srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return;let ext=config.coverFormat==="png"?"png":"jpg",out=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,out))return;if(await Bun.file(out).exists())return;await mkdir6(path3.dirname(out),{recursive:!0}).catch(()=>{});let prefix=`${out}.${randomUUID7()}.tmp`,tmp=`${prefix}.${ext}`;if(await runPdftoppm(config.pdftoppmPath,[config.coverFormat==="png"?"-png":"-jpeg","-f","1","-l","1","-r",String(config.dpi),"-singlefile",sourcePath,prefix])&&await Bun.file(tmp).exists()){await rename4(tmp,out).catch(()=>{});return}await unlink6(tmp).catch(()=>{}),logger2.error(`[CDN] pdf cover failed for ${idPartOf(sourcePath)}`)}async function runPdftoppm(pdftoppmPath,args){try{return await Bun.spawn({cmd:[pdftoppmPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}var DEFAULT_PDF,MIN_PLAUSIBLE_COVER_BYTES=2048,COVER_MIME,popplerAvailable;var init_pdfTransform=__esm(()=>{init_helpers3();DEFAULT_PDF={enabled:!1,coverFormat:"jpeg",dpi:150,pdftoppmPath:"pdftoppm"};COVER_MIME={jpeg:"image/jpeg",png:"image/png"}});import{randomUUID as randomUUID8}from"crypto";import{mkdir as mkdir7,rename as rename5,stat as stat7,unlink as unlink7}from"fs/promises";import path4 from"path";function mergeVideoConfig(config){if(!config)return DEFAULT_VIDEO;return{enabled:config.enabled??DEFAULT_VIDEO.enabled,transcode:config.transcode??DEFAULT_VIDEO.transcode,poster:config.poster??DEFAULT_VIDEO.poster,posterFormat:config.posterFormat??DEFAULT_VIDEO.posterFormat,crf:config.crf??DEFAULT_VIDEO.crf,maxWidth:config.maxWidth??DEFAULT_VIDEO.maxWidth,ffmpegPath:config.ffmpegPath??DEFAULT_VIDEO.ffmpegPath}}function isTransformableVideo(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"").startsWith("video/")}function idPartOf2(sourcePath){return path4.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function variantPath(storagePath,cacheSubdir,sourcePath,mtimeMs,suffix){return path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath),`video-m${Math.floor(mtimeMs)}-${suffix}`)}async function checkFfmpeg(ffmpegPath,logger2){if(ffmpegAvailable!==void 0)return ffmpegAvailable;try{ffmpegAvailable=await Bun.spawn({cmd:[ffmpegPath,"-version"],stdout:"ignore",stderr:"ignore"}).exited===0}catch{ffmpegAvailable=!1}if(!ffmpegAvailable)logger2.error(`[CDN] storage.cdn.video.enabled is true but ffmpeg ("${ffmpegPath}") was not found on PATH. Install ffmpeg to enable video transcode/poster. Serving original videos untouched.`);return ffmpegAvailable}async function runFfmpeg(ffmpegPath,args){try{return await Bun.spawn({cmd:[ffmpegPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}async function resolveVideoVariant(args){let{sourcePath,storagePath,cacheSubdir,posterFormat,kind}=args,srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return null;let suffix=kind==="web"?"web.mp4":`poster.${posterFormat==="webp"?"webp":"jpg"}`,p=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,suffix);if(!isPathWithinBase(storagePath,p))return null;let variant=await stat7(p).catch(()=>null);if(!variant?.isFile())return null;if(variant.size<MIN_PLAUSIBLE_VARIANT_BYTES[kind])return await unlink7(p).catch(()=>{}),null;let contentType=kind==="web"?"video/mp4":POSTER_MIME[posterFormat];return{path:p,contentType}}async function processVideoOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformableVideo(mimeType))return;if(!await checkFfmpeg(config.ffmpegPath,logger2))return;let srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return;let dir=path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath));if(await mkdir7(dir,{recursive:!0}).catch(()=>{}),config.transcode){let out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,"web.mp4");if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let tmp=`${out}.${randomUUID8()}.tmp.mp4`;if(await runFfmpeg(config.ffmpegPath,["-y","-i",sourcePath,"-vf",`scale='min(${config.maxWidth},iw)':-2`,"-c:v","libx264","-crf",String(config.crf),"-preset","medium","-c:a","aac","-movflags","+faststart",tmp]))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video transcode failed for ${idPartOf2(sourcePath)}`)}}if(config.poster){let ext=config.posterFormat==="webp"?"webp":"jpg",out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,`poster.${ext}`);if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let posterArgs=["-y","-i",sourcePath,"-frames:v","1"];if(config.posterFormat==="webp")posterArgs.push("-c:v","libwebp");else posterArgs.push("-q:v","3");let tmp=`${out}.${randomUUID8()}.tmp.${ext}`;if(posterArgs.push(tmp),await runFfmpeg(config.ffmpegPath,posterArgs))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video poster failed for ${idPartOf2(sourcePath)}`)}}}var DEFAULT_VIDEO,MIN_PLAUSIBLE_VARIANT_BYTES,POSTER_MIME,ffmpegAvailable;var init_videoTransform=__esm(()=>{init_helpers3();DEFAULT_VIDEO={enabled:!1,transcode:!0,poster:!0,posterFormat:"jpeg",crf:23,maxWidth:1920,ffmpegPath:"ffmpeg"};MIN_PLAUSIBLE_VARIANT_BYTES={web:4096,poster:128},POSTER_MIME={jpeg:"image/jpeg",webp:"image/webp"}});import path5 from"path";function mergeCdnConfig(config){if(!config)return DEFAULT_CDN_CONFIG;return{enabled:config.enabled??DEFAULT_CDN_CONFIG.enabled,basePath:config.basePath??DEFAULT_CDN_CONFIG.basePath,cacheMaxAge:config.cacheMaxAge??DEFAULT_CDN_CONFIG.cacheMaxAge,enableRangeRequests:config.enableRangeRequests??DEFAULT_CDN_CONFIG.enableRangeRequests,enableEtag:config.enableEtag??DEFAULT_CDN_CONFIG.enableEtag,corsOrigins:config.corsOrigins??DEFAULT_CDN_CONFIG.corsOrigins,transform:mergeTransformConfig(config.transform),video:mergeVideoConfig(config.video),pdf:mergePdfConfig(config.pdf)}}function getMimeTypeDisposition(mimeType,forceDownload=!1){let normalized=mimeType.split(";")[0]?.trim().toLowerCase()??"";if(NEVER_INLINE.has(normalized))return"attachment";if(forceDownload)return"attachment";let inlineTypes=["image/","video/","audio/","text/","application/pdf"];for(let type4 of inlineTypes)if(normalized.startsWith(type4)||normalized===type4)return"inline";return"attachment"}function sanitizeFilename(filename){return filename.replace(/[^A-Za-z0-9._-]+/g,"_").replace(/_{2,}/g,"_").slice(0,200)}function buildContentDisposition(type4,fileName){return`${type4}; filename="${sanitizeFilename(fileName)}"; filename*=UTF-8''${encodeURIComponent(fileName)}`}function isTraversalId(id){return id.includes("/")||id.includes("\\")||id.includes("..")||id.includes("\x00")}function resolveTenantSchema(request){return request.headers.get("x-tenant-schema")||void 0}function createCdnRoutes(config){let{cdn,storagePath,logger:logger2,getFileRecord,getStorageProvider:getStorageProvider2,authorizeFile}=config,materialize=async(absolutePath)=>{let provider=getStorageProvider2?.();if(!provider||provider.kind==="local")return absolutePath;let relative=path5.relative(storagePath,absolutePath);if(!relative||relative.startsWith(".."))return absolutePath;return await provider.localPath(relative)??absolutePath};if(!cdn.enabled)return collectRoutes();let routeGetId=defineRoute({method:"GET",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file by ID",description:"Serve file with streaming, range requests, and caching support"},handler:async({params,request,set:set2,query})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,{success:!1,message:"Invalid file id"};let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,{success:!1,message:"You are not allowed to access this file"};let filePath,fileName,mimeType;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,{success:!1,message:"File not found"};filePath=path5.join(fileRecord.path,fileRecord.name),fileName=fileRecord.original_name?.trim()||fileRecord.name,mimeType=fileRecord.mimeType||fileRecord.mime_type||"application/octet-stream"}else filePath=path5.join(storagePath,id),fileName=id,mimeType="application/octet-stream";if(!isPathWithinBase(storagePath,filePath))return set2.status=404,{success:!1,message:"File not found"};if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,{success:!1,message:"Physical file not found"};if(cdn.video.enabled&&isTransformableVideo(mimeType)){let wantPoster=query.poster!==void 0&&query.poster!=="0"&&query.poster!=="false",variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:wantPoster?"poster":"web"});if(variant)filePath=variant.path,mimeType=variant.contentType;else if(wantPoster)return set2.status=404,{success:!1,message:"Poster not generated"}}if(cdn.pdf.enabled&&isTransformablePdf(mimeType)){if(query.cover!==void 0&&query.cover!=="0"&&query.cover!=="false"){let coverArgs={sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,coverFormat:cdn.pdf.coverFormat},cover=await resolvePdfCover(coverArgs);if(!cover)await processPdfOnUpload({sourcePath:filePath,mimeType,storagePath,cacheSubdir:cdn.transform.cacheSubdir,config:cdn.pdf,logger:logger2}),cover=await resolvePdfCover(coverArgs);if(!cover)return set2.status=404,{success:!1,message:"Cover not generated"};filePath=cover.path,mimeType=cover.contentType}}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,cacheHeaders={"Cache-Control":mimeType.startsWith("video/")?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)cacheHeaders.ETag=etag;if(cdn.corsOrigins.length>0)cacheHeaders["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),cacheHeaders["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";if(cdn.transform.enabled&&isTransformableImage(mimeType)){let transformParams=parseTransformParams(query,cdn.transform);if(transformParams){let derivative=await ensureDerivative({sourcePath:filePath,mimeType,params:transformParams,storagePath,config:cdn.transform,logger:logger2,accept:request.headers.get("accept")??void 0});if(derivative){let derivativeInfo=await fileManager.getFileInfo(derivative.path),derivativeHeaders={...cacheHeaders,"Content-Type":derivative.contentType,"Content-Disposition":`inline; filename="${sanitizeFilename(fileName)}"`,"X-Content-Type-Options":"nosniff",Vary:"Accept"};if(cdn.enableEtag)derivativeHeaders.ETag=derivative.etag;if(cdn.enableEtag&&request.headers.get("if-none-match")===derivative.etag)return new Response(null,{status:304,headers:derivativeHeaders});return new Response(Bun.file(derivative.path),{status:200,headers:{"Content-Length":derivativeInfo.size.toString(),...derivativeHeaders}})}}}let forceDownload=query.download!==void 0&&query.download!=="0"&&query.download!=="false",dispositionType=getMimeTypeDisposition(mimeType,forceDownload),contentDisposition=buildContentDisposition(dispositionType,fileName),ifNoneMatch=request.headers.get("if-none-match");if(etag&&ifNoneMatch===etag)return new Response(null,{status:304,headers:cacheHeaders});let bunFile=Bun.file(filePath),range=request.headers.get("range");if(cdn.enableRangeRequests&&range){let rangeMatch=range.match(/bytes=(\d*)-(\d*)/);if(!rangeMatch)return set2.status=416,new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let startStr=rangeMatch[1]??"",endStr=rangeMatch[2]??"",isSuffix=startStr===""&&endStr!=="",start=isSuffix?Math.max(0,fileInfo.size-parseInt(endStr,10)):parseInt(startStr||"0",10),end=isSuffix||!endStr?fileInfo.size-1:parseInt(endStr,10);if(isSuffix&&parseInt(endStr,10)===0)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});if(start>=fileInfo.size||end>=fileInfo.size||start>end)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let chunkSize=end-start+1,chunkStream=boundedStream(bunFile.slice(start,end+1).stream(),chunkSize);return new Response(chunkStream,{status:206,headers:{"Content-Range":`bytes ${start}-${end}/${fileInfo.size}`,"Accept-Ranges":"bytes","Content-Length":chunkSize.toString(),"Content-Type":mimeType,"Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}return new Response(bunFile,{status:200,headers:{"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}}),routeHeadId=defineRoute({method:"HEAD",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file metadata",description:"Get file headers without body for preflight checks"},handler:async({params,request,set:set2})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,new Response(null,{status:400});let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,new Response(null,{status:403});let filePath,mimeType,fileName;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,new Response(null,{status:404});filePath=path5.join(fileRecord.path,fileRecord.name),mimeType=fileRecord.mime_type||"application/octet-stream",fileName=fileRecord.original_name?.trim()||fileRecord.name}else filePath=path5.join(storagePath,id),mimeType="application/octet-stream",fileName=id;if(!isPathWithinBase(storagePath,filePath))return set2.status=404,new Response(null,{status:404});if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,new Response(null,{status:404});if(cdn.video.enabled&&isTransformableVideo(mimeType)){let variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:"web"});if(variant)filePath=variant.path,mimeType=variant.contentType}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,isVideo=mimeType.startsWith("video/"),headers={"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Content-Disposition":buildContentDisposition(getMimeTypeDisposition(mimeType),fileName),"X-Content-Type-Options":"nosniff","Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Cache-Control":isVideo?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)headers.ETag=etag;if(cdn.corsOrigins.length>0)headers["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),headers["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";return new Response(null,{status:200,headers})}});logger2.info(`[CDN] Routes enabled at ${cdn.basePath}`);let declared=[routeGetId,routeHeadId];return collectRoutes([{prefix:cdn.basePath,routes:declared}])}var DEFAULT_CDN_CONFIG,NEVER_INLINE;var init_cdn=__esm(()=>{init_esm3();init_File();init_routeCollector();init_helpers3();init_imageTransform();init_pdfTransform();init_videoTransform();DEFAULT_CDN_CONFIG={enabled:!0,basePath:"/cdn",cacheMaxAge:86400,enableRangeRequests:!0,enableEtag:!0,corsOrigins:["*"],transform:mergeTransformConfig(),video:mergeVideoConfig(),pdf:mergePdfConfig()};NEVER_INLINE=new Set(["text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/ecmascript","text/ecmascript","application/x-httpd-php"])});function buildFileRecordPayload(upload,userId){return{id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:upload.originalName.split(".").pop()||"",uploadedBy:userId??null}}async function persistUploadedFiles(args){let{db,filesTable,files,storageConfig,subFolder,userId}=args,uploaded=await uploadFiles(files,storageConfig,subFolder),records=[];for(let upload of uploaded.success){let payload=buildFileRecordPayload(upload,userId);payload.createdBy=userId??null,await db.insert(filesTable).values(payload),records.push({id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:payload.extension})}return{records,failed:uploaded.failed}}var init_file_record=__esm(()=>{init_helpers3()});import path6 from"path";function scheduleUploadMediaProcessing(records,opts){let{storagePath,media,logger:logger2}=opts,{transform:transform3,video,pdf}=media,imagesOn=transform3.enabled&&transform3.pregenerate.enabled,videoOn=video.enabled,pdfOn=pdf.enabled;if(!imagesOn&&!videoOn&&!pdfOn)return;for(let record3 of records){let sourcePath=path6.join(record3.path,record3.name);if(imagesOn&&isTransformableImage(record3.mimeType))pregenerateImageVariants({sourcePath,mimeType:record3.mimeType,storagePath,config:transform3,logger:logger2}).catch(()=>{});if(pdfOn&&isTransformablePdf(record3.mimeType))processPdfOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:pdf,logger:logger2}).catch(()=>{});if(videoOn&&isTransformableVideo(record3.mimeType))processVideoOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:video,logger:logger2}).catch(()=>{})}}var init_mediaPostProcess=__esm(()=>{init_imageTransform();init_pdfTransform();init_videoTransform()});var exports_storage={};__export(exports_storage,{validateFile:()=>validateFile,uploadFiles:()=>uploadFiles,uploadFile:()=>uploadFile,setStorageProvider:()=>setStorageProvider,scheduleUploadMediaProcessing:()=>scheduleUploadMediaProcessing,resolvePdfCover:()=>resolvePdfCover,processPdfOnUpload:()=>processPdfOnUpload,persistUploadedFiles:()=>persistUploadedFiles,parseFormDataBody:()=>parseFormDataBody,normalizeMimeType:()=>normalizeMimeType,mergeVideoConfig:()=>mergeVideoConfig,mergeTransformConfig:()=>mergeTransformConfig,mergeStorageConfig:()=>mergeStorageConfig,mergePdfConfig:()=>mergePdfConfig,mergeCdnConfig:()=>mergeCdnConfig,isTransformablePdf:()=>isTransformablePdf,isMimeTypeListed:()=>isMimeTypeListed,getStorageProvider:()=>getStorageProvider,deleteFile:()=>deleteFile,createCdnRoutes:()=>createCdnRoutes,buildFileRecordPayload:()=>buildFileRecordPayload});var init_storage2=__esm(()=>{init_cdn();init_file_record();init_helpers3();init_imageTransform();init_mediaPostProcess();init_videoTransform();init_pdfTransform()});function createGodminGuard(deps){let{logger:logger2,db,schemaTables,area}=deps,allowedRoles=new Set((deps.allowedRoles??[]).map((role)=>role.toLowerCase()));return async({request,set:set2})=>{let roles=decodeHeaderList(request.headers.get("x-user-roles")),headerGrants=roles.includes(GODMIN_ROLE_NAME)||allowedRoles.size>0&&roles.some((role)=>allowedRoles.has(role.toLowerCase())),userId=request.headers.get("x-user-id"),caller;if(userId&&db&&schemaTables.users)try{let{eq:eq31}=await import("drizzle-orm"),usersTable=schemaTables.users;caller=(await db.select().from(usersTable).where(eq31(usersTable.id,userId)).limit(1))[0]}catch(err){logger2.warn(`[${area}] Failed to check isGod from DB`,{error:err instanceof Error?err.message:String(err)})}if(!headerGrants&&caller?.isGod!==!0)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:allowedRoles.size>0?`${area} requires godmin or one of: ${[...allowedRoles].join(", ")}`:`Only godmin users can access ${area}`,data:null}));if(caller){let refusal=accountStateRefusal(caller);if(refusal)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:refusal,data:null}))}return}}var init_godminGuard=__esm(()=>{init_Authorization();init_response();init_requireGodmin()});var exports_helpers={};__export(exports_helpers,{scanUndeclaredEnv:()=>scanUndeclaredEnv,scanEnvVars:()=>scanEnvVars,restoreMaskedEchoes:()=>restoreMaskedEchoes,readOverridesFromRedis:()=>readOverridesFromRedis,persistSectionToRedis:()=>persistSectionToRedis,persistConfigToDisk:()=>persistConfigToDisk,maskUrlCredentials:()=>maskUrlCredentials,maskSensitiveFields:()=>maskSensitiveFields,looksSecretValue:()=>looksSecretValue,loadOverridesFromRedis:()=>loadOverridesFromRedis,isRestartRequired:()=>isRestartRequired,hasSection:()=>hasSection,extractSection:()=>extractSection,deepMerge:()=>deepMerge,clearOverridesFromRedis:()=>clearOverridesFromRedis,buildSectionsMeta:()=>buildSectionsMeta,applySectionUpdate:()=>applySectionUpdate});var SENSITIVE_KEY_PATTERNS,FORBIDDEN_SECTION_KEYS,isSensitiveKey=(key2)=>SENSITIVE_KEY_PATTERNS.some((pattern2)=>pattern2.test(key2)),HEADER_MAP_KEYS,maskHeaderMap=(value2)=>{let masked={};for(let name2 of Object.keys(value2))masked[name2]="***";return masked},URL_CREDENTIALS,maskUrlCredentials=(value2)=>value2.replace(URL_CREDENTIALS,"$1***$2"),B64ISH_VALUE,looksSecretValue=(value2)=>{if(!value2)return!1;let v=value2.trim();if(v.length>=60&&B64ISH_VALUE.test(v))return!0;return v.includes("PRIVATE KEY")||v.includes("BEGIN ")||v.includes('"private_key"')},RESTART_REQUIRED_KEYS,asRecord=(config)=>config,maskSensitiveFields=(obj)=>{let result={};for(let[key2,value2]of Object.entries(obj)){if(isSensitiveKey(key2)&&typeof value2==="string"){result[key2]="***";continue}if(Array.isArray(value2)){result[key2]=value2.map((item)=>typeof item==="object"&&item!==null?maskSensitiveFields(item):item);continue}if(typeof value2==="object"&&value2!==null){result[key2]=HEADER_MAP_KEYS.test(key2)?maskHeaderMap(value2):maskSensitiveFields(value2);continue}result[key2]=typeof value2==="string"?maskUrlCredentials(value2):value2}return result},MASK="***",isPlainObject2=(value2)=>typeof value2==="object"&&value2!==null&&!Array.isArray(value2),restoreMaskedEchoes=(section,current,incoming)=>restoreAgainst(current,maskSensitiveFields({[section]:current})[section],incoming),restoreAgainst=(current,masked,incoming,everyValueMasked=!1)=>{if(isPlainObject2(incoming)&&isPlainObject2(current)&&isPlainObject2(masked)){let result={};for(let[key2,value2]of Object.entries(incoming)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;if(Object.hasOwn(current,key2)){result[key2]=restoreAgainst(current[key2],masked[key2],value2,HEADER_MAP_KEYS.test(key2));continue}if(value2===MASK&&(everyValueMasked||isSensitiveKey(key2)))continue;result[key2]=value2}return result}if(Array.isArray(incoming)&&Array.isArray(current)&&Array.isArray(masked)&&incoming.length===current.length)return incoming.map((item,index)=>restoreAgainst(current[index],masked[index],item));if(typeof incoming==="string"&&incoming===masked&&masked!==current)return current;return incoming},buildSectionsMeta=(config)=>{let record3=asRecord(config);return Object.keys(record3).filter((key2)=>record3[key2]!==void 0).map((key2)=>{let value2=record3[key2],type4=Array.isArray(value2)?"array":typeof value2==="object"&&value2!==null?"object":"primitive";return{key:key2,type:type4,restartRequired:RESTART_REQUIRED_KEYS.has(key2)}})},extractSection=(config,section)=>asRecord(config)[section],hasSection=(config,section)=>Object.hasOwn(asRecord(config),section),applySectionUpdate=(config,section,value2)=>{if(FORBIDDEN_SECTION_KEYS.has(section))return;asRecord(config)[section]=value2},isRestartRequired=(section)=>RESTART_REQUIRED_KEYS.has(section),ENV_VAR_PATTERN,scanEnvVars=(obj,parentPath="")=>{let entries=[];for(let[key2,value2]of Object.entries(obj)){let currentPath=parentPath?`${parentPath}.${key2}`:key2;if(typeof value2==="string"&&ENV_VAR_PATTERN.test(value2)){let envValue=process.env[value2],valueIsSecret=envValue!==void 0&&looksSecretValue(envValue);entries.push({configPath:currentPath,envName:value2,resolved:envValue!==void 0,value:envValue!==void 0?isSensitiveKey(key2)||valueIsSecret?"***":maskUrlCredentials(envValue):null,isSecret:isSensitiveKey(key2)||valueIsSecret,recognized:!0});continue}if(Array.isArray(value2)){for(let i=0;i<value2.length;i++){let item=value2[i];if(typeof item==="object"&&item!==null)entries.push(...scanEnvVars(item,`${currentPath}[${i}]`))}continue}if(typeof value2==="object"&&value2!==null)entries.push(...scanEnvVars(value2,currentPath))}return entries},K8S_LINK_RE,SYSTEM_ENV,SYSTEM_PREFIXES,PROVIDER_KEY_TOKENS,isProviderApiKey=(name2)=>{let upper=name2.toUpperCase();return upper.endsWith("_API_KEY")&&PROVIDER_KEY_TOKENS.some((token)=>upper.includes(token))},isInfraNoise=(name2,value2)=>{if(SYSTEM_ENV.has(name2))return!0;if(SYSTEM_PREFIXES.some((prefix)=>name2.startsWith(prefix)))return!0;if(K8S_LINK_RE.test(name2))return!0;if(name2.endsWith("_PORT")&&value2.startsWith("tcp://"))return!0;return!1},scanUndeclaredEnv=(declaredNames)=>{let entries=[];for(let[name2,rawValue]of Object.entries(process.env)){if(declaredNames.has(name2))continue;let value2=rawValue??"";if(isInfraNoise(name2,value2))continue;if(isProviderApiKey(name2))continue;let resolved=value2!=="";entries.push({configPath:name2,envName:name2,resolved,value:resolved?"***":null,isSecret:resolved,recognized:!1})}return entries},buildRedisKey=(appId)=>`nucleus:config:overrides:${appId}`,persistConfigToDisk=async(configFilePath,config)=>{let fs3=__require("fs"),content=JSON.stringify(asRecord(config),null,2);fs3.writeFileSync(configFilePath,content,"utf-8")},decodeOverrides=(stored)=>{let value2=parseStoredJson(stored);if(value2===null||typeof value2!=="object"||Array.isArray(value2))return null;return value2},persistSectionToRedis=async(redis,appId,section,value2)=>{let redisKey=buildRedisKey(appId),existing=await redis.read(redisKey),overrides=(existing.success?decodeOverrides(existing.data):null)??{};overrides[section]=value2,await redis.create(redisKey,overrides)},readOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey);if(!result.success)return null;return decodeOverrides(result.data)},clearOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId);await redis.create(redisKey,{})},loadOverridesFromRedis=async(redis,appId,config)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey),overrides=result.success?decodeOverrides(result.data):null;if(!overrides)return{applied:[],ignored:[]};let applied=[],ignored=[],record3=asRecord(config);for(let[section,value2]of Object.entries(overrides)){if(FORBIDDEN_SECTION_KEYS.has(section))continue;if(!Object.hasOwn(record3,section)){ignored.push(section);continue}let current=record3[section];if(typeof value2==="object"&&value2!==null&&!Array.isArray(value2)&&typeof current==="object"&&current!==null&&!Array.isArray(current))record3[section]=deepMerge(current,value2);else record3[section]=value2;applied.push(section)}return{applied,ignored}},deepMerge=(target2,source)=>{let result={...target2};for(let[key2,sourceValue]of Object.entries(source)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;let targetValue=target2[key2];if(typeof sourceValue==="object"&&sourceValue!==null&&!Array.isArray(sourceValue)&&typeof targetValue==="object"&&targetValue!==null&&!Array.isArray(targetValue))result[key2]=deepMerge(targetValue,sourceValue);else result[key2]=sourceValue}return result};var init_helpers4=__esm(()=>{SENSITIVE_KEY_PATTERNS=[/secret/i,/password/i,/token/i,/^apiKey$/i,/^secretKey$/i,/^webhookSecret$/i,/connection_string/i,/connectionString/i,/^clientSecret$/i,/json_file_path/i,/key$/i,/salt/i,/passphrase/i,/credential/i,/^authorization$/i,/^cookie$/i,/^x-api-key$/i],FORBIDDEN_SECTION_KEYS=new Set(["__proto__","constructor","prototype"]),HEADER_MAP_KEYS=/^(headers|extraHeaders|defaultHeaders|requestHeaders)$/i,URL_CREDENTIALS=/^([a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:)[^/\s@]+(@)/i,B64ISH_VALUE=/^[A-Za-z0-9+/=_-]{60,}$/,RESTART_REQUIRED_KEYS=new Set(["appId","mode","database","redis","authentication","authorization","email","payment","entities"]),ENV_VAR_PATTERN=/^[A-Z][A-Z0-9_]{2,}$/,K8S_LINK_RE=/(_SERVICE_HOST|_SERVICE_PORT.*|_PORT_\d+_TCP.*)$/,SYSTEM_ENV=new Set(["PATH","HOME","HOSTNAME","PWD","OLDPWD","TERM","SHLVL","_","LANG","TZ","container","VIRTUAL_ENV","DEBIAN_FRONTEND"]),SYSTEM_PREFIXES=["LC_","GPG_","PYTHON","SSL_CERT","KUBERNETES_"],PROVIDER_KEY_TOKENS=["OPENAI","CLAUDE","ANTHROPIC","GEMINI","GOOGLE","XAI","GROQ","COHERE","ZAI","OLLAMA","KIE","DEEPGRAM","ELEVENLABS","AZURE_OPENAI","MISTRAL","PERPLEXITY","TOGETHER","FIREWORKS","REPLICATE","STABILITY","RUNWAY","HUGGINGFACE","VOYAGE","JINA"]});function hasGodminRole(request){return decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r))}async function userHasGodminRoleInDb(db,schemaTables,userId,logger2){if(!userId||!db)return!1;let userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!userRolesTable||!rolesTable)return!1;try{let{eq:eq31}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq31(ur.roleId,r.id)).where(eq31(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[AdminGuard] Failed to check godmin role from DB",{error:err instanceof Error?err.message:String(err)}),!1}}async function isGodminRequest(request,deps){if(decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r)))return!0;let userId=request.headers.get("x-user-id"),{db,schemaTables,logger:logger2}=deps;if(userId&&db&&schemaTables.users)try{let{eq:eq31}=await import("drizzle-orm"),usersTable=schemaTables.users;if((await db.select().from(usersTable).where(eq31(usersTable.id,userId)).limit(1))[0]?.isGod===!0)return!0}catch(err){logger2.warn("[AdminGuard] Failed to check isGod from DB",{error:err instanceof Error?err.message:String(err)})}return!1}function createGodminGuard2(deps,label="this operation"){return createPrivilegedGuard(deps,label)}function createPrivilegedGuard(deps,label="this operation",options={}){let allowed=new Set((options.allowRoles??[]).map((role)=>role.trim().toLowerCase()));return async({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,Response.json({isSuccess:!1,success:!1,message:"Authentication required",data:null});if(allowed.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowed.has(role.trim().toLowerCase())))return}if(!await isGodminRequest(request,deps)){set2.status=403;let needs=allowed.size>0?`godmin privileges or one of: ${[...allowed].join(", ")}`:"godmin privileges";return Response.json({isSuccess:!1,success:!1,message:`Forbidden: ${label} requires ${needs}`,data:null})}return}}var init_adminGuard=__esm(()=>{init_Authorization();init_types3()});function toCamel4(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function registerSensitiveColumns(names2){for(let name2 of names2)registry2.add(name2),registry2.add(toCamel4(name2))}function isConfigSensitiveKey(key2){return registry2.has(key2)}function sensitiveColumnNames(){return[...registry2]}function sensitiveFieldQueryable(field,opts){if(!isConfigSensitiveKey(field))return!0;if(!opts.authEnabled)return!1;return opts.allowedFields?.includes(field)===!0}function stripUnclaimedSensitive(row,allowedFields){if(allowedFields&&allowedFields.length>0)return row;if(registry2.size===0)return row;return scrub(row)}function scrub(value2){if(value2===null||typeof value2!=="object")return value2;if(Array.isArray(value2))return value2.map(scrub);let proto=Object.getPrototypeOf(value2);if(proto!==Object.prototype&&proto!==null)return value2;let out={};for(let[k,v]of Object.entries(value2)){if(registry2.has(k))continue;out[k]=scrub(v)}return out}var registry2;var init_sensitiveColumns=__esm(()=>{registry2=new Set});var exports_ack_manager={};__export(exports_ack_manager,{storePendingMessage:()=>storePendingMessage,removePendingMessage:()=>removePendingMessage,recordSent:()=>recordSent,recordFailed:()=>recordFailed,recordAcked:()=>recordAcked,initAckCleanup:()=>initAckCleanup,incrementRetryCount:()=>incrementRetryCount,getPendingMessagesForUser:()=>getPendingMessagesForUser,getPendingMessageCount:()=>getPendingMessageCount,getDeliveryStats:()=>getDeliveryStats,generateMessageId:()=>generateMessageId,destroyAckCleanup:()=>destroyAckCleanup,acknowledgeMessage:()=>acknowledgeMessage});function cleanupRecentAcks(){let now=Date.now();for(let[key2,timestamp]of recentAcks)if(now-timestamp>1e4)recentAcks.delete(key2)}function initAckCleanup(){if(cleanupInterval)return;cleanupInterval=setInterval(cleanupRecentAcks,30000),cleanupInterval.unref?.()}function destroyAckCleanup(){if(cleanupInterval)clearInterval(cleanupInterval),cleanupInterval=null}function generateMessageId(){return`msg_${Date.now()}_${Math.random().toString(36).substring(2,11)}`}async function storePendingMessage(redis,message,ttlSeconds){if(!message.userId)return;let key2=`pubsub:pending:user:${message.userId}:${message.messageId}`,setKey=`pubsub:user:pending-set:${message.userId}`;await redis.create(key2,message,ttlSeconds);let existingResult=await redis.read(setKey),existingSet=existingResult.success&&existingResult.data?existingResult.data:[];if(!existingSet.includes(message.messageId))existingSet.push(message.messageId),await redis.create(setKey,existingSet,ttlSeconds)}async function acknowledgeMessage(redis,userId,messageId,ttlSeconds){let dedupKey=`${userId}:${messageId}`;if(recentAcks.has(dedupKey))return!1;let pendingKey=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`,ackKey=`pubsub:ack:${userId}:${messageId}`,pendingResult=await redis.read(pendingKey);if(!pendingResult.success||!pendingResult.data)return recentAcks.set(dedupKey,Date.now()),!1;recentAcks.set(dedupKey,Date.now());let pending=pendingResult.data,ack={messageId,clientId:pending.clientId,ackedAt:Date.now()};await redis.create(ackKey,ack,60),await redis.remove(pendingKey);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,ttlSeconds);else await redis.remove(setKey);let latencyMs=Date.now()-pending.sentAt;return recordAcked(latencyMs),!0}async function getPendingMessagesForUser(redis,userId){if(!userId)return[];let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey),messageIds=setResult.success&&setResult.data?setResult.data:[],messages=[];for(let messageId of messageIds){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(msgResult.success&&msgResult.data)messages.push(msgResult.data)}return messages.sort((a,b)=>a.sentAt-b.sentAt),messages}async function getPendingMessageCount(redis,userId){if(!userId)return 0;let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey);return(setResult.success&&setResult.data?setResult.data:[]).length}async function incrementRetryCount(redis,userId,messageId,ttlSeconds,maxRetries){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(!msgResult.success||!msgResult.data)return!1;let message={...msgResult.data,retryCount:msgResult.data.retryCount+1};if(message.retryCount>=maxRetries)return await removePendingMessage(redis,userId,messageId),recordFailed(),!1;return await redis.create(key2,message,ttlSeconds),!0}async function removePendingMessage(redis,userId,messageId){let key2=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`;await redis.remove(key2);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,300);else await redis.remove(setKey)}function recordSent(){stats.totalSent++}function recordAcked(latencyMs){stats.totalAcked++,stats.averageLatencyMs=(stats.averageLatencyMs*(stats.totalAcked-1)+latencyMs)/stats.totalAcked}function recordFailed(){stats.totalFailed++}function getDeliveryStats(){return{...stats}}var recentAcks,cleanupInterval=null,stats;var init_ack_manager=__esm(()=>{recentAcks=new Map;stats={totalSent:0,totalAcked:0,totalFailed:0,averageLatencyMs:0}});import{eq as eq36}from"drizzle-orm";async function revocationReason(params){let{db,sessionsTable}=params;if(!db||!sessionsTable)return null;let row=(await db.select().from(sessionsTable).where(eq36(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return null;let reason=row.revokedReason??row.revoked_reason;return typeof reason==="string"&&reason.length>0?reason:null}async function refreshSessionIsAlive(params){if(!params.sessionId)return{alive:!1,reason:"no session bound to the token"};let record3=await readSession({sessionId:params.sessionId}).catch(()=>null);if(!record3){let cause=await revocationReason(params).catch(()=>null);return{alive:!1,reason:cause?`session revoked: ${cause}`:"session not found"}}let{userId:sessionUserId,rememberMe:sessionRememberMe}=record3,reuseState={refreshTokenHash:record3.refreshTokenHash,previousRefreshTokenHash:record3.previousRefreshTokenHash,previousRefreshTokenAt:record3.previousRefreshTokenAt},{db,sessionsTable}=params;if(!db||!sessionsTable)return{alive:!0,userId:sessionUserId,rememberMe:sessionRememberMe,...reuseState};let row=(await db.select().from(sessionsTable).where(eq36(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return{alive:!1,reason:"session row missing"};let revokedAtVal=row.revokedAt,isRevoked=revokedAtVal!=null&&!(typeof revokedAtVal==="object"&&!(revokedAtVal instanceof Date)&&Object.keys(revokedAtVal).length===0);if(row.isActive===!1||isRevoked)return{alive:!1,reason:"session revoked"};let expiresAt=row.expiresAt;if(expiresAt&&new Date(expiresAt)<new Date)return{alive:!1,reason:"session expired"};let rowRememberMe=typeof row.rememberMe==="boolean"?row.rememberMe:void 0;return{alive:!0,userId:sessionUserId,rememberMe:rowRememberMe??sessionRememberMe,...reuseState}}var init_sessionBinding=__esm(()=>{init_SessionStore()});var exports_buildServices={};__export(exports_buildServices,{buildVerificationServices:()=>buildVerificationServices});function buildVerificationServices(deps){let verificationService=new VerificationService({db:deps.db,schemaTables:deps.schemaTables,config:deps.config,logger:deps.logger}),notificationService=new NotificationService({db:deps.db,schemaTables:deps.schemaTables,config:deps.notificationConfig||{enabled:!1},logger:deps.logger,getEmailService:deps.getEmailService});return verificationService.setNotificationHandler(async(params)=>{if(!deps.notificationConfig?.enabled)return;await notificationService.triggerNotifications({trigger:params.trigger,flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:params.node_id,verifier_id:params.verifier_id,decision:params.decision,context:params.context})}),{verificationService,notificationService}}var init_buildServices=__esm(()=>{init_Notification();init_Verification()});function resolveMutationSchema(staticSchema,tenantHeader,registry3){let schema3=staticSchema;if(registry3&&tenantHeader){let tctx=registry3.getSchemaContext(tenantHeader);if(!tctx)return{ok:!1,reason:"unknown"};schema3=tctx.schemaName}if(!SQL_IDENT.test(schema3))return{ok:!1,reason:"invalid"};return{ok:!0,schema:schema3}}var SQL_IDENT;var init_resolveMutationSchema=__esm(()=>{SQL_IDENT=/^[a-zA-Z_][a-zA-Z0-9_]*$/});import{eq as eq41,sql as sql9}from"drizzle-orm";function createChangeUserIdRoute(config,schemaName="public"){let{db,logger:logger2}=config,requireGodmin2=createRequireGodmin(config),declared=[defineRoute({method:"POST",path:"/auth/admin/change-user-id",body:Type.Object({currentId:Type.String(),newId:Type.String()}),detail:{tags:["Authentication"],summary:"Change User ID",description:"Godmin: change a user's UUID while preserving all FK relations, audit columns, and polymorphic references"},handler:async(ctx)=>{let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let registry3=config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry,schemaResult=resolveMutationSchema(schemaName,ctx.request.headers.get("x-tenant-schema"),registry3);if(!schemaResult.ok)return ctx.set.status=400,{success:!1,message:schemaResult.reason==="unknown"?"Unknown tenant schema":"Invalid tenant schema"};let effectiveSchema=schemaResult.schema,gate=await requireGodmin2(ctx.request);if(!gate.ok)return ctx.set.status=gate.status,{success:!1,message:gate.message};let requestingUserId=gate.callerId,{currentId,newId}=ctx.body;if(!currentId||!newId)return ctx.set.status=400,{success:!1,message:"currentId and newId are required"};if(currentId===newId)return ctx.set.status=400,{success:!1,message:"New ID must be different from current ID"};let uuidRegex=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;if(!uuidRegex.test(newId))return ctx.set.status=400,{success:!1,message:"newId must be a valid UUID"};if(!uuidRegex.test(currentId))return ctx.set.status=400,{success:!1,message:"currentId must be a valid UUID"};let targetUser=(await db.select().from(usersTable).where(eq41(usersTable.id,currentId)).limit(1))[0];if(!targetUser)return ctx.set.status=404,{success:!1,message:"User not found"};if((await db.select().from(usersTable).where(eq41(usersTable.id,newId)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"A user with this ID already exists"};try{let fkResult=await db.execute(sql9`
+${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algorithms!==void 0){let getInfoAlgs=authenticatorGetInfo.algorithms.map((_alg)=>_alg.alg);if(getInfoAlgs.indexOf(attestationStatementAlg)<0)throw Error(`Attestation statement alg ${attestationStatementAlg} did not match one of ${getInfoAlgs}`)}let authenticatorCerts=x5c.map(convertCertBufferToPEM),statementRootCerts=attestationRootCertificates.map(convertCertBufferToPEM),authenticatorIsSelfReferencing=!1;if(authenticatorCerts.length===1&&statementRootCerts.indexOf(authenticatorCerts[0])>=0)authenticatorIsSelfReferencing=!0;if(!authenticatorIsSelfReferencing)try{await validateCertificatePath(authenticatorCerts,statementRootCerts)}catch(err){throw Error(`Could not validate certificate path with any metadata root certificates: ${err.message}`)}return!0}function stringifyCOSEInfo(info){let{kty,alg,crv}=info,toReturn="";if(kty!==COSEKTY.RSA)toReturn=`{ kty: ${kty}, alg: ${alg}, crv: ${crv} }`;else toReturn=`{ kty: ${kty}, alg: ${alg} }`;return toReturn}var algSignToCOSEInfoMap;var init_verifyAttestationWithMetadata=__esm(()=>{init_convertCertBufferToPEM();init_validateCertificatePath();init_decodeCredentialPublicKey();init_cose();algSignToCOSEInfoMap={secp256r1_ecdsa_sha256_raw:{kty:2,alg:-7,crv:1},secp256r1_ecdsa_sha256_der:{kty:2,alg:-7,crv:1},rsassa_pss_sha256_raw:{kty:3,alg:-37},rsassa_pss_sha256_der:{kty:3,alg:-37},secp256k1_ecdsa_sha256_raw:{kty:2,alg:-47,crv:8},secp256k1_ecdsa_sha256_der:{kty:2,alg:-47,crv:8},rsassa_pss_sha384_raw:{kty:3,alg:-38},rsassa_pkcsv15_sha256_raw:{kty:3,alg:-257},rsassa_pkcsv15_sha384_raw:{kty:3,alg:-258},rsassa_pkcsv15_sha512_raw:{kty:3,alg:-259},rsassa_pkcsv15_sha1_raw:{kty:3,alg:-65535},secp384r1_ecdsa_sha384_raw:{kty:2,alg:-35,crv:2},secp512r1_ecdsa_sha256_raw:{kty:2,alg:-36,crv:3},ed25519_eddsa_sha512_raw:{kty:1,alg:-8,crv:6}}});async function verifyAttestationPacked(options){let{attStmt,clientDataHash,authData,credentialPublicKey,aaguid,rootCertificates}=options,sig=attStmt.get("sig"),x5c=attStmt.get("x5c"),alg=attStmt.get("alg");if(!sig)throw Error("No attestation signature provided in attestation statement (Packed)");if(!alg)throw Error("Attestation statement did not contain alg (Packed)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Packed)`);let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]),verified=!1;if(x5c){let{subject,basicConstraintsCA,version,notBefore,notAfter,parsedCertificate}=getCertificateInfo(x5c[0]),{OU,CN,O,C}=subject;if(OU!=="Authenticator Attestation")throw Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');if(!CN)throw Error("Certificate CN was empty (Packed|Full)");if(!O)throw Error("Certificate O was empty (Packed|Full)");if(!C||C.length!==2)throw Error("Certificate C was not two-character ISO 3166 code (Packed|Full)");if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (Packed|Full)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (Packed|Full)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (Packed|Full)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);try{await validateExtFIDOGenCEAAGUID(parsedCertificate.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (Packed|Full)`)}let statement=await MetadataService.getStatement(aaguid);if(statement){if(statement.attestationTypes.indexOf("basic_full")<0)throw Error("Metadata does not indicate support for full attestations (Packed|Full)");try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (Packed|Full)`)}}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Packed|Full)`)}verified=await verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0]})}else verified=await verifySignature2({signature:sig,data:signatureBase,credentialPublicKey,hashAlgorithm:alg});return verified}var init_verifyAttestationPacked=__esm(()=>{init_cose();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationAndroidSafetyNet(options){let{attStmt,clientDataHash,authData,aaguid,rootCertificates,verifyTimestampMS=!0,credentialPublicKey,attestationSafetyNetEnforceCTSCheck}=options,alg=attStmt.get("alg"),response=attStmt.get("response");if(!attStmt.get("ver"))throw Error("No ver value in attestation (SafetyNet)");if(!response)throw Error("No response was included in attStmt by authenticator (SafetyNet)");let jwtParts=exports_isoUint8Array.toUTF8String(response).split("."),HEADER=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[0])),PAYLOAD=JSON.parse(exports_isoBase64URL.toUTF8String(jwtParts[1])),SIGNATURE=jwtParts[2],{nonce,ctsProfileMatch,timestampMs}=PAYLOAD;if(verifyTimestampMS){let now=Date.now();if(timestampMs>Date.now())throw Error(`Payload timestamp "${timestampMs}" was later than "${now}" (SafetyNet)`);let timestampPlusDelay=timestampMs+60000;if(now=Date.now(),timestampPlusDelay<now)throw Error(`Payload timestamp "${timestampPlusDelay}" has expired (SafetyNet)`)}let nonceBase=exports_isoUint8Array.concat([authData,clientDataHash]),nonceBuffer=await toHash(nonceBase),expectedNonce=exports_isoBase64URL.fromBuffer(nonceBuffer,"base64");if(nonce!==expectedNonce)throw Error("Could not verify payload nonce (SafetyNet)");if(attestationSafetyNetEnforceCTSCheck&&!ctsProfileMatch)throw Error("Could not verify device integrity (SafetyNet)");let leafCertBuffer=exports_isoBase64URL.toBuffer(HEADER.x5c[0],"base64"),leafCertInfo=getCertificateInfo(leafCertBuffer),{subject}=leafCertInfo;if(subject.CN!=="attest.android.com")throw Error('Certificate common name was not "attest.android.com" (SafetyNet)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c:HEADER.x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (SafetyNet)`)}else try{await validateCertificatePath(HEADER.x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (SafetyNet)`)}let signatureBaseBuffer=exports_isoUint8Array.fromUTF8String(`${jwtParts[0]}.${jwtParts[1]}`),signatureBuffer=exports_isoBase64URL.toBuffer(SIGNATURE);return await verifySignature2({signature:signatureBuffer,data:signatureBaseBuffer,x509Certificate:leafCertBuffer})}var init_verifyAttestationAndroidSafetyNet=__esm(()=>{init_toHash();init_verifySignature();init_getCertificateInfo();init_validateCertificatePath();init_convertCertBufferToPEM();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});var TPM_ST,TPM_ALG,TPM_ECC_CURVE,TPM_MANUFACTURERS,TPM_ECC_CURVE_COSE_CRV_MAP;var init_constants2=__esm(()=>{TPM_ST={196:"TPM_ST_RSP_COMMAND",32768:"TPM_ST_NULL",32769:"TPM_ST_NO_SESSIONS",32770:"TPM_ST_SESSIONS",32788:"TPM_ST_ATTEST_NV",32789:"TPM_ST_ATTEST_COMMAND_AUDIT",32790:"TPM_ST_ATTEST_SESSION_AUDIT",32791:"TPM_ST_ATTEST_CERTIFY",32792:"TPM_ST_ATTEST_QUOTE",32793:"TPM_ST_ATTEST_TIME",32794:"TPM_ST_ATTEST_CREATION",32801:"TPM_ST_CREATION",32802:"TPM_ST_VERIFIED",32803:"TPM_ST_AUTH_SECRET",32804:"TPM_ST_HASHCHECK",32805:"TPM_ST_AUTH_SIGNED",32809:"TPM_ST_FU_MANIFEST"},TPM_ALG={0:"TPM_ALG_ERROR",1:"TPM_ALG_RSA",4:"TPM_ALG_SHA",4:"TPM_ALG_SHA1",5:"TPM_ALG_HMAC",6:"TPM_ALG_AES",7:"TPM_ALG_MGF1",8:"TPM_ALG_KEYEDHASH",10:"TPM_ALG_XOR",11:"TPM_ALG_SHA256",12:"TPM_ALG_SHA384",13:"TPM_ALG_SHA512",16:"TPM_ALG_NULL",18:"TPM_ALG_SM3_256",19:"TPM_ALG_SM4",20:"TPM_ALG_RSASSA",21:"TPM_ALG_RSAES",22:"TPM_ALG_RSAPSS",23:"TPM_ALG_OAEP",24:"TPM_ALG_ECDSA",25:"TPM_ALG_ECDH",26:"TPM_ALG_ECDAA",27:"TPM_ALG_SM2",28:"TPM_ALG_ECSCHNORR",29:"TPM_ALG_ECMQV",32:"TPM_ALG_KDF1_SP800_56A",33:"TPM_ALG_KDF2",34:"TPM_ALG_KDF1_SP800_108",35:"TPM_ALG_ECC",37:"TPM_ALG_SYMCIPHER",38:"TPM_ALG_CAMELLIA",64:"TPM_ALG_CTR",65:"TPM_ALG_OFB",66:"TPM_ALG_CBC",67:"TPM_ALG_CFB",68:"TPM_ALG_ECB"},TPM_ECC_CURVE={0:"TPM_ECC_NONE",1:"TPM_ECC_NIST_P192",2:"TPM_ECC_NIST_P224",3:"TPM_ECC_NIST_P256",4:"TPM_ECC_NIST_P384",5:"TPM_ECC_NIST_P521",16:"TPM_ECC_BN_P256",17:"TPM_ECC_BN_P638",32:"TPM_ECC_SM2_P256"},TPM_MANUFACTURERS={"id:414D4400":{name:"AMD",id:"AMD"},"id:414E5400":{name:"Ant Group",id:"ANT"},"id:41544D4C":{name:"Atmel",id:"ATML"},"id:4252434D":{name:"Broadcom",id:"BRCM"},"id:4353434F":{name:"Cisco",id:"CSCO"},"id:464C5953":{name:"Flyslice Technologies",id:"FLYS"},"id:524F4343":{name:"Fuzhou Rockchip",id:"ROCC"},"id:474F4F47":{name:"Google",id:"GOOG"},"id:48504900":{name:"HPI",id:"HPI"},"id:48504500":{name:"HPE",id:"HPE"},"id:48495349":{name:"Huawei",id:"HISI"},"id:49424d00":{name:"IBM",id:"IBM"},"id:49424D00":{name:"IBM",id:"IBM"},"id:49465800":{name:"Infineon",id:"IFX"},"id:494E5443":{name:"Intel",id:"INTC"},"id:4C454E00":{name:"Lenovo",id:"LEN"},"id:4D534654":{name:"Microsoft",id:"MSFT"},"id:4E534D20":{name:"National Semiconductor",id:"NSM"},"id:4E545A00":{name:"Nationz",id:"NTZ"},"id:4E534700":{name:"NSING",id:"NSG"},"id:4E544300":{name:"Nuvoton Technology",id:"NTC"},"id:51434F4D":{name:"Qualcomm",id:"QCOM"},"id:534D534E":{name:"Samsung",id:"SMSN"},"id:53454345":{name:"SecEdge",id:"SECE"},"id:534E5300":{name:"Sinosun",id:"SNS"},"id:534D5343":{name:"SMSC",id:"SMSC"},"id:53544D20":{name:"STMicroelectronics",id:"STM"},"id:54584E00":{name:"Texas Instruments",id:"TXN"},"id:57454300":{name:"Winbond",id:"WEC"},"id:5345414C":{name:"Wisekey",id:"SEAL"},"id:FFFFF1D0":{name:"FIDO Alliance",id:"FIDO"}},TPM_ECC_CURVE_COSE_CRV_MAP={TPM_ECC_NIST_P256:1,TPM_ECC_NIST_P384:2,TPM_ECC_NIST_P521:3,TPM_ECC_BN_P256:1,TPM_ECC_SM2_P256:1}});function parseCertInfo(certInfo){let pointer=0,dataView=exports_isoUint8Array.toDataView(certInfo),magic=dataView.getUint32(pointer);pointer+=4;let typeBuffer=dataView.getUint16(pointer);pointer+=2;let type=TPM_ST[typeBuffer],qualifiedSignerLength=dataView.getUint16(pointer);pointer+=2;let qualifiedSigner=certInfo.slice(pointer,pointer+=qualifiedSignerLength),extraDataLength=dataView.getUint16(pointer);pointer+=2;let extraData=certInfo.slice(pointer,pointer+=extraDataLength),clock=certInfo.slice(pointer,pointer+=8),resetCount=dataView.getUint32(pointer);pointer+=4;let restartCount=dataView.getUint32(pointer);pointer+=4;let safe=!!certInfo.slice(pointer,pointer+=1),clockInfo={clock,resetCount,restartCount,safe},firmwareVersion=certInfo.slice(pointer,pointer+=8),attestedNameLength=dataView.getUint16(pointer);pointer+=2;let attestedName=certInfo.slice(pointer,pointer+=attestedNameLength),attestedNameDataView=exports_isoUint8Array.toDataView(attestedName),qualifiedNameLength=dataView.getUint16(pointer);pointer+=2;let qualifiedName=certInfo.slice(pointer,pointer+=qualifiedNameLength),attested={nameAlg:TPM_ALG[attestedNameDataView.getUint16(0)],nameAlgBuffer:attestedName.slice(0,2),name:attestedName,qualifiedName};return{magic,type,qualifiedSigner,extraData,clockInfo,firmwareVersion,attested}}var init_parseCertInfo=__esm(()=>{init_constants2();init_iso()});function parsePubArea(pubArea){let pointer=0,dataView=exports_isoUint8Array.toDataView(pubArea),type=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let nameAlg=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let objectAttributesInt=dataView.getUint32(pointer);pointer+=4;let objectAttributes={fixedTPM:!!(objectAttributesInt&1),stClear:!!(objectAttributesInt&2),fixedParent:!!(objectAttributesInt&8),sensitiveDataOrigin:!!(objectAttributesInt&16),userWithAuth:!!(objectAttributesInt&32),adminWithPolicy:!!(objectAttributesInt&64),noDA:!!(objectAttributesInt&512),encryptedDuplication:!!(objectAttributesInt&1024),restricted:!!(objectAttributesInt&32768),decrypt:!!(objectAttributesInt&65536),signOrEncrypt:!!(objectAttributesInt&131072)},authPolicyLength=dataView.getUint16(pointer);pointer+=2;let authPolicy=pubArea.slice(pointer,pointer+=authPolicyLength),parameters2={},unique=Uint8Array.from([]);if(type==="TPM_ALG_RSA"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let keyBits=dataView.getUint16(pointer);pointer+=2;let exponent=dataView.getUint32(pointer);pointer+=4,parameters2.rsa={symmetric,scheme,keyBits,exponent};let uniqueLength=dataView.getUint16(pointer);pointer+=2,unique=pubArea.slice(pointer,pointer+=uniqueLength)}else if(type==="TPM_ALG_ECC"){let symmetric=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let scheme=TPM_ALG[dataView.getUint16(pointer)];pointer+=2;let curveID=TPM_ECC_CURVE[dataView.getUint16(pointer)];pointer+=2;let kdf=TPM_ALG[dataView.getUint16(pointer)];pointer+=2,parameters2.ecc={symmetric,scheme,curveID,kdf};let uniqueXLength=dataView.getUint16(pointer);pointer+=2;let uniqueX=pubArea.slice(pointer,pointer+=uniqueXLength),uniqueYLength=dataView.getUint16(pointer);pointer+=2;let uniqueY=pubArea.slice(pointer,pointer+=uniqueYLength);unique=exports_isoUint8Array.concat([uniqueX,uniqueY])}else throw Error(`Unexpected type "${type}" (TPM)`);return{type,nameAlg,objectAttributes,authPolicy,parameters:parameters2,unique}}var init_parsePubArea=__esm(()=>{init_constants2();init_iso()});async function verifyAttestationTPM(options){let{aaguid,attStmt,authData,credentialPublicKey,clientDataHash,rootCertificates}=options,ver=attStmt.get("ver"),sig=attStmt.get("sig"),alg=attStmt.get("alg"),x5c=attStmt.get("x5c"),pubArea=attStmt.get("pubArea"),certInfo=attStmt.get("certInfo");if(ver!=="2.0")throw Error(`Unexpected ver "${ver}", expected "2.0" (TPM)`);if(!sig)throw Error("No attestation signature provided in attestation statement (TPM)");if(!alg)throw Error("Attestation statement did not contain alg (TPM)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (TPM)`);if(!x5c)throw Error("No attestation certificate provided in attestation statement (TPM)");if(!pubArea)throw Error("Attestation statement did not contain pubArea (TPM)");if(!certInfo)throw Error("Attestation statement did not contain certInfo (TPM)");let parsedPubArea=parsePubArea(pubArea),{unique,type:pubType,parameters:parameters2}=parsedPubArea,cosePublicKey=decodeCredentialPublicKey(credentialPublicKey);if(pubType==="TPM_ALG_RSA"){if(!isCOSEPublicKeyRSA(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let n=cosePublicKey.get(COSEKEYS.n),e=cosePublicKey.get(COSEKEYS.e);if(!n)throw Error("COSE public key missing n (TPM|RSA)");if(!e)throw Error("COSE public key missing e (TPM|RSA)");if(!exports_isoUint8Array.areEqual(unique,n))throw Error("PubArea unique is not same as credentialPublicKey (TPM|RSA)");if(!parameters2.rsa)throw Error("Parsed pubArea type is RSA, but missing parameters.rsa (TPM|RSA)");let eBuffer=e,pubAreaExponent=parameters2.rsa.exponent||65537,eSum=eBuffer[0]+(eBuffer[1]<<8)+(eBuffer[2]<<16);if(pubAreaExponent!==eSum)throw Error(`Unexpected public key exp ${eSum}, expected ${pubAreaExponent} (TPM|RSA)`)}else if(pubType==="TPM_ALG_ECC"){if(!isCOSEPublicKeyEC2(cosePublicKey))throw Error(`Credential public key with kty ${cosePublicKey.get(COSEKEYS.kty)} did not match ${pubType}`);let crv=cosePublicKey.get(COSEKEYS.crv),x=cosePublicKey.get(COSEKEYS.x),y=cosePublicKey.get(COSEKEYS.y);if(!crv)throw Error("COSE public key missing crv (TPM|ECC)");if(!x)throw Error("COSE public key missing x (TPM|ECC)");if(!y)throw Error("COSE public key missing y (TPM|ECC)");if(!exports_isoUint8Array.areEqual(unique,exports_isoUint8Array.concat([x,y])))throw Error("PubArea unique is not same as public key x and y (TPM|ECC)");if(!parameters2.ecc)throw Error("Parsed pubArea type is ECC, but missing parameters.ecc (TPM|ECC)");let pubAreaCurveID=parameters2.ecc.curveID,pubAreaCurveIDMapToCOSECRV=TPM_ECC_CURVE_COSE_CRV_MAP[pubAreaCurveID];if(pubAreaCurveIDMapToCOSECRV!==crv)throw Error(`Public area key curve ID "${pubAreaCurveID}" mapped to "${pubAreaCurveIDMapToCOSECRV}" which did not match public key crv of "${crv}" (TPM|ECC)`)}else throw Error(`Unsupported pubArea.type "${pubType}"`);let parsedCertInfo=parseCertInfo(certInfo),{magic,type:certType,attested,extraData}=parsedCertInfo;if(magic!==4283712327)throw Error(`Unexpected magic value "${magic}", expected "0xff544347" (TPM)`);if(certType!=="TPM_ST_ATTEST_CERTIFY")throw Error(`Unexpected type "${certType}", expected "TPM_ST_ATTEST_CERTIFY" (TPM)`);let pubAreaHash=await toHash(pubArea,attestedNameAlgToCOSEAlg(attested.nameAlg)),attestedName=exports_isoUint8Array.concat([attested.nameAlgBuffer,pubAreaHash]);if(!exports_isoUint8Array.areEqual(attested.name,attestedName))throw Error("Attested name comparison failed (TPM)");let attToBeSigned=exports_isoUint8Array.concat([authData,clientDataHash]),attToBeSignedHash=await toHash(attToBeSigned,alg);if(!exports_isoUint8Array.areEqual(extraData,attToBeSignedHash))throw Error("CertInfo extra data did not equal hashed attestation (TPM)");if(x5c.length<1)throw Error("No certificates present in x5c array (TPM)");let leafCertInfo=getCertificateInfo(x5c[0]),{basicConstraintsCA,version,subject,notAfter,notBefore}=leafCertInfo;if(basicConstraintsCA)throw Error("Certificate basic constraints CA was not `false` (TPM)");if(version!==2)throw Error("Certificate version was not `3` (ASN.1 value of 2) (TPM)");if(subject.combined.length>0)throw Error("Certificate subject was not empty (TPM)");let now=new Date;if(notBefore>now)throw Error(`Certificate not good before "${notBefore.toString()}" (TPM)`);if(now=new Date,notAfter<now)throw Error(`Certificate not good after "${notAfter.toString()}" (TPM)`);let parsedCert=AsnParser.parse(x5c[0],Certificate);if(!parsedCert.tbsCertificate.extensions)throw Error("Certificate was missing extensions (TPM)");let subjectAltNamePresent,extKeyUsage;if(parsedCert.tbsCertificate.extensions.forEach((ext)=>{if(ext.extnID===id_ce_subjectAltName)subjectAltNamePresent=AsnParser.parse(ext.extnValue,SubjectAlternativeName);else if(ext.extnID===id_ce_extKeyUsage)extKeyUsage=AsnParser.parse(ext.extnValue,ExtendedKeyUsage)}),!subjectAltNamePresent)throw Error("Certificate did not contain subjectAltName extension (TPM)");if(!subjectAltNamePresent[0].directoryName?.[0].length)throw Error("Certificate subjectAltName extension directoryName was empty (TPM)");let{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}=getTcgAtTpmValues(subjectAltNamePresent[0].directoryName);if(!tcgAtTpmManufacturer||!tcgAtTpmModel||!tcgAtTpmVersion)throw Error("Certificate contained incomplete subjectAltName data (TPM)");if(!extKeyUsage)throw Error("Certificate did not contain ExtendedKeyUsage extension (TPM)");if(!TPM_MANUFACTURERS[tcgAtTpmManufacturer])throw Error(`Could not match TPM manufacturer "${tcgAtTpmManufacturer}" (TPM)`);if(extKeyUsage[0]!=="2.23.133.8.3")throw Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);try{await validateExtFIDOGenCEAAGUID(parsedCert.tbsCertificate.extensions,aaguid)}catch(err){throw Error(`${err.message} (TPM)`)}let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){throw Error(`${err.message} (TPM)`)}else try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (TPM)`)}return verifySignature2({signature:sig,data:certInfo,x509Certificate:x5c[0],hashAlgorithm:alg})}function getTcgAtTpmValues(root){let tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion;return root.forEach((relName)=>{relName.forEach((attr)=>{if(attr.type==="2.23.133.2.1")tcgAtTpmManufacturer=attr.value.toString();else if(attr.type==="2.23.133.2.2")tcgAtTpmModel=attr.value.toString();else if(attr.type==="2.23.133.2.3")tcgAtTpmVersion=attr.value.toString()})}),{tcgAtTpmManufacturer,tcgAtTpmModel,tcgAtTpmVersion}}function attestedNameAlgToCOSEAlg(alg){if(alg==="TPM_ALG_SHA256")return COSEALG.ES256;else if(alg==="TPM_ALG_SHA384")return COSEALG.ES384;else if(alg==="TPM_ALG_SHA512")return COSEALG.ES512;throw Error(`Unexpected TPM attested name alg ${alg}`)}var init_verifyAttestationTPM=__esm(()=>{init_es2015();init_es20152();init_decodeCredentialPublicKey();init_cose();init_toHash();init_convertCertBufferToPEM();init_validateCertificatePath();init_getCertificateInfo();init_verifySignature();init_iso();init_validateExtFIDOGenCEAAGUID();init_metadataService();init_verifyAttestationWithMetadata();init_constants2();init_parseCertInfo();init_parsePubArea()});class RootOfTrust{verifiedBootKey=new OctetString2;deviceLocked=!1;verifiedBootState=VerifiedBootState.verified;verifiedBootHash;constructor(params={}){Object.assign(this,params)}}class AuthorizationList{purpose;algorithm;keySize;digest;padding;ecCurve;rsaPublicExponent;mgfDigest;rollbackResistance;earlyBootOnly;activeDateTime;originationExpireDateTime;usageExpireDateTime;usageCountLimit;noAuthRequired;userAuthType;authTimeout;allowWhileOnBody;trustedUserPresenceRequired;trustedConfirmationRequired;unlockedDeviceRequired;allApplications;applicationId;creationDateTime;origin;rollbackResistant;rootOfTrust;osVersion;osPatchLevel;attestationApplicationId;attestationIdBrand;attestationIdDevice;attestationIdProduct;attestationIdSerial;attestationIdImei;attestationIdMeid;attestationIdManufacturer;attestationIdModel;vendorPatchLevel;bootPatchLevel;deviceUniqueAttestation;attestationIdSecondImei;moduleHash;constructor(params={}){Object.assign(this,params)}}class KeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;teeEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}}class KeyMintKeyDescription{attestationVersion=Version3.keyMint4;attestationSecurityLevel=SecurityLevel.software;keyMintVersion=0;keyMintSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new AuthorizationList;hardwareEnforced=new AuthorizationList;constructor(params={}){Object.assign(this,params)}toLegacyKeyDescription(){return new KeyDescription({attestationVersion:this.attestationVersion,attestationSecurityLevel:this.attestationSecurityLevel,keymasterVersion:this.keyMintVersion,keymasterSecurityLevel:this.keyMintSecurityLevel,attestationChallenge:this.attestationChallenge,uniqueId:this.uniqueId,softwareEnforced:this.softwareEnforced,teeEnforced:this.hardwareEnforced})}static fromLegacyKeyDescription(keyDesc){return new KeyMintKeyDescription({attestationVersion:keyDesc.attestationVersion,attestationSecurityLevel:keyDesc.attestationSecurityLevel,keyMintVersion:keyDesc.keymasterVersion,keyMintSecurityLevel:keyDesc.keymasterSecurityLevel,attestationChallenge:keyDesc.attestationChallenge,uniqueId:keyDesc.uniqueId,softwareEnforced:keyDesc.softwareEnforced,hardwareEnforced:keyDesc.teeEnforced})}}var IntegerSet_1,id_ce_keyDescription="1.3.6.1.4.1.11129.2.1.17",VerifiedBootState,IntegerSet,SecurityLevel,Version3;var init_key_description=__esm(()=>{init_modules();init_es2015();(function(VerifiedBootState2){VerifiedBootState2[VerifiedBootState2.verified=0]="verified",VerifiedBootState2[VerifiedBootState2.selfSigned=1]="selfSigned",VerifiedBootState2[VerifiedBootState2.unverified=2]="unverified",VerifiedBootState2[VerifiedBootState2.failed=3]="failed"})(VerifiedBootState||(VerifiedBootState={}));__decorate([AsnProp({type:OctetString2})],RootOfTrust.prototype,"verifiedBootKey",void 0);__decorate([AsnProp({type:AsnPropTypes.Boolean})],RootOfTrust.prototype,"deviceLocked",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],RootOfTrust.prototype,"verifiedBootState",void 0);__decorate([AsnProp({type:OctetString2,optional:!0})],RootOfTrust.prototype,"verifiedBootHash",void 0);IntegerSet=IntegerSet_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,IntegerSet_1.prototype)}};IntegerSet=IntegerSet_1=__decorate([AsnType({type:AsnTypeTypes.Set,itemType:AsnPropTypes.Integer})],IntegerSet);__decorate([AsnProp({context:1,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"purpose",void 0);__decorate([AsnProp({context:2,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"algorithm",void 0);__decorate([AsnProp({context:3,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"keySize",void 0);__decorate([AsnProp({context:5,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"digest",void 0);__decorate([AsnProp({context:6,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"padding",void 0);__decorate([AsnProp({context:10,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"ecCurve",void 0);__decorate([AsnProp({context:200,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"rsaPublicExponent",void 0);__decorate([AsnProp({context:203,type:IntegerSet,optional:!0})],AuthorizationList.prototype,"mgfDigest",void 0);__decorate([AsnProp({context:303,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistance",void 0);__decorate([AsnProp({context:305,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"earlyBootOnly",void 0);__decorate([AsnProp({context:400,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"activeDateTime",void 0);__decorate([AsnProp({context:401,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"originationExpireDateTime",void 0);__decorate([AsnProp({context:402,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageExpireDateTime",void 0);__decorate([AsnProp({context:405,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"usageCountLimit",void 0);__decorate([AsnProp({context:503,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"noAuthRequired",void 0);__decorate([AsnProp({context:504,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"userAuthType",void 0);__decorate([AsnProp({context:505,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"authTimeout",void 0);__decorate([AsnProp({context:506,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allowWhileOnBody",void 0);__decorate([AsnProp({context:507,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedUserPresenceRequired",void 0);__decorate([AsnProp({context:508,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"trustedConfirmationRequired",void 0);__decorate([AsnProp({context:509,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"unlockedDeviceRequired",void 0);__decorate([AsnProp({context:600,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"allApplications",void 0);__decorate([AsnProp({context:601,type:OctetString2,optional:!0})],AuthorizationList.prototype,"applicationId",void 0);__decorate([AsnProp({context:701,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"creationDateTime",void 0);__decorate([AsnProp({context:702,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"origin",void 0);__decorate([AsnProp({context:703,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"rollbackResistant",void 0);__decorate([AsnProp({context:704,type:RootOfTrust,optional:!0})],AuthorizationList.prototype,"rootOfTrust",void 0);__decorate([AsnProp({context:705,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osVersion",void 0);__decorate([AsnProp({context:706,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"osPatchLevel",void 0);__decorate([AsnProp({context:709,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationApplicationId",void 0);__decorate([AsnProp({context:710,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdBrand",void 0);__decorate([AsnProp({context:711,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdDevice",void 0);__decorate([AsnProp({context:712,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdProduct",void 0);__decorate([AsnProp({context:713,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSerial",void 0);__decorate([AsnProp({context:714,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdImei",void 0);__decorate([AsnProp({context:715,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdMeid",void 0);__decorate([AsnProp({context:716,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdManufacturer",void 0);__decorate([AsnProp({context:717,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdModel",void 0);__decorate([AsnProp({context:718,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"vendorPatchLevel",void 0);__decorate([AsnProp({context:719,type:AsnPropTypes.Integer,optional:!0})],AuthorizationList.prototype,"bootPatchLevel",void 0);__decorate([AsnProp({context:720,type:AsnPropTypes.Null,optional:!0})],AuthorizationList.prototype,"deviceUniqueAttestation",void 0);__decorate([AsnProp({context:723,type:OctetString2,optional:!0})],AuthorizationList.prototype,"attestationIdSecondImei",void 0);__decorate([AsnProp({context:724,type:OctetString2,optional:!0})],AuthorizationList.prototype,"moduleHash",void 0);(function(SecurityLevel2){SecurityLevel2[SecurityLevel2.software=0]="software",SecurityLevel2[SecurityLevel2.trustedEnvironment=1]="trustedEnvironment",SecurityLevel2[SecurityLevel2.strongBox=2]="strongBox"})(SecurityLevel||(SecurityLevel={}));(function(Version4){Version4[Version4.KM2=1]="KM2",Version4[Version4.KM3=2]="KM3",Version4[Version4.KM4=3]="KM4",Version4[Version4.KM4_1=4]="KM4_1",Version4[Version4.keyMint1=100]="keyMint1",Version4[Version4.keyMint2=200]="keyMint2",Version4[Version4.keyMint3=300]="keyMint3",Version4[Version4.keyMint4=400]="keyMint4"})(Version3||(Version3={}));__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyDescription.prototype,"teeEnforced",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],KeyMintKeyDescription.prototype,"keyMintVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],KeyMintKeyDescription.prototype,"keyMintSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],KeyMintKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:AuthorizationList})],KeyMintKeyDescription.prototype,"hardwareEnforced",void 0)});class NonStandardKeyDescription{attestationVersion=Version3.KM4;attestationSecurityLevel=SecurityLevel.software;keymasterVersion=0;keymasterSecurityLevel=SecurityLevel.software;attestationChallenge=new OctetString2;uniqueId=new OctetString2;softwareEnforced=new NonStandardAuthorizationList;teeEnforced=new NonStandardAuthorizationList;get keyMintVersion(){return this.keymasterVersion}set keyMintVersion(value){this.keymasterVersion=value}get keyMintSecurityLevel(){return this.keymasterSecurityLevel}set keyMintSecurityLevel(value){this.keymasterSecurityLevel=value}get hardwareEnforced(){return this.teeEnforced}set hardwareEnforced(value){this.teeEnforced=value}constructor(params={}){Object.assign(this,params)}}var NonStandardAuthorizationList_1,NonStandardAuthorization,NonStandardAuthorizationList,NonStandardKeyMintKeyDescription;var init_nonstandard=__esm(()=>{init_modules();init_es2015();init_key_description();NonStandardAuthorization=class extends AuthorizationList{};NonStandardAuthorization=__decorate([AsnType({type:AsnTypeTypes.Choice})],NonStandardAuthorization);NonStandardAuthorizationList=NonStandardAuthorizationList_1=class extends AsnArray{constructor(items){super(items);Object.setPrototypeOf(this,NonStandardAuthorizationList_1.prototype)}findProperty(key2){let prop=this.find((o)=>o[key2]!==void 0);if(prop)return prop[key2];return}};NonStandardAuthorizationList=NonStandardAuthorizationList_1=__decorate([AsnType({type:AsnTypeTypes.Sequence,itemType:NonStandardAuthorization})],NonStandardAuthorizationList);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"attestationVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"attestationSecurityLevel",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],NonStandardKeyDescription.prototype,"keymasterVersion",void 0);__decorate([AsnProp({type:AsnPropTypes.Enumerated})],NonStandardKeyDescription.prototype,"keymasterSecurityLevel",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"attestationChallenge",void 0);__decorate([AsnProp({type:OctetString2})],NonStandardKeyDescription.prototype,"uniqueId",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"softwareEnforced",void 0);__decorate([AsnProp({type:NonStandardAuthorizationList})],NonStandardKeyDescription.prototype,"teeEnforced",void 0);NonStandardKeyMintKeyDescription=class extends NonStandardKeyDescription{constructor(params={}){if("keymasterVersion"in params&&!("keyMintVersion"in params))params.keyMintVersion=params.keymasterVersion;if("keymasterSecurityLevel"in params&&!("keyMintSecurityLevel"in params))params.keyMintSecurityLevel=params.keymasterSecurityLevel;if("teeEnforced"in params&&!("hardwareEnforced"in params))params.hardwareEnforced=params.teeEnforced;super(params)}};NonStandardKeyMintKeyDescription=__decorate([AsnType({type:AsnTypeTypes.Sequence})],NonStandardKeyMintKeyDescription)});class AttestationPackageInfo{packageName;version;constructor(params={}){Object.assign(this,params)}}class AttestationApplicationId{packageInfos;signatureDigests;constructor(params={}){Object.assign(this,params)}}var init_attestation=__esm(()=>{init_modules();init_es2015();__decorate([AsnProp({type:AsnPropTypes.OctetString})],AttestationPackageInfo.prototype,"packageName",void 0);__decorate([AsnProp({type:AsnPropTypes.Integer})],AttestationPackageInfo.prototype,"version",void 0);__decorate([AsnProp({type:AttestationPackageInfo,repeated:"set"})],AttestationApplicationId.prototype,"packageInfos",void 0);__decorate([AsnProp({type:AsnPropTypes.OctetString,repeated:"set"})],AttestationApplicationId.prototype,"signatureDigests",void 0)});var init_es201511=__esm(()=>{init_key_description();init_nonstandard();init_attestation()});async function verifyAttestationAndroidKey(options){let{authData,clientDataHash,attStmt,credentialPublicKey,aaguid,rootCertificates}=options,x5c=attStmt.get("x5c"),sig=attStmt.get("sig"),alg=attStmt.get("alg");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Android Key)");if(!sig)throw Error("No attestation signature provided in attestation statement (Android Key)");if(!alg)throw Error("Attestation statement did not contain alg (Android Key)");if(!isCOSEAlg(alg))throw Error(`Attestation statement contained invalid alg ${alg} (Android Key)`);let parsedCert=AsnParser.parse(x5c[0],Certificate),parsedCertPubKey=new Uint8Array(parsedCert.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey),credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,parsedCertPubKey))throw Error("Credential public key does not equal leaf cert public key (Android Key)");let extKeyStore=parsedCert.tbsCertificate.extensions?.find((ext)=>ext.extnID===id_ce_keyDescription);if(!extKeyStore)throw Error("Certificate did not contain extKeyStore (Android Key)");let parsedExtKeyStore=AsnParser.parse(extKeyStore.extnValue,KeyDescription),{attestationChallenge,teeEnforced,softwareEnforced}=parsedExtKeyStore;if(!exports_isoUint8Array.areEqual(new Uint8Array(attestationChallenge.buffer),clientDataHash))throw Error("Attestation challenge was not equal to client data hash (Android Key)");if(teeEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');if(softwareEnforced.allApplications!==void 0)throw Error('teeEnforced contained "allApplications [600]" tag (Android Key)');let statement=await MetadataService.getStatement(aaguid);if(statement)try{await verifyAttestationWithMetadata({statement,credentialPublicKey,x5c,attestationStatementAlg:alg})}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}else{let x5cNoRootPEM=x5c.slice(0,-1).map(convertCertBufferToPEM),x5cRootPEM=x5c.slice(-1).map(convertCertBufferToPEM);try{await validateCertificatePath(x5cNoRootPEM,x5cRootPEM)}catch(err){let _err=err;throw Error(`${_err.message} (Android Key)`,{cause:_err})}if(rootCertificates.length>0&&rootCertificates.indexOf(x5cRootPEM[0])<0)throw Error("x5c root certificate was not a known root certificate (Android Key)")}let signatureBase=exports_isoUint8Array.concat([authData,clientDataHash]);return verifySignature2({signature:sig,data:signatureBase,x509Certificate:x5c[0],hashAlgorithm:alg})}var init_verifyAttestationAndroidKey=__esm(()=>{init_es2015();init_es20152();init_es201511();init_convertCertBufferToPEM();init_validateCertificatePath();init_verifySignature();init_convertCOSEtoPKCS();init_cose();init_iso();init_metadataService();init_verifyAttestationWithMetadata()});async function verifyAttestationApple(options){let{attStmt,authData,clientDataHash,credentialPublicKey,rootCertificates}=options,x5c=attStmt.get("x5c");if(!x5c)throw Error("No attestation certificate provided in attestation statement (Apple)");try{await validateCertificatePath(x5c.map(convertCertBufferToPEM),rootCertificates)}catch(err){throw Error(`${err.message} (Apple)`)}let parsedCredCert=AsnParser.parse(x5c[0],Certificate),{extensions:extensions2,subjectPublicKeyInfo}=parsedCredCert.tbsCertificate;if(!extensions2)throw Error("credCert missing extensions (Apple)");let extCertNonce=extensions2.find((ext)=>ext.extnID==="1.2.840.113635.100.8.2");if(!extCertNonce)throw Error('credCert missing "1.2.840.113635.100.8.2" extension (Apple)');let nonceToHash=exports_isoUint8Array.concat([authData,clientDataHash]),nonce=await toHash(nonceToHash),extNonce=new Uint8Array(extCertNonce.extnValue.buffer).slice(6);if(!exports_isoUint8Array.areEqual(nonce,extNonce))throw Error("credCert nonce was not expected value (Apple)");let credPubKeyPKCS=convertCOSEtoPKCS(credentialPublicKey),credCertSubjectPublicKey=new Uint8Array(subjectPublicKeyInfo.subjectPublicKey);if(!exports_isoUint8Array.areEqual(credPubKeyPKCS,credCertSubjectPublicKey))throw Error("Credential public key does not equal credCert public key (Apple)");return!0}var init_verifyAttestationApple=__esm(()=>{init_es2015();init_es20152();init_validateCertificatePath();init_convertCertBufferToPEM();init_toHash();init_convertCOSEtoPKCS();init_iso()});async function verifyRegistrationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,requireUserPresence=!0,requireUserVerification=!0,supportedAlgorithmIDs=supportedCOSEAlgorithmIdentifiers,attestationSafetyNetEnforceCTSCheck=!0}=options,{id,rawId,type:credentialType,response:attestationResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);let clientDataJSON=decodeClientDataJSON(attestationResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected registration response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected registration response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.create")throw Error(`Unexpected registration response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected registration response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin))throw Error(`Unexpected registration response origin "${origin}", expected one of: ${expectedOrigin.join(", ")}`)}else if(origin!==expectedOrigin)throw Error(`Unexpected registration response origin "${origin}", expected "${expectedOrigin}"`);if(tokenBinding){if(typeof tokenBinding!=="object")throw Error(`Unexpected value for TokenBinding "${tokenBinding}"`);if(["present","supported","not-supported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding.status value of "${tokenBinding.status}"`)}let attestationObject=exports_isoBase64URL.toBuffer(attestationResponse.attestationObject),decodedAttestationObject=decodeAttestationObject(attestationObject),fmt=decodedAttestationObject.get("fmt"),authData=decodedAttestationObject.get("authData"),attStmt=decodedAttestationObject.get("attStmt"),parsedAuthData=parseAuthenticatorData(authData),{aaguid,rpIdHash,flags,credentialID,counter,credentialPublicKey,extensionsData}=parsedAuthData,matchedRPID;if(expectedRPID){let expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs)}if(requireUserPresence&&!flags.up)throw Error("User presence was required, but user was not present");if(requireUserVerification&&!flags.uv)throw Error("User verification was required, but user could not be verified");if(!credentialID)throw Error("No credential ID was provided by authenticator");if(!credentialPublicKey)throw Error("No public key was provided by authenticator");if(!aaguid)throw Error("No AAGUID was present during registration");let alg=decodeCredentialPublicKey(credentialPublicKey).get(COSEKEYS.alg);if(typeof alg!=="number")throw Error("Credential public key was missing numeric alg");if(!supportedAlgorithmIDs.includes(alg)){let supported=supportedAlgorithmIDs.join(", ");throw Error(`Unexpected public key alg "${alg}", expected one of "${supported}"`)}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(attestationResponse.clientDataJSON)),rootCertificates=SettingsService.getRootCertificates({identifier:fmt}),verifierOpts={aaguid,attStmt,authData,clientDataHash,credentialID,credentialPublicKey,rootCertificates,rpIdHash,attestationSafetyNetEnforceCTSCheck},verified=!1;if(fmt==="fido-u2f")verified=await verifyAttestationFIDOU2F(verifierOpts);else if(fmt==="packed")verified=await verifyAttestationPacked(verifierOpts);else if(fmt==="android-safetynet")verified=await verifyAttestationAndroidSafetyNet(verifierOpts);else if(fmt==="android-key")verified=await verifyAttestationAndroidKey(verifierOpts);else if(fmt==="tpm")verified=await verifyAttestationTPM(verifierOpts);else if(fmt==="apple")verified=await verifyAttestationApple(verifierOpts);else if(fmt==="none"){if(attStmt.size>0)throw Error("None attestation had unexpected attestation statement");verified=!0}else throw Error(`Unsupported Attestation Format: ${fmt}`);if(!verified)return{verified:!1};let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:!0,registrationInfo:{fmt,aaguid:convertAAGUIDToString(aaguid),credentialType,credential:{id:exports_isoBase64URL.fromBuffer(credentialID),publicKey:credentialPublicKey,counter,transports:response.response.transports},attestationObject,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,origin:clientDataJSON.origin,rpID:matchedRPID,authenticatorExtensionResults:extensionsData}}}var init_verifyRegistrationResponse=__esm(()=>{init_decodeAttestationObject();init_decodeClientDataJSON();init_parseAuthenticatorData();init_toHash();init_decodeCredentialPublicKey();init_cose();init_convertAAGUIDToString();init_parseBackupFlags();init_matchExpectedRPID();init_iso();init_settingsService();init_generateRegistrationOptions();init_verifyAttestationFIDOU2F();init_verifyAttestationPacked();init_verifyAttestationAndroidSafetyNet();init_verifyAttestationTPM();init_verifyAttestationAndroidKey();init_verifyAttestationApple()});async function generateAuthenticationOptions(options){let{allowCredentials,challenge=await generateChallenge2(),timeout=60000,userVerification="preferred",extensions:extensions2,rpID}=options,_challenge=challenge;if(typeof _challenge==="string")_challenge=exports_isoUint8Array.fromUTF8String(_challenge);return{rpId:rpID,challenge:exports_isoBase64URL.fromBuffer(_challenge),allowCredentials:allowCredentials?.map((cred)=>{if(!exports_isoBase64URL.isBase64URL(cred.id))throw Error(`allowCredential id "${cred.id}" is not a valid base64url string`);return{...cred,id:exports_isoBase64URL.trimPadding(cred.id),type:"public-key"}}),timeout,userVerification,extensions:extensions2}}var init_generateAuthenticationOptions=__esm(()=>{init_iso();init_generateChallenge()});async function verifyAuthenticationResponse(options){let{response,expectedChallenge,expectedOrigin,expectedRPID,expectedType,credential,requireUserVerification=!0,advancedFIDOConfig}=options,{id,rawId,type:credentialType,response:assertionResponse}=response;if(!id)throw Error("Missing credential ID");if(id!==rawId)throw Error("Credential ID was not base64url-encoded");if(credentialType!=="public-key")throw Error(`Unexpected credential type ${credentialType}, expected "public-key"`);if(!response)throw Error("Credential missing response");if(typeof assertionResponse?.clientDataJSON!=="string")throw Error("Credential response clientDataJSON was not a string");let clientDataJSON=decodeClientDataJSON(assertionResponse.clientDataJSON),{type,origin,challenge,tokenBinding}=clientDataJSON;if(Array.isArray(expectedType)){if(!expectedType.includes(type)){let joinedExpectedType=expectedType.join(", ");throw Error(`Unexpected authentication response type "${type}", expected one of: ${joinedExpectedType}`)}}else if(expectedType){if(type!==expectedType)throw Error(`Unexpected authentication response type "${type}", expected "${expectedType}"`)}else if(type!=="webauthn.get")throw Error(`Unexpected authentication response type: ${type}`);if(typeof expectedChallenge==="function"){if(!await expectedChallenge(challenge))throw Error(`Custom challenge verifier returned false for registration response challenge "${challenge}"`)}else if(challenge!==expectedChallenge)throw Error(`Unexpected authentication response challenge "${challenge}", expected "${expectedChallenge}"`);if(Array.isArray(expectedOrigin)){if(!expectedOrigin.includes(origin)){let joinedExpectedOrigin=expectedOrigin.join(", ");throw Error(`Unexpected authentication response origin "${origin}", expected one of: ${joinedExpectedOrigin}`)}}else if(origin!==expectedOrigin)throw Error(`Unexpected authentication response origin "${origin}", expected "${expectedOrigin}"`);if(!exports_isoBase64URL.isBase64URL(assertionResponse.authenticatorData))throw Error("Credential response authenticatorData was not a base64url string");if(!exports_isoBase64URL.isBase64URL(assertionResponse.signature))throw Error("Credential response signature was not a base64url string");if(assertionResponse.userHandle&&typeof assertionResponse.userHandle!=="string")throw Error("Credential response userHandle was not a string");if(tokenBinding){if(typeof tokenBinding!=="object")throw Error("ClientDataJSON tokenBinding was not an object");if(["present","supported","notSupported"].indexOf(tokenBinding.status)<0)throw Error(`Unexpected tokenBinding status ${tokenBinding.status}`)}let authDataBuffer=exports_isoBase64URL.toBuffer(assertionResponse.authenticatorData),parsedAuthData=parseAuthenticatorData(authDataBuffer),{rpIdHash,flags,counter,extensionsData}=parsedAuthData,expectedRPIDs=[];if(typeof expectedRPID==="string")expectedRPIDs=[expectedRPID];else expectedRPIDs=expectedRPID;let matchedRPID=await matchExpectedRPID(rpIdHash,expectedRPIDs);if(advancedFIDOConfig!==void 0){let{userVerification:fidoUserVerification}=advancedFIDOConfig;if(fidoUserVerification==="required"){if(!flags.uv)throw Error("User verification required, but user could not be verified")}}else{if(!flags.up)throw Error("User not present during authentication");if(requireUserVerification&&!flags.uv)throw Error("User verification required, but user could not be verified")}let clientDataHash=await toHash(exports_isoBase64URL.toBuffer(assertionResponse.clientDataJSON)),signatureBase=exports_isoUint8Array.concat([authDataBuffer,clientDataHash]),signature=exports_isoBase64URL.toBuffer(assertionResponse.signature);if((counter>0||credential.counter>0)&&counter<=credential.counter)throw Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);let{credentialDeviceType,credentialBackedUp}=parseBackupFlags(flags);return{verified:await verifySignature2({signature,data:signatureBase,credentialPublicKey:credential.publicKey}),authenticationInfo:{newCounter:counter,credentialID:credential.id,userVerified:flags.uv,credentialDeviceType,credentialBackedUp,authenticatorExtensionResults:extensionsData,origin:clientDataJSON.origin,rpID:matchedRPID}}}var init_verifyAuthenticationResponse=__esm(()=>{init_decodeClientDataJSON();init_toHash();init_verifySignature();init_parseAuthenticatorData();init_parseBackupFlags();init_matchExpectedRPID();init_iso()});var init_mdsTypes=()=>{};var init_types11=()=>{};var init_esm2=__esm(()=>{init_generateRegistrationOptions();init_verifyRegistrationResponse();init_generateAuthenticationOptions();init_verifyAuthenticationResponse();init_metadataService();init_settingsService();init_mdsTypes();init_types11()});function base64UrlEncode2(buffer){let binary="";for(let byte of buffer)binary+=String.fromCharCode(byte);return(typeof btoa<"u"?btoa(binary):Buffer.from(binary,"binary").toString("base64")).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function base64UrlDecode2(value){let padded=value.replace(/-/g,"+").replace(/_/g,"/").padEnd(value.length+(4-value.length%4)%4,"="),binary=typeof atob<"u"?atob(padded):Buffer.from(padded,"base64").toString("binary"),buffer=new ArrayBuffer(binary.length),out=new Uint8Array(buffer);for(let i=0;i<binary.length;i+=1)out[i]=binary.charCodeAt(i);return out}function parseTransports(value){if(!value)return null;if(Array.isArray(value))return value;if(typeof value==="string")try{let parsed=JSON.parse(value);return Array.isArray(parsed)?parsed:null}catch{return null}return null}function parseDeviceType(value){if(value==="singleDevice"||value==="multiDevice")return value;return null}var exports_WebAuthn={};__export(exports_WebAuthn,{WebAuthnService:()=>WebAuthnService});class WebAuthnService{config;challengeTtlMs;constructor(config){this.config=config,this.challengeTtlMs=config.challengeTtlMs??DEFAULT_CHALLENGE_TTL_MS}async createRegistrationOptions(params){let existing=await this.config.storage.listCredentialsByUser(params.userId,params.schemaName),options=await generateRegistrationOptions({rpName:this.config.rp.rpName,rpID:this.config.rp.rpID,userID:new TextEncoder().encode(params.userId),userName:params.userName,userDisplayName:params.userDisplayName??params.userName,attestationType:"none",authenticatorSelection:{residentKey:"preferred",userVerification:this.config.userVerification??"preferred"},excludeCredentials:existing.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"registration",userId:params.userId,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyRegistration(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"registration",params.schemaName);if(!stored||stored.userId!==params.userId)return null;if(stored.expiresAt.getTime()<Date.now())return null;let verification;try{verification=await verifyRegistrationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Registration attestation rejected",{userId:params.userId,reason:error instanceof Error?error.message:String(error)}),null}if(!verification.verified||!verification.registrationInfo)return null;let info=verification.registrationInfo,publicKey=base64UrlEncode2(info.credential.publicKey),attachment=params.response.authenticatorAttachment==="platform"||params.response.authenticatorAttachment==="cross-platform"?params.response.authenticatorAttachment:null;return this.config.storage.insertCredential({userId:params.userId,credentialId:info.credential.id,publicKey,counter:info.credential.counter,transports:info.credential.transports??null,deviceType:info.credentialDeviceType,backedUp:info.credentialBackedUp,aaguid:info.aaguid??null,authenticatorAttachment:attachment,nickname:params.nickname??null,lastUsedAt:null,revokedAt:null},params.schemaName)}async createAuthenticationOptions(params){let credentials=params.userId?await this.config.storage.listCredentialsByUser(params.userId,params.schemaName):[],options=await generateAuthenticationOptions({rpID:this.config.rp.rpID,userVerification:this.config.userVerification??"preferred",allowCredentials:credentials.filter((cred)=>!cred.revokedAt).map((cred)=>({id:cred.credentialId,transports:cred.transports??void 0}))});return await this.config.storage.storeChallenge({challenge:options.challenge,challengeType:"authentication",userId:params.userId??null,expiresAt:new Date(Date.now()+this.challengeTtlMs)},params.schemaName),options}async verifyAuthentication(params){let stored=await this.config.storage.consumeChallenge(params.expectedChallenge,"authentication",params.schemaName);if(!stored)return{verified:!1,userId:null,credentialId:null};if(stored.expiresAt.getTime()<Date.now())return{verified:!1,userId:null,credentialId:null};let credential=await this.config.storage.findCredentialById(params.response.id,params.schemaName);if(!credential||credential.revokedAt)return{verified:!1,userId:null,credentialId:null};let verification;try{verification=await verifyAuthenticationResponse({response:params.response,expectedChallenge:params.expectedChallenge,expectedOrigin:this.config.rp.expectedOrigins,expectedRPID:this.config.rp.rpID,credential:{id:credential.credentialId,publicKey:base64UrlDecode2(credential.publicKey),counter:credential.counter,transports:credential.transports??void 0},requireUserVerification:this.config.userVerification==="required"})}catch(error){return this.config.logger?.warn("[WEBAUTHN] Authentication assertion rejected",{userId:credential.userId,credentialId:credential.credentialId,reason:error instanceof Error?error.message:String(error)}),{verified:!1,userId:null,credentialId:null}}if(!verification.verified)return{verified:!1,userId:null,credentialId:null};return await this.config.storage.updateCredentialCounter(credential.credentialId,verification.authenticationInfo.newCounter,params.schemaName),{verified:!0,userId:credential.userId,credentialId:credential.credentialId}}listUserCredentials(userId,schemaName){return this.config.storage.listCredentialsByUser(userId,schemaName)}revokeCredential(credentialId,userId,schemaName){return this.config.storage.revokeCredential(credentialId,userId,schemaName)}renameCredential(credentialId,userId,nickname,schemaName){return this.config.storage.renameCredential(credentialId,userId,nickname,schemaName)}}var DEFAULT_CHALLENGE_TTL_MS=300000;var init_WebAuthn=__esm(()=>{init_esm2()});var init_Services=__esm(()=>{init_ApiKey();init_Auth();init_Authorization();init_Backup();init_Captcha();init_Domain();init_Email();init_Gmail();init_Logger2();init_Monitoring();init_Notification();init_OAuth();init_Payment();init_RateLimiter();init_Secrets();init_Tenant();init_Verification();init_WebAuthn()});function encodeHeaderList(items){return items.map((v)=>encodeURIComponent(v)).join(",")}function decodeHeaderList(header){if(!header)return[];return header.split(",").map((v)=>v.trim()).filter(Boolean).map((v)=>{try{return decodeURIComponent(v)}catch{return v}})}function encodeClaimScopesHeader(claimScopes){if(!claimScopes||Object.keys(claimScopes).length===0)return"";return encodeURIComponent(JSON.stringify(claimScopes))}function decodeClaimScopesHeader(header){if(!header)return;try{let parsed=JSON.parse(decodeURIComponent(header));if(parsed&&typeof parsed==="object"&&!Array.isArray(parsed))return parsed;return}catch{return}}async function withDeadline(promise,timeoutMs,message){promise.catch(()=>{});let timer,deadline=new Promise((_resolve,reject)=>{timer=setTimeout(()=>reject(Error(message)),timeoutMs)});try{return await Promise.race([promise,deadline])}finally{if(timer)clearTimeout(timer)}}function defineRoute(declaration){return{...declaration,toClientEndpoint(){return{method:declaration.method,path:declaration.path,isPublic:declaration.isPublic,isFormData:declaration.isFormData,serviceId:declaration.serviceId,_payload:void 0,_success:void 0,_error:void 0}}}}var INTERNAL_HEADERS;var init_internalHeaders=__esm(()=>{INTERNAL_HEADERS=["x-user-id","x-request-id","x-auth-type","x-api-key-id","x-api-key-owner-type","x-user-roles","x-user-claims","x-user-claim-scopes","x-session-id","x-access-token","x-refresh-token","x-tenant-schema"]});function createResponseSet(){return{headers:{}}}function withEnvelopeFlags(body){let hasSuccess=Object.hasOwn(body,"success")&&typeof body.success==="boolean",hasIsSuccess=Object.hasOwn(body,"isSuccess")&&typeof body.isSuccess==="boolean";if(hasSuccess===hasIsSuccess)return body;let mirrored={};for(let[key2,value]of Object.entries(body))if(mirrored[key2]=value,key2==="success")mirrored.isSuccess=value;else if(key2==="isSuccess")mirrored.success=value;return mirrored}function mirrorFlags(result){if(Array.isArray(result))return result;let proto=Object.getPrototypeOf(result);if(proto!==Object.prototype&&proto!==null)return result;return withEnvelopeFlags(result)}function usableStatus(status){if(typeof status!=="number"||!Number.isInteger(status))return;if(status!==101&&(status<200||status>599))return;return status}function applySetHeaders(target2,set){for(let[key2,value]of Object.entries(set.headers))target2.set(key2,value)}function finalizeResponse(result,set){let setStatus=usableStatus(set.status),setTouched=setStatus!==void 0||Object.keys(set.headers).length>0;if(result instanceof Response){if(!setTouched)return result;let status2=result.status!==200?result.status:setStatus??200,headers2=new Headers;applySetHeaders(headers2,set);for(let cookie of result.headers.getSetCookie())headers2.append("set-cookie",cookie);if(result.headers.forEach((value,key2)=>{if(key2.toLowerCase()==="set-cookie")return;headers2.set(key2,value)}),BODILESS.has(status2))return new Response(null,{status:status2,headers:headers2});return new Response(result.body,{status:status2,headers:headers2})}if(result instanceof Error){let errorStatus=setStatus??500,errorHeaders=new Headers;if(applySetHeaders(errorHeaders,set),!errorHeaders.has("content-type"))errorHeaders.set("content-type","application/json");if(BODILESS.has(errorStatus))return new Response(null,{status:errorStatus,headers:errorHeaders});return new Response(JSON.stringify(withEnvelopeFlags({isSuccess:!1,message:result.message,status:errorStatus,errors:[{message:result.message}],data:null})),{status:errorStatus,headers:errorHeaders})}let status=setStatus??200,headers=new Headers;if(applySetHeaders(headers,set),result===void 0||result===null)return new Response(null,{status,headers});let isScalar=typeof result==="string"||typeof result==="number"||typeof result==="boolean";if(!headers.has("content-type"))headers.set("content-type",isScalar?"text/plain;charset=utf-8":"application/json");if(BODILESS.has(status))return new Response(null,{status,headers});return new Response(isScalar?String(result):JSON.stringify(mirrorFlags(result)),{status,headers})}var BODILESS;var init_response=__esm(()=>{BODILESS=new Set([204,304])});function beginRouteRecording(){if(recordingDepth===0)recording=[],recordedSocket=null,recordedAdapterSteps=[],recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedBootSteps=[],recordedShutdownSteps=[];recordingDepth+=1}function endRouteRecording(){if(recordingDepth===0)throw Error("endRouteRecording() without a matching beginRouteRecording()");if(recordingDepth-=1,recordingDepth>0)return recording??[];let collected=recording??[];return recording=null,collected}function recordRouteGroups(groups){if(recording){recording.push(...groups);return}console.warn(`[nucleus] recordRouteGroups: ${groups.length} route group(s) were recorded while no recording was open, so they were DISCARDED. A host must pass its groups as \`createNucleusServer({ routes: [...] })\`; collecting them outside \`buildNucleus\` records nothing, and if you rely on it alone those routes will answer 404.`)}function recordSocket(route){if(recording)recordedSocket=route}function getRecordedSocket(){return recordedSocket}function recordAdapterStep(step){if(recording)recordedAdapterSteps.push(step)}function recordSwagger(config){if(recording)recordedSwagger=config}function recordRuntime(runtime){recordedRuntime=runtime}function getMountedRuntime(){return recordedRuntime}function recordResolvedOptions(options){recordedResolvedOptions=options}function getResolvedOptions(){return recordedResolvedOptions}function recordStaticAssets(assetsPath){if(recording)recordedStaticAssets=assetsPath}function getRecordedStaticAssets(){return recordedStaticAssets}function recordBootStep(step){if(recording)recordedBootSteps.push(step)}function recordShutdownStep(step){if(recording)recordedShutdownSteps.push(step)}function getRecordedBootSteps(){return recordedBootSteps}function getRecordedShutdownSteps(){return recordedShutdownSteps}var recording=null,recordingDepth=0,recordedSocket=null,recordedAdapterSteps,recordedSwagger=null,recordedStaticAssets=null,recordedRuntime=null,recordedResolvedOptions=null,recordedBootSteps,recordedShutdownSteps;var init_routeRecording=__esm(()=>{recordedAdapterSteps=[],recordedBootSteps=[],recordedShutdownSteps=[]});function isRouteCollector(value){return typeof value==="object"&&value!==null&&COLLECTOR in value}function collectRoutes(groups=[]){let collected=[],collector={[COLLECTOR]:!0,groups:collected,use(other){return collected.push(...other.groups),collector}};if(groups.length>0)collected.push(...groups),recordRouteGroups(groups);return collector}var COLLECTOR;var init_routeCollector=__esm(()=>{init_routeRecording();COLLECTOR=Symbol.for("nucleus.routeCollector")});function defineWebSocketRoute(route){return route}function eraseSocketData(route){return route}function headersOf(request){let out={};request.headers.forEach((value,key2)=>{out[key2]=value});for(let header of INTERNAL_HEADERS)delete out[header];return out}function upgradeFor(route,request,server){let url=new URL(request.url);if(url.pathname!==route.path)return null;let data={query:Object.fromEntries(url.searchParams),headers:headersOf(request)};if(server.upgrade(request,{data}))return new Response(null,{status:101});return new Response("NOT_FOUND",{status:404})}function websocketHandlers(route){return{idleTimeout:route.idleTimeout,open:(ws)=>route.open?.(ws),message:(ws,message)=>route.message?.(ws,message),close:(ws,code,reason)=>route.close?.(ws,code,reason)}}var init_websocket=__esm(()=>{init_internalHeaders()});function joinPath(prefix,path){if(!prefix)return path;let left=prefix.endsWith("/")?prefix.slice(0,-1):prefix;if(path==="/"||path==="")return left||"/";let right=path.startsWith("/")?path:`/${path}`;return`${left}${right}`||"/"}function elysiaSchema(route){let schema={};if(route.body)schema.body=route.body;if(route.query)schema.query=route.query;if(route.params)schema.params=route.params;if(route.detail)schema.detail=route.detail;if(route.type)schema.type=route.type;return schema}function mountWebSocketRoute(app,route){let erased=eraseSocketData(route);recordSocket(erased),app.ws(erased.path,{idleTimeout:erased.idleTimeout,open:erased.open,message:erased.message,close:erased.close})}function useRoutes(app,child){if(isRouteCollector(app)){if(isRouteCollector(child))return app.use(child),app;throw Error("useRoutes: a RouteCollector cannot absorb an Elysia plugin. Record it as an "+"adapter step instead \u2014 only the adapter has an Elysia to mount it on.")}if(isRouteCollector(child))return mountGroups(app,child.groups),app;return app.use(child),app}function mountRoutes(app,groups,options={}){if(isRouteCollector(app))return app.use(collectRoutes(groups)),app;return recordRouteGroups(groups),mountGroups(app,groups,options),app}function mountGroups(app,groups,options={}){for(let group of groups)for(let route of group.routes){let method=METHODS[route.method];if(!method)throw Error(`${route.method} ${route.path}: no Elysia method for it. A WebSocket does not `+"belong in an HTTP group \u2014 declare it with defineWebSocketRoute and mount it with "+"mountWebSocketRoute, as routes/pubsub does.");let path=joinPath(group.prefix,route.path),guards=[...group.guards??[],...route.guards??[]];app[method](path,async(context)=>{let set=createResponseSet(),request=context.request,guardContext={request,set,body:context.body,params:context.params??{},query:context.query??{}};if(options.onRequest){let early=await options.onRequest(guardContext);if(early!==void 0)return finalizeResponse(early,set)}for(let guard of guards){let early=await guard(guardContext);if(early!==void 0)return finalizeResponse(early,set)}let result=await route.handler({request,params:context.params??{},query:context.query??{},body:context.body,set});return finalizeResponse(result,set)},elysiaSchema(route))}return app}var METHODS;var init_routeMount=__esm(()=>{init_response();init_routeCollector();init_routeRecording();init_websocket();METHODS={GET:"get",POST:"post",PUT:"put",PATCH:"patch",DELETE:"delete",HEAD:"head",OPTIONS:"options"}});function toCamel3(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function readColumn(row,column){if(column in row)return row[column];let camel=toCamel3(column);return camel in row?row[camel]:void 0}function isBlank(value){if(value===null||value===void 0)return!0;if(typeof value==="string")return value.trim().length===0;if(Array.isArray(value))return value.length===0;return!1}function coerce(value){if(isBlank(value))return;if(Array.isArray(value))return coerce(value[0]);if(typeof value==="string")return value.trim();if(typeof value==="number"||typeof value==="boolean")return String(value);return}function readClaim(profile,claim){if(claim in profile)return profile[claim];if(!claim.includes("."))return;let cursor=profile;for(let segment of claim.split(".")){if(cursor===null||typeof cursor!=="object")return;cursor=cursor[segment]}return cursor}function splitTarget(target2){let i=target2.indexOf(".");if(i===-1)return{table:"",column:""};return{table:target2.slice(0,i),column:target2.slice(i+1)}}function resolveProfileSyncUpdates(input){let users={},profiles={},errors2=[];for(let mapping of input.mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let target2=table==="users"?users:profiles;if(column in target2)continue;let incoming=coerce(readClaim(input.rawProfile,mapping.claim));if(incoming===void 0)continue;let currentRow=table==="users"?input.currentUser:input.currentProfile,current=readColumn(currentRow,column);if(mapping.overwrite===!1&&!isBlank(current))continue;if(current===incoming)continue;target2[column]=incoming}return{users,profiles,errors:errors2}}function validateProfileSyncTargets(mappings,columnsByTable){let errors2=[];for(let mapping of mappings){let{table,column}=splitTarget(mapping.target);if(!table||!column||table!=="users"&&table!=="profiles"){errors2.push(`profileSync mapping target "${mapping.target}" must be "users.<column>" or "profiles.<column>"`);continue}let columns=columnsByTable[table]??[],known=new Set(columns.flatMap((c)=>[c,toCamel3(c)]));if(!known.has(column)&&!known.has(toCamel3(column)))errors2.push(`profileSync maps "${mapping.claim}" to "${mapping.target}", but "${table}" has no column "${column}". Add it via a config entity with "extends": true.`)}return errors2}function isCommonPassword(pwd){let bare=foldAccents(pwd.trim());if(COMMON_PASSWORDS.has(bare))return!0;let stripped=normalizeForListCheck(pwd);return stripped.length>0&&COMMON_PASSWORDS.has(stripped)}function containsUserInfo(pwd,identity){if(!identity)return!1;let lowered=foldAccents(pwd.trim());if(!lowered)return!1;let id=foldAccents(identity.trim());if(!id)return!1;let parts=new Set([id]),at=id.indexOf("@");if(at>0){parts.add(id.slice(0,at));let domain=id.slice(at+1).split(".")[0];if(domain)parts.add(domain)}if(lowered.includes(id))return!0;for(let part of parts){if(part===id)continue;if(part.length>=4&&lowered.includes(part))return!0}return!1}function validateAgainstPolicy(pwd,policy,identity){let errors2=[],minLen=policy?.minLength??8,maxLen=policy?.maxLength??128;if(pwd.length<minLen)errors2.push(`Password must be at least ${minLen} characters`);if(pwd.length>maxLen)errors2.push(`Password must be at most ${maxLen} characters`);if((policy?.requireUppercase??!0)&&!/[A-Z]/.test(pwd))errors2.push("Password must contain uppercase letter");if((policy?.requireLowercase??!0)&&!/[a-z]/.test(pwd))errors2.push("Password must contain lowercase letter");if((policy?.requireNumber??!0)&&!/[0-9]/.test(pwd))errors2.push("Password must contain a number");if(policy?.requireSpecialChar??!1){let allowed=policy?.specialChars?.trim();if(!(allowed?[...pwd].some((ch)=>allowed.includes(ch)):/[!@#$%^&*()_+\-=[\]{};':"\\|,.<>/?]/.test(pwd)))errors2.push(allowed?`Password must contain one of these characters: ${allowed}`:"Password must contain a special character")}if(policy?.preventCommonPasswords&&isCommonPassword(pwd))errors2.push("Password is too common");if(policy?.preventUserInfoInPassword&&containsUserInfo(pwd,identity))errors2.push("Password must not contain your email or username");return{valid:errors2.length===0,errors:errors2}}function identityRuleError(pwd,policy,identity){if(!policy?.preventUserInfoInPassword)return null;return containsUserInfo(pwd,identity)?"Password must not contain your email or username":null}var COMMON_PASSWORDS,foldAccents=(value)=>value.replace(/[\u0130I\u0131]/g,"i").replace(/[\u015E\u015F]/g,"s").replace(/[\u011E\u011F]/g,"g").replace(/[\u00C7\u00E7]/g,"c").replace(/[\u00D6\u00F6]/g,"o").replace(/[\u00DC\u00FC]/g,"u").toLowerCase(),normalizeForListCheck=(pwd)=>foldAccents(pwd.trim()).replace(/[0-9]+$/,"").replace(/[!@#$%^&*._-]+$/,"");var init_passwordPolicy=__esm(()=>{COMMON_PASSWORDS=new Set(["password","passwort","parola","sifre","qwerty","qwertyui","azerty","asdfgh","zxcvbn","qazwsx","qweasd","letmein","welcome","admin","administrator","root","toor","guest","test","demo","login","pass","secret","master","dragon","monkey","sunshine","princess","football","baseball","superman","batman","trustno","iloveyou","starwars","whatever","freedom","shadow","michael","jennifer","jordan","harley","ranger","hunter","buster","thomas","robert","soccer","hockey","killer","george","charlie","andrew","tigger","joshua","pepper","daniel","ginger","summer","ashley","bailey","banana","chelsea","diamond","yellow","orange","purple","silver","cookie","maggie","nicole","hannah","jessica","matthew","access","flower","hello","hellothere","changeme","default","temporary","temppass","newpass","passpass","system","manager","service","oracle","postgres","mysql","redis","server","database","internet","computer","samsung","google","facebook","twitter","linkedin","company","business","office","work","school","student","teacher","abcdef","abcabc","aaaaaa","zzzzzz","asdfasdf","qwerqwer","iloveu","princess1","letmein1","trustno1","passw0rd","p@ssword","p@ssw0rd","qwerty1","admin1","welcome1","password1","abc","abcd","abcde","ankara","istanbul","izmir","galatasaray","fenerbahce","besiktas","trabzonspor","turkiye","merhaba","deneme","sifrem","gizli","kullanici","yonetici"])});function hasGodminRole(request){return decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r))}async function userHasGodminRoleInDb(db,schemaTables,userId,logger2){if(!userId||!db)return!1;let userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!userRolesTable||!rolesTable)return!1;try{let{eq:eq20}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq20(ur.roleId,r.id)).where(eq20(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[AdminGuard] Failed to check godmin role from DB",{error:err instanceof Error?err.message:String(err)}),!1}}async function isGodminRequest(request,deps){if(decodeHeaderList(request.headers.get("x-user-roles")).some((r)=>isGodminRole(r)))return!0;let userId=request.headers.get("x-user-id"),{db,schemaTables,logger:logger2}=deps;if(userId&&db&&schemaTables.users)try{let{eq:eq20}=await import("drizzle-orm"),usersTable=schemaTables.users;if((await db.select().from(usersTable).where(eq20(usersTable.id,userId)).limit(1))[0]?.isGod===!0)return!0}catch(err){logger2.warn("[AdminGuard] Failed to check isGod from DB",{error:err instanceof Error?err.message:String(err)})}return!1}function createGodminGuard(deps,label="this operation"){return createPrivilegedGuard(deps,label)}function createPrivilegedGuard(deps,label="this operation",options={}){let allowed=new Set((options.allowRoles??[]).map((role)=>role.trim().toLowerCase()));return async({request,set})=>{if(!request.headers.get("x-user-id"))return set.status=401,Response.json({isSuccess:!1,success:!1,message:"Authentication required",data:null});if(allowed.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowed.has(role.trim().toLowerCase())))return}if(!await isGodminRequest(request,deps)){set.status=403;let needs=allowed.size>0?`godmin privileges or one of: ${[...allowed].join(", ")}`:"godmin privileges";return Response.json({isSuccess:!1,success:!1,message:`Forbidden: ${label} requires ${needs}`,data:null})}return}}var init_adminGuard=__esm(()=>{init_Authorization();init_types3()});var resolveAuthTablesForRequest=(request,authConfig)=>{let defaults={usersTable:authConfig.usersTable,sessionsTable:authConfig.sessionsTable??null,userRolesTable:authConfig.userRolesTable??void 0,rolesTable:authConfig.rolesTable??void 0,roleClaimsTable:authConfig.roleClaimsTable??void 0,claimsTable:authConfig.claimsTable??void 0,oauthAccountsTable:authConfig.oauthAccountsTable??void 0,apiKeysTable:authConfig.apiKeysTable??void 0,schemaTables:authConfig.schemaTables||{}},registry=authConfig.getTenantRegistry?authConfig.getTenantRegistry():authConfig.tenantRegistry;if(!registry)return defaults;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaults;let ctx=registry.getSchemaContext(schemaName);if(!ctx)return defaults;let tables=ctx.schemaTables;return{usersTable:tables.users??defaults.usersTable,sessionsTable:tables.userSessions??tables.user_sessions??tables.sessions??defaults.sessionsTable,userRolesTable:tables.userRoles??defaults.userRolesTable,rolesTable:tables.roles??defaults.rolesTable,roleClaimsTable:tables.roleClaims??defaults.roleClaimsTable,claimsTable:tables.claims??defaults.claimsTable,oauthAccountsTable:tables.oauthAccounts??defaults.oauthAccountsTable,apiKeysTable:tables.apiKeys??defaults.apiKeysTable,schemaTables:tables}};import{eq as eq20}from"drizzle-orm";function accountStateRefusal(caller){if(caller.isActive===!1)return"Account is not active";let lockedUntil=caller.lockedUntil?new Date(caller.lockedUntil):null;return(lockedUntil!==null&&lockedUntil<=new Date?!1:lockedUntil!==null||caller.isLocked===!0)?"Account is locked":null}function createRequireGodmin(config){let{db}=config;return async function(request){let{usersTable}=resolveAuthTablesForRequest(request,config);if(!db||!usersTable)return{ok:!1,status:500,message:"Database not configured"};let callerId=request.headers.get("x-user-id");if(!callerId)return{ok:!1,status:401,message:"Unauthorized"};let caller=(await db.select().from(usersTable).where(eq20(usersTable.id,callerId)).limit(1))[0],isGodByColumn=Boolean(caller?.isGod),isGodByRole=hasGodminRole(request)||await userHasGodminRoleInDb(db,config.schemaTables??{},callerId,config.logger);if(!caller||!isGodByColumn&&!isGodByRole)return{ok:!1,status:403,message:"Forbidden: godmin privileges required"};let refusal=accountStateRefusal(caller);if(refusal)return{ok:!1,status:403,message:refusal};return{ok:!0,callerId,caller}}}var init_requireGodmin=__esm(()=>{init_adminGuard()});import{and as and15,eq as eq23}from"drizzle-orm";function resolveDefaultRoleNames(authentication){let names2=new Set,single=authentication?.defaultRole?.trim();if(single)names2.add(single);for(let name2 of authentication?.defaultRoles??[]){let trimmed=String(name2??"").trim();if(trimmed)names2.add(trimmed)}return[...names2]}async function assignDefaultRoles(params){let{roleNames,...rest}=params;for(let roleName of roleNames)await assignDefaultRole({...rest,roleName})}async function assignDefaultRole(params){let{db,userId,roleName,rolesTable,userRolesTable,logger:logger2}=params;if(!rolesTable||!userRolesTable){logger2.warn("[AUTH] assignDefaultRole called without rolesTable or userRolesTable \u2014 skipping",{userId,roleName});return}try{let rolesCols=rolesTable,userRolesCols=userRolesTable,role=(await db.select().from(rolesTable).where(eq23(rolesCols.name,roleName)).limit(1))[0];if(!role){logger2.warn(`[AUTH] Default role "${roleName}" not found in roles table \u2014 skipping assignment`,{userId});return}let roleId=role.id;if((await db.select().from(userRolesTable).where(and15(eq23(userRolesCols.userId,userId),eq23(userRolesCols.roleId,roleId))).limit(1)).length>0){logger2.debug("[AUTH] User already has default role \u2014 skipping",{userId,roleName});return}await db.insert(userRolesTable).values({userId,roleId}),logger2.info("[AUTH] Default role assigned to new user",{userId,roleName})}catch(err){logger2.warn("[AUTH] Failed to assign default role \u2014 continuing",{userId,roleName,error:err instanceof Error?err.message:String(err)})}}var init_assignDefaultRole=()=>{};import crypto6 from"crypto";var{password:password2}=globalThis.Bun;async function hashPassword(plainPassword){return await password2.hash(plainPassword,{algorithm:"bcrypt",cost:10})}function generateVerificationToken(){return crypto6.randomBytes(32).toString("hex")}function hashVerificationToken(token){return crypto6.createHash("sha256").update(token).digest("hex")}function parseTimeToMs(time2){let match=time2.match(/^(\d+)(s|m|h|d)$/);if(!match?.[1]||!match[2])return 86400000;let value=Number.parseInt(match[1],10);switch(match[2]){case"s":return value*1000;case"m":return value*60*1000;case"h":return value*60*60*1000;case"d":return value*24*60*60*1000;default:return 86400000}}function validatePasswordStrength(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var init_utils6=__esm(()=>{init_passwordPolicy()});function pickByName(bag,name2){if(!name2)return;let camel=name2.replace(/_([a-z0-9])/g,(_,c)=>c.toUpperCase()),snake=name2.replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase();for(let key2 of[name2,camel,snake]){let found=bag[key2];if(found!==void 0)return found}return}import{inArray as inArray8}from"drizzle-orm";function accountLinkFor(links,table){if(!links?.length||!table)return null;let byTable={};for(let link of links)if(link?.table)byTable[link.table]=link;return pickByName(byTable,table)??null}function accountIdsIn(rows,userColumn){if(!userColumn)return[];let ids=new Set;for(let row of rows){let value=pickByName(row,userColumn),id=String(value??"").trim();if(id)ids.add(id)}return[...ids]}async function closeAccounts(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))];if(ids.length===0||!deps.usersTable)return{closed:0,signedOut:!0,closedIds:[]};let idColumn=pickByName(deps.usersTable,"id"),activeColumn=pickByName(deps.usersTable,"is_active");if(!idColumn||!activeColumn)return{closed:0,signedOut:!1,closedIds:[]};try{await deps.db.update(deps.usersTable).set({isActive:!1}).where(inArray8(idColumn,ids))}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:0,signedOut:!1,closedIds:[]}}let sessionUser=deps.sessionsTable?pickByName(deps.sessionsTable,"user_id"):void 0;if(!deps.sessionsTable||!sessionUser)return{closed:ids.length,signedOut:!1,closedIds:ids};try{return await deps.db.delete(deps.sessionsTable).where(inArray8(sessionUser,ids)),{closed:ids.length,signedOut:!0,closedIds:ids}}catch(error){if(deps.onError?.(error),deps.atomic)throw error;return{closed:ids.length,signedOut:!1,closedIds:ids}}}var init_AccountLink=()=>{};import{inArray as inArray9}from"drizzle-orm";async function revokeUserSessions(deps,userIds){let ids=[...new Set(userIds.map((id)=>String(id??"").trim()).filter(Boolean))],sessions=deps.sessionsTable;if(!deps.db||!sessions||ids.length===0)return 0;let sessionUser=pickByName(sessions,"user_id");if(!sessionUser)return 0;try{return(await deps.db.delete(sessions).where(inArray9(sessionUser,ids)))?.rowCount??ids.length}catch(error){return deps.onError?.(error),0}}var init_revokeUserSessions=__esm(()=>{init_AccountLink()});var exports_value={};__export(exports_value,{IsUndefined:()=>IsUndefined,IsUint8Array:()=>IsUint8Array,IsSymbol:()=>IsSymbol,IsString:()=>IsString,IsRegExp:()=>IsRegExp,IsObject:()=>IsObject,IsNumber:()=>IsNumber,IsNull:()=>IsNull,IsIterator:()=>IsIterator,IsFunction:()=>IsFunction,IsDate:()=>IsDate,IsBoolean:()=>IsBoolean,IsBigInt:()=>IsBigInt,IsAsyncIterator:()=>IsAsyncIterator,IsArray:()=>IsArray,HasPropertyKey:()=>HasPropertyKey});function HasPropertyKey(value,key2){return key2 in value}function IsAsyncIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.asyncIterator in value}function IsArray(value){return Array.isArray(value)}function IsBigInt(value){return typeof value==="bigint"}function IsBoolean(value){return typeof value==="boolean"}function IsDate(value){return value instanceof globalThis.Date}function IsFunction(value){return typeof value==="function"}function IsIterator(value){return IsObject(value)&&!IsArray(value)&&!IsUint8Array(value)&&Symbol.iterator in value}function IsNull(value){return value===null}function IsNumber(value){return typeof value==="number"}function IsObject(value){return typeof value==="object"&&value!==null}function IsRegExp(value){return value instanceof globalThis.RegExp}function IsString(value){return typeof value==="string"}function IsSymbol(value){return typeof value==="symbol"}function IsUint8Array(value){return value instanceof globalThis.Uint8Array}function IsUndefined(value){return value===void 0}function ArrayType(value){return value.map((value2)=>Visit(value2))}function DateType(value){return new Date(value.getTime())}function Uint8ArrayType(value){return new Uint8Array(value)}function RegExpType(value){return new RegExp(value.source,value.flags)}function ObjectType(value){let result={};for(let key2 of Object.getOwnPropertyNames(value))result[key2]=Visit(value[key2]);for(let key2 of Object.getOwnPropertySymbols(value))result[key2]=Visit(value[key2]);return result}function Visit(value){return IsArray(value)?ArrayType(value):IsDate(value)?DateType(value):IsUint8Array(value)?Uint8ArrayType(value):IsRegExp(value)?RegExpType(value):IsObject(value)?ObjectType(value):value}function Clone(value){return Visit(value)}var init_value=()=>{};function CloneType(schema,options){return options===void 0?Clone(schema):Clone({...options,...schema})}var init_type=__esm(()=>{init_value()});var init_clone=__esm(()=>{init_type();init_value()});function IsAsyncIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.asyncIterator in value2}function IsIterator2(value2){return IsObject2(value2)&&globalThis.Symbol.iterator in value2}function IsStandardObject(value2){return IsObject2(value2)&&(globalThis.Object.getPrototypeOf(value2)===Object.prototype||globalThis.Object.getPrototypeOf(value2)===null)}function IsPromise(value2){return value2 instanceof globalThis.Promise}function IsDate2(value2){return value2 instanceof Date&&globalThis.Number.isFinite(value2.getTime())}function IsMap(value2){return value2 instanceof globalThis.Map}function IsSet(value2){return value2 instanceof globalThis.Set}function IsTypedArray(value2){return globalThis.ArrayBuffer.isView(value2)}function IsUint8Array2(value2){return value2 instanceof globalThis.Uint8Array}function HasPropertyKey2(value2,key2){return key2 in value2}function IsObject2(value2){return value2!==null&&typeof value2==="object"}function IsArray2(value2){return globalThis.Array.isArray(value2)&&!globalThis.ArrayBuffer.isView(value2)}function IsUndefined2(value2){return value2===void 0}function IsNull2(value2){return value2===null}function IsBoolean2(value2){return typeof value2==="boolean"}function IsNumber2(value2){return typeof value2==="number"}function IsInteger(value2){return globalThis.Number.isInteger(value2)}function IsBigInt2(value2){return typeof value2==="bigint"}function IsString2(value2){return typeof value2==="string"}function IsFunction2(value2){return typeof value2==="function"}function IsSymbol2(value2){return typeof value2==="symbol"}function IsValueType(value2){return IsBigInt2(value2)||IsBoolean2(value2)||IsNull2(value2)||IsNumber2(value2)||IsString2(value2)||IsSymbol2(value2)||IsUndefined2(value2)}var init_guard=()=>{};var TypeSystemPolicy;var init_policy=__esm(()=>{init_guard();(function(TypeSystemPolicy2){TypeSystemPolicy2.InstanceMode="default",TypeSystemPolicy2.ExactOptionalPropertyTypes=!1,TypeSystemPolicy2.AllowArrayObject=!1,TypeSystemPolicy2.AllowNaN=!1,TypeSystemPolicy2.AllowNullVoid=!1;function IsExactOptionalProperty(value2,key2){return TypeSystemPolicy2.ExactOptionalPropertyTypes?key2 in value2:value2[key2]!==void 0}TypeSystemPolicy2.IsExactOptionalProperty=IsExactOptionalProperty;function IsObjectLike(value2){let isObject=IsObject2(value2);return TypeSystemPolicy2.AllowArrayObject?isObject:isObject&&!IsArray2(value2)}TypeSystemPolicy2.IsObjectLike=IsObjectLike;function IsRecordLike(value2){return IsObjectLike(value2)&&!(value2 instanceof Date)&&!(value2 instanceof Uint8Array)}TypeSystemPolicy2.IsRecordLike=IsRecordLike;function IsNumberLike(value2){return TypeSystemPolicy2.AllowNaN?IsNumber2(value2):Number.isFinite(value2)}TypeSystemPolicy2.IsNumberLike=IsNumberLike;function IsVoidLike(value2){let isUndefined=IsUndefined2(value2);return TypeSystemPolicy2.AllowNullVoid?isUndefined||value2===null:isUndefined}TypeSystemPolicy2.IsVoidLike=IsVoidLike})(TypeSystemPolicy||(TypeSystemPolicy={}))});function ImmutableArray(value2){return globalThis.Object.freeze(value2).map((value3)=>Immutable(value3))}function ImmutableDate(value2){return value2}function ImmutableUint8Array(value2){return value2}function ImmutableRegExp(value2){return value2}function ImmutableObject(value2){let result={};for(let key2 of Object.getOwnPropertyNames(value2))result[key2]=Immutable(value2[key2]);for(let key2 of Object.getOwnPropertySymbols(value2))result[key2]=Immutable(value2[key2]);return globalThis.Object.freeze(result)}function Immutable(value2){return IsArray(value2)?ImmutableArray(value2):IsDate(value2)?ImmutableDate(value2):IsUint8Array(value2)?ImmutableUint8Array(value2):IsRegExp(value2)?ImmutableRegExp(value2):IsObject(value2)?ImmutableObject(value2):value2}var init_immutable=()=>{};function CreateType(schema,options){let result=options!==void 0?{...options,...schema}:schema;switch(TypeSystemPolicy.InstanceMode){case"freeze":return Immutable(result);case"clone":return Clone(result);default:return result}}var init_type2=__esm(()=>{init_policy();init_immutable();init_value()});var init_create=__esm(()=>{init_type2()});var TypeBoxError;var init_error=__esm(()=>{TypeBoxError=class TypeBoxError extends Error{constructor(message){super(message)}}});var init_error2=__esm(()=>{init_error()});var TransformKind,ReadonlyKind,OptionalKind,Hint,Kind;var init_symbols=__esm(()=>{TransformKind=Symbol.for("TypeBox.Transform"),ReadonlyKind=Symbol.for("TypeBox.Readonly"),OptionalKind=Symbol.for("TypeBox.Optional"),Hint=Symbol.for("TypeBox.Hint"),Kind=Symbol.for("TypeBox.Kind")});var init_symbols2=__esm(()=>{init_symbols()});function IsReadonly(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny(value2){return IsKindOf(value2,"Any")}function IsArgument(value2){return IsKindOf(value2,"Argument")}function IsArray3(value2){return IsKindOf(value2,"Array")}function IsAsyncIterator3(value2){return IsKindOf(value2,"AsyncIterator")}function IsBigInt3(value2){return IsKindOf(value2,"BigInt")}function IsBoolean3(value2){return IsKindOf(value2,"Boolean")}function IsComputed(value2){return IsKindOf(value2,"Computed")}function IsConstructor(value2){return IsKindOf(value2,"Constructor")}function IsDate3(value2){return IsKindOf(value2,"Date")}function IsFunction3(value2){return IsKindOf(value2,"Function")}function IsInteger2(value2){return IsKindOf(value2,"Integer")}function IsIntersect(value2){return IsKindOf(value2,"Intersect")}function IsIterator3(value2){return IsKindOf(value2,"Iterator")}function IsKindOf(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralValue(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsLiteral(value2){return IsKindOf(value2,"Literal")}function IsMappedKey(value2){return IsKindOf(value2,"MappedKey")}function IsMappedResult(value2){return IsKindOf(value2,"MappedResult")}function IsNever(value2){return IsKindOf(value2,"Never")}function IsNot(value2){return IsKindOf(value2,"Not")}function IsNull3(value2){return IsKindOf(value2,"Null")}function IsNumber3(value2){return IsKindOf(value2,"Number")}function IsObject3(value2){return IsKindOf(value2,"Object")}function IsPromise2(value2){return IsKindOf(value2,"Promise")}function IsRecord(value2){return IsKindOf(value2,"Record")}function IsRef(value2){return IsKindOf(value2,"Ref")}function IsRegExp2(value2){return IsKindOf(value2,"RegExp")}function IsString3(value2){return IsKindOf(value2,"String")}function IsSymbol3(value2){return IsKindOf(value2,"Symbol")}function IsTemplateLiteral(value2){return IsKindOf(value2,"TemplateLiteral")}function IsThis(value2){return IsKindOf(value2,"This")}function IsTransform(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple(value2){return IsKindOf(value2,"Tuple")}function IsUndefined3(value2){return IsKindOf(value2,"Undefined")}function IsUnion(value2){return IsKindOf(value2,"Union")}function IsUint8Array3(value2){return IsKindOf(value2,"Uint8Array")}function IsUnknown(value2){return IsKindOf(value2,"Unknown")}function IsUnsafe(value2){return IsKindOf(value2,"Unsafe")}function IsVoid(value2){return IsKindOf(value2,"Void")}function IsKind(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])}function IsSchema(value2){return IsAny(value2)||IsArgument(value2)||IsArray3(value2)||IsBoolean3(value2)||IsBigInt3(value2)||IsAsyncIterator3(value2)||IsComputed(value2)||IsConstructor(value2)||IsDate3(value2)||IsFunction3(value2)||IsInteger2(value2)||IsIntersect(value2)||IsIterator3(value2)||IsLiteral(value2)||IsMappedKey(value2)||IsMappedResult(value2)||IsNever(value2)||IsNot(value2)||IsNull3(value2)||IsNumber3(value2)||IsObject3(value2)||IsPromise2(value2)||IsRecord(value2)||IsRef(value2)||IsRegExp2(value2)||IsString3(value2)||IsSymbol3(value2)||IsTemplateLiteral(value2)||IsThis(value2)||IsTuple(value2)||IsUndefined3(value2)||IsUnion(value2)||IsUint8Array3(value2)||IsUnknown(value2)||IsUnsafe(value2)||IsVoid(value2)||IsKind(value2)}var init_kind=__esm(()=>{init_symbols2()});var exports_type={};__export(exports_type,{TypeGuardUnknownTypeError:()=>TypeGuardUnknownTypeError,IsVoid:()=>IsVoid2,IsUnsafe:()=>IsUnsafe2,IsUnknown:()=>IsUnknown2,IsUnionLiteral:()=>IsUnionLiteral,IsUnion:()=>IsUnion2,IsUndefined:()=>IsUndefined4,IsUint8Array:()=>IsUint8Array4,IsTuple:()=>IsTuple2,IsTransform:()=>IsTransform2,IsThis:()=>IsThis2,IsTemplateLiteral:()=>IsTemplateLiteral2,IsSymbol:()=>IsSymbol4,IsString:()=>IsString4,IsSchema:()=>IsSchema2,IsRegExp:()=>IsRegExp3,IsRef:()=>IsRef2,IsRecursive:()=>IsRecursive,IsRecord:()=>IsRecord2,IsReadonly:()=>IsReadonly2,IsProperties:()=>IsProperties,IsPromise:()=>IsPromise3,IsOptional:()=>IsOptional2,IsObject:()=>IsObject4,IsNumber:()=>IsNumber4,IsNull:()=>IsNull4,IsNot:()=>IsNot2,IsNever:()=>IsNever2,IsMappedResult:()=>IsMappedResult2,IsMappedKey:()=>IsMappedKey2,IsLiteralValue:()=>IsLiteralValue2,IsLiteralString:()=>IsLiteralString,IsLiteralNumber:()=>IsLiteralNumber,IsLiteralBoolean:()=>IsLiteralBoolean,IsLiteral:()=>IsLiteral2,IsKindOf:()=>IsKindOf2,IsKind:()=>IsKind2,IsIterator:()=>IsIterator4,IsIntersect:()=>IsIntersect2,IsInteger:()=>IsInteger3,IsImport:()=>IsImport,IsFunction:()=>IsFunction4,IsDate:()=>IsDate4,IsConstructor:()=>IsConstructor2,IsComputed:()=>IsComputed2,IsBoolean:()=>IsBoolean4,IsBigInt:()=>IsBigInt4,IsAsyncIterator:()=>IsAsyncIterator4,IsArray:()=>IsArray4,IsArgument:()=>IsArgument2,IsAny:()=>IsAny2});function IsPattern(value2){try{return new RegExp(value2),!0}catch{return!1}}function IsControlCharacterFree(value2){if(!IsString(value2))return!1;for(let i=0;i<value2.length;i++){let code=value2.charCodeAt(i);if(code>=7&&code<=13||code===27||code===127)return!1}return!0}function IsAdditionalProperties(value2){return IsOptionalBoolean(value2)||IsSchema2(value2)}function IsOptionalBigInt(value2){return IsUndefined(value2)||IsBigInt(value2)}function IsOptionalNumber(value2){return IsUndefined(value2)||IsNumber(value2)}function IsOptionalBoolean(value2){return IsUndefined(value2)||IsBoolean(value2)}function IsOptionalString(value2){return IsUndefined(value2)||IsString(value2)}function IsOptionalPattern(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)&&IsPattern(value2)}function IsOptionalFormat(value2){return IsUndefined(value2)||IsString(value2)&&IsControlCharacterFree(value2)}function IsOptionalSchema(value2){return IsUndefined(value2)||IsSchema2(value2)}function IsReadonly2(value2){return IsObject(value2)&&value2[ReadonlyKind]==="Readonly"}function IsOptional2(value2){return IsObject(value2)&&value2[OptionalKind]==="Optional"}function IsAny2(value2){return IsKindOf2(value2,"Any")&&IsOptionalString(value2.$id)}function IsArgument2(value2){return IsKindOf2(value2,"Argument")&&IsNumber(value2.index)}function IsArray4(value2){return IsKindOf2(value2,"Array")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)&&IsOptionalNumber(value2.minItems)&&IsOptionalNumber(value2.maxItems)&&IsOptionalBoolean(value2.uniqueItems)&&IsOptionalSchema(value2.contains)&&IsOptionalNumber(value2.minContains)&&IsOptionalNumber(value2.maxContains)}function IsAsyncIterator4(value2){return IsKindOf2(value2,"AsyncIterator")&&value2.type==="AsyncIterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsBigInt4(value2){return IsKindOf2(value2,"BigInt")&&value2.type==="bigint"&&IsOptionalString(value2.$id)&&IsOptionalBigInt(value2.exclusiveMaximum)&&IsOptionalBigInt(value2.exclusiveMinimum)&&IsOptionalBigInt(value2.maximum)&&IsOptionalBigInt(value2.minimum)&&IsOptionalBigInt(value2.multipleOf)}function IsBoolean4(value2){return IsKindOf2(value2,"Boolean")&&value2.type==="boolean"&&IsOptionalString(value2.$id)}function IsComputed2(value2){return IsKindOf2(value2,"Computed")&&IsString(value2.target)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))}function IsConstructor2(value2){return IsKindOf2(value2,"Constructor")&&value2.type==="Constructor"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsDate4(value2){return IsKindOf2(value2,"Date")&&value2.type==="Date"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximumTimestamp)&&IsOptionalNumber(value2.exclusiveMinimumTimestamp)&&IsOptionalNumber(value2.maximumTimestamp)&&IsOptionalNumber(value2.minimumTimestamp)&&IsOptionalNumber(value2.multipleOfTimestamp)}function IsFunction4(value2){return IsKindOf2(value2,"Function")&&value2.type==="Function"&&IsOptionalString(value2.$id)&&IsArray(value2.parameters)&&value2.parameters.every((schema)=>IsSchema2(schema))&&IsSchema2(value2.returns)}function IsImport(value2){return IsKindOf2(value2,"Import")&&HasPropertyKey(value2,"$defs")&&IsObject(value2.$defs)&&IsProperties(value2.$defs)&&HasPropertyKey(value2,"$ref")&&IsString(value2.$ref)&&value2.$ref in value2.$defs}function IsInteger3(value2){return IsKindOf2(value2,"Integer")&&value2.type==="integer"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsProperties(value2){return IsObject(value2)&&Object.entries(value2).every(([key2,schema])=>IsControlCharacterFree(key2)&&IsSchema2(schema))}function IsIntersect2(value2){return IsKindOf2(value2,"Intersect")&&(IsString(value2.type)&&value2.type!=="object"?!1:!0)&&IsArray(value2.allOf)&&value2.allOf.every((schema)=>IsSchema2(schema)&&!IsTransform2(schema))&&IsOptionalString(value2.type)&&(IsOptionalBoolean(value2.unevaluatedProperties)||IsOptionalSchema(value2.unevaluatedProperties))&&IsOptionalString(value2.$id)}function IsIterator4(value2){return IsKindOf2(value2,"Iterator")&&value2.type==="Iterator"&&IsOptionalString(value2.$id)&&IsSchema2(value2.items)}function IsKindOf2(value2,kind){return IsObject(value2)&&Kind in value2&&value2[Kind]===kind}function IsLiteralString(value2){return IsLiteral2(value2)&&IsString(value2.const)}function IsLiteralNumber(value2){return IsLiteral2(value2)&&IsNumber(value2.const)}function IsLiteralBoolean(value2){return IsLiteral2(value2)&&IsBoolean(value2.const)}function IsLiteral2(value2){return IsKindOf2(value2,"Literal")&&IsOptionalString(value2.$id)&&IsLiteralValue2(value2.const)}function IsLiteralValue2(value2){return IsBoolean(value2)||IsNumber(value2)||IsString(value2)}function IsMappedKey2(value2){return IsKindOf2(value2,"MappedKey")&&IsArray(value2.keys)&&value2.keys.every((key2)=>IsNumber(key2)||IsString(key2))}function IsMappedResult2(value2){return IsKindOf2(value2,"MappedResult")&&IsProperties(value2.properties)}function IsNever2(value2){return IsKindOf2(value2,"Never")&&IsObject(value2.not)&&Object.getOwnPropertyNames(value2.not).length===0}function IsNot2(value2){return IsKindOf2(value2,"Not")&&IsSchema2(value2.not)}function IsNull4(value2){return IsKindOf2(value2,"Null")&&value2.type==="null"&&IsOptionalString(value2.$id)}function IsNumber4(value2){return IsKindOf2(value2,"Number")&&value2.type==="number"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.exclusiveMaximum)&&IsOptionalNumber(value2.exclusiveMinimum)&&IsOptionalNumber(value2.maximum)&&IsOptionalNumber(value2.minimum)&&IsOptionalNumber(value2.multipleOf)}function IsObject4(value2){return IsKindOf2(value2,"Object")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsProperties(value2.properties)&&IsAdditionalProperties(value2.additionalProperties)&&IsOptionalNumber(value2.minProperties)&&IsOptionalNumber(value2.maxProperties)}function IsPromise3(value2){return IsKindOf2(value2,"Promise")&&value2.type==="Promise"&&IsOptionalString(value2.$id)&&IsSchema2(value2.item)}function IsRecord2(value2){return IsKindOf2(value2,"Record")&&value2.type==="object"&&IsOptionalString(value2.$id)&&IsAdditionalProperties(value2.additionalProperties)&&IsObject(value2.patternProperties)&&((schema)=>{let keys=Object.getOwnPropertyNames(schema.patternProperties);return keys.length===1&&IsPattern(keys[0])&&IsObject(schema.patternProperties)&&IsSchema2(schema.patternProperties[keys[0]])})(value2)}function IsRecursive(value2){return IsObject(value2)&&Hint in value2&&value2[Hint]==="Recursive"}function IsRef2(value2){return IsKindOf2(value2,"Ref")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsRegExp3(value2){return IsKindOf2(value2,"RegExp")&&IsOptionalString(value2.$id)&&IsString(value2.source)&&IsString(value2.flags)&&IsOptionalNumber(value2.maxLength)&&IsOptionalNumber(value2.minLength)}function IsString4(value2){return IsKindOf2(value2,"String")&&value2.type==="string"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minLength)&&IsOptionalNumber(value2.maxLength)&&IsOptionalPattern(value2.pattern)&&IsOptionalFormat(value2.format)}function IsSymbol4(value2){return IsKindOf2(value2,"Symbol")&&value2.type==="symbol"&&IsOptionalString(value2.$id)}function IsTemplateLiteral2(value2){return IsKindOf2(value2,"TemplateLiteral")&&value2.type==="string"&&IsString(value2.pattern)&&value2.pattern[0]==="^"&&value2.pattern[value2.pattern.length-1]==="$"}function IsThis2(value2){return IsKindOf2(value2,"This")&&IsOptionalString(value2.$id)&&IsString(value2.$ref)}function IsTransform2(value2){return IsObject(value2)&&TransformKind in value2}function IsTuple2(value2){return IsKindOf2(value2,"Tuple")&&value2.type==="array"&&IsOptionalString(value2.$id)&&IsNumber(value2.minItems)&&IsNumber(value2.maxItems)&&value2.minItems===value2.maxItems&&(IsUndefined(value2.items)&&IsUndefined(value2.additionalItems)&&value2.minItems===0||IsArray(value2.items)&&value2.items.every((schema)=>IsSchema2(schema)))}function IsUndefined4(value2){return IsKindOf2(value2,"Undefined")&&value2.type==="undefined"&&IsOptionalString(value2.$id)}function IsUnionLiteral(value2){return IsUnion2(value2)&&value2.anyOf.every((schema)=>IsLiteralString(schema)||IsLiteralNumber(schema))}function IsUnion2(value2){return IsKindOf2(value2,"Union")&&IsOptionalString(value2.$id)&&IsObject(value2)&&IsArray(value2.anyOf)&&value2.anyOf.every((schema)=>IsSchema2(schema))}function IsUint8Array4(value2){return IsKindOf2(value2,"Uint8Array")&&value2.type==="Uint8Array"&&IsOptionalString(value2.$id)&&IsOptionalNumber(value2.minByteLength)&&IsOptionalNumber(value2.maxByteLength)}function IsUnknown2(value2){return IsKindOf2(value2,"Unknown")&&IsOptionalString(value2.$id)}function IsUnsafe2(value2){return IsKindOf2(value2,"Unsafe")}function IsVoid2(value2){return IsKindOf2(value2,"Void")&&value2.type==="void"&&IsOptionalString(value2.$id)}function IsKind2(value2){return IsObject(value2)&&Kind in value2&&IsString(value2[Kind])&&!KnownTypes.includes(value2[Kind])}function IsSchema2(value2){return IsObject(value2)&&(IsAny2(value2)||IsArgument2(value2)||IsArray4(value2)||IsBoolean4(value2)||IsBigInt4(value2)||IsAsyncIterator4(value2)||IsComputed2(value2)||IsConstructor2(value2)||IsDate4(value2)||IsFunction4(value2)||IsInteger3(value2)||IsIntersect2(value2)||IsIterator4(value2)||IsLiteral2(value2)||IsMappedKey2(value2)||IsMappedResult2(value2)||IsNever2(value2)||IsNot2(value2)||IsNull4(value2)||IsNumber4(value2)||IsObject4(value2)||IsPromise3(value2)||IsRecord2(value2)||IsRef2(value2)||IsRegExp3(value2)||IsString4(value2)||IsSymbol4(value2)||IsTemplateLiteral2(value2)||IsThis2(value2)||IsTuple2(value2)||IsUndefined4(value2)||IsUnion2(value2)||IsUint8Array4(value2)||IsUnknown2(value2)||IsUnsafe2(value2)||IsVoid2(value2)||IsKind2(value2))}var TypeGuardUnknownTypeError,KnownTypes;var init_type3=__esm(()=>{init_symbols2();init_error2();TypeGuardUnknownTypeError=class TypeGuardUnknownTypeError extends TypeBoxError{};KnownTypes=["Argument","Any","Array","AsyncIterator","BigInt","Boolean","Computed","Constructor","Date","Enum","Function","Integer","Intersect","Iterator","Literal","MappedKey","MappedResult","Not","Null","Number","Object","Promise","Record","Ref","RegExp","String","Symbol","TemplateLiteral","This","Tuple","Undefined","Union","Uint8Array","Unknown","Void"]});var init_guard2=__esm(()=>{init_kind();init_type3()});var init_helpers2=()=>{};var PatternBoolean="(true|false)",PatternNumber="(0|[1-9][0-9]*)",PatternString="(.*)",PatternNumberExact="^(0|[1-9][0-9]*)$",PatternStringExact="^(.*)$",PatternNeverExact="^(?!.*)$";var init_patterns=()=>{};var exports_format={};__export(exports_format,{Set:()=>Set3,Has:()=>Has,Get:()=>Get,Entries:()=>Entries,Delete:()=>Delete3,Clear:()=>Clear});function Entries(){return new Map(map)}function Clear(){return map.clear()}function Delete3(format2){return map.delete(format2)}function Has(format2){return map.has(format2)}function Set3(format2,func){map.set(format2,func)}function Get(format2){return map.get(format2)}var map;var init_format=__esm(()=>{map=new Map});var exports_type2={};__export(exports_type2,{Set:()=>Set4,Has:()=>Has2,Get:()=>Get2,Entries:()=>Entries2,Delete:()=>Delete4,Clear:()=>Clear2});function Entries2(){return new Map(map2)}function Clear2(){return map2.clear()}function Delete4(kind){return map2.delete(kind)}function Has2(kind){return map2.has(kind)}function Set4(kind,func){map2.set(kind,func)}function Get2(kind){return map2.get(kind)}var map2;var init_type4=__esm(()=>{map2=new Map});var init_registry4=__esm(()=>{init_format();init_type4()});function SetIncludes(T,S){return T.includes(S)}function SetDistinct(T){return[...new Set(T)]}function SetIntersect(T,S){return T.filter((L)=>S.includes(L))}function SetIntersectManyResolve(T,Init){return T.reduce((Acc,L)=>{return SetIntersect(Acc,L)},Init)}function SetIntersectMany(T){return T.length===1?T[0]:T.length>1?SetIntersectManyResolve(T.slice(1),T[0]):[]}function SetUnionMany(T){let Acc=[];for(let L of T)Acc.push(...L);return Acc}var init_sets=()=>{};function Any2(options){return CreateType({[Kind]:"Any"},options)}var init_any=__esm(()=>{init_create();init_symbols2()});var init_any2=__esm(()=>{init_any()});function Array2(items,options){return CreateType({[Kind]:"Array",type:"array",items},options)}var init_array=__esm(()=>{init_type2();init_symbols2()});var init_array2=__esm(()=>{init_array()});function Argument(index){return CreateType({[Kind]:"Argument",index})}var init_argument=__esm(()=>{init_type2();init_symbols2()});var init_argument2=__esm(()=>{init_argument()});function AsyncIterator2(items,options){return CreateType({[Kind]:"AsyncIterator",type:"AsyncIterator",items},options)}var init_async_iterator=__esm(()=>{init_symbols2();init_type2()});var init_async_iterator2=__esm(()=>{init_async_iterator()});function Computed(target2,parameters2,options){return CreateType({[Kind]:"Computed",target:target2,parameters:parameters2},options)}var init_computed=__esm(()=>{init_create();init_symbols()});var init_computed2=__esm(()=>{init_computed()});function DiscardKey(value2,key2){let{[key2]:_,...rest}=value2;return rest}function Discard(value2,keys){return keys.reduce((acc,key2)=>DiscardKey(acc,key2),value2)}var init_discard=()=>{};function Never(options){return CreateType({[Kind]:"Never",not:{}},options)}var init_never=__esm(()=>{init_type2();init_symbols2()});var init_never2=__esm(()=>{init_never()});var init_mapped_key=()=>{};function MappedResult(properties){return CreateType({[Kind]:"MappedResult",properties})}var init_mapped_result=__esm(()=>{init_type2();init_symbols2()});function Constructor(parameters2,returns,options){return CreateType({[Kind]:"Constructor",type:"Constructor",parameters:parameters2,returns},options)}var init_constructor=__esm(()=>{init_type2();init_symbols2()});var init_constructor2=__esm(()=>{init_constructor()});function Function2(parameters2,returns,options){return CreateType({[Kind]:"Function",type:"Function",parameters:parameters2,returns},options)}var init_function=__esm(()=>{init_type2();init_symbols2()});var init_function2=__esm(()=>{init_function()});function UnionCreate(T,options){return CreateType({[Kind]:"Union",anyOf:T},options)}var init_union_create=__esm(()=>{init_type2();init_symbols2()});function IsUnionOptional(types17){return types17.some((type3)=>IsOptional(type3))}function RemoveOptionalFromRest(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType(left):left)}function RemoveOptionalFromType(T){return Discard(T,[OptionalKind])}function ResolveUnion(types17,options){return IsUnionOptional(types17)?Optional(UnionCreate(RemoveOptionalFromRest(types17),options)):UnionCreate(RemoveOptionalFromRest(types17),options)}function UnionEvaluated(T,options){return T.length===1?CreateType(T[0],options):T.length===0?Never(options):ResolveUnion(T,options)}var init_union_evaluated=__esm(()=>{init_type2();init_symbols2();init_discard();init_never2();init_optional2();init_union_create();init_kind()});var init_union_type=()=>{};function Union(types17,options){return types17.length===0?Never(options):types17.length===1?CreateType(types17[0],options):UnionCreate(types17,options)}var init_union=__esm(()=>{init_never2();init_type2();init_union_create()});var init_union2=__esm(()=>{init_union_evaluated();init_union_type();init_union()});function Unescape(pattern){return pattern.replace(/\\\$/g,"$").replace(/\\\*/g,"*").replace(/\\\^/g,"^").replace(/\\\|/g,"|").replace(/\\\(/g,"(").replace(/\\\)/g,")")}function IsNonEscaped(pattern,index,char){return pattern[index]===char&&pattern.charCodeAt(index-1)!==92}function IsOpenParen(pattern,index){return IsNonEscaped(pattern,index,"(")}function IsCloseParen(pattern,index){return IsNonEscaped(pattern,index,")")}function IsSeparator(pattern,index){return IsNonEscaped(pattern,index,"|")}function IsGroup(pattern){if(!(IsOpenParen(pattern,0)&&IsCloseParen(pattern,pattern.length-1)))return!1;let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(count2===0&&index!==pattern.length-1)return!1}return!0}function InGroup(pattern){return pattern.slice(1,pattern.length-1)}function IsPrecedenceOr(pattern){let count2=0;for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0)return!0}return!1}function IsPrecedenceAnd(pattern){for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index))return!0;return!1}function Or(pattern){let[count2,start]=[0,0],expressions=[];for(let index=0;index<pattern.length;index++){if(IsOpenParen(pattern,index))count2+=1;if(IsCloseParen(pattern,index))count2-=1;if(IsSeparator(pattern,index)&&count2===0){let range2=pattern.slice(start,index);if(range2.length>0)expressions.push(TemplateLiteralParse(range2));start=index+1}}let range=pattern.slice(start);if(range.length>0)expressions.push(TemplateLiteralParse(range));if(expressions.length===0)return{type:"const",const:""};if(expressions.length===1)return expressions[0];return{type:"or",expr:expressions}}function And(pattern){function Group(value2,index){if(!IsOpenParen(value2,index))throw new TemplateLiteralParserError("TemplateLiteralParser: Index must point to open parens");let count2=0;for(let scan=index;scan<value2.length;scan++){if(IsOpenParen(value2,scan))count2+=1;if(IsCloseParen(value2,scan))count2-=1;if(count2===0)return[index,scan]}throw new TemplateLiteralParserError("TemplateLiteralParser: Unclosed group parens in expression")}function Range(pattern2,index){for(let scan=index;scan<pattern2.length;scan++)if(IsOpenParen(pattern2,scan))return[index,scan];return[index,pattern2.length]}let expressions=[];for(let index=0;index<pattern.length;index++)if(IsOpenParen(pattern,index)){let[start,end]=Group(pattern,index),range=pattern.slice(start,end+1);expressions.push(TemplateLiteralParse(range)),index=end}else{let[start,end]=Range(pattern,index),range=pattern.slice(start,end);if(range.length>0)expressions.push(TemplateLiteralParse(range));index=end-1}return expressions.length===0?{type:"const",const:""}:expressions.length===1?expressions[0]:{type:"and",expr:expressions}}function TemplateLiteralParse(pattern){return IsGroup(pattern)?TemplateLiteralParse(InGroup(pattern)):IsPrecedenceOr(pattern)?Or(pattern):IsPrecedenceAnd(pattern)?And(pattern):{type:"const",const:Unescape(pattern)}}function TemplateLiteralParseExact(pattern){return TemplateLiteralParse(pattern.slice(1,pattern.length-1))}var TemplateLiteralParserError;var init_parse=__esm(()=>{init_error2();TemplateLiteralParserError=class TemplateLiteralParserError extends TypeBoxError{}});function IsNumberExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="0"&&expression.expr[1].type==="const"&&expression.expr[1].const==="[1-9][0-9]*"}function IsBooleanExpression(expression){return expression.type==="or"&&expression.expr.length===2&&expression.expr[0].type==="const"&&expression.expr[0].const==="true"&&expression.expr[1].type==="const"&&expression.expr[1].const==="false"}function IsStringExpression(expression){return expression.type==="const"&&expression.const===".*"}function IsTemplateLiteralExpressionFinite(expression){return IsNumberExpression(expression)||IsStringExpression(expression)?!1:IsBooleanExpression(expression)?!0:expression.type==="and"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="or"?expression.expr.every((expr)=>IsTemplateLiteralExpressionFinite(expr)):expression.type==="const"?!0:(()=>{throw new TemplateLiteralFiniteError("Unknown expression type")})()}function IsTemplateLiteralFinite(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)}var TemplateLiteralFiniteError;var init_finite=__esm(()=>{init_parse();init_error2();TemplateLiteralFiniteError=class TemplateLiteralFiniteError extends TypeBoxError{}});function*GenerateReduce(buffer){if(buffer.length===1)return yield*buffer[0];for(let left of buffer[0])for(let right of GenerateReduce(buffer.slice(1)))yield`${left}${right}`}function*GenerateAnd(expression){return yield*GenerateReduce(expression.expr.map((expr)=>[...TemplateLiteralExpressionGenerate(expr)]))}function*GenerateOr(expression){for(let expr of expression.expr)yield*TemplateLiteralExpressionGenerate(expr)}function*GenerateConst(expression){return yield expression.const}function*TemplateLiteralExpressionGenerate(expression){return expression.type==="and"?yield*GenerateAnd(expression):expression.type==="or"?yield*GenerateOr(expression):expression.type==="const"?yield*GenerateConst(expression):(()=>{throw new TemplateLiteralGenerateError("Unknown expression")})()}function TemplateLiteralGenerate(schema){let expression=TemplateLiteralParseExact(schema.pattern);return IsTemplateLiteralExpressionFinite(expression)?[...TemplateLiteralExpressionGenerate(expression)]:[]}var TemplateLiteralGenerateError;var init_generate=__esm(()=>{init_finite();init_parse();init_error2();TemplateLiteralGenerateError=class TemplateLiteralGenerateError extends TypeBoxError{}});function Literal(value2,options){return CreateType({[Kind]:"Literal",const:value2,type:typeof value2},options)}var init_literal=__esm(()=>{init_type2();init_symbols2()});var init_literal2=__esm(()=>{init_literal()});function Boolean3(options){return CreateType({[Kind]:"Boolean",type:"boolean"},options)}var init_boolean=__esm(()=>{init_symbols2();init_create()});var init_boolean2=__esm(()=>{init_boolean()});function BigInt2(options){return CreateType({[Kind]:"BigInt",type:"bigint"},options)}var init_bigint=__esm(()=>{init_symbols2();init_create()});var init_bigint2=__esm(()=>{init_bigint()});function Number2(options){return CreateType({[Kind]:"Number",type:"number"},options)}var init_number=__esm(()=>{init_type2();init_symbols2()});var init_number2=__esm(()=>{init_number()});function String2(options){return CreateType({[Kind]:"String",type:"string"},options)}var init_string=__esm(()=>{init_type2();init_symbols2()});var init_string2=__esm(()=>{init_string()});function*FromUnion(syntax){let trim=syntax.trim().replace(/"|'/g,"");return trim==="boolean"?yield Boolean3():trim==="number"?yield Number2():trim==="bigint"?yield BigInt2():trim==="string"?yield String2():yield(()=>{let literals=trim.split("|").map((literal2)=>Literal(literal2.trim()));return literals.length===0?Never():literals.length===1?literals[0]:UnionEvaluated(literals)})()}function*FromTerminal(syntax){if(syntax[1]!=="{"){let L=Literal("$"),R=FromSyntax(syntax.slice(1));return yield*[L,...R]}for(let i=2;i<syntax.length;i++)if(syntax[i]==="}"){let L=FromUnion(syntax.slice(2,i)),R=FromSyntax(syntax.slice(i+1));return yield*[...L,...R]}yield Literal(syntax)}function*FromSyntax(syntax){for(let i=0;i<syntax.length;i++)if(syntax[i]==="$"){let L=Literal(syntax.slice(0,i)),R=FromTerminal(syntax.slice(i));return yield*[L,...R]}yield Literal(syntax)}function TemplateLiteralSyntax(syntax){return[...FromSyntax(syntax)]}var init_syntax=__esm(()=>{init_literal2();init_boolean2();init_bigint2();init_number2();init_string2();init_union2();init_never2()});function Escape(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function Visit2(schema,acc){return IsTemplateLiteral(schema)?schema.pattern.slice(1,schema.pattern.length-1):IsUnion(schema)?`(${schema.anyOf.map((schema2)=>Visit2(schema2,acc)).join("|")})`:IsNumber3(schema)?`${acc}${PatternNumber}`:IsInteger2(schema)?`${acc}${PatternNumber}`:IsBigInt3(schema)?`${acc}${PatternNumber}`:IsString3(schema)?`${acc}${PatternString}`:IsLiteral(schema)?`${acc}${Escape(schema.const.toString())}`:IsBoolean3(schema)?`${acc}${PatternBoolean}`:(()=>{throw new TemplateLiteralPatternError(`Unexpected Kind '${schema[Kind]}'`)})()}function TemplateLiteralPattern(kinds){return`^${kinds.map((schema)=>Visit2(schema,"")).join("")}$`}var TemplateLiteralPatternError;var init_pattern=__esm(()=>{init_patterns();init_symbols2();init_error2();init_kind();TemplateLiteralPatternError=class TemplateLiteralPatternError extends TypeBoxError{}});function TemplateLiteralToUnion(schema){let L=TemplateLiteralGenerate(schema).map((S)=>Literal(S));return UnionEvaluated(L)}var init_union3=__esm(()=>{init_union2();init_literal2();init_generate()});function TemplateLiteral(unresolved,options){let pattern=IsString(unresolved)?TemplateLiteralPattern(TemplateLiteralSyntax(unresolved)):TemplateLiteralPattern(unresolved);return CreateType({[Kind]:"TemplateLiteral",type:"string",pattern},options)}var init_template_literal=__esm(()=>{init_type2();init_syntax();init_pattern();init_symbols2()});var init_template_literal2=__esm(()=>{init_finite();init_generate();init_syntax();init_parse();init_pattern();init_union3();init_template_literal()});function FromTemplateLiteral(templateLiteral){return TemplateLiteralGenerate(templateLiteral).map((key2)=>key2.toString())}function FromUnion2(types17){let result=[];for(let type3 of types17)result.push(...IndexPropertyKeys(type3));return result}function FromLiteral(literalValue){return[literalValue.toString()]}function IndexPropertyKeys(type3){return[...new Set(IsTemplateLiteral(type3)?FromTemplateLiteral(type3):IsUnion(type3)?FromUnion2(type3.anyOf):IsLiteral(type3)?FromLiteral(type3.const):IsNumber3(type3)?["[number]"]:IsInteger2(type3)?["[number]"]:[])]}var init_indexed_property_keys=__esm(()=>{init_template_literal2();init_kind()});function FromProperties(type3,properties,options){let result={};for(let K2 of Object.getOwnPropertyNames(properties))result[K2]=Index(type3,IndexPropertyKeys(properties[K2]),options);return result}function FromMappedResult(type3,mappedResult,options){return FromProperties(type3,mappedResult.properties,options)}function IndexFromMappedResult(type3,mappedResult,options){let properties=FromMappedResult(type3,mappedResult,options);return MappedResult(properties)}var init_indexed_from_mapped_result=__esm(()=>{init_mapped2();init_indexed_property_keys();init_indexed2()});function FromRest(types17,key2){return types17.map((type3)=>IndexFromPropertyKey(type3,key2))}function FromIntersectRest(types17){return types17.filter((type3)=>!IsNever(type3))}function FromIntersect(types17,key2){return IntersectEvaluated(FromIntersectRest(FromRest(types17,key2)))}function FromUnionRest(types17){return types17.some((L)=>IsNever(L))?[]:types17}function FromUnion3(types17,key2){return UnionEvaluated(FromUnionRest(FromRest(types17,key2)))}function FromTuple(types17,key2){return key2 in types17?types17[key2]:key2==="[number]"?UnionEvaluated(types17):Never()}function FromArray(type3,key2){return key2==="[number]"?type3:Never()}function FromProperty(properties,propertyKey){return propertyKey in properties?properties[propertyKey]:Never()}function IndexFromPropertyKey(type3,propertyKey){return IsIntersect(type3)?FromIntersect(type3.allOf,propertyKey):IsUnion(type3)?FromUnion3(type3.anyOf,propertyKey):IsTuple(type3)?FromTuple(type3.items??[],propertyKey):IsArray3(type3)?FromArray(type3.items,propertyKey):IsObject3(type3)?FromProperty(type3.properties,propertyKey):Never()}function IndexFromPropertyKeys(type3,propertyKeys){return propertyKeys.map((propertyKey)=>IndexFromPropertyKey(type3,propertyKey))}function FromSchema(type3,propertyKeys){return UnionEvaluated(IndexFromPropertyKeys(type3,propertyKeys))}function Index(type3,key2,options){if(IsRef(type3)||IsRef(key2)){if(!IsSchema(type3)||!IsSchema(key2))throw new TypeBoxError("Index types using Ref parameters require both Type and Key to be of TSchema");return Computed("Index",[type3,key2])}if(IsMappedResult(key2))return IndexFromMappedResult(type3,key2,options);if(IsMappedKey(key2))return IndexFromMappedKey(type3,key2,options);return CreateType(IsSchema(key2)?FromSchema(type3,IndexPropertyKeys(key2)):FromSchema(type3,key2),options)}var init_indexed=__esm(()=>{init_type2();init_error2();init_computed2();init_never2();init_intersect2();init_union2();init_indexed_property_keys();init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_kind()});function MappedIndexPropertyKey(type3,key2,options){return{[key2]:Index(type3,[key2],Clone(options))}}function MappedIndexPropertyKeys(type3,propertyKeys,options){return propertyKeys.reduce((result,left)=>{return{...result,...MappedIndexPropertyKey(type3,left,options)}},{})}function MappedIndexProperties(type3,mappedKey,options){return MappedIndexPropertyKeys(type3,mappedKey.keys,options)}function IndexFromMappedKey(type3,mappedKey,options){let properties=MappedIndexProperties(type3,mappedKey,options);return MappedResult(properties)}var init_indexed_from_mapped_key=__esm(()=>{init_indexed();init_mapped2();init_value()});var init_indexed2=__esm(()=>{init_indexed_from_mapped_key();init_indexed_from_mapped_result();init_indexed_property_keys();init_indexed()});function Iterator2(items,options){return CreateType({[Kind]:"Iterator",type:"Iterator",items},options)}var init_iterator=__esm(()=>{init_type2();init_symbols2()});var init_iterator2=__esm(()=>{init_iterator()});function RequiredArray(properties){return globalThis.Object.keys(properties).filter((key2)=>!IsOptional(properties[key2]))}function _Object(properties,options){let required=RequiredArray(properties),schema=required.length>0?{[Kind]:"Object",type:"object",required,properties}:{[Kind]:"Object",type:"object",properties};return CreateType(schema,options)}var Object2;var init_object=__esm(()=>{init_type2();init_symbols2();init_kind();Object2=_Object});var init_object2=__esm(()=>{init_object()});function Promise2(item,options){return CreateType({[Kind]:"Promise",type:"Promise",item},options)}var init_promise=__esm(()=>{init_type2();init_symbols2()});var init_promise2=__esm(()=>{init_promise()});function RemoveReadonly(schema){return CreateType(Discard(schema,[ReadonlyKind]))}function AddReadonly(schema){return CreateType({...schema,[ReadonlyKind]:"Readonly"})}function ReadonlyWithFlag(schema,F){return F===!1?RemoveReadonly(schema):AddReadonly(schema)}function Readonly(schema,enable){let F=enable??!0;return IsMappedResult(schema)?ReadonlyFromMappedResult(schema,F):ReadonlyWithFlag(schema,F)}var init_readonly=__esm(()=>{init_type2();init_symbols2();init_discard();init_readonly_from_mapped_result();init_kind()});function FromProperties2(K,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Readonly(K[K2],F);return Acc}function FromMappedResult2(R,F){return FromProperties2(R.properties,F)}function ReadonlyFromMappedResult(R,F){let P=FromMappedResult2(R,F);return MappedResult(P)}var init_readonly_from_mapped_result=__esm(()=>{init_mapped2();init_readonly()});var init_readonly2=__esm(()=>{init_readonly_from_mapped_result();init_readonly()});function Tuple(types17,options){return CreateType(types17.length>0?{[Kind]:"Tuple",type:"array",items:types17,additionalItems:!1,minItems:types17.length,maxItems:types17.length}:{[Kind]:"Tuple",type:"array",minItems:types17.length,maxItems:types17.length},options)}var init_tuple=__esm(()=>{init_type2();init_symbols2()});var init_tuple2=__esm(()=>{init_tuple()});function FromMappedResult3(K,P){return K in P?FromSchemaType(K,P[K]):MappedResult(P)}function MappedKeyToKnownMappedResultProperties(K){return{[K]:Literal(K)}}function MappedKeyToUnknownMappedResultProperties(P){let Acc={};for(let L of P)Acc[L]=Literal(L);return Acc}function MappedKeyToMappedResultProperties(K,P){return SetIncludes(P,K)?MappedKeyToKnownMappedResultProperties(K):MappedKeyToUnknownMappedResultProperties(P)}function FromMappedKey(K,P){let R=MappedKeyToMappedResultProperties(K,P);return FromMappedResult3(K,R)}function FromRest2(K,T){return T.map((L)=>FromSchemaType(K,L))}function FromProperties3(K,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(T))Acc[K2]=FromSchemaType(K,T[K2]);return Acc}function FromSchemaType(K,T){let options={...T};return IsOptional(T)?Optional(FromSchemaType(K,Discard(T,[OptionalKind]))):IsReadonly(T)?Readonly(FromSchemaType(K,Discard(T,[ReadonlyKind]))):IsMappedResult(T)?FromMappedResult3(K,T.properties):IsMappedKey(T)?FromMappedKey(K,T.keys):IsConstructor(T)?Constructor(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsFunction3(T)?Function2(FromRest2(K,T.parameters),FromSchemaType(K,T.returns),options):IsAsyncIterator3(T)?AsyncIterator2(FromSchemaType(K,T.items),options):IsIterator3(T)?Iterator2(FromSchemaType(K,T.items),options):IsIntersect(T)?Intersect(FromRest2(K,T.allOf),options):IsUnion(T)?Union(FromRest2(K,T.anyOf),options):IsTuple(T)?Tuple(FromRest2(K,T.items??[]),options):IsObject3(T)?Object2(FromProperties3(K,T.properties),options):IsArray3(T)?Array2(FromSchemaType(K,T.items),options):IsPromise2(T)?Promise2(FromSchemaType(K,T.item),options):T}function MappedFunctionReturnType(K,T){let Acc={};for(let L of K)Acc[L]=FromSchemaType(L,T);return Acc}function Mapped(key2,map3,options){let K=IsSchema(key2)?IndexPropertyKeys(key2):key2,RT=map3({[Kind]:"MappedKey",keys:K}),R=MappedFunctionReturnType(K,RT);return Object2(R,options)}var init_mapped=__esm(()=>{init_symbols2();init_discard();init_array2();init_async_iterator2();init_constructor2();init_function2();init_indexed2();init_intersect2();init_iterator2();init_literal2();init_object2();init_optional2();init_promise2();init_readonly2();init_tuple2();init_union2();init_sets();init_mapped_result();init_kind()});var init_mapped2=__esm(()=>{init_mapped_key();init_mapped_result();init_mapped()});function RemoveOptional(schema){return CreateType(Discard(schema,[OptionalKind]))}function AddOptional(schema){return CreateType({...schema,[OptionalKind]:"Optional"})}function OptionalWithFlag(schema,F){return F===!1?RemoveOptional(schema):AddOptional(schema)}function Optional(schema,enable){let F=enable??!0;return IsMappedResult(schema)?OptionalFromMappedResult(schema,F):OptionalWithFlag(schema,F)}var init_optional=__esm(()=>{init_type2();init_symbols2();init_discard();init_optional_from_mapped_result();init_kind()});function FromProperties4(P,F){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Optional(P[K2],F);return Acc}function FromMappedResult4(R,F){return FromProperties4(R.properties,F)}function OptionalFromMappedResult(R,F){let P=FromMappedResult4(R,F);return MappedResult(P)}var init_optional_from_mapped_result=__esm(()=>{init_mapped2();init_optional()});var init_optional2=__esm(()=>{init_optional_from_mapped_result();init_optional()});function IntersectCreate(T,options={}){let allObjects=T.every((schema)=>IsObject3(schema)),clonedUnevaluatedProperties=IsSchema(options.unevaluatedProperties)?{unevaluatedProperties:options.unevaluatedProperties}:{};return CreateType(options.unevaluatedProperties===!1||IsSchema(options.unevaluatedProperties)||allObjects?{...clonedUnevaluatedProperties,[Kind]:"Intersect",type:"object",allOf:T}:{...clonedUnevaluatedProperties,[Kind]:"Intersect",allOf:T},options)}var init_intersect_create=__esm(()=>{init_type2();init_symbols2();init_kind()});function IsIntersectOptional(types17){return types17.every((left)=>IsOptional(left))}function RemoveOptionalFromType2(type3){return Discard(type3,[OptionalKind])}function RemoveOptionalFromRest2(types17){return types17.map((left)=>IsOptional(left)?RemoveOptionalFromType2(left):left)}function ResolveIntersect(types17,options){return IsIntersectOptional(types17)?Optional(IntersectCreate(RemoveOptionalFromRest2(types17),options)):IntersectCreate(RemoveOptionalFromRest2(types17),options)}function IntersectEvaluated(types17,options={}){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return ResolveIntersect(types17,options)}var init_intersect_evaluated=__esm(()=>{init_symbols2();init_type2();init_discard();init_never2();init_optional2();init_intersect_create();init_kind()});var init_intersect_type=()=>{};function Intersect(types17,options){if(types17.length===1)return CreateType(types17[0],options);if(types17.length===0)return Never(options);if(types17.some((schema)=>IsTransform(schema)))throw Error("Cannot intersect transform types");return IntersectCreate(types17,options)}var init_intersect=__esm(()=>{init_type2();init_never2();init_intersect_create();init_kind()});var init_intersect2=__esm(()=>{init_intersect_evaluated();init_intersect_type();init_intersect()});function Ref(...args){let[$ref,options]=typeof args[0]==="string"?[args[0],args[1]]:[args[0].$id,args[1]];if(typeof $ref!=="string")throw new TypeBoxError("Ref: $ref must be a string");return CreateType({[Kind]:"Ref",$ref},options)}var init_ref=__esm(()=>{init_error2();init_type2();init_symbols2()});var init_ref2=__esm(()=>{init_ref()});function FromComputed(target2,parameters2){return Computed("Awaited",[Computed(target2,parameters2)])}function FromRef($ref){return Computed("Awaited",[Ref($ref)])}function FromIntersect2(types17){return Intersect(FromRest3(types17))}function FromUnion4(types17){return Union(FromRest3(types17))}function FromPromise(type3){return Awaited(type3)}function FromRest3(types17){return types17.map((type3)=>Awaited(type3))}function Awaited(type3,options){return CreateType(IsComputed(type3)?FromComputed(type3.target,type3.parameters):IsIntersect(type3)?FromIntersect2(type3.allOf):IsUnion(type3)?FromUnion4(type3.anyOf):IsPromise2(type3)?FromPromise(type3.item):IsRef(type3)?FromRef(type3.$ref):type3,options)}var init_awaited=__esm(()=>{init_type2();init_computed2();init_intersect2();init_union2();init_ref2();init_kind()});var init_awaited2=__esm(()=>{init_awaited()});function FromRest4(types17){let result=[];for(let L of types17)result.push(KeyOfPropertyKeys(L));return result}function FromIntersect3(types17){let propertyKeysArray=FromRest4(types17);return SetUnionMany(propertyKeysArray)}function FromUnion5(types17){let propertyKeysArray=FromRest4(types17);return SetIntersectMany(propertyKeysArray)}function FromTuple2(types17){return types17.map((_,indexer)=>indexer.toString())}function FromArray2(_){return["[number]"]}function FromProperties5(T){return globalThis.Object.getOwnPropertyNames(T)}function FromPatternProperties(patternProperties){if(!includePatternProperties)return[];return globalThis.Object.getOwnPropertyNames(patternProperties).map((key2)=>{return key2[0]==="^"&&key2[key2.length-1]==="$"?key2.slice(1,key2.length-1):key2})}function KeyOfPropertyKeys(type3){return IsIntersect(type3)?FromIntersect3(type3.allOf):IsUnion(type3)?FromUnion5(type3.anyOf):IsTuple(type3)?FromTuple2(type3.items??[]):IsArray3(type3)?FromArray2(type3.items):IsObject3(type3)?FromProperties5(type3.properties):IsRecord(type3)?FromPatternProperties(type3.patternProperties):[]}function KeyOfPattern(schema){includePatternProperties=!0;let keys=KeyOfPropertyKeys(schema);return includePatternProperties=!1,`^(${keys.map((key2)=>`(${key2})`).join("|")})$`}var includePatternProperties=!1;var init_keyof_property_keys=__esm(()=>{init_sets();init_kind()});function FromComputed2(target2,parameters2){return Computed("KeyOf",[Computed(target2,parameters2)])}function FromRef2($ref){return Computed("KeyOf",[Ref($ref)])}function KeyOfFromType(type3,options){let propertyKeys=KeyOfPropertyKeys(type3),propertyKeyTypes=KeyOfPropertyKeysToRest(propertyKeys),result=UnionEvaluated(propertyKeyTypes);return CreateType(result,options)}function KeyOfPropertyKeysToRest(propertyKeys){return propertyKeys.map((L)=>L==="[number]"?Number2():Literal(L))}function KeyOf(type3,options){return IsComputed(type3)?FromComputed2(type3.target,type3.parameters):IsRef(type3)?FromRef2(type3.$ref):IsMappedResult(type3)?KeyOfFromMappedResult(type3,options):KeyOfFromType(type3,options)}var init_keyof=__esm(()=>{init_type2();init_literal2();init_number2();init_computed2();init_ref2();init_keyof_property_keys();init_union2();init_keyof_from_mapped_result();init_kind()});function FromProperties6(properties,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=KeyOf(properties[K2],Clone(options));return result}function FromMappedResult5(mappedResult,options){return FromProperties6(mappedResult.properties,options)}function KeyOfFromMappedResult(mappedResult,options){let properties=FromMappedResult5(mappedResult,options);return MappedResult(properties)}var init_keyof_from_mapped_result=__esm(()=>{init_mapped2();init_keyof();init_value()});function KeyOfPropertyEntries(schema){let keys=KeyOfPropertyKeys(schema),schemas=IndexFromPropertyKeys(schema,keys);return keys.map((_,index)=>[keys[index],schemas[index]])}var init_keyof_property_entries=__esm(()=>{init_indexed();init_keyof_property_keys()});var init_keyof2=__esm(()=>{init_keyof_from_mapped_result();init_keyof_property_entries();init_keyof_property_keys();init_keyof()});function CompositeKeys(T){let Acc=[];for(let L of T)Acc.push(...KeyOfPropertyKeys(L));return SetDistinct(Acc)}function FilterNever(T){return T.filter((L)=>!IsNever(L))}function CompositeProperty(T,K){let Acc=[];for(let L of T)Acc.push(...IndexFromPropertyKeys(L,[K]));return FilterNever(Acc)}function CompositeProperties(T,K){let Acc={};for(let L of K)Acc[L]=IntersectEvaluated(CompositeProperty(T,L));return Acc}function Composite(T,options){let K=CompositeKeys(T),P=CompositeProperties(T,K);return Object2(P,options)}var init_composite=__esm(()=>{init_intersect2();init_indexed2();init_keyof2();init_object2();init_sets();init_kind()});var init_composite2=__esm(()=>{init_composite()});function Date2(options){return CreateType({[Kind]:"Date",type:"Date"},options)}var init_date=__esm(()=>{init_symbols2();init_type2()});var init_date2=__esm(()=>{init_date()});function Null2(options){return CreateType({[Kind]:"Null",type:"null"},options)}var init_null=__esm(()=>{init_type2();init_symbols2()});var init_null2=__esm(()=>{init_null()});function Symbol2(options){return CreateType({[Kind]:"Symbol",type:"symbol"},options)}var init_symbol=__esm(()=>{init_type2();init_symbols2()});var init_symbol2=__esm(()=>{init_symbol()});function Undefined(options){return CreateType({[Kind]:"Undefined",type:"undefined"},options)}var init_undefined=__esm(()=>{init_type2();init_symbols2()});var init_undefined2=__esm(()=>{init_undefined()});function Uint8Array2(options){return CreateType({[Kind]:"Uint8Array",type:"Uint8Array"},options)}var init_uint8array=__esm(()=>{init_type2();init_symbols2()});var init_uint8array2=__esm(()=>{init_uint8array()});function Unknown(options){return CreateType({[Kind]:"Unknown"},options)}var init_unknown=__esm(()=>{init_type2();init_symbols2()});var init_unknown2=__esm(()=>{init_unknown()});function FromArray3(T){return T.map((L)=>FromValue(L,!1))}function FromProperties7(value2){let Acc={};for(let K of globalThis.Object.getOwnPropertyNames(value2))Acc[K]=Readonly(FromValue(value2[K],!1));return Acc}function ConditionalReadonly(T,root){return root===!0?T:Readonly(T)}function FromValue(value2,root){return IsAsyncIterator(value2)?ConditionalReadonly(Any2(),root):IsIterator(value2)?ConditionalReadonly(Any2(),root):IsArray(value2)?Readonly(Tuple(FromArray3(value2))):IsUint8Array(value2)?Uint8Array2():IsDate(value2)?Date2():IsObject(value2)?ConditionalReadonly(Object2(FromProperties7(value2)),root):IsFunction(value2)?ConditionalReadonly(Function2([],Unknown()),root):IsUndefined(value2)?Undefined():IsNull(value2)?Null2():IsSymbol(value2)?Symbol2():IsBigInt(value2)?BigInt2():IsNumber(value2)?Literal(value2):IsBoolean(value2)?Literal(value2):IsString(value2)?Literal(value2):Object2({})}function Const(T,options){return CreateType(FromValue(T,!0),options)}var init_const=__esm(()=>{init_any2();init_bigint2();init_date2();init_function2();init_literal2();init_null2();init_object2();init_symbol2();init_tuple2();init_readonly2();init_undefined2();init_uint8array2();init_unknown2();init_create()});var init_const2=__esm(()=>{init_const()});function ConstructorParameters(schema,options){return IsConstructor(schema)?Tuple(schema.parameters,options):Never(options)}var init_constructor_parameters=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_constructor_parameters2=__esm(()=>{init_constructor_parameters()});function Enum(item,options){if(IsUndefined(item))throw Error("Enum undefined or empty");let values1=globalThis.Object.getOwnPropertyNames(item).filter((key2)=>isNaN(key2)).map((key2)=>item[key2]),anyOf=[...new Set(values1)].map((value2)=>Literal(value2));return Union(anyOf,{...options,[Hint]:"Enum"})}var init_enum=__esm(()=>{init_literal2();init_symbols2();init_union2()});var init_enum2=__esm(()=>{init_enum()});function IntoBooleanResult(result){return result===ExtendsResult.False?result:ExtendsResult.True}function Throw(message){throw new ExtendsResolverError(message)}function IsStructuralRight(right){return exports_type.IsNever(right)||exports_type.IsIntersect(right)||exports_type.IsUnion(right)||exports_type.IsUnknown(right)||exports_type.IsAny(right)}function StructuralRight(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):Throw("StructuralRight")}function FromAnyRight(left,right){return ExtendsResult.True}function FromAny(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)&&right.anyOf.some((schema)=>exports_type.IsAny(schema)||exports_type.IsUnknown(schema))?ExtendsResult.True:exports_type.IsUnion(right)?ExtendsResult.Union:exports_type.IsUnknown(right)?ExtendsResult.True:exports_type.IsAny(right)?ExtendsResult.True:ExtendsResult.Union}function FromArrayRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)?ExtendsResult.True:ExtendsResult.False}function FromArray4(left,right){return exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsArray(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromAsyncIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsAsyncIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromBigInt(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBigInt(right)?ExtendsResult.True:ExtendsResult.False}function FromBooleanRight(left,right){return exports_type.IsLiteralBoolean(left)?ExtendsResult.True:exports_type.IsBoolean(left)?ExtendsResult.True:ExtendsResult.False}function FromBoolean(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsBoolean(right)?ExtendsResult.True:ExtendsResult.False}function FromConstructor(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsConstructor(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromDate(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsDate(right)?ExtendsResult.True:ExtendsResult.False}function FromFunction(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsFunction(right)?ExtendsResult.False:left.parameters.length>right.parameters.length?ExtendsResult.False:!left.parameters.every((schema,index)=>IntoBooleanResult(Visit3(right.parameters[index],schema))===ExtendsResult.True)?ExtendsResult.False:IntoBooleanResult(Visit3(left.returns,right.returns))}function FromIntegerRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsNumber(left.const)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromInteger(left,right){return exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):ExtendsResult.False}function FromIntersectRight(left,right){return right.allOf.every((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIntersect4(left,right){return left.allOf.some((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromIterator(left,right){return IsStructuralRight(right)?StructuralRight(left,right):!exports_type.IsIterator(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.items,right.items))}function FromLiteral2(left,right){return exports_type.IsLiteral(right)&&right.const===left.const?ExtendsResult.True:IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):ExtendsResult.False}function FromNeverRight(left,right){return ExtendsResult.False}function FromNever(left,right){return ExtendsResult.True}function UnwrapTNot(schema){let[current,depth]=[schema,0];while(!0){if(!exports_type.IsNot(current))break;current=current.not,depth+=1}return depth%2===0?current:Unknown()}function FromNot(left,right){return exports_type.IsNot(left)?Visit3(UnwrapTNot(left),right):exports_type.IsNot(right)?Visit3(left,UnwrapTNot(right)):Throw("Invalid fallthrough for Not")}function FromNull(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsNull(right)?ExtendsResult.True:ExtendsResult.False}function FromNumberRight(left,right){return exports_type.IsLiteralNumber(left)?ExtendsResult.True:exports_type.IsNumber(left)||exports_type.IsInteger(left)?ExtendsResult.True:ExtendsResult.False}function FromNumber(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsInteger(right)||exports_type.IsNumber(right)?ExtendsResult.True:ExtendsResult.False}function IsObjectPropertyCount(schema,count2){return Object.getOwnPropertyNames(schema.properties).length===count2}function IsObjectStringLike(schema){return IsObjectArrayLike(schema)}function IsObjectSymbolLike(schema){return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"description"in schema.properties&&exports_type.IsUnion(schema.properties.description)&&schema.properties.description.anyOf.length===2&&(exports_type.IsString(schema.properties.description.anyOf[0])&&exports_type.IsUndefined(schema.properties.description.anyOf[1])||exports_type.IsString(schema.properties.description.anyOf[1])&&exports_type.IsUndefined(schema.properties.description.anyOf[0]))}function IsObjectNumberLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBooleanLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectBigIntLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectDateLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectUint8ArrayLike(schema){return IsObjectArrayLike(schema)}function IsObjectFunctionLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectConstructorLike(schema){return IsObjectPropertyCount(schema,0)}function IsObjectArrayLike(schema){let length=Number2();return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"length"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.length,length))===ExtendsResult.True}function IsObjectPromiseLike(schema){let then=Function2([Any2()],Any2());return IsObjectPropertyCount(schema,0)||IsObjectPropertyCount(schema,1)&&"then"in schema.properties&&IntoBooleanResult(Visit3(schema.properties.then,then))===ExtendsResult.True}function Property(left,right){return Visit3(left,right)===ExtendsResult.False?ExtendsResult.False:exports_type.IsOptional(left)&&!exports_type.IsOptional(right)?ExtendsResult.False:ExtendsResult.True}function FromObjectRight(left,right){return exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:exports_type.IsNever(left)||exports_type.IsLiteralString(left)&&IsObjectStringLike(right)||exports_type.IsLiteralNumber(left)&&IsObjectNumberLike(right)||exports_type.IsLiteralBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsBigInt(left)&&IsObjectBigIntLike(right)||exports_type.IsString(left)&&IsObjectStringLike(right)||exports_type.IsSymbol(left)&&IsObjectSymbolLike(right)||exports_type.IsNumber(left)&&IsObjectNumberLike(right)||exports_type.IsInteger(left)&&IsObjectNumberLike(right)||exports_type.IsBoolean(left)&&IsObjectBooleanLike(right)||exports_type.IsUint8Array(left)&&IsObjectUint8ArrayLike(right)||exports_type.IsDate(left)&&IsObjectDateLike(right)||exports_type.IsConstructor(left)&&IsObjectConstructorLike(right)||exports_type.IsFunction(left)&&IsObjectFunctionLike(right)?ExtendsResult.True:exports_type.IsRecord(left)&&exports_type.IsString(RecordKey(left))?(()=>{return right[Hint]==="Record"?ExtendsResult.True:ExtendsResult.False})():exports_type.IsRecord(left)&&exports_type.IsNumber(RecordKey(left))?(()=>{return IsObjectPropertyCount(right,0)?ExtendsResult.True:ExtendsResult.False})():ExtendsResult.False}function FromObject(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):!exports_type.IsObject(right)?ExtendsResult.False:(()=>{for(let key2 of Object.getOwnPropertyNames(right.properties)){if(!(key2 in left.properties)&&!exports_type.IsOptional(right.properties[key2]))return ExtendsResult.False;if(exports_type.IsOptional(right.properties[key2]))return ExtendsResult.True;if(Property(left.properties[key2],right.properties[key2])===ExtendsResult.False)return ExtendsResult.False}return ExtendsResult.True})()}function FromPromise2(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectPromiseLike(right)?ExtendsResult.True:!exports_type.IsPromise(right)?ExtendsResult.False:IntoBooleanResult(Visit3(left.item,right.item))}function RecordKey(schema){return PatternNumberExact in schema.patternProperties?Number2():(PatternStringExact in schema.patternProperties)?String2():Throw("Unknown record key pattern")}function RecordValue(schema){return PatternNumberExact in schema.patternProperties?schema.patternProperties[PatternNumberExact]:(PatternStringExact in schema.patternProperties)?schema.patternProperties[PatternStringExact]:Throw("Unable to get record value schema")}function FromRecordRight(left,right){let[Key,Value]=[RecordKey(right),RecordValue(right)];return exports_type.IsLiteralString(left)&&exports_type.IsNumber(Key)&&IntoBooleanResult(Visit3(left,Value))===ExtendsResult.True?ExtendsResult.True:exports_type.IsUint8Array(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsString(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsArray(left)&&exports_type.IsNumber(Key)?Visit3(left,Value):exports_type.IsObject(left)?(()=>{for(let key2 of Object.getOwnPropertyNames(left.properties))if(Property(Value,left.properties[key2])===ExtendsResult.False)return ExtendsResult.False;return ExtendsResult.True})():ExtendsResult.False}function FromRecord(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):!exports_type.IsRecord(right)?ExtendsResult.False:Visit3(RecordValue(left),RecordValue(right))}function FromRegExp(left,right){let L=exports_type.IsRegExp(left)?String2():left,R=exports_type.IsRegExp(right)?String2():right;return Visit3(L,R)}function FromStringRight(left,right){return exports_type.IsLiteral(left)&&exports_value.IsString(left.const)?ExtendsResult.True:exports_type.IsString(left)?ExtendsResult.True:ExtendsResult.False}function FromString(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsString(right)?ExtendsResult.True:ExtendsResult.False}function FromSymbol(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsSymbol(right)?ExtendsResult.True:ExtendsResult.False}function FromTemplateLiteral2(left,right){return exports_type.IsTemplateLiteral(left)?Visit3(TemplateLiteralToUnion(left),right):exports_type.IsTemplateLiteral(right)?Visit3(left,TemplateLiteralToUnion(right)):Throw("Invalid fallthrough for TemplateLiteral")}function IsArrayOfTuple(left,right){return exports_type.IsArray(right)&&left.items!==void 0&&left.items.every((schema)=>Visit3(schema,right.items)===ExtendsResult.True)}function FromTupleRight(left,right){return exports_type.IsNever(left)?ExtendsResult.True:exports_type.IsUnknown(left)?ExtendsResult.False:exports_type.IsAny(left)?ExtendsResult.Union:ExtendsResult.False}function FromTuple3(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)&&IsObjectArrayLike(right)?ExtendsResult.True:exports_type.IsArray(right)&&IsArrayOfTuple(left,right)?ExtendsResult.True:!exports_type.IsTuple(right)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)||!exports_value.IsUndefined(left.items)&&exports_value.IsUndefined(right.items)?ExtendsResult.False:exports_value.IsUndefined(left.items)&&!exports_value.IsUndefined(right.items)?ExtendsResult.True:left.items.every((schema,index)=>Visit3(schema,right.items[index])===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUint8Array(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsUint8Array(right)?ExtendsResult.True:ExtendsResult.False}function FromUndefined(left,right){return IsStructuralRight(right)?StructuralRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsRecord(right)?FromRecordRight(left,right):exports_type.IsVoid(right)?FromVoidRight(left,right):exports_type.IsUndefined(right)?ExtendsResult.True:ExtendsResult.False}function FromUnionRight(left,right){return right.anyOf.some((schema)=>Visit3(left,schema)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnion6(left,right){return left.anyOf.every((schema)=>Visit3(schema,right)===ExtendsResult.True)?ExtendsResult.True:ExtendsResult.False}function FromUnknownRight(left,right){return ExtendsResult.True}function FromUnknown(left,right){return exports_type.IsNever(right)?FromNeverRight(left,right):exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsString(right)?FromStringRight(left,right):exports_type.IsNumber(right)?FromNumberRight(left,right):exports_type.IsInteger(right)?FromIntegerRight(left,right):exports_type.IsBoolean(right)?FromBooleanRight(left,right):exports_type.IsArray(right)?FromArrayRight(left,right):exports_type.IsTuple(right)?FromTupleRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsUnknown(right)?ExtendsResult.True:ExtendsResult.False}function FromVoidRight(left,right){return exports_type.IsUndefined(left)?ExtendsResult.True:exports_type.IsUndefined(left)?ExtendsResult.True:ExtendsResult.False}function FromVoid(left,right){return exports_type.IsIntersect(right)?FromIntersectRight(left,right):exports_type.IsUnion(right)?FromUnionRight(left,right):exports_type.IsUnknown(right)?FromUnknownRight(left,right):exports_type.IsAny(right)?FromAnyRight(left,right):exports_type.IsObject(right)?FromObjectRight(left,right):exports_type.IsVoid(right)?ExtendsResult.True:ExtendsResult.False}function Visit3(left,right){return exports_type.IsTemplateLiteral(left)||exports_type.IsTemplateLiteral(right)?FromTemplateLiteral2(left,right):exports_type.IsRegExp(left)||exports_type.IsRegExp(right)?FromRegExp(left,right):exports_type.IsNot(left)||exports_type.IsNot(right)?FromNot(left,right):exports_type.IsAny(left)?FromAny(left,right):exports_type.IsArray(left)?FromArray4(left,right):exports_type.IsBigInt(left)?FromBigInt(left,right):exports_type.IsBoolean(left)?FromBoolean(left,right):exports_type.IsAsyncIterator(left)?FromAsyncIterator(left,right):exports_type.IsConstructor(left)?FromConstructor(left,right):exports_type.IsDate(left)?FromDate(left,right):exports_type.IsFunction(left)?FromFunction(left,right):exports_type.IsInteger(left)?FromInteger(left,right):exports_type.IsIntersect(left)?FromIntersect4(left,right):exports_type.IsIterator(left)?FromIterator(left,right):exports_type.IsLiteral(left)?FromLiteral2(left,right):exports_type.IsNever(left)?FromNever(left,right):exports_type.IsNull(left)?FromNull(left,right):exports_type.IsNumber(left)?FromNumber(left,right):exports_type.IsObject(left)?FromObject(left,right):exports_type.IsRecord(left)?FromRecord(left,right):exports_type.IsString(left)?FromString(left,right):exports_type.IsSymbol(left)?FromSymbol(left,right):exports_type.IsTuple(left)?FromTuple3(left,right):exports_type.IsPromise(left)?FromPromise2(left,right):exports_type.IsUint8Array(left)?FromUint8Array(left,right):exports_type.IsUndefined(left)?FromUndefined(left,right):exports_type.IsUnion(left)?FromUnion6(left,right):exports_type.IsUnknown(left)?FromUnknown(left,right):exports_type.IsVoid(left)?FromVoid(left,right):Throw(`Unknown left type operand '${left[Kind]}'`)}function ExtendsCheck(left,right){return Visit3(left,right)}var ExtendsResolverError,ExtendsResult;var init_extends_check=__esm(()=>{init_any2();init_function2();init_number2();init_string2();init_unknown2();init_template_literal2();init_patterns();init_symbols2();init_error2();init_guard2();ExtendsResolverError=class ExtendsResolverError extends TypeBoxError{};(function(ExtendsResult2){ExtendsResult2[ExtendsResult2.Union=0]="Union",ExtendsResult2[ExtendsResult2.True=1]="True",ExtendsResult2[ExtendsResult2.False=2]="False"})(ExtendsResult||(ExtendsResult={}))});function FromProperties8(P,Right,True,False,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extends(P[K2],Right,True,False,Clone(options));return Acc}function FromMappedResult6(Left,Right,True,False,options){return FromProperties8(Left.properties,Right,True,False,options)}function ExtendsFromMappedResult(Left,Right,True,False,options){let P=FromMappedResult6(Left,Right,True,False,options);return MappedResult(P)}var init_extends_from_mapped_result=__esm(()=>{init_mapped2();init_extends();init_value()});function ExtendsResolve(left,right,trueType,falseType){let R=ExtendsCheck(left,right);return R===ExtendsResult.Union?Union([trueType,falseType]):R===ExtendsResult.True?trueType:falseType}function Extends(L,R,T,F,options){return IsMappedResult(L)?ExtendsFromMappedResult(L,R,T,F,options):IsMappedKey(L)?CreateType(ExtendsFromMappedKey(L,R,T,F,options)):CreateType(ExtendsResolve(L,R,T,F),options)}var init_extends=__esm(()=>{init_type2();init_union2();init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_kind()});function FromPropertyKey(K,U,L,R,options){return{[K]:Extends(Literal(K),U,L,R,Clone(options))}}function FromPropertyKeys(K,U,L,R,options){return K.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey(LK,U,L,R,options)}},{})}function FromMappedKey2(K,U,L,R,options){return FromPropertyKeys(K.keys,U,L,R,options)}function ExtendsFromMappedKey(T,U,L,R,options){let P=FromMappedKey2(T,U,L,R,options);return MappedResult(P)}var init_extends_from_mapped_key=__esm(()=>{init_mapped2();init_literal2();init_extends();init_value()});function Intersect2(schema){return schema.allOf.every((schema2)=>ExtendsUndefinedCheck(schema2))}function Union2(schema){return schema.anyOf.some((schema2)=>ExtendsUndefinedCheck(schema2))}function Not(schema){return!ExtendsUndefinedCheck(schema.not)}function ExtendsUndefinedCheck(schema){return schema[Kind]==="Intersect"?Intersect2(schema):schema[Kind]==="Union"?Union2(schema):schema[Kind]==="Not"?Not(schema):schema[Kind]==="Undefined"?!0:!1}var init_extends_undefined=__esm(()=>{init_symbols2()});var init_extends2=__esm(()=>{init_extends_check();init_extends_from_mapped_key();init_extends_from_mapped_result();init_extends_undefined();init_extends()});function ExcludeFromTemplateLiteral(L,R){return Exclude(TemplateLiteralToUnion(L),R)}var init_exclude_from_template_literal=__esm(()=>{init_exclude();init_template_literal2()});function ExcludeRest(L,R){let excluded=L.filter((inner)=>ExtendsCheck(inner,R)===ExtendsResult.False);return excluded.length===1?excluded[0]:Union(excluded)}function Exclude(L,R,options={}){if(IsTemplateLiteral(L))return CreateType(ExcludeFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExcludeFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExcludeRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?Never():L,options)}var init_exclude=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_exclude_from_mapped_result();init_exclude_from_template_literal();init_kind()});function FromProperties9(P,U){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Exclude(P[K2],U);return Acc}function FromMappedResult7(R,T){return FromProperties9(R.properties,T)}function ExcludeFromMappedResult(R,T){let P=FromMappedResult7(R,T);return MappedResult(P)}var init_exclude_from_mapped_result=__esm(()=>{init_mapped2();init_exclude()});var init_exclude2=__esm(()=>{init_exclude_from_mapped_result();init_exclude_from_template_literal();init_exclude()});function ExtractFromTemplateLiteral(L,R){return Extract(TemplateLiteralToUnion(L),R)}var init_extract_from_template_literal=__esm(()=>{init_extract();init_template_literal2()});function ExtractRest(L,R){let extracted=L.filter((inner)=>ExtendsCheck(inner,R)!==ExtendsResult.False);return extracted.length===1?extracted[0]:Union(extracted)}function Extract(L,R,options){if(IsTemplateLiteral(L))return CreateType(ExtractFromTemplateLiteral(L,R),options);if(IsMappedResult(L))return CreateType(ExtractFromMappedResult(L,R),options);return CreateType(IsUnion(L)?ExtractRest(L.anyOf,R):ExtendsCheck(L,R)!==ExtendsResult.False?L:Never(),options)}var init_extract=__esm(()=>{init_type2();init_union2();init_never2();init_extends2();init_extract_from_mapped_result();init_extract_from_template_literal();init_kind()});function FromProperties10(P,T){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Extract(P[K2],T);return Acc}function FromMappedResult8(R,T){return FromProperties10(R.properties,T)}function ExtractFromMappedResult(R,T){let P=FromMappedResult8(R,T);return MappedResult(P)}var init_extract_from_mapped_result=__esm(()=>{init_mapped2();init_extract()});var init_extract2=__esm(()=>{init_extract_from_mapped_result();init_extract_from_template_literal();init_extract()});function InstanceType(schema,options){return IsConstructor(schema)?CreateType(schema.returns,options):Never(options)}var init_instance_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_instance_type2=__esm(()=>{init_instance_type()});function ReadonlyOptional(schema){return Readonly(Optional(schema))}var init_readonly_optional=__esm(()=>{init_readonly2();init_optional2()});var init_readonly_optional2=__esm(()=>{init_readonly_optional()});function RecordCreateFromPattern(pattern2,T,options){return CreateType({[Kind]:"Record",type:"object",patternProperties:{[pattern2]:T}},options)}function RecordCreateFromKeys(K,T,options){let result={};for(let K2 of K)result[K2]=T;return Object2(result,{...options,[Hint]:"Record"})}function FromTemplateLiteralKey(K,T,options){return IsTemplateLiteralFinite(K)?RecordCreateFromKeys(IndexPropertyKeys(K),T,options):RecordCreateFromPattern(K.pattern,T,options)}function FromUnionKey(key2,type3,options){return RecordCreateFromKeys(IndexPropertyKeys(Union(key2)),type3,options)}function FromLiteralKey(key2,type3,options){return RecordCreateFromKeys([key2.toString()],type3,options)}function FromRegExpKey(key2,type3,options){return RecordCreateFromPattern(key2.source,type3,options)}function FromStringKey(key2,type3,options){let pattern2=IsUndefined(key2.pattern)?PatternStringExact:key2.pattern;return RecordCreateFromPattern(pattern2,type3,options)}function FromAnyKey(_,type3,options){return RecordCreateFromPattern(PatternStringExact,type3,options)}function FromNeverKey(_key,type3,options){return RecordCreateFromPattern(PatternNeverExact,type3,options)}function FromBooleanKey(_key,type3,options){return Object2({true:type3,false:type3},options)}function FromIntegerKey(_key,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function FromNumberKey(_,type3,options){return RecordCreateFromPattern(PatternNumberExact,type3,options)}function Record(key2,type3,options={}){return IsUnion(key2)?FromUnionKey(key2.anyOf,type3,options):IsTemplateLiteral(key2)?FromTemplateLiteralKey(key2,type3,options):IsLiteral(key2)?FromLiteralKey(key2.const,type3,options):IsBoolean3(key2)?FromBooleanKey(key2,type3,options):IsInteger2(key2)?FromIntegerKey(key2,type3,options):IsNumber3(key2)?FromNumberKey(key2,type3,options):IsRegExp2(key2)?FromRegExpKey(key2,type3,options):IsString3(key2)?FromStringKey(key2,type3,options):IsAny(key2)?FromAnyKey(key2,type3,options):IsNever(key2)?FromNeverKey(key2,type3,options):Never(options)}function RecordPattern(record){return globalThis.Object.getOwnPropertyNames(record.patternProperties)[0]}function RecordKey2(type3){let pattern2=RecordPattern(type3);return pattern2===PatternStringExact?String2():pattern2===PatternNumberExact?Number2():String2({pattern:pattern2})}function RecordValue2(type3){return type3.patternProperties[RecordPattern(type3)]}var init_record=__esm(()=>{init_type2();init_symbols2();init_never2();init_number2();init_object2();init_string2();init_union2();init_template_literal2();init_patterns();init_indexed2();init_kind()});var init_record2=__esm(()=>{init_record()});function FromConstructor2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromFunction2(args,type3){return type3.parameters=FromTypes(args,type3.parameters),type3.returns=FromType(args,type3.returns),type3}function FromIntersect5(args,type3){return type3.allOf=FromTypes(args,type3.allOf),type3}function FromUnion7(args,type3){return type3.anyOf=FromTypes(args,type3.anyOf),type3}function FromTuple4(args,type3){if(IsUndefined(type3.items))return type3;return type3.items=FromTypes(args,type3.items),type3}function FromArray5(args,type3){return type3.items=FromType(args,type3.items),type3}function FromAsyncIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromIterator2(args,type3){return type3.items=FromType(args,type3.items),type3}function FromPromise3(args,type3){return type3.item=FromType(args,type3.item),type3}function FromObject2(args,type3){let mappedProperties=FromProperties11(args,type3.properties);return{...type3,...Object2(mappedProperties)}}function FromRecord2(args,type3){let mappedKey=FromType(args,RecordKey2(type3)),mappedValue=FromType(args,RecordValue2(type3)),result=Record(mappedKey,mappedValue);return{...type3,...result}}function FromArgument(args,argument2){return argument2.index in args?args[argument2.index]:Unknown()}function FromProperty2(args,type3){let isReadonly=IsReadonly(type3),isOptional=IsOptional(type3),mapped2=FromType(args,type3);return isReadonly&&isOptional?ReadonlyOptional(mapped2):isReadonly&&!isOptional?Readonly(mapped2):!isReadonly&&isOptional?Optional(mapped2):mapped2}function FromProperties11(args,properties){return globalThis.Object.getOwnPropertyNames(properties).reduce((result,key2)=>{return{...result,[key2]:FromProperty2(args,properties[key2])}},{})}function FromTypes(args,types17){return types17.map((type3)=>FromType(args,type3))}function FromType(args,type3){return IsConstructor(type3)?FromConstructor2(args,type3):IsFunction3(type3)?FromFunction2(args,type3):IsIntersect(type3)?FromIntersect5(args,type3):IsUnion(type3)?FromUnion7(args,type3):IsTuple(type3)?FromTuple4(args,type3):IsArray3(type3)?FromArray5(args,type3):IsAsyncIterator3(type3)?FromAsyncIterator2(args,type3):IsIterator3(type3)?FromIterator2(args,type3):IsPromise2(type3)?FromPromise3(args,type3):IsObject3(type3)?FromObject2(args,type3):IsRecord(type3)?FromRecord2(args,type3):IsArgument(type3)?FromArgument(args,type3):type3}function Instantiate(type3,args){return FromType(args,CloneType(type3))}var init_instantiate=__esm(()=>{init_type();init_unknown2();init_readonly_optional2();init_readonly2();init_optional2();init_object2();init_record2();init_kind()});var init_instantiate2=__esm(()=>{init_instantiate()});function Integer2(options){return CreateType({[Kind]:"Integer",type:"integer"},options)}var init_integer=__esm(()=>{init_type2();init_symbols2()});var init_integer2=__esm(()=>{init_integer()});function MappedIntrinsicPropertyKey(K,M,options){return{[K]:Intrinsic(Literal(K),M,Clone(options))}}function MappedIntrinsicPropertyKeys(K,M,options){return K.reduce((Acc,L)=>{return{...Acc,...MappedIntrinsicPropertyKey(L,M,options)}},{})}function MappedIntrinsicProperties(T,M,options){return MappedIntrinsicPropertyKeys(T.keys,M,options)}function IntrinsicFromMappedKey(T,M,options){let P=MappedIntrinsicProperties(T,M,options);return MappedResult(P)}var init_intrinsic_from_mapped_key=__esm(()=>{init_mapped2();init_intrinsic();init_literal2();init_value()});function ApplyUncapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toLowerCase(),rest].join("")}function ApplyCapitalize(value2){let[first,rest]=[value2.slice(0,1),value2.slice(1)];return[first.toUpperCase(),rest].join("")}function ApplyUppercase(value2){return value2.toUpperCase()}function ApplyLowercase(value2){return value2.toLowerCase()}function FromTemplateLiteral3(schema,mode,options){let expression=TemplateLiteralParseExact(schema.pattern);if(!IsTemplateLiteralExpressionFinite(expression))return{...schema,pattern:FromLiteralValue(schema.pattern,mode)};let literals=[...TemplateLiteralExpressionGenerate(expression)].map((value2)=>Literal(value2)),mapped2=FromRest5(literals,mode),union3=Union(mapped2);return TemplateLiteral([union3],options)}function FromLiteralValue(value2,mode){return typeof value2==="string"?mode==="Uncapitalize"?ApplyUncapitalize(value2):mode==="Capitalize"?ApplyCapitalize(value2):mode==="Uppercase"?ApplyUppercase(value2):mode==="Lowercase"?ApplyLowercase(value2):value2:value2.toString()}function FromRest5(T,M){return T.map((L)=>Intrinsic(L,M))}function Intrinsic(schema,mode,options={}){return IsMappedKey(schema)?IntrinsicFromMappedKey(schema,mode,options):IsTemplateLiteral(schema)?FromTemplateLiteral3(schema,mode,options):IsUnion(schema)?Union(FromRest5(schema.anyOf,mode),options):IsLiteral(schema)?Literal(FromLiteralValue(schema.const,mode),options):CreateType(schema,options)}var init_intrinsic=__esm(()=>{init_type2();init_template_literal2();init_intrinsic_from_mapped_key();init_literal2();init_union2();init_kind()});function Capitalize(T,options={}){return Intrinsic(T,"Capitalize",options)}var init_capitalize=__esm(()=>{init_intrinsic()});function Lowercase(T,options={}){return Intrinsic(T,"Lowercase",options)}var init_lowercase=__esm(()=>{init_intrinsic()});function Uncapitalize(T,options={}){return Intrinsic(T,"Uncapitalize",options)}var init_uncapitalize=__esm(()=>{init_intrinsic()});function Uppercase(T,options={}){return Intrinsic(T,"Uppercase",options)}var init_uppercase=__esm(()=>{init_intrinsic()});var init_intrinsic2=__esm(()=>{init_capitalize();init_intrinsic_from_mapped_key();init_intrinsic();init_lowercase();init_uncapitalize();init_uppercase()});function FromProperties12(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Omit(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult9(mappedResult,propertyKeys,options){return FromProperties12(mappedResult.properties,propertyKeys,options)}function OmitFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult9(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_omit_from_mapped_result=__esm(()=>{init_mapped2();init_omit();init_value()});function FromIntersect6(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromUnion8(types17,propertyKeys){return types17.map((type3)=>OmitResolve(type3,propertyKeys))}function FromProperty3(properties,key2){let{[key2]:_,...R}=properties;return R}function FromProperties13(properties,propertyKeys){return propertyKeys.reduce((T,K2)=>FromProperty3(T,K2),properties)}function FromObject3(type3,propertyKeys,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties13(properties,propertyKeys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function OmitResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect6(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion8(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject3(type3,propertyKeys,type3.properties):Object2({})}function Omit(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?OmitFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?OmitFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Omit",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Omit",[type3,typeKey],options):CreateType({...OmitResolve(type3,propertyKeys),...options})}var init_omit=__esm(()=>{init_type2();init_symbols();init_computed2();init_literal2();init_indexed2();init_intersect2();init_union2();init_object2();init_omit_from_mapped_key();init_omit_from_mapped_result();init_kind()});function FromPropertyKey2(type3,key2,options){return{[key2]:Omit(type3,[key2],Clone(options))}}function FromPropertyKeys2(type3,propertyKeys,options){return propertyKeys.reduce((Acc,LK)=>{return{...Acc,...FromPropertyKey2(type3,LK,options)}},{})}function FromMappedKey3(type3,mappedKey,options){return FromPropertyKeys2(type3,mappedKey.keys,options)}function OmitFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey3(type3,mappedKey,options);return MappedResult(properties)}var init_omit_from_mapped_key=__esm(()=>{init_mapped2();init_omit();init_value()});var init_omit2=__esm(()=>{init_omit_from_mapped_key();init_omit_from_mapped_result();init_omit()});function FromProperties14(properties,propertyKeys,options){let result={};for(let K2 of globalThis.Object.getOwnPropertyNames(properties))result[K2]=Pick(properties[K2],propertyKeys,Clone(options));return result}function FromMappedResult10(mappedResult,propertyKeys,options){return FromProperties14(mappedResult.properties,propertyKeys,options)}function PickFromMappedResult(mappedResult,propertyKeys,options){let properties=FromMappedResult10(mappedResult,propertyKeys,options);return MappedResult(properties)}var init_pick_from_mapped_result=__esm(()=>{init_mapped2();init_pick();init_value()});function FromIntersect7(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromUnion9(types17,propertyKeys){return types17.map((type3)=>PickResolve(type3,propertyKeys))}function FromProperties15(properties,propertyKeys){let result={};for(let K2 of propertyKeys)if(K2 in properties)result[K2]=properties[K2];return result}function FromObject4(Type,keys,properties){let options=Discard(Type,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties15(properties,keys);return Object2(mappedProperties,options)}function UnionFromPropertyKeys2(propertyKeys){let result=propertyKeys.reduce((result2,key2)=>IsLiteralValue(key2)?[...result2,Literal(key2)]:result2,[]);return Union(result)}function PickResolve(type3,propertyKeys){return IsIntersect(type3)?Intersect(FromIntersect7(type3.allOf,propertyKeys)):IsUnion(type3)?Union(FromUnion9(type3.anyOf,propertyKeys)):IsObject3(type3)?FromObject4(type3,propertyKeys,type3.properties):Object2({})}function Pick(type3,key2,options){let typeKey=IsArray(key2)?UnionFromPropertyKeys2(key2):key2,propertyKeys=IsSchema(key2)?IndexPropertyKeys(key2):key2,isTypeRef=IsRef(type3),isKeyRef=IsRef(key2);return IsMappedResult(type3)?PickFromMappedResult(type3,propertyKeys,options):IsMappedKey(key2)?PickFromMappedKey(type3,key2,options):isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):!isTypeRef&&isKeyRef?Computed("Pick",[type3,typeKey],options):isTypeRef&&!isKeyRef?Computed("Pick",[type3,typeKey],options):CreateType({...PickResolve(type3,propertyKeys),...options})}var init_pick=__esm(()=>{init_type2();init_computed2();init_intersect2();init_literal2();init_object2();init_union2();init_indexed2();init_symbols();init_kind();init_pick_from_mapped_key();init_pick_from_mapped_result()});function FromPropertyKey3(type3,key2,options){return{[key2]:Pick(type3,[key2],Clone(options))}}function FromPropertyKeys3(type3,propertyKeys,options){return propertyKeys.reduce((result,leftKey)=>{return{...result,...FromPropertyKey3(type3,leftKey,options)}},{})}function FromMappedKey4(type3,mappedKey,options){return FromPropertyKeys3(type3,mappedKey.keys,options)}function PickFromMappedKey(type3,mappedKey,options){let properties=FromMappedKey4(type3,mappedKey,options);return MappedResult(properties)}var init_pick_from_mapped_key=__esm(()=>{init_mapped2();init_pick();init_value()});var init_pick2=__esm(()=>{init_pick_from_mapped_key();init_pick_from_mapped_result();init_pick()});function FromComputed3(target2,parameters2){return Computed("Partial",[Computed(target2,parameters2)])}function FromRef3($ref){return Computed("Partial",[Ref($ref)])}function FromProperties16(properties){let partialProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))partialProperties[K]=Optional(properties[K]);return partialProperties}function FromObject5(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties16(properties);return Object2(mappedProperties,options)}function FromRest6(types17){return types17.map((type3)=>PartialResolve(type3))}function PartialResolve(type3){return IsComputed(type3)?FromComputed3(type3.target,type3.parameters):IsRef(type3)?FromRef3(type3.$ref):IsIntersect(type3)?Intersect(FromRest6(type3.allOf)):IsUnion(type3)?Union(FromRest6(type3.anyOf)):IsObject3(type3)?FromObject5(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Partial(type3,options){if(IsMappedResult(type3))return PartialFromMappedResult(type3,options);else return CreateType({...PartialResolve(type3),...options})}var init_partial=__esm(()=>{init_type2();init_computed2();init_optional2();init_object2();init_intersect2();init_union2();init_ref2();init_discard();init_symbols2();init_partial_from_mapped_result();init_kind()});function FromProperties17(K,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(K))Acc[K2]=Partial(K[K2],Clone(options));return Acc}function FromMappedResult11(R,options){return FromProperties17(R.properties,options)}function PartialFromMappedResult(R,options){let P=FromMappedResult11(R,options);return MappedResult(P)}var init_partial_from_mapped_result=__esm(()=>{init_mapped2();init_partial();init_value()});var init_partial2=__esm(()=>{init_partial_from_mapped_result();init_partial()});function FromComputed4(target2,parameters2){return Computed("Required",[Computed(target2,parameters2)])}function FromRef4($ref){return Computed("Required",[Ref($ref)])}function FromProperties18(properties){let requiredProperties={};for(let K of globalThis.Object.getOwnPropertyNames(properties))requiredProperties[K]=Discard(properties[K],[OptionalKind]);return requiredProperties}function FromObject6(type3,properties){let options=Discard(type3,[TransformKind,"$id","required","properties"]),mappedProperties=FromProperties18(properties);return Object2(mappedProperties,options)}function FromRest7(types17){return types17.map((type3)=>RequiredResolve(type3))}function RequiredResolve(type3){return IsComputed(type3)?FromComputed4(type3.target,type3.parameters):IsRef(type3)?FromRef4(type3.$ref):IsIntersect(type3)?Intersect(FromRest7(type3.allOf)):IsUnion(type3)?Union(FromRest7(type3.anyOf)):IsObject3(type3)?FromObject6(type3,type3.properties):IsBigInt3(type3)?type3:IsBoolean3(type3)?type3:IsInteger2(type3)?type3:IsLiteral(type3)?type3:IsNull3(type3)?type3:IsNumber3(type3)?type3:IsString3(type3)?type3:IsSymbol3(type3)?type3:IsUndefined3(type3)?type3:Object2({})}function Required(type3,options){if(IsMappedResult(type3))return RequiredFromMappedResult(type3,options);else return CreateType({...RequiredResolve(type3),...options})}var init_required=__esm(()=>{init_type2();init_computed2();init_object2();init_intersect2();init_union2();init_ref2();init_symbols2();init_discard();init_required_from_mapped_result();init_kind()});function FromProperties19(P,options){let Acc={};for(let K2 of globalThis.Object.getOwnPropertyNames(P))Acc[K2]=Required(P[K2],options);return Acc}function FromMappedResult12(R,options){return FromProperties19(R.properties,options)}function RequiredFromMappedResult(R,options){let P=FromMappedResult12(R,options);return MappedResult(P)}var init_required_from_mapped_result=__esm(()=>{init_mapped2();init_required()});var init_required2=__esm(()=>{init_required_from_mapped_result();init_required()});function DereferenceParameters(moduleProperties,types17){return types17.map((type3)=>{return IsRef(type3)?Dereference(moduleProperties,type3.$ref):FromType2(moduleProperties,type3)})}function Dereference(moduleProperties,ref2){return ref2 in moduleProperties?IsRef(moduleProperties[ref2])?Dereference(moduleProperties,moduleProperties[ref2].$ref):FromType2(moduleProperties,moduleProperties[ref2]):Never()}function FromAwaited(parameters2){return Awaited(parameters2[0])}function FromIndex(parameters2){return Index(parameters2[0],parameters2[1])}function FromKeyOf(parameters2){return KeyOf(parameters2[0])}function FromPartial(parameters2){return Partial(parameters2[0])}function FromOmit(parameters2){return Omit(parameters2[0],parameters2[1])}function FromPick(parameters2){return Pick(parameters2[0],parameters2[1])}function FromRequired(parameters2){return Required(parameters2[0])}function FromComputed5(moduleProperties,target2,parameters2){let dereferenced=DereferenceParameters(moduleProperties,parameters2);return target2==="Awaited"?FromAwaited(dereferenced):target2==="Index"?FromIndex(dereferenced):target2==="KeyOf"?FromKeyOf(dereferenced):target2==="Partial"?FromPartial(dereferenced):target2==="Omit"?FromOmit(dereferenced):target2==="Pick"?FromPick(dereferenced):target2==="Required"?FromRequired(dereferenced):Never()}function FromArray6(moduleProperties,type3){return Array2(FromType2(moduleProperties,type3))}function FromAsyncIterator3(moduleProperties,type3){return AsyncIterator2(FromType2(moduleProperties,type3))}function FromConstructor3(moduleProperties,parameters2,instanceType){return Constructor(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,instanceType))}function FromFunction3(moduleProperties,parameters2,returnType){return Function2(FromTypes2(moduleProperties,parameters2),FromType2(moduleProperties,returnType))}function FromIntersect8(moduleProperties,types17){return Intersect(FromTypes2(moduleProperties,types17))}function FromIterator3(moduleProperties,type3){return Iterator2(FromType2(moduleProperties,type3))}function FromObject7(moduleProperties,properties){return Object2(globalThis.Object.keys(properties).reduce((result,key2)=>{return{...result,[key2]:FromType2(moduleProperties,properties[key2])}},{}))}function FromRecord3(moduleProperties,type3){let[value2,pattern2]=[FromType2(moduleProperties,RecordValue2(type3)),RecordPattern(type3)],result=CloneType(type3);return result.patternProperties[pattern2]=value2,result}function FromTransform(moduleProperties,transform){return IsRef(transform)?{...Dereference(moduleProperties,transform.$ref),[TransformKind]:transform[TransformKind]}:transform}function FromTuple5(moduleProperties,types17){return Tuple(FromTypes2(moduleProperties,types17))}function FromUnion10(moduleProperties,types17){return Union(FromTypes2(moduleProperties,types17))}function FromTypes2(moduleProperties,types17){return types17.map((type3)=>FromType2(moduleProperties,type3))}function FromType2(moduleProperties,type3){return IsOptional(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[OptionalKind])),type3):IsReadonly(type3)?CreateType(FromType2(moduleProperties,Discard(type3,[ReadonlyKind])),type3):IsTransform(type3)?CreateType(FromTransform(moduleProperties,type3),type3):IsArray3(type3)?CreateType(FromArray6(moduleProperties,type3.items),type3):IsAsyncIterator3(type3)?CreateType(FromAsyncIterator3(moduleProperties,type3.items),type3):IsComputed(type3)?CreateType(FromComputed5(moduleProperties,type3.target,type3.parameters)):IsConstructor(type3)?CreateType(FromConstructor3(moduleProperties,type3.parameters,type3.returns),type3):IsFunction3(type3)?CreateType(FromFunction3(moduleProperties,type3.parameters,type3.returns),type3):IsIntersect(type3)?CreateType(FromIntersect8(moduleProperties,type3.allOf),type3):IsIterator3(type3)?CreateType(FromIterator3(moduleProperties,type3.items),type3):IsObject3(type3)?CreateType(FromObject7(moduleProperties,type3.properties),type3):IsRecord(type3)?CreateType(FromRecord3(moduleProperties,type3)):IsTuple(type3)?CreateType(FromTuple5(moduleProperties,type3.items||[]),type3):IsUnion(type3)?CreateType(FromUnion10(moduleProperties,type3.anyOf),type3):type3}function ComputeType(moduleProperties,key2){return key2 in moduleProperties?FromType2(moduleProperties,moduleProperties[key2]):Never()}function ComputeModuleProperties(moduleProperties){return globalThis.Object.getOwnPropertyNames(moduleProperties).reduce((result,key2)=>{return{...result,[key2]:ComputeType(moduleProperties,key2)}},{})}var init_compute=__esm(()=>{init_create();init_clone();init_discard();init_array2();init_awaited2();init_async_iterator2();init_constructor2();init_indexed2();init_function2();init_intersect2();init_iterator2();init_keyof2();init_object2();init_omit2();init_pick2();init_never2();init_partial2();init_record2();init_required2();init_tuple2();init_union2();init_symbols2();init_kind()});class TModule{constructor($defs){let computed2=ComputeModuleProperties($defs),identified=this.WithIdentifiers(computed2);this.$defs=identified}Import(key2,options){let $defs={...this.$defs,[key2]:CreateType(this.$defs[key2],options)};return CreateType({[Kind]:"Import",$defs,$ref:key2})}WithIdentifiers($defs){return globalThis.Object.getOwnPropertyNames($defs).reduce((result,key2)=>{return{...result,[key2]:{...$defs[key2],$id:key2}}},{})}}function Module(properties){return new TModule(properties)}var init_module=__esm(()=>{init_create();init_symbols2();init_compute()});var init_module2=__esm(()=>{init_module()});function Not2(type3,options){return CreateType({[Kind]:"Not",not:type3},options)}var init_not=__esm(()=>{init_type2();init_symbols2()});var init_not2=__esm(()=>{init_not()});function Parameters(schema,options){return IsFunction3(schema)?Tuple(schema.parameters,options):Never()}var init_parameters2=__esm(()=>{init_tuple2();init_never2();init_kind()});var init_parameters3=__esm(()=>{init_parameters2()});function Recursive(callback,options={}){if(IsUndefined(options.$id))options.$id=`T${Ordinal++}`;let thisType=CloneType(callback({[Kind]:"This",$ref:`${options.$id}`}));return thisType.$id=options.$id,CreateType({[Hint]:"Recursive",...thisType},options)}var Ordinal=0;var init_recursive=__esm(()=>{init_type();init_type2();init_symbols2()});var init_recursive2=__esm(()=>{init_recursive()});function RegExp2(unresolved,options){let expr=IsString(unresolved)?new globalThis.RegExp(unresolved):unresolved;return CreateType({[Kind]:"RegExp",type:"RegExp",source:expr.source,flags:expr.flags},options)}var init_regexp=__esm(()=>{init_type2();init_symbols2()});var init_regexp2=__esm(()=>{init_regexp()});function RestResolve(T){return IsIntersect(T)?T.allOf:IsUnion(T)?T.anyOf:IsTuple(T)?T.items??[]:[]}function Rest(T){return RestResolve(T)}var init_rest=__esm(()=>{init_kind()});var init_rest2=__esm(()=>{init_rest()});function ReturnType(schema,options){return IsFunction3(schema)?CreateType(schema.returns,options):Never(options)}var init_return_type=__esm(()=>{init_type2();init_never2();init_kind()});var init_return_type2=__esm(()=>{init_return_type()});var init_anyschema=()=>{};var init_schema3=()=>{};var init_schema4=__esm(()=>{init_anyschema();init_schema3()});var init_static=()=>{};var init_static2=__esm(()=>{init_static()});class TransformDecodeBuilder{constructor(schema2){this.schema=schema2}Decode(decode3){return new TransformEncodeBuilder(this.schema,decode3)}}class TransformEncodeBuilder{constructor(schema2,decode3){this.schema=schema2,this.decode=decode3}EncodeTransform(encode4,schema2){let Codec={Encode:(value2)=>schema2[TransformKind].Encode(encode4(value2)),Decode:(value2)=>this.decode(schema2[TransformKind].Decode(value2))};return{...schema2,[TransformKind]:Codec}}EncodeSchema(encode4,schema2){let Codec={Decode:this.decode,Encode:encode4};return{...schema2,[TransformKind]:Codec}}Encode(encode4){return IsTransform(this.schema)?this.EncodeTransform(encode4,this.schema):this.EncodeSchema(encode4,this.schema)}}function Transform(schema2){return new TransformDecodeBuilder(schema2)}var init_transform=__esm(()=>{init_symbols2();init_kind()});var init_transform2=__esm(()=>{init_transform()});function Unsafe(options={}){return CreateType({[Kind]:options[Kind]??"Unsafe"},options)}var init_unsafe=__esm(()=>{init_type2();init_symbols2()});var init_unsafe2=__esm(()=>{init_unsafe()});function Void(options){return CreateType({[Kind]:"Void",type:"void"},options)}var init_void=__esm(()=>{init_type2();init_symbols2()});var init_void2=__esm(()=>{init_void()});var exports_type3={};__export(exports_type3,{Void:()=>Void,Uppercase:()=>Uppercase,Unsafe:()=>Unsafe,Unknown:()=>Unknown,Union:()=>Union,Undefined:()=>Undefined,Uncapitalize:()=>Uncapitalize,Uint8Array:()=>Uint8Array2,Tuple:()=>Tuple,Transform:()=>Transform,TemplateLiteral:()=>TemplateLiteral,Symbol:()=>Symbol2,String:()=>String2,ReturnType:()=>ReturnType,Rest:()=>Rest,Required:()=>Required,RegExp:()=>RegExp2,Ref:()=>Ref,Recursive:()=>Recursive,Record:()=>Record,ReadonlyOptional:()=>ReadonlyOptional,Readonly:()=>Readonly,Promise:()=>Promise2,Pick:()=>Pick,Partial:()=>Partial,Parameters:()=>Parameters,Optional:()=>Optional,Omit:()=>Omit,Object:()=>Object2,Number:()=>Number2,Null:()=>Null2,Not:()=>Not2,Never:()=>Never,Module:()=>Module,Mapped:()=>Mapped,Lowercase:()=>Lowercase,Literal:()=>Literal,KeyOf:()=>KeyOf,Iterator:()=>Iterator2,Intersect:()=>Intersect,Integer:()=>Integer2,Instantiate:()=>Instantiate,InstanceType:()=>InstanceType,Index:()=>Index,Function:()=>Function2,Extract:()=>Extract,Extends:()=>Extends,Exclude:()=>Exclude,Enum:()=>Enum,Date:()=>Date2,ConstructorParameters:()=>ConstructorParameters,Constructor:()=>Constructor,Const:()=>Const,Composite:()=>Composite,Capitalize:()=>Capitalize,Boolean:()=>Boolean3,BigInt:()=>BigInt2,Awaited:()=>Awaited,AsyncIterator:()=>AsyncIterator2,Array:()=>Array2,Argument:()=>Argument,Any:()=>Any2});var init_type5=__esm(()=>{init_any2();init_argument2();init_array2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_intrinsic2();init_iterator2();init_keyof2();init_literal2();init_mapped2();init_module2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2()});var Type;var init_type6=__esm(()=>{init_type5();Type=exports_type3});var init_esm3=__esm(()=>{init_clone();init_create();init_error2();init_guard2();init_helpers2();init_patterns();init_registry4();init_sets();init_symbols2();init_any2();init_array2();init_argument2();init_async_iterator2();init_awaited2();init_bigint2();init_boolean2();init_composite2();init_const2();init_constructor2();init_constructor_parameters2();init_date2();init_enum2();init_exclude2();init_extends2();init_extract2();init_function2();init_indexed2();init_instance_type2();init_instantiate2();init_integer2();init_intersect2();init_iterator2();init_intrinsic2();init_keyof2();init_literal2();init_module2();init_mapped2();init_never2();init_not2();init_null2();init_number2();init_object2();init_omit2();init_optional2();init_parameters3();init_partial2();init_pick2();init_promise2();init_readonly2();init_readonly_optional2();init_record2();init_recursive2();init_ref2();init_regexp2();init_required2();init_rest2();init_return_type2();init_schema4();init_static2();init_string2();init_symbol2();init_template_literal2();init_transform2();init_tuple2();init_uint8array2();init_undefined2();init_union2();init_unknown2();init_unsafe2();init_void2();init_type6()});function isEmailExempt(email,exemptDomains){if(!exemptDomains||exemptDomains.length===0)return!1;let domain=email.split("@")[1]?.toLowerCase();if(!domain)return!1;return exemptDomains.some((d)=>domain===d.toLowerCase()||domain.endsWith(`.${d.toLowerCase()}`))}function normalizeTrustedOrigins(raw,env=process.env){if(Array.isArray(raw))return raw.length>0?raw:void 0;if(typeof raw!=="string"||!raw.trim())return;let trimmed=raw.trim(),fromEnv=env[trimmed],isEnvName=/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed),list2=(fromEnv??(isEnvName?"":trimmed)).split(/[,;\s]+/).map((entry)=>entry.trim().replace(/\/+$/,"")).filter(Boolean);return list2.length>0?list2:void 0}function pickTrustedOrigin(candidate,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]];if(candidate&&isOriginTrusted(candidate.replace(/\/+$/,""),trusted))return candidate.replace(/\/+$/,"");return fallbackOrigin}function resolveAppOrigin(request,fallbackUrl,allowedOrigins){let fallbackOrigin="";if(fallbackUrl)try{fallbackOrigin=new URL(fallbackUrl).origin}catch{}let trusted=[...fallbackOrigin?[fallbackOrigin]:[],...allowedOrigins??[]],candidates=[],appOrigin=request.headers.get("x-app-origin");if(appOrigin)candidates.push(appOrigin.replace(/\/+$/,""));let origin=request.headers.get("origin");if(origin)candidates.push(origin.replace(/\/+$/,""));let forwardedHost=request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();if(forwardedHost){let proto=request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()||"https";candidates.push(`${proto}://${forwardedHost}`)}for(let candidate of candidates)if(isOriginTrusted(candidate,trusted))return candidate;return fallbackOrigin}function extractConfiguredPath(configuredUrl,defaultPath){if(!configuredUrl)return defaultPath;try{return new URL(configuredUrl).pathname}catch{return configuredUrl.startsWith("/")?configuredUrl:defaultPath}}function buildEmailActionLink(params){let{request,configuredUrl,path,query,allowedOrigins}=params,origin=resolveAppOrigin(request,configuredUrl,allowedOrigins),normalizedPath=path.startsWith("/")?path:`/${path}`,queryString=new URLSearchParams(query).toString();return`${origin}${normalizedPath}${queryString?`?${queryString}`:""}`}var originHost=(value2)=>{try{return new URL(value2).host.toLowerCase()}catch{return value2.includes("://")?null:value2.toLowerCase().replace(/[/?#].*$/,"")||null}},isOriginTrusted=(candidate,trusted)=>{let candHost=originHost(candidate);if(!candHost)return!1;for(let entry of trusted){let tHost=originHost(entry);if(!tHost)continue;if(tHost.startsWith("*.")){let base=tHost.slice(2);if(candHost===base||candHost.endsWith(`.${base}`))return!0}else if(candHost===tHost)return!0}return!1};var{password:password3}=globalThis.Bun;async function verifyPassword(plainPassword,hashedPassword){try{return await password3.verify(plainPassword,hashedPassword)}catch{return!1}}function labelFromRawUserAgent(userAgent){let ua=(userAgent??"").trim(),lower=ua.toLowerCase();if(!ua||lower==="unknown"||lower==="unknown browser")return;let meaningful=(ua.match(/[A-Za-z][A-Za-z0-9._-]*\/[0-9][^\s;)]*/g)??[]).find((t)=>!/^mozilla\//i.test(t));if(meaningful)return meaningful.split("/")[0];return ua.match(/[A-Za-z][A-Za-z0-9 ._-]{2,}/)?.[0]?.trim()||void 0}function parseUserAgentForLogin(userAgent,ipAddress,deviceHint,clientHints){let ua=userAgent.toLowerCase(),headlessIndicators=["headlesschrome","headless","phantomjs","nightmare","selenium","webdriver","puppeteer","playwright"],botIndicators=["bot","crawler","spider","scraper","curl","wget","python-requests","python-urllib","java/","httpclient","go-http-client","node-fetch","axios","postman","insomnia","httpie"],isHeadless=headlessIndicators.some((indicator)=>ua.includes(indicator)),isBot=botIndicators.some((indicator)=>ua.includes(indicator)),isSuspicious=isHeadless||isBot,suspiciousPatterns=[];if(isHeadless)suspiciousPatterns.push("headless_browser");if(isBot)suspiciousPatterns.push("bot_user_agent");if(!ua||ua.length<10)suspiciousPatterns.push("missing_or_short_ua");if(ua==="mozilla/5.0")suspiciousPatterns.push("generic_ua");if(ua.includes("nucleusserveraction")||ua.includes("serveraction"))suspiciousPatterns.push("server_action");let deviceType="unknown";if(ua.includes("ipad"))deviceType="tablet";else if(ua.includes("iphone"))deviceType="mobile";else if(ua.includes("macintosh")||ua.includes("windows")&&!ua.includes("windows phone")||ua.includes("linux")&&!ua.includes("android"))deviceType="desktop";else if(ua.includes("tablet")||ua.includes("android")&&ua.includes("tablet"))deviceType="tablet";else if(ua.includes("mobile")||ua.includes("android"))deviceType="mobile";let browserName,browserVersion;if(isHeadless)browserName="Headless Browser";else if(isBot)browserName="Bot/Crawler";else if(ua.includes("edg")){browserName="Edge";let match=userAgent.match(/Edg\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("opr/")||ua.includes("opera")){browserName="Opera";let match=userAgent.match(/OPR\/(\d+\.\d+)/i)||userAgent.match(/Opera\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("samsungbrowser")){browserName="Samsung Internet";let match=userAgent.match(/SamsungBrowser\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("crios")){browserName="Chrome";let match=userAgent.match(/CriOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("fxios")){browserName="Firefox";let match=userAgent.match(/FxiOS\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("chrome")){browserName="Chrome";let match=userAgent.match(/Chrome\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("firefox")){browserName="Firefox";let match=userAgent.match(/Firefox\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}else if(ua.includes("safari")){browserName="Safari";let match=userAgent.match(/Version\/(\d+\.\d+)/i);if(match?.[1])browserVersion=match[1]}let osName,osVersion;if(ua.includes("windows nt 10"))osName="Windows",osVersion="10/11";else if(ua.includes("windows nt"))osName="Windows";else if(ua.includes("iphone")||ua.includes("ipad")){osName="iOS";let match=userAgent.match(/OS (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("mac os x")){osName="macOS";let match=userAgent.match(/Mac OS X (\d+[._]\d+)/i);if(match?.[1])osVersion=match[1].replace("_",".")}else if(ua.includes("android")){osName="Android";let match=userAgent.match(/Android (\d+\.?\d*)/i);if(match?.[1])osVersion=match[1]}else if(ua.includes("linux"))osName="Linux";if(!browserName&&clientHints?.uaHeader){let brands=[...clientHints.uaHeader.matchAll(/"([^"]+)";v="([^"]+)"/g)].map((m)=>({brand:m[1]??"",version:m[2]??""})).filter((b)=>b.brand&&!/not.?a.?brand/i.test(b.brand)),preferred=brands.find((b)=>/google chrome|microsoft edge|opera|firefox|safari/i.test(b.brand))??brands.find((b)=>!/chromium/i.test(b.brand))??brands[0];if(preferred)browserName=preferred.brand.replace(/^Google /,"").replace(/^Microsoft /,""),browserVersion=preferred.version}if(!osName&&clientHints?.platformHeader)osName=clientHints.platformHeader.replace(/"/g,"").trim()||osName;if(deviceType==="unknown"&&clientHints?.mobileHeader==="?1")deviceType="mobile";return{deviceName:browserName&&osName?`${browserName} on ${osName}`:browserName?browserName:osName?osName:deviceType!=="unknown"?deviceType.charAt(0).toUpperCase()+deviceType.slice(1):labelFromRawUserAgent(userAgent)??"Unknown Device",deviceType,browserName,browserVersion,osName,osVersion,ipAddress,userAgent,deviceHint,locationCountry:void 0,locationCity:void 0,isHeadless,isBot,isSuspicious,suspiciousPatterns}}var init_utils7=()=>{};function deviceContextFromRequest(request){let rawFwd=request.headers.get("x-forwarded-for")?.split(",")[0]?.trim(),isPrivate=(ip)=>!ip||ip==="127.0.0.1"||ip==="::1"||ip==="localhost"||ip.startsWith("10.")||ip.startsWith("192.168.")||ip.startsWith("172.");return{ipAddress:request.headers.get("cf-connecting-ip")?.trim()||request.headers.get("true-client-ip")?.trim()||(!isPrivate(rawFwd)?rawFwd:void 0)||request.headers.get("x-real-ip")?.trim()||rawFwd||"127.0.0.1",userAgent:request.headers.get("user-agent")||"",clientHints:{uaHeader:request.headers.get("sec-ch-ua")??void 0,platformHeader:request.headers.get("sec-ch-ua-platform")??void 0,mobileHeader:request.headers.get("sec-ch-ua-mobile")??void 0}}}function ensureDeviceInfo(info,clientHints){if(info.browserName&&info.osName&&info.deviceName)return info;let parsed=info.userAgent?parseUserAgentForLogin(info.userAgent,info.ipAddress,info.deviceHint,clientHints):void 0;return{ipAddress:info.ipAddress,userAgent:info.userAgent,deviceHint:info.deviceHint,deviceName:info.deviceName??parsed?.deviceName??"Unknown Device",deviceType:info.deviceType&&info.deviceType!=="unknown"?info.deviceType:parsed?.deviceType??info.deviceType??"unknown",browserName:info.browserName??parsed?.browserName,browserVersion:info.browserVersion??parsed?.browserVersion,osName:info.osName??parsed?.osName,osVersion:info.osVersion??parsed?.osVersion,locationCountry:info.locationCountry,locationCity:info.locationCity}}var init_deviceInfo=__esm(()=>{init_utils7()});function boundedStream(source,limit){if(limit<=0)return new ReadableStream({start(controller){controller.close()},cancel:()=>source.cancel().catch(()=>{})});let reader=source.getReader(),sent=0;return new ReadableStream({async pull(controller){while(sent<limit){let{done,value:value2}=await reader.read();if(done){controller.close();return}if(!value2||value2.byteLength===0)continue;let remaining=limit-sent;if(value2.byteLength<=remaining)sent+=value2.byteLength,controller.enqueue(value2);else controller.enqueue(value2.subarray(0,remaining)),sent=limit;if(sent>=limit){controller.close(),reader.cancel().catch(()=>{});return}return}controller.close()},cancel(reason){return reader.cancel(reason).catch(()=>{})}})}import{randomUUID as randomUUID5}from"crypto";import path from"path";function unboundedIfZero(value2){return Number.isFinite(value2)&&value2>0?value2:Number.POSITIVE_INFINITY}function mergeStorageConfig(config){if(!config)return DEFAULT_STORAGE_CONFIG;return{enabled:config.enabled??DEFAULT_STORAGE_CONFIG.enabled,basePath:config.basePath??DEFAULT_STORAGE_CONFIG.basePath,maxFileSizeBytes:unboundedIfZero(config.maxFileSizeBytes??DEFAULT_STORAGE_CONFIG.maxFileSizeBytes),allowedMimeTypes:config.allowedMimeTypes??DEFAULT_STORAGE_CONFIG.allowedMimeTypes,blockedMimeTypes:config.blockedMimeTypes??DEFAULT_STORAGE_CONFIG.blockedMimeTypes,formData:{filesField:config.formData?.filesField??DEFAULT_STORAGE_CONFIG.formData.filesField,dataField:config.formData?.dataField??DEFAULT_STORAGE_CONFIG.formData.dataField,maxFiles:unboundedIfZero(config.formData?.maxFiles??DEFAULT_STORAGE_CONFIG.formData.maxFiles)}}}function normalizeMimeType(mimeType){return(mimeType??"").split(";")[0]?.trim().toLowerCase()??""}function isMimeTypeListed(list2,mimeType){if(!list2||list2.length===0)return!1;let normalized=normalizeMimeType(mimeType);if(!normalized)return!1;return list2.some((entry)=>normalizeMimeType(entry)===normalized)}function parseFormDataBody(body,config){let result={data:{},files:[]};if(!body||typeof body!=="object")return result;let bodyObj=body,dataField=bodyObj[config.formData.dataField];if(dataField){if(typeof dataField==="string")try{result.data=JSON.parse(dataField)}catch{result.data={}}else if(typeof dataField==="object")result.data=dataField}let filesField=bodyObj[config.formData.filesField];if(filesField){if(filesField instanceof File)result.files=[filesField];else if(Array.isArray(filesField))result.files=filesField.filter((f)=>f instanceof File)}return result}function validateFile(file,config){if(file.size>config.maxFileSizeBytes)return{valid:!1,error:`File ${file.name} exceeds maximum size of ${config.maxFileSizeBytes} bytes`,rejected:!0};if(isMimeTypeListed(config.blockedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not allowed`,rejected:!0};if(config.allowedMimeTypes.length>0&&!isMimeTypeListed(config.allowedMimeTypes,file.type))return{valid:!1,error:`File type ${file.type} is not in allowed list`,rejected:!0};return{valid:!0}}function setStorageProvider(provider){activeStorageProvider=provider}function getStorageProvider(){return activeStorageProvider}async function uploadFile(file,config,subFolder){let id=randomUUID5(),ext=path.extname(file.name),uniqueName=`${id}${ext}`,folderPath=subFolder?path.join(config.basePath,subFolder):config.basePath,provider=activeStorageProvider;if(provider&&provider.kind!=="local"){let relative=subFolder?`${subFolder}/${uniqueName}`:uniqueName;await provider.write(relative,new Uint8Array(await file.arrayBuffer()))}else await fileManager.createFile({dir:folderPath,name:uniqueName,data:file,options:{type:file.type,createDir:!0}});return{id,name:uniqueName,originalName:file.name,path:folderPath,mimeType:file.type,size:file.size,createdAt:new Date}}async function uploadFiles(files,config,subFolder){let success=[],failed=[];for(let file of files.slice(0,config.formData.maxFiles)){let validation=validateFile(file,config);if(!validation.valid){failed.push({file:file.name,error:validation.error||"Unknown error",rejected:validation.rejected===!0});continue}try{let result=await uploadFile(file,config,subFolder);success.push(result)}catch(error3){failed.push({file:file.name,error:error3 instanceof Error?error3.message:"Upload failed"})}}return{success,failed}}function isPathWithinBase(base,target2){let resolvedBase=path.resolve(base),resolvedTarget=path.resolve(target2);return resolvedTarget===resolvedBase||resolvedTarget.startsWith(resolvedBase+path.sep)}async function deleteFile(filePath,fileName,storageBase){try{let fullPath=path.join(filePath,fileName);if(storageBase&&!isPathWithinBase(storageBase,fullPath))return!1;let provider=activeStorageProvider;if(provider&&provider.kind!=="local"&&storageBase)return await provider.delete(path.relative(storageBase,fullPath));return await fileManager.deleteFile(fullPath)}catch{return!1}}var DEFAULT_STORAGE_CONFIG,activeStorageProvider=null;var init_helpers3=__esm(()=>{init_File();DEFAULT_STORAGE_CONFIG={enabled:!1,basePath:"./uploads",maxFileSizeBytes:104857600,allowedMimeTypes:[],blockedMimeTypes:["application/x-executable","application/x-msdos-program","text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/x-httpd-php"],formData:{filesField:"files",dataField:"data",maxFiles:10}}});import{readFileSync as readFileSync4}from"fs";import*as os3 from"os";function parseCpuMax(raw){if(!raw)return null;let[quota,period]=raw.trim().split(/\s+/);if(!quota||quota==="max")return null;let q=Number(quota),p=Number(period??"100000");if(!Number.isFinite(q)||!Number.isFinite(p)||p<=0||q<=0)return null;return q/p}function parseCpuV1(quotaRaw,periodRaw){let q=Number((quotaRaw??"").trim()),p=Number((periodRaw??"").trim());if(!Number.isFinite(q)||q<=0||!Number.isFinite(p)||p<=0)return null;return q/p}function read(path2){try{return readFileSync4(path2,"utf8")}catch{return null}}function cpuBudget(sources={}){let cores=sources.cores??os3.cpus().length??1,limit=parseCpuMax(sources.cpuMax??read("/sys/fs/cgroup/cpu.max"))??parseCpuV1(sources.v1Quota??read("/sys/fs/cgroup/cpu/cpu.cfs_quota_us"),sources.v1Period??read("/sys/fs/cgroup/cpu/cpu.cfs_period_us"));if(limit===null)return Math.max(1,cores);return Math.max(1,Math.min(cores,Math.ceil(limit)))}var init_cpuBudget=()=>{};var require_is=__commonJS((exports,module3)=>{var defined=function(val){return typeof val<"u"&&val!==null},object3=function(val){return typeof val==="object"},plainObject=function(val){return Object.prototype.toString.call(val)==="[object Object]"},fn=function(val){return typeof val==="function"},bool=function(val){return typeof val==="boolean"},buffer=function(val){return val instanceof Buffer},typedArray=function(val){if(defined(val))switch(val.constructor){case Uint8Array:case Uint8ClampedArray:case Int8Array:case Uint16Array:case Int16Array:case Uint32Array:case Int32Array:case Float32Array:case Float64Array:return!0}return!1},arrayBuffer=function(val){return val instanceof ArrayBuffer},string3=function(val){return typeof val==="string"&&val.length>0},number3=function(val){return typeof val==="number"&&!Number.isNaN(val)},integer3=function(val){return Number.isInteger(val)},inRange=function(val,min,max){return val>=min&&val<=max},inArray11=function(val,list2){return list2.includes(val)},invalidParameterError=function(name2,expected,actual){return Error(`Expected ${expected} for ${name2} but received ${actual} of type ${typeof actual}`)},nativeError=function(native,context){return context.message=native.message,context};module3.exports={defined,object:object3,plainObject,fn,bool,buffer,typedArray,arrayBuffer,string:string3,number:number3,integer:integer3,inRange,inArray:inArray11,invalidParameterError,nativeError}});var require_process=__commonJS((exports,module3)=>{var isLinux=()=>process.platform==="linux",report=null,getReport=()=>{if(!report)if(isLinux()&&process.report){let orig=process.report.excludeNetwork;process.report.excludeNetwork=!0,report=process.report.getReport(),process.report.excludeNetwork=orig}else report={};return report};module3.exports={isLinux,getReport}});var require_filesystem=__commonJS((exports,module3)=>{var fs3=__require("fs"),readFileSync5=(path2)=>{let fd=fs3.openSync(path2,"r"),buffer=Buffer.alloc(2048),bytesRead=fs3.readSync(fd,buffer,0,2048,0);return fs3.close(fd,()=>{}),buffer.subarray(0,bytesRead)},readFile2=(path2)=>new Promise((resolve2,reject)=>{fs3.open(path2,"r",(err,fd)=>{if(err)reject(err);else{let buffer=Buffer.alloc(2048);fs3.read(fd,buffer,0,2048,0,(_,bytesRead)=>{resolve2(buffer.subarray(0,bytesRead)),fs3.close(fd,()=>{})})}})});module3.exports={LDD_PATH:"/usr/bin/ldd",SELF_PATH:"/proc/self/exe",readFileSync:readFileSync5,readFile:readFile2}});var require_elf=__commonJS((exports,module3)=>{var interpreterPath=(elf)=>{if(elf.length<64)return null;if(elf.readUInt32BE(0)!==2135247942)return null;if(elf.readUInt8(4)!==2)return null;if(elf.readUInt8(5)!==1)return null;let offset=elf.readUInt32LE(32),size=elf.readUInt16LE(54),count2=elf.readUInt16LE(56);for(let i=0;i<count2;i++){let headerOffset=offset+i*size;if(elf.readUInt32LE(headerOffset)===3){let fileOffset=elf.readUInt32LE(headerOffset+8),fileSize=elf.readUInt32LE(headerOffset+32);return elf.subarray(fileOffset,fileOffset+fileSize).toString().replace(/\0.*$/g,"")}}return null};module3.exports={interpreterPath}});var require_detect_libc=__commonJS((exports,module3)=>{var childProcess=__require("child_process"),{isLinux,getReport}=require_process(),{LDD_PATH,SELF_PATH,readFile:readFile2,readFileSync:readFileSync5}=require_filesystem(),{interpreterPath}=require_elf(),cachedFamilyInterpreter,cachedFamilyFilesystem,cachedVersionFilesystem,commandOut="",safeCommand=()=>{if(!commandOut)return new Promise((resolve2)=>{childProcess.exec("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",(err,out)=>{commandOut=err?" ":out,resolve2(commandOut)})});return commandOut},safeCommandSync=()=>{if(!commandOut)try{commandOut=childProcess.execSync("getconf GNU_LIBC_VERSION 2>&1 || true; ldd --version 2>&1 || true",{encoding:"utf8"})}catch(_err){commandOut=" "}return commandOut},GLIBC="glibc",RE_GLIBC_VERSION=/LIBC[a-z0-9 \-).]*?(\d+\.\d+)/i,MUSL="musl",isFileMusl=(f)=>f.includes("libc.musl-")||f.includes("ld-musl-"),familyFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return GLIBC;if(Array.isArray(report.sharedObjects)){if(report.sharedObjects.some(isFileMusl))return MUSL}return null},familyFromCommand=(out)=>{let[getconf,ldd1]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return GLIBC;if(ldd1&&ldd1.includes(MUSL))return MUSL;return null},familyFromInterpreterPath=(path2)=>{if(path2){if(path2.includes("/ld-musl-"))return MUSL;else if(path2.includes("/ld-linux-"))return GLIBC}return null},getFamilyFromLddContent=(content)=>{if(content=content.toString(),content.includes("musl"))return MUSL;if(content.includes("GNU C Library"))return GLIBC;return null},familyFromFilesystem=async()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=await readFile2(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromFilesystemSync=()=>{if(cachedFamilyFilesystem!==void 0)return cachedFamilyFilesystem;cachedFamilyFilesystem=null;try{let lddContent=readFileSync5(LDD_PATH);cachedFamilyFilesystem=getFamilyFromLddContent(lddContent)}catch(e){}return cachedFamilyFilesystem},familyFromInterpreter=async()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=await readFile2(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},familyFromInterpreterSync=()=>{if(cachedFamilyInterpreter!==void 0)return cachedFamilyInterpreter;cachedFamilyInterpreter=null;try{let selfContent=readFileSync5(SELF_PATH),path2=interpreterPath(selfContent);cachedFamilyInterpreter=familyFromInterpreterPath(path2)}catch(e){}return cachedFamilyInterpreter},family=async()=>{let family2=null;if(isLinux()){if(family2=await familyFromInterpreter(),!family2){if(family2=await familyFromFilesystem(),!family2)family2=familyFromReport();if(!family2){let out=await safeCommand();family2=familyFromCommand(out)}}}return family2},familySync=()=>{let family2=null;if(isLinux()){if(family2=familyFromInterpreterSync(),!family2){if(family2=familyFromFilesystemSync(),!family2)family2=familyFromReport();if(!family2){let out=safeCommandSync();family2=familyFromCommand(out)}}}return family2},isNonGlibcLinux=async()=>isLinux()&&await family()!==GLIBC,isNonGlibcLinuxSync=()=>isLinux()&&familySync()!==GLIBC,versionFromFilesystem=async()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=(await readFile2(LDD_PATH)).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromFilesystemSync=()=>{if(cachedVersionFilesystem!==void 0)return cachedVersionFilesystem;cachedVersionFilesystem=null;try{let versionMatch=readFileSync5(LDD_PATH).match(RE_GLIBC_VERSION);if(versionMatch)cachedVersionFilesystem=versionMatch[1]}catch(e){}return cachedVersionFilesystem},versionFromReport=()=>{let report=getReport();if(report.header&&report.header.glibcVersionRuntime)return report.header.glibcVersionRuntime;return null},versionSuffix=(s)=>s.trim().split(/\s+/)[1],versionFromCommand=(out)=>{let[getconf,ldd1,ldd2]=out.split(/[\r\n]+/);if(getconf&&getconf.includes(GLIBC))return versionSuffix(getconf);if(ldd1&&ldd2&&ldd1.includes(MUSL))return versionSuffix(ldd2);return null},version=async()=>{let version2=null;if(isLinux()){if(version2=await versionFromFilesystem(),!version2)version2=versionFromReport();if(!version2){let out=await safeCommand();version2=versionFromCommand(out)}}return version2},versionSync=()=>{let version2=null;if(isLinux()){if(version2=versionFromFilesystemSync(),!version2)version2=versionFromReport();if(!version2){let out=safeCommandSync();version2=versionFromCommand(out)}}return version2};module3.exports={GLIBC,MUSL,family,familySync,isNonGlibcLinux,isNonGlibcLinuxSync,version,versionSync}});var require_debug=__commonJS((exports,module3)=>{var debug=typeof process==="object"&&process.env&&process.env.NODE_DEBUG&&/\bsemver\b/i.test(process.env.NODE_DEBUG)?(...args)=>console.error("SEMVER",...args):()=>{};module3.exports=debug});var require_constants2=__commonJS((exports,module3)=>{var MAX_SAFE_INTEGER=Number.MAX_SAFE_INTEGER||9007199254740991,RELEASE_TYPES=["major","premajor","minor","preminor","patch","prepatch","prerelease"];module3.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER,RELEASE_TYPES,SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}});var require_re=__commonJS((exports,module3)=>{var{MAX_SAFE_COMPONENT_LENGTH,MAX_SAFE_BUILD_LENGTH,MAX_LENGTH}=require_constants2(),debug=require_debug();exports=module3.exports={};var re=exports.re=[],safeRe=exports.safeRe=[],src=exports.src=[],safeSrc=exports.safeSrc=[],t=exports.t={},R=0,LETTERDASHNUMBER="[a-zA-Z0-9-]",safeRegexReplacements=[["\\s",1],["\\d",MAX_LENGTH],[LETTERDASHNUMBER,MAX_SAFE_BUILD_LENGTH]],makeSafeRegex=(value2)=>{for(let[token,max]of safeRegexReplacements)value2=value2.split(`${token}*`).join(`${token}{0,${max}}`).split(`${token}+`).join(`${token}{1,${max}}`);return value2},createToken=(name2,value2,isGlobal)=>{let safe=makeSafeRegex(value2),index=R++;debug(name2,index,value2),t[name2]=index,src[index]=value2,safeSrc[index]=safe,re[index]=new RegExp(value2,isGlobal?"g":void 0),safeRe[index]=new RegExp(safe,isGlobal?"g":void 0)};createToken("NUMERICIDENTIFIER","0|[1-9]\\d*");createToken("NUMERICIDENTIFIERLOOSE","\\d+");createToken("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`);createToken("MAINVERSION",`(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})\\.(${src[t.NUMERICIDENTIFIER]})`);createToken("MAINVERSIONLOOSE",`(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})\\.(${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASEIDENTIFIER",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIER]})`);createToken("PRERELEASEIDENTIFIERLOOSE",`(?:${src[t.NONNUMERICIDENTIFIER]}|${src[t.NUMERICIDENTIFIERLOOSE]})`);createToken("PRERELEASE",`(?:-(${src[t.PRERELEASEIDENTIFIER]}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`);createToken("PRERELEASELOOSE",`(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`);createToken("BUILDIDENTIFIER",`${LETTERDASHNUMBER}+`);createToken("BUILD",`(?:\\+(${src[t.BUILDIDENTIFIER]}(?:\\.${src[t.BUILDIDENTIFIER]})*))`);createToken("FULLPLAIN",`v?${src[t.MAINVERSION]}${src[t.PRERELEASE]}?${src[t.BUILD]}?`);createToken("FULL",`^${src[t.FULLPLAIN]}$`);createToken("LOOSEPLAIN",`[v=\\s]*${src[t.MAINVERSIONLOOSE]}${src[t.PRERELEASELOOSE]}?${src[t.BUILD]}?`);createToken("LOOSE",`^${src[t.LOOSEPLAIN]}$`);createToken("GTLT","((?:<|>)?=?)");createToken("XRANGEIDENTIFIERLOOSE",`${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`);createToken("XRANGEIDENTIFIER",`${src[t.NUMERICIDENTIFIER]}|x|X|\\*`);createToken("XRANGEPLAIN",`[v=\\s]*(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:\\.(${src[t.XRANGEIDENTIFIER]})(?:${src[t.PRERELEASE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGEPLAINLOOSE",`[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})(?:${src[t.PRERELEASELOOSE]})?${src[t.BUILD]}?)?)?`);createToken("XRANGE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`);createToken("XRANGELOOSE",`^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`);createToken("COERCEPLAIN",`(^|[^\\d])(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}})(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`);createToken("COERCE",`${src[t.COERCEPLAIN]}(?:$|[^\\d])`);createToken("COERCEFULL",src[t.COERCEPLAIN]+`(?:${src[t.PRERELEASE]})?(?:${src[t.BUILD]})?(?:$|[^\\d])`);createToken("COERCERTL",src[t.COERCE],!0);createToken("COERCERTLFULL",src[t.COERCEFULL],!0);createToken("LONETILDE","(?:~>?)");createToken("TILDETRIM",`(\\s*)${src[t.LONETILDE]}\\s+`,!0);exports.tildeTrimReplace="$1~";createToken("TILDE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`);createToken("TILDELOOSE",`^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("LONECARET","(?:\\^)");createToken("CARETTRIM",`(\\s*)${src[t.LONECARET]}\\s+`,!0);exports.caretTrimReplace="$1^";createToken("CARET",`^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`);createToken("CARETLOOSE",`^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`);createToken("COMPARATORLOOSE",`^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`);createToken("COMPARATOR",`^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`);createToken("COMPARATORTRIM",`(\\s*)${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`,!0);exports.comparatorTrimReplace="$1$2$3";createToken("HYPHENRANGE",`^\\s*(${src[t.XRANGEPLAIN]})\\s+-\\s+(${src[t.XRANGEPLAIN]})\\s*$`);createToken("HYPHENRANGELOOSE",`^\\s*(${src[t.XRANGEPLAINLOOSE]})\\s+-\\s+(${src[t.XRANGEPLAINLOOSE]})\\s*$`);createToken("STAR","(<|>)?=?\\s*\\*");createToken("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$");createToken("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")});var require_parse_options=__commonJS((exports,module3)=>{var looseOption=Object.freeze({loose:!0}),emptyOpts=Object.freeze({}),parseOptions=(options)=>{if(!options)return emptyOpts;if(typeof options!=="object")return looseOption;return options};module3.exports=parseOptions});var require_identifiers=__commonJS((exports,module3)=>{var numeric=/^[0-9]+$/,compareIdentifiers=(a,b)=>{if(typeof a==="number"&&typeof b==="number")return a===b?0:a<b?-1:1;let anum=numeric.test(a),bnum=numeric.test(b);if(anum&&bnum)a=+a,b=+b;return a===b?0:anum&&!bnum?-1:bnum&&!anum?1:a<b?-1:1},rcompareIdentifiers=(a,b)=>compareIdentifiers(b,a);module3.exports={compareIdentifiers,rcompareIdentifiers}});var require_semver=__commonJS((exports,module3)=>{var debug=require_debug(),{MAX_LENGTH,MAX_SAFE_INTEGER}=require_constants2(),{safeRe:re,t}=require_re(),parseOptions=require_parse_options(),{compareIdentifiers}=require_identifiers();class SemVer{constructor(version,options){if(options=parseOptions(options),version instanceof SemVer)if(version.loose===!!options.loose&&version.includePrerelease===!!options.includePrerelease)return version;else version=version.version;else if(typeof version!=="string")throw TypeError(`Invalid version. Must be a string. Got type "${typeof version}".`);if(version.length>MAX_LENGTH)throw TypeError(`version is longer than ${MAX_LENGTH} characters`);debug("SemVer",version,options),this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease;let m=version.trim().match(options.loose?re[t.LOOSE]:re[t.FULL]);if(!m)throw TypeError(`Invalid Version: ${version}`);if(this.raw=version,this.major=+m[1],this.minor=+m[2],this.patch=+m[3],this.major>MAX_SAFE_INTEGER||this.major<0)throw TypeError("Invalid major version");if(this.minor>MAX_SAFE_INTEGER||this.minor<0)throw TypeError("Invalid minor version");if(this.patch>MAX_SAFE_INTEGER||this.patch<0)throw TypeError("Invalid patch version");if(!m[4])this.prerelease=[];else this.prerelease=m[4].split(".").map((id)=>{if(/^[0-9]+$/.test(id)){let num3=+id;if(num3>=0&&num3<MAX_SAFE_INTEGER)return num3}return id});this.build=m[5]?m[5].split("."):[],this.format()}format(){if(this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length)this.version+=`-${this.prerelease.join(".")}`;return this.version}toString(){return this.version}compare(other){if(debug("SemVer.compare",this.version,this.options,other),!(other instanceof SemVer)){if(typeof other==="string"&&other===this.version)return 0;other=new SemVer(other,this.options)}if(other.version===this.version)return 0;return this.compareMain(other)||this.comparePre(other)}compareMain(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.major<other.major)return-1;if(this.major>other.major)return 1;if(this.minor<other.minor)return-1;if(this.minor>other.minor)return 1;if(this.patch<other.patch)return-1;if(this.patch>other.patch)return 1;return 0}comparePre(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);if(this.prerelease.length&&!other.prerelease.length)return-1;else if(!this.prerelease.length&&other.prerelease.length)return 1;else if(!this.prerelease.length&&!other.prerelease.length)return 0;let i=0;do{let a=this.prerelease[i],b=other.prerelease[i];if(debug("prerelease compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}compareBuild(other){if(!(other instanceof SemVer))other=new SemVer(other,this.options);let i=0;do{let a=this.build[i],b=other.build[i];if(debug("build compare",i,a,b),a===void 0&&b===void 0)return 0;else if(b===void 0)return 1;else if(a===void 0)return-1;else if(a===b)continue;else return compareIdentifiers(a,b)}while(++i)}inc(release,identifier,identifierBase){if(release.startsWith("pre")){if(!identifier&&identifierBase===!1)throw Error("invalid increment argument: identifier is empty");if(identifier){let match=`-${identifier}`.match(this.options.loose?re[t.PRERELEASELOOSE]:re[t.PRERELEASE]);if(!match||match[1]!==identifier)throw Error(`invalid identifier: ${identifier}`)}}switch(release){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",identifier,identifierBase);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",identifier,identifierBase);break;case"prepatch":this.prerelease.length=0,this.inc("patch",identifier,identifierBase),this.inc("pre",identifier,identifierBase);break;case"prerelease":if(this.prerelease.length===0)this.inc("patch",identifier,identifierBase);this.inc("pre",identifier,identifierBase);break;case"release":if(this.prerelease.length===0)throw Error(`version ${this.raw} is not a prerelease`);this.prerelease.length=0;break;case"major":if(this.minor!==0||this.patch!==0||this.prerelease.length===0)this.major++;this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":if(this.patch!==0||this.prerelease.length===0)this.minor++;this.patch=0,this.prerelease=[];break;case"patch":if(this.prerelease.length===0)this.patch++;this.prerelease=[];break;case"pre":{let base=Number(identifierBase)?1:0;if(this.prerelease.length===0)this.prerelease=[base];else{let i=this.prerelease.length;while(--i>=0)if(typeof this.prerelease[i]==="number")this.prerelease[i]++,i=-2;if(i===-1){if(identifier===this.prerelease.join(".")&&identifierBase===!1)throw Error("invalid increment argument: identifier already exists");this.prerelease.push(base)}}if(identifier){let prerelease=[identifier,base];if(identifierBase===!1)prerelease=[identifier];if(compareIdentifiers(this.prerelease[0],identifier)===0){if(isNaN(this.prerelease[1]))this.prerelease=prerelease}else this.prerelease=prerelease}break}default:throw Error(`invalid increment argument: ${release}`)}if(this.raw=this.format(),this.build.length)this.raw+=`+${this.build.join(".")}`;return this}}module3.exports=SemVer});var require_parse=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=(version,options,throwErrors=!1)=>{if(version instanceof SemVer)return version;try{return new SemVer(version,options)}catch(er){if(!throwErrors)return null;throw er}};module3.exports=parse3});var require_coerce=__commonJS((exports,module3)=>{var SemVer=require_semver(),parse3=require_parse(),{safeRe:re,t}=require_re(),coerce2=(version,options)=>{if(version instanceof SemVer)return version;if(typeof version==="number")version=String(version);if(typeof version!=="string")return null;options=options||{};let match=null;if(!options.rtl)match=version.match(options.includePrerelease?re[t.COERCEFULL]:re[t.COERCE]);else{let coerceRtlRegex=options.includePrerelease?re[t.COERCERTLFULL]:re[t.COERCERTL],next;while((next=coerceRtlRegex.exec(version))&&(!match||match.index+match[0].length!==version.length)){if(!match||next.index+next[0].length!==match.index+match[0].length)match=next;coerceRtlRegex.lastIndex=next.index+next[1].length+next[2].length}coerceRtlRegex.lastIndex=-1}if(match===null)return null;let major=match[2],minor=match[3]||"0",patch=match[4]||"0",prerelease=options.includePrerelease&&match[5]?`-${match[5]}`:"",build=options.includePrerelease&&match[6]?`+${match[6]}`:"";return parse3(`${major}.${minor}.${patch}${prerelease}${build}`,options)};module3.exports=coerce2});var require_compare=__commonJS((exports,module3)=>{var SemVer=require_semver(),compare2=(a,b,loose)=>new SemVer(a,loose).compare(new SemVer(b,loose));module3.exports=compare2});var require_gte=__commonJS((exports,module3)=>{var compare2=require_compare(),gte=(a,b,loose)=>compare2(a,b,loose)>=0;module3.exports=gte});var require_lrucache=__commonJS((exports,module3)=>{class LRUCache{constructor(){this.max=1000,this.map=new Map}get(key2){let value2=this.map.get(key2);if(value2===void 0)return;else return this.map.delete(key2),this.map.set(key2,value2),value2}delete(key2){return this.map.delete(key2)}set(key2,value2){if(!this.delete(key2)&&value2!==void 0){if(this.map.size>=this.max){let firstKey=this.map.keys().next().value;this.delete(firstKey)}this.map.set(key2,value2)}return this}}module3.exports=LRUCache});var require_eq=__commonJS((exports,module3)=>{var compare2=require_compare(),eq31=(a,b,loose)=>compare2(a,b,loose)===0;module3.exports=eq31});var require_neq=__commonJS((exports,module3)=>{var compare2=require_compare(),neq=(a,b,loose)=>compare2(a,b,loose)!==0;module3.exports=neq});var require_gt=__commonJS((exports,module3)=>{var compare2=require_compare(),gt=(a,b,loose)=>compare2(a,b,loose)>0;module3.exports=gt});var require_lt=__commonJS((exports,module3)=>{var compare2=require_compare(),lt2=(a,b,loose)=>compare2(a,b,loose)<0;module3.exports=lt2});var require_lte=__commonJS((exports,module3)=>{var compare2=require_compare(),lte=(a,b,loose)=>compare2(a,b,loose)<=0;module3.exports=lte});var require_cmp=__commonJS((exports,module3)=>{var eq31=require_eq(),neq=require_neq(),gt=require_gt(),gte=require_gte(),lt2=require_lt(),lte=require_lte(),cmp=(a,op,b,loose)=>{switch(op){case"===":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a===b;case"!==":if(typeof a==="object")a=a.version;if(typeof b==="object")b=b.version;return a!==b;case"":case"=":case"==":return eq31(a,b,loose);case"!=":return neq(a,b,loose);case">":return gt(a,b,loose);case">=":return gte(a,b,loose);case"<":return lt2(a,b,loose);case"<=":return lte(a,b,loose);default:throw TypeError(`Invalid operator: ${op}`)}};module3.exports=cmp});var require_comparator=__commonJS((exports,module3)=>{var ANY=Symbol("SemVer ANY");class Comparator{static get ANY(){return ANY}constructor(comp,options){if(options=parseOptions(options),comp instanceof Comparator)if(comp.loose===!!options.loose)return comp;else comp=comp.value;if(comp=comp.trim().split(/\s+/).join(" "),debug("comparator",comp,options),this.options=options,this.loose=!!options.loose,this.parse(comp),this.semver===ANY)this.value="";else this.value=this.operator+this.semver.version;debug("comp",this)}parse(comp){let r=this.options.loose?re[t.COMPARATORLOOSE]:re[t.COMPARATOR],m=comp.match(r);if(!m)throw TypeError(`Invalid comparator: ${comp}`);if(this.operator=m[1]!==void 0?m[1]:"",this.operator==="=")this.operator="";if(!m[2])this.semver=ANY;else this.semver=new SemVer(m[2],this.options.loose)}toString(){return this.value}test(version){if(debug("Comparator.test",version,this.options.loose),this.semver===ANY||version===ANY)return!0;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}return cmp(version,this.operator,this.semver,this.options)}intersects(comp,options){if(!(comp instanceof Comparator))throw TypeError("a Comparator is required");if(this.operator===""){if(this.value==="")return!0;return new Range(comp.value,options).test(this.value)}else if(comp.operator===""){if(comp.value==="")return!0;return new Range(this.value,options).test(comp.semver)}if(options=parseOptions(options),options.includePrerelease&&(this.value==="<0.0.0-0"||comp.value==="<0.0.0-0"))return!1;if(!options.includePrerelease&&(this.value.startsWith("<0.0.0")||comp.value.startsWith("<0.0.0")))return!1;if(this.operator.startsWith(">")&&comp.operator.startsWith(">"))return!0;if(this.operator.startsWith("<")&&comp.operator.startsWith("<"))return!0;if(this.semver.version===comp.semver.version&&this.operator.includes("=")&&comp.operator.includes("="))return!0;if(cmp(this.semver,"<",comp.semver,options)&&this.operator.startsWith(">")&&comp.operator.startsWith("<"))return!0;if(cmp(this.semver,">",comp.semver,options)&&this.operator.startsWith("<")&&comp.operator.startsWith(">"))return!0;return!1}}module3.exports=Comparator;var parseOptions=require_parse_options(),{safeRe:re,t}=require_re(),cmp=require_cmp(),debug=require_debug(),SemVer=require_semver(),Range=require_range()});var require_range=__commonJS((exports,module3)=>{var SPACE_CHARACTERS=/\s+/g;class Range{constructor(range,options){if(options=parseOptions(options),range instanceof Range)if(range.loose===!!options.loose&&range.includePrerelease===!!options.includePrerelease)return range;else return new Range(range.raw,options);if(range instanceof Comparator)return this.raw=range.value,this.set=[[range]],this.formatted=void 0,this;if(this.options=options,this.loose=!!options.loose,this.includePrerelease=!!options.includePrerelease,this.raw=range.trim().replace(SPACE_CHARACTERS," "),this.set=this.raw.split("||").map((r)=>this.parseRange(r.trim())).filter((c)=>c.length),!this.set.length)throw TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){let first=this.set[0];if(this.set=this.set.filter((c)=>!isNullSet(c[0])),this.set.length===0)this.set=[first];else if(this.set.length>1){for(let c of this.set)if(c.length===1&&isAny(c[0])){this.set=[c];break}}}this.formatted=void 0}get range(){if(this.formatted===void 0){this.formatted="";for(let i=0;i<this.set.length;i++){if(i>0)this.formatted+="||";let comps=this.set[i];for(let k=0;k<comps.length;k++){if(k>0)this.formatted+=" ";this.formatted+=comps[k].toString().trim()}}}return this.formatted}format(){return this.range}toString(){return this.range}parseRange(range){let memoKey=((this.options.includePrerelease&&FLAG_INCLUDE_PRERELEASE)|(this.options.loose&&FLAG_LOOSE))+":"+range,cached=cache.get(memoKey);if(cached)return cached;let loose=this.options.loose,hr=loose?re[t.HYPHENRANGELOOSE]:re[t.HYPHENRANGE];range=range.replace(hr,hyphenReplace(this.options.includePrerelease)),debug("hyphen replace",range),range=range.replace(re[t.COMPARATORTRIM],comparatorTrimReplace),debug("comparator trim",range),range=range.replace(re[t.TILDETRIM],tildeTrimReplace),debug("tilde trim",range),range=range.replace(re[t.CARETTRIM],caretTrimReplace),debug("caret trim",range);let rangeList=range.split(" ").map((comp)=>parseComparator(comp,this.options)).join(" ").split(/\s+/).map((comp)=>replaceGTE0(comp,this.options));if(loose)rangeList=rangeList.filter((comp)=>{return debug("loose invalid filter",comp,this.options),!!comp.match(re[t.COMPARATORLOOSE])});debug("range list",rangeList);let rangeMap=new Map,comparators=rangeList.map((comp)=>new Comparator(comp,this.options));for(let comp of comparators){if(isNullSet(comp))return[comp];rangeMap.set(comp.value,comp)}if(rangeMap.size>1&&rangeMap.has(""))rangeMap.delete("");let result=[...rangeMap.values()];return cache.set(memoKey,result),result}intersects(range,options){if(!(range instanceof Range))throw TypeError("a Range is required");return this.set.some((thisComparators)=>{return isSatisfiable(thisComparators,options)&&range.set.some((rangeComparators)=>{return isSatisfiable(rangeComparators,options)&&thisComparators.every((thisComparator)=>{return rangeComparators.every((rangeComparator)=>{return thisComparator.intersects(rangeComparator,options)})})})})}test(version){if(!version)return!1;if(typeof version==="string")try{version=new SemVer(version,this.options)}catch(er){return!1}for(let i=0;i<this.set.length;i++)if(testSet(this.set[i],version,this.options))return!0;return!1}}module3.exports=Range;var LRU=require_lrucache(),cache=new LRU,parseOptions=require_parse_options(),Comparator=require_comparator(),debug=require_debug(),SemVer=require_semver(),{safeRe:re,t,comparatorTrimReplace,tildeTrimReplace,caretTrimReplace}=require_re(),{FLAG_INCLUDE_PRERELEASE,FLAG_LOOSE}=require_constants2(),isNullSet=(c)=>c.value==="<0.0.0-0",isAny=(c)=>c.value==="",isSatisfiable=(comparators,options)=>{let result=!0,remainingComparators=comparators.slice(),testComparator=remainingComparators.pop();while(result&&remainingComparators.length)result=remainingComparators.every((otherComparator)=>{return testComparator.intersects(otherComparator,options)}),testComparator=remainingComparators.pop();return result},parseComparator=(comp,options)=>{return comp=comp.replace(re[t.BUILD],""),debug("comp",comp,options),comp=replaceCarets(comp,options),debug("caret",comp),comp=replaceTildes(comp,options),debug("tildes",comp),comp=replaceXRanges(comp,options),debug("xrange",comp),comp=replaceStars(comp,options),debug("stars",comp),comp},isX=(id)=>!id||id.toLowerCase()==="x"||id==="*",replaceTildes=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceTilde(c,options)).join(" ")},replaceTilde=(comp,options)=>{let r=options.loose?re[t.TILDELOOSE]:re[t.TILDE];return comp.replace(r,(_,M,m,p,pr)=>{debug("tilde",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0 <${+M+1}.0.0-0`;else if(isX(p))ret=`>=${M}.${m}.0 <${M}.${+m+1}.0-0`;else if(pr)debug("replaceTilde pr",pr),ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${M}.${+m+1}.0-0`;return debug("tilde return",ret),ret})},replaceCarets=(comp,options)=>{return comp.trim().split(/\s+/).map((c)=>replaceCaret(c,options)).join(" ")},replaceCaret=(comp,options)=>{debug("caret",comp,options);let r=options.loose?re[t.CARETLOOSE]:re[t.CARET],z=options.includePrerelease?"-0":"";return comp.replace(r,(_,M,m,p,pr)=>{debug("caret",comp,_,M,m,p,pr);let ret;if(isX(M))ret="";else if(isX(m))ret=`>=${M}.0.0${z} <${+M+1}.0.0-0`;else if(isX(p))if(M==="0")ret=`>=${M}.${m}.0${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.0${z} <${+M+1}.0.0-0`;else if(pr)if(debug("replaceCaret pr",pr),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}-${pr} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}-${pr} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p}-${pr} <${+M+1}.0.0-0`;else if(debug("no pr"),M==="0")if(m==="0")ret=`>=${M}.${m}.${p}${z} <${M}.${m}.${+p+1}-0`;else ret=`>=${M}.${m}.${p}${z} <${M}.${+m+1}.0-0`;else ret=`>=${M}.${m}.${p} <${+M+1}.0.0-0`;return debug("caret return",ret),ret})},replaceXRanges=(comp,options)=>{return debug("replaceXRanges",comp,options),comp.split(/\s+/).map((c)=>replaceXRange(c,options)).join(" ")},replaceXRange=(comp,options)=>{comp=comp.trim();let r=options.loose?re[t.XRANGELOOSE]:re[t.XRANGE];return comp.replace(r,(ret,gtlt,M,m,p,pr)=>{debug("xRange",comp,ret,gtlt,M,m,p,pr);let xM=isX(M),xm=xM||isX(m),xp=xm||isX(p),anyX=xp;if(gtlt==="="&&anyX)gtlt="";if(pr=options.includePrerelease?"-0":"",xM)if(gtlt===">"||gtlt==="<")ret="<0.0.0-0";else ret="*";else if(gtlt&&anyX){if(xm)m=0;if(p=0,gtlt===">")if(gtlt=">=",xm)M=+M+1,m=0,p=0;else m=+m+1,p=0;else if(gtlt==="<=")if(gtlt="<",xm)M=+M+1;else m=+m+1;if(gtlt==="<")pr="-0";ret=`${gtlt+M}.${m}.${p}${pr}`}else if(xm)ret=`>=${M}.0.0${pr} <${+M+1}.0.0-0`;else if(xp)ret=`>=${M}.${m}.0${pr} <${M}.${+m+1}.0-0`;return debug("xRange return",ret),ret})},replaceStars=(comp,options)=>{return debug("replaceStars",comp,options),comp.trim().replace(re[t.STAR],"")},replaceGTE0=(comp,options)=>{return debug("replaceGTE0",comp,options),comp.trim().replace(re[options.includePrerelease?t.GTE0PRE:t.GTE0],"")},hyphenReplace=(incPr)=>($0,from,fM,fm,fp,fpr,fb,to,tM,tm,tp,tpr)=>{if(isX(fM))from="";else if(isX(fm))from=`>=${fM}.0.0${incPr?"-0":""}`;else if(isX(fp))from=`>=${fM}.${fm}.0${incPr?"-0":""}`;else if(fpr)from=`>=${from}`;else from=`>=${from}${incPr?"-0":""}`;if(isX(tM))to="";else if(isX(tm))to=`<${+tM+1}.0.0-0`;else if(isX(tp))to=`<${tM}.${+tm+1}.0-0`;else if(tpr)to=`<=${tM}.${tm}.${tp}-${tpr}`;else if(incPr)to=`<${tM}.${tm}.${+tp+1}-0`;else to=`<=${to}`;return`${from} ${to}`.trim()},testSet=(set2,version,options)=>{for(let i=0;i<set2.length;i++)if(!set2[i].test(version))return!1;if(version.prerelease.length&&!options.includePrerelease){for(let i=0;i<set2.length;i++){if(debug(set2[i].semver),set2[i].semver===Comparator.ANY)continue;if(set2[i].semver.prerelease.length>0){let allowed=set2[i].semver;if(allowed.major===version.major&&allowed.minor===version.minor&&allowed.patch===version.patch)return!0}}return!1}return!0}});var require_satisfies=__commonJS((exports,module3)=>{var Range=require_range(),satisfies=(version,range,options)=>{try{range=new Range(range,options)}catch(er){return!1}return range.test(version)};module3.exports=satisfies});var require_package=__commonJS((exports,module3)=>{module3.exports={name:"sharp",description:"High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",version:"0.33.5",author:"Lovell Fuller <npm@lovell.info>",homepage:"https://sharp.pixelplumbing.com",contributors:["Pierre Inglebert <pierre.inglebert@gmail.com>","Jonathan Ong <jonathanrichardong@gmail.com>","Chanon Sajjamanochai <chanon.s@gmail.com>","Juliano Julio <julianojulio@gmail.com>","Daniel Gasienica <daniel@gasienica.ch>","Julian Walker <julian@fiftythree.com>","Amit Pitaru <pitaru.amit@gmail.com>","Brandon Aaron <hello.brandon@aaron.sh>","Andreas Lind <andreas@one.com>","Maurus Cuelenaere <mcuelenaere@gmail.com>","Linus Unneb\xE4ck <linus@folkdatorn.se>","Victor Mateevitsi <mvictoras@gmail.com>","Alaric Holloway <alaric.holloway@gmail.com>","Bernhard K. Weisshuhn <bkw@codingforce.com>","Chris Riley <criley@primedia.com>","David Carley <dacarley@gmail.com>","John Tobin <john@limelightmobileinc.com>","Kenton Gray <kentongray@gmail.com>","Felix B\xFCnemann <Felix.Buenemann@gmail.com>","Samy Al Zahrani <samyalzahrany@gmail.com>","Chintan Thakkar <lemnisk8@gmail.com>","F. Orlando Galashan <frulo@gmx.de>","Kleis Auke Wolthuizen <info@kleisauke.nl>","Matt Hirsch <mhirsch@media.mit.edu>","Matthias Thoemmes <thoemmes@gmail.com>","Patrick Paskaris <patrick@paskaris.gr>","J\xE9r\xE9my Lal <kapouer@melix.org>","Rahul Nanwani <r.nanwani@gmail.com>","Alice Monday <alice0meta@gmail.com>","Kristo Jorgenson <kristo.jorgenson@gmail.com>","YvesBos <yves_bos@outlook.com>","Guy Maliar <guy@tailorbrands.com>","Nicolas Coden <nicolas@ncoden.fr>","Matt Parrish <matt.r.parrish@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Matthew McEachen <matthew+github@mceachen.org>","Jarda Kot\u011B\u0161ovec <jarda.kotesovec@gmail.com>","Kenric D'Souza <kenric.dsouza@gmail.com>","Oleh Aleinyk <oleg.aleynik@gmail.com>","Marcel Bretschneider <marcel.bretschneider@gmail.com>","Andrea Bianco <andrea.bianco@unibas.ch>","Rik Heywood <rik@rik.org>","Thomas Parisot <hi@oncletom.io>","Nathan Graves <nathanrgraves+github@gmail.com>","Tom Lokhorst <tom@lokhorst.eu>","Espen Hovlandsdal <espen@hovlandsdal.com>","Sylvain Dumont <sylvain.dumont35@gmail.com>","Alun Davies <alun.owain.davies@googlemail.com>","Aidan Hoolachan <ajhoolachan21@gmail.com>","Axel Eirola <axel.eirola@iki.fi>","Freezy <freezy@xbmc.org>","Daiz <taneli.vatanen@gmail.com>","Julian Aubourg <j@ubourg.net>","Keith Belovay <keith@picthrive.com>","Michael B. Klein <mbklein@gmail.com>","Jordan Prudhomme <jordan@raboland.fr>","Ilya Ovdin <iovdin@gmail.com>","Andargor <andargor@yahoo.com>","Paul Neave <paul.neave@gmail.com>","Brendan Kennedy <brenwken@gmail.com>","Brychan Bennett-Odlum <git@brychan.io>","Edward Silverton <e.silverton@gmail.com>","Roman Malieiev <aromaleev@gmail.com>","Tomas Szabo <tomas.szabo@deftomat.com>","Robert O'Rourke <robert@o-rourke.org>","Guillermo Alfonso Varela Chouci\xF1o <guillevch@gmail.com>","Christian Flintrup <chr@gigahost.dk>","Manan Jadhav <manan@motionden.com>","Leon Radley <leon@radley.se>","alza54 <alza54@thiocod.in>","Jacob Smith <jacob@frende.me>","Michael Nutt <michael@nutt.im>","Brad Parham <baparham@gmail.com>","Taneli Vatanen <taneli.vatanen@gmail.com>","Joris Dugu\xE9 <zaruike10@gmail.com>","Chris Banks <christopher.bradley.banks@gmail.com>","Ompal Singh <ompal.hitm09@gmail.com>","Brodan <christopher.hranj@gmail.com>","Ankur Parihar <ankur.github@gmail.com>","Brahim Ait elhaj <brahima@gmail.com>","Mart Jansink <m.jansink@gmail.com>","Lachlan Newman <lachnewman007@gmail.com>","Dennis Beatty <dennis@dcbeatty.com>","Ingvar Stepanyan <me@rreverser.com>","Don Denton <don@happycollision.com>"],scripts:{install:"node install/check",clean:"rm -rf src/build/ .nyc_output/ coverage/ test/fixtures/output.*",test:"npm run test-lint && npm run test-unit && npm run test-licensing && npm run test-types","test-lint":"semistandard && cpplint","test-unit":"nyc --reporter=lcov --reporter=text --check-coverage --branches=100 mocha","test-licensing":'license-checker --production --summary --onlyAllow="Apache-2.0;BSD;ISC;LGPL-3.0-or-later;MIT"',"test-leak":"./test/leak/leak.sh","test-types":"tsd","package-from-local-build":"node npm/from-local-build","package-from-github-release":"node npm/from-github-release","docs-build":"node docs/build && node docs/search-index/build","docs-serve":"cd docs && npx serve","docs-publish":"cd docs && npx firebase-tools deploy --project pixelplumbing --only hosting:pixelplumbing-sharp"},type:"commonjs",main:"lib/index.js",types:"lib/index.d.ts",files:["install","lib","src/*.{cc,h,gyp}"],repository:{type:"git",url:"git://github.com/lovell/sharp.git"},keywords:["jpeg","png","webp","avif","tiff","gif","svg","jp2","dzi","image","resize","thumbnail","crop","embed","libvips","vips"],dependencies:{color:"^4.2.3","detect-libc":"^2.0.3",semver:"^7.6.3"},optionalDependencies:{"@img/sharp-darwin-arm64":"0.33.5","@img/sharp-darwin-x64":"0.33.5","@img/sharp-libvips-darwin-arm64":"1.0.4","@img/sharp-libvips-darwin-x64":"1.0.4","@img/sharp-libvips-linux-arm":"1.0.5","@img/sharp-libvips-linux-arm64":"1.0.4","@img/sharp-libvips-linux-s390x":"1.0.4","@img/sharp-libvips-linux-x64":"1.0.4","@img/sharp-libvips-linuxmusl-arm64":"1.0.4","@img/sharp-libvips-linuxmusl-x64":"1.0.4","@img/sharp-linux-arm":"0.33.5","@img/sharp-linux-arm64":"0.33.5","@img/sharp-linux-s390x":"0.33.5","@img/sharp-linux-x64":"0.33.5","@img/sharp-linuxmusl-arm64":"0.33.5","@img/sharp-linuxmusl-x64":"0.33.5","@img/sharp-wasm32":"0.33.5","@img/sharp-win32-ia32":"0.33.5","@img/sharp-win32-x64":"0.33.5"},devDependencies:{"@emnapi/runtime":"^1.2.0","@img/sharp-libvips-dev":"1.0.4","@img/sharp-libvips-dev-wasm32":"1.0.5","@img/sharp-libvips-win32-ia32":"1.0.4","@img/sharp-libvips-win32-x64":"1.0.4","@types/node":"*",async:"^3.2.5",cc:"^3.0.1",emnapi:"^1.2.0","exif-reader":"^2.0.1","extract-zip":"^2.0.1",icc:"^3.0.0","jsdoc-to-markdown":"^8.0.3","license-checker":"^25.0.1",mocha:"^10.7.3","node-addon-api":"^8.1.0",nyc:"^17.0.0",prebuild:"^13.0.1",semistandard:"^17.0.0","tar-fs":"^3.0.6",tsd:"^0.31.1"},license:"Apache-2.0",engines:{node:"^18.17.0 || ^20.3.0 || >=21.0.0"},config:{libvips:">=8.15.3"},funding:{url:"https://opencollective.com/libvips"},binary:{napi_versions:[9]},semistandard:{env:["mocha"]},cc:{linelength:"120",filter:["build/include"]},nyc:{include:["lib"]},tsd:{directory:"test/types/"}}});var require_libvips=__commonJS((exports,module3)=>{var{spawnSync}=__require("child_process"),{createHash:createHash4}=__require("crypto"),semverCoerce=require_coerce(),semverGreaterThanOrEqualTo=require_gte(),semverSatisfies=require_satisfies(),detectLibc=require_detect_libc(),{config,engines,optionalDependencies}=require_package(),minimumLibvipsVersionLabelled=process.env.npm_package_config_libvips||config.libvips,minimumLibvipsVersion=semverCoerce(minimumLibvipsVersionLabelled).version,prebuiltPlatforms=["darwin-arm64","darwin-x64","linux-arm","linux-arm64","linux-s390x","linux-x64","linuxmusl-arm64","linuxmusl-x64","win32-ia32","win32-x64"],spawnSyncOptions={encoding:"utf8",shell:!0},log3=(item)=>{if(item instanceof Error)console.error(`sharp: Installation error: ${item.message}`);else console.log(`sharp: ${item}`)},runtimeLibc=()=>detectLibc.isNonGlibcLinuxSync()?detectLibc.familySync():"",runtimePlatformArch=()=>`${process.platform}${runtimeLibc()}-${process.arch}`,buildPlatformArch=()=>{if(isEmscripten())return"wasm32";let{npm_config_arch,npm_config_platform,npm_config_libc}=process.env,libc=typeof npm_config_libc==="string"?npm_config_libc:runtimeLibc();return`${npm_config_platform||process.platform}${libc}-${npm_config_arch||process.arch}`},buildSharpLibvipsIncludeDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/include`)}catch{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/include");})()}catch{}}return""},buildSharpLibvipsCPlusPlusDir=()=>{try{return (()=>{throw new Error("Cannot require module "+"@img/sharp-libvips-dev/cplusplus");})()}catch{}return""},buildSharpLibvipsLibDir=()=>{try{return __require(`@img/sharp-libvips-dev-${buildPlatformArch()}/lib`)}catch{try{return __require(`@img/sharp-libvips-${buildPlatformArch()}/lib`)}catch{}}return""},isUnsupportedNodeRuntime=()=>{if(process.release?.name==="node"&&process.versions){if(!semverSatisfies(process.versions.node,engines.node))return{found:process.versions.node,expected:engines.node}}},isEmscripten=()=>{let{CC}=process.env;return Boolean(CC&&CC.endsWith("/emcc"))},isRosetta=()=>{if(process.platform==="darwin"&&process.arch==="x64")return(spawnSync("sysctl sysctl.proc_translated",spawnSyncOptions).stdout||"").trim()==="sysctl.proc_translated: 1";return!1},sha5122=(s)=>createHash4("sha512").update(s).digest("hex"),yarnLocator=()=>{try{let identHash=sha5122(`imgsharp-libvips-${buildPlatformArch()}`),npmVersion=semverCoerce(optionalDependencies[`@img/sharp-libvips-${buildPlatformArch()}`]).version;return sha5122(`${identHash}npm:${npmVersion}`).slice(0,10)}catch{}return""},spawnRebuild=()=>spawnSync(`node-gyp rebuild --directory=src ${isEmscripten()?"--nodedir=emscripten":""}`,{...spawnSyncOptions,stdio:"inherit"}).status,globalLibvipsVersion=()=>{if(process.platform!=="win32")return(spawnSync("pkg-config --modversion vips-cpp",{...spawnSyncOptions,env:{...process.env,PKG_CONFIG_PATH:pkgConfigPath()}}).stdout||"").trim();else return""},pkgConfigPath=()=>{if(process.platform!=="win32")return[(spawnSync('which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',spawnSyncOptions).stdout||"").trim(),process.env.PKG_CONFIG_PATH,"/usr/local/lib/pkgconfig","/usr/lib/pkgconfig","/usr/local/libdata/pkgconfig","/usr/libdata/pkgconfig"].filter(Boolean).join(":");else return""},skipSearch=(status,reason,logger2)=>{if(logger2)logger2(`Detected ${reason}, skipping search for globally-installed libvips`);return status},useGlobalLibvips=(logger2)=>{if(Boolean(process.env.SHARP_IGNORE_GLOBAL_LIBVIPS)===!0)return skipSearch(!1,"SHARP_IGNORE_GLOBAL_LIBVIPS",logger2);if(Boolean(process.env.SHARP_FORCE_GLOBAL_LIBVIPS)===!0)return skipSearch(!0,"SHARP_FORCE_GLOBAL_LIBVIPS",logger2);if(isRosetta())return skipSearch(!1,"Rosetta",logger2);let globalVipsVersion=globalLibvipsVersion();return!!globalVipsVersion&&semverGreaterThanOrEqualTo(globalVipsVersion,minimumLibvipsVersion)};module3.exports={minimumLibvipsVersion,prebuiltPlatforms,buildPlatformArch,buildSharpLibvipsIncludeDir,buildSharpLibvipsCPlusPlusDir,buildSharpLibvipsLibDir,isUnsupportedNodeRuntime,runtimePlatformArch,log:log3,yarnLocator,spawnRebuild,globalLibvipsVersion,pkgConfigPath,useGlobalLibvips}});var require_sharp=__commonJS((exports,module3)=>{var{familySync,versionSync}=require_detect_libc(),{runtimePlatformArch,isUnsupportedNodeRuntime,prebuiltPlatforms,minimumLibvipsVersion}=require_libvips(),runtimePlatform=runtimePlatformArch(),paths=[`../src/build/Release/sharp-${runtimePlatform}.node`,"../src/build/Release/sharp-wasm32.node",`@img/sharp-${runtimePlatform}/sharp.node`,"@img/sharp-wasm32/sharp.node"],sharp,errors2=[];for(let path2 of paths)try{sharp=__require(path2);break}catch(err){errors2.push(err)}if(sharp)module3.exports=sharp;else{let[isLinux,isMacOs,isWindows]=["linux","darwin","win32"].map((os4)=>runtimePlatform.startsWith(os4)),help=[`Could not load the "sharp" module using the ${runtimePlatform} runtime`];errors2.forEach((err)=>{if(err.code!=="MODULE_NOT_FOUND")help.push(`${err.code}: ${err.message}`)});let messages=errors2.map((err)=>err.message).join(" ");if(help.push("Possible solutions:"),isUnsupportedNodeRuntime()){let{found,expected}=isUnsupportedNodeRuntime();help.push("- Please upgrade Node.js:",`    Found ${found}`,`    Requires ${expected}`)}else if(prebuiltPlatforms.includes(runtimePlatform)){let[os4,cpu]=runtimePlatform.split("-"),libc=os4.endsWith("musl")?" --libc=musl":"";help.push("- Ensure optional dependencies can be installed:","    npm install --include=optional sharp","- Ensure your package manager supports multi-platform installation:","    See https://sharp.pixelplumbing.com/install#cross-platform","- Add platform-specific dependencies:",`    npm install --os=${os4.replace("musl","")}${libc} --cpu=${cpu} sharp`)}else help.push(`- Manually install libvips >= ${minimumLibvipsVersion}`,"- Add experimental WebAssembly-based dependencies:","    npm install --cpu=wasm32 sharp","    npm install @img/sharp-wasm32");if(isLinux&&/(symbol not found|CXXABI_)/i.test(messages))try{let{config}=__require(`@img/sharp-libvips-${runtimePlatform}/package`),libcFound=`${familySync()} ${versionSync()}`,libcRequires=`${config.musl?"musl":"glibc"} ${config.musl||config.glibc}`;help.push("- Update your OS:",`    Found ${libcFound}`,`    Requires ${libcRequires}`)}catch(errEngines){}if(isLinux&&/\/snap\/core[0-9]{2}/.test(messages))help.push("- Remove the Node.js Snap, which does not support native modules","    snap remove node");if(isMacOs&&/Incompatible library version/.test(messages))help.push("- Update Homebrew:","    brew update && brew upgrade vips");if(errors2.some((err)=>err.code==="ERR_DLOPEN_DISABLED"))help.push("- Run Node.js without using the --no-addons flag");if(isWindows&&/The specified procedure could not be found/.test(messages))help.push("- Using the canvas package on Windows?","    See https://sharp.pixelplumbing.com/install#canvas-and-windows","- Check for outdated versions of sharp in the dependency tree:","    npm ls sharp");throw help.push("- Consult the installation documentation:","    See https://sharp.pixelplumbing.com/install"),Error(help.join(`
+`))}});var require_constructor=__commonJS((exports,module3)=>{var util=__require("util"),stream=__require("stream"),is2=require_is();require_sharp();var debuglog=util.debuglog("sharp"),Sharp=function(input,options){if(arguments.length===1&&!is2.defined(input))throw Error("Invalid input");if(!(this instanceof Sharp))return new Sharp(input,options);return stream.Duplex.call(this),this.options={topOffsetPre:-1,leftOffsetPre:-1,widthPre:-1,heightPre:-1,topOffsetPost:-1,leftOffsetPost:-1,widthPost:-1,heightPost:-1,width:-1,height:-1,canvas:"crop",position:0,resizeBackground:[0,0,0,255],useExifOrientation:!1,angle:0,rotationAngle:0,rotationBackground:[0,0,0,255],rotateBeforePreExtract:!1,flip:!1,flop:!1,extendTop:0,extendBottom:0,extendLeft:0,extendRight:0,extendBackground:[0,0,0,255],extendWith:"background",withoutEnlargement:!1,withoutReduction:!1,affineMatrix:[],affineBackground:[0,0,0,255],affineIdx:0,affineIdy:0,affineOdx:0,affineOdy:0,affineInterpolator:this.constructor.interpolators.bilinear,kernel:"lanczos3",fastShrinkOnLoad:!0,tint:[-1,0,0,0],flatten:!1,flattenBackground:[0,0,0],unflatten:!1,negate:!1,negateAlpha:!0,medianSize:0,blurSigma:0,precision:"integer",minAmpl:0.2,sharpenSigma:0,sharpenM1:1,sharpenM2:2,sharpenX1:2,sharpenY2:10,sharpenY3:20,threshold:0,thresholdGrayscale:!0,trimBackground:[],trimThreshold:-1,trimLineArt:!1,gamma:0,gammaOut:0,greyscale:!1,normalise:!1,normaliseLower:1,normaliseUpper:99,claheWidth:0,claheHeight:0,claheMaxSlope:3,brightness:1,saturation:1,hue:0,lightness:0,booleanBufferIn:null,booleanFileIn:"",joinChannelIn:[],extractChannel:-1,removeAlpha:!1,ensureAlpha:-1,colourspace:"srgb",colourspacePipeline:"last",composite:[],fileOut:"",formatOut:"input",streamOut:!1,keepMetadata:0,withMetadataOrientation:-1,withMetadataDensity:0,withIccProfile:"",withExif:{},withExifMerge:!0,resolveWithObject:!1,jpegQuality:80,jpegProgressive:!1,jpegChromaSubsampling:"4:2:0",jpegTrellisQuantisation:!1,jpegOvershootDeringing:!1,jpegOptimiseScans:!1,jpegOptimiseCoding:!0,jpegQuantisationTable:0,pngProgressive:!1,pngCompressionLevel:6,pngAdaptiveFiltering:!1,pngPalette:!1,pngQuality:100,pngEffort:7,pngBitdepth:8,pngDither:1,jp2Quality:80,jp2TileHeight:512,jp2TileWidth:512,jp2Lossless:!1,jp2ChromaSubsampling:"4:4:4",webpQuality:80,webpAlphaQuality:100,webpLossless:!1,webpNearLossless:!1,webpSmartSubsample:!1,webpPreset:"default",webpEffort:4,webpMinSize:!1,webpMixed:!1,gifBitdepth:8,gifEffort:7,gifDither:1,gifInterFrameMaxError:0,gifInterPaletteMaxError:3,gifReuse:!0,gifProgressive:!1,tiffQuality:80,tiffCompression:"jpeg",tiffPredictor:"horizontal",tiffPyramid:!1,tiffMiniswhite:!1,tiffBitdepth:8,tiffTile:!1,tiffTileHeight:256,tiffTileWidth:256,tiffXres:1,tiffYres:1,tiffResolutionUnit:"inch",heifQuality:50,heifLossless:!1,heifCompression:"av1",heifEffort:4,heifChromaSubsampling:"4:4:4",heifBitdepth:8,jxlDistance:1,jxlDecodingTier:0,jxlEffort:7,jxlLossless:!1,rawDepth:"uchar",tileSize:256,tileOverlap:0,tileContainer:"fs",tileLayout:"dz",tileFormat:"last",tileDepth:"last",tileAngle:0,tileSkipBlanks:-1,tileBackground:[255,255,255,255],tileCentre:!1,tileId:"https://example.com/iiif",tileBasename:"",timeoutSeconds:0,linearA:[],linearB:[],debuglog:(warning)=>{this.emit("warning",warning),debuglog(warning)},queueListener:function(queueLength){Sharp.queue.emit("change",queueLength)}},this.options.input=this._createInputDescriptor(input,options,{allowStream:!0}),this};Object.setPrototypeOf(Sharp.prototype,stream.Duplex.prototype);Object.setPrototypeOf(Sharp,stream.Duplex);function clone2(){let clone3=this.constructor.call(),{debuglog:debuglog2,queueListener,...options}=this.options;if(clone3.options=structuredClone(options),clone3.options.debuglog=debuglog2,clone3.options.queueListener=queueListener,this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),clone3.options.input.buffer=this.options.input.buffer,clone3.emit("finish")});return clone3}Object.assign(Sharp.prototype,{clone:clone2});module3.exports=Sharp});var require_color_name=__commonJS((exports,module3)=>{module3.exports={aliceblue:[240,248,255],antiquewhite:[250,235,215],aqua:[0,255,255],aquamarine:[127,255,212],azure:[240,255,255],beige:[245,245,220],bisque:[255,228,196],black:[0,0,0],blanchedalmond:[255,235,205],blue:[0,0,255],blueviolet:[138,43,226],brown:[165,42,42],burlywood:[222,184,135],cadetblue:[95,158,160],chartreuse:[127,255,0],chocolate:[210,105,30],coral:[255,127,80],cornflowerblue:[100,149,237],cornsilk:[255,248,220],crimson:[220,20,60],cyan:[0,255,255],darkblue:[0,0,139],darkcyan:[0,139,139],darkgoldenrod:[184,134,11],darkgray:[169,169,169],darkgreen:[0,100,0],darkgrey:[169,169,169],darkkhaki:[189,183,107],darkmagenta:[139,0,139],darkolivegreen:[85,107,47],darkorange:[255,140,0],darkorchid:[153,50,204],darkred:[139,0,0],darksalmon:[233,150,122],darkseagreen:[143,188,143],darkslateblue:[72,61,139],darkslategray:[47,79,79],darkslategrey:[47,79,79],darkturquoise:[0,206,209],darkviolet:[148,0,211],deeppink:[255,20,147],deepskyblue:[0,191,255],dimgray:[105,105,105],dimgrey:[105,105,105],dodgerblue:[30,144,255],firebrick:[178,34,34],floralwhite:[255,250,240],forestgreen:[34,139,34],fuchsia:[255,0,255],gainsboro:[220,220,220],ghostwhite:[248,248,255],gold:[255,215,0],goldenrod:[218,165,32],gray:[128,128,128],green:[0,128,0],greenyellow:[173,255,47],grey:[128,128,128],honeydew:[240,255,240],hotpink:[255,105,180],indianred:[205,92,92],indigo:[75,0,130],ivory:[255,255,240],khaki:[240,230,140],lavender:[230,230,250],lavenderblush:[255,240,245],lawngreen:[124,252,0],lemonchiffon:[255,250,205],lightblue:[173,216,230],lightcoral:[240,128,128],lightcyan:[224,255,255],lightgoldenrodyellow:[250,250,210],lightgray:[211,211,211],lightgreen:[144,238,144],lightgrey:[211,211,211],lightpink:[255,182,193],lightsalmon:[255,160,122],lightseagreen:[32,178,170],lightskyblue:[135,206,250],lightslategray:[119,136,153],lightslategrey:[119,136,153],lightsteelblue:[176,196,222],lightyellow:[255,255,224],lime:[0,255,0],limegreen:[50,205,50],linen:[250,240,230],magenta:[255,0,255],maroon:[128,0,0],mediumaquamarine:[102,205,170],mediumblue:[0,0,205],mediumorchid:[186,85,211],mediumpurple:[147,112,219],mediumseagreen:[60,179,113],mediumslateblue:[123,104,238],mediumspringgreen:[0,250,154],mediumturquoise:[72,209,204],mediumvioletred:[199,21,133],midnightblue:[25,25,112],mintcream:[245,255,250],mistyrose:[255,228,225],moccasin:[255,228,181],navajowhite:[255,222,173],navy:[0,0,128],oldlace:[253,245,230],olive:[128,128,0],olivedrab:[107,142,35],orange:[255,165,0],orangered:[255,69,0],orchid:[218,112,214],palegoldenrod:[238,232,170],palegreen:[152,251,152],paleturquoise:[175,238,238],palevioletred:[219,112,147],papayawhip:[255,239,213],peachpuff:[255,218,185],peru:[205,133,63],pink:[255,192,203],plum:[221,160,221],powderblue:[176,224,230],purple:[128,0,128],rebeccapurple:[102,51,153],red:[255,0,0],rosybrown:[188,143,143],royalblue:[65,105,225],saddlebrown:[139,69,19],salmon:[250,128,114],sandybrown:[244,164,96],seagreen:[46,139,87],seashell:[255,245,238],sienna:[160,82,45],silver:[192,192,192],skyblue:[135,206,235],slateblue:[106,90,205],slategray:[112,128,144],slategrey:[112,128,144],snow:[255,250,250],springgreen:[0,255,127],steelblue:[70,130,180],tan:[210,180,140],teal:[0,128,128],thistle:[216,191,216],tomato:[255,99,71],turquoise:[64,224,208],violet:[238,130,238],wheat:[245,222,179],white:[255,255,255],whitesmoke:[245,245,245],yellow:[255,255,0],yellowgreen:[154,205,50]}});var require_is_arrayish=__commonJS((exports,module3)=>{module3.exports=function(obj){if(!obj||typeof obj==="string")return!1;return obj instanceof Array||Array.isArray(obj)||obj.length>=0&&(obj.splice instanceof Function||Object.getOwnPropertyDescriptor(obj,obj.length-1)&&obj.constructor.name!=="String")}});var require_simple_swizzle=__commonJS((exports,module3)=>{var isArrayish=require_is_arrayish(),concat4=Array.prototype.concat,slice2=Array.prototype.slice,swizzle=module3.exports=function(args){var results=[];for(var i=0,len=args.length;i<len;i++){var arg=args[i];if(isArrayish(arg))results=concat4.call(results,slice2.call(arg));else results.push(arg)}return results};swizzle.wrap=function(fn){return function(){return fn(swizzle(arguments))}}});var require_color_string=__commonJS((exports,module3)=>{var colorNames=require_color_name(),swizzle=require_simple_swizzle(),hasOwnProperty=Object.hasOwnProperty,reverseNames=Object.create(null);for(name2 in colorNames)if(hasOwnProperty.call(colorNames,name2))reverseNames[colorNames[name2]]=name2;var name2,cs=module3.exports={to:{},get:{}};cs.get=function(string3){var prefix=string3.substring(0,3).toLowerCase(),val,model;switch(prefix){case"hsl":val=cs.get.hsl(string3),model="hsl";break;case"hwb":val=cs.get.hwb(string3),model="hwb";break;default:val=cs.get.rgb(string3),model="rgb";break}if(!val)return null;return{model,value:val}};cs.get.rgb=function(string3){if(!string3)return null;var abbr=/^#([a-f0-9]{3,4})$/i,hex2=/^#([a-f0-9]{6})([a-f0-9]{2})?$/i,rgba=/^rgba?\(\s*([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)(?=[\s,])\s*(?:,\s*)?([+-]?\d+)\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,per=/^rgba?\(\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*,?\s*([+-]?[\d\.]+)\%\s*(?:[,|\/]\s*([+-]?[\d\.]+)(%?)\s*)?\)$/,keyword=/^(\w+)$/,rgb=[0,0,0,1],match,i,hexAlpha;if(match=string3.match(hex2)){hexAlpha=match[2],match=match[1];for(i=0;i<3;i++){var i2=i*2;rgb[i]=parseInt(match.slice(i2,i2+2),16)}if(hexAlpha)rgb[3]=parseInt(hexAlpha,16)/255}else if(match=string3.match(abbr)){match=match[1],hexAlpha=match[3];for(i=0;i<3;i++)rgb[i]=parseInt(match[i]+match[i],16);if(hexAlpha)rgb[3]=parseInt(hexAlpha+hexAlpha,16)/255}else if(match=string3.match(rgba)){for(i=0;i<3;i++)rgb[i]=parseInt(match[i+1],0);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(per)){for(i=0;i<3;i++)rgb[i]=Math.round(parseFloat(match[i+1])*2.55);if(match[4])if(match[5])rgb[3]=parseFloat(match[4])*0.01;else rgb[3]=parseFloat(match[4])}else if(match=string3.match(keyword)){if(match[1]==="transparent")return[0,0,0,0];if(!hasOwnProperty.call(colorNames,match[1]))return null;return rgb=colorNames[match[1]],rgb[3]=1,rgb}else return null;for(i=0;i<3;i++)rgb[i]=clamp(rgb[i],0,255);return rgb[3]=clamp(rgb[3],0,1),rgb};cs.get.hsl=function(string3){if(!string3)return null;var hsl=/^hsla?\(\s*([+-]?(?:\d{0,3}\.)?\d+)(?:deg)?\s*,?\s*([+-]?[\d\.]+)%\s*,?\s*([+-]?[\d\.]+)%\s*(?:[,|\/]\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hsl);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,s=clamp(parseFloat(match[2]),0,100),l=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,s,l,a]}return null};cs.get.hwb=function(string3){if(!string3)return null;var hwb=/^hwb\(\s*([+-]?\d{0,3}(?:\.\d+)?)(?:deg)?\s*,\s*([+-]?[\d\.]+)%\s*,\s*([+-]?[\d\.]+)%\s*(?:,\s*([+-]?(?=\.\d|\d)(?:0|[1-9]\d*)?(?:\.\d*)?(?:[eE][+-]?\d+)?)\s*)?\)$/,match=string3.match(hwb);if(match){var alpha=parseFloat(match[4]),h=(parseFloat(match[1])%360+360)%360,w=clamp(parseFloat(match[2]),0,100),b=clamp(parseFloat(match[3]),0,100),a=clamp(isNaN(alpha)?1:alpha,0,1);return[h,w,b,a]}return null};cs.to.hex=function(){var rgba=swizzle(arguments);return"#"+hexDouble(rgba[0])+hexDouble(rgba[1])+hexDouble(rgba[2])+(rgba[3]<1?hexDouble(Math.round(rgba[3]*255)):"")};cs.to.rgb=function(){var rgba=swizzle(arguments);return rgba.length<4||rgba[3]===1?"rgb("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+")":"rgba("+Math.round(rgba[0])+", "+Math.round(rgba[1])+", "+Math.round(rgba[2])+", "+rgba[3]+")"};cs.to.rgb.percent=function(){var rgba=swizzle(arguments),r=Math.round(rgba[0]/255*100),g=Math.round(rgba[1]/255*100),b=Math.round(rgba[2]/255*100);return rgba.length<4||rgba[3]===1?"rgb("+r+"%, "+g+"%, "+b+"%)":"rgba("+r+"%, "+g+"%, "+b+"%, "+rgba[3]+")"};cs.to.hsl=function(){var hsla=swizzle(arguments);return hsla.length<4||hsla[3]===1?"hsl("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%)":"hsla("+hsla[0]+", "+hsla[1]+"%, "+hsla[2]+"%, "+hsla[3]+")"};cs.to.hwb=function(){var hwba=swizzle(arguments),a="";if(hwba.length>=4&&hwba[3]!==1)a=", "+hwba[3];return"hwb("+hwba[0]+", "+hwba[1]+"%, "+hwba[2]+"%"+a+")"};cs.to.keyword=function(rgb){return reverseNames[rgb.slice(0,3)]};function clamp(num3,min,max){return Math.min(Math.max(min,num3),max)}function hexDouble(num3){var str4=Math.round(num3).toString(16).toUpperCase();return str4.length<2?"0"+str4:str4}});var require_conversions=__commonJS((exports,module3)=>{var cssKeywords=require_color_name(),reverseKeywords={};for(let key2 of Object.keys(cssKeywords))reverseKeywords[cssKeywords[key2]]=key2;var convert2={rgb:{channels:3,labels:"rgb"},hsl:{channels:3,labels:"hsl"},hsv:{channels:3,labels:"hsv"},hwb:{channels:3,labels:"hwb"},cmyk:{channels:4,labels:"cmyk"},xyz:{channels:3,labels:"xyz"},lab:{channels:3,labels:"lab"},lch:{channels:3,labels:"lch"},hex:{channels:1,labels:["hex"]},keyword:{channels:1,labels:["keyword"]},ansi16:{channels:1,labels:["ansi16"]},ansi256:{channels:1,labels:["ansi256"]},hcg:{channels:3,labels:["h","c","g"]},apple:{channels:3,labels:["r16","g16","b16"]},gray:{channels:1,labels:["gray"]}};module3.exports=convert2;for(let model of Object.keys(convert2)){if(!("channels"in convert2[model]))throw Error("missing channels property: "+model);if(!("labels"in convert2[model]))throw Error("missing channel labels property: "+model);if(convert2[model].labels.length!==convert2[model].channels)throw Error("channel and label counts mismatch: "+model);let{channels,labels}=convert2[model];delete convert2[model].channels,delete convert2[model].labels,Object.defineProperty(convert2[model],"channels",{value:channels}),Object.defineProperty(convert2[model],"labels",{value:labels})}convert2.rgb.hsl=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,min=Math.min(r,g,b),max=Math.max(r,g,b),delta=max-min,h,s;if(max===min)h=0;else if(r===max)h=(g-b)/delta;else if(g===max)h=2+(b-r)/delta;else if(b===max)h=4+(r-g)/delta;if(h=Math.min(h*60,360),h<0)h+=360;let l=(min+max)/2;if(max===min)s=0;else if(l<=0.5)s=delta/(max+min);else s=delta/(2-max-min);return[h,s*100,l*100]};convert2.rgb.hsv=function(rgb){let rdif,gdif,bdif,h,s,r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,v=Math.max(r,g,b),diff=v-Math.min(r,g,b),diffc=function(c){return(v-c)/6/diff+0.5};if(diff===0)h=0,s=0;else{if(s=diff/v,rdif=diffc(r),gdif=diffc(g),bdif=diffc(b),r===v)h=bdif-gdif;else if(g===v)h=0.3333333333333333+rdif-bdif;else if(b===v)h=0.6666666666666666+gdif-rdif;if(h<0)h+=1;else if(h>1)h-=1}return[h*360,s*100,v*100]};convert2.rgb.hwb=function(rgb){let r=rgb[0],g=rgb[1],b=rgb[2],h=convert2.rgb.hsl(rgb)[0],w=0.00392156862745098*Math.min(r,Math.min(g,b));return b=1-0.00392156862745098*Math.max(r,Math.max(g,b)),[h,w*100,b*100]};convert2.rgb.cmyk=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,k=Math.min(1-r,1-g,1-b),c=(1-r-k)/(1-k)||0,m=(1-g-k)/(1-k)||0,y=(1-b-k)/(1-k)||0;return[c*100,m*100,y*100,k*100]};function comparativeDistance(x,y){return(x[0]-y[0])**2+(x[1]-y[1])**2+(x[2]-y[2])**2}convert2.rgb.keyword=function(rgb){let reversed=reverseKeywords[rgb];if(reversed)return reversed;let currentClosestDistance=1/0,currentClosestKeyword;for(let keyword of Object.keys(cssKeywords)){let value2=cssKeywords[keyword],distance=comparativeDistance(rgb,value2);if(distance<currentClosestDistance)currentClosestDistance=distance,currentClosestKeyword=keyword}return currentClosestKeyword};convert2.keyword.rgb=function(keyword){return cssKeywords[keyword]};convert2.rgb.xyz=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255;r=r>0.04045?((r+0.055)/1.055)**2.4:r/12.92,g=g>0.04045?((g+0.055)/1.055)**2.4:g/12.92,b=b>0.04045?((b+0.055)/1.055)**2.4:b/12.92;let x=r*0.4124+g*0.3576+b*0.1805,y=r*0.2126+g*0.7152+b*0.0722,z=r*0.0193+g*0.1192+b*0.9505;return[x*100,y*100,z*100]};convert2.rgb.lab=function(rgb){let xyz=convert2.rgb.xyz(rgb),x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.hsl.rgb=function(hsl){let h=hsl[0]/360,s=hsl[1]/100,l=hsl[2]/100,t2,t3,val;if(s===0)return val=l*255,[val,val,val];if(l<0.5)t2=l*(1+s);else t2=l+s-l*s;let t1=2*l-t2,rgb=[0,0,0];for(let i=0;i<3;i++){if(t3=h+0.3333333333333333*-(i-1),t3<0)t3++;if(t3>1)t3--;if(6*t3<1)val=t1+(t2-t1)*6*t3;else if(2*t3<1)val=t2;else if(3*t3<2)val=t1+(t2-t1)*(0.6666666666666666-t3)*6;else val=t1;rgb[i]=val*255}return rgb};convert2.hsl.hsv=function(hsl){let h=hsl[0],s=hsl[1]/100,l=hsl[2]/100,smin=s,lmin=Math.max(l,0.01);l*=2,s*=l<=1?l:2-l,smin*=lmin<=1?lmin:2-lmin;let v=(l+s)/2,sv=l===0?2*smin/(lmin+smin):2*s/(l+s);return[h,sv*100,v*100]};convert2.hsv.rgb=function(hsv){let h=hsv[0]/60,s=hsv[1]/100,v=hsv[2]/100,hi=Math.floor(h)%6,f=h-Math.floor(h),p=255*v*(1-s),q=255*v*(1-s*f),t=255*v*(1-s*(1-f));switch(v*=255,hi){case 0:return[v,t,p];case 1:return[q,v,p];case 2:return[p,v,t];case 3:return[p,q,v];case 4:return[t,p,v];case 5:return[v,p,q]}};convert2.hsv.hsl=function(hsv){let h=hsv[0],s=hsv[1]/100,v=hsv[2]/100,vmin=Math.max(v,0.01),sl,l;l=(2-s)*v;let lmin=(2-s)*vmin;return sl=s*vmin,sl/=lmin<=1?lmin:2-lmin,sl=sl||0,l/=2,[h,sl*100,l*100]};convert2.hwb.rgb=function(hwb){let h=hwb[0]/360,wh=hwb[1]/100,bl=hwb[2]/100,ratio=wh+bl,f;if(ratio>1)wh/=ratio,bl/=ratio;let i=Math.floor(6*h),v=1-bl;if(f=6*h-i,(i&1)!==0)f=1-f;let n=wh+f*(v-wh),r,g,b;switch(i){default:case 6:case 0:r=v,g=n,b=wh;break;case 1:r=n,g=v,b=wh;break;case 2:r=wh,g=v,b=n;break;case 3:r=wh,g=n,b=v;break;case 4:r=n,g=wh,b=v;break;case 5:r=v,g=wh,b=n;break}return[r*255,g*255,b*255]};convert2.cmyk.rgb=function(cmyk){let c=cmyk[0]/100,m=cmyk[1]/100,y=cmyk[2]/100,k=cmyk[3]/100,r=1-Math.min(1,c*(1-k)+k),g=1-Math.min(1,m*(1-k)+k),b=1-Math.min(1,y*(1-k)+k);return[r*255,g*255,b*255]};convert2.xyz.rgb=function(xyz){let x=xyz[0]/100,y=xyz[1]/100,z=xyz[2]/100,r,g,b;return r=x*3.2406+y*-1.5372+z*-0.4986,g=x*-0.9689+y*1.8758+z*0.0415,b=x*0.0557+y*-0.204+z*1.057,r=r>0.0031308?1.055*r**0.4166666666666667-0.055:r*12.92,g=g>0.0031308?1.055*g**0.4166666666666667-0.055:g*12.92,b=b>0.0031308?1.055*b**0.4166666666666667-0.055:b*12.92,r=Math.min(Math.max(0,r),1),g=Math.min(Math.max(0,g),1),b=Math.min(Math.max(0,b),1),[r*255,g*255,b*255]};convert2.xyz.lab=function(xyz){let x=xyz[0],y=xyz[1],z=xyz[2];x/=95.047,y/=100,z/=108.883,x=x>0.008856?x**0.3333333333333333:7.787*x+0.13793103448275862,y=y>0.008856?y**0.3333333333333333:7.787*y+0.13793103448275862,z=z>0.008856?z**0.3333333333333333:7.787*z+0.13793103448275862;let l=116*y-16,a=500*(x-y),b=200*(y-z);return[l,a,b]};convert2.lab.xyz=function(lab){let l=lab[0],a=lab[1],b=lab[2],x,y,z;y=(l+16)/116,x=a/500+y,z=y-b/200;let y2=y**3,x2=x**3,z2=z**3;return y=y2>0.008856?y2:(y-0.13793103448275862)/7.787,x=x2>0.008856?x2:(x-0.13793103448275862)/7.787,z=z2>0.008856?z2:(z-0.13793103448275862)/7.787,x*=95.047,y*=100,z*=108.883,[x,y,z]};convert2.lab.lch=function(lab){let l=lab[0],a=lab[1],b=lab[2],h;if(h=Math.atan2(b,a)*360/2/Math.PI,h<0)h+=360;let c=Math.sqrt(a*a+b*b);return[l,c,h]};convert2.lch.lab=function(lch){let l=lch[0],c=lch[1],hr=lch[2]/360*2*Math.PI,a=c*Math.cos(hr),b=c*Math.sin(hr);return[l,a,b]};convert2.rgb.ansi16=function(args,saturation=null){let[r,g,b]=args,value2=saturation===null?convert2.rgb.hsv(args)[2]:saturation;if(value2=Math.round(value2/50),value2===0)return 30;let ansi=30+(Math.round(b/255)<<2|Math.round(g/255)<<1|Math.round(r/255));if(value2===2)ansi+=60;return ansi};convert2.hsv.ansi16=function(args){return convert2.rgb.ansi16(convert2.hsv.rgb(args),args[2])};convert2.rgb.ansi256=function(args){let r=args[0],g=args[1],b=args[2];if(r===g&&g===b){if(r<8)return 16;if(r>248)return 231;return Math.round((r-8)/247*24)+232}return 16+36*Math.round(r/255*5)+6*Math.round(g/255*5)+Math.round(b/255*5)};convert2.ansi16.rgb=function(args){let color=args%10;if(color===0||color===7){if(args>50)color+=3.5;return color=color/10.5*255,[color,color,color]}let mult=(~~(args>50)+1)*0.5,r=(color&1)*mult*255,g=(color>>1&1)*mult*255,b=(color>>2&1)*mult*255;return[r,g,b]};convert2.ansi256.rgb=function(args){if(args>=232){let c=(args-232)*10+8;return[c,c,c]}args-=16;let rem,r=Math.floor(args/36)/5*255,g=Math.floor((rem=args%36)/6)/5*255,b=rem%6/5*255;return[r,g,b]};convert2.rgb.hex=function(args){let string3=(((Math.round(args[0])&255)<<16)+((Math.round(args[1])&255)<<8)+(Math.round(args[2])&255)).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.hex.rgb=function(args){let match=args.toString(16).match(/[a-f0-9]{6}|[a-f0-9]{3}/i);if(!match)return[0,0,0];let colorString=match[0];if(match[0].length===3)colorString=colorString.split("").map((char)=>{return char+char}).join("");let integer3=parseInt(colorString,16),r=integer3>>16&255,g=integer3>>8&255,b=integer3&255;return[r,g,b]};convert2.rgb.hcg=function(rgb){let r=rgb[0]/255,g=rgb[1]/255,b=rgb[2]/255,max=Math.max(Math.max(r,g),b),min=Math.min(Math.min(r,g),b),chroma=max-min,grayscale,hue;if(chroma<1)grayscale=min/(1-chroma);else grayscale=0;if(chroma<=0)hue=0;else if(max===r)hue=(g-b)/chroma%6;else if(max===g)hue=2+(b-r)/chroma;else hue=4+(r-g)/chroma;return hue/=6,hue%=1,[hue*360,chroma*100,grayscale*100]};convert2.hsl.hcg=function(hsl){let s=hsl[1]/100,l=hsl[2]/100,c=l<0.5?2*s*l:2*s*(1-l),f=0;if(c<1)f=(l-0.5*c)/(1-c);return[hsl[0],c*100,f*100]};convert2.hsv.hcg=function(hsv){let s=hsv[1]/100,v=hsv[2]/100,c=s*v,f=0;if(c<1)f=(v-c)/(1-c);return[hsv[0],c*100,f*100]};convert2.hcg.rgb=function(hcg){let h=hcg[0]/360,c=hcg[1]/100,g=hcg[2]/100;if(c===0)return[g*255,g*255,g*255];let pure=[0,0,0],hi=h%1*6,v=hi%1,w=1-v,mg=0;switch(Math.floor(hi)){case 0:pure[0]=1,pure[1]=v,pure[2]=0;break;case 1:pure[0]=w,pure[1]=1,pure[2]=0;break;case 2:pure[0]=0,pure[1]=1,pure[2]=v;break;case 3:pure[0]=0,pure[1]=w,pure[2]=1;break;case 4:pure[0]=v,pure[1]=0,pure[2]=1;break;default:pure[0]=1,pure[1]=0,pure[2]=w}return mg=(1-c)*g,[(c*pure[0]+mg)*255,(c*pure[1]+mg)*255,(c*pure[2]+mg)*255]};convert2.hcg.hsv=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c),f=0;if(v>0)f=c/v;return[hcg[0],f*100,v*100]};convert2.hcg.hsl=function(hcg){let c=hcg[1]/100,l=hcg[2]/100*(1-c)+0.5*c,s=0;if(l>0&&l<0.5)s=c/(2*l);else if(l>=0.5&&l<1)s=c/(2*(1-l));return[hcg[0],s*100,l*100]};convert2.hcg.hwb=function(hcg){let c=hcg[1]/100,g=hcg[2]/100,v=c+g*(1-c);return[hcg[0],(v-c)*100,(1-v)*100]};convert2.hwb.hcg=function(hwb){let w=hwb[1]/100,v=1-hwb[2]/100,c=v-w,g=0;if(c<1)g=(v-c)/(1-c);return[hwb[0],c*100,g*100]};convert2.apple.rgb=function(apple){return[apple[0]/65535*255,apple[1]/65535*255,apple[2]/65535*255]};convert2.rgb.apple=function(rgb){return[rgb[0]/255*65535,rgb[1]/255*65535,rgb[2]/255*65535]};convert2.gray.rgb=function(args){return[args[0]/100*255,args[0]/100*255,args[0]/100*255]};convert2.gray.hsl=function(args){return[0,0,args[0]]};convert2.gray.hsv=convert2.gray.hsl;convert2.gray.hwb=function(gray){return[0,100,gray[0]]};convert2.gray.cmyk=function(gray){return[0,0,0,gray[0]]};convert2.gray.lab=function(gray){return[gray[0],0,0]};convert2.gray.hex=function(gray){let val=Math.round(gray[0]/100*255)&255,string3=((val<<16)+(val<<8)+val).toString(16).toUpperCase();return"000000".substring(string3.length)+string3};convert2.rgb.gray=function(rgb){return[(rgb[0]+rgb[1]+rgb[2])/3/255*100]}});var require_route=__commonJS((exports,module3)=>{var conversions=require_conversions();function buildGraph(){let graph={},models=Object.keys(conversions);for(let len=models.length,i=0;i<len;i++)graph[models[i]]={distance:-1,parent:null};return graph}function deriveBFS(fromModel){let graph=buildGraph(),queue=[fromModel];graph[fromModel].distance=0;while(queue.length){let current=queue.pop(),adjacents=Object.keys(conversions[current]);for(let len=adjacents.length,i=0;i<len;i++){let adjacent=adjacents[i],node=graph[adjacent];if(node.distance===-1)node.distance=graph[current].distance+1,node.parent=current,queue.unshift(adjacent)}}return graph}function link(from,to){return function(args){return to(from(args))}}function wrapConversion(toModel,graph){let path2=[graph[toModel].parent,toModel],fn=conversions[graph[toModel].parent][toModel],cur=graph[toModel].parent;while(graph[cur].parent)path2.unshift(graph[cur].parent),fn=link(conversions[graph[cur].parent][cur],fn),cur=graph[cur].parent;return fn.conversion=path2,fn}module3.exports=function(fromModel){let graph=deriveBFS(fromModel),conversion={},models=Object.keys(graph);for(let len=models.length,i=0;i<len;i++){let toModel=models[i];if(graph[toModel].parent===null)continue;conversion[toModel]=wrapConversion(toModel,graph)}return conversion}});var require_color_convert=__commonJS((exports,module3)=>{var conversions=require_conversions(),route=require_route(),convert2={},models=Object.keys(conversions);function wrapRaw(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;return fn(args)};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}function wrapRounded(fn){let wrappedFn=function(...args){let arg0=args[0];if(arg0===void 0||arg0===null)return arg0;if(arg0.length>1)args=arg0;let result=fn(args);if(typeof result==="object")for(let len=result.length,i=0;i<len;i++)result[i]=Math.round(result[i]);return result};if("conversion"in fn)wrappedFn.conversion=fn.conversion;return wrappedFn}models.forEach((fromModel)=>{convert2[fromModel]={},Object.defineProperty(convert2[fromModel],"channels",{value:conversions[fromModel].channels}),Object.defineProperty(convert2[fromModel],"labels",{value:conversions[fromModel].labels});let routes=route(fromModel);Object.keys(routes).forEach((toModel)=>{let fn=routes[toModel];convert2[fromModel][toModel]=wrapRounded(fn),convert2[fromModel][toModel].raw=wrapRaw(fn)})});module3.exports=convert2});var require_color=__commonJS((exports,module3)=>{var colorString=require_color_string(),convert2=require_color_convert(),skippedModels=["keyword","gray","hex"],hashedModelKeys={};for(let model of Object.keys(convert2))hashedModelKeys[[...convert2[model].labels].sort().join("")]=model;var limiters={};function Color(object3,model){if(!(this instanceof Color))return new Color(object3,model);if(model&&model in skippedModels)model=null;if(model&&!(model in convert2))throw Error("Unknown model: "+model);let i,channels;if(object3==null)this.model="rgb",this.color=[0,0,0],this.valpha=1;else if(object3 instanceof Color)this.model=object3.model,this.color=[...object3.color],this.valpha=object3.valpha;else if(typeof object3==="string"){let result=colorString.get(object3);if(result===null)throw Error("Unable to parse color from string: "+object3);this.model=result.model,channels=convert2[this.model].channels,this.color=result.value.slice(0,channels),this.valpha=typeof result.value[channels]==="number"?result.value[channels]:1}else if(object3.length>0){this.model=model||"rgb",channels=convert2[this.model].channels;let newArray=Array.prototype.slice.call(object3,0,channels);this.color=zeroArray(newArray,channels),this.valpha=typeof object3[channels]==="number"?object3[channels]:1}else if(typeof object3==="number")this.model="rgb",this.color=[object3>>16&255,object3>>8&255,object3&255],this.valpha=1;else{this.valpha=1;let keys=Object.keys(object3);if("alpha"in object3)keys.splice(keys.indexOf("alpha"),1),this.valpha=typeof object3.alpha==="number"?object3.alpha:0;let hashedKeys=keys.sort().join("");if(!(hashedKeys in hashedModelKeys))throw Error("Unable to parse color from object: "+JSON.stringify(object3));this.model=hashedModelKeys[hashedKeys];let{labels}=convert2[this.model],color=[];for(i=0;i<labels.length;i++)color.push(object3[labels[i]]);this.color=zeroArray(color)}if(limiters[this.model]){channels=convert2[this.model].channels;for(i=0;i<channels;i++){let limit=limiters[this.model][i];if(limit)this.color[i]=limit(this.color[i])}}if(this.valpha=Math.max(0,Math.min(1,this.valpha)),Object.freeze)Object.freeze(this)}Color.prototype={toString(){return this.string()},toJSON(){return this[this.model]()},string(places){let self2=this.model in colorString.to?this:this.rgb();self2=self2.round(typeof places==="number"?places:1);let args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to[self2.model](args)},percentString(places){let self2=this.rgb().round(typeof places==="number"?places:1),args=self2.valpha===1?self2.color:[...self2.color,this.valpha];return colorString.to.rgb.percent(args)},array(){return this.valpha===1?[...this.color]:[...this.color,this.valpha]},object(){let result={},{channels}=convert2[this.model],{labels}=convert2[this.model];for(let i=0;i<channels;i++)result[labels[i]]=this.color[i];if(this.valpha!==1)result.alpha=this.valpha;return result},unitArray(){let rgb=this.rgb().color;if(rgb[0]/=255,rgb[1]/=255,rgb[2]/=255,this.valpha!==1)rgb.push(this.valpha);return rgb},unitObject(){let rgb=this.rgb().object();if(rgb.r/=255,rgb.g/=255,rgb.b/=255,this.valpha!==1)rgb.alpha=this.valpha;return rgb},round(places){return places=Math.max(places||0,0),new Color([...this.color.map(roundToPlace(places)),this.valpha],this.model)},alpha(value2){if(value2!==void 0)return new Color([...this.color,Math.max(0,Math.min(1,value2))],this.model);return this.valpha},red:getset("rgb",0,maxfn(255)),green:getset("rgb",1,maxfn(255)),blue:getset("rgb",2,maxfn(255)),hue:getset(["hsl","hsv","hsl","hwb","hcg"],0,(value2)=>(value2%360+360)%360),saturationl:getset("hsl",1,maxfn(100)),lightness:getset("hsl",2,maxfn(100)),saturationv:getset("hsv",1,maxfn(100)),value:getset("hsv",2,maxfn(100)),chroma:getset("hcg",1,maxfn(100)),gray:getset("hcg",2,maxfn(100)),white:getset("hwb",1,maxfn(100)),wblack:getset("hwb",2,maxfn(100)),cyan:getset("cmyk",0,maxfn(100)),magenta:getset("cmyk",1,maxfn(100)),yellow:getset("cmyk",2,maxfn(100)),black:getset("cmyk",3,maxfn(100)),x:getset("xyz",0,maxfn(95.047)),y:getset("xyz",1,maxfn(100)),z:getset("xyz",2,maxfn(108.833)),l:getset("lab",0,maxfn(100)),a:getset("lab",1),b:getset("lab",2),keyword(value2){if(value2!==void 0)return new Color(value2);return convert2[this.model].keyword(this.color)},hex(value2){if(value2!==void 0)return new Color(value2);return colorString.to.hex(this.rgb().round().color)},hexa(value2){if(value2!==void 0)return new Color(value2);let rgbArray=this.rgb().round().color,alphaHex=Math.round(this.valpha*255).toString(16).toUpperCase();if(alphaHex.length===1)alphaHex="0"+alphaHex;return colorString.to.hex(rgbArray)+alphaHex},rgbNumber(){let rgb=this.rgb().color;return(rgb[0]&255)<<16|(rgb[1]&255)<<8|rgb[2]&255},luminosity(){let rgb=this.rgb().color,lum=[];for(let[i,element]of rgb.entries()){let chan=element/255;lum[i]=chan<=0.04045?chan/12.92:((chan+0.055)/1.055)**2.4}return 0.2126*lum[0]+0.7152*lum[1]+0.0722*lum[2]},contrast(color2){let lum1=this.luminosity(),lum2=color2.luminosity();if(lum1>lum2)return(lum1+0.05)/(lum2+0.05);return(lum2+0.05)/(lum1+0.05)},level(color2){let contrastRatio=this.contrast(color2);if(contrastRatio>=7)return"AAA";return contrastRatio>=4.5?"AA":""},isDark(){let rgb=this.rgb().color;return(rgb[0]*2126+rgb[1]*7152+rgb[2]*722)/1e4<128},isLight(){return!this.isDark()},negate(){let rgb=this.rgb();for(let i=0;i<3;i++)rgb.color[i]=255-rgb.color[i];return rgb},lighten(ratio){let hsl=this.hsl();return hsl.color[2]+=hsl.color[2]*ratio,hsl},darken(ratio){let hsl=this.hsl();return hsl.color[2]-=hsl.color[2]*ratio,hsl},saturate(ratio){let hsl=this.hsl();return hsl.color[1]+=hsl.color[1]*ratio,hsl},desaturate(ratio){let hsl=this.hsl();return hsl.color[1]-=hsl.color[1]*ratio,hsl},whiten(ratio){let hwb=this.hwb();return hwb.color[1]+=hwb.color[1]*ratio,hwb},blacken(ratio){let hwb=this.hwb();return hwb.color[2]+=hwb.color[2]*ratio,hwb},grayscale(){let rgb=this.rgb().color,value2=rgb[0]*0.3+rgb[1]*0.59+rgb[2]*0.11;return Color.rgb(value2,value2,value2)},fade(ratio){return this.alpha(this.valpha-this.valpha*ratio)},opaquer(ratio){return this.alpha(this.valpha+this.valpha*ratio)},rotate(degrees){let hsl=this.hsl(),hue=hsl.color[0];return hue=(hue+degrees)%360,hue=hue<0?360+hue:hue,hsl.color[0]=hue,hsl},mix(mixinColor,weight){if(!mixinColor||!mixinColor.rgb)throw Error('Argument to "mix" was not a Color instance, but rather an instance of '+typeof mixinColor);let color1=mixinColor.rgb(),color2=this.rgb(),p=weight===void 0?0.5:weight,w=2*p-1,a=color1.alpha()-color2.alpha(),w1=((w*a===-1?w:(w+a)/(1+w*a))+1)/2,w2=1-w1;return Color.rgb(w1*color1.red()+w2*color2.red(),w1*color1.green()+w2*color2.green(),w1*color1.blue()+w2*color2.blue(),color1.alpha()*p+color2.alpha()*(1-p))}};for(let model of Object.keys(convert2)){if(skippedModels.includes(model))continue;let{channels}=convert2[model];Color.prototype[model]=function(...args){if(this.model===model)return new Color(this);if(args.length>0)return new Color(args,model);return new Color([...assertArray(convert2[this.model][model].raw(this.color)),this.valpha],model)},Color[model]=function(...args){let color=args[0];if(typeof color==="number")color=zeroArray(args,channels);return new Color(color,model)}}function roundTo(number3,places){return Number(number3.toFixed(places))}function roundToPlace(places){return function(number3){return roundTo(number3,places)}}function getset(model,channel,modifier){model=Array.isArray(model)?model:[model];for(let m of model)(limiters[m]||(limiters[m]=[]))[channel]=modifier;return model=model[0],function(value2){let result;if(value2!==void 0){if(modifier)value2=modifier(value2);return result=this[model](),result.color[channel]=value2,result}if(result=this[model]().color[channel],modifier)result=modifier(result);return result}}function maxfn(max){return function(v){return Math.max(0,Math.min(max,v))}}function assertArray(value2){return Array.isArray(value2)?value2:[value2]}function zeroArray(array3,length){for(let i=0;i<length;i++)if(typeof array3[i]!=="number")array3[i]=0;return array3}module3.exports=Color});var require_input=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),sharp=require_sharp(),align={left:"low",center:"centre",centre:"centre",right:"high"};function _inputOptionsFromObject(obj){let{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}=obj;return[raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd].some(is2.defined)?{raw,density,limitInputPixels,ignoreIcc,unlimited,sequentialRead,failOn,failOnError,animated,page,pages,subifd}:void 0}function _createInputDescriptor(input,inputOptions,containerOptions){let inputDescriptor={failOn:"warning",limitInputPixels:Math.pow(16383,2),ignoreIcc:!1,unlimited:!1,sequentialRead:!0};if(is2.string(input))inputDescriptor.file=input;else if(is2.buffer(input)){if(input.length===0)throw Error("Input Buffer is empty");inputDescriptor.buffer=input}else if(is2.arrayBuffer(input)){if(input.byteLength===0)throw Error("Input bit Array is empty");inputDescriptor.buffer=Buffer.from(input,0,input.byteLength)}else if(is2.typedArray(input)){if(input.length===0)throw Error("Input Bit Array is empty");inputDescriptor.buffer=Buffer.from(input.buffer,input.byteOffset,input.byteLength)}else if(is2.plainObject(input)&&!is2.defined(inputOptions)){if(inputOptions=input,_inputOptionsFromObject(inputOptions))inputDescriptor.buffer=[]}else if(!is2.defined(input)&&!is2.defined(inputOptions)&&is2.object(containerOptions)&&containerOptions.allowStream)inputDescriptor.buffer=[];else throw Error(`Unsupported input '${input}' of type ${typeof input}${is2.defined(inputOptions)?` when also providing options of type ${typeof inputOptions}`:""}`);if(is2.object(inputOptions)){if(is2.defined(inputOptions.failOnError))if(is2.bool(inputOptions.failOnError))inputDescriptor.failOn=inputOptions.failOnError?"warning":"none";else throw is2.invalidParameterError("failOnError","boolean",inputOptions.failOnError);if(is2.defined(inputOptions.failOn))if(is2.string(inputOptions.failOn)&&is2.inArray(inputOptions.failOn,["none","truncated","error","warning"]))inputDescriptor.failOn=inputOptions.failOn;else throw is2.invalidParameterError("failOn","one of: none, truncated, error, warning",inputOptions.failOn);if(is2.defined(inputOptions.density))if(is2.inRange(inputOptions.density,1,1e5))inputDescriptor.density=inputOptions.density;else throw is2.invalidParameterError("density","number between 1 and 100000",inputOptions.density);if(is2.defined(inputOptions.ignoreIcc))if(is2.bool(inputOptions.ignoreIcc))inputDescriptor.ignoreIcc=inputOptions.ignoreIcc;else throw is2.invalidParameterError("ignoreIcc","boolean",inputOptions.ignoreIcc);if(is2.defined(inputOptions.limitInputPixels))if(is2.bool(inputOptions.limitInputPixels))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels?Math.pow(16383,2):0;else if(is2.integer(inputOptions.limitInputPixels)&&is2.inRange(inputOptions.limitInputPixels,0,Number.MAX_SAFE_INTEGER))inputDescriptor.limitInputPixels=inputOptions.limitInputPixels;else throw is2.invalidParameterError("limitInputPixels","positive integer",inputOptions.limitInputPixels);if(is2.defined(inputOptions.unlimited))if(is2.bool(inputOptions.unlimited))inputDescriptor.unlimited=inputOptions.unlimited;else throw is2.invalidParameterError("unlimited","boolean",inputOptions.unlimited);if(is2.defined(inputOptions.sequentialRead))if(is2.bool(inputOptions.sequentialRead))inputDescriptor.sequentialRead=inputOptions.sequentialRead;else throw is2.invalidParameterError("sequentialRead","boolean",inputOptions.sequentialRead);if(is2.defined(inputOptions.raw))if(is2.object(inputOptions.raw)&&is2.integer(inputOptions.raw.width)&&inputOptions.raw.width>0&&is2.integer(inputOptions.raw.height)&&inputOptions.raw.height>0&&is2.integer(inputOptions.raw.channels)&&is2.inRange(inputOptions.raw.channels,1,4))switch(inputDescriptor.rawWidth=inputOptions.raw.width,inputDescriptor.rawHeight=inputOptions.raw.height,inputDescriptor.rawChannels=inputOptions.raw.channels,inputDescriptor.rawPremultiplied=!!inputOptions.raw.premultiplied,input.constructor){case Uint8Array:case Uint8ClampedArray:inputDescriptor.rawDepth="uchar";break;case Int8Array:inputDescriptor.rawDepth="char";break;case Uint16Array:inputDescriptor.rawDepth="ushort";break;case Int16Array:inputDescriptor.rawDepth="short";break;case Uint32Array:inputDescriptor.rawDepth="uint";break;case Int32Array:inputDescriptor.rawDepth="int";break;case Float32Array:inputDescriptor.rawDepth="float";break;case Float64Array:inputDescriptor.rawDepth="double";break;default:inputDescriptor.rawDepth="uchar";break}else throw Error("Expected width, height and channels for raw pixel input");if(is2.defined(inputOptions.animated))if(is2.bool(inputOptions.animated))inputDescriptor.pages=inputOptions.animated?-1:1;else throw is2.invalidParameterError("animated","boolean",inputOptions.animated);if(is2.defined(inputOptions.pages))if(is2.integer(inputOptions.pages)&&is2.inRange(inputOptions.pages,-1,1e5))inputDescriptor.pages=inputOptions.pages;else throw is2.invalidParameterError("pages","integer between -1 and 100000",inputOptions.pages);if(is2.defined(inputOptions.page))if(is2.integer(inputOptions.page)&&is2.inRange(inputOptions.page,0,1e5))inputDescriptor.page=inputOptions.page;else throw is2.invalidParameterError("page","integer between 0 and 100000",inputOptions.page);if(is2.defined(inputOptions.level))if(is2.integer(inputOptions.level)&&is2.inRange(inputOptions.level,0,256))inputDescriptor.level=inputOptions.level;else throw is2.invalidParameterError("level","integer between 0 and 256",inputOptions.level);if(is2.defined(inputOptions.subifd))if(is2.integer(inputOptions.subifd)&&is2.inRange(inputOptions.subifd,-1,1e5))inputDescriptor.subifd=inputOptions.subifd;else throw is2.invalidParameterError("subifd","integer between -1 and 100000",inputOptions.subifd);if(is2.defined(inputOptions.create))if(is2.object(inputOptions.create)&&is2.integer(inputOptions.create.width)&&inputOptions.create.width>0&&is2.integer(inputOptions.create.height)&&inputOptions.create.height>0&&is2.integer(inputOptions.create.channels)){if(inputDescriptor.createWidth=inputOptions.create.width,inputDescriptor.createHeight=inputOptions.create.height,inputDescriptor.createChannels=inputOptions.create.channels,is2.defined(inputOptions.create.noise)){if(!is2.object(inputOptions.create.noise))throw Error("Expected noise to be an object");if(!is2.inArray(inputOptions.create.noise.type,["gaussian"]))throw Error("Only gaussian noise is supported at the moment");if(!is2.inRange(inputOptions.create.channels,1,4))throw is2.invalidParameterError("create.channels","number between 1 and 4",inputOptions.create.channels);if(inputDescriptor.createNoiseType=inputOptions.create.noise.type,is2.number(inputOptions.create.noise.mean)&&is2.inRange(inputOptions.create.noise.mean,0,1e4))inputDescriptor.createNoiseMean=inputOptions.create.noise.mean;else throw is2.invalidParameterError("create.noise.mean","number between 0 and 10000",inputOptions.create.noise.mean);if(is2.number(inputOptions.create.noise.sigma)&&is2.inRange(inputOptions.create.noise.sigma,0,1e4))inputDescriptor.createNoiseSigma=inputOptions.create.noise.sigma;else throw is2.invalidParameterError("create.noise.sigma","number between 0 and 10000",inputOptions.create.noise.sigma)}else if(is2.defined(inputOptions.create.background)){if(!is2.inRange(inputOptions.create.channels,3,4))throw is2.invalidParameterError("create.channels","number between 3 and 4",inputOptions.create.channels);let background=color(inputOptions.create.background);inputDescriptor.createBackground=[background.red(),background.green(),background.blue(),Math.round(background.alpha()*255)]}else throw Error("Expected valid noise or background to create a new input image");delete inputDescriptor.buffer}else throw Error("Expected valid width, height and channels to create a new input image");if(is2.defined(inputOptions.text))if(is2.object(inputOptions.text)&&is2.string(inputOptions.text.text)){if(inputDescriptor.textValue=inputOptions.text.text,is2.defined(inputOptions.text.height)&&is2.defined(inputOptions.text.dpi))throw Error("Expected only one of dpi or height");if(is2.defined(inputOptions.text.font))if(is2.string(inputOptions.text.font))inputDescriptor.textFont=inputOptions.text.font;else throw is2.invalidParameterError("text.font","string",inputOptions.text.font);if(is2.defined(inputOptions.text.fontfile))if(is2.string(inputOptions.text.fontfile))inputDescriptor.textFontfile=inputOptions.text.fontfile;else throw is2.invalidParameterError("text.fontfile","string",inputOptions.text.fontfile);if(is2.defined(inputOptions.text.width))if(is2.integer(inputOptions.text.width)&&inputOptions.text.width>0)inputDescriptor.textWidth=inputOptions.text.width;else throw is2.invalidParameterError("text.width","positive integer",inputOptions.text.width);if(is2.defined(inputOptions.text.height))if(is2.integer(inputOptions.text.height)&&inputOptions.text.height>0)inputDescriptor.textHeight=inputOptions.text.height;else throw is2.invalidParameterError("text.height","positive integer",inputOptions.text.height);if(is2.defined(inputOptions.text.align))if(is2.string(inputOptions.text.align)&&is2.string(this.constructor.align[inputOptions.text.align]))inputDescriptor.textAlign=this.constructor.align[inputOptions.text.align];else throw is2.invalidParameterError("text.align","valid alignment",inputOptions.text.align);if(is2.defined(inputOptions.text.justify))if(is2.bool(inputOptions.text.justify))inputDescriptor.textJustify=inputOptions.text.justify;else throw is2.invalidParameterError("text.justify","boolean",inputOptions.text.justify);if(is2.defined(inputOptions.text.dpi))if(is2.integer(inputOptions.text.dpi)&&is2.inRange(inputOptions.text.dpi,1,1e6))inputDescriptor.textDpi=inputOptions.text.dpi;else throw is2.invalidParameterError("text.dpi","integer between 1 and 1000000",inputOptions.text.dpi);if(is2.defined(inputOptions.text.rgba))if(is2.bool(inputOptions.text.rgba))inputDescriptor.textRgba=inputOptions.text.rgba;else throw is2.invalidParameterError("text.rgba","bool",inputOptions.text.rgba);if(is2.defined(inputOptions.text.spacing))if(is2.integer(inputOptions.text.spacing)&&is2.inRange(inputOptions.text.spacing,-1e6,1e6))inputDescriptor.textSpacing=inputOptions.text.spacing;else throw is2.invalidParameterError("text.spacing","integer between -1000000 and 1000000",inputOptions.text.spacing);if(is2.defined(inputOptions.text.wrap))if(is2.string(inputOptions.text.wrap)&&is2.inArray(inputOptions.text.wrap,["word","char","word-char","none"]))inputDescriptor.textWrap=inputOptions.text.wrap;else throw is2.invalidParameterError("text.wrap","one of: word, char, word-char, none",inputOptions.text.wrap);delete inputDescriptor.buffer}else throw Error("Expected a valid string to create an image with text.")}else if(is2.defined(inputOptions))throw Error("Invalid input options "+inputOptions);return inputDescriptor}function _write(chunk,encoding,callback){if(Array.isArray(this.options.input.buffer))if(is2.buffer(chunk)){if(this.options.input.buffer.length===0)this.on("finish",()=>{this.streamInFinished=!0});this.options.input.buffer.push(chunk),callback()}else callback(Error("Non-Buffer data on Writable Stream"));else callback(Error("Unexpected data on Writable Stream"))}function _flattenBufferIn(){if(this._isStreamInput())this.options.input.buffer=Buffer.concat(this.options.input.buffer)}function _isStreamInput(){return Array.isArray(this.options.input.buffer)}function metadata(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)})});else sharp.metadata(this.options,(err,metadata2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,metadata2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{let finished=()=>{this._flattenBufferIn(),sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})};if(this.writableFinished)finished();else this.once("finish",finished)});else return new Promise((resolve2,reject)=>{sharp.metadata(this.options,(err,metadata2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(metadata2)})})}function stats(callback){let stack=Error();if(is2.fn(callback)){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)})});else sharp.stats(this.options,(err,stats2)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,stats2)});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.on("finish",function(){this._flattenBufferIn(),sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})});else return new Promise((resolve2,reject)=>{sharp.stats(this.options,(err,stats2)=>{if(err)reject(is2.nativeError(err,stack));else resolve2(stats2)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{_inputOptionsFromObject,_createInputDescriptor,_write,_flattenBufferIn,_isStreamInput,metadata,stats}),Sharp.align=align}});var require_resize=__commonJS((exports,module3)=>{var is2=require_is(),gravity={center:0,centre:0,north:1,east:2,south:3,west:4,northeast:5,southeast:6,southwest:7,northwest:8},position={top:1,right:2,bottom:3,left:4,"right top":5,"right bottom":6,"left bottom":7,"left top":8},extendWith={background:"background",copy:"copy",repeat:"repeat",mirror:"mirror"},strategy={entropy:16,attention:17},kernel={nearest:"nearest",linear:"linear",cubic:"cubic",mitchell:"mitchell",lanczos2:"lanczos2",lanczos3:"lanczos3"},fit={contain:"contain",cover:"cover",fill:"fill",inside:"inside",outside:"outside"},mapFitToCanvas={contain:"embed",cover:"crop",fill:"ignore_aspect",inside:"max",outside:"min"};function isRotationExpected(options){return options.angle%360!==0||options.useExifOrientation===!0||options.rotationAngle!==0}function isResizeExpected(options){return options.width!==-1||options.height!==-1}function resize(widthOrOptions,height,options){if(isResizeExpected(this.options))this.options.debuglog("ignoring previous resize options");if(this.options.widthPost!==-1)this.options.debuglog("operation order will be: extract, resize, extract");if(is2.defined(widthOrOptions))if(is2.object(widthOrOptions)&&!is2.defined(options))options=widthOrOptions;else if(is2.integer(widthOrOptions)&&widthOrOptions>0)this.options.width=widthOrOptions;else throw is2.invalidParameterError("width","positive integer",widthOrOptions);else this.options.width=-1;if(is2.defined(height))if(is2.integer(height)&&height>0)this.options.height=height;else throw is2.invalidParameterError("height","positive integer",height);else this.options.height=-1;if(is2.object(options)){if(is2.defined(options.width))if(is2.integer(options.width)&&options.width>0)this.options.width=options.width;else throw is2.invalidParameterError("width","positive integer",options.width);if(is2.defined(options.height))if(is2.integer(options.height)&&options.height>0)this.options.height=options.height;else throw is2.invalidParameterError("height","positive integer",options.height);if(is2.defined(options.fit)){let canvas=mapFitToCanvas[options.fit];if(is2.string(canvas))this.options.canvas=canvas;else throw is2.invalidParameterError("fit","valid fit",options.fit)}if(is2.defined(options.position)){let pos=is2.integer(options.position)?options.position:strategy[options.position]||position[options.position]||gravity[options.position];if(is2.integer(pos)&&(is2.inRange(pos,0,8)||is2.inRange(pos,16,17)))this.options.position=pos;else throw is2.invalidParameterError("position","valid position/gravity/strategy",options.position)}if(this._setBackgroundColourOption("resizeBackground",options.background),is2.defined(options.kernel))if(is2.string(kernel[options.kernel]))this.options.kernel=kernel[options.kernel];else throw is2.invalidParameterError("kernel","valid kernel name",options.kernel);if(is2.defined(options.withoutEnlargement))this._setBooleanOption("withoutEnlargement",options.withoutEnlargement);if(is2.defined(options.withoutReduction))this._setBooleanOption("withoutReduction",options.withoutReduction);if(is2.defined(options.fastShrinkOnLoad))this._setBooleanOption("fastShrinkOnLoad",options.fastShrinkOnLoad)}if(isRotationExpected(this.options)&&isResizeExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}function extend(extend2){if(is2.integer(extend2)&&extend2>0)this.options.extendTop=extend2,this.options.extendBottom=extend2,this.options.extendLeft=extend2,this.options.extendRight=extend2;else if(is2.object(extend2)){if(is2.defined(extend2.top))if(is2.integer(extend2.top)&&extend2.top>=0)this.options.extendTop=extend2.top;else throw is2.invalidParameterError("top","positive integer",extend2.top);if(is2.defined(extend2.bottom))if(is2.integer(extend2.bottom)&&extend2.bottom>=0)this.options.extendBottom=extend2.bottom;else throw is2.invalidParameterError("bottom","positive integer",extend2.bottom);if(is2.defined(extend2.left))if(is2.integer(extend2.left)&&extend2.left>=0)this.options.extendLeft=extend2.left;else throw is2.invalidParameterError("left","positive integer",extend2.left);if(is2.defined(extend2.right))if(is2.integer(extend2.right)&&extend2.right>=0)this.options.extendRight=extend2.right;else throw is2.invalidParameterError("right","positive integer",extend2.right);if(this._setBackgroundColourOption("extendBackground",extend2.background),is2.defined(extend2.extendWith))if(is2.string(extendWith[extend2.extendWith]))this.options.extendWith=extendWith[extend2.extendWith];else throw is2.invalidParameterError("extendWith","one of: background, copy, repeat, mirror",extend2.extendWith)}else throw is2.invalidParameterError("extend","integer or object",extend2);return this}function extract3(options){let suffix=isResizeExpected(this.options)||this.options.widthPre!==-1?"Post":"Pre";if(this.options[`width${suffix}`]!==-1)this.options.debuglog("ignoring previous extract options");if(["left","top","width","height"].forEach(function(name2){let value2=options[name2];if(is2.integer(value2)&&value2>=0)this.options[name2+(name2==="left"||name2==="top"?"Offset":"")+suffix]=value2;else throw is2.invalidParameterError(name2,"integer",value2)},this),isRotationExpected(this.options)&&!isResizeExpected(this.options)){if(this.options.widthPre===-1||this.options.widthPost===-1)this.options.rotateBeforePreExtract=!0}return this}function trim(options){if(this.options.trimThreshold=10,is2.defined(options))if(is2.object(options)){if(is2.defined(options.background))this._setBackgroundColourOption("trimBackground",options.background);if(is2.defined(options.threshold))if(is2.number(options.threshold)&&options.threshold>=0)this.options.trimThreshold=options.threshold;else throw is2.invalidParameterError("threshold","positive number",options.threshold);if(is2.defined(options.lineArt))this._setBooleanOption("trimLineArt",options.lineArt)}else throw is2.invalidParameterError("trim","object",options);if(isRotationExpected(this.options))this.options.rotateBeforePreExtract=!0;return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{resize,extend,extract:extract3,trim}),Sharp.gravity=gravity,Sharp.strategy=strategy,Sharp.kernel=kernel,Sharp.fit=fit,Sharp.position=position}});var require_composite=__commonJS((exports,module3)=>{var is2=require_is(),blend={clear:"clear",source:"source",over:"over",in:"in",out:"out",atop:"atop",dest:"dest","dest-over":"dest-over","dest-in":"dest-in","dest-out":"dest-out","dest-atop":"dest-atop",xor:"xor",add:"add",saturate:"saturate",multiply:"multiply",screen:"screen",overlay:"overlay",darken:"darken",lighten:"lighten","colour-dodge":"colour-dodge","color-dodge":"colour-dodge","colour-burn":"colour-burn","color-burn":"colour-burn","hard-light":"hard-light","soft-light":"soft-light",difference:"difference",exclusion:"exclusion"};function composite3(images){if(!Array.isArray(images))throw is2.invalidParameterError("images to composite","array",images);return this.options.composite=images.map((image)=>{if(!is2.object(image))throw is2.invalidParameterError("image to composite","object",image);let inputOptions=this._inputOptionsFromObject(image),composite4={input:this._createInputDescriptor(image.input,inputOptions,{allowStream:!1}),blend:"over",tile:!1,left:0,top:0,hasOffset:!1,gravity:0,premultiplied:!1};if(is2.defined(image.blend))if(is2.string(blend[image.blend]))composite4.blend=blend[image.blend];else throw is2.invalidParameterError("blend","valid blend name",image.blend);if(is2.defined(image.tile))if(is2.bool(image.tile))composite4.tile=image.tile;else throw is2.invalidParameterError("tile","boolean",image.tile);if(is2.defined(image.left))if(is2.integer(image.left))composite4.left=image.left;else throw is2.invalidParameterError("left","integer",image.left);if(is2.defined(image.top))if(is2.integer(image.top))composite4.top=image.top;else throw is2.invalidParameterError("top","integer",image.top);if(is2.defined(image.top)!==is2.defined(image.left))throw Error("Expected both left and top to be set");else composite4.hasOffset=is2.integer(image.top)&&is2.integer(image.left);if(is2.defined(image.gravity))if(is2.integer(image.gravity)&&is2.inRange(image.gravity,0,8))composite4.gravity=image.gravity;else if(is2.string(image.gravity)&&is2.integer(this.constructor.gravity[image.gravity]))composite4.gravity=this.constructor.gravity[image.gravity];else throw is2.invalidParameterError("gravity","valid gravity",image.gravity);if(is2.defined(image.premultiplied))if(is2.bool(image.premultiplied))composite4.premultiplied=image.premultiplied;else throw is2.invalidParameterError("premultiplied","boolean",image.premultiplied);return composite4}),this}module3.exports=function(Sharp){Sharp.prototype.composite=composite3,Sharp.blend=blend}});var require_operation=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),vipsPrecision={integer:"integer",float:"float",approximate:"approximate"};function rotate(angle,options){if(this.options.useExifOrientation||this.options.angle||this.options.rotationAngle)this.options.debuglog("ignoring previous rotate options");if(!is2.defined(angle))this.options.useExifOrientation=!0;else if(is2.integer(angle)&&!(angle%90))this.options.angle=angle;else if(is2.number(angle)){if(this.options.rotationAngle=angle,is2.object(options)&&options.background){let backgroundColour=color(options.background);this.options.rotationBackground=[backgroundColour.red(),backgroundColour.green(),backgroundColour.blue(),Math.round(backgroundColour.alpha()*255)]}}else throw is2.invalidParameterError("angle","numeric",angle);return this}function flip(flip2){return this.options.flip=is2.bool(flip2)?flip2:!0,this}function flop(flop2){return this.options.flop=is2.bool(flop2)?flop2:!0,this}function affine(matrix,options){let flatMatrix=[].concat(...matrix);if(flatMatrix.length===4&&flatMatrix.every(is2.number))this.options.affineMatrix=flatMatrix;else throw is2.invalidParameterError("matrix","1x4 or 2x2 array",matrix);if(is2.defined(options))if(is2.object(options)){if(this._setBackgroundColourOption("affineBackground",options.background),is2.defined(options.idx))if(is2.number(options.idx))this.options.affineIdx=options.idx;else throw is2.invalidParameterError("options.idx","number",options.idx);if(is2.defined(options.idy))if(is2.number(options.idy))this.options.affineIdy=options.idy;else throw is2.invalidParameterError("options.idy","number",options.idy);if(is2.defined(options.odx))if(is2.number(options.odx))this.options.affineOdx=options.odx;else throw is2.invalidParameterError("options.odx","number",options.odx);if(is2.defined(options.ody))if(is2.number(options.ody))this.options.affineOdy=options.ody;else throw is2.invalidParameterError("options.ody","number",options.ody);if(is2.defined(options.interpolator))if(is2.inArray(options.interpolator,Object.values(this.constructor.interpolators)))this.options.affineInterpolator=options.interpolator;else throw is2.invalidParameterError("options.interpolator","valid interpolator name",options.interpolator)}else throw is2.invalidParameterError("options","object",options);return this}function sharpen(options,flat,jagged){if(!is2.defined(options))this.options.sharpenSigma=-1;else if(is2.bool(options))this.options.sharpenSigma=options?-1:0;else if(is2.number(options)&&is2.inRange(options,0.01,1e4)){if(this.options.sharpenSigma=options,is2.defined(flat))if(is2.number(flat)&&is2.inRange(flat,0,1e4))this.options.sharpenM1=flat;else throw is2.invalidParameterError("flat","number between 0 and 10000",flat);if(is2.defined(jagged))if(is2.number(jagged)&&is2.inRange(jagged,0,1e4))this.options.sharpenM2=jagged;else throw is2.invalidParameterError("jagged","number between 0 and 10000",jagged)}else if(is2.plainObject(options)){if(is2.number(options.sigma)&&is2.inRange(options.sigma,0.000001,10))this.options.sharpenSigma=options.sigma;else throw is2.invalidParameterError("options.sigma","number between 0.000001 and 10",options.sigma);if(is2.defined(options.m1))if(is2.number(options.m1)&&is2.inRange(options.m1,0,1e6))this.options.sharpenM1=options.m1;else throw is2.invalidParameterError("options.m1","number between 0 and 1000000",options.m1);if(is2.defined(options.m2))if(is2.number(options.m2)&&is2.inRange(options.m2,0,1e6))this.options.sharpenM2=options.m2;else throw is2.invalidParameterError("options.m2","number between 0 and 1000000",options.m2);if(is2.defined(options.x1))if(is2.number(options.x1)&&is2.inRange(options.x1,0,1e6))this.options.sharpenX1=options.x1;else throw is2.invalidParameterError("options.x1","number between 0 and 1000000",options.x1);if(is2.defined(options.y2))if(is2.number(options.y2)&&is2.inRange(options.y2,0,1e6))this.options.sharpenY2=options.y2;else throw is2.invalidParameterError("options.y2","number between 0 and 1000000",options.y2);if(is2.defined(options.y3))if(is2.number(options.y3)&&is2.inRange(options.y3,0,1e6))this.options.sharpenY3=options.y3;else throw is2.invalidParameterError("options.y3","number between 0 and 1000000",options.y3)}else throw is2.invalidParameterError("sigma","number between 0.01 and 10000",options);return this}function median2(size){if(!is2.defined(size))this.options.medianSize=3;else if(is2.integer(size)&&is2.inRange(size,1,1000))this.options.medianSize=size;else throw is2.invalidParameterError("size","integer between 1 and 1000",size);return this}function blur(options){let sigma;if(is2.number(options))sigma=options;else if(is2.plainObject(options)){if(!is2.number(options.sigma))throw is2.invalidParameterError("options.sigma","number between 0.3 and 1000",sigma);if(sigma=options.sigma,"precision"in options)if(is2.string(vipsPrecision[options.precision]))this.options.precision=vipsPrecision[options.precision];else throw is2.invalidParameterError("precision","one of: integer, float, approximate",options.precision);if("minAmplitude"in options)if(is2.number(options.minAmplitude)&&is2.inRange(options.minAmplitude,0.001,1))this.options.minAmpl=options.minAmplitude;else throw is2.invalidParameterError("minAmplitude","number between 0.001 and 1",options.minAmplitude)}if(!is2.defined(options))this.options.blurSigma=-1;else if(is2.bool(options))this.options.blurSigma=options?-1:0;else if(is2.number(sigma)&&is2.inRange(sigma,0.3,1000))this.options.blurSigma=sigma;else throw is2.invalidParameterError("sigma","number between 0.3 and 1000",sigma);return this}function flatten(options){if(this.options.flatten=is2.bool(options)?options:!0,is2.object(options))this._setBackgroundColourOption("flattenBackground",options.background);return this}function unflatten(){return this.options.unflatten=!0,this}function gamma(gamma2,gammaOut){if(!is2.defined(gamma2))this.options.gamma=2.2;else if(is2.number(gamma2)&&is2.inRange(gamma2,1,3))this.options.gamma=gamma2;else throw is2.invalidParameterError("gamma","number between 1.0 and 3.0",gamma2);if(!is2.defined(gammaOut))this.options.gammaOut=this.options.gamma;else if(is2.number(gammaOut)&&is2.inRange(gammaOut,1,3))this.options.gammaOut=gammaOut;else throw is2.invalidParameterError("gammaOut","number between 1.0 and 3.0",gammaOut);return this}function negate(options){if(this.options.negate=is2.bool(options)?options:!0,is2.plainObject(options)&&"alpha"in options)if(!is2.bool(options.alpha))throw is2.invalidParameterError("alpha","should be boolean value",options.alpha);else this.options.negateAlpha=options.alpha;return this}function normalise(options){if(is2.plainObject(options)){if(is2.defined(options.lower))if(is2.number(options.lower)&&is2.inRange(options.lower,0,99))this.options.normaliseLower=options.lower;else throw is2.invalidParameterError("lower","number between 0 and 99",options.lower);if(is2.defined(options.upper))if(is2.number(options.upper)&&is2.inRange(options.upper,1,100))this.options.normaliseUpper=options.upper;else throw is2.invalidParameterError("upper","number between 1 and 100",options.upper)}if(this.options.normaliseLower>=this.options.normaliseUpper)throw is2.invalidParameterError("range","lower to be less than upper",`${this.options.normaliseLower} >= ${this.options.normaliseUpper}`);return this.options.normalise=!0,this}function normalize3(options){return this.normalise(options)}function clahe(options){if(is2.plainObject(options)){if(is2.integer(options.width)&&options.width>0)this.options.claheWidth=options.width;else throw is2.invalidParameterError("width","integer greater than zero",options.width);if(is2.integer(options.height)&&options.height>0)this.options.claheHeight=options.height;else throw is2.invalidParameterError("height","integer greater than zero",options.height);if(is2.defined(options.maxSlope))if(is2.integer(options.maxSlope)&&is2.inRange(options.maxSlope,0,100))this.options.claheMaxSlope=options.maxSlope;else throw is2.invalidParameterError("maxSlope","integer between 0 and 100",options.maxSlope)}else throw is2.invalidParameterError("options","plain object",options);return this}function convolve(kernel){if(!is2.object(kernel)||!Array.isArray(kernel.kernel)||!is2.integer(kernel.width)||!is2.integer(kernel.height)||!is2.inRange(kernel.width,3,1001)||!is2.inRange(kernel.height,3,1001)||kernel.height*kernel.width!==kernel.kernel.length)throw Error("Invalid convolution kernel");if(!is2.integer(kernel.scale))kernel.scale=kernel.kernel.reduce(function(a,b){return a+b},0);if(kernel.scale<1)kernel.scale=1;if(!is2.integer(kernel.offset))kernel.offset=0;return this.options.convKernel=kernel,this}function threshold(threshold2,options){if(!is2.defined(threshold2))this.options.threshold=128;else if(is2.bool(threshold2))this.options.threshold=threshold2?128:0;else if(is2.integer(threshold2)&&is2.inRange(threshold2,0,255))this.options.threshold=threshold2;else throw is2.invalidParameterError("threshold","integer between 0 and 255",threshold2);if(!is2.object(options)||options.greyscale===!0||options.grayscale===!0)this.options.thresholdGrayscale=!0;else this.options.thresholdGrayscale=!1;return this}function boolean3(operand,operator,options){if(this.options.boolean=this._createInputDescriptor(operand,options),is2.string(operator)&&is2.inArray(operator,["and","or","eor"]))this.options.booleanOp=operator;else throw is2.invalidParameterError("operator","one of: and, or, eor",operator);return this}function linear(a,b){if(!is2.defined(a)&&is2.number(b))a=1;else if(is2.number(a)&&!is2.defined(b))b=0;if(!is2.defined(a))this.options.linearA=[];else if(is2.number(a))this.options.linearA=[a];else if(Array.isArray(a)&&a.length&&a.every(is2.number))this.options.linearA=a;else throw is2.invalidParameterError("a","number or array of numbers",a);if(!is2.defined(b))this.options.linearB=[];else if(is2.number(b))this.options.linearB=[b];else if(Array.isArray(b)&&b.length&&b.every(is2.number))this.options.linearB=b;else throw is2.invalidParameterError("b","number or array of numbers",b);if(this.options.linearA.length!==this.options.linearB.length)throw Error("Expected a and b to be arrays of the same length");return this}function recomb(inputMatrix){if(!Array.isArray(inputMatrix))throw is2.invalidParameterError("inputMatrix","array",inputMatrix);if(inputMatrix.length!==3&&inputMatrix.length!==4)throw is2.invalidParameterError("inputMatrix","3x3 or 4x4 array",inputMatrix.length);let recombMatrix=inputMatrix.flat().map(Number);if(recombMatrix.length!==9&&recombMatrix.length!==16)throw is2.invalidParameterError("inputMatrix","cardinality of 9 or 16",recombMatrix.length);return this.options.recombMatrix=recombMatrix,this}function modulate(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","plain object",options);if("brightness"in options)if(is2.number(options.brightness)&&options.brightness>=0)this.options.brightness=options.brightness;else throw is2.invalidParameterError("brightness","number above zero",options.brightness);if("saturation"in options)if(is2.number(options.saturation)&&options.saturation>=0)this.options.saturation=options.saturation;else throw is2.invalidParameterError("saturation","number above zero",options.saturation);if("hue"in options)if(is2.integer(options.hue))this.options.hue=options.hue%360;else throw is2.invalidParameterError("hue","number",options.hue);if("lightness"in options)if(is2.number(options.lightness))this.options.lightness=options.lightness;else throw is2.invalidParameterError("lightness","number",options.lightness);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{rotate,flip,flop,affine,sharpen,median:median2,blur,flatten,unflatten,gamma,negate,normalise,normalize:normalize3,clahe,convolve,threshold,boolean:boolean3,linear,recomb,modulate})}});var require_colour=__commonJS((exports,module3)=>{var color=require_color(),is2=require_is(),colourspace={multiband:"multiband","b-w":"b-w",bw:"b-w",cmyk:"cmyk",srgb:"srgb"};function tint(tint2){return this._setBackgroundColourOption("tint",tint2),this}function greyscale(greyscale2){return this.options.greyscale=is2.bool(greyscale2)?greyscale2:!0,this}function grayscale(grayscale2){return this.greyscale(grayscale2)}function pipelineColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspacePipeline=colourspace2,this}function pipelineColorspace(colorspace){return this.pipelineColourspace(colorspace)}function toColourspace(colourspace2){if(!is2.string(colourspace2))throw is2.invalidParameterError("colourspace","string",colourspace2);return this.options.colourspace=colourspace2,this}function toColorspace(colorspace){return this.toColourspace(colorspace)}function _setBackgroundColourOption(key2,value2){if(is2.defined(value2))if(is2.object(value2)||is2.string(value2)){let colour=color(value2);this.options[key2]=[colour.red(),colour.green(),colour.blue(),Math.round(colour.alpha()*255)]}else throw is2.invalidParameterError("background","object or string",value2)}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{tint,greyscale,grayscale,pipelineColourspace,pipelineColorspace,toColourspace,toColorspace,_setBackgroundColourOption}),Sharp.colourspace=colourspace,Sharp.colorspace=colourspace}});var require_channel=__commonJS((exports,module3)=>{var is2=require_is(),bool={and:"and",or:"or",eor:"eor"};function removeAlpha(){return this.options.removeAlpha=!0,this}function ensureAlpha(alpha){if(is2.defined(alpha))if(is2.number(alpha)&&is2.inRange(alpha,0,1))this.options.ensureAlpha=alpha;else throw is2.invalidParameterError("alpha","number between 0 and 1",alpha);else this.options.ensureAlpha=1;return this}function extractChannel(channel){let channelMap={red:0,green:1,blue:2,alpha:3};if(Object.keys(channelMap).includes(channel))channel=channelMap[channel];if(is2.integer(channel)&&is2.inRange(channel,0,4))this.options.extractChannel=channel;else throw is2.invalidParameterError("channel","integer or one of: red, green, blue, alpha",channel);return this}function joinChannel(images,options){if(Array.isArray(images))images.forEach(function(image){this.options.joinChannelIn.push(this._createInputDescriptor(image,options))},this);else this.options.joinChannelIn.push(this._createInputDescriptor(images,options));return this}function bandbool(boolOp){if(is2.string(boolOp)&&is2.inArray(boolOp,["and","or","eor"]))this.options.bandBoolOp=boolOp;else throw is2.invalidParameterError("boolOp","one of: and, or, eor",boolOp);return this}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{removeAlpha,ensureAlpha,extractChannel,joinChannel,bandbool}),Sharp.bool=bool}});var require_output=__commonJS((exports,module3)=>{var path2=__require("path"),is2=require_is(),sharp=require_sharp(),formats2=new Map([["heic","heif"],["heif","heif"],["avif","avif"],["jpeg","jpeg"],["jpg","jpeg"],["jpe","jpeg"],["tile","tile"],["dz","tile"],["png","png"],["raw","raw"],["tiff","tiff"],["tif","tiff"],["webp","webp"],["gif","gif"],["jp2","jp2"],["jpx","jp2"],["j2k","jp2"],["j2c","jp2"],["jxl","jxl"]]),jp2Regex=/\.(jp[2x]|j2[kc])$/i,errJp2Save=()=>Error("JP2 output requires libvips with support for OpenJPEG"),bitdepthFromColourCount=(colours)=>1<<31-Math.clz32(Math.ceil(Math.log2(colours)));function toFile(fileOut,callback){let err;if(!is2.string(fileOut))err=Error("Missing output file path");else if(is2.string(this.options.input.file)&&path2.resolve(this.options.input.file)===path2.resolve(fileOut))err=Error("Cannot use same file for input and output");else if(jp2Regex.test(path2.extname(fileOut))&&!this.constructor.format.jp2k.output.file)err=errJp2Save();if(err)if(is2.fn(callback))callback(err);else return Promise.reject(err);else{this.options.fileOut=fileOut;let stack=Error();return this._pipeline(callback,stack)}return this}function toBuffer2(options,callback){if(is2.object(options))this._setBooleanOption("resolveWithObject",options.resolveWithObject);else if(this.options.resolveWithObject)this.options.resolveWithObject=!1;this.options.fileOut="";let stack=Error();return this._pipeline(is2.fn(options)?options:callback,stack)}function keepExif(){return this.options.keepMetadata|=1,this}function withExif(exif){if(is2.object(exif))for(let[ifd,entries]of Object.entries(exif))if(is2.object(entries))for(let[k,v]of Object.entries(entries))if(is2.string(v))this.options.withExif[`exif-${ifd.toLowerCase()}-${k}`]=v;else throw is2.invalidParameterError(`${ifd}.${k}`,"string",v);else throw is2.invalidParameterError(ifd,"object",entries);else throw is2.invalidParameterError("exif","object",exif);return this.options.withExifMerge=!1,this.keepExif()}function withExifMerge(exif){return this.withExif(exif),this.options.withExifMerge=!0,this}function keepIccProfile(){return this.options.keepMetadata|=8,this}function withIccProfile(icc,options){if(is2.string(icc))this.options.withIccProfile=icc;else throw is2.invalidParameterError("icc","string",icc);if(this.keepIccProfile(),is2.object(options)){if(is2.defined(options.attach))if(is2.bool(options.attach)){if(!options.attach)this.options.keepMetadata&=-9}else throw is2.invalidParameterError("attach","boolean",options.attach)}return this}function keepMetadata(){return this.options.keepMetadata=31,this}function withMetadata(options){if(this.keepMetadata(),this.withIccProfile("srgb"),is2.object(options)){if(is2.defined(options.orientation))if(is2.integer(options.orientation)&&is2.inRange(options.orientation,1,8))this.options.withMetadataOrientation=options.orientation;else throw is2.invalidParameterError("orientation","integer between 1 and 8",options.orientation);if(is2.defined(options.density))if(is2.number(options.density)&&options.density>0)this.options.withMetadataDensity=options.density;else throw is2.invalidParameterError("density","positive number",options.density);if(is2.defined(options.icc))this.withIccProfile(options.icc);if(is2.defined(options.exif))this.withExifMerge(options.exif)}return this}function toFormat(format2,options){let actualFormat=formats2.get((is2.object(format2)&&is2.string(format2.id)?format2.id:format2).toLowerCase());if(!actualFormat)throw is2.invalidParameterError("format",`one of: ${[...formats2.keys()].join(", ")}`,format2);return this[actualFormat](options)}function jpeg(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jpegQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.progressive))this._setBooleanOption("jpegProgressive",options.progressive);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jpegChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);let optimiseCoding=is2.bool(options.optimizeCoding)?options.optimizeCoding:options.optimiseCoding;if(is2.defined(optimiseCoding))this._setBooleanOption("jpegOptimiseCoding",optimiseCoding);if(is2.defined(options.mozjpeg))if(is2.bool(options.mozjpeg)){if(options.mozjpeg)this.options.jpegTrellisQuantisation=!0,this.options.jpegOvershootDeringing=!0,this.options.jpegOptimiseScans=!0,this.options.jpegProgressive=!0,this.options.jpegQuantisationTable=3}else throw is2.invalidParameterError("mozjpeg","boolean",options.mozjpeg);let trellisQuantisation=is2.bool(options.trellisQuantization)?options.trellisQuantization:options.trellisQuantisation;if(is2.defined(trellisQuantisation))this._setBooleanOption("jpegTrellisQuantisation",trellisQuantisation);if(is2.defined(options.overshootDeringing))this._setBooleanOption("jpegOvershootDeringing",options.overshootDeringing);let optimiseScans=is2.bool(options.optimizeScans)?options.optimizeScans:options.optimiseScans;if(is2.defined(optimiseScans)){if(this._setBooleanOption("jpegOptimiseScans",optimiseScans),optimiseScans)this.options.jpegProgressive=!0}let quantisationTable=is2.number(options.quantizationTable)?options.quantizationTable:options.quantisationTable;if(is2.defined(quantisationTable))if(is2.integer(quantisationTable)&&is2.inRange(quantisationTable,0,8))this.options.jpegQuantisationTable=quantisationTable;else throw is2.invalidParameterError("quantisationTable","integer between 0 and 8",quantisationTable)}return this._updateFormatOut("jpeg",options)}function png(options){if(is2.object(options)){if(is2.defined(options.progressive))this._setBooleanOption("pngProgressive",options.progressive);if(is2.defined(options.compressionLevel))if(is2.integer(options.compressionLevel)&&is2.inRange(options.compressionLevel,0,9))this.options.pngCompressionLevel=options.compressionLevel;else throw is2.invalidParameterError("compressionLevel","integer between 0 and 9",options.compressionLevel);if(is2.defined(options.adaptiveFiltering))this._setBooleanOption("pngAdaptiveFiltering",options.adaptiveFiltering);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.pngBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.palette))this._setBooleanOption("pngPalette",options.palette);else if([options.quality,options.effort,options.colours,options.colors,options.dither].some(is2.defined))this._setBooleanOption("pngPalette",!0);if(this.options.pngPalette){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,0,100))this.options.pngQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 0 and 100",options.quality);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,1,10))this.options.pngEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.pngDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither)}}return this._updateFormatOut("png",options)}function webp(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.webpQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.alphaQuality))if(is2.integer(options.alphaQuality)&&is2.inRange(options.alphaQuality,0,100))this.options.webpAlphaQuality=options.alphaQuality;else throw is2.invalidParameterError("alphaQuality","integer between 0 and 100",options.alphaQuality);if(is2.defined(options.lossless))this._setBooleanOption("webpLossless",options.lossless);if(is2.defined(options.nearLossless))this._setBooleanOption("webpNearLossless",options.nearLossless);if(is2.defined(options.smartSubsample))this._setBooleanOption("webpSmartSubsample",options.smartSubsample);if(is2.defined(options.preset))if(is2.string(options.preset)&&is2.inArray(options.preset,["default","photo","picture","drawing","icon","text"]))this.options.webpPreset=options.preset;else throw is2.invalidParameterError("preset","one of: default, photo, picture, drawing, icon, text",options.preset);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,6))this.options.webpEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 6",options.effort);if(is2.defined(options.minSize))this._setBooleanOption("webpMinSize",options.minSize);if(is2.defined(options.mixed))this._setBooleanOption("webpMixed",options.mixed)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("webp",options)}function gif(options){if(is2.object(options)){if(is2.defined(options.reuse))this._setBooleanOption("gifReuse",options.reuse);if(is2.defined(options.progressive))this._setBooleanOption("gifProgressive",options.progressive);let colours=options.colours||options.colors;if(is2.defined(colours))if(is2.integer(colours)&&is2.inRange(colours,2,256))this.options.gifBitdepth=bitdepthFromColourCount(colours);else throw is2.invalidParameterError("colours","integer between 2 and 256",colours);if(is2.defined(options.effort))if(is2.number(options.effort)&&is2.inRange(options.effort,1,10))this.options.gifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 1 and 10",options.effort);if(is2.defined(options.dither))if(is2.number(options.dither)&&is2.inRange(options.dither,0,1))this.options.gifDither=options.dither;else throw is2.invalidParameterError("dither","number between 0.0 and 1.0",options.dither);if(is2.defined(options.interFrameMaxError))if(is2.number(options.interFrameMaxError)&&is2.inRange(options.interFrameMaxError,0,32))this.options.gifInterFrameMaxError=options.interFrameMaxError;else throw is2.invalidParameterError("interFrameMaxError","number between 0.0 and 32.0",options.interFrameMaxError);if(is2.defined(options.interPaletteMaxError))if(is2.number(options.interPaletteMaxError)&&is2.inRange(options.interPaletteMaxError,0,256))this.options.gifInterPaletteMaxError=options.interPaletteMaxError;else throw is2.invalidParameterError("interPaletteMaxError","number between 0.0 and 256.0",options.interPaletteMaxError)}return trySetAnimationOptions(options,this.options),this._updateFormatOut("gif",options)}function jp2(options){if(!this.constructor.format.jp2k.output.buffer)throw errJp2Save();if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jp2Quality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jp2Lossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&is2.inRange(options.tileWidth,1,32768))this.options.jp2TileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer between 1 and 32768",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&is2.inRange(options.tileHeight,1,32768))this.options.jp2TileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer between 1 and 32768",options.tileHeight);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.jp2ChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling)}return this._updateFormatOut("jp2",options)}function trySetAnimationOptions(source,target2){if(is2.object(source)&&is2.defined(source.loop))if(is2.integer(source.loop)&&is2.inRange(source.loop,0,65535))target2.loop=source.loop;else throw is2.invalidParameterError("loop","integer between 0 and 65535",source.loop);if(is2.object(source)&&is2.defined(source.delay))if(is2.integer(source.delay)&&is2.inRange(source.delay,0,65535))target2.delay=[source.delay];else if(Array.isArray(source.delay)&&source.delay.every(is2.integer)&&source.delay.every((v)=>is2.inRange(v,0,65535)))target2.delay=source.delay;else throw is2.invalidParameterError("delay","integer or an array of integers between 0 and 65535",source.delay)}function tiff(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.tiffQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[1,2,4,8]))this.options.tiffBitdepth=options.bitdepth;else throw is2.invalidParameterError("bitdepth","1, 2, 4 or 8",options.bitdepth);if(is2.defined(options.tile))this._setBooleanOption("tiffTile",options.tile);if(is2.defined(options.tileWidth))if(is2.integer(options.tileWidth)&&options.tileWidth>0)this.options.tiffTileWidth=options.tileWidth;else throw is2.invalidParameterError("tileWidth","integer greater than zero",options.tileWidth);if(is2.defined(options.tileHeight))if(is2.integer(options.tileHeight)&&options.tileHeight>0)this.options.tiffTileHeight=options.tileHeight;else throw is2.invalidParameterError("tileHeight","integer greater than zero",options.tileHeight);if(is2.defined(options.miniswhite))this._setBooleanOption("tiffMiniswhite",options.miniswhite);if(is2.defined(options.pyramid))this._setBooleanOption("tiffPyramid",options.pyramid);if(is2.defined(options.xres))if(is2.number(options.xres)&&options.xres>0)this.options.tiffXres=options.xres;else throw is2.invalidParameterError("xres","number greater than zero",options.xres);if(is2.defined(options.yres))if(is2.number(options.yres)&&options.yres>0)this.options.tiffYres=options.yres;else throw is2.invalidParameterError("yres","number greater than zero",options.yres);if(is2.defined(options.compression))if(is2.string(options.compression)&&is2.inArray(options.compression,["none","jpeg","deflate","packbits","ccittfax4","lzw","webp","zstd","jp2k"]))this.options.tiffCompression=options.compression;else throw is2.invalidParameterError("compression","one of: none, jpeg, deflate, packbits, ccittfax4, lzw, webp, zstd, jp2k",options.compression);if(is2.defined(options.predictor))if(is2.string(options.predictor)&&is2.inArray(options.predictor,["none","horizontal","float"]))this.options.tiffPredictor=options.predictor;else throw is2.invalidParameterError("predictor","one of: none, horizontal, float",options.predictor);if(is2.defined(options.resolutionUnit))if(is2.string(options.resolutionUnit)&&is2.inArray(options.resolutionUnit,["inch","cm"]))this.options.tiffResolutionUnit=options.resolutionUnit;else throw is2.invalidParameterError("resolutionUnit","one of: inch, cm",options.resolutionUnit)}return this._updateFormatOut("tiff",options)}function avif(options){return this.heif({...options,compression:"av1"})}function heif(options){if(is2.object(options)){if(is2.string(options.compression)&&is2.inArray(options.compression,["av1","hevc"]))this.options.heifCompression=options.compression;else throw is2.invalidParameterError("compression","one of: av1, hevc",options.compression);if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.heifQuality=options.quality;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.heifLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,0,9))this.options.heifEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 0 and 9",options.effort);if(is2.defined(options.chromaSubsampling))if(is2.string(options.chromaSubsampling)&&is2.inArray(options.chromaSubsampling,["4:2:0","4:4:4"]))this.options.heifChromaSubsampling=options.chromaSubsampling;else throw is2.invalidParameterError("chromaSubsampling","one of: 4:2:0, 4:4:4",options.chromaSubsampling);if(is2.defined(options.bitdepth))if(is2.integer(options.bitdepth)&&is2.inArray(options.bitdepth,[8,10,12])){if(options.bitdepth!==8&&this.constructor.versions.heif)throw is2.invalidParameterError("bitdepth when using prebuilt binaries",8,options.bitdepth);this.options.heifBitdepth=options.bitdepth}else throw is2.invalidParameterError("bitdepth","8, 10 or 12",options.bitdepth)}else throw is2.invalidParameterError("options","Object",options);return this._updateFormatOut("heif",options)}function jxl(options){if(is2.object(options)){if(is2.defined(options.quality))if(is2.integer(options.quality)&&is2.inRange(options.quality,1,100))this.options.jxlDistance=options.quality>=30?0.1+(100-options.quality)*0.09:0.017666666666666667*options.quality*options.quality-1.15*options.quality+25;else throw is2.invalidParameterError("quality","integer between 1 and 100",options.quality);else if(is2.defined(options.distance))if(is2.number(options.distance)&&is2.inRange(options.distance,0,15))this.options.jxlDistance=options.distance;else throw is2.invalidParameterError("distance","number between 0.0 and 15.0",options.distance);if(is2.defined(options.decodingTier))if(is2.integer(options.decodingTier)&&is2.inRange(options.decodingTier,0,4))this.options.jxlDecodingTier=options.decodingTier;else throw is2.invalidParameterError("decodingTier","integer between 0 and 4",options.decodingTier);if(is2.defined(options.lossless))if(is2.bool(options.lossless))this.options.jxlLossless=options.lossless;else throw is2.invalidParameterError("lossless","boolean",options.lossless);if(is2.defined(options.effort))if(is2.integer(options.effort)&&is2.inRange(options.effort,3,9))this.options.jxlEffort=options.effort;else throw is2.invalidParameterError("effort","integer between 3 and 9",options.effort)}return this._updateFormatOut("jxl",options)}function raw(options){if(is2.object(options)){if(is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["char","uchar","short","ushort","int","uint","float","complex","double","dpcomplex"]))this.options.rawDepth=options.depth;else throw is2.invalidParameterError("depth","one of: char, uchar, short, ushort, int, uint, float, complex, double, dpcomplex",options.depth)}return this._updateFormatOut("raw")}function tile(options){if(is2.object(options)){if(is2.defined(options.size))if(is2.integer(options.size)&&is2.inRange(options.size,1,8192))this.options.tileSize=options.size;else throw is2.invalidParameterError("size","integer between 1 and 8192",options.size);if(is2.defined(options.overlap))if(is2.integer(options.overlap)&&is2.inRange(options.overlap,0,8192)){if(options.overlap>this.options.tileSize)throw is2.invalidParameterError("overlap",`<= size (${this.options.tileSize})`,options.overlap);this.options.tileOverlap=options.overlap}else throw is2.invalidParameterError("overlap","integer between 0 and 8192",options.overlap);if(is2.defined(options.container))if(is2.string(options.container)&&is2.inArray(options.container,["fs","zip"]))this.options.tileContainer=options.container;else throw is2.invalidParameterError("container","one of: fs, zip",options.container);if(is2.defined(options.layout))if(is2.string(options.layout)&&is2.inArray(options.layout,["dz","google","iiif","iiif3","zoomify"]))this.options.tileLayout=options.layout;else throw is2.invalidParameterError("layout","one of: dz, google, iiif, iiif3, zoomify",options.layout);if(is2.defined(options.angle))if(is2.integer(options.angle)&&!(options.angle%90))this.options.tileAngle=options.angle;else throw is2.invalidParameterError("angle","positive/negative multiple of 90",options.angle);if(this._setBackgroundColourOption("tileBackground",options.background),is2.defined(options.depth))if(is2.string(options.depth)&&is2.inArray(options.depth,["onepixel","onetile","one"]))this.options.tileDepth=options.depth;else throw is2.invalidParameterError("depth","one of: onepixel, onetile, one",options.depth);if(is2.defined(options.skipBlanks))if(is2.integer(options.skipBlanks)&&is2.inRange(options.skipBlanks,-1,65535))this.options.tileSkipBlanks=options.skipBlanks;else throw is2.invalidParameterError("skipBlanks","integer between -1 and 255/65535",options.skipBlanks);else if(is2.defined(options.layout)&&options.layout==="google")this.options.tileSkipBlanks=5;let centre=is2.bool(options.center)?options.center:options.centre;if(is2.defined(centre))this._setBooleanOption("tileCentre",centre);if(is2.defined(options.id))if(is2.string(options.id))this.options.tileId=options.id;else throw is2.invalidParameterError("id","string",options.id);if(is2.defined(options.basename))if(is2.string(options.basename))this.options.tileBasename=options.basename;else throw is2.invalidParameterError("basename","string",options.basename)}if(is2.inArray(this.options.formatOut,["jpeg","png","webp"]))this.options.tileFormat=this.options.formatOut;else if(this.options.formatOut!=="input")throw is2.invalidParameterError("format","one of: jpeg, png, webp",this.options.formatOut);return this._updateFormatOut("dz")}function timeout(options){if(!is2.plainObject(options))throw is2.invalidParameterError("options","object",options);if(is2.integer(options.seconds)&&is2.inRange(options.seconds,0,3600))this.options.timeoutSeconds=options.seconds;else throw is2.invalidParameterError("seconds","integer between 0 and 3600",options.seconds);return this}function _updateFormatOut(formatOut,options){if(!(is2.object(options)&&options.force===!1))this.options.formatOut=formatOut;return this}function _setBooleanOption(key2,val){if(is2.bool(val))this.options[key2]=val;else throw is2.invalidParameterError(key2,"boolean",val)}function _read(){if(!this.options.streamOut){this.options.streamOut=!0;let stack=Error();this._pipeline(void 0,stack)}}function _pipeline(callback,stack){if(typeof callback==="function"){if(this._isStreamInput())this.on("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)})});else sharp.pipeline(this.options,(err,data,info)=>{if(err)callback(is2.nativeError(err,stack));else callback(null,data,info)});return this}else if(this.options.streamOut){if(this._isStreamInput()){if(this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))})}),this.streamInFinished)this.emit("finish")}else sharp.pipeline(this.options,(err,data,info)=>{if(err)this.emit("error",is2.nativeError(err,stack));else this.emit("info",info),this.push(data);this.push(null),this.on("end",()=>this.emit("close"))});return this}else if(this._isStreamInput())return new Promise((resolve2,reject)=>{this.once("finish",()=>{this._flattenBufferIn(),sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})});else return new Promise((resolve2,reject)=>{sharp.pipeline(this.options,(err,data,info)=>{if(err)reject(is2.nativeError(err,stack));else if(this.options.resolveWithObject)resolve2({data,info});else resolve2(data)})})}module3.exports=function(Sharp){Object.assign(Sharp.prototype,{toFile,toBuffer:toBuffer2,keepExif,withExif,withExifMerge,keepIccProfile,withIccProfile,keepMetadata,withMetadata,toFormat,jpeg,jp2,png,webp,tiff,avif,heif,jxl,gif,raw,tile,timeout,_updateFormatOut,_setBooleanOption,_read,_pipeline})}});var require_utility=__commonJS((exports,module3)=>{var events=__require("events"),detectLibc=require_detect_libc(),is2=require_is(),{runtimePlatformArch}=require_libvips(),sharp=require_sharp(),runtimePlatform=runtimePlatformArch(),libvipsVersion=sharp.libvipsVersion(),format2=sharp.format();format2.heif.output.alias=["avif","heic"];format2.jpeg.output.alias=["jpe","jpg"];format2.tiff.output.alias=["tif"];format2.jp2k.output.alias=["j2c","j2k","jp2","jpx"];var interpolators={nearest:"nearest",bilinear:"bilinear",bicubic:"bicubic",locallyBoundedBicubic:"lbb",nohalo:"nohalo",vertexSplitQuadraticBasisSpline:"vsqbs"},versions={vips:libvipsVersion.semver};if(!libvipsVersion.isGlobal)if(!libvipsVersion.isWasm)try{versions=__require(`@img/sharp-${runtimePlatform}/versions`)}catch(_){try{versions=__require(`@img/sharp-libvips-${runtimePlatform}/versions`)}catch(_2){}}else try{versions=(()=>{throw new Error("Cannot require module "+"@img/sharp-wasm32/versions");})()}catch(_){}versions.sharp=require_package().version;if(versions.heif&&format2.heif)format2.heif.input.fileSuffix=[".avif"],format2.heif.output.alias=["avif"];function cache(options){if(is2.bool(options))if(options)return sharp.cache(50,20,100);else return sharp.cache(0,0,0);else if(is2.object(options))return sharp.cache(options.memory,options.files,options.items);else return sharp.cache()}cache(!0);function concurrency(concurrency2){return sharp.concurrency(is2.integer(concurrency2)?concurrency2:null)}if(detectLibc.familySync()===detectLibc.GLIBC&&!sharp._isUsingJemalloc())sharp.concurrency(1);else if(detectLibc.familySync()===detectLibc.MUSL&&sharp.concurrency()===1024)sharp.concurrency(__require("os").availableParallelism());var queue=new events.EventEmitter;function counters(){return sharp.counters()}function simd(simd2){return sharp.simd(is2.bool(simd2)?simd2:null)}function block(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!0);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}function unblock(options){if(is2.object(options))if(Array.isArray(options.operation)&&options.operation.every(is2.string))sharp.block(options.operation,!1);else throw is2.invalidParameterError("operation","Array<string>",options.operation);else throw is2.invalidParameterError("options","object",options)}module3.exports=function(Sharp){Sharp.cache=cache,Sharp.concurrency=concurrency,Sharp.counters=counters,Sharp.simd=simd,Sharp.format=format2,Sharp.interpolators=interpolators,Sharp.versions=versions,Sharp.queue=queue,Sharp.block=block,Sharp.unblock=unblock}});var require_lib=__commonJS((exports,module3)=>{var Sharp=require_constructor();require_input()(Sharp);require_resize()(Sharp);require_composite()(Sharp);require_operation()(Sharp);require_colour()(Sharp);require_channel()(Sharp);require_output()(Sharp);require_utility()(Sharp);module3.exports=Sharp});import{randomUUID as randomUUID6}from"crypto";import{mkdir as mkdir5,rename as rename3,stat as stat5,unlink as unlink5}from"fs/promises";import path2 from"path";function mergeTransformConfig(config){if(!config)return DEFAULT_TRANSFORM;return{enabled:config.enabled??DEFAULT_TRANSFORM.enabled,maxWidth:config.maxWidth??DEFAULT_TRANSFORM.maxWidth,maxHeight:config.maxHeight??DEFAULT_TRANSFORM.maxHeight,defaultQuality:config.defaultQuality??DEFAULT_TRANSFORM.defaultQuality,allowedFormats:config.allowedFormats??DEFAULT_TRANSFORM.allowedFormats,cacheSubdir:config.cacheSubdir??DEFAULT_TRANSFORM.cacheSubdir,maxInputPixels:config.maxInputPixels??DEFAULT_TRANSFORM.maxInputPixels,pregenerate:{enabled:config.pregenerate?.enabled??DEFAULT_PREGENERATE.enabled,widths:config.pregenerate?.widths??DEFAULT_PREGENERATE.widths,formats:config.pregenerate?.formats??DEFAULT_PREGENERATE.formats,quality:config.pregenerate?.quality}}}function isTransformableImage(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")in MIME_TO_FORMAT}function clampInt(raw,min,max){if(raw===void 0)return;let n=Number.parseInt(raw,10);if(!Number.isFinite(n))return;return Math.min(max,Math.max(min,n))}function preferredOutputFormat(input){let{requested,allowedFormats}=input;if(requested)return requested;let sourceFormat=MIME_TO_FORMAT[input.mimeType.split(";")[0]?.trim().toLowerCase()??""];if(!sourceFormat)return;if((input.accept??"").toLowerCase().includes("image/webp")&&(sourceFormat==="jpeg"||sourceFormat==="png")&&allowedFormats.includes("webp"))return"webp";return sourceFormat}function parseTransformParams(query,config){let width=clampInt(query.w,1,config.maxWidth),height=clampInt(query.h,1,config.maxHeight),qualityRaw=clampInt(query.q,1,100),requestedFormat=query.format?.trim().toLowerCase(),format2=requestedFormat&&config.allowedFormats.includes(requestedFormat)?requestedFormat:void 0;if(width===void 0&&height===void 0&&qualityRaw===void 0&&!format2)return null;return{width,height,quality:qualityRaw??config.defaultQuality,format:format2}}function deriveCacheKey(mtimeMs,params,outputFormat){return[`m${Math.floor(mtimeMs)}`,params.width?`w${params.width}`:"w0",params.height?`h${params.height}`:"h0",`q${params.quality}`,outputFormat].join("-")}async function loadSharp(logger2){if(sharpModule!==void 0)return sharpModule;try{let mod=await Promise.resolve().then(() => __toESM(require_lib(),1));sharpModule=mod.default??mod;try{let budget=cpuBudget();sharpModule.concurrency(budget),logger2.info(`[CDN] sharp thread pool set to ${budget} (CPU allowance, not host cores)`)}catch(error3){logger2.warn(`[CDN] could not set sharp concurrency: ${error3 instanceof Error?error3.message:String(error3)}`)}try{sharpModule.cache(!1),logger2.info("[CDN] libvips operation cache disabled (derivatives are cached on disk)")}catch(error3){logger2.warn(`[CDN] could not disable the libvips cache: ${error3 instanceof Error?error3.message:String(error3)}`)}}catch{sharpModule=null,logger2.error('[CDN] storage.cdn.transform.enabled is true but the optional "sharp" dependency is not installed. Run `npm i sharp` to enable image transforms. Serving original files untouched.')}return sharpModule}async function ensureDerivative(args){let{sourcePath,mimeType,params,storagePath,config,logger:logger2}=args;if(!isTransformableImage(mimeType))return null;let outputFormat=preferredOutputFormat({mimeType,requested:params.format,accept:args.accept,allowedFormats:config.allowedFormats});if(!outputFormat)return null;let sharp=await loadSharp(logger2);if(!sharp)return null;let idPart=path2.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f",srcStat=await stat5(sourcePath).catch(()=>null);if(!srcStat)return null;let key2=deriveCacheKey(srcStat.mtimeMs,params,outputFormat),cacheDir=path2.join(storagePath,config.cacheSubdir,idPart),cachePath=path2.join(cacheDir,`${key2}.${outputFormat}`);if(!isPathWithinBase(storagePath,cachePath))return null;let contentType=FORMAT_TO_MIME[outputFormat],etag=`"${idPart}-${key2}"`,cached=await stat5(cachePath).catch(()=>null);if(cached?.isFile()&&cached.size>0)return{path:cachePath,contentType,etag};let pending=inFlightDerivatives.get(cachePath);if(pending)return pending;let task=(async()=>{let tmpPath=null;try{let pipeline=sharp(sourcePath,{limitInputPixels:config.maxInputPixels,failOn:"none"});if(pipeline.rotate().keepIccProfile(),params.width||params.height)pipeline.resize({width:params.width,height:params.height,fit:"inside",withoutEnlargement:!0});switch(outputFormat){case"webp":pipeline.webp({quality:params.quality});break;case"avif":pipeline.avif({quality:params.quality});break;case"jpeg":pipeline.jpeg({quality:params.quality});break;case"png":pipeline.png({quality:params.quality});break}let buffer=await pipeline.toBuffer();if(buffer.length===0)return logger2.error(`[CDN] image transform produced an empty buffer for ${idPart}; serving original.`),null;return await mkdir5(cacheDir,{recursive:!0}),tmpPath=`${cachePath}.${randomUUID6()}.tmp`,await Bun.write(tmpPath,buffer),await rename3(tmpPath,cachePath),tmpPath=null,{path:cachePath,contentType,etag}}catch(err){if(tmpPath)await unlink5(tmpPath).catch(()=>{});return logger2.error(`[CDN] image transform failed for ${idPart}; serving original. ${String(err)}`),null}})();inFlightDerivatives.set(cachePath,task);try{return await task}finally{inFlightDerivatives.delete(cachePath)}}async function pregenerateImageVariants(args){let{sourcePath,mimeType,storagePath,config,logger:logger2}=args,pg=config.pregenerate;if(!config.enabled||!pg.enabled||!isTransformableImage(mimeType))return 0;if(pg.widths.length===0||pg.formats.length===0)return 0;let quality=pg.quality??config.defaultQuality,made=0;for(let width of pg.widths)for(let format2 of pg.formats)if(await ensureDerivative({sourcePath,mimeType,params:{width,quality,format:format2},storagePath,config,logger:logger2}))made+=1;return made}var DEFAULT_PREGENERATE,DEFAULT_TRANSFORM,MIME_TO_FORMAT,FORMAT_TO_MIME,sharpModule,inFlightDerivatives;var init_imageTransform=__esm(()=>{init_cpuBudget();init_helpers3();DEFAULT_PREGENERATE={enabled:!1,widths:[],formats:["webp"]},DEFAULT_TRANSFORM={enabled:!1,maxWidth:3840,maxHeight:3840,defaultQuality:80,allowedFormats:["webp","avif","jpeg","png"],cacheSubdir:".cache/cdn",maxInputPixels:1e8,pregenerate:DEFAULT_PREGENERATE};MIME_TO_FORMAT={"image/webp":"webp","image/avif":"avif","image/jpeg":"jpeg","image/jpg":"jpeg","image/png":"png"},FORMAT_TO_MIME={webp:"image/webp",avif:"image/avif",jpeg:"image/jpeg",png:"image/png"};inFlightDerivatives=new Map});import{randomUUID as randomUUID7}from"crypto";import{mkdir as mkdir6,rename as rename4,stat as stat6,unlink as unlink6}from"fs/promises";import path3 from"path";function mergePdfConfig(config){if(!config)return DEFAULT_PDF;return{enabled:config.enabled??DEFAULT_PDF.enabled,coverFormat:config.coverFormat??DEFAULT_PDF.coverFormat,dpi:config.dpi??DEFAULT_PDF.dpi,pdftoppmPath:config.pdftoppmPath??DEFAULT_PDF.pdftoppmPath}}function isTransformablePdf(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"")==="application/pdf"}function idPartOf(sourcePath){return path3.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function coverPath(storagePath,cacheSubdir,sourcePath,mtimeMs,ext){return path3.join(storagePath,cacheSubdir,idPartOf(sourcePath),`pdf-m${Math.floor(mtimeMs)}-cover.${ext}`)}async function checkPoppler(pdftoppmPath,logger2){if(popplerAvailable!==void 0)return popplerAvailable;try{await Bun.spawn({cmd:[pdftoppmPath,"-v"],stdout:"ignore",stderr:"ignore"}).exited,popplerAvailable=!0}catch{popplerAvailable=!1}if(!popplerAvailable)logger2.error(`[CDN] storage.cdn.pdf.enabled is true but pdftoppm ("${pdftoppmPath}") was not found on PATH. Install poppler-utils to enable PDF cover generation. Serving PDFs without covers.`);return popplerAvailable}async function resolvePdfCover(args){let{sourcePath,storagePath,cacheSubdir,coverFormat}=args,srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return null;let ext=coverFormat==="png"?"png":"jpg",p=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,p))return null;let cover=await stat6(p).catch(()=>null);if(!cover?.isFile())return null;if(cover.size<MIN_PLAUSIBLE_COVER_BYTES)return await unlink6(p).catch(()=>{}),null;return{path:p,contentType:COVER_MIME[coverFormat]}}async function processPdfOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformablePdf(mimeType))return;if(!await checkPoppler(config.pdftoppmPath,logger2))return;let srcStat=await stat6(sourcePath).catch(()=>null);if(!srcStat)return;let ext=config.coverFormat==="png"?"png":"jpg",out=coverPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,ext);if(!isPathWithinBase(storagePath,out))return;if(await Bun.file(out).exists())return;await mkdir6(path3.dirname(out),{recursive:!0}).catch(()=>{});let prefix=`${out}.${randomUUID7()}.tmp`,tmp=`${prefix}.${ext}`;if(await runPdftoppm(config.pdftoppmPath,[config.coverFormat==="png"?"-png":"-jpeg","-f","1","-l","1","-r",String(config.dpi),"-singlefile",sourcePath,prefix])&&await Bun.file(tmp).exists()){await rename4(tmp,out).catch(()=>{});return}await unlink6(tmp).catch(()=>{}),logger2.error(`[CDN] pdf cover failed for ${idPartOf(sourcePath)}`)}async function runPdftoppm(pdftoppmPath,args){try{return await Bun.spawn({cmd:[pdftoppmPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}var DEFAULT_PDF,MIN_PLAUSIBLE_COVER_BYTES=2048,COVER_MIME,popplerAvailable;var init_pdfTransform=__esm(()=>{init_helpers3();DEFAULT_PDF={enabled:!1,coverFormat:"jpeg",dpi:150,pdftoppmPath:"pdftoppm"};COVER_MIME={jpeg:"image/jpeg",png:"image/png"}});import{randomUUID as randomUUID8}from"crypto";import{mkdir as mkdir7,rename as rename5,stat as stat7,unlink as unlink7}from"fs/promises";import path4 from"path";function mergeVideoConfig(config){if(!config)return DEFAULT_VIDEO;return{enabled:config.enabled??DEFAULT_VIDEO.enabled,transcode:config.transcode??DEFAULT_VIDEO.transcode,poster:config.poster??DEFAULT_VIDEO.poster,posterFormat:config.posterFormat??DEFAULT_VIDEO.posterFormat,crf:config.crf??DEFAULT_VIDEO.crf,maxWidth:config.maxWidth??DEFAULT_VIDEO.maxWidth,ffmpegPath:config.ffmpegPath??DEFAULT_VIDEO.ffmpegPath}}function isTransformableVideo(mimeType){return(mimeType.split(";")[0]?.trim().toLowerCase()??"").startsWith("video/")}function idPartOf2(sourcePath){return path4.basename(sourcePath).replace(/[^A-Za-z0-9._-]+/g,"_")||"f"}function variantPath(storagePath,cacheSubdir,sourcePath,mtimeMs,suffix){return path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath),`video-m${Math.floor(mtimeMs)}-${suffix}`)}async function checkFfmpeg(ffmpegPath,logger2){if(ffmpegAvailable!==void 0)return ffmpegAvailable;try{ffmpegAvailable=await Bun.spawn({cmd:[ffmpegPath,"-version"],stdout:"ignore",stderr:"ignore"}).exited===0}catch{ffmpegAvailable=!1}if(!ffmpegAvailable)logger2.error(`[CDN] storage.cdn.video.enabled is true but ffmpeg ("${ffmpegPath}") was not found on PATH. Install ffmpeg to enable video transcode/poster. Serving original videos untouched.`);return ffmpegAvailable}async function runFfmpeg(ffmpegPath,args){try{return await Bun.spawn({cmd:[ffmpegPath,...args],stdout:"ignore",stderr:"ignore"}).exited===0}catch{return!1}}async function resolveVideoVariant(args){let{sourcePath,storagePath,cacheSubdir,posterFormat,kind}=args,srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return null;let suffix=kind==="web"?"web.mp4":`poster.${posterFormat==="webp"?"webp":"jpg"}`,p=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,suffix);if(!isPathWithinBase(storagePath,p))return null;let variant=await stat7(p).catch(()=>null);if(!variant?.isFile())return null;if(variant.size<MIN_PLAUSIBLE_VARIANT_BYTES[kind])return await unlink7(p).catch(()=>{}),null;let contentType=kind==="web"?"video/mp4":POSTER_MIME[posterFormat];return{path:p,contentType}}async function processVideoOnUpload(args){let{sourcePath,mimeType,storagePath,cacheSubdir,config,logger:logger2}=args;if(!config.enabled||!isTransformableVideo(mimeType))return;if(!await checkFfmpeg(config.ffmpegPath,logger2))return;let srcStat=await stat7(sourcePath).catch(()=>null);if(!srcStat)return;let dir=path4.join(storagePath,cacheSubdir,idPartOf2(sourcePath));if(await mkdir7(dir,{recursive:!0}).catch(()=>{}),config.transcode){let out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,"web.mp4");if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let tmp=`${out}.${randomUUID8()}.tmp.mp4`;if(await runFfmpeg(config.ffmpegPath,["-y","-i",sourcePath,"-vf",`scale='min(${config.maxWidth},iw)':-2`,"-c:v","libx264","-crf",String(config.crf),"-preset","medium","-c:a","aac","-movflags","+faststart",tmp]))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video transcode failed for ${idPartOf2(sourcePath)}`)}}if(config.poster){let ext=config.posterFormat==="webp"?"webp":"jpg",out=variantPath(storagePath,cacheSubdir,sourcePath,srcStat.mtimeMs,`poster.${ext}`);if(isPathWithinBase(storagePath,out)&&!await Bun.file(out).exists()){let posterArgs=["-y","-i",sourcePath,"-frames:v","1"];if(config.posterFormat==="webp")posterArgs.push("-c:v","libwebp");else posterArgs.push("-q:v","3");let tmp=`${out}.${randomUUID8()}.tmp.${ext}`;if(posterArgs.push(tmp),await runFfmpeg(config.ffmpegPath,posterArgs))await rename5(tmp,out).catch(()=>{});else await unlink7(tmp).catch(()=>{}),logger2.error(`[CDN] video poster failed for ${idPartOf2(sourcePath)}`)}}}var DEFAULT_VIDEO,MIN_PLAUSIBLE_VARIANT_BYTES,POSTER_MIME,ffmpegAvailable;var init_videoTransform=__esm(()=>{init_helpers3();DEFAULT_VIDEO={enabled:!1,transcode:!0,poster:!0,posterFormat:"jpeg",crf:23,maxWidth:1920,ffmpegPath:"ffmpeg"};MIN_PLAUSIBLE_VARIANT_BYTES={web:4096,poster:128},POSTER_MIME={jpeg:"image/jpeg",webp:"image/webp"}});import path5 from"path";function mergeCdnConfig(config){if(!config)return DEFAULT_CDN_CONFIG;return{enabled:config.enabled??DEFAULT_CDN_CONFIG.enabled,basePath:config.basePath??DEFAULT_CDN_CONFIG.basePath,cacheMaxAge:config.cacheMaxAge??DEFAULT_CDN_CONFIG.cacheMaxAge,enableRangeRequests:config.enableRangeRequests??DEFAULT_CDN_CONFIG.enableRangeRequests,enableEtag:config.enableEtag??DEFAULT_CDN_CONFIG.enableEtag,corsOrigins:config.corsOrigins??DEFAULT_CDN_CONFIG.corsOrigins,transform:mergeTransformConfig(config.transform),video:mergeVideoConfig(config.video),pdf:mergePdfConfig(config.pdf)}}function getMimeTypeDisposition(mimeType,forceDownload=!1){let normalized=mimeType.split(";")[0]?.trim().toLowerCase()??"";if(NEVER_INLINE.has(normalized))return"attachment";if(forceDownload)return"attachment";let inlineTypes=["image/","video/","audio/","text/","application/pdf"];for(let type4 of inlineTypes)if(normalized.startsWith(type4)||normalized===type4)return"inline";return"attachment"}function sanitizeFilename(filename){return filename.replace(/[^A-Za-z0-9._-]+/g,"_").replace(/_{2,}/g,"_").slice(0,200)}function buildContentDisposition(type4,fileName){return`${type4}; filename="${sanitizeFilename(fileName)}"; filename*=UTF-8''${encodeURIComponent(fileName)}`}function isTraversalId(id){return id.includes("/")||id.includes("\\")||id.includes("..")||id.includes("\x00")}function resolveTenantSchema(request){return request.headers.get("x-tenant-schema")||void 0}function createCdnRoutes(config){let{cdn,storagePath,logger:logger2,getFileRecord,getStorageProvider:getStorageProvider2,authorizeFile}=config,materialize=async(absolutePath)=>{let provider=getStorageProvider2?.();if(!provider||provider.kind==="local")return absolutePath;let relative=path5.relative(storagePath,absolutePath);if(!relative||relative.startsWith(".."))return absolutePath;return await provider.localPath(relative)??absolutePath};if(!cdn.enabled)return collectRoutes();let routeGetId=defineRoute({method:"GET",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file by ID",description:"Serve file with streaming, range requests, and caching support"},handler:async({params,request,set:set2,query})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,{success:!1,message:"Invalid file id"};let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,{success:!1,message:"You are not allowed to access this file"};let filePath,fileName,mimeType;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,{success:!1,message:"File not found"};filePath=path5.join(fileRecord.path,fileRecord.name),fileName=fileRecord.original_name?.trim()||fileRecord.name,mimeType=fileRecord.mimeType||fileRecord.mime_type||"application/octet-stream"}else filePath=path5.join(storagePath,id),fileName=id,mimeType="application/octet-stream";if(!isPathWithinBase(storagePath,filePath))return set2.status=404,{success:!1,message:"File not found"};if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,{success:!1,message:"Physical file not found"};if(cdn.video.enabled&&isTransformableVideo(mimeType)){let wantPoster=query.poster!==void 0&&query.poster!=="0"&&query.poster!=="false",variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:wantPoster?"poster":"web"});if(variant)filePath=variant.path,mimeType=variant.contentType;else if(wantPoster)return set2.status=404,{success:!1,message:"Poster not generated"}}if(cdn.pdf.enabled&&isTransformablePdf(mimeType)){if(query.cover!==void 0&&query.cover!=="0"&&query.cover!=="false"){let coverArgs={sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,coverFormat:cdn.pdf.coverFormat},cover=await resolvePdfCover(coverArgs);if(!cover)await processPdfOnUpload({sourcePath:filePath,mimeType,storagePath,cacheSubdir:cdn.transform.cacheSubdir,config:cdn.pdf,logger:logger2}),cover=await resolvePdfCover(coverArgs);if(!cover)return set2.status=404,{success:!1,message:"Cover not generated"};filePath=cover.path,mimeType=cover.contentType}}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,cacheHeaders={"Cache-Control":mimeType.startsWith("video/")?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)cacheHeaders.ETag=etag;if(cdn.corsOrigins.length>0)cacheHeaders["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),cacheHeaders["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";if(cdn.transform.enabled&&isTransformableImage(mimeType)){let transformParams=parseTransformParams(query,cdn.transform);if(transformParams){let derivative=await ensureDerivative({sourcePath:filePath,mimeType,params:transformParams,storagePath,config:cdn.transform,logger:logger2,accept:request.headers.get("accept")??void 0});if(derivative){let derivativeInfo=await fileManager.getFileInfo(derivative.path),derivativeHeaders={...cacheHeaders,"Content-Type":derivative.contentType,"Content-Disposition":`inline; filename="${sanitizeFilename(fileName)}"`,"X-Content-Type-Options":"nosniff",Vary:"Accept"};if(cdn.enableEtag)derivativeHeaders.ETag=derivative.etag;if(cdn.enableEtag&&request.headers.get("if-none-match")===derivative.etag)return new Response(null,{status:304,headers:derivativeHeaders});return new Response(Bun.file(derivative.path),{status:200,headers:{"Content-Length":derivativeInfo.size.toString(),...derivativeHeaders}})}}}let forceDownload=query.download!==void 0&&query.download!=="0"&&query.download!=="false",dispositionType=getMimeTypeDisposition(mimeType,forceDownload),contentDisposition=buildContentDisposition(dispositionType,fileName),ifNoneMatch=request.headers.get("if-none-match");if(etag&&ifNoneMatch===etag)return new Response(null,{status:304,headers:cacheHeaders});let bunFile=Bun.file(filePath),range=request.headers.get("range");if(cdn.enableRangeRequests&&range){let rangeMatch=range.match(/bytes=(\d*)-(\d*)/);if(!rangeMatch)return set2.status=416,new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let startStr=rangeMatch[1]??"",endStr=rangeMatch[2]??"",isSuffix=startStr===""&&endStr!=="",start=isSuffix?Math.max(0,fileInfo.size-parseInt(endStr,10)):parseInt(startStr||"0",10),end=isSuffix||!endStr?fileInfo.size-1:parseInt(endStr,10);if(isSuffix&&parseInt(endStr,10)===0)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});if(start>=fileInfo.size||end>=fileInfo.size||start>end)return new Response("Range not satisfiable",{status:416,headers:{"Content-Range":`bytes */${fileInfo.size}`,"Content-Type":mimeType,"X-Content-Type-Options":"nosniff",...cacheHeaders}});let chunkSize=end-start+1,chunkStream=boundedStream(bunFile.slice(start,end+1).stream(),chunkSize);return new Response(chunkStream,{status:206,headers:{"Content-Range":`bytes ${start}-${end}/${fileInfo.size}`,"Accept-Ranges":"bytes","Content-Length":chunkSize.toString(),"Content-Type":mimeType,"Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}return new Response(bunFile,{status:200,headers:{"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Content-Disposition":contentDisposition,"X-Content-Type-Options":"nosniff",...cacheHeaders}})}}),routeHeadId=defineRoute({method:"HEAD",path:"/:id",params:Type.Object({id:Type.String()}),detail:{tags:["CDN"],summary:"Get file metadata",description:"Get file headers without body for preflight checks"},handler:async({params,request,set:set2})=>{let{id}=params;if(isTraversalId(id))return set2.status=400,new Response(null,{status:400});let schemaName=resolveTenantSchema(request);if(authorizeFile&&!await authorizeFile({id,request,schemaName}))return set2.status=403,new Response(null,{status:403});let filePath,mimeType,fileName;if(getFileRecord){let fileRecord=await getFileRecord(id,schemaName);if(!fileRecord)return set2.status=404,new Response(null,{status:404});filePath=path5.join(fileRecord.path,fileRecord.name),mimeType=fileRecord.mime_type||"application/octet-stream",fileName=fileRecord.original_name?.trim()||fileRecord.name}else filePath=path5.join(storagePath,id),mimeType="application/octet-stream",fileName=id;if(!isPathWithinBase(storagePath,filePath))return set2.status=404,new Response(null,{status:404});if(filePath=await materialize(filePath),!await fileManager.exists(filePath))return set2.status=404,new Response(null,{status:404});if(cdn.video.enabled&&isTransformableVideo(mimeType)){let variant=await resolveVideoVariant({sourcePath:filePath,storagePath,cacheSubdir:cdn.transform.cacheSubdir,posterFormat:cdn.video.posterFormat,kind:"web"});if(variant)filePath=variant.path,mimeType=variant.contentType}let fileInfo=await fileManager.getFileInfo(filePath),lastModified=new Date(fileInfo.modifiedAt||Date.now()).toUTCString(),etag=cdn.enableEtag?`"${fileInfo.size}-${fileInfo.modifiedAt?.getTime()||Date.now()}"`:void 0,isVideo=mimeType.startsWith("video/"),headers={"Content-Length":fileInfo.size.toString(),"Content-Type":mimeType,"Content-Disposition":buildContentDisposition(getMimeTypeDisposition(mimeType),fileName),"X-Content-Type-Options":"nosniff","Accept-Ranges":cdn.enableRangeRequests?"bytes":"none","Cache-Control":isVideo?"public, no-cache":`public, max-age=${cdn.cacheMaxAge}`,"Last-Modified":lastModified};if(etag)headers.ETag=etag;if(cdn.corsOrigins.length>0)headers["Access-Control-Allow-Origin"]=cdn.corsOrigins[0]==="*"?"*":cdn.corsOrigins.join(", "),headers["Access-Control-Allow-Methods"]="GET, HEAD, OPTIONS";return new Response(null,{status:200,headers})}});logger2.info(`[CDN] Routes enabled at ${cdn.basePath}`);let declared=[routeGetId,routeHeadId];return collectRoutes([{prefix:cdn.basePath,routes:declared}])}var DEFAULT_CDN_CONFIG,NEVER_INLINE;var init_cdn=__esm(()=>{init_esm3();init_File();init_routeCollector();init_helpers3();init_imageTransform();init_pdfTransform();init_videoTransform();DEFAULT_CDN_CONFIG={enabled:!0,basePath:"/cdn",cacheMaxAge:86400,enableRangeRequests:!0,enableEtag:!0,corsOrigins:["*"],transform:mergeTransformConfig(),video:mergeVideoConfig(),pdf:mergePdfConfig()};NEVER_INLINE=new Set(["text/html","application/xhtml+xml","image/svg+xml","application/xml","text/xml","application/javascript","text/javascript","application/ecmascript","text/ecmascript","application/x-httpd-php"])});function buildFileRecordPayload(upload,userId){return{id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:upload.originalName.split(".").pop()||"",uploadedBy:userId??null}}async function persistUploadedFiles(args){let{db,filesTable,files,storageConfig,subFolder,userId}=args,uploaded=await uploadFiles(files,storageConfig,subFolder),records=[];for(let upload of uploaded.success){let payload=buildFileRecordPayload(upload,userId);payload.createdBy=userId??null,await db.insert(filesTable).values(payload),records.push({id:upload.id,name:upload.name,originalName:upload.originalName,path:upload.path,mimeType:upload.mimeType,size:upload.size,extension:payload.extension})}return{records,failed:uploaded.failed}}var init_file_record=__esm(()=>{init_helpers3()});import path6 from"path";function scheduleUploadMediaProcessing(records,opts){let{storagePath,media,logger:logger2}=opts,{transform:transform3,video,pdf}=media,imagesOn=transform3.enabled&&transform3.pregenerate.enabled,videoOn=video.enabled,pdfOn=pdf.enabled;if(!imagesOn&&!videoOn&&!pdfOn)return;for(let record3 of records){let sourcePath=path6.join(record3.path,record3.name);if(imagesOn&&isTransformableImage(record3.mimeType))pregenerateImageVariants({sourcePath,mimeType:record3.mimeType,storagePath,config:transform3,logger:logger2}).catch(()=>{});if(pdfOn&&isTransformablePdf(record3.mimeType))processPdfOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:pdf,logger:logger2}).catch(()=>{});if(videoOn&&isTransformableVideo(record3.mimeType))processVideoOnUpload({sourcePath,mimeType:record3.mimeType,storagePath,cacheSubdir:transform3.cacheSubdir,config:video,logger:logger2}).catch(()=>{})}}var init_mediaPostProcess=__esm(()=>{init_imageTransform();init_pdfTransform();init_videoTransform()});var exports_storage={};__export(exports_storage,{validateFile:()=>validateFile,uploadFiles:()=>uploadFiles,uploadFile:()=>uploadFile,setStorageProvider:()=>setStorageProvider,scheduleUploadMediaProcessing:()=>scheduleUploadMediaProcessing,resolvePdfCover:()=>resolvePdfCover,processPdfOnUpload:()=>processPdfOnUpload,persistUploadedFiles:()=>persistUploadedFiles,parseFormDataBody:()=>parseFormDataBody,normalizeMimeType:()=>normalizeMimeType,mergeVideoConfig:()=>mergeVideoConfig,mergeTransformConfig:()=>mergeTransformConfig,mergeStorageConfig:()=>mergeStorageConfig,mergePdfConfig:()=>mergePdfConfig,mergeCdnConfig:()=>mergeCdnConfig,isTransformablePdf:()=>isTransformablePdf,isMimeTypeListed:()=>isMimeTypeListed,getStorageProvider:()=>getStorageProvider,deleteFile:()=>deleteFile,createCdnRoutes:()=>createCdnRoutes,buildFileRecordPayload:()=>buildFileRecordPayload});var init_storage2=__esm(()=>{init_cdn();init_file_record();init_helpers3();init_imageTransform();init_mediaPostProcess();init_videoTransform();init_pdfTransform()});function createGodminGuard2(deps){let{logger:logger2,db,schemaTables,area}=deps,allowedRoles=new Set((deps.allowedRoles??[]).map((role)=>role.toLowerCase()));return async({request,set:set2})=>{let roles=decodeHeaderList(request.headers.get("x-user-roles")),headerGrants=roles.includes(GODMIN_ROLE_NAME)||allowedRoles.size>0&&roles.some((role)=>allowedRoles.has(role.toLowerCase())),userId=request.headers.get("x-user-id"),caller;if(userId&&db&&schemaTables.users)try{let{eq:eq31}=await import("drizzle-orm"),usersTable=schemaTables.users;caller=(await db.select().from(usersTable).where(eq31(usersTable.id,userId)).limit(1))[0]}catch(err){logger2.warn(`[${area}] Failed to check isGod from DB`,{error:err instanceof Error?err.message:String(err)})}if(!headerGrants&&caller?.isGod!==!0)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:allowedRoles.size>0?`${area} requires godmin or one of: ${[...allowedRoles].join(", ")}`:`Only godmin users can access ${area}`,data:null}));if(caller){let refusal=accountStateRefusal(caller);if(refusal)return set2.status=403,Response.json(withEnvelopeFlags({isSuccess:!1,message:refusal,data:null}))}return}}var init_godminGuard=__esm(()=>{init_Authorization();init_response();init_requireGodmin()});var exports_helpers={};__export(exports_helpers,{scanUndeclaredEnv:()=>scanUndeclaredEnv,scanEnvVars:()=>scanEnvVars,restoreMaskedEchoes:()=>restoreMaskedEchoes,readOverridesFromRedis:()=>readOverridesFromRedis,persistSectionToRedis:()=>persistSectionToRedis,persistConfigToDisk:()=>persistConfigToDisk,maskUrlCredentials:()=>maskUrlCredentials,maskSensitiveFields:()=>maskSensitiveFields,looksSecretValue:()=>looksSecretValue,loadOverridesFromRedis:()=>loadOverridesFromRedis,isRestartRequired:()=>isRestartRequired,hasSection:()=>hasSection,extractSection:()=>extractSection,deepMerge:()=>deepMerge,clearOverridesFromRedis:()=>clearOverridesFromRedis,buildSectionsMeta:()=>buildSectionsMeta,applySectionUpdate:()=>applySectionUpdate});var SENSITIVE_KEY_PATTERNS,FORBIDDEN_SECTION_KEYS,isSensitiveKey=(key2)=>SENSITIVE_KEY_PATTERNS.some((pattern2)=>pattern2.test(key2)),HEADER_MAP_KEYS,maskHeaderMap=(value2)=>{let masked={};for(let name2 of Object.keys(value2))masked[name2]="***";return masked},URL_CREDENTIALS,maskUrlCredentials=(value2)=>value2.replace(URL_CREDENTIALS,"$1***$2"),B64ISH_VALUE,looksSecretValue=(value2)=>{if(!value2)return!1;let v=value2.trim();if(v.length>=60&&B64ISH_VALUE.test(v))return!0;return v.includes("PRIVATE KEY")||v.includes("BEGIN ")||v.includes('"private_key"')},RESTART_REQUIRED_KEYS,asRecord=(config)=>config,maskSensitiveFields=(obj)=>{let result={};for(let[key2,value2]of Object.entries(obj)){if(isSensitiveKey(key2)&&typeof value2==="string"){result[key2]="***";continue}if(Array.isArray(value2)){result[key2]=value2.map((item)=>typeof item==="object"&&item!==null?maskSensitiveFields(item):item);continue}if(typeof value2==="object"&&value2!==null){result[key2]=HEADER_MAP_KEYS.test(key2)?maskHeaderMap(value2):maskSensitiveFields(value2);continue}result[key2]=typeof value2==="string"?maskUrlCredentials(value2):value2}return result},MASK="***",isPlainObject2=(value2)=>typeof value2==="object"&&value2!==null&&!Array.isArray(value2),restoreMaskedEchoes=(section,current,incoming)=>restoreAgainst(current,maskSensitiveFields({[section]:current})[section],incoming),restoreAgainst=(current,masked,incoming,everyValueMasked=!1)=>{if(isPlainObject2(incoming)&&isPlainObject2(current)&&isPlainObject2(masked)){let result={};for(let[key2,value2]of Object.entries(incoming)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;if(Object.hasOwn(current,key2)){result[key2]=restoreAgainst(current[key2],masked[key2],value2,HEADER_MAP_KEYS.test(key2));continue}if(value2===MASK&&(everyValueMasked||isSensitiveKey(key2)))continue;result[key2]=value2}return result}if(Array.isArray(incoming)&&Array.isArray(current)&&Array.isArray(masked)&&incoming.length===current.length)return incoming.map((item,index)=>restoreAgainst(current[index],masked[index],item));if(typeof incoming==="string"&&incoming===masked&&masked!==current)return current;return incoming},buildSectionsMeta=(config)=>{let record3=asRecord(config);return Object.keys(record3).filter((key2)=>record3[key2]!==void 0).map((key2)=>{let value2=record3[key2],type4=Array.isArray(value2)?"array":typeof value2==="object"&&value2!==null?"object":"primitive";return{key:key2,type:type4,restartRequired:RESTART_REQUIRED_KEYS.has(key2)}})},extractSection=(config,section)=>asRecord(config)[section],hasSection=(config,section)=>Object.hasOwn(asRecord(config),section),applySectionUpdate=(config,section,value2)=>{if(FORBIDDEN_SECTION_KEYS.has(section))return;asRecord(config)[section]=value2},isRestartRequired=(section)=>RESTART_REQUIRED_KEYS.has(section),ENV_VAR_PATTERN,scanEnvVars=(obj,parentPath="")=>{let entries=[];for(let[key2,value2]of Object.entries(obj)){let currentPath=parentPath?`${parentPath}.${key2}`:key2;if(typeof value2==="string"&&ENV_VAR_PATTERN.test(value2)){let envValue=process.env[value2],valueIsSecret=envValue!==void 0&&looksSecretValue(envValue);entries.push({configPath:currentPath,envName:value2,resolved:envValue!==void 0,value:envValue!==void 0?isSensitiveKey(key2)||valueIsSecret?"***":maskUrlCredentials(envValue):null,isSecret:isSensitiveKey(key2)||valueIsSecret,recognized:!0});continue}if(Array.isArray(value2)){for(let i=0;i<value2.length;i++){let item=value2[i];if(typeof item==="object"&&item!==null)entries.push(...scanEnvVars(item,`${currentPath}[${i}]`))}continue}if(typeof value2==="object"&&value2!==null)entries.push(...scanEnvVars(value2,currentPath))}return entries},K8S_LINK_RE,SYSTEM_ENV,SYSTEM_PREFIXES,PROVIDER_KEY_TOKENS,isProviderApiKey=(name2)=>{let upper=name2.toUpperCase();return upper.endsWith("_API_KEY")&&PROVIDER_KEY_TOKENS.some((token)=>upper.includes(token))},isInfraNoise=(name2,value2)=>{if(SYSTEM_ENV.has(name2))return!0;if(SYSTEM_PREFIXES.some((prefix)=>name2.startsWith(prefix)))return!0;if(K8S_LINK_RE.test(name2))return!0;if(name2.endsWith("_PORT")&&value2.startsWith("tcp://"))return!0;return!1},scanUndeclaredEnv=(declaredNames)=>{let entries=[];for(let[name2,rawValue]of Object.entries(process.env)){if(declaredNames.has(name2))continue;let value2=rawValue??"";if(isInfraNoise(name2,value2))continue;if(isProviderApiKey(name2))continue;let resolved=value2!=="";entries.push({configPath:name2,envName:name2,resolved,value:resolved?"***":null,isSecret:resolved,recognized:!1})}return entries},buildRedisKey=(appId)=>`nucleus:config:overrides:${appId}`,persistConfigToDisk=async(configFilePath,config)=>{let fs3=__require("fs"),content=JSON.stringify(asRecord(config),null,2);fs3.writeFileSync(configFilePath,content,"utf-8")},decodeOverrides=(stored)=>{let value2=parseStoredJson(stored);if(value2===null||typeof value2!=="object"||Array.isArray(value2))return null;return value2},persistSectionToRedis=async(redis,appId,section,value2)=>{let redisKey=buildRedisKey(appId),existing=await redis.read(redisKey),overrides=(existing.success?decodeOverrides(existing.data):null)??{};overrides[section]=value2,await redis.create(redisKey,overrides)},readOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey);if(!result.success)return null;return decodeOverrides(result.data)},clearOverridesFromRedis=async(redis,appId)=>{let redisKey=buildRedisKey(appId);await redis.create(redisKey,{})},loadOverridesFromRedis=async(redis,appId,config)=>{let redisKey=buildRedisKey(appId),result=await redis.read(redisKey),overrides=result.success?decodeOverrides(result.data):null;if(!overrides)return{applied:[],ignored:[]};let applied=[],ignored=[],record3=asRecord(config);for(let[section,value2]of Object.entries(overrides)){if(FORBIDDEN_SECTION_KEYS.has(section))continue;if(!Object.hasOwn(record3,section)){ignored.push(section);continue}let current=record3[section];if(typeof value2==="object"&&value2!==null&&!Array.isArray(value2)&&typeof current==="object"&&current!==null&&!Array.isArray(current))record3[section]=deepMerge(current,value2);else record3[section]=value2;applied.push(section)}return{applied,ignored}},deepMerge=(target2,source)=>{let result={...target2};for(let[key2,sourceValue]of Object.entries(source)){if(FORBIDDEN_SECTION_KEYS.has(key2))continue;let targetValue=target2[key2];if(typeof sourceValue==="object"&&sourceValue!==null&&!Array.isArray(sourceValue)&&typeof targetValue==="object"&&targetValue!==null&&!Array.isArray(targetValue))result[key2]=deepMerge(targetValue,sourceValue);else result[key2]=sourceValue}return result};var init_helpers4=__esm(()=>{SENSITIVE_KEY_PATTERNS=[/secret/i,/password/i,/token/i,/^apiKey$/i,/^secretKey$/i,/^webhookSecret$/i,/connection_string/i,/connectionString/i,/^clientSecret$/i,/json_file_path/i,/key$/i,/salt/i,/passphrase/i,/credential/i,/^authorization$/i,/^cookie$/i,/^x-api-key$/i],FORBIDDEN_SECTION_KEYS=new Set(["__proto__","constructor","prototype"]),HEADER_MAP_KEYS=/^(headers|extraHeaders|defaultHeaders|requestHeaders)$/i,URL_CREDENTIALS=/^([a-z][a-z0-9+.-]*:\/\/[^/\s:@]*:)[^/\s@]+(@)/i,B64ISH_VALUE=/^[A-Za-z0-9+/=_-]{60,}$/,RESTART_REQUIRED_KEYS=new Set(["appId","mode","database","redis","authentication","authorization","email","payment","entities"]),ENV_VAR_PATTERN=/^[A-Z][A-Z0-9_]{2,}$/,K8S_LINK_RE=/(_SERVICE_HOST|_SERVICE_PORT.*|_PORT_\d+_TCP.*)$/,SYSTEM_ENV=new Set(["PATH","HOME","HOSTNAME","PWD","OLDPWD","TERM","SHLVL","_","LANG","TZ","container","VIRTUAL_ENV","DEBIAN_FRONTEND"]),SYSTEM_PREFIXES=["LC_","GPG_","PYTHON","SSL_CERT","KUBERNETES_"],PROVIDER_KEY_TOKENS=["OPENAI","CLAUDE","ANTHROPIC","GEMINI","GOOGLE","XAI","GROQ","COHERE","ZAI","OLLAMA","KIE","DEEPGRAM","ELEVENLABS","AZURE_OPENAI","MISTRAL","PERPLEXITY","TOGETHER","FIREWORKS","REPLICATE","STABILITY","RUNWAY","HUGGINGFACE","VOYAGE","JINA"]});function toCamel4(name2){return name2.replace(/_([a-z])/g,(_,letter)=>letter.toUpperCase())}function registerSensitiveColumns(names2){for(let name2 of names2)registry2.add(name2),registry2.add(toCamel4(name2))}function isConfigSensitiveKey(key2){return registry2.has(key2)}function sensitiveColumnNames(){return[...registry2]}function sensitiveFieldQueryable(field,opts){if(!isConfigSensitiveKey(field))return!0;if(!opts.authEnabled)return!1;return opts.allowedFields?.includes(field)===!0}function stripUnclaimedSensitive(row,allowedFields){if(allowedFields&&allowedFields.length>0)return row;if(registry2.size===0)return row;return scrub(row)}function scrub(value2){if(value2===null||typeof value2!=="object")return value2;if(Array.isArray(value2))return value2.map(scrub);let proto=Object.getPrototypeOf(value2);if(proto!==Object.prototype&&proto!==null)return value2;let out={};for(let[k,v]of Object.entries(value2)){if(registry2.has(k))continue;out[k]=scrub(v)}return out}var registry2;var init_sensitiveColumns=__esm(()=>{registry2=new Set});var exports_ack_manager={};__export(exports_ack_manager,{storePendingMessage:()=>storePendingMessage,removePendingMessage:()=>removePendingMessage,recordSent:()=>recordSent,recordFailed:()=>recordFailed,recordAcked:()=>recordAcked,initAckCleanup:()=>initAckCleanup,incrementRetryCount:()=>incrementRetryCount,getPendingMessagesForUser:()=>getPendingMessagesForUser,getPendingMessageCount:()=>getPendingMessageCount,getDeliveryStats:()=>getDeliveryStats,generateMessageId:()=>generateMessageId,destroyAckCleanup:()=>destroyAckCleanup,acknowledgeMessage:()=>acknowledgeMessage});function cleanupRecentAcks(){let now=Date.now();for(let[key2,timestamp]of recentAcks)if(now-timestamp>1e4)recentAcks.delete(key2)}function initAckCleanup(){if(cleanupInterval)return;cleanupInterval=setInterval(cleanupRecentAcks,30000),cleanupInterval.unref?.()}function destroyAckCleanup(){if(cleanupInterval)clearInterval(cleanupInterval),cleanupInterval=null}function generateMessageId(){return`msg_${Date.now()}_${Math.random().toString(36).substring(2,11)}`}async function storePendingMessage(redis,message,ttlSeconds){if(!message.userId)return;let key2=`pubsub:pending:user:${message.userId}:${message.messageId}`,setKey=`pubsub:user:pending-set:${message.userId}`;await redis.create(key2,message,ttlSeconds);let existingResult=await redis.read(setKey),existingSet=existingResult.success&&existingResult.data?existingResult.data:[];if(!existingSet.includes(message.messageId))existingSet.push(message.messageId),await redis.create(setKey,existingSet,ttlSeconds)}async function acknowledgeMessage(redis,userId,messageId,ttlSeconds){let dedupKey=`${userId}:${messageId}`;if(recentAcks.has(dedupKey))return!1;let pendingKey=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`,ackKey=`pubsub:ack:${userId}:${messageId}`,pendingResult=await redis.read(pendingKey);if(!pendingResult.success||!pendingResult.data)return recentAcks.set(dedupKey,Date.now()),!1;recentAcks.set(dedupKey,Date.now());let pending=pendingResult.data,ack={messageId,clientId:pending.clientId,ackedAt:Date.now()};await redis.create(ackKey,ack,60),await redis.remove(pendingKey);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,ttlSeconds);else await redis.remove(setKey);let latencyMs=Date.now()-pending.sentAt;return recordAcked(latencyMs),!0}async function getPendingMessagesForUser(redis,userId){if(!userId)return[];let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey),messageIds=setResult.success&&setResult.data?setResult.data:[],messages=[];for(let messageId of messageIds){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(msgResult.success&&msgResult.data)messages.push(msgResult.data)}return messages.sort((a,b)=>a.sentAt-b.sentAt),messages}async function getPendingMessageCount(redis,userId){if(!userId)return 0;let setKey=`pubsub:user:pending-set:${userId}`,setResult=await redis.read(setKey);return(setResult.success&&setResult.data?setResult.data:[]).length}async function incrementRetryCount(redis,userId,messageId,ttlSeconds,maxRetries){let key2=`pubsub:pending:user:${userId}:${messageId}`,msgResult=await redis.read(key2);if(!msgResult.success||!msgResult.data)return!1;let message={...msgResult.data,retryCount:msgResult.data.retryCount+1};if(message.retryCount>=maxRetries)return await removePendingMessage(redis,userId,messageId),recordFailed(),!1;return await redis.create(key2,message,ttlSeconds),!0}async function removePendingMessage(redis,userId,messageId){let key2=`pubsub:pending:user:${userId}:${messageId}`,setKey=`pubsub:user:pending-set:${userId}`;await redis.remove(key2);let setResult=await redis.read(setKey),updatedSet=(setResult.success&&setResult.data?setResult.data:[]).filter((id)=>id!==messageId);if(updatedSet.length>0)await redis.create(setKey,updatedSet,300);else await redis.remove(setKey)}function recordSent(){stats.totalSent++}function recordAcked(latencyMs){stats.totalAcked++,stats.averageLatencyMs=(stats.averageLatencyMs*(stats.totalAcked-1)+latencyMs)/stats.totalAcked}function recordFailed(){stats.totalFailed++}function getDeliveryStats(){return{...stats}}var recentAcks,cleanupInterval=null,stats;var init_ack_manager=__esm(()=>{recentAcks=new Map;stats={totalSent:0,totalAcked:0,totalFailed:0,averageLatencyMs:0}});import{eq as eq36}from"drizzle-orm";async function revocationReason(params){let{db,sessionsTable}=params;if(!db||!sessionsTable)return null;let row=(await db.select().from(sessionsTable).where(eq36(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return null;let reason=row.revokedReason??row.revoked_reason;return typeof reason==="string"&&reason.length>0?reason:null}async function refreshSessionIsAlive(params){if(!params.sessionId)return{alive:!1,reason:"no session bound to the token"};let record3=await readSession({sessionId:params.sessionId}).catch(()=>null);if(!record3){let cause=await revocationReason(params).catch(()=>null);return{alive:!1,reason:cause?`session revoked: ${cause}`:"session not found"}}let{userId:sessionUserId,rememberMe:sessionRememberMe}=record3,reuseState={refreshTokenHash:record3.refreshTokenHash,previousRefreshTokenHash:record3.previousRefreshTokenHash,previousRefreshTokenAt:record3.previousRefreshTokenAt},{db,sessionsTable}=params;if(!db||!sessionsTable)return{alive:!0,userId:sessionUserId,rememberMe:sessionRememberMe,...reuseState};let row=(await db.select().from(sessionsTable).where(eq36(sessionsTable.id,params.sessionId)).limit(1))[0];if(!row)return{alive:!1,reason:"session row missing"};let revokedAtVal=row.revokedAt,isRevoked=revokedAtVal!=null&&!(typeof revokedAtVal==="object"&&!(revokedAtVal instanceof Date)&&Object.keys(revokedAtVal).length===0);if(row.isActive===!1||isRevoked)return{alive:!1,reason:"session revoked"};let expiresAt=row.expiresAt;if(expiresAt&&new Date(expiresAt)<new Date)return{alive:!1,reason:"session expired"};let rowRememberMe=typeof row.rememberMe==="boolean"?row.rememberMe:void 0;return{alive:!0,userId:sessionUserId,rememberMe:rowRememberMe??sessionRememberMe,...reuseState}}var init_sessionBinding=__esm(()=>{init_SessionStore()});var exports_buildServices={};__export(exports_buildServices,{buildVerificationServices:()=>buildVerificationServices});function buildVerificationServices(deps){let verificationService=new VerificationService({db:deps.db,schemaTables:deps.schemaTables,config:deps.config,logger:deps.logger}),notificationService=new NotificationService({db:deps.db,schemaTables:deps.schemaTables,config:deps.notificationConfig||{enabled:!1},logger:deps.logger,getEmailService:deps.getEmailService});return verificationService.setNotificationHandler(async(params)=>{if(!deps.notificationConfig?.enabled)return;await notificationService.triggerNotifications({trigger:params.trigger,flow_id:params.flow_id,entity_name:params.entity_name,entity_id:params.entity_id,node_id:params.node_id,verifier_id:params.verifier_id,decision:params.decision,context:params.context})}),{verificationService,notificationService}}var init_buildServices=__esm(()=>{init_Notification();init_Verification()});function resolveMutationSchema(staticSchema,tenantHeader,registry3){let schema3=staticSchema;if(registry3&&tenantHeader){let tctx=registry3.getSchemaContext(tenantHeader);if(!tctx)return{ok:!1,reason:"unknown"};schema3=tctx.schemaName}if(!SQL_IDENT.test(schema3))return{ok:!1,reason:"invalid"};return{ok:!0,schema:schema3}}var SQL_IDENT;var init_resolveMutationSchema=__esm(()=>{SQL_IDENT=/^[a-zA-Z_][a-zA-Z0-9_]*$/});import{eq as eq41,sql as sql9}from"drizzle-orm";function createChangeUserIdRoute(config,schemaName="public"){let{db,logger:logger2}=config,requireGodmin2=createRequireGodmin(config),declared=[defineRoute({method:"POST",path:"/auth/admin/change-user-id",body:Type.Object({currentId:Type.String(),newId:Type.String()}),detail:{tags:["Authentication"],summary:"Change User ID",description:"Godmin: change a user's UUID while preserving all FK relations, audit columns, and polymorphic references"},handler:async(ctx)=>{let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let registry3=config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry,schemaResult=resolveMutationSchema(schemaName,ctx.request.headers.get("x-tenant-schema"),registry3);if(!schemaResult.ok)return ctx.set.status=400,{success:!1,message:schemaResult.reason==="unknown"?"Unknown tenant schema":"Invalid tenant schema"};let effectiveSchema=schemaResult.schema,gate=await requireGodmin2(ctx.request);if(!gate.ok)return ctx.set.status=gate.status,{success:!1,message:gate.message};let requestingUserId=gate.callerId,{currentId,newId}=ctx.body;if(!currentId||!newId)return ctx.set.status=400,{success:!1,message:"currentId and newId are required"};if(currentId===newId)return ctx.set.status=400,{success:!1,message:"New ID must be different from current ID"};let uuidRegex=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;if(!uuidRegex.test(newId))return ctx.set.status=400,{success:!1,message:"newId must be a valid UUID"};if(!uuidRegex.test(currentId))return ctx.set.status=400,{success:!1,message:"currentId must be a valid UUID"};let targetUser=(await db.select().from(usersTable).where(eq41(usersTable.id,currentId)).limit(1))[0];if(!targetUser)return ctx.set.status=404,{success:!1,message:"User not found"};if((await db.select().from(usersTable).where(eq41(usersTable.id,newId)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"A user with this ID already exists"};try{let fkResult=await db.execute(sql9`
 					SELECT
 						tc.constraint_name,
 						tc.table_name,
@@ -522,7 +522,7 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
 </table>
 </td></tr>
 </table>
-</body></html>`},routeGetApprovePage=defineRoute({method:"GET",path:"/approve-page",detail:{tags:["Authentication"],summary:"Approval page",description:"Standalone HTML page for approving a device (no frontend auth required)"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return new Response("Service unavailable",{status:503});let token=new URL(ctx.request.url).searchParams.get("token");if(!token){let html2=buildApprovalPageHtml({},"approve","","invalid");return new Response(html2,{status:400,headers:{"Content-Type":"text/html; charset=utf-8"}})}let sessions=await db.select().from(sessionsTable2).where(eq62(col15("approvalToken"),token)).limit(1);if(sessions.length===0){let html2=buildApprovalPageHtml({},"approve",token,"invalid");return new Response(html2,{status:404,headers:{"Content-Type":"text/html; charset=utf-8"}})}let session=sessions[0];if(session.approvalStatus!=="pending"&&session.approval_status!=="pending"){let html2=buildApprovalPageHtml(session,"approve",token,"already_processed");return new Response(html2,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}let requestedAt=session.approvalRequestedAt||session.approval_requested_at;if(requestedAt&&Date.now()-new Date(requestedAt).getTime()>APPROVAL_TOKEN_TTL_MS){let html2=buildApprovalPageHtml(session,"approve",token,"expired");return new Response(html2,{status:410,headers:{"Content-Type":"text/html; charset=utf-8"}})}let html=buildApprovalPageHtml(session,"approve",token,"pending");return new Response(html,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}}),routeGetRejectPage=defineRoute({method:"GET",path:"/reject-page",detail:{tags:["Authentication"],summary:"Rejection page",description:"Standalone HTML page for rejecting a device (no frontend auth required)"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return new Response("Service unavailable",{status:503});let token=new URL(ctx.request.url).searchParams.get("token");if(!token){let html2=buildApprovalPageHtml({},"reject","","invalid");return new Response(html2,{status:400,headers:{"Content-Type":"text/html; charset=utf-8"}})}let sessions=await db.select().from(sessionsTable2).where(eq62(col15("approvalToken"),token)).limit(1);if(sessions.length===0){let html2=buildApprovalPageHtml({},"reject",token,"invalid");return new Response(html2,{status:404,headers:{"Content-Type":"text/html; charset=utf-8"}})}let session=sessions[0];if(session.approvalStatus!=="pending"&&session.approval_status!=="pending"){let html2=buildApprovalPageHtml(session,"reject",token,"already_processed");return new Response(html2,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}let requestedAt=session.approvalRequestedAt||session.approval_requested_at;if(requestedAt&&Date.now()-new Date(requestedAt).getTime()>APPROVAL_TOKEN_TTL_MS){let html2=buildApprovalPageHtml(session,"reject",token,"expired");return new Response(html2,{status:410,headers:{"Content-Type":"text/html; charset=utf-8"}})}let html=buildApprovalPageHtml(session,"reject",token,"pending");return new Response(html,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}}),routeGetApprovalStatus=defineRoute({method:"GET",path:"/approval-status",detail:{tags:["Authentication"],summary:"Check approval status",description:"Check the approval status of a pending session"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let sessionId=new URL(ctx.request.url).searchParams.get("sessionId");if(!sessionId)return ctx.set.status=400,{success:!1,message:"sessionId is required"};let sessions=await db.select().from(sessionsTable2).where(eq62(col15("id"),sessionId)).limit(1);if(sessions.length===0)return ctx.set.status=404,{success:!1,message:"Session not found"};let session=sessions[0];return{success:!0,data:{approvalStatus:session.approvalStatus||session.approval_status||"unknown",isActive:session.isActive||session.is_active}}}}),routeGetDevices=defineRoute({method:"GET",path:"/devices",detail:{tags:["Authentication"],summary:"List remembered devices",description:"List the caller's remembered (device-trust) devices; never returns the token."},handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let dtTable=getSessionsForRequest(ctx.request).trustedDevicesTable;if(!dtTable||!db)return{success:!0,data:{items:[]}};let{listUserDevices:listUserDevices2}=await Promise.resolve().then(() => (init_store3(),exports_store));return{success:!0,data:{items:await listUserDevices2(db,dtTable,userId)}}}}),routeDeleteDevicesId=defineRoute({method:"DELETE",path:"/devices/:id",detail:{tags:["Authentication"],summary:"Revoke a remembered device",description:"Owner-scoped revoke of one remembered device (untrusts it)."},handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let id=ctx.params.id,dtTable=getSessionsForRequest(ctx.request).trustedDevicesTable;if(!dtTable||!db)return ctx.set.status=503,{success:!1,message:"Device trust not enabled"};let{revokeDeviceById:revokeDeviceById2}=await Promise.resolve().then(() => (init_store3(),exports_store));if(await revokeDeviceById2(db,dtTable,id,userId,"user_revoked")===0)return ctx.set.status=404,{success:!1,message:"Device not found"};return log3.info("Remembered device revoked",{userId,deviceId:id}),{success:!0,message:"Device revoked"}}}),adminGuard=createGodminGuard({logger:logger2,db,schemaTables:config.schemaTables??{},area:"session management",allowedRoles:sessionsConfig.adminRoles??[]}),routeGetAdminUserid=defineRoute({method:"GET",path:"/admin/:userId",guards:[adminGuard],detail:{tags:["Authentication"],summary:"List another user's active sessions (admin)",description:"Godmin or a role named in authentication.sessions.adminRoles. Used for offboarding and lost-device response."},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let{userId}=ctx.params,sessions=await db.select().from(sessionsTable2).where(and26(eq62(col15("userId"),userId),eq62(col15("isActive"),!0),isNull5(col15("revokedAt")))).orderBy(desc6(col15("lastActivityAt")));return{success:!0,data:{sessions:sessions.map((session)=>formatSessionForResponse(session)),totalCount:sessions.length}}}}),routeDeleteAdminUserid=defineRoute({method:"DELETE",path:"/admin/:userId",guards:[adminGuard],body:AdminRevokeSessionsBodySchema,detail:{tags:["Authentication"],summary:"End another user's sessions (admin)",description:"Ends every active session of the given user, or just one when `sessionId` is supplied. Godmin or authentication.sessions.adminRoles."},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let{userId}=ctx.params,body=ctx.body??{},actorId=ctx.request.headers.get("x-user-id")||void 0,target2=body.sessionId?and26(eq62(col15("id"),body.sessionId),eq62(col15("userId"),userId),eq62(col15("isActive"),!0)):and26(eq62(col15("userId"),userId),eq62(col15("isActive"),!0)),affected=await db.update(sessionsTable2).set({isActive:!1,revokedAt:new Date,revokedReason:body.reason||"admin_revoked"}).where(target2).returning({id:col15("id")});log3.warn("Sessions revoked by an administrator",{actorId,subjectUserId:userId,sessionId:body.sessionId,revoked:affected.length,reason:body.reason||"admin_revoked"});let reqUrl=new URL(ctx.request.url);return logger2.audit({entityName:"user_sessions",entityId:body.sessionId,operation:"SESSION_REVOKE_ALL",userId:actorId,summary:body.sessionId?`Admin revoked one session of user ${userId}`:`Admin revoked ${affected.length} session(s) of user ${userId}`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search}),{success:!0,message:`${affected.length} session${affected.length===1?"":"s"} ended`,data:{revoked:affected.length}}}});return collectRoutes([{prefix:baseRoute,routes:[routeGetRoot,routeGetCurrent,routeDeleteSessionid,routeDeleteAll,routeGetStats,routePostApprove,routePostReject,routeGetPending,routeGetApprovePage,routeGetRejectPage,routeGetApprovalStatus,routeGetDevices,routeDeleteDevicesId,routeGetAdminUserid,routeDeleteAdminUserid]}])}var init_sessions=__esm(()=>{init_scopes();init_routeCollector();init_godminGuard();init_types20();init_utils11();init_types20()});function resolveCookies(cookieConfig){return{accessTokenName:cookieConfig?.accessTokenName||"access_token",refreshTokenName:cookieConfig?.refreshTokenName||"refresh_token",sessionTokenName:cookieConfig?.sessionTokenName||"session_token",accessTokenMaxAge:cookieConfig?.accessTokenMaxAge||900,refreshTokenMaxAge:cookieConfig?.refreshTokenMaxAge||604800,sessionTokenMaxAge:cookieConfig?.sessionTokenMaxAge||2592000,secure:cookieConfig?.secure??!0,httpOnly:cookieConfig?.httpOnly??!0,sameSite:cookieConfig?.sameSite||"lax",path:cookieConfig?.path||"/",domain:cookieConfig?.domain}}function buildCookieHeaders(cookies,tokens){let securePart=cookies.secure?"; Secure":"",domainPart=cookies.domain?`; Domain=${cookies.domain}`:"",cookieOptions=`; Path=${cookies.path}; HttpOnly; SameSite=${cookies.sameSite}${securePart}${domainPart}`,headers=new Headers;return headers.set("Content-Type","application/json"),headers.set("x-session-id",tokens.sessionId),headers.append("Set-Cookie",`${cookies.accessTokenName}=${tokens.accessToken}${cookieOptions}; Max-Age=${cookies.accessTokenMaxAge}`),headers.append("Set-Cookie",`${cookies.refreshTokenName}=${tokens.refreshToken}${cookieOptions}; Max-Age=${cookies.refreshTokenMaxAge}`),headers.append("Set-Cookie",`${cookies.sessionTokenName}=${tokens.sessionId}${cookieOptions}; Max-Age=${cookies.sessionTokenMaxAge}`),headers}var WebAuthnRegisterOptionsSchema,WebAuthnRegisterVerifySchema,WebAuthnAuthOptionsSchema,WebAuthnAuthVerifySchema,WebAuthnRenameSchema;var init_types21=__esm(()=>{init_esm3();WebAuthnRegisterOptionsSchema=Type.Object({nickname:Type.Optional(Type.String({maxLength:128}))}),WebAuthnRegisterVerifySchema=Type.Object({response:Type.Any(),challenge:Type.String(),nickname:Type.Optional(Type.String({maxLength:128}))}),WebAuthnAuthOptionsSchema=Type.Object({email:Type.Optional(Type.String({format:"email"}))}),WebAuthnAuthVerifySchema=Type.Object({response:Type.Any(),challenge:Type.String(),rememberMe:Type.Optional(Type.Boolean())}),WebAuthnRenameSchema=Type.Object({nickname:Type.String({minLength:1,maxLength:128})})});import{eq as eq63}from"drizzle-orm";function getSchema(ctx){return ctx.request.headers.get("x-tenant-schema")||void 0}function getUserId2(ctx){return ctx.request.headers.get("x-user-id")}function createWebAuthnRoute(config,routeOptions,webauthnService,helpers3,cookieConfig){let{db,logger:logger2}=config,basePath=routeOptions.basePath||"/auth/webauthn",cookies=resolveCookies(cookieConfig);if(!routeOptions.enabled)return collectRoutes();let routePostRegisterOptions=defineRoute({method:"POST",path:"/register/options",body:WebAuthnRegisterOptionsSchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let user=(await db.select().from(usersTable).where(eq63(usersTable.id,userId)).limit(1))[0];if(!user)return ctx.set.status=404,{success:!1,message:"User not found"};return{success:!0,data:await webauthnService.createRegistrationOptions({userId,userName:user.email||userId,userDisplayName:user.email||userId,schemaName:getSchema(ctx)})}}}),routePostRegisterVerify=defineRoute({method:"POST",path:"/register/verify",body:WebAuthnRegisterVerifySchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let body=ctx.body,credential=await webauthnService.verifyRegistration({response:body.response,expectedChallenge:body.challenge,userId,nickname:body.nickname,schemaName:getSchema(ctx)});if(!credential)return logger2.warn("[WEBAUTHN] Registration verification failed",{userId}),ctx.set.status=400,{success:!1,message:"Registration failed"};return{success:!0,data:{id:credential.id,credentialId:credential.credentialId,nickname:credential.nickname,deviceType:credential.deviceType,backedUp:credential.backedUp,authenticatorAttachment:credential.authenticatorAttachment,aaguid:credential.aaguid,transports:credential.transports,lastUsedAt:credential.lastUsedAt,revokedAt:credential.revokedAt,createdAt:credential.createdAt}}}}),routePostAuthenticateOptions=defineRoute({method:"POST",path:"/authenticate/options",body:WebAuthnAuthOptionsSchema,handler:async(ctx)=>{let body=ctx.body,resolvedUserId;if(body.email){let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(db&&usersTable){let user=(await db.select().from(usersTable).where(eq63(usersTable.email,body.email.toLowerCase())).limit(1))[0];if(user)resolvedUserId=user.id}}return{success:!0,data:await webauthnService.createAuthenticationOptions({userId:resolvedUserId,schemaName:getSchema(ctx)})}}}),routePostAuthenticateVerify=defineRoute({method:"POST",path:"/authenticate/verify",body:WebAuthnAuthVerifySchema,handler:async(ctx)=>{let body=ctx.body,result=await webauthnService.verifyAuthentication({response:body.response,expectedChallenge:body.challenge,schemaName:getSchema(ctx)});if(!result.verified||!result.userId)return ctx.set.status=401,{success:!1,message:"Authentication failed"};let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let user=(await db.select().from(usersTable).where(eq63(usersTable.id,result.userId)).limit(1))[0];if(!user)return ctx.set.status=401,{success:!1,message:"User not found"};let webauthnState=evaluateAccountState(user);if(!webauthnState.allowed)return ctx.set.status=401,{success:!1,message:webauthnState.message};let roles=[],claims=[],claimScopes={};try{let resolved=resolveAuthTablesForRequest(ctx.request,config),rc=await fetchUserRolesAndClaims(db,result.userId,resolved);roles=rc.roles,claims=rc.claims,claimScopes=rc.claimScopes}catch{}let ipAddress=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent=ctx.request.headers.get("user-agent")||"",sessionParams={userId:result.userId,deviceInfo:ensureDeviceInfo({ipAddress,userAgent},deviceContextFromRequest(ctx.request).clientHints),loginMethod:"webauthn",rememberMe:body.rememberMe??!1},sessionId=await helpers3.createSession(sessionParams),accessToken=helpers3.signAccessToken(result.userId,roles.length>0?roles:void 0,claims.length>0?claims:void 0,getSchema(ctx),claimScopes,sessionId),refreshToken=helpers3.signRefreshToken(result.userId,body.rememberMe??!1,sessionId),deviceTokenCookie;if(helpers3.saveSessionToDb){let dtCfg=config.authentication?.deviceTrust;if(dtCfg?.enabled)sessionParams.deviceToken=readDeviceTokenFromCookieHeader(ctx.request.headers.get("cookie"),dtCfg);let saveResult=await helpers3.saveSessionToDb(sessionId,sessionParams,getSchema(ctx));if(saveResult?.denied)return ctx.set.status=403,{success:!1,message:"This device could not be recognized. Please contact support."};if(deviceTokenCookie=saveResult?.deviceTokenCookie,saveResult?.requiresApproval){if(deviceTokenCookie)ctx.set.headers["Set-Cookie"]=deviceTokenCookie;return ctx.set.status=202,{success:!1,requiresApproval:!0,sessionId:saveResult.sessionId??sessionId,message:"Login requires approval"}}}let headers=buildCookieHeaders(cookies,{accessToken,refreshToken,sessionId});if(deviceTokenCookie)headers.append("Set-Cookie",deviceTokenCookie);return logger2.info("[WEBAUTHN] Authentication successful",{userId:result.userId,credentialId:result.credentialId}),new Response(JSON.stringify({success:!0,data:{user:{id:user.id,email:user.email},accessToken,refreshToken,sessionId}}),{status:200,headers})}}),routeGetCredentials=defineRoute({method:"GET",path:"/credentials",handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};return{success:!0,data:{credentials:(await webauthnService.listUserCredentials(userId,getSchema(ctx))).map((cred)=>({id:cred.id,credentialId:cred.credentialId,nickname:cred.nickname,deviceType:cred.deviceType,backedUp:cred.backedUp,authenticatorAttachment:cred.authenticatorAttachment,transports:cred.transports,aaguid:cred.aaguid,lastUsedAt:cred.lastUsedAt,revokedAt:cred.revokedAt,createdAt:cred.createdAt}))}}}}),routeDeleteCredentialsCredentialid=defineRoute({method:"DELETE",path:"/credentials/:credentialId",handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{credentialId}=ctx.params;if(!await webauthnService.revokeCredential(credentialId,userId,getSchema(ctx)))return ctx.set.status=404,{success:!1,message:"Credential not found"};return{success:!0,message:"Credential revoked"}}}),routePatchCredentialsCredentialid=defineRoute({method:"PATCH",path:"/credentials/:credentialId",body:WebAuthnRenameSchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{credentialId}=ctx.params,body=ctx.body;if(!await webauthnService.renameCredential(credentialId,userId,body.nickname,getSchema(ctx)))return ctx.set.status=404,{success:!1,message:"Credential not found"};return{success:!0,message:"Credential renamed"}}});return collectRoutes([{prefix:basePath,routes:[routePostRegisterOptions,routePostRegisterVerify,routePostAuthenticateOptions,routePostAuthenticateVerify,routeGetCredentials,routeDeleteCredentialsCredentialid,routePatchCredentialsCredentialid]}])}var init_webauthn=__esm(()=>{init_DeviceTrust();init_routeCollector();init_fetchUserRolesAndClaims();init_deviceInfo();init_types21();init_types21()});var exports_auth={};__export(exports_auth,{createWebAuthnRoute:()=>createWebAuthnRoute,createSessionsRoute:()=>createSessionsRoute,createRegisterRoute:()=>createRegisterRoute,createRefreshRoute:()=>createRefreshRoute,createPasswordSetRoute:()=>createPasswordSetRoute,createPasswordResetRoute:()=>createPasswordResetRoute,createPasswordChangeRoute:()=>createPasswordChangeRoute,createMeRoute:()=>createMeRoute,createMagicLinkRoute:()=>createMagicLinkRoute,createLogoutRoute:()=>createLogoutRoute,createLoginRoute:()=>createLoginRoute,createInviteRoute:()=>createInviteRoute,createImpersonateRoute:()=>createImpersonateRoute,createHardDeleteUserRoute:()=>createHardDeleteUserRoute,createEmailVerificationRoutes:()=>createEmailVerificationRoutes,createCreateUserRoute:()=>createCreateUserRoute,createChangeUserIdRoute:()=>createChangeUserIdRoute,createAuthRoutes:()=>createAuthRoutes,createApiKeyRoutes:()=>createApiKeyRoutes});function createAuthRoutes(app,config){let{authConfig,features,helpers:helpers3}=config;if(config.oauthAccountsTable)authConfig.oauthAccountsTable=config.oauthAccountsTable;if(config.schemaTables)authConfig.schemaTables=config.schemaTables;if(config.tenantRegistry)authConfig.tenantRegistry=config.tenantRegistry;if(config.getTenantRegistry)authConfig.getTenantRegistry=config.getTenantRegistry;let buffer=authConfig.authentication?.cookieMaxAgeBufferSeconds??0,rawCookieDomain=authConfig.authentication?.cookieDomain,resolvedCookieDomainRaw=rawCookieDomain?process.env[rawCookieDomain]??rawCookieDomain:void 0,resolvedCookieDomain=resolvedCookieDomainRaw==="localhost"||resolvedCookieDomainRaw===".localhost"?void 0:resolvedCookieDomainRaw,isLocalDev=!resolvedCookieDomain,cookieConfig={accessTokenName:authConfig.authentication?.accessToken?.name||"access_token",refreshTokenName:authConfig.authentication?.refreshToken?.name||"refresh_token",sessionTokenName:authConfig.authentication?.sessionToken?.name||"session_token",accessTokenMaxAge:Math.max(0,parseTimeToSeconds2(authConfig.authentication?.accessToken?.expiresIn||"15m")-buffer),refreshTokenMaxAge:parseTimeToSeconds2(authConfig.authentication?.refreshToken?.expiresIn||"7d"),sessionTokenMaxAge:parseTimeToSeconds2(authConfig.authentication?.sessionToken?.expiresIn||"30d"),domain:resolvedCookieDomain,secure:!isLocalDev,httpOnly:!0,sameSite:"lax",path:"/"};if(authConfig.logger.info("[AUTH] Cookie config created",{accessTokenMaxAge:cookieConfig.accessTokenMaxAge,refreshTokenMaxAge:cookieConfig.refreshTokenMaxAge,sessionTokenMaxAge:cookieConfig.sessionTokenMaxAge,accessTokenExpiresIn:authConfig.authentication?.accessToken?.expiresIn,sessionTokenExpiresIn:authConfig.authentication?.sessionToken?.expiresIn}),features.login?.enabled){let loginRoutes=createLoginRoute(authConfig,features.login,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig,config.tokenResponseConfig,config.captchaService??void 0);useRoutes(app,loginRoutes)}if(features.register?.enabled){let registerRoutes=createRegisterRoute(authConfig,features.register,helpers3.sendWelcomeEmail,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,cookieConfig,config.tokenResponseConfig,config.getEmailService,config.appName,helpers3.saveSessionToDb);if(useRoutes(app,registerRoutes),features.register.emailVerification?.enabled){let emailVerificationRoutes=createEmailVerificationRoutes({authConfig,registerConfig:features.register,getEmailService:config.getEmailService,appName:config.appName});useRoutes(app,emailVerificationRoutes)}}if(features.logout?.enabled){let logoutRoutes=createLogoutRoute(authConfig,features.logout,helpers3.destroySession,helpers3.revokeSessionInDb,cookieConfig);useRoutes(app,logoutRoutes)}if(features.refresh?.enabled){let refreshRoutes=createRefreshRoute(authConfig,features.refresh,helpers3.verifyRefreshToken,helpers3.signAccessToken,helpers3.signRefreshToken,config.tokenResponseConfig,buffer,cookieConfig);useRoutes(app,refreshRoutes)}if(features.passwordReset?.enabled&&helpers3.storeResetToken&&helpers3.getResetToken&&helpers3.deleteResetToken){let passwordResetRoutes=createPasswordResetRoute(authConfig,features.passwordReset,helpers3.storeResetToken,helpers3.getResetToken,helpers3.deleteResetToken,helpers3.sendResetEmail);useRoutes(app,passwordResetRoutes)}if(features.passwordChange?.enabled){let passwordChangeRoutes=createPasswordChangeRoute(authConfig,features.passwordChange);useRoutes(app,passwordChangeRoutes)}if(features.passwordSet?.enabled){let passwordSetRoutes=createPasswordSetRoute(authConfig,features.passwordSet,helpers3.getMagicToken,helpers3.deleteMagicToken);useRoutes(app,passwordSetRoutes)}if(features.sessions?.enabled&&config.sessionsTable){let sessionsRoutes=createSessionsRoute(authConfig,features.sessions,config.sessionsTable);useRoutes(app,sessionsRoutes)}if(features.magicLink?.enabled&&helpers3.storeMagicToken&&helpers3.getMagicToken&&helpers3.deleteMagicToken){let magicLinkRoutes=createMagicLinkRoute(authConfig,features.magicLink,config.getEmailService,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.storeMagicToken,helpers3.getMagicToken,helpers3.deleteMagicToken,config.appName,cookieConfig,helpers3.saveSessionToDb);useRoutes(app,magicLinkRoutes)}if(features.me?.enabled){let meRoutes=createMeRoute(authConfig,features.me,config.schemaTables||{},config.schemaRelations||{},config.databaseUrl);useRoutes(app,meRoutes)}if(features.invite?.enabled&&helpers3.storeMagicToken){let inviteRoutes=createInviteRoute(authConfig,features.invite,config.getEmailService,helpers3.storeMagicToken,config.appName,helpers3.getMagicToken);useRoutes(app,inviteRoutes)}if(features.captcha?.enabled&&config.captchaService){let captchaRoutes=createCaptchaRoutes({captchaService:config.captchaService,logger:authConfig.logger,basePath:features.captcha.route||"/auth/captcha"});useRoutes(app,captchaRoutes)}if(features.oauth?.enabled&&features.oauth.providers){let oauthService=new OAuthService(features.oauth,config.oauthStateStore),oauthRoutes=createOAuthRoutes(authConfig,oauthService,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig,config.tokenResponseConfig,config.getEmailService,helpers3.storeMagicToken,config.appName);useRoutes(app,oauthRoutes)}if(features.apiKeys?.enabled&&config.apiKeysTable)authConfig.apiKeysTable=config.apiKeysTable,createApiKeyRoutes(app,authConfig,features.apiKeys);if(features.webauthn?.enabled&&config.webauthnService){let webauthnRoutes=createWebAuthnRoute(authConfig,{basePath:features.webauthn.route||"/auth/webauthn",isPublic:features.webauthn.isPublic,enabled:!0},config.webauthnService,{signAccessToken:helpers3.signAccessToken,signRefreshToken:helpers3.signRefreshToken,createSession:helpers3.createSession,saveSessionToDb:helpers3.saveSessionToDb},cookieConfig);useRoutes(app,webauthnRoutes)}let checkRoutes=createCheckRoute(authConfig,{route:"/auth/check",isPublic:!1,enabled:!0});if(useRoutes(app,checkRoutes),config.admin?.impersonate?.enabled!==!1){let impersonateRoutes=createImpersonateRoute(authConfig,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.verifyRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig);useRoutes(app,impersonateRoutes)}if(config.admin?.changeUserId?.enabled!==!1){let changeUserIdRoutes=createChangeUserIdRoute(authConfig,config.schemaName||"public");useRoutes(app,changeUserIdRoutes)}if(config.admin?.createUser?.enabled!==!1){let createUserRoutes=createCreateUserRoute(authConfig,config.admin?.createUser);useRoutes(app,createUserRoutes)}if(useRoutes(app,createPasswordAdminRoutes(authConfig,{passwordTools:config.admin?.passwordTools?.enabled===!0})),useRoutes(app,createUserStateRoutes(authConfig)),config.admin?.hardDelete?.enabled!==!1){let hardDeleteRoutes=createHardDeleteUserRoute(authConfig);useRoutes(app,hardDeleteRoutes)}return app}var init_auth=__esm(()=>{init_OAuth();init_routeMount();init_utils5();init_changeUserId();init_createUser();init_hardDeleteUser();init_impersonate();init_passwordAdmin();init_userState();init_apiKeys();init_captcha();init_check();init_emailVerification();init_invite();init_login();init_logout();init_magicLink();init_me();init_oauth();init_passwordChange();init_passwordReset();init_passwordSet();init_refresh();init_register();init_sessions();init_webauthn();init_changeUserId();init_createUser();init_hardDeleteUser();init_impersonate();init_apiKeys();init_emailVerification();init_invite();init_login();init_logout();init_magicLink();init_me();init_passwordChange();init_passwordReset();init_passwordSet();init_refresh();init_register();init_sessions();init_webauthn()});var exports_backup={};__export(exports_backup,{createBackupRoutes:()=>createBackupRoutes});function createBackupRoutes(routeConfig){let{db,logger:logger2,schemaTables,schemaName,getTenantRegistry,lock}=routeConfig,config={...DEFAULT_BACKUP_CONFIG,...routeConfig.config},basePath=config.basePath,backupLogsTable=schemaTables.backupLogs||schemaTables.backup_logs,backupService=new BackupService({db,logger:logger2,config,schemaTables,schemaName,backupLogsTable,lock});if(config.schedule.enabled)backupService.startScheduler();let guard4=createGodminGuard2({db,schemaTables,logger:logger2},"backup management"),resolveTargetSchema=(targetSchema)=>{if(!targetSchema||targetSchema===schemaName)return{ok:!0,name:schemaName,tables:schemaTables};let tenantCtx=getTenantRegistry?.()?.getSchemaContext(targetSchema);if(!tenantCtx)return{ok:!1,message:`Schema not found: ${targetSchema}`};return{ok:!0,name:targetSchema,tables:tenantCtx.schemaTables}},declared=[defineRoute({method:"POST",path:basePath,handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let body=ctx.body,target2=resolveTargetSchema(body?.schema);if(!target2.ok)return ctx.set.status=404,{success:!1,message:target2.message};let result=await backupService.createBackup("manual",userId,target2.name,target2.tables);if(result.status==="failed")return ctx.set.status=500,{success:!1,message:result.errorMessage||"Backup failed"};return{success:!0,message:"Backup created successfully",data:{id:result.id,backupName:result.backupName,schemaName:result.schemaName,tableCount:result.tableCount,rowCount:result.rowCount,sizeBytes:result.sizeBytes,status:result.status}}},body:Type.Optional(Type.Object({schema:Type.Optional(Type.String())})),detail:{tags:["Backup"],summary:"Create backup",description:"Create a new database backup. Optionally specify a schema for multi-tenant backups."}}),defineRoute({method:"GET",path:basePath,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};let backups=await backupService.listBackups();return{success:!0,data:{items:backups,totalCount:backups.length}}},detail:{tags:["Backup"],summary:"List backups",description:"List all backup records."}}),defineRoute({method:"GET",path:`${basePath}/:id/download`,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required"};let{id}=ctx.params,filePath=await backupService.getBackupFilePath(id);if(!filePath)return ctx.set.status=404,{success:!1,message:"Backup not found"};try{let{readFile:readFile2}=await import("fs/promises"),content=await readFile2(filePath,"utf-8");return new Response(content,{headers:{"Content-Type":"application/json","Content-Disposition":`attachment; filename="${id}.json"`}})}catch{return ctx.set.status=404,{success:!1,message:"Backup file not found on disk"}}},detail:{tags:["Backup"],summary:"Download backup",description:"Download a backup file by ID."}}),defineRoute({method:"POST",path:`${basePath}/:id/restore`,handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!config.allowRestore)return ctx.set.status=403,{success:!1,message:"Restore is disabled in configuration"};let{id}=ctx.params,restoreBody=ctx.body,target2=resolveTargetSchema(restoreBody?.schema);if(!target2.ok)return ctx.set.status=404,{success:!1,message:target2.message};let result=await backupService.restoreFromBackup(id,userId,target2.name,target2.tables);if(!result.success)return ctx.set.status=400,result;return await logger2.audit({entityName:"backup_logs",entityId:id,operation:"RESTORE",userId,summary:`Database restored from backup ${id}`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),result},detail:{tags:["Backup"],summary:"Restore from backup",description:"Restore database from a specific backup. Creates a pre-restore backup automatically."}}),defineRoute({method:"DELETE",path:`${basePath}/:id`,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required"};let{id}=ctx.params;if(!await backupService.deleteBackup(id))return ctx.set.status=404,{success:!1,message:"Backup not found"};return{success:!0,message:"Backup deleted"}},detail:{tags:["Backup"],summary:"Delete backup",description:"Delete a specific backup and its file."}})];return{routes:collectRoutes([{guards:[guard4],routes:declared}]),backupService}}var DEFAULT_BACKUP_CONFIG;var init_backup=__esm(()=>{init_esm3();init_Backup();init_routeCollector();init_adminGuard();DEFAULT_BACKUP_CONFIG={enabled:!1,basePath:"/admin/backup",storagePath:"./backups",format:"json",maxBackups:50,allowRestore:!0,excludeTables:["audit_logs","backup_logs"],schedule:{enabled:!1,cron:"0 2 * * *",retentionDays:30}}});var validateAmount=(v,field="amount",opts={})=>{if(typeof v!=="number"||!Number.isFinite(v))return{ok:!1,error:`${field} must be a finite number`};if(opts.allowZero?v<0:v<=0)return{ok:!1,error:`${field} must be ${opts.allowZero?">= 0":"> 0"}`};return{ok:!0,value:v}},isValidCurrency=(v)=>v===void 0||v===null||typeof v==="string"&&/^[A-Za-z]{3}$/.test(v);import{eq as eq64}from"drizzle-orm";var col15=(table,name2)=>table[name2],str4=(v)=>typeof v==="string"?v:null,num3=(v)=>typeof v==="number"?v:null,handleChargeRefunded=async(deps,obj)=>{let candidates=[str4(obj.id),str4(obj.payment_intent)].filter((v)=>v!==null);for(let candidate of candidates){let updated=await deps.db.update(deps.transactionsTable).set({status:"refunded",refundedAmount:num3(obj.amount_refunded)??void 0,refundedAt:new Date,statusMessage:"Refunded via Stripe webhook",updatedAt:new Date}).where(eq64(col15(deps.transactionsTable,"providerPaymentId"),candidate)).returning();if(Array.isArray(updated)&&updated.length>0)return}},handleDisputeCreated=async(deps,obj)=>{let payoutService=deps.getPayoutService?.();if(!payoutService)return;let metadata=obj.metadata??{};await payoutService.openDispute({provider:"stripe",providerDisputeId:str4(obj.id)??void 0,ownerType:str4(metadata.ownerType)==="seller"?"seller":void 0,ownerId:str4(metadata.ownerId)??void 0,amount:num3(obj.amount)??void 0,currency:str4(obj.currency)?.toUpperCase(),reason:str4(obj.reason)??void 0})},handleDisputeClosed=async(deps,obj)=>{let payoutService=deps.getPayoutService?.(),providerId=str4(obj.id);if(!payoutService||!providerId)return;await payoutService.reconcileDisputeByProvider(providerId,str4(obj.status)??"")},handlePayoutOutcome=async(deps,obj,outcome,reason)=>{let payoutService=deps.getPayoutService?.(),providerId=str4(obj.id);if(!payoutService||!providerId)return;await payoutService.reconcilePayoutByProvider(providerId,outcome,reason)},dispatch=async(deps,eventType,obj)=>{switch(eventType){case"charge.refunded":await handleChargeRefunded(deps,obj);break;case"charge.dispute.created":await handleDisputeCreated(deps,obj);break;case"charge.dispute.closed":case"charge.dispute.funds_reinstated":await handleDisputeClosed(deps,obj);break;case"payout.paid":await handlePayoutOutcome(deps,obj,"completed");break;case"payout.failed":case"payout.canceled":await handlePayoutOutcome(deps,obj,"failed",str4(obj.failure_message)??eventType);break;case"transfer.reversed":await handlePayoutOutcome(deps,obj,"failed","transfer reversed");break;default:break}},createStripeWebhookRoute=(deps)=>{return defineRoute({method:"POST",path:"/webhook",handler:async(ctx)=>{if(deps.provider.name!=="stripe")return ctx.set.status=501,{received:!1,error:"Webhooks are only supported for the Stripe provider"};if(!deps.webhookSecret)return deps.logger.error("[Payment] Webhook received but STRIPE_WEBHOOK_SECRET is not configured"),ctx.set.status=500,{received:!1,error:"Webhook secret not configured"};let rawBody=await ctx.request.text(),signature=ctx.request.headers.get("stripe-signature")??"",verified=await verifyStripeWebhook(rawBody,signature,deps.webhookSecret);if(!verified.success||!verified.event)return deps.logger.warn("[Payment] Webhook signature verification failed",{error:verified.error}),ctx.set.status=400,{received:!1,error:"Invalid signature"};let event=verified.event,eventId=str4(event.id)??"",eventType=str4(event.type)??"",obj=event.data?.object??{},idempotencyKey=`stripe:${eventId}`,inserted=await deps.db.insert(deps.webhookLogsTable).values({provider:"stripe",eventType,providerPaymentId:str4(obj.payment_intent)??str4(obj.id),rawPayload:event,processed:!1,idempotencyKey,ipAddress:ctx.request.headers.get("x-forwarded-for")??ctx.request.headers.get("x-real-ip")??null}).onConflictDoNothing().returning();if(!Array.isArray(inserted)||inserted.length===0)return{received:!0,duplicate:!0,eventType};try{return await dispatch(deps,eventType,obj),await deps.db.update(deps.webhookLogsTable).set({processed:!0,processingResult:{ok:!0},updatedAt:new Date}).where(eq64(col15(deps.webhookLogsTable,"idempotencyKey"),idempotencyKey)),deps.logger.info("[Payment] Webhook processed",{eventType,eventId}),{received:!0,eventType}}catch(err){let message=err instanceof Error?err.message:String(err);return deps.logger.error("[Payment] Webhook handler failed",{eventType,error:message}),await deps.db.update(deps.webhookLogsTable).set({errorMessage:message,updatedAt:new Date}).where(eq64(col15(deps.webhookLogsTable,"idempotencyKey"),idempotencyKey)).catch(()=>{}),ctx.set.status=500,{received:!1,error:"Handler error"}}}})};var init_webhook=__esm(()=>{init_Payment()});var exports_payment={};__export(exports_payment,{createPaymentRoutes:()=>createPaymentRoutes});import{and as and27,eq as eq65,inArray as inArray19,ne as ne4,or as or5,sql as sql12}from"drizzle-orm";var escapeHtml2=(value2)=>value2.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"),generateRedirectHtml=(url,title)=>{let safeTitle=escapeHtml2(title),safeUrlAttr=escapeHtml2(url),safeUrlJs=JSON.stringify(url).replace(/</g,"\\u003c").replace(/>/g,"\\u003e");return`
+</body></html>`},routeGetApprovePage=defineRoute({method:"GET",path:"/approve-page",detail:{tags:["Authentication"],summary:"Approval page",description:"Standalone HTML page for approving a device (no frontend auth required)"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return new Response("Service unavailable",{status:503});let token=new URL(ctx.request.url).searchParams.get("token");if(!token){let html2=buildApprovalPageHtml({},"approve","","invalid");return new Response(html2,{status:400,headers:{"Content-Type":"text/html; charset=utf-8"}})}let sessions=await db.select().from(sessionsTable2).where(eq62(col15("approvalToken"),token)).limit(1);if(sessions.length===0){let html2=buildApprovalPageHtml({},"approve",token,"invalid");return new Response(html2,{status:404,headers:{"Content-Type":"text/html; charset=utf-8"}})}let session=sessions[0];if(session.approvalStatus!=="pending"&&session.approval_status!=="pending"){let html2=buildApprovalPageHtml(session,"approve",token,"already_processed");return new Response(html2,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}let requestedAt=session.approvalRequestedAt||session.approval_requested_at;if(requestedAt&&Date.now()-new Date(requestedAt).getTime()>APPROVAL_TOKEN_TTL_MS){let html2=buildApprovalPageHtml(session,"approve",token,"expired");return new Response(html2,{status:410,headers:{"Content-Type":"text/html; charset=utf-8"}})}let html=buildApprovalPageHtml(session,"approve",token,"pending");return new Response(html,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}}),routeGetRejectPage=defineRoute({method:"GET",path:"/reject-page",detail:{tags:["Authentication"],summary:"Rejection page",description:"Standalone HTML page for rejecting a device (no frontend auth required)"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return new Response("Service unavailable",{status:503});let token=new URL(ctx.request.url).searchParams.get("token");if(!token){let html2=buildApprovalPageHtml({},"reject","","invalid");return new Response(html2,{status:400,headers:{"Content-Type":"text/html; charset=utf-8"}})}let sessions=await db.select().from(sessionsTable2).where(eq62(col15("approvalToken"),token)).limit(1);if(sessions.length===0){let html2=buildApprovalPageHtml({},"reject",token,"invalid");return new Response(html2,{status:404,headers:{"Content-Type":"text/html; charset=utf-8"}})}let session=sessions[0];if(session.approvalStatus!=="pending"&&session.approval_status!=="pending"){let html2=buildApprovalPageHtml(session,"reject",token,"already_processed");return new Response(html2,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}let requestedAt=session.approvalRequestedAt||session.approval_requested_at;if(requestedAt&&Date.now()-new Date(requestedAt).getTime()>APPROVAL_TOKEN_TTL_MS){let html2=buildApprovalPageHtml(session,"reject",token,"expired");return new Response(html2,{status:410,headers:{"Content-Type":"text/html; charset=utf-8"}})}let html=buildApprovalPageHtml(session,"reject",token,"pending");return new Response(html,{status:200,headers:{"Content-Type":"text/html; charset=utf-8"}})}}),routeGetApprovalStatus=defineRoute({method:"GET",path:"/approval-status",detail:{tags:["Authentication"],summary:"Check approval status",description:"Check the approval status of a pending session"},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let sessionId=new URL(ctx.request.url).searchParams.get("sessionId");if(!sessionId)return ctx.set.status=400,{success:!1,message:"sessionId is required"};let sessions=await db.select().from(sessionsTable2).where(eq62(col15("id"),sessionId)).limit(1);if(sessions.length===0)return ctx.set.status=404,{success:!1,message:"Session not found"};let session=sessions[0];return{success:!0,data:{approvalStatus:session.approvalStatus||session.approval_status||"unknown",isActive:session.isActive||session.is_active}}}}),routeGetDevices=defineRoute({method:"GET",path:"/devices",detail:{tags:["Authentication"],summary:"List remembered devices",description:"List the caller's remembered (device-trust) devices; never returns the token."},handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let dtTable=getSessionsForRequest(ctx.request).trustedDevicesTable;if(!dtTable||!db)return{success:!0,data:{items:[]}};let{listUserDevices:listUserDevices2}=await Promise.resolve().then(() => (init_store3(),exports_store));return{success:!0,data:{items:await listUserDevices2(db,dtTable,userId)}}}}),routeDeleteDevicesId=defineRoute({method:"DELETE",path:"/devices/:id",detail:{tags:["Authentication"],summary:"Revoke a remembered device",description:"Owner-scoped revoke of one remembered device (untrusts it)."},handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let id=ctx.params.id,dtTable=getSessionsForRequest(ctx.request).trustedDevicesTable;if(!dtTable||!db)return ctx.set.status=503,{success:!1,message:"Device trust not enabled"};let{revokeDeviceById:revokeDeviceById2}=await Promise.resolve().then(() => (init_store3(),exports_store));if(await revokeDeviceById2(db,dtTable,id,userId,"user_revoked")===0)return ctx.set.status=404,{success:!1,message:"Device not found"};return log3.info("Remembered device revoked",{userId,deviceId:id}),{success:!0,message:"Device revoked"}}}),adminGuard=createGodminGuard2({logger:logger2,db,schemaTables:config.schemaTables??{},area:"session management",allowedRoles:sessionsConfig.adminRoles??[]}),routeGetAdminUserid=defineRoute({method:"GET",path:"/admin/:userId",guards:[adminGuard],detail:{tags:["Authentication"],summary:"List another user's active sessions (admin)",description:"Godmin or a role named in authentication.sessions.adminRoles. Used for offboarding and lost-device response."},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let{userId}=ctx.params,sessions=await db.select().from(sessionsTable2).where(and26(eq62(col15("userId"),userId),eq62(col15("isActive"),!0),isNull5(col15("revokedAt")))).orderBy(desc6(col15("lastActivityAt")));return{success:!0,data:{sessions:sessions.map((session)=>formatSessionForResponse(session)),totalCount:sessions.length}}}}),routeDeleteAdminUserid=defineRoute({method:"DELETE",path:"/admin/:userId",guards:[adminGuard],body:AdminRevokeSessionsBodySchema,detail:{tags:["Authentication"],summary:"End another user's sessions (admin)",description:"Ends every active session of the given user, or just one when `sessionId` is supplied. Godmin or authentication.sessions.adminRoles."},handler:async(ctx)=>{let{sessionsTable:sessionsTable2,col:col15}=getSessionsForRequest(ctx.request);if(!db)return ctx.set.status=500,{success:!1,message:"Database not configured"};let{userId}=ctx.params,body=ctx.body??{},actorId=ctx.request.headers.get("x-user-id")||void 0,target2=body.sessionId?and26(eq62(col15("id"),body.sessionId),eq62(col15("userId"),userId),eq62(col15("isActive"),!0)):and26(eq62(col15("userId"),userId),eq62(col15("isActive"),!0)),affected=await db.update(sessionsTable2).set({isActive:!1,revokedAt:new Date,revokedReason:body.reason||"admin_revoked"}).where(target2).returning({id:col15("id")});log3.warn("Sessions revoked by an administrator",{actorId,subjectUserId:userId,sessionId:body.sessionId,revoked:affected.length,reason:body.reason||"admin_revoked"});let reqUrl=new URL(ctx.request.url);return logger2.audit({entityName:"user_sessions",entityId:body.sessionId,operation:"SESSION_REVOKE_ALL",userId:actorId,summary:body.sessionId?`Admin revoked one session of user ${userId}`:`Admin revoked ${affected.length} session(s) of user ${userId}`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search}),{success:!0,message:`${affected.length} session${affected.length===1?"":"s"} ended`,data:{revoked:affected.length}}}});return collectRoutes([{prefix:baseRoute,routes:[routeGetRoot,routeGetCurrent,routeDeleteSessionid,routeDeleteAll,routeGetStats,routePostApprove,routePostReject,routeGetPending,routeGetApprovePage,routeGetRejectPage,routeGetApprovalStatus,routeGetDevices,routeDeleteDevicesId,routeGetAdminUserid,routeDeleteAdminUserid]}])}var init_sessions=__esm(()=>{init_scopes();init_routeCollector();init_godminGuard();init_types20();init_utils11();init_types20()});function resolveCookies(cookieConfig){return{accessTokenName:cookieConfig?.accessTokenName||"access_token",refreshTokenName:cookieConfig?.refreshTokenName||"refresh_token",sessionTokenName:cookieConfig?.sessionTokenName||"session_token",accessTokenMaxAge:cookieConfig?.accessTokenMaxAge||900,refreshTokenMaxAge:cookieConfig?.refreshTokenMaxAge||604800,sessionTokenMaxAge:cookieConfig?.sessionTokenMaxAge||2592000,secure:cookieConfig?.secure??!0,httpOnly:cookieConfig?.httpOnly??!0,sameSite:cookieConfig?.sameSite||"lax",path:cookieConfig?.path||"/",domain:cookieConfig?.domain}}function buildCookieHeaders(cookies,tokens){let securePart=cookies.secure?"; Secure":"",domainPart=cookies.domain?`; Domain=${cookies.domain}`:"",cookieOptions=`; Path=${cookies.path}; HttpOnly; SameSite=${cookies.sameSite}${securePart}${domainPart}`,headers=new Headers;return headers.set("Content-Type","application/json"),headers.set("x-session-id",tokens.sessionId),headers.append("Set-Cookie",`${cookies.accessTokenName}=${tokens.accessToken}${cookieOptions}; Max-Age=${cookies.accessTokenMaxAge}`),headers.append("Set-Cookie",`${cookies.refreshTokenName}=${tokens.refreshToken}${cookieOptions}; Max-Age=${cookies.refreshTokenMaxAge}`),headers.append("Set-Cookie",`${cookies.sessionTokenName}=${tokens.sessionId}${cookieOptions}; Max-Age=${cookies.sessionTokenMaxAge}`),headers}var WebAuthnRegisterOptionsSchema,WebAuthnRegisterVerifySchema,WebAuthnAuthOptionsSchema,WebAuthnAuthVerifySchema,WebAuthnRenameSchema;var init_types21=__esm(()=>{init_esm3();WebAuthnRegisterOptionsSchema=Type.Object({nickname:Type.Optional(Type.String({maxLength:128}))}),WebAuthnRegisterVerifySchema=Type.Object({response:Type.Any(),challenge:Type.String(),nickname:Type.Optional(Type.String({maxLength:128}))}),WebAuthnAuthOptionsSchema=Type.Object({email:Type.Optional(Type.String({format:"email"}))}),WebAuthnAuthVerifySchema=Type.Object({response:Type.Any(),challenge:Type.String(),rememberMe:Type.Optional(Type.Boolean())}),WebAuthnRenameSchema=Type.Object({nickname:Type.String({minLength:1,maxLength:128})})});import{eq as eq63}from"drizzle-orm";function getSchema(ctx){return ctx.request.headers.get("x-tenant-schema")||void 0}function getUserId2(ctx){return ctx.request.headers.get("x-user-id")}function createWebAuthnRoute(config,routeOptions,webauthnService,helpers3,cookieConfig){let{db,logger:logger2}=config,basePath=routeOptions.basePath||"/auth/webauthn",cookies=resolveCookies(cookieConfig);if(!routeOptions.enabled)return collectRoutes();let routePostRegisterOptions=defineRoute({method:"POST",path:"/register/options",body:WebAuthnRegisterOptionsSchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let user=(await db.select().from(usersTable).where(eq63(usersTable.id,userId)).limit(1))[0];if(!user)return ctx.set.status=404,{success:!1,message:"User not found"};return{success:!0,data:await webauthnService.createRegistrationOptions({userId,userName:user.email||userId,userDisplayName:user.email||userId,schemaName:getSchema(ctx)})}}}),routePostRegisterVerify=defineRoute({method:"POST",path:"/register/verify",body:WebAuthnRegisterVerifySchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let body=ctx.body,credential=await webauthnService.verifyRegistration({response:body.response,expectedChallenge:body.challenge,userId,nickname:body.nickname,schemaName:getSchema(ctx)});if(!credential)return logger2.warn("[WEBAUTHN] Registration verification failed",{userId}),ctx.set.status=400,{success:!1,message:"Registration failed"};return{success:!0,data:{id:credential.id,credentialId:credential.credentialId,nickname:credential.nickname,deviceType:credential.deviceType,backedUp:credential.backedUp,authenticatorAttachment:credential.authenticatorAttachment,aaguid:credential.aaguid,transports:credential.transports,lastUsedAt:credential.lastUsedAt,revokedAt:credential.revokedAt,createdAt:credential.createdAt}}}}),routePostAuthenticateOptions=defineRoute({method:"POST",path:"/authenticate/options",body:WebAuthnAuthOptionsSchema,handler:async(ctx)=>{let body=ctx.body,resolvedUserId;if(body.email){let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(db&&usersTable){let user=(await db.select().from(usersTable).where(eq63(usersTable.email,body.email.toLowerCase())).limit(1))[0];if(user)resolvedUserId=user.id}}return{success:!0,data:await webauthnService.createAuthenticationOptions({userId:resolvedUserId,schemaName:getSchema(ctx)})}}}),routePostAuthenticateVerify=defineRoute({method:"POST",path:"/authenticate/verify",body:WebAuthnAuthVerifySchema,handler:async(ctx)=>{let body=ctx.body,result=await webauthnService.verifyAuthentication({response:body.response,expectedChallenge:body.challenge,schemaName:getSchema(ctx)});if(!result.verified||!result.userId)return ctx.set.status=401,{success:!1,message:"Authentication failed"};let{usersTable}=resolveAuthTablesForRequest(ctx.request,config);if(!db||!usersTable)return ctx.set.status=500,{success:!1,message:"Database not configured"};let user=(await db.select().from(usersTable).where(eq63(usersTable.id,result.userId)).limit(1))[0];if(!user)return ctx.set.status=401,{success:!1,message:"User not found"};let webauthnState=evaluateAccountState(user);if(!webauthnState.allowed)return ctx.set.status=401,{success:!1,message:webauthnState.message};let roles=[],claims=[],claimScopes={};try{let resolved=resolveAuthTablesForRequest(ctx.request,config),rc=await fetchUserRolesAndClaims(db,result.userId,resolved);roles=rc.roles,claims=rc.claims,claimScopes=rc.claimScopes}catch{}let ipAddress=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent=ctx.request.headers.get("user-agent")||"",sessionParams={userId:result.userId,deviceInfo:ensureDeviceInfo({ipAddress,userAgent},deviceContextFromRequest(ctx.request).clientHints),loginMethod:"webauthn",rememberMe:body.rememberMe??!1},sessionId=await helpers3.createSession(sessionParams),accessToken=helpers3.signAccessToken(result.userId,roles.length>0?roles:void 0,claims.length>0?claims:void 0,getSchema(ctx),claimScopes,sessionId),refreshToken=helpers3.signRefreshToken(result.userId,body.rememberMe??!1,sessionId),deviceTokenCookie;if(helpers3.saveSessionToDb){let dtCfg=config.authentication?.deviceTrust;if(dtCfg?.enabled)sessionParams.deviceToken=readDeviceTokenFromCookieHeader(ctx.request.headers.get("cookie"),dtCfg);let saveResult=await helpers3.saveSessionToDb(sessionId,sessionParams,getSchema(ctx));if(saveResult?.denied)return ctx.set.status=403,{success:!1,message:"This device could not be recognized. Please contact support."};if(deviceTokenCookie=saveResult?.deviceTokenCookie,saveResult?.requiresApproval){if(deviceTokenCookie)ctx.set.headers["Set-Cookie"]=deviceTokenCookie;return ctx.set.status=202,{success:!1,requiresApproval:!0,sessionId:saveResult.sessionId??sessionId,message:"Login requires approval"}}}let headers=buildCookieHeaders(cookies,{accessToken,refreshToken,sessionId});if(deviceTokenCookie)headers.append("Set-Cookie",deviceTokenCookie);return logger2.info("[WEBAUTHN] Authentication successful",{userId:result.userId,credentialId:result.credentialId}),new Response(JSON.stringify({success:!0,data:{user:{id:user.id,email:user.email},accessToken,refreshToken,sessionId}}),{status:200,headers})}}),routeGetCredentials=defineRoute({method:"GET",path:"/credentials",handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};return{success:!0,data:{credentials:(await webauthnService.listUserCredentials(userId,getSchema(ctx))).map((cred)=>({id:cred.id,credentialId:cred.credentialId,nickname:cred.nickname,deviceType:cred.deviceType,backedUp:cred.backedUp,authenticatorAttachment:cred.authenticatorAttachment,transports:cred.transports,aaguid:cred.aaguid,lastUsedAt:cred.lastUsedAt,revokedAt:cred.revokedAt,createdAt:cred.createdAt}))}}}}),routeDeleteCredentialsCredentialid=defineRoute({method:"DELETE",path:"/credentials/:credentialId",handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{credentialId}=ctx.params;if(!await webauthnService.revokeCredential(credentialId,userId,getSchema(ctx)))return ctx.set.status=404,{success:!1,message:"Credential not found"};return{success:!0,message:"Credential revoked"}}}),routePatchCredentialsCredentialid=defineRoute({method:"PATCH",path:"/credentials/:credentialId",body:WebAuthnRenameSchema,handler:async(ctx)=>{let userId=getUserId2(ctx);if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let{credentialId}=ctx.params,body=ctx.body;if(!await webauthnService.renameCredential(credentialId,userId,body.nickname,getSchema(ctx)))return ctx.set.status=404,{success:!1,message:"Credential not found"};return{success:!0,message:"Credential renamed"}}});return collectRoutes([{prefix:basePath,routes:[routePostRegisterOptions,routePostRegisterVerify,routePostAuthenticateOptions,routePostAuthenticateVerify,routeGetCredentials,routeDeleteCredentialsCredentialid,routePatchCredentialsCredentialid]}])}var init_webauthn=__esm(()=>{init_DeviceTrust();init_routeCollector();init_fetchUserRolesAndClaims();init_deviceInfo();init_types21();init_types21()});var exports_auth={};__export(exports_auth,{createWebAuthnRoute:()=>createWebAuthnRoute,createSessionsRoute:()=>createSessionsRoute,createRegisterRoute:()=>createRegisterRoute,createRefreshRoute:()=>createRefreshRoute,createPasswordSetRoute:()=>createPasswordSetRoute,createPasswordResetRoute:()=>createPasswordResetRoute,createPasswordChangeRoute:()=>createPasswordChangeRoute,createMeRoute:()=>createMeRoute,createMagicLinkRoute:()=>createMagicLinkRoute,createLogoutRoute:()=>createLogoutRoute,createLoginRoute:()=>createLoginRoute,createInviteRoute:()=>createInviteRoute,createImpersonateRoute:()=>createImpersonateRoute,createHardDeleteUserRoute:()=>createHardDeleteUserRoute,createEmailVerificationRoutes:()=>createEmailVerificationRoutes,createCreateUserRoute:()=>createCreateUserRoute,createChangeUserIdRoute:()=>createChangeUserIdRoute,createAuthRoutes:()=>createAuthRoutes,createApiKeyRoutes:()=>createApiKeyRoutes});function createAuthRoutes(app,config){let{authConfig,features,helpers:helpers3}=config;if(config.oauthAccountsTable)authConfig.oauthAccountsTable=config.oauthAccountsTable;if(config.schemaTables)authConfig.schemaTables=config.schemaTables;if(config.tenantRegistry)authConfig.tenantRegistry=config.tenantRegistry;if(config.getTenantRegistry)authConfig.getTenantRegistry=config.getTenantRegistry;let buffer=authConfig.authentication?.cookieMaxAgeBufferSeconds??0,rawCookieDomain=authConfig.authentication?.cookieDomain,resolvedCookieDomainRaw=rawCookieDomain?process.env[rawCookieDomain]??rawCookieDomain:void 0,resolvedCookieDomain=resolvedCookieDomainRaw==="localhost"||resolvedCookieDomainRaw===".localhost"?void 0:resolvedCookieDomainRaw,isLocalDev=!resolvedCookieDomain,cookieConfig={accessTokenName:authConfig.authentication?.accessToken?.name||"access_token",refreshTokenName:authConfig.authentication?.refreshToken?.name||"refresh_token",sessionTokenName:authConfig.authentication?.sessionToken?.name||"session_token",accessTokenMaxAge:Math.max(0,parseTimeToSeconds2(authConfig.authentication?.accessToken?.expiresIn||"15m")-buffer),refreshTokenMaxAge:parseTimeToSeconds2(authConfig.authentication?.refreshToken?.expiresIn||"7d"),sessionTokenMaxAge:parseTimeToSeconds2(authConfig.authentication?.sessionToken?.expiresIn||"30d"),domain:resolvedCookieDomain,secure:!isLocalDev,httpOnly:!0,sameSite:"lax",path:"/"};if(authConfig.logger.info("[AUTH] Cookie config created",{accessTokenMaxAge:cookieConfig.accessTokenMaxAge,refreshTokenMaxAge:cookieConfig.refreshTokenMaxAge,sessionTokenMaxAge:cookieConfig.sessionTokenMaxAge,accessTokenExpiresIn:authConfig.authentication?.accessToken?.expiresIn,sessionTokenExpiresIn:authConfig.authentication?.sessionToken?.expiresIn}),features.login?.enabled){let loginRoutes=createLoginRoute(authConfig,features.login,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig,config.tokenResponseConfig,config.captchaService??void 0);useRoutes(app,loginRoutes)}if(features.register?.enabled){let registerRoutes=createRegisterRoute(authConfig,features.register,helpers3.sendWelcomeEmail,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,cookieConfig,config.tokenResponseConfig,config.getEmailService,config.appName,helpers3.saveSessionToDb);if(useRoutes(app,registerRoutes),features.register.emailVerification?.enabled){let emailVerificationRoutes=createEmailVerificationRoutes({authConfig,registerConfig:features.register,getEmailService:config.getEmailService,appName:config.appName});useRoutes(app,emailVerificationRoutes)}}if(features.logout?.enabled){let logoutRoutes=createLogoutRoute(authConfig,features.logout,helpers3.destroySession,helpers3.revokeSessionInDb,cookieConfig);useRoutes(app,logoutRoutes)}if(features.refresh?.enabled){let refreshRoutes=createRefreshRoute(authConfig,features.refresh,helpers3.verifyRefreshToken,helpers3.signAccessToken,helpers3.signRefreshToken,config.tokenResponseConfig,buffer,cookieConfig);useRoutes(app,refreshRoutes)}if(features.passwordReset?.enabled&&helpers3.storeResetToken&&helpers3.getResetToken&&helpers3.deleteResetToken){let passwordResetRoutes=createPasswordResetRoute(authConfig,features.passwordReset,helpers3.storeResetToken,helpers3.getResetToken,helpers3.deleteResetToken,helpers3.sendResetEmail);useRoutes(app,passwordResetRoutes)}if(features.passwordChange?.enabled){let passwordChangeRoutes=createPasswordChangeRoute(authConfig,features.passwordChange);useRoutes(app,passwordChangeRoutes)}if(features.passwordSet?.enabled){let passwordSetRoutes=createPasswordSetRoute(authConfig,features.passwordSet,helpers3.getMagicToken,helpers3.deleteMagicToken);useRoutes(app,passwordSetRoutes)}if(features.sessions?.enabled&&config.sessionsTable){let sessionsRoutes=createSessionsRoute(authConfig,features.sessions,config.sessionsTable);useRoutes(app,sessionsRoutes)}if(features.magicLink?.enabled&&helpers3.storeMagicToken&&helpers3.getMagicToken&&helpers3.deleteMagicToken){let magicLinkRoutes=createMagicLinkRoute(authConfig,features.magicLink,config.getEmailService,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.storeMagicToken,helpers3.getMagicToken,helpers3.deleteMagicToken,config.appName,cookieConfig,helpers3.saveSessionToDb);useRoutes(app,magicLinkRoutes)}if(features.me?.enabled){let meRoutes=createMeRoute(authConfig,features.me,config.schemaTables||{},config.schemaRelations||{},config.databaseUrl);useRoutes(app,meRoutes)}if(features.invite?.enabled&&helpers3.storeMagicToken){let inviteRoutes=createInviteRoute(authConfig,features.invite,config.getEmailService,helpers3.storeMagicToken,config.appName,helpers3.getMagicToken);useRoutes(app,inviteRoutes)}if(features.captcha?.enabled&&config.captchaService){let captchaRoutes=createCaptchaRoutes({captchaService:config.captchaService,logger:authConfig.logger,basePath:features.captcha.route||"/auth/captcha"});useRoutes(app,captchaRoutes)}if(features.oauth?.enabled&&features.oauth.providers){let oauthService=new OAuthService(features.oauth,config.oauthStateStore),oauthRoutes=createOAuthRoutes(authConfig,oauthService,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig,config.tokenResponseConfig,config.getEmailService,helpers3.storeMagicToken,config.appName);useRoutes(app,oauthRoutes)}if(features.apiKeys?.enabled&&config.apiKeysTable)authConfig.apiKeysTable=config.apiKeysTable,createApiKeyRoutes(app,authConfig,features.apiKeys);if(features.webauthn?.enabled&&config.webauthnService){let webauthnRoutes=createWebAuthnRoute(authConfig,{basePath:features.webauthn.route||"/auth/webauthn",isPublic:features.webauthn.isPublic,enabled:!0},config.webauthnService,{signAccessToken:helpers3.signAccessToken,signRefreshToken:helpers3.signRefreshToken,createSession:helpers3.createSession,saveSessionToDb:helpers3.saveSessionToDb},cookieConfig);useRoutes(app,webauthnRoutes)}let checkRoutes=createCheckRoute(authConfig,{route:"/auth/check",isPublic:!1,enabled:!0});if(useRoutes(app,checkRoutes),config.admin?.impersonate?.enabled!==!1){let impersonateRoutes=createImpersonateRoute(authConfig,helpers3.signAccessToken,helpers3.signRefreshToken,helpers3.verifyRefreshToken,helpers3.createSession,helpers3.saveSessionToDb,cookieConfig);useRoutes(app,impersonateRoutes)}if(config.admin?.changeUserId?.enabled!==!1){let changeUserIdRoutes=createChangeUserIdRoute(authConfig,config.schemaName||"public");useRoutes(app,changeUserIdRoutes)}if(config.admin?.createUser?.enabled!==!1){let createUserRoutes=createCreateUserRoute(authConfig,config.admin?.createUser);useRoutes(app,createUserRoutes)}if(useRoutes(app,createPasswordAdminRoutes(authConfig,{passwordTools:config.admin?.passwordTools?.enabled===!0})),useRoutes(app,createUserStateRoutes(authConfig)),config.admin?.hardDelete?.enabled!==!1){let hardDeleteRoutes=createHardDeleteUserRoute(authConfig);useRoutes(app,hardDeleteRoutes)}return app}var init_auth=__esm(()=>{init_OAuth();init_routeMount();init_utils5();init_changeUserId();init_createUser();init_hardDeleteUser();init_impersonate();init_passwordAdmin();init_userState();init_apiKeys();init_captcha();init_check();init_emailVerification();init_invite();init_login();init_logout();init_magicLink();init_me();init_oauth();init_passwordChange();init_passwordReset();init_passwordSet();init_refresh();init_register();init_sessions();init_webauthn();init_changeUserId();init_createUser();init_hardDeleteUser();init_impersonate();init_apiKeys();init_emailVerification();init_invite();init_login();init_logout();init_magicLink();init_me();init_passwordChange();init_passwordReset();init_passwordSet();init_refresh();init_register();init_sessions();init_webauthn()});var exports_backup={};__export(exports_backup,{createBackupRoutes:()=>createBackupRoutes});function createBackupRoutes(routeConfig){let{db,logger:logger2,schemaTables,schemaName,getTenantRegistry,lock}=routeConfig,config={...DEFAULT_BACKUP_CONFIG,...routeConfig.config},basePath=config.basePath,backupLogsTable=schemaTables.backupLogs||schemaTables.backup_logs,backupService=new BackupService({db,logger:logger2,config,schemaTables,schemaName,backupLogsTable,lock});if(config.schedule.enabled)backupService.startScheduler();let guard4=createGodminGuard({db,schemaTables,logger:logger2},"backup management"),resolveTargetSchema=(targetSchema)=>{if(!targetSchema||targetSchema===schemaName)return{ok:!0,name:schemaName,tables:schemaTables};let tenantCtx=getTenantRegistry?.()?.getSchemaContext(targetSchema);if(!tenantCtx)return{ok:!1,message:`Schema not found: ${targetSchema}`};return{ok:!0,name:targetSchema,tables:tenantCtx.schemaTables}},declared=[defineRoute({method:"POST",path:basePath,handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let body=ctx.body,target2=resolveTargetSchema(body?.schema);if(!target2.ok)return ctx.set.status=404,{success:!1,message:target2.message};let result=await backupService.createBackup("manual",userId,target2.name,target2.tables);if(result.status==="failed")return ctx.set.status=500,{success:!1,message:result.errorMessage||"Backup failed"};return{success:!0,message:"Backup created successfully",data:{id:result.id,backupName:result.backupName,schemaName:result.schemaName,tableCount:result.tableCount,rowCount:result.rowCount,sizeBytes:result.sizeBytes,status:result.status}}},body:Type.Optional(Type.Object({schema:Type.Optional(Type.String())})),detail:{tags:["Backup"],summary:"Create backup",description:"Create a new database backup. Optionally specify a schema for multi-tenant backups."}}),defineRoute({method:"GET",path:basePath,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};let backups=await backupService.listBackups();return{success:!0,data:{items:backups,totalCount:backups.length}}},detail:{tags:["Backup"],summary:"List backups",description:"List all backup records."}}),defineRoute({method:"GET",path:`${basePath}/:id/download`,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required"};let{id}=ctx.params,filePath=await backupService.getBackupFilePath(id);if(!filePath)return ctx.set.status=404,{success:!1,message:"Backup not found"};try{let{readFile:readFile2}=await import("fs/promises"),content=await readFile2(filePath,"utf-8");return new Response(content,{headers:{"Content-Type":"application/json","Content-Disposition":`attachment; filename="${id}.json"`}})}catch{return ctx.set.status=404,{success:!1,message:"Backup file not found on disk"}}},detail:{tags:["Backup"],summary:"Download backup",description:"Download a backup file by ID."}}),defineRoute({method:"POST",path:`${basePath}/:id/restore`,handler:async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!config.allowRestore)return ctx.set.status=403,{success:!1,message:"Restore is disabled in configuration"};let{id}=ctx.params,restoreBody=ctx.body,target2=resolveTargetSchema(restoreBody?.schema);if(!target2.ok)return ctx.set.status=404,{success:!1,message:target2.message};let result=await backupService.restoreFromBackup(id,userId,target2.name,target2.tables);if(!result.success)return ctx.set.status=400,result;return await logger2.audit({entityName:"backup_logs",entityId:id,operation:"RESTORE",userId,summary:`Database restored from backup ${id}`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),result},detail:{tags:["Backup"],summary:"Restore from backup",description:"Restore database from a specific backup. Creates a pre-restore backup automatically."}}),defineRoute({method:"DELETE",path:`${basePath}/:id`,handler:async(ctx)=>{if(!ctx.request.headers.get("x-user-id"))return ctx.set.status=401,{success:!1,message:"Authentication required"};let{id}=ctx.params;if(!await backupService.deleteBackup(id))return ctx.set.status=404,{success:!1,message:"Backup not found"};return{success:!0,message:"Backup deleted"}},detail:{tags:["Backup"],summary:"Delete backup",description:"Delete a specific backup and its file."}})];return{routes:collectRoutes([{guards:[guard4],routes:declared}]),backupService}}var DEFAULT_BACKUP_CONFIG;var init_backup=__esm(()=>{init_esm3();init_Backup();init_routeCollector();init_adminGuard();DEFAULT_BACKUP_CONFIG={enabled:!1,basePath:"/admin/backup",storagePath:"./backups",format:"json",maxBackups:50,allowRestore:!0,excludeTables:["audit_logs","backup_logs"],schedule:{enabled:!1,cron:"0 2 * * *",retentionDays:30}}});var validateAmount=(v,field="amount",opts={})=>{if(typeof v!=="number"||!Number.isFinite(v))return{ok:!1,error:`${field} must be a finite number`};if(opts.allowZero?v<0:v<=0)return{ok:!1,error:`${field} must be ${opts.allowZero?">= 0":"> 0"}`};return{ok:!0,value:v}},isValidCurrency=(v)=>v===void 0||v===null||typeof v==="string"&&/^[A-Za-z]{3}$/.test(v);import{eq as eq64}from"drizzle-orm";var col15=(table,name2)=>table[name2],str4=(v)=>typeof v==="string"?v:null,num3=(v)=>typeof v==="number"?v:null,handleChargeRefunded=async(deps,obj)=>{let candidates=[str4(obj.id),str4(obj.payment_intent)].filter((v)=>v!==null);for(let candidate of candidates){let updated=await deps.db.update(deps.transactionsTable).set({status:"refunded",refundedAmount:num3(obj.amount_refunded)??void 0,refundedAt:new Date,statusMessage:"Refunded via Stripe webhook",updatedAt:new Date}).where(eq64(col15(deps.transactionsTable,"providerPaymentId"),candidate)).returning();if(Array.isArray(updated)&&updated.length>0)return}},handleDisputeCreated=async(deps,obj)=>{let payoutService=deps.getPayoutService?.();if(!payoutService)return;let metadata=obj.metadata??{};await payoutService.openDispute({provider:"stripe",providerDisputeId:str4(obj.id)??void 0,ownerType:str4(metadata.ownerType)==="seller"?"seller":void 0,ownerId:str4(metadata.ownerId)??void 0,amount:num3(obj.amount)??void 0,currency:str4(obj.currency)?.toUpperCase(),reason:str4(obj.reason)??void 0})},handleDisputeClosed=async(deps,obj)=>{let payoutService=deps.getPayoutService?.(),providerId=str4(obj.id);if(!payoutService||!providerId)return;await payoutService.reconcileDisputeByProvider(providerId,str4(obj.status)??"")},handlePayoutOutcome=async(deps,obj,outcome,reason)=>{let payoutService=deps.getPayoutService?.(),providerId=str4(obj.id);if(!payoutService||!providerId)return;await payoutService.reconcilePayoutByProvider(providerId,outcome,reason)},dispatch=async(deps,eventType,obj)=>{switch(eventType){case"charge.refunded":await handleChargeRefunded(deps,obj);break;case"charge.dispute.created":await handleDisputeCreated(deps,obj);break;case"charge.dispute.closed":case"charge.dispute.funds_reinstated":await handleDisputeClosed(deps,obj);break;case"payout.paid":await handlePayoutOutcome(deps,obj,"completed");break;case"payout.failed":case"payout.canceled":await handlePayoutOutcome(deps,obj,"failed",str4(obj.failure_message)??eventType);break;case"transfer.reversed":await handlePayoutOutcome(deps,obj,"failed","transfer reversed");break;default:break}},createStripeWebhookRoute=(deps)=>{return defineRoute({method:"POST",path:"/webhook",handler:async(ctx)=>{if(deps.provider.name!=="stripe")return ctx.set.status=501,{received:!1,error:"Webhooks are only supported for the Stripe provider"};if(!deps.webhookSecret)return deps.logger.error("[Payment] Webhook received but STRIPE_WEBHOOK_SECRET is not configured"),ctx.set.status=500,{received:!1,error:"Webhook secret not configured"};let rawBody=await ctx.request.text(),signature=ctx.request.headers.get("stripe-signature")??"",verified=await verifyStripeWebhook(rawBody,signature,deps.webhookSecret);if(!verified.success||!verified.event)return deps.logger.warn("[Payment] Webhook signature verification failed",{error:verified.error}),ctx.set.status=400,{received:!1,error:"Invalid signature"};let event=verified.event,eventId=str4(event.id)??"",eventType=str4(event.type)??"",obj=event.data?.object??{},idempotencyKey=`stripe:${eventId}`,inserted=await deps.db.insert(deps.webhookLogsTable).values({provider:"stripe",eventType,providerPaymentId:str4(obj.payment_intent)??str4(obj.id),rawPayload:event,processed:!1,idempotencyKey,ipAddress:ctx.request.headers.get("x-forwarded-for")??ctx.request.headers.get("x-real-ip")??null}).onConflictDoNothing().returning();if(!Array.isArray(inserted)||inserted.length===0)return{received:!0,duplicate:!0,eventType};try{return await dispatch(deps,eventType,obj),await deps.db.update(deps.webhookLogsTable).set({processed:!0,processingResult:{ok:!0},updatedAt:new Date}).where(eq64(col15(deps.webhookLogsTable,"idempotencyKey"),idempotencyKey)),deps.logger.info("[Payment] Webhook processed",{eventType,eventId}),{received:!0,eventType}}catch(err){let message=err instanceof Error?err.message:String(err);return deps.logger.error("[Payment] Webhook handler failed",{eventType,error:message}),await deps.db.update(deps.webhookLogsTable).set({errorMessage:message,updatedAt:new Date}).where(eq64(col15(deps.webhookLogsTable,"idempotencyKey"),idempotencyKey)).catch(()=>{}),ctx.set.status=500,{received:!1,error:"Handler error"}}}})};var init_webhook=__esm(()=>{init_Payment()});var exports_payment={};__export(exports_payment,{createPaymentRoutes:()=>createPaymentRoutes});import{and as and27,eq as eq65,inArray as inArray19,ne as ne4,or as or5,sql as sql12}from"drizzle-orm";var escapeHtml2=(value2)=>value2.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"),generateRedirectHtml=(url,title)=>{let safeTitle=escapeHtml2(title),safeUrlAttr=escapeHtml2(url),safeUrlJs=JSON.stringify(url).replace(/</g,"\\u003c").replace(/>/g,"\\u003e");return`
 <!DOCTYPE html>
 <html>
 <head>
@@ -541,13 +541,13 @@ ${strMDSAlgs}`)}if(attestationStatementAlg!==void 0&&authenticatorGetInfo?.algor
         and table_name = ${tableName}
         and column_name = 'expires_at'
     `),first=((Array.isArray(current)?current:current?.rows)??[])[0];if(!first)return{action:"already-nullable"};if(first.is_nullable==="YES")return{action:"already-nullable"};return await db.execute(sql14.raw(`ALTER TABLE "${schemaName}"."${tableName}" ALTER COLUMN "expires_at" DROP NOT NULL`)),logger2?.info(`[Schema] "${schemaName}"."${tableName}".expires_at may now be empty \u2014 this install runs sessions that never expire, and a session with no expiry is a row with no expiry.`),{action:"relaxed"}}catch(error3){let reason=error3 instanceof Error?error3.message:String(error3);return logger2?.warn(`[Schema] Could not let "${schemaName}"."${tableName}".expires_at be empty: ${reason}. Sign-in will fail with "Missing required field: expires_at" until this column allows nulls.`),{action:"failed",reason}}}var SAFE_IDENTIFIER;var init_relaxSessionExpiry=__esm(()=>{SAFE_IDENTIFIER=/^[A-Za-z_][A-Za-z0-9_]*$/});function normSegment(input){return input.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_|_$/g,"")}function normPath(path7){return normSegment(path7.replace(/\{[^}]+\}/g,(m)=>m.slice(1,-1)))}function shortHash(input){let h=5381;for(let i=0;i<input.length;i++)h=(h*33^input.charCodeAt(i))>>>0;return h.toString(36)}function capAction(action,max=100){if(action.length<=max)return action;let suffix=`_${shortHash(action)}`;return action.slice(0,Math.max(1,max-suffix.length))+suffix}function resourceFromPath(path7){let segs=path7.split("/").filter(Boolean).filter((s)=>!s.startsWith("{"));for(let s of segs){if(s==="api"||/^v\d+$/i.test(s))continue;return normSegment(s)}return normSegment(segs[0]??"root")}function matchesExclude(path7,patterns3){if(!patterns3?.length)return!1;for(let raw of patterns3){let p=raw.trim();if(!p)continue;if(p.endsWith("/*")){let prefix=p.slice(0,-2);if(path7===prefix||path7.startsWith(`${prefix}/`))return!0}else if(p.endsWith("*")){if(path7.startsWith(p.slice(0,-1)))return!0}else if(path7===p)return!0}return!1}function parseOpenApiToClaims(serviceId,doc,opts={}){let sid=normSegment(serviceId);if(!sid)throw Error("endpointDiscovery: serviceId is empty after normalization");if(RESERVED_SERVICE_IDS.has(sid))throw Error(`endpointDiscovery: serviceId "${serviceId}" collides with an HTTP-method claim prefix; pick another id`);let specs=[],seen=new Set,paths=doc.paths??{};for(let[path7,ops]of Object.entries(paths)){if(!ops||matchesExclude(path7,opts.exclude))continue;for(let method of HTTP_METHODS2){let op=ops[method];if(!op)continue;let tag=(op.tags?.[0]?normSegment(op.tags[0]):"")||resourceFromPath(path7),opToken=(op.operationId?normSegment(op.operationId):"")||`${method}_${normPath(path7)}`,action=capAction(`${sid}.${tag||"root"}.${opToken||method}`);if(seen.has(action)){action=capAction(`${action}_${shortHash(`${method} ${path7}`)}`);while(seen.has(action))action=capAction(`${action}_${shortHash(action)}`)}seen.add(action),specs.push({action,path:path7,method:method.toUpperCase(),description:op.summary||op.description||`${method.toUpperCase()} ${path7}`})}}return specs}function diffClaims(existing,specs){let specByAction=new Map(specs.map((s)=>[s.action,s])),existByAction=new Map(existing.map((e)=>[e.action,e]));return{toInsert:specs.filter((s)=>!existByAction.has(s.action)),toReactivate:specs.filter((s)=>existByAction.get(s.action)?.isActive===!1),toDeactivate:existing.filter((e)=>e.isActive&&!specByAction.has(e.action)),unchanged:specs.filter((s)=>existByAction.get(s.action)?.isActive===!0)}}async function fetchOpenApi(baseUrl,openapiPath,fetchImpl=fetch){let url=`${baseUrl.replace(/\/$/,"")}${openapiPath.startsWith("/")?"":"/"}${openapiPath}`,res=await fetchImpl(url);if(!res.ok)throw Error(`endpointDiscovery: OpenAPI fetch failed ${res.status} for ${url}`);return await res.json()}var HTTP_METHODS2,RESERVED_SERVICE_IDS;var init_EndpointDiscovery=__esm(()=>{HTTP_METHODS2=["get","post","put","patch","delete"],RESERVED_SERVICE_IDS=new Set(["get","post","put","patch","delete","toggle","bulk"])});var exports_seed={};__export(exports_seed,{seedDiscoveredClaims:()=>seedDiscoveredClaims,runEndpointDiscovery:()=>runEndpointDiscovery,getRouteManifest:()=>getRouteManifest,getRoleClaimsManifest:()=>getRoleClaimsManifest});import{eq as eq66,like as like2}from"drizzle-orm";function col16(table,name2){return table[name2]}async function seedDiscoveredClaims(db,claimsTable,serviceId,specs,logger2){let actionCol=col16(claimsTable,"action"),prefix=specs[0]?.action.split(".")[0]??serviceId.toLowerCase(),existing=(await db.select().from(claimsTable).where(like2(actionCol,`${prefix}.%`))).map((r)=>({action:String(r.action),isActive:r.isActive!==!1,path:String(r.path??""),method:String(r.method??""),description:String(r.description??"")})),plan=diffClaims(existing,specs);for(let s of plan.toInsert)await db.insert(claimsTable).values({action:s.action,path:s.path,method:s.method,description:s.description});for(let s of plan.toReactivate)await db.update(claimsTable).set({isActive:!0,path:s.path,method:s.method,description:s.description}).where(eq66(actionCol,s.action));for(let e of plan.toDeactivate)await db.update(claimsTable).set({isActive:!1}).where(eq66(actionCol,e.action));let summary={added:plan.toInsert.length,reactivated:plan.toReactivate.length,deactivated:plan.toDeactivate.length,unchanged:plan.unchanged.length,total:specs.length};return logger2.info(`[Discovery] Reconciled "${serviceId}"`,summary),summary}async function runEndpointDiscovery(db,schemaTables,config,logger2,fetchImpl=fetch){let claimsTable=schemaTables.claims,services=config.services??[],results=[];if(!claimsTable)return logger2.warn("[Discovery] No claims table in schema; skipping endpoint discovery"),{services:[]};for(let svc of services)try{let doc=await fetchOpenApi(svc.baseUrl,svc.openapi??"/openapi.json",fetchImpl),specs=parseOpenApiToClaims(svc.id,doc,{exclude:svc.exclude}),summary=await seedDiscoveredClaims(db,claimsTable,svc.id,specs,logger2);results.push({id:svc.id,...summary})}catch(err){let message=err instanceof Error?err.message:String(err);logger2.error(`[Discovery] Service "${svc.id}" discovery failed`,{error:message}),results.push({id:svc.id,added:0,reactivated:0,deactivated:0,unchanged:0,total:0,error:message})}return{services:results}}async function getRouteManifest(db,claimsTable,serviceId){return(await db.select().from(claimsTable).where(like2(col16(claimsTable,"action"),`${serviceId.toLowerCase()}.%`))).filter((r)=>r.isActive!==!1).map((r)=>({action:String(r.action),path:String(r.path??""),method:String(r.method??"")}))}async function getRoleClaimsManifest(db,schemaTables,serviceId){let{roles:rolesTable,claims:claimsTable}=schemaTables,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims;if(!rolesTable||!claimsTable||!roleClaimsTable)return{};let sid=serviceId.toLowerCase(),claimRows=await db.select().from(claimsTable),claimIdToAction=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let action=String(c.action??"");if(action===sid||action.startsWith(`${sid}.`))claimIdToAction.set(String(c.id),action)}if(claimIdToAction.size===0)return{};let roleRows=await db.select().from(rolesTable),roleIdToName=new Map;for(let r of roleRows)roleIdToName.set(String(r.id),String(r.name??""));let rcRows=await db.select().from(roleClaimsTable),out={};for(let rc of rcRows){if(rc.isActive===!1)continue;let action=claimIdToAction.get(String(rc.claimId??rc.claim_id)),roleName=roleIdToName.get(String(rc.roleId??rc.role_id));if(!action||!roleName)continue;let actions=out[roleName];if(!actions)actions=[],out[roleName]=actions;actions.push(action)}return out}var init_seed=__esm(()=>{init_EndpointDiscovery()});var OPS_BY_TYPE;var init_types23=__esm(()=>{OPS_BY_TYPE={int:["gt","gte","lt","lte","eq","ne"],boolean:["eq","ne"],string:["eq","ne"]}});function isRecord(v){return typeof v==="object"&&v!==null}function guardActionFromName(name2){let brace=name2.indexOf("{");return(brace>=0?name2.slice(0,brace):name2).replace(/:$/,"")}function parseGuardCatalogEntry(entry){if(!isRecord(entry))return null;let name2=typeof entry.name==="string"?entry.name.trim():"";if(!name2)return null;let valueType=entry.value;if(typeof valueType!=="string"||!VALUE_TYPES.includes(valueType))return null;let action=guardActionFromName(name2);if(!action)return null;return{action,policy:{kind:"guard",keyTemplate:name2,valueType}}}function parseGuardPolicy(raw){if(!isRecord(raw)||raw.kind!=="guard")return null;if(typeof raw.keyTemplate!=="string"||!raw.keyTemplate)return null;let vt=raw.valueType;if(typeof vt!=="string"||!VALUE_TYPES.includes(vt))return null;return{kind:"guard",keyTemplate:raw.keyTemplate,valueType:vt}}function resolveGuardKey(keyTemplate,ctx){return keyTemplate.replaceAll("{userId}",ctx.userId).replaceAll("{tenant}",ctx.tenant??"default")}function coerceThreshold(value2,type4){if(type4==="int"){if(value2==null)return null;if(typeof value2==="boolean"||typeof value2==="symbol")return null;if(typeof value2==="string"&&value2.trim()==="")return null;if(typeof value2==="object")return null;let n=Number(value2);return Number.isFinite(n)?n:null}if(type4==="boolean"){if(typeof value2==="boolean")return value2;if(value2==="true"||value2===1||value2==="1")return!0;if(value2==="false"||value2===0||value2==="0")return!1;return null}return value2==null?null:String(value2)}function parseGuardCondition(scope,valueType){let raw=scope;if(typeof scope==="string")try{raw=JSON.parse(scope)}catch{return null}if(!isRecord(raw))return null;let op=raw.op;if(typeof op!=="string"||!OPS_BY_TYPE[valueType].includes(op))return null;let value2=coerceThreshold(raw.value,valueType);if(value2===null)return null;let invalidates=Array.isArray(raw.invalidates)?raw.invalidates.filter((a)=>typeof a==="string"&&a.length>0):[];return{op,value:value2,invalidates}}function coerceStateValue(raw,type4){if(raw==null)return null;let v=isRecord(raw)&&"data"in raw?raw.data:raw;if(v==null)return null;if(typeof v==="object")return null;if(type4==="int"&&typeof v==="string"&&v.trim()==="")return null;return coerceThreshold(v,type4)}function guardConditionHolds(rawValue,valueType,condition){let actual=coerceStateValue(rawValue,valueType);if(actual===null)return!1;let target2=condition.value;switch(condition.op){case"gt":return actual>target2;case"gte":return actual>=target2;case"lt":return actual<target2;case"lte":return actual<=target2;case"eq":return actual===target2;case"ne":return actual!==target2;default:return!1}}function parseClaimGuardCatalog(entries){if(!entries?.length)return[];let out=[],seen=new Set;for(let e of entries){let parsed=parseGuardCatalogEntry(e);if(parsed&&!seen.has(parsed.action))seen.add(parsed.action),out.push(parsed)}return out}var VALUE_TYPES;var init_evaluate=__esm(()=>{init_types23();VALUE_TYPES=["int","boolean","string"]});async function resolveClaimGuards(db,schemaTables,userId,read2,ctx={}){let claimsTable=schemaTables.claims,roleClaimsTable=schemaTables.roleClaims??schemaTables.role_claims,userRolesTable=schemaTables.userRoles??schemaTables.user_roles;if(!claimsTable||!roleClaimsTable||!userRolesTable)return EMPTY;let claimRows=await db.select().from(claimsTable),guardByClaimId=new Map;for(let c of claimRows){if(c.isActive===!1)continue;let policy=parseGuardPolicy(c.policy);if(policy)guardByClaimId.set(String(c.id),{action:String(c.action??""),policy})}if(guardByClaimId.size===0)return EMPTY;let urRows=await db.select().from(userRolesTable),roleIds=new Set(urRows.filter((r)=>r.isActive!==!1&&String(r.userId??r.user_id)===userId).map((r)=>String(r.roleId??r.role_id)));if(roleIds.size===0)return EMPTY;let rcRows=await db.select().from(roleClaimsTable),guards=[],suppressed=new Set,firedGuards=[],stateCache=new Map;for(let rc of rcRows){if(rc.isActive===!1)continue;if(!roleIds.has(String(rc.roleId??rc.role_id)))continue;let guard4=guardByClaimId.get(String(rc.claimId??rc.claim_id));if(!guard4)continue;let condition=parseGuardCondition(rc.scope,guard4.policy.valueType);if(!condition)continue;let key2=resolveGuardKey(guard4.policy.keyTemplate,{userId,tenant:ctx.tenant}),value2;if(stateCache.has(key2))value2=stateCache.get(key2);else value2=await read2(key2).catch(()=>null),stateCache.set(key2,value2);let holds=guardConditionHolds(value2,guard4.policy.valueType,condition),current=normalizeCurrent(value2,guard4.policy.valueType);if(guards.push({action:guard4.action,key:key2,valueType:guard4.policy.valueType,op:condition.op,threshold:condition.value,current,invalidates:condition.invalidates,holds}),holds&&condition.invalidates.length>0){for(let a of condition.invalidates)suppressed.add(a);firedGuards.push({action:guard4.action,key:key2,invalidates:condition.invalidates})}}return{guards,suppressedClaims:[...suppressed],firedGuards}}function normalizeCurrent(raw,type4){if(raw==null)return null;let v=typeof raw==="object"&&raw!==null&&"data"in raw?raw.data:raw;if(v==null)return null;if(type4==="int"){let n=Number(v);return Number.isFinite(n)?n:null}if(type4==="boolean")return v===!0||v==="true"||v===1||v==="1";return String(v)}var EMPTY;var init_resolve=__esm(()=>{init_evaluate();EMPTY={guards:[],suppressedClaims:[],firedGuards:[]}});import{eq as eq67}from"drizzle-orm";async function seedClaimGuards(db,schemaTables,claimGuards,logger2){let claimsTable=schemaTables.claims;if(!claimsTable)return{created:0,updated:0,deactivated:0};let actionCol=claimsTable.action,desired=parseClaimGuardCatalog(claimGuards),desiredByAction=new Map(desired.map((d)=>[d.action,d.policy])),existing=await db.select().from(claimsTable),existingGuardActions=new Set,result={created:0,updated:0,deactivated:0};for(let row of existing){if(!parseGuardPolicy(row.policy))continue;let action=String(row.action??"");existingGuardActions.add(action);let want=desiredByAction.get(action);if(!want){if(row.isActive!==!1)await db.update(claimsTable).set({isActive:!1}).where(eq67(actionCol,action)),result.deactivated++;continue}let current=row.policy;if(JSON.stringify(current)!==JSON.stringify(want)||row.isActive===!1)await db.update(claimsTable).set({policy:want,isActive:!0,path:want.keyTemplate,method:"GUARD"}).where(eq67(actionCol,action)),result.updated++}for(let{action,policy}of desired){if(existingGuardActions.has(action))continue;await db.insert(claimsTable).values({action,description:`ClaimGuard [${policy.valueType}] key=${policy.keyTemplate}`,path:policy.keyTemplate,method:"GUARD",policy,isActive:!0}),result.created++}return logger2?.info?.(`[Authorization] ClaimGuards seeded (created=${result.created}, updated=${result.updated}, deactivated=${result.deactivated})`),result}var init_seed2=__esm(()=>{init_evaluate()});var exports_ClaimGuard={};__export(exports_ClaimGuard,{seedClaimGuards:()=>seedClaimGuards,resolveGuardKey:()=>resolveGuardKey,resolveClaimGuards:()=>resolveClaimGuards,parseGuardPolicy:()=>parseGuardPolicy,parseGuardCondition:()=>parseGuardCondition,parseGuardCatalogEntry:()=>parseGuardCatalogEntry,parseClaimGuardCatalog:()=>parseClaimGuardCatalog,guardConditionHolds:()=>guardConditionHolds,guardActionFromName:()=>guardActionFromName,OPS_BY_TYPE:()=>OPS_BY_TYPE});var init_ClaimGuard=__esm(()=>{init_evaluate();init_resolve();init_seed2();init_types23()});var exports_dbStorage={};__export(exports_dbStorage,{createDbWebAuthnStorage:()=>createDbWebAuthnStorage});import{and as and28,eq as eq68,isNull as isNull6}from"drizzle-orm";function rowToRecord(row){return{id:row.id,userId:row.userId,credentialId:row.credentialId,publicKey:row.publicKey,counter:typeof row.counter==="bigint"?Number(row.counter):Number(row.counter??0),transports:parseTransports(row.transports),deviceType:parseDeviceType(row.deviceType),backedUp:row.backedUp,aaguid:row.aaguid,authenticatorAttachment:row.authenticatorAttachment==="platform"||row.authenticatorAttachment==="cross-platform"?row.authenticatorAttachment:null,nickname:row.nickname,lastUsedAt:row.lastUsedAt,revokedAt:row.revokedAt,createdAt:row.createdAt}}function col17(table,key2){return table[key2]}function createDbWebAuthnStorage(deps){let{db,resolveTable}=deps,credentialsName="webauthnCredentials",challengesName="webauthnChallenges";return{storeChallenge:async(challenge,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return;await db.insert(table).values({userId:challenge.userId??null,challenge:challenge.challenge,challengeType:challenge.challengeType,expiresAt:challenge.expiresAt})},consumeChallenge:async(challenge,challengeType,schemaName)=>{let table=resolveTable("webauthnChallenges",schemaName);if(!table)return null;let row=(await db.update(table).set({consumedAt:new Date}).where(and28(eq68(col17(table,"challenge"),challenge),eq68(col17(table,"challengeType"),challengeType),isNull6(col17(table,"consumedAt")))).returning())[0];if(!row)return null;return{challenge:row.challenge,challengeType:row.challengeType,userId:row.userId,expiresAt:row.expiresAt}},listCredentialsByUser:async(userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return[];return(await db.select().from(table).where(eq68(col17(table,"userId"),userId))).map(rowToRecord)},findCredentialById:async(credentialId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return null;let rows=await db.select().from(table).where(eq68(col17(table,"credentialId"),credentialId)).limit(1);return rows[0]?rowToRecord(rows[0]):null},insertCredential:async(record3,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)throw Error("webauthn_credentials table not configured");let row=(await db.insert(table).values({userId:record3.userId,credentialId:record3.credentialId,publicKey:record3.publicKey,counter:record3.counter,transports:record3.transports??null,deviceType:record3.deviceType??null,backedUp:record3.backedUp,aaguid:record3.aaguid??null,authenticatorAttachment:record3.authenticatorAttachment??null,nickname:record3.nickname??null}).returning())[0];if(!row)throw Error("Failed to insert webauthn credential");return rowToRecord(row)},updateCredentialCounter:async(credentialId,counter,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return;await db.update(table).set({counter,lastUsedAt:new Date}).where(eq68(col17(table,"credentialId"),credentialId))},revokeCredential:async(credentialId,userId,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({revokedAt:new Date}).where(and28(eq68(col17(table,"credentialId"),credentialId),eq68(col17(table,"userId"),userId))).returning()).length>0},renameCredential:async(credentialId,userId,nickname,schemaName)=>{let table=resolveTable("webauthnCredentials",schemaName);if(!table)return!1;return(await db.update(table).set({nickname}).where(and28(eq68(col17(table,"credentialId"),credentialId),eq68(col17(table,"userId"),userId))).returning()).length>0}}}var init_dbStorage=()=>{};function isValidUploadId(id){return typeof id==="string"&&/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(id)}function offsetVerdict(input){let{declaredOffset,actualOffset,chunkBytes,totalSize}=input;if(!Number.isFinite(declaredOffset)||declaredOffset<0)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(declaredOffset!==actualOffset)return{ok:!1,reason:"offset_mismatch",expected:actualOffset};if(actualOffset+chunkBytes>totalSize)return{ok:!1,reason:"too_long",expected:actualOffset};return{ok:!0}}function isComplete(actualOffset,totalSize){return actualOffset===totalSize&&totalSize>0}function sessionRefusal(input){let{session,callerId,fingerprint,now}=input;if(!session)return"not_found";if(!callerId||session.owner!==callerId)return"not_yours";if(now-session.createdAt>86400000)return"expired";if(fingerprint!=null&&fingerprint!==session.fingerprint)return"wrong_file";return null}function isExpired(session,now){return now-session.createdAt>86400000}function sessionStatus(session,offset){return{uploadId:session.id,offset,size:session.size,originalName:session.originalName,complete:isComplete(offset,session.size)}}var SESSION_TTL_MS=86400000,CHUNK_SIZE_BYTES=8388608,MAX_CHUNK_BYTES=33554432;import{randomUUID as randomUUID10}from"crypto";import{mkdir as mkdir8,open as open2,readdir as readdir3,readFile as readFile2,rm as rm2,stat as stat8,writeFile as writeFile2}from"fs/promises";import path7 from"path";function createResumableStore(basePath){let root=path7.join(basePath,UPLOAD_DIR);function pathsFor(id){if(!isValidUploadId(id))return null;let part=path7.join(root,`${id}.part`),meta=path7.join(root,`${id}.json`);if(!isPathWithinBase(root,part)||!isPathWithinBase(root,meta))return null;return{part,meta}}async function create4(input,now){await mkdir8(root,{recursive:!0});let session={...input,id:randomUUID10(),createdAt:now},paths=pathsFor(session.id);if(!paths)throw Error("Generated upload id was rejected by its own validator");return await writeFile2(paths.meta,JSON.stringify(session),"utf8"),await writeFile2(paths.part,""),session}async function read2(id){let paths=pathsFor(id);if(!paths)return null;try{let raw=await readFile2(paths.meta,"utf8"),parsed=JSON.parse(raw);if(!parsed||typeof parsed.owner!=="string"||typeof parsed.size!=="number")return null;return parsed}catch{return null}}async function offsetOf(id){let paths=pathsFor(id);if(!paths)return null;try{return(await stat8(paths.part)).size}catch{return null}}async function writeAt(id,offset,chunk){let paths=pathsFor(id);if(!paths)return null;let handle=await open2(paths.part,"r+");try{await handle.write(chunk,0,chunk.byteLength,offset)}finally{await handle.close()}return(await stat8(paths.part)).size}async function readAssembled(id){let paths=pathsFor(id);if(!paths)return null;try{return await readFile2(paths.part)}catch{return null}}function partPath(id){return pathsFor(id)?.part??null}async function discardMeta(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.meta,{force:!0})}async function discard2(id){let paths=pathsFor(id);if(!paths)return;await rm2(paths.part,{force:!0}),await rm2(paths.meta,{force:!0})}async function sweep(now){let removed=0,entries;try{entries=await readdir3(root)}catch{return 0}for(let entry of entries){if(!entry.endsWith(".json"))continue;let id=entry.slice(0,-5);try{let session=await read2(id);if(session&&!isExpired(session,now))continue;await discard2(id),removed+=1}catch{}}return removed}return{create:create4,read:read2,offsetOf,writeAt,readAssembled,partPath,discard:discard2,discardMeta,sweep,root}}var UPLOAD_DIR=".uploads";var init_store4=__esm(()=>{init_helpers3()});var exports_resumable={};__export(exports_resumable,{createResumableRoutes:()=>createResumableRoutes,SESSION_TTL_MS:()=>SESSION_TTL_MS,CHUNK_SIZE_BYTES:()=>CHUNK_SIZE_BYTES});function toBytes(body){if(body instanceof Uint8Array)return body;if(body instanceof ArrayBuffer)return new Uint8Array(body);if(ArrayBuffer.isView(body))return new Uint8Array(body.buffer,body.byteOffset,body.byteLength);if(typeof body==="string")return new TextEncoder().encode(body);return new Uint8Array(0)}function createResumableRoutes(config){let{basePath,storage,logger:logger2,getUserId:getUserId3,canUpload,register}=config,store=createResumableStore(basePath),openSession=async(id,request,fingerprint)=>{let userId=getUserId3(request);if(!await canUpload(request))return{ok:!1,status:403,message:"You are not allowed to upload files."};let session=isValidUploadId(id)?await store.read(id):null,refusal=sessionRefusal({session,callerId:userId,fingerprint,now:Date.now()});if(refusal)return{ok:!1,status:REFUSAL_STATUS[refusal],message:REFUSAL_MESSAGE[refusal]};return{ok:!0,session,userId}},routePostRoot=defineRoute({method:"POST",path:"/",body:Type.Object({originalName:Type.String({minLength:1,maxLength:500}),size:Type.Number(),mimeType:Type.String({maxLength:200}),type:Type.Optional(Type.String({maxLength:40})),fingerprint:Type.String({minLength:1,maxLength:200})}),detail:{tags:["Storage"],summary:"Start a resumable upload"},handler:async({body,request,set:set2})=>{let userId=getUserId3(request);if(!userId)return set2.status=401,{success:!1,message:"Sign in to upload."};if(!await canUpload(request))return set2.status=403,{success:!1,message:"You are not allowed to upload files."};if(!Number.isFinite(body.size)||body.size<=0)return set2.status=400,{success:!1,message:"A size is required to start an upload."};if(body.size>storage.maxFileSizeBytes)return set2.status=413,{success:!1,message:`This file is larger than the ${Math.round(storage.maxFileSizeBytes/1048576)} MB limit.`};if(isMimeTypeListed(storage.blockedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};if(storage.allowedMimeTypes?.length&&!isMimeTypeListed(storage.allowedMimeTypes,body.mimeType))return set2.status=415,{success:!1,message:"This kind of file cannot be uploaded."};let session=await store.create({owner:userId,originalName:body.originalName,size:body.size,mimeType:body.mimeType,type:body.type??"file",fingerprint:body.fingerprint},Date.now());return set2.status=201,{success:!0,data:sessionStatus(session,0)}}}),routeGetId=defineRoute({method:"GET",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePatchId=defineRoute({method:"PATCH",path:"/:id",detail:{tags:["Storage"],summary:"Append a piece"},handler:async({params,request,body,set:set2})=>{let fingerprint=request.headers.get("upload-fingerprint"),opened=await openSession(params.id,request,fingerprint);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let declared2=Number(request.headers.get("upload-offset")),actual=await store.offsetOf(params.id)??0,chunk=toBytes(body),sentBytes=request.body!==null||Number(request.headers.get("content-length")??"0")>0;if(chunk.byteLength===0&&sentBytes)return set2.status=415,{success:!1,message:"The piece could not be read. Send it as application/octet-stream.",data:{offset:actual}};if(chunk.byteLength>MAX_CHUNK_BYTES)return set2.status=413,{success:!1,message:`A single piece may not exceed ${MAX_CHUNK_BYTES/1048576} MB.`,data:{offset:actual}};let verdict=offsetVerdict({declaredOffset:declared2,actualOffset:actual,chunkBytes:chunk.byteLength,totalSize:opened.session.size});if(!verdict.ok)return set2.status=409,{success:!1,message:verdict.reason==="too_long"?"This piece would take the file past the size it was started with.":"This piece does not continue where the file ends.",data:{offset:verdict.expected}};let offset=await store.writeAt(params.id,actual,chunk);if(offset===null)return set2.status=500,{success:!1,message:"The piece could not be written."};return{success:!0,data:sessionStatus(opened.session,offset)}}}),routePostIdComplete=defineRoute({method:"POST",path:"/:id/complete",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};let offset=await store.offsetOf(params.id)??0;if(!isComplete(offset,opened.session.size))return set2.status=409,{success:!1,message:"The file is not complete yet.",data:sessionStatus(opened.session,offset)};let partPath=store.partPath(params.id);if(!partPath)return set2.status=500,{success:!1,message:"The assembled file could not be found."};let registered=await register({partPath,size:offset,originalName:opened.session.originalName,mimeType:opened.session.mimeType,type:opened.session.type,userId:opened.userId});if(!registered)return set2.status=500,{success:!1,message:"The file could not be registered. Try completing again."};return await store.discardMeta(params.id),logger2.info(`[Storage] Resumable upload finished: ${opened.session.originalName} (${offset} bytes)`),{success:!0,data:{id:registered.id}}}}),routeDeleteId=defineRoute({method:"DELETE",path:"/:id",handler:async({params,request,set:set2})=>{let opened=await openSession(params.id,request);if(!opened.ok)return set2.status=opened.status,{success:!1,message:opened.message};return await store.discard(params.id),{success:!0,data:{discarded:!0}}}});return{plugin:collectRoutes([{prefix:"/uploads",routes:[routePostRoot,routeGetId,routePatchId,routePostIdComplete,routeDeleteId]}]),sweep:(now)=>store.sweep(now)}}var REFUSAL_STATUS,REFUSAL_MESSAGE;var init_resumable=__esm(()=>{init_esm3();init_routeCollector();init_helpers3();init_store4();REFUSAL_STATUS={not_found:404,not_yours:404,expired:410,wrong_file:409},REFUSAL_MESSAGE={not_found:"No such upload.",not_yours:"No such upload.",expired:"This upload was abandoned and has been cleaned up. Start it again.",wrong_file:"This is a different file from the one this upload started with."}});var exports_authorization={};__export(exports_authorization,{createAuthorizationDiscoveryRoutes:()=>createAuthorizationDiscoveryRoutes});import{timingSafeEqual as timingSafeEqual4}from"crypto";function tokensMatch2(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual4(ba,bb)}function createAuthorizationDiscoveryRoutes(cfg){let{db,schemaTables,logger:logger2,discovery,readState}=cfg,token=discovery.token||process.env.NUCLEUS_DISCOVERY_TOKEN,claimsTable=schemaTables.claims,manifestAuthorized=(request)=>{if(hasGodminRole(request))return!0;if(token){let presented=request.headers.get("x-discovery-token")??"";return tokensMatch2(presented,token)}return!1},authorizeGuardRead=(request,query,set2)=>{let callerId=request.headers.get("x-user-id")??"",isGodmin4=hasGodminRole(request),requested=query.userId;if(requested&&requested!==callerId&&!isGodmin4)return{error:fail6(set2,403,"Forbidden: only godmin can read another user's guards")};let targetUserId=requested&&isGodmin4?requested:callerId;if(!targetUserId)return{error:fail6(set2,401,"Unauthorized: no user context")};return{userId:targetUserId}},guardsHandler=async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;let tenant=request.headers.get("x-tenant-id")??void 0;if(!readState)return{success:!0,data:{userId:auth.userId,guards:[]}};let{guards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,guards}}},declared=[defineRoute({method:"POST",path:"/authorization/discover",handler:async({request,set:set2})=>{if(!hasGodminRole(request))return fail6(set2,403,"Forbidden: endpoint discovery requires godmin");if(!discovery.enabled)return fail6(set2,400,"endpointDiscovery is not enabled");return{success:!0,message:"Discovery completed",data:await runEndpointDiscovery(db,schemaTables,discovery,logger2)}}}),defineRoute({method:"GET",path:"/authorization/route-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");if(!claimsTable)return fail6(set2,503,"Claims table unavailable");let service=query.service;if(service){let rows=await getRouteManifest(db,claimsTable,service);return{success:!0,data:{service,routes:rows}}}let all={};for(let svc of discovery.services??[])all[svc.id]=await getRouteManifest(db,claimsTable,svc.id);return{success:!0,data:all}}}),defineRoute({method:"GET",path:"/authorization/role-claims-manifest",handler:async({request,query,set:set2})=>{if(!manifestAuthorized(request))return fail6(set2,403,"Forbidden: godmin or a valid x-discovery-token required");let service=query.service;if(!service)return fail6(set2,400,"service query param required");let map3=await getRoleClaimsManifest(db,schemaTables,service);return{success:!0,data:{service,roleClaims:map3}}}}),defineRoute({method:"GET",path:"/authorization/guards",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/quotas",handler:guardsHandler}),defineRoute({method:"GET",path:"/authorization/suppressed-claims",handler:async({request,query,set:set2})=>{let auth=authorizeGuardRead(request,query,set2);if("error"in auth)return auth.error;if(!readState)return{success:!0,data:{userId:auth.userId,suppressedClaims:[],firedGuards:[]}};let tenant=request.headers.get("x-tenant-id")??void 0,{suppressedClaims,firedGuards}=await resolveClaimGuards(db,schemaTables,auth.userId,readState,{tenant});return{success:!0,data:{userId:auth.userId,suppressedClaims,firedGuards}}}})];return collectRoutes([{routes:declared}])}var fail6=(set2,status,message)=>{return set2.status=status,{success:!1,message,data:null}};var init_authorization=__esm(()=>{init_ClaimGuard();init_seed();init_routeCollector();init_adminGuard()});var import_reflect_metadata2=__toESM(require_Reflect(),1);import{createHash as createHash7,randomUUID as randomUUID11}from"crypto";import{pushSchema}from"drizzle-kit/api";import{and as and29,desc as desc7,eq as eq69,lt as lt3,ne as ne5,sql as sql14}from"drizzle-orm";import{drizzle as drizzle2}from"drizzle-orm/node-postgres";import{pgSchema as pgSchema2}from"drizzle-orm/pg-core";import{join as join3}from"path";class LiveStorageProvider{resolve;constructor(resolve){this.resolve=resolve}get kind(){return this.resolve().kind}get describe(){return this.resolve().describe}isAvailable(){return this.resolve().isAvailable()}exists(relativePath){return this.resolve().exists(relativePath)}stat(relativePath){return this.resolve().stat(relativePath)}read(relativePath){return this.resolve().read(relativePath)}write(relativePath,data){return this.resolve().write(relativePath,data)}delete(relativePath){return this.resolve().delete(relativePath)}ensureDir(relativeDir){return this.resolve().ensureDir(relativeDir)}list(relativeDir){return this.resolve().list(relativeDir)}localPath(relativePath){return this.resolve().localPath(relativePath)}close(){return this.resolve().close()}}import{mkdir,readdir,stat,unlink}from"fs/promises";import{dirname,join}from"path";function normalizeRelativePath(relativePath){let cleaned=relativePath.replace(/\\/g,"/").replace(/^\/+/,""),segments=[];for(let segment of cleaned.split("/")){if(!segment||segment===".")continue;if(segment==="..")throw Error(`Path traversal rejected: ${relativePath}`);segments.push(segment)}return segments.join("/")}class LocalStorageProvider{kind="local";describe;basePath;constructor(basePath,_deps){this.basePath=basePath,this.describe=`local:${basePath}`}resolve(relativePath){return join(this.basePath,normalizeRelativePath(relativePath))}async isAvailable(){try{return await mkdir(this.basePath,{recursive:!0}),!0}catch{return!1}}async exists(relativePath){return Bun.file(this.resolve(relativePath)).exists()}async stat(relativePath){try{let info=await stat(this.resolve(relativePath));return{size:info.size,modifiedAt:info.mtime,isDirectory:info.isDirectory()}}catch{return null}}async read(relativePath){let file=Bun.file(this.resolve(relativePath));if(!await file.exists())return null;return Buffer.from(await file.arrayBuffer())}async write(relativePath,data){let full=this.resolve(relativePath);await mkdir(dirname(full),{recursive:!0}),await Bun.write(full,data)}async delete(relativePath){try{return await unlink(this.resolve(relativePath)),!0}catch{return!1}}async ensureDir(relativeDir){await mkdir(this.resolve(relativeDir),{recursive:!0})}async list(relativeDir){try{return await readdir(this.resolve(relativeDir))}catch{return[]}}async localPath(relativePath){let full=this.resolve(relativePath);return await Bun.file(full).exists()?full:null}async close(){}}import{stat as fsStat,mkdir as mkdir2,rename,unlink as unlink2}from"fs/promises";import{dirname as dirname2,join as join2}from"path";var DEFAULT_TIMEOUT_MS=15000,DEFAULT_CACHE_TTL_SECONDS=300;class SmbStorageProvider{kind="smb";describe;getConfig;logger;client=null;clientFingerprint="";cacheDir;cacheTtlMs;cacheEnabled;inFlight=new Map;constructor(getConfig,deps,defaultCacheDir){this.getConfig=getConfig,this.logger=deps.logger;let config=getConfig();this.cacheEnabled=config.cache?.enabled!==!1,this.cacheDir=config.cache?.path||defaultCacheDir,this.cacheTtlMs=(config.cache?.ttlSeconds??DEFAULT_CACHE_TTL_SECONDS)*1000,this.describe=`smb://${config.host}/${config.share}${config.basePath?`/${config.basePath}`:""}`}async getClient(){let{host,share,domain,username,password,port,timeoutMs}=this.getConfig(),fingerprint=`${host}|${share}|${domain}|${username}|${password}|${port}`;if(this.client&&fingerprint===this.clientFingerprint)return this.client;if(this.client){try{this.client.disconnect()}catch{}this.client=null}let imported=await Promise.resolve().then(() => __toESM(require_smb2(),1)).catch(()=>{throw Error('storage.provider is "smb" but the optional @marsaud/smb2 dependency is not installed \u2014 run: bun add @marsaud/smb2')}),SMB2=imported.default??imported;return this.client=new SMB2({share:`\\\\${host}\\${share}`,domain:domain||"WORKGROUP",username,password,port:port??445,autoCloseTimeout:timeoutMs??DEFAULT_TIMEOUT_MS}),this.clientFingerprint=fingerprint,this.client}async call(fn){let client=await this.getClient(),timeoutMs=this.getConfig().timeoutMs??DEFAULT_TIMEOUT_MS;return new Promise((resolve,reject)=>{let settled=!1,timer=setTimeout(()=>{if(settled)return;settled=!0,reject(Error(`SMB operation timed out after ${timeoutMs}ms (${this.describe})`))},timeoutMs);fn(client,(err,value)=>{if(settled)return;if(settled=!0,clearTimeout(timer),err)reject(err);else resolve(value)})})}remotePath(relativePath){let normalized=normalizeRelativePath(relativePath),configuredBase=this.getConfig().basePath,base=configuredBase?normalizeRelativePath(configuredBase):"";return(base?`${base}/${normalized}`:normalized).replace(/\//g,"\\")}cachePath(relativePath){return join2(this.cacheDir,normalizeRelativePath(relativePath))}async isAvailable(){try{return await this.call((client,cb)=>client.readdir(this.getConfig().basePath?this.remotePath(""):"",cb)),!0}catch(error){return this.logger.warn("[Storage/SMB] Share is not reachable",{target:this.describe,error:error instanceof Error?error.message:String(error)}),!1}}async exists(relativePath){try{return await this.call((client,cb)=>client.exists(this.remotePath(relativePath),cb))}catch{return!1}}async stat(relativePath){try{let info=await this.call((client,cb)=>client.stat(this.remotePath(relativePath),cb));return{size:Number(info.size),modifiedAt:new Date(info.mtime),isDirectory:typeof info.isDirectory==="function"?info.isDirectory():await this.looksLikeDirectory(relativePath)}}catch{return null}}async read(relativePath){try{return await this.call((client,cb)=>client.readFile(this.remotePath(relativePath),cb))}catch(error){return this.logger.warn("[Storage/SMB] Read failed",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}}async write(relativePath,data){let parent=normalizeRelativePath(relativePath).split("/").slice(0,-1).join("/");if(parent)await this.ensureDir(parent);let payload=typeof data==="string"?Buffer.from(data,"utf-8"):Buffer.from(data);if(await this.call((client,cb)=>client.writeFile(this.remotePath(relativePath),payload,cb)),this.cacheEnabled){let target=this.cachePath(relativePath);await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{}),await Bun.write(target,payload).catch(()=>{})}}async delete(relativePath){try{if(await this.call((client,cb)=>client.unlink(this.remotePath(relativePath),cb)),this.cacheEnabled)await unlink2(this.cachePath(relativePath)).catch(()=>{});return!0}catch{return!1}}async ensureDir(relativeDir){let normalized=normalizeRelativePath(relativeDir);if(!normalized)return;let segments=normalized.split("/");for(let i=1;i<=segments.length;i++){let partial=segments.slice(0,i).join("/");try{await this.call((client,cb)=>client.mkdir(this.remotePath(partial),cb))}catch{}}}async looksLikeDirectory(relativePath){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativePath),cb)),!0}catch{return!1}}async list(relativeDir){try{return await this.call((client,cb)=>client.readdir(this.remotePath(relativeDir),cb))}catch{return[]}}async localPath(relativePath){if(!this.cacheEnabled)return null;let target=this.cachePath(relativePath),cached=await fsStat(target).catch(()=>null);if(cached&&Date.now()-cached.mtimeMs<this.cacheTtlMs)return target;let pending=this.inFlight.get(target);if(pending)return pending;let download=(async()=>{let data=await this.read(relativePath);if(!data)return null;await mkdir2(dirname2(target),{recursive:!0}).catch(()=>{});let tmp=`${target}.${process.pid}.tmp`;try{return await Bun.write(tmp,data),await rename(tmp,target),target}catch(error){return await unlink2(tmp).catch(()=>{}),this.logger.warn("[Storage/SMB] Could not cache file locally",{path:relativePath,error:error instanceof Error?error.message:String(error)}),null}})().finally(()=>{this.inFlight.delete(target)});return this.inFlight.set(target,download),download}async close(){try{this.client?.disconnect()}catch{}this.client=null}}var DEFAULT_EXCLUDES=[".cache",".tmp","lost+found"];async function migrateStorage(options,deps){let{from,to,onProgress}=options,exclude=new Set([...DEFAULT_EXCLUDES,...options.exclude??[]]),maxFiles=options.maxFiles??50000,report={copied:0,skipped:0,failed:0,bytes:0,failures:[],truncated:!1},walk=async(dir)=>{if(report.truncated)return;let entries=await from.list(dir);for(let entry of entries){if(report.truncated)return;if(!entry||entry==="."||entry==="..")continue;let relative=dir?`${dir}/${entry}`:entry;if(exclude.has(entry))continue;let info=await from.stat(relative);if(!info){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}if(info.isDirectory){await walk(relative);continue}if(report.copied+report.skipped>=maxFiles){report.truncated=!0;return}if(await to.exists(relative)){report.skipped+=1;continue}try{let bytes=await from.read(relative);if(!bytes){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);continue}let parent=relative.includes("/")?relative.slice(0,relative.lastIndexOf("/")):"";if(parent)await to.ensureDir(parent);await to.write(relative,bytes),report.copied+=1,report.bytes+=bytes.length,onProgress?.(report.copied,relative)}catch(error){if(report.failed+=1,report.failures.length<50)report.failures.push(relative);deps.logger.warn("[Storage] Migration copy failed",{path:relative,error:error instanceof Error?error.message:String(error)})}}};return await walk(""),deps.logger.info("[Storage] Migration finished",{from:from.describe,to:to.describe,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),report}function parseSmbUrl(value){let raw=(value??"").trim();if(!raw)return{host:"",share:""};let withoutScheme=raw.replace(/^smb:\/\//i,"").replace(/^\\\\/,"").replace(/\\/g,"/"),[host="",share="",...rest]=withoutScheme.split("/").filter(Boolean);return{host,share,basePath:rest.length>0?rest.join("/"):void 0}}function createStorageProvider(options,deps){let{basePath,smb,resolveCredential}=options,setting=(key,configValue)=>resolveCredential?.("storage.smb",key,configValue)??configValue,resolveSmbConfig=()=>{let fromUrl=parseSmbUrl(setting("url"));return{...smb,host:fromUrl.host||setting("host",smb?.host)||"",share:fromUrl.share||setting("share",smb?.share)||"",basePath:fromUrl.basePath??setting("base_path",smb?.basePath),domain:setting("domain",smb?.domain),username:setting("username",smb?.username),password:setting("password",smb?.password)}},resolveKind=()=>{let chosen=resolveCredential?.("storage","provider",options.provider);return chosen==="smb"?"smb":chosen==="local"?"local":options.provider??"local"},local=new LocalStorageProvider(basePath,deps),smbProvider=null,smbSignature="",warnedIncomplete=!1;return new LiveStorageProvider(()=>{if(resolveKind()!=="smb")return local;let config=resolveSmbConfig();if(!config.host||!config.share){if(!warnedIncomplete)warnedIncomplete=!0,deps.logger.error('[Storage] provider is "smb" but the host/share are not set \u2014 using local storage until they are');return local}warnedIncomplete=!1;let signature=JSON.stringify([config.host,config.share,config.basePath,config.domain,config.username,config.password,config.port]);if(!smbProvider||signature!==smbSignature)smbProvider?.close(),smbProvider=new SmbStorageProvider(resolveSmbConfig,deps,join3(basePath,".cache","smb")),smbSignature=signature,deps.logger.info("[Storage] SMB target configured",{target:smbProvider.describe});return smbProvider})}init_Services();init_ApiKey();init_Middleware();init_Captcha();init_Domain();init_ServerLogBuffer();init_transports();init_Secrets();var SYSTEM_TABLES=[{table_name:"users",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"email",type:"varchar",length:255},{name:"password",type:"varchar",length:255},{name:"verified_at",type:"timestamp"},{name:"email_verification_token",type:"varchar",length:255},{name:"email_verification_token_expires_at",type:"timestamp"},{name:"email_verification_sent_at",type:"timestamp"},{name:"email_verification_attempts",type:"integer",default:0},{name:"last_login_at",type:"timestamp"},{name:"login_count",type:"integer",default:0},{name:"is_locked",type:"boolean",default:!1},{name:"locked_until",type:"timestamp"},{name:"failed_login_attempts",type:"integer",default:0},{name:"is_god",type:"boolean",default:!1},{name:"cohort_id",type:"uuid",references:{table:"user_cohorts",column:"id",onDelete:"set null"}},{name:"email_verified",type:"boolean",default:!1}],indexes:[{columns:["email"],unique:!0},{columns:["email","is_active"]},{columns:["last_login_at"]},{columns:["is_locked","locked_until"]}]},{table_name:"profiles",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"first_name",type:"varchar",length:100,notNull:!0},{name:"last_name",type:"varchar",length:100,notNull:!0}],indexes:[{columns:["user_id"],unique:!0},{columns:["first_name","last_name"]}]},{table_name:"roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500}],indexes:[{columns:["name"],unique:!0}]},{table_name:"claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"action",type:"varchar",length:100,notNull:!0},{name:"description",type:"varchar",length:500},{name:"path",type:"varchar",length:200,notNull:!0},{name:"method",type:"varchar",length:10,notNull:!0},{name:"policy",type:"jsonb"}],indexes:[{columns:["action"],unique:!0},{columns:["path","method"]}]},{table_name:"user_roles",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}}],indexes:[{columns:["user_id"]},{columns:["role_id"]}],constraints:{unique:[{name:"unique_user_role",columns:["user_id","role_id"]}]}},{table_name:"role_claims",feature_set:["authentication","authorization"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"role_id",type:"uuid",notNull:!0,references:{table:"roles",column:"id",onDelete:"cascade"}},{name:"claim_id",type:"uuid",notNull:!0,references:{table:"claims",column:"id",onDelete:"cascade"}},{name:"scope",type:"text"}],indexes:[{columns:["role_id"]},{columns:["claim_id"]},{columns:["role_id","claim_id","scope"]}]},{table_name:"files",feature_set:["storage"],add_base_columns:!0,is_form_data:!0,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"original_name",type:"varchar",length:255,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["image","document","video","audio","profile_picture"]},{name:"path",type:"varchar",length:500,notNull:!0},{name:"size",type:"bigint",mode:"number",notNull:!0},{name:"mime_type",type:"varchar",length:100,notNull:!0},{name:"extension",type:"varchar",length:10,notNull:!0},{name:"uploaded_by",type:"uuid",references:{table:"users",column:"id"}}],indexes:[{columns:["type"]},{columns:["uploaded_by"]},{columns:["size"]}]},{table_name:"addresses",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"street",type:"varchar",length:255},{name:"city",type:"varchar",length:100},{name:"state",type:"varchar",length:50},{name:"zip",type:"varchar",length:20},{name:"country",type:"varchar",length:50,default:"US"},{name:"latitude",type:"decimal",precision:10,scale:8},{name:"longitude",type:"decimal",precision:11,scale:8},{name:"neighborhood",type:"varchar",length:100},{name:"apartment",type:"varchar",length:50},{name:"province",type:"varchar",length:100},{name:"district",type:"varchar",length:100},{name:"type",type:"varchar",length:50}],indexes:[{columns:["city","state"]},{columns:["latitude","longitude"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"phones",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!0,columns:[{name:"owner_type",type:"varchar",length:50,notNull:!0,enumValues:["user","company","contact"]},{name:"owner_id",type:"uuid",notNull:!0},{name:"name",type:"varchar",length:100,notNull:!0},{name:"type",type:"varchar",length:50,enumValues:["mobile","office","fax"]},{name:"number",type:"varchar",length:20,notNull:!0},{name:"country_code",type:"varchar",length:10,notNull:!0,default:"+1"},{name:"extension",type:"varchar",length:10}],indexes:[{columns:["number"]},{columns:["type"]},{columns:["owner_type","owner_id"]}]},{table_name:"notifications",feature_set:["notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0},{name:"title",type:"varchar",length:255,notNull:!0},{name:"body",type:"varchar",length:1000},{name:"entity_name",type:"varchar",length:100},{name:"entity_id",type:"uuid"},{name:"type",type:"varchar",length:50,notNull:!0,default:"system",enumValues:["verification","system","custom"]},{name:"source",type:"varchar",length:100},{name:"is_seen",type:"boolean",notNull:!0,default:!1},{name:"seen_at",type:"timestamptz"}],indexes:[{columns:["user_id","created_at"]},{columns:["is_seen"]},{columns:["type"]},{columns:["user_id","type","is_seen"]}]},{table_name:"tenants",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"subdomain",type:"varchar",length:100,notNull:!0,unique:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0,unique:!0},{name:"company_id",type:"uuid",notNull:!0},{name:"company_name",type:"varchar",length:255},{name:"god_admin_email",type:"varchar",length:255,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"provisioning"},{name:"plan",type:"varchar",length:50,default:"free"},{name:"domain",type:"varchar",length:255},{name:"settings",type:"jsonb",default:"{}"},{name:"trusted_sources",type:"jsonb",default:"[]"},{name:"max_users",type:"integer"},{name:"provisioned_at",type:"timestamptz"},{name:"suspended_at",type:"timestamptz"},{name:"suspended_reason",type:"text"}],indexes:[{columns:["status"]}]},{table_name:"tenant_events",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"event_data",type:"jsonb",default:"{}"},{name:"performed_by",type:"varchar",length:255},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["tenant_id"]},{columns:["event_type"]}]},{table_name:"tenant_features",feature_set:["multi-tenant"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:[],columns:[{name:"tenant_id",type:"uuid",notNull:!0,references:{table:"tenants",column:"id",onDelete:"cascade"}},{name:"feature_name",type:"varchar",length:100,notNull:!0},{name:"enabled",type:"boolean",notNull:!0,default:!0},{name:"config",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id","feature_name"],unique:!0},{columns:["feature_name"]}]},{table_name:"domain_hostnames",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | organization | user | external"},{name:"owner_id",type:"uuid",notNull:!0,comment:"Product-defined owner reference (e.g. band id, org id)"},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"cascade"},comment:"Tenant this hostname routes to; null for non-tenant owners"},{name:"schema_name",type:"varchar",length:100,comment:"Resolved tenant schema for routing"},{name:"hostname",type:"varchar",length:255,notNull:!0,comment:"Original hostname as entered by the user"},{name:"normalized_hostname",type:"varchar",length:255,notNull:!0,unique:!0,comment:"Lowercased, punycode, port-stripped hostname used for matching"},{name:"hostname_kind",type:"varchar",length:20,notNull:!0,default:"apex",comment:"platform_subdomain | apex | www | subdomain"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending_verification",comment:"draft | pending_verification | verifying | active | failed | disabled | archived"},{name:"routing_status",type:"varchar",length:20,notNull:!0,default:"inactive",comment:"inactive | pending | active | failed"},{name:"certificate_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"not_required | pending | active | failed"},{name:"verification_status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"provider",type:"varchar",length:30,notNull:!0,default:"manual_dns",comment:"manual_dns | cloudflare_for_saas | cloudflare_registrar"},{name:"provider_hostname_id",type:"varchar",length:255},{name:"dns_target",type:"varchar",length:255,comment:"CNAME / A target the customer must point at"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"redirect_to_hostname_id",type:"uuid",comment:"When set, this hostname 301-redirects to another hostname (e.g. apex to www)"},{name:"activated_at",type:"timestamptz"},{name:"disabled_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["tenant_id"]},{columns:["schema_name"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["provider","provider_hostname_id"]}]},{table_name:"domain_registrations",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Domains",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant"},{name:"owner_id",type:"uuid",notNull:!0},{name:"tenant_id",type:"uuid",references:{table:"tenants",column:"id",onDelete:"set null"}},{name:"requested_domain",type:"varchar",length:255,notNull:!0},{name:"registered_domain",type:"varchar",length:255},{name:"provider",type:"varchar",length:30,notNull:!0,default:"cloudflare_registrar"},{name:"provider_registration_id",type:"varchar",length:255},{name:"registrant_owner_type",type:"varchar",length:20,notNull:!0,default:"customer",comment:"customer | platform"},{name:"registrant_contact_snapshot",type:"jsonb",default:"{}"},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",comment:"draft | availability_checked | awaiting_payment | registering | active | failed | transfer_requested | transferred_out | cancelled | expired"},{name:"price_amount",type:"numeric",precision:12,scale:2},{name:"currency",type:"varchar",length:10},{name:"renewal_date",type:"timestamptz"},{name:"auto_renew",type:"boolean",notNull:!0,default:!0},{name:"terms_version",type:"varchar",length:50},{name:"terms_accepted_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["tenant_id"]},{columns:["status"]}]},{table_name:"domain_verification_challenges",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"challenge_type",type:"varchar",length:30,notNull:!0,default:"ownership_validation",comment:"hostname_validation | certificate_validation | ownership_validation"},{name:"record_type",type:"varchar",length:10,notNull:!0,default:"TXT",comment:"TXT | CNAME | A | AAAA | HTTP"},{name:"record_name",type:"varchar",length:255,notNull:!0},{name:"record_value",type:"text",notNull:!0},{name:"expected_target",type:"varchar",length:255},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | verified | failed | expired"},{name:"expires_at",type:"timestamptz"},{name:"verified_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["status"]}]},{table_name:"domain_provider_records",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",notNull:!0,references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:30,notNull:!0},{name:"provider_resource_type",type:"varchar",length:30,notNull:!0,comment:"custom_hostname | certificate | validation | zone | dns_record | registration"},{name:"provider_resource_id",type:"varchar",length:255},{name:"provider_status",type:"varchar",length:50},{name:"last_synced_at",type:"timestamptz"},{name:"raw_status",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["provider","provider_resource_id"]}]},{table_name:"domain_events",feature_set:["domains"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Domains",columns:[{name:"domain_hostname_id",type:"uuid",references:{table:"domainHostnames",column:"id",onDelete:"cascade"}},{name:"domain_registration_id",type:"uuid",references:{table:"domainRegistrations",column:"id",onDelete:"cascade"}},{name:"event_type",type:"varchar",length:50,notNull:!0},{name:"actor_type",type:"varchar",length:20},{name:"actor_id",type:"varchar",length:255},{name:"message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["domain_hostname_id"]},{columns:["event_type"]}]},{table_name:"verifications",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"requirement_id",type:"uuid",notNull:!0,references:{table:"verificationRequirements",column:"id"}},{name:"verifier_id",type:"uuid",notNull:!0,references:{table:"users",column:"id"}},{name:"signature_id",type:"uuid",references:{table:"files",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"decision",type:"varchar",length:50,notNull:!0,default:"pending",enumValues:["approved","rejected","pending"]},{name:"reason",type:"text"},{name:"diff",type:"jsonb"}],indexes:[{columns:["instance_id"]},{columns:["requirement_id"]},{columns:["verifier_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","step_order"]},{columns:["decision"]}]},{table_name:"verificationRequirements",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"instance_id",type:"uuid",notNull:!0,references:{table:"verificationInstances",column:"id",onDelete:"cascade"}},{name:"step_node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_node_id",type:"varchar",length:100,notNull:!0},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","rejected"]}],indexes:[{columns:["instance_id"]},{columns:["instance_id","step_order"]},{columns:["entity_name","entity_id"]},{columns:["verifier_user_id"]},{columns:["status"]}]},{table_name:"verificationFlows",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"trigger_on",type:"varchar",length:50,notNull:!0,default:"update",enumValues:["create","update","delete","manual"]},{name:"trigger_fields",type:"jsonb"},{name:"is_draft",type:"boolean",notNull:!0,default:!0},{name:"published_at",type:"timestamptz"},{name:"viewport",type:"jsonb"}],indexes:[{columns:["entity_name"]},{columns:["entity_name","trigger_on"]},{columns:["is_draft"]}]},{table_name:"verificationSteps",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"node_type",type:"varchar",length:50,notNull:!0,default:"step",enumValues:["step","verifier","notification"]},{name:"step_order",type:"integer",notNull:!0,default:1},{name:"name",type:"varchar",length:255},{name:"description",type:"text"},{name:"position_x",type:"numeric",notNull:!0,default:0},{name:"position_y",type:"numeric",notNull:!0,default:0},{name:"width",type:"numeric"},{name:"height",type:"numeric"},{name:"style",type:"jsonb"},{name:"data",type:"jsonb"}],indexes:[{columns:["flow_id"]},{columns:["entity_name"]},{columns:["flow_id","node_id"],unique:!0},{columns:["entity_name","step_order"]}]},{table_name:"verificationEdges",feature_set:["authentication","verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"edge_id",type:"varchar",length:100,notNull:!0},{name:"source_node_id",type:"varchar",length:100,notNull:!0},{name:"target_node_id",type:"varchar",length:100,notNull:!0},{name:"source_handle",type:"varchar",length:50},{name:"target_handle",type:"varchar",length:50},{name:"edge_type",type:"varchar",length:50,default:"default",enumValues:["default","conditional","success","failure"]},{name:"label",type:"varchar",length:255},{name:"condition",type:"jsonb"},{name:"style",type:"jsonb"},{name:"animated",type:"boolean",default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","edge_id"],unique:!0},{columns:["source_node_id"]},{columns:["target_node_id"]}]},{table_name:"verificationNotificationRules",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"trigger",type:"varchar",length:50,notNull:!0,enumValues:["on_flow_started","on_step_reached","on_approved","on_rejected","on_flow_completed"]},{name:"title_template",type:"varchar",length:255},{name:"body_template",type:"text"},{name:"starts_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["trigger"]}]},{table_name:"verificationNotificationRecipients",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"recipient_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role","all_verifiers","step_verifier","entity_creator"]},{name:"recipient_user_id",type:"uuid"},{name:"recipient_role",type:"varchar",length:100}],indexes:[{columns:["rule_id"]},{columns:["recipient_type"]}]},{table_name:"verificationVerifierConfigs",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id",onDelete:"cascade"}},{name:"node_id",type:"varchar",length:100,notNull:!0},{name:"verifier_type",type:"varchar",length:30,notNull:!0,enumValues:["user","role"]},{name:"verifier_user_id",type:"uuid"},{name:"verifier_role",type:"varchar",length:100},{name:"require_signature",type:"boolean",notNull:!0,default:!1},{name:"all_must_approve",type:"boolean",notNull:!0,default:!1}],indexes:[{columns:["flow_id"]},{columns:["flow_id","node_id"],unique:!0},{columns:["verifier_type"]}]},{table_name:"verificationInstances",feature_set:["verification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"flow_id",type:"uuid",notNull:!0,references:{table:"verificationFlows",column:"id"}},{name:"entity_name",type:"varchar",length:100,notNull:!0},{name:"entity_id",type:"uuid",notNull:!0},{name:"started_by",type:"uuid",references:{table:"users",column:"id"}},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","completed","rejected","cancelled"]},{name:"current_step_order",type:"integer",notNull:!0,default:1},{name:"started_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"completed_at",type:"timestamptz"}],indexes:[{columns:["flow_id"]},{columns:["entity_name","entity_id"]},{columns:["entity_name","entity_id","status"]},{columns:["status"]},{columns:["started_by"]}]},{table_name:"verificationNotificationChannels",feature_set:["verification","notification"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"rule_id",type:"uuid",notNull:!0,references:{table:"verificationNotificationRules",column:"id",onDelete:"cascade"}},{name:"channel",type:"varchar",length:30,notNull:!0,enumValues:["portal","email","sms","telegram","webhook"]}],indexes:[{columns:["rule_id"]},{columns:["rule_id","channel"],unique:!0},{columns:["channel"]}]},{table_name:"user_cohorts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"created_by",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"expires_at",type:"timestamptz"},{name:"user_count",type:"integer",notNull:!0,default:0},{name:"metadata",type:"jsonb",default:"{}"}]},{table_name:"user_sessions",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"refresh_token_hash",type:"varchar",length:255},{name:"device_fingerprint",type:"varchar",length:255},{name:"device_name",type:"varchar",length:100},{name:"device_type",type:"varchar",length:50,enumValues:["desktop","mobile","tablet","unknown"]},{name:"browser_name",type:"varchar",length:50},{name:"browser_version",type:"varchar",length:20},{name:"os_name",type:"varchar",length:50},{name:"os_version",type:"varchar",length:20},{name:"ip_address",type:"varchar",length:45,notNull:!0},{name:"location_country",type:"varchar",length:100},{name:"location_city",type:"varchar",length:100},{name:"location_coordinates",type:"varchar",length:50},{name:"last_activity_at",type:"timestamptz",notNull:!0,defaultRaw:"now()"},{name:"expires_at",type:"timestamptz",notNull:!1},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:100,enumValues:["user_logout","user_revoked","admin_revoked","security_concern","password_changed","expired","replaced"]},{name:"is_current",type:"boolean",notNull:!0,default:!1},{name:"login_method",type:"varchar",length:50,enumValues:["password","oauth_google","oauth_github","oauth_microsoft","magic_link","sso","api_key"]},{name:"remember_me",type:"boolean",notNull:!0,default:!1},{name:"trust_score",type:"integer",default:100},{name:"approval_status",type:"varchar",length:20,default:"approved",enumValues:["approved","pending","rejected"]},{name:"approval_token",type:"varchar",length:64},{name:"approval_requested_at",type:"timestamptz"},{name:"approval_responded_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["token_hash"],unique:!0},{columns:["refresh_token_hash"]},{columns:["user_id","is_active"]},{columns:["expires_at"]},{columns:["device_fingerprint"]},{columns:["ip_address"]},{columns:["last_activity_at"]},{columns:["approval_status"]},{columns:["approval_token"]}]},{table_name:"trusted_devices",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:64,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",enumValues:["pending","trusted","revoked"]},{name:"origin_session_id",type:"uuid"},{name:"label",type:"varchar",length:120},{name:"device_fingerprint",type:"varchar",length:255},{name:"first_seen_ip",type:"varchar",length:45},{name:"last_seen_ip",type:"varchar",length:45},{name:"last_seen_at",type:"timestamptz"},{name:"expires_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:30,enumValues:["user_revoked","password_reset","logout","admin_revoked","expired","replaced"]}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","status"]},{columns:["origin_session_id"]},{columns:["expires_at"]}]},{table_name:"password_reset_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"magic_link_tokens",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:["email"],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"email",type:"varchar",length:255,notNull:!0},{name:"token_hash",type:"varchar",length:255,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"used_at",type:"timestamptz"}],indexes:[{columns:["token_hash"],unique:!0},{columns:["user_id"]},{columns:["email"]},{columns:["expires_at"]}]},{table_name:"webauthn_credentials",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"credential_id",type:"text",notNull:!0},{name:"public_key",type:"text",notNull:!0},{name:"counter",type:"bigint",mode:"number",notNull:!0,defaultValue:0},{name:"transports",type:"jsonb"},{name:"device_type",type:"varchar",length:32},{name:"backed_up",type:"boolean",notNull:!0,defaultValue:!1},{name:"aaguid",type:"varchar",length:64},{name:"authenticator_attachment",type:"varchar",length:32},{name:"nickname",type:"varchar",length:128},{name:"last_used_at",type:"timestamptz"},{name:"revoked_at",type:"timestamptz"}],indexes:[{columns:["credential_id"],unique:!0},{columns:["user_id"]}]},{table_name:"webauthn_challenges",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,group_name:"Authentication",requires:[],available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id",onDelete:"cascade"}},{name:"challenge",type:"text",notNull:!0},{name:"challenge_type",type:"varchar",length:32,notNull:!0},{name:"expires_at",type:"timestamptz",notNull:!0},{name:"consumed_at",type:"timestamptz"}],indexes:[{columns:["challenge"],unique:!0},{columns:["user_id"]},{columns:["expires_at"]}]},{table_name:"audit_logs",feature_set:["audit"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"entity_id",type:"uuid"},{name:"entity_name",type:"text",notNull:!0},{name:"operation_type",type:"text",notNull:!0},{name:"user_id",type:"uuid"},{name:"ip_address",type:"text"},{name:"user_agent",type:"text"},{name:"summary",type:"text"},{name:"severity",type:"text",default:"info"},{name:"category",type:"text"},{name:"occurrence_count",type:"integer",default:1},{name:"last_occurrence_at",type:"timestamp"},{name:"old_values",type:"jsonb"},{name:"new_values",type:"jsonb"},{name:"created_at",type:"timestamp",notNull:!0,defaultRaw:"now()"},{name:"path",type:"text"},{name:"query",type:"text"}],indexes:[{columns:["entity_id"]},{columns:["entity_name"]},{columns:["user_id"]},{columns:["created_at"]},{columns:["severity"]},{columns:["category"]}]},{table_name:"monitoring_metrics",feature_set:["monitoring"],add_base_columns:!1,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","DELETE","PATCH","TOGGLE","VERIFICATION"],columns:[{name:"id",type:"uuid",primaryKey:!0,defaultRaw:"gen_random_uuid()"},{name:"metric_type",type:"text",notNull:!0},{name:"metric_name",type:"text",notNull:!0},{name:"value",type:"doublePrecision",notNull:!0},{name:"tags",type:"jsonb"},{name:"recorded_at",type:"timestamp",notNull:!0}],indexes:[{columns:["metric_type"]},{columns:["metric_name"]},{columns:["recorded_at"]}]},{table_name:"oauth_accounts",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0,enumValues:["google","github","microsoft","discord","facebook","twitter","apple","custom"]},{name:"provider_account_id",type:"varchar",length:255,notNull:!0},{name:"provider_email",type:"varchar",length:255},{name:"provider_name",type:"varchar",length:255},{name:"provider_avatar_url",type:"text"},{name:"access_token",type:"text"},{name:"refresh_token",type:"text"},{name:"token_expires_at",type:"timestamp"},{name:"scope",type:"text"},{name:"raw_profile",type:"jsonb"},{name:"is_primary",type:"boolean",notNull:!0,default:!1},{name:"last_used_at",type:"timestamp"}],indexes:[{columns:["user_id"]},{columns:["provider","provider_account_id"],unique:!0},{columns:["provider_email"]},{columns:["user_id","provider"]}],constraints:{unique:[{name:"unique_provider_account",columns:["provider","provider_account_id"]}]}},{table_name:"api_keys",feature_set:["authentication"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH"],bulk_endpoints_enabled:!1,columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"key_hash",type:"varchar",length:255,notNull:!0},{name:"key_preview",type:"varchar",length:20,notNull:!0},{name:"owner_type",type:"varchar",length:30,notNull:!0,default:"personal",enumValues:["personal","application"]},{name:"application_name",type:"varchar",length:255},{name:"allowed_roles",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_claims",type:"jsonb",notNull:!0,default:"[]"},{name:"allowed_scopes",type:"jsonb",notNull:!0,default:"[]"},{name:"expires_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"},{name:"last_used_ip",type:"varchar",length:45},{name:"usage_count",type:"integer",notNull:!0,default:0},{name:"revoked_at",type:"timestamptz"},{name:"revoked_reason",type:"varchar",length:255}],indexes:[{columns:["key_hash"],unique:!0},{columns:["user_id"]},{columns:["user_id","is_active"]},{columns:["owner_type"]},{columns:["expires_at"]},{columns:["last_used_at"]}]},{table_name:"backup_logs",feature_set:["backup"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["main","all"],excluded_schemas:[],excluded_methods:["PUT","PATCH"],columns:[{name:"backup_name",type:"varchar",length:255,notNull:!0},{name:"file_name",type:"varchar",length:500,notNull:!0},{name:"schema_name",type:"varchar",length:100,notNull:!0},{name:"format",type:"varchar",length:20,notNull:!0,default:"json"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending"},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual"},{name:"size_bytes",type:"integer"},{name:"table_count",type:"integer"},{name:"row_count",type:"integer"},{name:"included_tables",type:"jsonb",default:"[]"},{name:"excluded_tables",type:"jsonb",default:"[]"},{name:"error_message",type:"text"},{name:"started_at",type:"timestamp"},{name:"completed_at",type:"timestamp"},{name:"performed_by",type:"varchar",length:255},{name:"cron_expression",type:"varchar",length:100},{name:"retention_days",type:"integer"}],indexes:[{columns:["schema_name"]},{columns:["status"]},{columns:["trigger"]},{columns:["created_at"]}]},{table_name:"payment_transactions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"order_id",type:"varchar",length:255},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_transaction_id",type:"varchar",length:255},{name:"provider_payment_id",type:"varchar",length:255},{name:"payment_method",type:"varchar",length:50},{name:"amount",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","processing","completed","failed","refunded","partially_refunded","cancelled"]},{name:"status_code",type:"integer"},{name:"status_message",type:"text"},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"installment",type:"integer",default:1},{name:"is_three_d_secure",type:"boolean",default:!1},{name:"provider_response",type:"jsonb",default:"{}"},{name:"metadata",type:"jsonb",default:"{}"},{name:"refunded_amount",type:"numeric",precision:12,scale:2,default:0},{name:"refunded_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failed_at",type:"timestamptz"},{name:"ip_address",type:"varchar",length:45}],indexes:[{columns:["user_id"]},{columns:["order_id"]},{columns:["provider"]},{columns:["provider_payment_id"]},{columns:["status"]},{columns:["user_id","status"]}]},{table_name:"payment_methods",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"type",type:"varchar",length:30,notNull:!0,default:"card",enumValues:["card","bank_account","wallet"]},{name:"alias",type:"varchar",length:100},{name:"card_last_four",type:"varchar",length:4},{name:"card_type",type:"varchar",length:50},{name:"card_association",type:"varchar",length:50},{name:"card_family",type:"varchar",length:100},{name:"card_bank_name",type:"varchar",length:100},{name:"provider_card_user_key",type:"varchar",length:255},{name:"provider_card_token",type:"varchar",length:255},{name:"bin_number",type:"varchar",length:8},{name:"is_default",type:"boolean",default:!1},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["user_id","is_default"]},{columns:["provider_card_user_key"]}]},{table_name:"payment_webhook_logs",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT","PATCH","DELETE"],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"event_type",type:"varchar",length:100,notNull:!0},{name:"provider_payment_id",type:"varchar",length:255},{name:"raw_payload",type:"jsonb",notNull:!0},{name:"processed",type:"boolean",default:!1},{name:"processing_result",type:"jsonb"},{name:"error_message",type:"text"},{name:"ip_address",type:"varchar",length:45},{name:"idempotency_key",type:"varchar",length:255}],indexes:[{columns:["provider"]},{columns:["event_type"]},{columns:["provider_payment_id"]},{columns:["processed"]},{columns:["idempotency_key"],unique:!0}]},{table_name:"payment_sub_merchants",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_sub_merchant_key",type:"varchar",length:255},{name:"external_id",type:"varchar",length:255},{name:"type",type:"varchar",length:50,notNull:!0,default:"personal",enumValues:["personal","private_company","limited_or_joint_stock_company"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","active","suspended","rejected"]},{name:"name",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"gsm_number",type:"varchar",length:20},{name:"address",type:"text"},{name:"iban",type:"varchar",length:50},{name:"contact_name",type:"varchar",length:100},{name:"contact_surname",type:"varchar",length:100},{name:"identity_number",type:"varchar",length:20},{name:"tax_office",type:"varchar",length:100},{name:"tax_number",type:"varchar",length:20},{name:"legal_company_title",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,default:"TRY"},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_sub_merchant_key"]},{columns:["external_id"]},{columns:["status"]},{columns:["email"]}]},{table_name:"payment_commission_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"transaction_id",type:"uuid",notNull:!0,references:{table:"payment_transactions",column:"id",onDelete:"cascade"}},{name:"sub_merchant_id",type:"uuid",notNull:!0,references:{table:"payment_sub_merchants",column:"id"}},{name:"basket_item_id",type:"varchar",length:255},{name:"item_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"sub_merchant_price",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"platform_commission",type:"numeric",precision:12,scale:2,notNull:!0,default:0},{name:"commission_rate",type:"numeric",precision:5,scale:2,default:0},{name:"provider_split_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"TRY"},{name:"status",type:"varchar",length:30,notNull:!0,default:"pending",enumValues:["pending","approved","disapproved","refunded"]},{name:"approved_at",type:"timestamptz"},{name:"disapproved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["transaction_id"]},{columns:["sub_merchant_id"]},{columns:["status"]},{columns:["transaction_id","sub_merchant_id"]},{columns:["provider_split_id"]}]},{table_name:"payment_products",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_product_id",type:"varchar",length:255},{name:"name",type:"varchar",length:255,notNull:!0},{name:"description",type:"text"},{name:"type",type:"varchar",length:30,default:"service",enumValues:["service","good"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived","draft"]},{name:"images",type:"jsonb",default:"[]"},{name:"unit_label",type:"varchar",length:50},{name:"url",type:"varchar",length:500},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider"]},{columns:["provider_product_id"]},{columns:["name"]},{columns:["status"]},{columns:["type"]}]},{table_name:"payment_prices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"product_id",type:"uuid",notNull:!0,references:{table:"payment_products",column:"id",onDelete:"cascade"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_price_id",type:"varchar",length:255},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"unit_amount",type:"integer",notNull:!0,default:0},{name:"unit_amount_decimal",type:"varchar",length:30},{name:"type",type:"varchar",length:30,notNull:!0,default:"one_time",enumValues:["one_time","recurring"]},{name:"billing_scheme",type:"varchar",length:30,default:"per_unit",enumValues:["per_unit","tiered"]},{name:"nickname",type:"varchar",length:255},{name:"recurring_interval",type:"varchar",length:20,enumValues:["day","week","month","year"]},{name:"recurring_interval_count",type:"integer",default:1},{name:"recurring_usage_type",type:"varchar",length:20,default:"licensed",enumValues:["licensed","metered"]},{name:"recurring_aggregate_usage",type:"varchar",length:30,enumValues:["sum","last_during_period","last_ever","max"]},{name:"transform_quantity_divide_by",type:"integer"},{name:"transform_quantity_round",type:"varchar",length:10,enumValues:["up","down"]},{name:"status",type:"varchar",length:30,notNull:!0,default:"active",enumValues:["active","archived"]},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["product_id"]},{columns:["provider"]},{columns:["provider_price_id"]},{columns:["type"]},{columns:["currency"]},{columns:["status"]},{columns:["product_id","status"]}]},{table_name:"payment_customers",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],columns:[{name:"user_id",type:"uuid",references:{table:"users",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_customer_id",type:"varchar",length:255,notNull:!0},{name:"email",type:"varchar",length:255,notNull:!0},{name:"name",type:"varchar",length:255},{name:"phone",type:"varchar",length:50},{name:"description",type:"text"},{name:"address",type:"jsonb",default:"{}"},{name:"tax_id_type",type:"varchar",length:50},{name:"tax_id_value",type:"varchar",length:100},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["user_id"]},{columns:["provider"]},{columns:["provider_customer_id"]},{columns:["email"]},{columns:["user_id","provider"],unique:!0}]},{table_name:"payment_subscriptions",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_subscription_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"incomplete",enumValues:["active","past_due","unpaid","canceled","incomplete","incomplete_expired","trialing","paused"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"current_period_start",type:"timestamptz"},{name:"current_period_end",type:"timestamptz"},{name:"cancel_at_period_end",type:"boolean",default:!1},{name:"canceled_at",type:"timestamptz"},{name:"trial_start",type:"timestamptz"},{name:"trial_end",type:"timestamptz"},{name:"items",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["provider"]},{columns:["provider_subscription_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"payment_invoices",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["DELETE"],columns:[{name:"customer_id",type:"uuid",notNull:!0,references:{table:"payment_customers",column:"id"}},{name:"subscription_id",type:"uuid",references:{table:"payment_subscriptions",column:"id"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_invoice_id",type:"varchar",length:255},{name:"status",type:"varchar",length:30,notNull:!0,default:"draft",enumValues:["draft","open","paid","uncollectible","void"]},{name:"collection_method",type:"varchar",length:30,default:"charge_automatically",enumValues:["charge_automatically","send_invoice"]},{name:"currency",type:"varchar",length:10,notNull:!0,default:"USD"},{name:"amount_due",type:"integer",default:0},{name:"amount_paid",type:"integer",default:0},{name:"amount_remaining",type:"integer",default:0},{name:"description",type:"text"},{name:"hosted_invoice_url",type:"varchar",length:1000},{name:"invoice_pdf",type:"varchar",length:1000},{name:"due_date",type:"timestamptz"},{name:"days_until_due",type:"integer"},{name:"period_start",type:"timestamptz"},{name:"period_end",type:"timestamptz"},{name:"paid_at",type:"timestamptz"},{name:"voided_at",type:"timestamptz"},{name:"lines",type:"jsonb",default:"[]"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["customer_id"]},{columns:["subscription_id"]},{columns:["provider"]},{columns:["provider_invoice_id"]},{columns:["status"]},{columns:["customer_id","status"]}]},{table_name:"chat_conversations",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"type",type:"varchar",length:20,notNull:!0,default:"direct",enumValues:["direct","group"]},{name:"title",type:"varchar",length:255},{name:"description",type:"text"},{name:"avatar_file_id",type:"uuid"},{name:"direct_key",type:"varchar",length:255},{name:"last_message_at",type:"timestamptz"},{name:"last_message_preview",type:"varchar",length:500},{name:"last_message_sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}}],indexes:[{columns:["direct_key"],unique:!0},{columns:["type"]},{columns:["last_message_at"]}]},{table_name:"chat_participants",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"user_id",type:"uuid",notNull:!0,references:{table:"users",column:"id",onDelete:"cascade"}},{name:"role",type:"varchar",length:20,notNull:!0,default:"member",enumValues:["member","admin","owner"]},{name:"last_read_message_id",type:"uuid"},{name:"last_read_at",type:"timestamptz"},{name:"unread_count",type:"integer",notNull:!0,default:0},{name:"muted",type:"boolean",notNull:!0,default:!1},{name:"muted_until",type:"timestamptz"},{name:"notifications_enabled",type:"boolean",notNull:!0,default:!0},{name:"left_at",type:"timestamptz"}],indexes:[{columns:["user_id"]},{columns:["conversation_id"]}],constraints:{unique:[{name:"unique_conversation_participant",columns:["conversation_id","user_id"]}]}},{table_name:"chat_messages",feature_set:["authentication","chat"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"sender_id",type:"uuid",references:{table:"users",column:"id",onDelete:"set null"}},{name:"content",type:"text"},{name:"content_type",type:"varchar",length:20,notNull:!0,default:"text",enumValues:["text","image","file","video","audio","system"]},{name:"reply_to_id",type:"uuid",references:{table:"chat_messages",column:"id",onDelete:"set null"}},{name:"metadata",type:"jsonb",default:"{}"},{name:"client_message_id",type:"varchar",length:100},{name:"edited_at",type:"timestamptz"},{name:"deleted_at",type:"timestamptz"}],indexes:[{columns:["conversation_id","created_at"]},{columns:["sender_id"]},{columns:["reply_to_id"]}]},{table_name:"chat_message_attachments",feature_set:["authentication","chat","storage"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE","GET"],columns:[{name:"message_id",type:"uuid",notNull:!0,references:{table:"chat_messages",column:"id",onDelete:"cascade"}},{name:"conversation_id",type:"uuid",notNull:!0,references:{table:"chat_conversations",column:"id",onDelete:"cascade"}},{name:"file_id",type:"uuid",notNull:!0,references:{table:"files",column:"id",onDelete:"cascade"}},{name:"kind",type:"varchar",length:20,notNull:!0,default:"file",enumValues:["image","video","audio","file"]},{name:"original_name",type:"varchar",length:255},{name:"mime_type",type:"varchar",length:100},{name:"size",type:"bigint",mode:"number"},{name:"width",type:"integer"},{name:"height",type:"integer"},{name:"duration",type:"integer"}],indexes:[{columns:["message_id"]},{columns:["conversation_id"]},{columns:["file_id"]}]},{table_name:"payment_splits",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller",comment:"seller | platform | tenant | user"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"gross_amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"provider_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"platform_fee_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"reserve_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"net_payable_amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"available_for_payout_at",type:"timestamptz"},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | available | payout_requested | paid | held | refunded | disputed | cancelled"},{name:"source_type",type:"varchar",length:50},{name:"source_id",type:"varchar",length:255},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]},{columns:["transaction_id"]}]},{table_name:"payment_ledger_entries",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"account",type:"varchar",length:40,notNull:!0,comment:"platform_revenue | provider_fee | seller_payable | reserve | refund_liability | dispute_liability | payout_in_transit | payout_completed"},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"direction",type:"varchar",length:6,notNull:!0,comment:"debit | credit"},{name:"amount",type:"bigint",mode:"number",notNull:!0,comment:"Minor units"},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"entry_type",type:"varchar",length:40,notNull:!0,comment:"split | refund | payout | reserve_hold | reserve_release | dispute | adjustment"},{name:"reference_type",type:"varchar",length:50},{name:"reference_id",type:"varchar",length:255},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"description",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["account"]},{columns:["owner_type","owner_id"]},{columns:["entry_type"]},{columns:["reference_type","reference_id"]}]},{table_name:"payment_settlement_policies",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"tenant",comment:"tenant | seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"default_delay_days",type:"integer",notNull:!0,default:7},{name:"new_seller_delay_days",type:"integer",notNull:!0,default:14},{name:"reserve_rate",type:"numeric",precision:5,scale:4,notNull:!0,default:0,comment:"Fraction 0..1 held as reserve"},{name:"reserve_days",type:"integer",notNull:!0,default:0},{name:"minimum_payout_amount",type:"bigint",mode:"number",notNull:!0,default:0},{name:"currency",type:"varchar",length:10},{name:"early_payout_enabled",type:"boolean",notNull:!0,default:!1},{name:"status",type:"varchar",length:20,notNull:!0,default:"active"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"],unique:!0}]},{table_name:"payment_reserves",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"owner_id",type:"uuid",notNull:!0},{name:"split_id",type:"uuid",references:{table:"paymentSplits",column:"id",onDelete:"set null"}},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"reason",type:"varchar",length:30,notNull:!0,default:"refund_window",comment:"refund_window | chargeback_risk | new_seller | manual_hold | dispute | compliance_review"},{name:"status",type:"varchar",length:20,notNull:!0,default:"held",comment:"held | released | consumed | cancelled"},{name:"release_at",type:"timestamptz"},{name:"released_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["owner_type","owner_id"]},{columns:["status"]},{columns:["release_at"]}]},{table_name:"payment_payout_requests",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],group_name:"Payments Marketplace",columns:[{name:"recipient_owner_type",type:"varchar",length:20,notNull:!0,default:"seller"},{name:"recipient_owner_id",type:"uuid",notNull:!0},{name:"amount",type:"bigint",mode:"number",notNull:!0},{name:"currency",type:"varchar",length:10,notNull:!0},{name:"status",type:"varchar",length:20,notNull:!0,default:"pending",comment:"pending | approved | rejected | processing | completed | failed | cancelled"},{name:"provider",type:"varchar",length:50},{name:"provider_payout_id",type:"varchar",length:255},{name:"provider_transfer_id",type:"varchar",length:255},{name:"destination",type:"varchar",length:255},{name:"requested_by",type:"uuid"},{name:"decided_by",type:"uuid"},{name:"decided_at",type:"timestamptz"},{name:"completed_at",type:"timestamptz"},{name:"failure_reason",type:"text"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["recipient_owner_type","recipient_owner_id"]},{columns:["status"]}]},{table_name:"payment_disputes",feature_set:["payment"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["PUT"],group_name:"Payments Marketplace",columns:[{name:"transaction_id",type:"uuid",references:{table:"paymentTransactions",column:"id",onDelete:"set null"}},{name:"provider",type:"varchar",length:50,notNull:!0},{name:"provider_dispute_id",type:"varchar",length:255},{name:"owner_type",type:"varchar",length:20},{name:"owner_id",type:"uuid"},{name:"amount",type:"bigint",mode:"number"},{name:"currency",type:"varchar",length:10},{name:"reason",type:"varchar",length:100},{name:"status",type:"varchar",length:30,notNull:!0,default:"open",comment:"open | under_review | won | lost | accepted | cancelled"},{name:"evidence_due_at",type:"timestamptz"},{name:"resolved_at",type:"timestamptz"},{name:"metadata",type:"jsonb",default:"{}"}],indexes:[{columns:["provider","provider_dispute_id"]},{columns:["status"]},{columns:["owner_type","owner_id"]},{columns:["transaction_id"]}]},{table_name:"nucleus_secrets",feature_set:["secrets"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["GET","POST","PUT","PATCH","DELETE","TOGGLE"],bulk_endpoints_enabled:!1,group_name:"Secrets",columns:[{name:"scope",type:"varchar",length:200,notNull:!0,comment:"Config dot-path that owns the credential, e.g. authentication.oauth.providers.microsoft"},{name:"key",type:"varchar",length:120,notNull:!0,comment:"Leaf key under that path, e.g. clientSecret"},{name:"value_enc",type:"text",notNull:!0,comment:"AES-256-GCM envelope v1:iv:tag:ciphertext \u2014 never returned by any route"},{name:"previous_enc",type:"text",comment:"Value replaced by the last rotation, retained for one-step rollback"},{name:"preview",type:"varchar",length:80},{name:"kind",type:"varchar",length:30,notNull:!0,default:"text",enumValues:["text","password","json","connection_string","pem"]},{name:"description",type:"varchar",length:500},{name:"version",type:"integer",notNull:!0,default:1},{name:"rotated_at",type:"timestamptz"},{name:"last_used_at",type:"timestamptz"}],indexes:[{columns:["scope","key"],unique:!0},{columns:["scope"]}]},{table_name:"integration_sources",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"name",type:"varchar",length:150,notNull:!0},{name:"slug",type:"varchar",length:150,notNull:!0,comment:"Stable machine name; referenced by exports and by operators in logs"},{name:"base_url",type:"varchar",length:500,notNull:!0,comment:"Any scheme, host and port \u2014 https, plain http, in-cluster DNS, IP. HTTPS is NOT required and must never be enforced: reaching a service inside the same cluster over http is a legitimate deployment."},{name:"description",type:"text"},{name:"enabled",type:"boolean",default:!0},{name:"auth_type",type:"varchar",length:20,notNull:!0,default:"none",enumValues:["none","bearer","api_key","basic","oauth2"]},{name:"auth_token_encrypted",type:"text",sensitive:!0,comment:"Static credential (bearer / api key / basic blob), encrypted at rest"},{name:"auth_token_hint",type:"varchar",length:24},{name:"auth_header_name",type:"varchar",length:80,default:"Authorization"},{name:"auth_query_param",type:"varchar",length:80,comment:"When set, an api_key credential travels as this query parameter instead of a header"},{name:"extra_headers",type:"jsonb",default:{}},{name:"token_url",type:"varchar",length:500},{name:"oauth_grant_type",type:"varchar",length:40,default:"password",enumValues:["password","client_credentials"]},{name:"oauth_client_id",type:"varchar",length:200},{name:"oauth_client_secret_encrypted",type:"text",sensitive:!0},{name:"oauth_client_secret_hint",type:"varchar",length:24},{name:"oauth_username",type:"varchar",length:200},{name:"oauth_password_encrypted",type:"text",sensitive:!0},{name:"oauth_password_hint",type:"varchar",length:24},{name:"oauth_scope",type:"varchar",length:300},{name:"oauth_client_auth",type:"varchar",length:20,default:"basic",enumValues:["basic","body"]},{name:"tls_verify",type:"boolean",notNull:!0,default:!0,comment:"Per-source certificate verification. Turning it off applies to THIS source's connections only \u2014 never to the process, which is what a NODE_TLS_REJECT_UNAUTHORIZED toggle would do."},{name:"timeout_ms",type:"integer",notNull:!0,default:30000},{name:"spec_url",type:"varchar",length:500,comment:"Optional API description document (OpenAPI/Swagger/Postman/Bruno). Discovery is a convenience: every endpoint can always be defined by hand instead."},{name:"spec_format",type:"varchar",length:20,default:"manual",enumValues:["manual","openapi","swagger","postman","bruno","har"]}],constraints:{unique:[{name:"uniq_integration_source_slug",columns:["slug"]}]},indexes:[{columns:["enabled"]}]},{table_name:"integration_endpoints",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"source_id",type:"uuid",notNull:!0,references:{table:"integrationSources",column:"id",onDelete:"cascade"}},{name:"tag",type:"varchar",length:120,notNull:!0},{name:"name",type:"varchar",length:200},{name:"method",type:"varchar",length:10,notNull:!0,default:"GET",enumValues:["GET","POST","PUT","PATCH","DELETE"]},{name:"path",type:"varchar",length:500,notNull:!0,comment:"Appended to the source base URL. May carry {brace} or :colon path tokens, whose values come from param_bindings."},{name:"description",type:"text"},{name:"query_params",type:"jsonb",default:{}},{name:"request_body",type:"jsonb",default:{}},{name:"param_bindings",type:"jsonb",default:[],comment:"Where each path/query parameter comes from: a static value, another endpoint's records (fan-out), or a column of one of our own tables."},{name:"pagination",type:"jsonb",default:{},comment:"Explicitly chosen paging profile (none/page_number/offset/cursor/link_header). Never guessed \u2014 a wrong guess silently imports one page."},{name:"response_root_path",type:"varchar",length:200},{name:"tree_children_path",type:"varchar",length:200,comment:"Field holding a record's children when the source answers with a shape rather than a list \u2014 each node then becomes its own row and knows its parent"},{name:"sample_response",type:"jsonb",default:{},comment:"A few real records captured by a live test, so the mapping screen still shows fields when the source is unreachable"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["source_id"]},{columns:["source_id","tag"]}]},{table_name:"integration_mappings",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:[],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"endpoint_id",type:"uuid",notNull:!0,references:{table:"integrationEndpoints",column:"id",onDelete:"cascade"}},{name:"name",type:"varchar",length:200,notNull:!0},{name:"target_entity",type:"varchar",length:120,notNull:!0,comment:"snake_case table name this mapping writes into"},{name:"field_mappings",type:"jsonb",notNull:!0,default:[]},{name:"reference_checks",type:"jsonb",notNull:!0,default:[],comment:"Columns whose value must already exist in another entity, and what to do when it does not."},{name:"dedup_source_field",type:"varchar",length:200},{name:"dedup_target_field",type:"varchar",length:200,comment:"Target column that identifies the same record across runs. Without it nothing can be matched and every run appends."},{name:"write_mode",type:"varchar",length:20,notNull:!0,default:"upsert",enumValues:["upsert","append","replace"],comment:"replace is the destructive wipe-and-rewrite; it is no longer the default and is gated by the completeness check."},{name:"missing_record_policy",type:"varchar",length:20,notNull:!0,default:"ignore",enumValues:["ignore","deactivate","delete"],comment:"What happens to a row that exists here but no longer in the source. deactivate is the right answer for most HR data and could not be expressed before."},{name:"missing_record_column",type:"varchar",length:120},{name:"missing_record_value",type:"varchar",length:200},{name:"removal_scope_column",type:"varchar",length:120,comment:"Target column carrying whatever the fan-out varies \u2014 a company code, a branch, a tenant. Set it when one mapping reads its source through several calls: removal is then confined to the values actually read, so a call that answers HTTP 500 costs that slice its cleanup instead of costing the whole run. Without it a single failing call refuses every removal, and a source whose one bad endpoint fails every night is never cleaned at all."},{name:"origin_column",type:"varchar",length:120,comment:"Column this mapping stamps on rows it owns. Set it when the target table ALSO holds rows people create by hand: without it every hand-made row looks like one the source stopped carrying, and the first run with a removal policy deletes them all."},{name:"origin_value",type:"varchar",length:120,comment:"The value written into origin_column. Rows carrying it are the only removal candidates."},{name:"max_removal_share",type:"numeric",comment:"Share of the target table (0-1) above which an UNATTENDED run refuses to remove. A scheduled run passes through neither the preview nor a confirmation, so this is the only thing between a wrong plan and the table. 0 or null disables."},{name:"password_target_column",type:"varchar",length:100,comment:"Column that receives the shared opening password given at run time. The password itself is never stored."},{name:"account_rule",type:"jsonb",comment:"Creates a login alongside each imported record, in the same transaction, and links it. The password belongs to the run, never to this row."},{name:"schedule_cron",type:"varchar",length:120},{name:"schedule_timezone",type:"varchar",length:64,comment:"IANA zone the cron expression is read in. Without it a nightly job drifts with the container's clock."},{name:"schedule_enabled",type:"boolean",notNull:!0,default:!1},{name:"last_run_at",type:"timestamptz"},{name:"enabled",type:"boolean",default:!0}],indexes:[{columns:["endpoint_id"]},{columns:["target_entity"]},{columns:["schedule_enabled"]}]},{table_name:"integration_runs",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"mapping_id",type:"uuid",references:{table:"integrationMappings",column:"id",onDelete:"set null"},comment:"Nullable and NOT cascaded: deleting a mapping must not erase the record that it once rewrote a table."},{name:"target_entity",type:"varchar",length:120},{name:"write_mode",type:"varchar",length:20,enumValues:["upsert","append","replace"]},{name:"status",type:"varchar",length:20,notNull:!0,default:"queued",enumValues:["queued","running","succeeded","failed","cancelled","reverted"],comment:"There is deliberately no 'partial': a run either applied in full or not at all."},{name:"trigger",type:"varchar",length:20,notNull:!0,default:"manual",enumValues:["manual","schedule","api"]},{name:"total_fetched",type:"integer",notNull:!0,default:0},{name:"source_reported_total",type:"integer",comment:"What the source said it had. When this and total_fetched disagree, a destructive run refuses to start."},{name:"created_count",type:"integer",notNull:!0,default:0},{name:"references_created_count",type:"integer",notNull:!0,default:0,comment:"Rows this run added to OTHER tables so its records could point at them."},{name:"accounts_created_count",type:"integer",notNull:!0,default:0,comment:"Logins this run created so its records could be signed in to."},{name:"updated_count",type:"integer",notNull:!0,default:0},{name:"skipped_count",type:"integer",notNull:!0,default:0},{name:"deleted_count",type:"integer",notNull:!0,default:0},{name:"deactivated_count",type:"integer",notNull:!0,default:0},{name:"error_count",type:"integer",notNull:!0,default:0},{name:"external_call_count",type:"integer",notNull:!0,default:0},{name:"issues",type:"jsonb",default:[]},{name:"errors",type:"jsonb",default:[]},{name:"cancel_requested",type:"boolean",notNull:!0,default:!1,comment:"Set by the cancel endpoint; the engine checks it at every batch boundary. A dropped HTTP connection is NOT a cancellation."},{name:"started_at",type:"timestamptz"},{name:"finished_at",type:"timestamptz"},{name:"pre_images_expire_at",type:"timestamptz",comment:"After this, the run can no longer be reverted and the UI says so rather than offering a button that quietly does nothing."},{name:"reverted_at",type:"timestamptz"},{name:"reverted_by",type:"uuid",references:{table:"users",column:"id"}},{name:"reverted_run_id",type:"uuid"}],indexes:[{columns:["mapping_id"]},{columns:["status"]},{columns:["target_entity"]},{columns:["created_at"]}]},{table_name:"integration_run_items",feature_set:["integrations"],add_base_columns:!0,is_form_data:!1,available_app_ids:["default_be"],available_schemas:["*"],excluded_schemas:[],excluded_methods:["POST","PUT","PATCH","DELETE"],bulk_endpoints_enabled:!1,group_name:"Integrations",columns:[{name:"run_id",type:"uuid",notNull:!0,references:{table:"integrationRuns",column:"id",onDelete:"cascade"}},{name:"target_entity",type:"varchar",length:120,notNull:!0},{name:"row_id",type:"uuid"},{name:"action",type:"varchar",length:20,notNull:!0,enumValues:["create","update","delete","deactivate"]},{name:"before",type:"jsonb",comment:"The row as it stood before this run touched it. This is what makes a successful run reversible; the bulk delete path already produced these rows and threw them away."},{name:"after",type:"jsonb"}],indexes:[{columns:["run_id"]},{columns:["run_id","action"]},{columns:["target_entity","row_id"]}]}];var exceedsBodyLimit=(contentLengthHeader,maxBytes)=>{if(!maxBytes||maxBytes<=0)return!1;if(!contentLengthHeader)return!1;let len=Number(contentLengthHeader);if(!Number.isFinite(len)||len<0)return!1;return len>maxBytes};init_internalHeaders();init_response();function createInboundGuard(options={}){return({request,set})=>{for(let header of INTERNAL_HEADERS)request.headers.delete(header);if(exceedsBodyLimit(request.headers.get("content-length"),options.maxRequestBodyBytes))return set.status=413,Response.json(withEnvelopeFlags({isSuccess:!1,message:"Request body too large",status:413,errors:[{message:"Request body too large"}],data:null}));return}}function columnOfScope(scope){if(!scope)return null;let[field]=scope.split("="),trimmed=field?.trim();return trimmed?trimmed:null}function findUnstampedOwnership(assignments,ownership){let required=new Map;for(let{table,column}of ownership){let columns=required.get(table)??new Set;columns.add(column),required.set(table,columns)}let seen=new Map;for(let assignment of assignments){let scopeColumn=columnOfScope(assignment.scope);for(let claim of assignment.claims??[]){if(!claim.startsWith("post."))continue;let table=claim.slice(5),columns=required.get(table);if(!columns)continue;let perTable=seen.get(table)??new Map;for(let column of columns){let entry=perTable.get(column)??{scoped:new Set,unscoped:new Set},role=assignment.role??"(unnamed role)";if(scopeColumn===column)entry.scoped.add(role);else entry.unscoped.add(role);perTable.set(column,entry)}seen.set(table,perTable)}}let findings=[];for(let[table,perTable]of seen)for(let[column,entry]of perTable){if(entry.scoped.size===0||entry.unscoped.size===0)continue;findings.push({table,column,unscopedRoles:[...entry.unscoped].sort(),scopedRoles:[...entry.scoped].sort()})}return findings.sort((a,b)=>a.table.localeCompare(b.table)||a.column.localeCompare(b.column))}function describeUnstamped(findings){return findings.map((f)=>`[Authorization] ${f.table}.${f.column} is stamped for ${f.scopedRoles.join(", ")} (scoped create) but NOT for ${f.unscopedRoles.join(", ")}. Those roles must send ${f.column} themselves or their writes fail with "${f.column} is required". `+"Give them a scoped claim, or have the client send it \u2014 a scoped caller's value is "+"overridden server-side either way.")}init_response();init_routeCollector();init_routeMount();init_routeRecording();init_lifetime();import{and as and11,eq as eq16,inArray as inArray3,isNull as isNull2}from"drizzle-orm";var DEFAULT_CHAT_CONFIG={enabled:!1,basePath:"/chat",groupsEnabled:!0,maxGroupParticipants:256,maxMessageLength:8000,editingEnabled:!0,deletionEnabled:!0,typingIndicators:!0,readReceipts:!0,presence:!0,realtimeTopicPrefix:"chat",messagePageSize:50,moderatorRoles:[],attachments:{enabled:!0,maxPerMessage:10,maxFileSizeBytes:null,allowedMimeTypes:[]}};function mergeChatConfig(input){let base=DEFAULT_CHAT_CONFIG;if(!input)return base;return{enabled:input.enabled??base.enabled,basePath:input.basePath??base.basePath,groupsEnabled:input.groupsEnabled??base.groupsEnabled,maxGroupParticipants:input.maxGroupParticipants??base.maxGroupParticipants,maxMessageLength:input.maxMessageLength??base.maxMessageLength,editingEnabled:input.editingEnabled??base.editingEnabled,deletionEnabled:input.deletionEnabled??base.deletionEnabled,typingIndicators:input.typingIndicators??base.typingIndicators,readReceipts:input.readReceipts??base.readReceipts,presence:input.presence??base.presence,realtimeTopicPrefix:input.realtimeTopicPrefix??base.realtimeTopicPrefix,messagePageSize:input.messagePageSize??base.messagePageSize,moderatorRoles:input.moderatorRoles??base.moderatorRoles,attachments:{enabled:input.attachments?.enabled??base.attachments.enabled,maxPerMessage:input.attachments?.maxPerMessage??base.attachments.maxPerMessage,maxFileSizeBytes:input.attachments?.maxFileSizeBytes??base.attachments.maxFileSizeBytes,allowedMimeTypes:input.attachments?.allowedMimeTypes??base.attachments.allowedMimeTypes}}}function getCol(table,col7){return table[col7]}function getTable(schemaTables,name2,logger2){return resolveSchemaTable(schemaTables,name2,logger2)}function computeDirectKey(userA,userB){return[userA,userB].sort().join(":")}function kindFromMime(mime){if(!mime)return"file";if(mime.startsWith("image/"))return"image";if(mime.startsWith("video/"))return"video";if(mime.startsWith("audio/"))return"audio";return"file"}function str3(value){return typeof value==="string"?value:null}function num2(value){return typeof value==="number"?value:null}function date(value){if(value instanceof Date)return value;if(typeof value==="string")return new Date(value);return null}function cdnUrl(cdnBasePath,fileId){if(!fileId)return null;return`${cdnBasePath}/${fileId}`}function mapConversation(row,cdnBasePath){let avatarFileId=str3(row.avatarFileId);return{id:String(row.id),type:str3(row.type)??"direct",title:str3(row.title),description:str3(row.description),avatarFileId,avatarUrl:cdnUrl(cdnBasePath,avatarFileId),directKey:str3(row.directKey),lastMessageAt:date(row.lastMessageAt),lastMessagePreview:str3(row.lastMessagePreview),lastMessageSenderId:str3(row.lastMessageSenderId),createdBy:str3(row.createdBy),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),isActive:row.isActive!==!1}}function mapParticipant(row){return{id:String(row.id),conversationId:String(row.conversationId),userId:String(row.userId),role:str3(row.role)??"member",lastReadMessageId:str3(row.lastReadMessageId),lastReadAt:date(row.lastReadAt),unreadCount:num2(row.unreadCount)??0,muted:row.muted===!0,mutedUntil:date(row.mutedUntil),notificationsEnabled:row.notificationsEnabled!==!1,leftAt:date(row.leftAt),joinedAt:date(row.createdAt)??new Date(0)}}function mapAttachment(row,cdnBasePath){let fileId=String(row.fileId);return{id:String(row.id),messageId:String(row.messageId),conversationId:String(row.conversationId),fileId,kind:str3(row.kind)??"file",originalName:str3(row.originalName),mimeType:str3(row.mimeType),size:num2(row.size),width:num2(row.width),height:num2(row.height),duration:num2(row.duration),url:`${cdnBasePath}/${fileId}`}}function mapMessage(row,attachments){let metadata=row.metadata;return{id:String(row.id),conversationId:String(row.conversationId),senderId:str3(row.senderId),content:str3(row.content),contentType:str3(row.contentType)??"text",replyToId:str3(row.replyToId),metadata:metadata&&typeof metadata==="object"?metadata:null,clientMessageId:str3(row.clientMessageId),editedAt:date(row.editedAt),deletedAt:date(row.deletedAt),createdAt:date(row.createdAt)??new Date(0),updatedAt:date(row.updatedAt)??new Date(0),attachments}}function buildPreview(content,contentType,attachmentCount){if(content&&content.trim().length>0){let trimmed=content.trim();return trimmed.length>280?`${trimmed.slice(0,277)}...`:trimmed}if(attachmentCount>0){if(contentType==="image")return attachmentCount>1?`${attachmentCount} photos`:"Photo";if(contentType==="video")return attachmentCount>1?`${attachmentCount} videos`:"Video";if(contentType==="audio")return"Audio";return attachmentCount>1?`${attachmentCount} files`:"File"}if(contentType==="system")return"System message";return""}async function checkAttachmentFileAccess(args){let{db,schemaTables,fileId,userId}=args,attachments=getTable(schemaTables,"chat_message_attachments"),participants=getTable(schemaTables,"chat_participants");if(!attachments||!participants)return"not_attachment";let linked=await db.select().from(attachments).where(eq16(getCol(attachments,"fileId"),fileId));if(linked.length===0)return"not_attachment";if(!userId)return"denied";let conversationIds=[...new Set(linked.map((row)=>String(row.conversationId)))];return(await db.select().from(participants).where(and11(inArray3(getCol(participants,"conversationId"),conversationIds),eq16(getCol(participants,"userId"),userId),isNull2(getCol(participants,"leftAt")))).limit(1)).length>0?"allowed":"denied"}import{and as and13,desc as desc3,eq as eq18,inArray as inArray5}from"drizzle-orm";import{and as and12,eq as eq17,inArray as inArray4}from"drizzle-orm";class ChatError extends Error{code;constructor(code,message){super(message);this.code=code,this.name="ChatError"}}function resolveChatTables(ctx){let conversations=getTable(ctx.schemaTables,"chat_conversations",ctx.logger),participants=getTable(ctx.schemaTables,"chat_participants",ctx.logger),messages=getTable(ctx.schemaTables,"chat_messages",ctx.logger);if(!conversations||!participants||!messages)throw new ChatError("disabled","Chat tables are not available in this schema");let attachments=getTable(ctx.schemaTables,"chat_message_attachments")??null,files=getTable(ctx.schemaTables,"files")??null;return{conversations,participants,messages,attachments,files}}function chatTopic(ctx){return ctx.config.realtimeTopicPrefix||"chat"}async function getConversationRow(ctx,tables,conversationId){return(await ctx.db.select().from(tables.conversations).where(eq17(getCol(tables.conversations,"id"),conversationId)).limit(1))[0]??null}async function getParticipant(ctx,tables,conversationId,userId){let row=(await ctx.db.select().from(tables.participants).where(and12(eq17(getCol(tables.participants,"conversationId"),conversationId),eq17(getCol(tables.participants,"userId"),userId))).limit(1))[0];return row?mapParticipant(row):null}async function requireActiveMembership(ctx,tables,conversationId,userId){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant||participant.leftAt)throw new ChatError("forbidden","You are not a participant of this conversation");return participant}async function listParticipants(ctx,tables,conversationId,includeLeft=!1){let all=(await ctx.db.select().from(tables.participants).where(eq17(getCol(tables.participants,"conversationId"),conversationId))).map(mapParticipant);return includeLeft?all:all.filter((p)=>!p.leftAt)}async function assertUsersExist(ctx,userIds){let unique=[...new Set(userIds)];if(unique.length===0)return;let usersTable=getTable(ctx.schemaTables,"users",ctx.logger);if(!usersTable)throw new ChatError("disabled","Users table is not available in this schema");let rows=await ctx.db.select({id:getCol(usersTable,"id")}).from(usersTable).where(inArray4(getCol(usersTable,"id"),unique)),found=new Set(rows.map((r)=>r.id));for(let id of unique)if(!found.has(id))throw new ChatError("not_found",`User ${id} does not exist`)}function deliverToParticipants(ctx,participants,event,exceptUserId){if(!ctx.broadcaster)return;let topic=chatTopic(ctx);for(let participant of participants){if(participant.leftAt)continue;if(exceptUserId&&participant.userId===exceptUserId)continue;ctx.broadcaster.broadcastToUser(participant.userId,topic,event)}}async function buildSummary(ctx,tables,conversationRow,userId,participantsOverride){let conversation=mapConversation(conversationRow,ctx.cdnBasePath),participants=participantsOverride??await listParticipants(ctx,tables,conversation.id),myParticipant=participants.find((p)=>p.userId===userId)??null;return{...conversation,participants,myParticipant,unreadCount:myParticipant?.unreadCount??0}}async function getOrCreateDirect(ctx,params){let tables=resolveChatTables(ctx),{userId,targetUserId}=params;if(!targetUserId||targetUserId===userId)throw new ChatError("validation","A different target user is required");await assertUsersExist(ctx,[targetUserId]);let directKey=computeDirectKey(userId,targetUserId),existing=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(existing)return await rejoinIfNeeded(ctx,tables,String(existing.id),[userId,targetUserId]),buildSummary(ctx,tables,existing,userId);let now=new Date,conversationRow;try{conversationRow=(await ctx.db.insert(tables.conversations).values({type:"direct",directKey,createdBy:userId,lastMessageAt:now,lastMessagePreview:""}).returning())[0]}catch(_err){let raced=(await ctx.db.select().from(tables.conversations).where(eq18(getCol(tables.conversations,"directKey"),directKey)).limit(1))[0];if(!raced)throw new ChatError("conflict","Failed to create direct conversation");return await rejoinIfNeeded(ctx,tables,String(raced.id),[userId,targetUserId]),buildSummary(ctx,tables,raced,userId)}let conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values([{conversationId,userId,role:"member",createdBy:userId},{conversationId,userId:targetUserId,role:"member",createdBy:userId}]);let summary=await buildSummary(ctx,tables,conversationRow,userId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},userId),summary}async function createGroup(ctx,params){if(!ctx.config.groupsEnabled)throw new ChatError("disabled","Group conversations are disabled");let tables=resolveChatTables(ctx),{creatorId,title}=params;if(!title||title.trim().length===0)throw new ChatError("validation","A group title is required");let memberIds=[...new Set([creatorId,...params.participantIds])];if(memberIds.length>ctx.config.maxGroupParticipants)throw new ChatError("validation",`A group cannot exceed ${ctx.config.maxGroupParticipants} participants`);if(await assertUsersExist(ctx,memberIds),params.avatarFileId){if(!tables.files)throw new ChatError("disabled","Avatar files require storage to be enabled");let avatarRow=(await ctx.db.select().from(tables.files).where(eq18(getCol(tables.files,"id"),params.avatarFileId)).limit(1))[0],owner=avatarRow?String(avatarRow.uploadedBy??avatarRow.createdBy??""):"";if(!avatarRow||owner!==creatorId)throw new ChatError("forbidden","Avatar file is not owned by the creator")}let now=new Date,conversationRow=(await ctx.db.insert(tables.conversations).values({type:"group",title:title.trim(),description:params.description??null,avatarFileId:params.avatarFileId??null,createdBy:creatorId,lastMessageAt:now,lastMessagePreview:""}).returning())[0],conversationId=String(conversationRow.id);await ctx.db.insert(tables.participants).values(memberIds.map((memberId)=>({conversationId,userId:memberId,role:memberId===creatorId?"owner":"member",createdBy:creatorId})));let summary=await buildSummary(ctx,tables,conversationRow,creatorId);return deliverToParticipants(ctx,summary.participants,{type:"conversation.created",conversationId,conversation:summary},creatorId),summary}async function listConversations(ctx,params){let tables=resolveChatTables(ctx),limit=Math.min(Math.max(params.limit??30,1),100),offset=Math.max(params.offset??0,0),myParticipants=(await ctx.db.select().from(tables.participants).where(eq18(getCol(tables.participants,"userId"),params.userId))).map(mapParticipant).filter((p)=>!p.leftAt);if(myParticipants.length===0)return[];let conversationIds=myParticipants.map((p)=>p.conversationId),pageRows=await ctx.db.select().from(tables.conversations).where(and13(inArray5(getCol(tables.conversations,"id"),conversationIds),eq18(getCol(tables.conversations,"isActive"),!0))).orderBy(desc3(getCol(tables.conversations,"lastMessageAt"))).limit(limit).offset(offset);if(pageRows.length===0)return[];let pageIds=pageRows.map((r)=>String(r.id)),participantRows=await ctx.db.select().from(tables.participants).where(inArray5(getCol(tables.participants,"conversationId"),pageIds)),byConversation=new Map;for(let row of participantRows){let mapped=mapParticipant(row);if(mapped.leftAt)continue;let list2=byConversation.get(mapped.conversationId)??[];list2.push(mapped),byConversation.set(mapped.conversationId,list2)}let summaries=[];for(let row of pageRows){let id=String(row.id);summaries.push(await buildSummary(ctx,tables,row,params.userId,byConversation.get(id)??[]))}return summaries}async function getConversation(ctx,conversationId,userId){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,conversationId,userId);let row=await getConversationRow(ctx,tables,conversationId);if(!row)throw new ChatError("not_found","Conversation not found");return buildSummary(ctx,tables,row,userId)}async function rejoinIfNeeded(ctx,tables,conversationId,userIds){for(let userId of userIds){let participant=await getParticipant(ctx,tables,conversationId,userId);if(!participant)await ctx.db.insert(tables.participants).values({conversationId,userId,role:"member",createdBy:userId});else if(participant.leftAt)await ctx.db.update(tables.participants).set({leftAt:null}).where(eq18(getCol(tables.participants,"id"),participant.id))}}function assertCanManage(actor){if(actor.role!=="owner"&&actor.role!=="admin")throw new ChatError("forbidden","Only group admins can manage participants")}async function addParticipants(ctx,conversationId,actorId,userIds){let tables=resolveChatTables(ctx),conversation=await getConversationRow(ctx,tables,conversationId);if(!conversation)throw new ChatError("not_found","Conversation not found");if(mapConversation(conversation,ctx.cdnBasePath).type!=="group")throw new ChatError("validation","Participants can only be managed in group conversations");let actor=await requireActiveMembership(ctx,tables,conversationId,actorId);assertCanManage(actor);let toAdd=[...new Set(userIds)];await assertUsersExist(ctx,toAdd);let current=await listParticipants(ctx,tables,conversationId,!0),activeCount=current.filter((p)=>!p.leftAt).length,newOnes=toAdd.filter((id)=>!current.some((p)=>p.userId===id&&!p.leftAt));if(activeCount+newOnes.length>ctx.config.maxGroupParticipants)throw new ChatError("validation","Group participant limit exceeded");for(let userId of toAdd)await rejoinIfNeeded(ctx,tables,conversationId,[userId]);let participants=await listParticipants(ctx,tables,conversationId);return deliverToParticipants(ctx,participants,{type:"participant.added",conversationId,userIds:toAdd,by:actorId}),participants}async function removeParticipant(ctx,conversationId,actorId,targetUserId){let tables=resolveChatTables(ctx),actor=await requireActiveMembership(ctx,tables,conversationId,actorId);if(actorId!==targetUserId)assertCanManage(actor);let target2=await getParticipant(ctx,tables,conversationId,targetUserId);if(!target2||target2.leftAt)throw new ChatError("not_found","Participant not found in conversation");await ctx.db.update(tables.participants).set({leftAt:new Date}).where(eq18(getCol(tables.participants,"id"),target2.id));let participants=await listParticipants(ctx,tables,conversationId),event={type:"participant.removed",conversationId,userId:targetUserId,by:actorId};if(deliverToParticipants(ctx,participants,event),ctx.broadcaster)ctx.broadcaster.broadcastToUser(targetUserId,ctx.config.realtimeTopicPrefix||"chat",event)}import{and as and14,desc as desc4,eq as eq19,inArray as inArray6,isNull as isNull3,lt,ne as ne2,sql as sql6}from"drizzle-orm";async function loadAttachments(ctx,tables,messageIds){let grouped=new Map;if(!tables.attachments||messageIds.length===0)return grouped;let rows=await ctx.db.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"messageId"),messageIds));for(let row of rows){let attachment=mapAttachment(row,ctx.cdnBasePath),list2=grouped.get(attachment.messageId)??[];list2.push(attachment),grouped.set(attachment.messageId,list2)}return grouped}function inferContentType(explicit,attachments){if(explicit)return explicit;if(attachments.length===0)return"text";let kind=attachments[0]?.kind;if(kind==="image")return"image";if(kind==="video")return"video";if(kind==="audio")return"audio";return"file"}async function persistAttachments(ctx,tables,conversationId,messageId,params){let inputs=params.attachments??[];if(inputs.length===0)return[];if(!ctx.attachmentsAvailable||!tables.attachments||!tables.files)throw new ChatError("disabled","File attachments require storage and CDN to be enabled");if(inputs.length>ctx.config.attachments.maxPerMessage)throw new ChatError("validation",`A message cannot have more than ${ctx.config.attachments.maxPerMessage} attachments`);let fileIds=inputs.map((a)=>a.fileId),fileRows=await ctx.db.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),fileIds)),filesById=new Map;for(let row of fileRows)filesById.set(String(row.id),row);let payloads=inputs.map((input)=>{let fileRow=filesById.get(input.fileId);if(!fileRow)throw new ChatError("not_found",`Attachment file ${input.fileId} was not found`);if(String(fileRow.uploadedBy??fileRow.createdBy??"")!==params.senderId)throw new ChatError("forbidden",`Attachment file ${input.fileId} is not owned by the sender`);let mimeType=fileRow.mimeType??input.mimeType??null,size=fileRow.size??input.size??null,allowedTypes=ctx.config.attachments?.allowedMimeTypes??[];if(allowedTypes.length>0&&(!mimeType||!allowedTypes.includes(mimeType)))throw new ChatError("validation",`Attachment file ${input.fileId} is a ${mimeType??"unknown"} file, which this conversation does not accept`);let maxBytes=ctx.config.attachments?.maxFileSizeBytes??null;if(maxBytes!=null&&size!=null&&size>maxBytes)throw new ChatError("validation",`Attachment file ${input.fileId} is ${size} bytes, over the ${maxBytes} byte limit for attachments`);return{conversationId,messageId,fileId:input.fileId,kind:input.kind??kindFromMime(mimeType),originalName:fileRow.originalName??input.originalName??null,mimeType,size,width:input.width??null,height:input.height??null,duration:input.duration??null,createdBy:params.senderId}});return(await ctx.db.insert(tables.attachments).values(payloads).returning()).map((row)=>mapAttachment(row,ctx.cdnBasePath))}async function sendMessage(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.senderId);let content=params.content?.trim()?params.content:null,hasAttachments=(params.attachments?.length??0)>0;if(!content&&!hasAttachments)throw new ChatError("validation","A message must contain text or at least one attachment");if(content&&content.length>ctx.config.maxMessageLength)throw new ChatError("validation",`Message exceeds the maximum length of ${ctx.config.maxMessageLength} characters`);if(params.metadata!==void 0&&params.metadata!==null){if(JSON.stringify(params.metadata).length>4096)throw new ChatError("validation","Message metadata exceeds the maximum size of 4096 bytes")}let{message,participants}=await ctx.db.transaction(async(tx)=>{let txCtx={...ctx,db:tx},messageRow=(await tx.insert(tables.messages).values({conversationId:params.conversationId,senderId:params.senderId,content,contentType:params.contentType??"text",replyToId:params.replyToId??null,clientMessageId:params.clientMessageId??null,metadata:params.metadata??{},createdBy:params.senderId}).returning())[0],messageId=String(messageRow.id),attachments=await persistAttachments(txCtx,tables,params.conversationId,messageId,params),contentType=inferContentType(params.contentType,attachments);if(contentType!==messageRow.contentType)await tx.update(tables.messages).set({contentType}).where(eq19(getCol(tables.messages,"id"),messageId)),messageRow.contentType=contentType;let mappedMessage=mapMessage(messageRow,attachments),preview=buildPreview(mappedMessage.content,mappedMessage.contentType,attachments.length),now=mappedMessage.createdAt;await tx.update(tables.conversations).set({lastMessageAt:now,lastMessagePreview:preview,lastMessageSenderId:params.senderId,updatedAt:new Date}).where(eq19(getCol(tables.conversations,"id"),params.conversationId)),await tx.update(tables.participants).set({unreadCount:sql6`${getCol(tables.participants,"unreadCount")} + 1`}).where(and14(eq19(getCol(tables.participants,"conversationId"),params.conversationId),ne2(getCol(tables.participants,"userId"),params.senderId),isNull3(getCol(tables.participants,"leftAt"))));let parts=await listParticipants(txCtx,tables,params.conversationId);return{message:mappedMessage,participants:parts}});return deliverToParticipants(ctx,participants,{type:"message.created",conversationId:params.conversationId,message}),message}async function getMessages(ctx,params){let tables=resolveChatTables(ctx);await requireActiveMembership(ctx,tables,params.conversationId,params.userId);let limit=Math.min(Math.max(params.limit??ctx.config.messagePageSize,1),100),conditions=[eq19(getCol(tables.messages,"conversationId"),params.conversationId)];if(params.before){let cursor=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),params.before)).limit(1))[0];if(cursor?.createdAt)conditions.push(lt(getCol(tables.messages,"createdAt"),cursor.createdAt))}let rows=await ctx.db.select().from(tables.messages).where(and14(...conditions)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(limit+1),pageRows=rows.slice(0,limit),hasMore=rows.length>limit,attachmentsByMessage=await loadAttachments(ctx,tables,pageRows.map((r)=>String(r.id)));return{messages:pageRows.map((row)=>mapMessage(row,attachmentsByMessage.get(String(row.id))??[])),hasMore}}async function markRead(ctx,conversationId,userId,messageId){let tables=resolveChatTables(ctx),participant=await requireActiveMembership(ctx,tables,conversationId,userId),targetMessageId=messageId??null;if(targetMessageId){if(!(await ctx.db.select().from(tables.messages).where(and14(eq19(getCol(tables.messages,"id"),targetMessageId),eq19(getCol(tables.messages,"conversationId"),conversationId))).limit(1))[0])throw new ChatError("not_found","Message not found in this conversation")}else{let latestRow=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"conversationId"),conversationId)).orderBy(desc4(getCol(tables.messages,"createdAt"))).limit(1))[0];targetMessageId=latestRow?String(latestRow.id):null}let readAt=new Date;if(await ctx.db.update(tables.participants).set({lastReadMessageId:targetMessageId,lastReadAt:readAt,unreadCount:0}).where(eq19(getCol(tables.participants,"id"),participant.id)),ctx.config.readReceipts){let participants=await listParticipants(ctx,tables,conversationId);deliverToParticipants(ctx,participants,{type:"conversation.read",conversationId,userId,lastReadMessageId:targetMessageId,readAt:readAt.toISOString()},userId)}return{lastReadMessageId:targetMessageId,readAt}}async function editMessage(ctx,messageId,userId,content){if(!ctx.config.editingEnabled)throw new ChatError("disabled","Message editing is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(String(row.senderId)!==userId)throw new ChatError("forbidden","You can only edit your own messages");let trimmed=content.trim();if(!trimmed)throw new ChatError("validation","Message content cannot be empty");if(trimmed.length>ctx.config.maxMessageLength)throw new ChatError("validation","Message exceeds the maximum length");let editedAt=new Date,updated=await ctx.db.update(tables.messages).set({content:trimmed,editedAt,updatedAt:editedAt}).where(eq19(getCol(tables.messages,"id"),messageId)).returning(),attachments=await loadAttachments(ctx,tables,[messageId]),message=mapMessage(updated[0],attachments.get(messageId)??[]),participants=await listParticipants(ctx,tables,String(row.conversationId));return deliverToParticipants(ctx,participants,{type:"message.updated",conversationId:String(row.conversationId),message}),message}async function deleteMessage(ctx,messageId,userId,asModerator=!1){if(!ctx.config.deletionEnabled&&!asModerator)throw new ChatError("disabled","Message deletion is disabled");let tables=resolveChatTables(ctx),row=(await ctx.db.select().from(tables.messages).where(eq19(getCol(tables.messages,"id"),messageId)).limit(1))[0];if(!row||row.deletedAt)throw new ChatError("not_found","Message not found");if(!asModerator&&String(row.senderId)!==userId)throw new ChatError("forbidden","You can only delete your own messages");let deletedAt=new Date,orphanedFiles=await ctx.db.transaction(async(tx)=>{if(await tx.update(tables.messages).set({content:null,deletedAt,updatedAt:deletedAt}).where(eq19(getCol(tables.messages,"id"),messageId)),!tables.attachments)return[];let attachmentRows=await tx.select().from(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));if(attachmentRows.length===0)return[];await tx.delete(tables.attachments).where(eq19(getCol(tables.attachments,"messageId"),messageId));let fileIds=[...new Set(attachmentRows.map((a)=>String(a.fileId)))];if(!tables.files||fileIds.length===0)return[];let stillLinked=await tx.select().from(tables.attachments).where(inArray6(getCol(tables.attachments,"fileId"),fileIds)),keep=new Set(stillLinked.map((a)=>String(a.fileId))),removable=fileIds.filter((id)=>!keep.has(id));if(removable.length===0)return[];let fileRows=await tx.select().from(tables.files).where(inArray6(getCol(tables.files,"id"),removable));return await tx.delete(tables.files).where(inArray6(getCol(tables.files,"id"),removable)),fileRows.filter((f)=>typeof f.path==="string"&&typeof f.name==="string").map((f)=>({path:String(f.path),name:String(f.name)}))});for(let file of orphanedFiles)if(await ctx.deleteStoredFile?.(file)===!1)ctx.logger.warn("[Chat] Attachment blob cleanup failed",{messageId,name:file.name});let participants=await listParticipants(ctx,tables,String(row.conversationId));deliverToParticipants(ctx,participants,{type:"message.deleted",conversationId:String(row.conversationId),messageId})}async function setTyping(ctx,conversationId,userId,isTyping=!0){if(!ctx.config.typingIndicators)return;let tables=resolveChatTables(ctx),participants=await listParticipants(ctx,tables,conversationId);if(!participants.some((p)=>p.userId===userId))throw new ChatError("forbidden","You are not a participant of this conversation");deliverToParticipants(ctx,participants,{type:"typing",conversationId,userId,isTyping},userId)}class ChatService{ctx;constructor(init){this.ctx={db:init.db,schemaTables:init.schemaTables,config:init.config,logger:init.logger,broadcaster:init.broadcaster??null,cdnBasePath:init.cdnBasePath??"/cdn",attachmentsAvailable:init.attachmentsAvailable??!1,deleteStoredFile:init.deleteStoredFile??null}}get config(){return this.ctx.config}getOrCreateDirect(userId,targetUserId){return getOrCreateDirect(this.ctx,{userId,targetUserId})}createGroup(params){return createGroup(this.ctx,params)}listConversations(userId,opts){return listConversations(this.ctx,{userId,limit:opts?.limit,offset:opts?.offset})}getConversation(conversationId,userId){return getConversation(this.ctx,conversationId,userId)}addParticipants(conversationId,actorId,userIds){return addParticipants(this.ctx,conversationId,actorId,userIds)}removeParticipant(conversationId,actorId,targetUserId){return removeParticipant(this.ctx,conversationId,actorId,targetUserId)}sendMessage(params){return sendMessage(this.ctx,params)}getMessages(params){return getMessages(this.ctx,params)}markRead(conversationId,userId,messageId){return markRead(this.ctx,conversationId,userId,messageId)}editMessage(messageId,userId,content){return editMessage(this.ctx,messageId,userId,content)}deleteMessage(messageId,userId,asModerator=!1){return deleteMessage(this.ctx,messageId,userId,asModerator)}setTyping(conversationId,userId,isTyping){return setTyping(this.ctx,conversationId,userId,isTyping)}}init_SystemCollector();init_lifecycle();init_Notification();var EXTEND_ALLOWED_KEYS=new Set(["table_name","extends","columns","indexes"]);function hasDbDefault(column){return column.default!==void 0||column.defaultRaw!==void 0||column.generatedAlwaysAs!==void 0||column.generatedAlwaysAsIdentity===!0||column.generatedByDefaultAsIdentity===!0}var AUTH_FEATURES=new Set(["authentication","authorization"]);function resolveEntities(systemTables,configEntities,options={}){let errors2=[],warnings=[],consumed=new Set,entities=[];for(let system of systemTables){let config=configEntities.find((c)=>c.table_name===system.table_name);if(!config){entities.push(system);continue}if(consumed.add(config.table_name),!config.extends){if(!config.replaces)warnings.push(`[Schema] "${config.table_name}" is declared in config.entities AND ships as a system table. Using YOUR definition and skipping the built-in one. Add "extends": true to inherit the built-in columns and route policy, or "replaces": true if replacing it is deliberate.`);entities.push(config);continue}for(let key2 of Object.keys(config))if(!EXTEND_ALLOWED_KEYS.has(key2))warnings.push(`[Schema] "${config.table_name}" sets "${key2}" alongside "extends": true \u2014 ignored. `+"An extending entry inherits every table-level setting from the built-in definition.");if(options.enabledTableNames&&!options.enabledTableNames.has(system.table_name))errors2.push({code:"E5_FEATURE_DISABLED",table:system.table_name,message:`"${system.table_name}" is extended but its feature is disabled, so the table is never created. Enable the feature or remove the extending entry.`});if(options.consumerMode&&(system.feature_set??[]).some((f)=>AUTH_FEATURES.has(f)))errors2.push({code:"E3_CONSUMER_AUTH_TABLE",table:system.table_name,message:`"${system.table_name}" is an auth system table and cannot be extended in consumer mode \u2014 `+"the identity tables live in the IDP. Extending it would create a local copy here."});let builtInNames=new Set((system.columns??[]).map((c)=>c.name));if(system.add_base_columns!==!1)for(let name2 of options.baseColumnNames??[])builtInNames.add(name2);for(let column of config.columns??[]){if(builtInNames.has(column.name))errors2.push({code:"E1_COLUMN_COLLISION",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" already exists in the built-in definition. An extending entry may only ADD columns; rename yours.`});if(column.notNull===!0&&column.nullable!==!0&&!hasDbDefault(column))errors2.push({code:"E2_NOT_NULL_WITHOUT_DEFAULT",table:system.table_name,column:column.name,message:`"${system.table_name}.${column.name}" is notNull without a default. The framework writes this table from fixed-column inserts (register, invite, admin create-user, godmin seed, `+"tenant provisioning) that cannot supply it \u2014 every one of them would fail. Make it "+"nullable or give it a default."})}let merged={...system,columns:[...system.columns??[],...config.columns??[]],indexes:[...system.indexes??[],...config.indexes??[]]};entities.push(merged)}for(let config of configEntities){if(consumed.has(config.table_name))continue;if(config.extends){errors2.push({code:"E4_UNKNOWN_SYSTEM_TABLE",table:config.table_name,message:`"${config.table_name}" sets "extends": true but there is no system table with that name. Remove the flag to declare it as an ordinary entity.`});continue}entities.push(config)}return{entities,errors:errors2,warnings}}function resolveAuthType(pathname,auth){let at=(route)=>pathname===route||pathname.endsWith(route)||pathname.includes(`${route}/`);if(at(auth?.login?.route||"/auth/login"))return"login";if(at(auth?.register?.route||"/auth/register"))return"register";if(at(auth?.passwordReset?.route||"/auth/password-reset"))return"passwordReset";if(at(auth?.magicLink?.route||"/auth/magic-link"))return"magicLink";if(at(auth?.invite?.route||"/auth/invite"))return"other";if(at("/sessions/approve")||at("/sessions/reject"))return"login";return}init_Logger2();var METHOD_MAP={GET:["GET"],POST:["POST"],PUT:["PUT"],DELETE:["DELETE"],PATCH:["PATCH"],TOGGLE:["PATCH"],VERIFICATION:["POST"]};function unhonouredIsPublicDeclarations(config){let auth=config.authentication;if(!auth)return[];let notes=[],alwaysPublic=[["authentication.sessions",auth.sessions],["authentication.passwordSet",auth.passwordSet],["authentication.webauthn",auth.webauthn],["authentication.invite",auth.invite],["authentication.register.emailVerification",auth.register?.emailVerification]];for(let[name2,feature]of alwaysPublic)if(feature?.enabled&&feature.isPublic===!1)notes.push(`${name2}.isPublic is false but these routes stay public: the flow is reached without a session`);if(auth.me?.isPublic===!0)notes.push("authentication.me.isPublic is true but /auth/me is never published as public");let sessionToken=auth.sessionToken;if(sessionToken){let named=["secret","algorithm","issuer","audience"].filter((k)=>sessionToken[k]!==void 0);if(named.length>0)notes.push(`authentication.sessionToken.${named.join("/")} is set, but the session token is an opaque id looked up in the store rather than a JWT: nothing signs or verifies it`)}return notes}function buildAuthPublicRoutes(config,basePath){let routes=[],auth=config.authentication;if(!auth)return routes;if(auth.login?.enabled&&auth.login?.isPublic)routes.push({path:auth.login.route||`${basePath}/auth/login`,method:"POST",source:"auth"});if(auth.register?.enabled&&auth.register?.isPublic)routes.push({path:auth.register.route||`${basePath}/auth/register`,method:"POST",source:"auth"});if(auth.logout?.enabled&&auth.logout?.isPublic)routes.push({path:auth.logout.route||`${basePath}/auth/logout`,method:"POST",source:"auth"});if(auth.refresh?.enabled&&auth.refresh?.isPublic)routes.push({path:auth.refresh.route||`${basePath}/auth/refresh`,method:"POST",source:"auth"});if(auth.admin?.impersonate?.enabled!==!1)routes.push({path:`${basePath}/auth/admin/impersonate/stop`,method:"POST",source:"system"});if(auth.passwordReset?.enabled&&auth.passwordReset?.isPublic){let baseRoute=auth.passwordReset.route||`${basePath}/auth/password-reset`;routes.push({path:`${baseRoute}/request`,method:"POST",source:"auth"},{path:`${baseRoute}/confirm`,method:"POST",source:"auth"})}if(auth.passwordChange?.enabled&&auth.passwordChange?.isPublic)routes.push({path:auth.passwordChange.route||`${basePath}/auth/password-change`,method:"POST",source:"auth"});if(auth.magicLink?.enabled&&auth.magicLink?.isPublic)routes.push({path:auth.magicLink.route||`${basePath}/auth/magic-link`,method:"POST",source:"auth"},{path:auth.magicLink.verifyRoute||`${basePath}/auth/magic-link/verify`,method:"GET",source:"auth"});if(auth.register?.enabled&&auth.register?.emailVerification?.enabled)routes.push({path:`${basePath}/verify-email`,method:"GET",source:"auth"},{path:`${basePath}/resend-verification`,method:"POST",source:"auth"});if(auth.invite?.enabled&&auth.invite?.isPublic)routes.push({path:auth.invite.route||`${basePath}/auth/invite`,method:"POST",source:"auth"});if(auth.invite?.enabled){let inviteRoute=auth.invite.route||`${basePath}/auth/invite`;routes.push({path:`${inviteRoute}/verify`,method:"POST",source:"auth"})}if(auth.passwordSet?.enabled)routes.push({path:auth.passwordSet.route||`${basePath}/auth/password-set`,method:"POST",source:"auth"});if(auth.webauthn?.enabled){let webauthnRoute=auth.webauthn.route||`${basePath}/auth/webauthn`;routes.push({path:`${webauthnRoute}/authenticate/options`,method:"POST",source:"auth"},{path:`${webauthnRoute}/authenticate/verify`,method:"POST",source:"auth"})}if(auth.captcha?.enabled&&auth.captcha?.isPublic){let baseRoute=auth.captcha.route||`${basePath}/auth/captcha`;routes.push({path:`${baseRoute}/generate`,method:"GET",source:"auth"},{path:`${baseRoute}/validate`,method:"POST",source:"auth"})}if(auth.sessions?.enabled){let sessionsRoute=auth.sessions.route||`${basePath}/auth/sessions`;routes.push({path:`${sessionsRoute}/approve`,method:"POST",source:"auth"},{path:`${sessionsRoute}/reject`,method:"POST",source:"auth"},{path:`${sessionsRoute}/approve-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/reject-page`,method:"GET",source:"auth"},{path:`${sessionsRoute}/approval-status`,method:"GET",source:"auth"})}if(auth.oauth?.enabled){let oauthBase=auth.oauth.basePath||`${basePath}/auth/oauth`,knownProviders=["google","github","microsoft","discord","facebook","twitter","apple","custom"];routes.push({path:`${oauthBase}/providers`,method:"GET",source:"auth"});for(let provider of knownProviders)routes.push({path:`${oauthBase}/${provider}`,method:"GET",source:"auth"},{path:`${oauthBase}/${provider}/callback`,method:"GET",source:"auth"})}return routes}function buildEntityPublicRoutes(entities,basePath,_schema){let routes=[];for(let entity of entities){if(!entity.is_public)continue;let camelName=entity.table_name.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),entityPath=`${basePath}/${camelName}`;for(let[nucleusMethod,isPublic]of Object.entries(entity.is_public)){if(!isPublic)continue;let httpMethods=METHOD_MAP[nucleusMethod];if(!httpMethods)continue;for(let method of httpMethods)if(method==="GET")routes.push({path:entityPath,method:"GET",source:"entity"}),routes.push({path:`${entityPath}/:id`,method:"GET",source:"entity"});else if(method==="POST")routes.push({path:entityPath,method:"POST",source:"entity"});else if(method==="PUT"||method==="PATCH")routes.push({path:`${entityPath}/:id`,method,source:"entity"});else if(method==="DELETE")routes.push({path:`${entityPath}/:id`,method:"DELETE",source:"entity"})}}return routes}function buildSystemTablePublicRoutes(systemTables,basePath,schema){return buildEntityPublicRoutes(systemTables,basePath,schema)}function buildPublicRoutes(config,systemTables,basePath="",schema="public"){let authRoutes=buildAuthPublicRoutes(config,basePath),entityRoutes=buildEntityPublicRoutes(config.entities||[],basePath,schema),systemRoutes=buildSystemTablePublicRoutes(systemTables,basePath,schema),pubsubRoutes=[];if(config.pubsub?.enabled){let pubsubBasePath=config.pubsub.basePath||"/subs",wsPath=config.pubsub.wsPath||"/api/events/subscribe";pubsubRoutes.push({path:`${pubsubBasePath}/:topic`,method:"POST",source:"system"},{path:wsPath,method:"GET",source:"system"})}let paymentRoutes=[];if(config.payment?.enabled){let paymentBasePath=config.payment.basePath||"/payment";paymentRoutes.push({path:`${paymentBasePath}/callback`,method:"POST",source:"system"},{path:`${paymentBasePath}/callback`,method:"OPTIONS",source:"system"},{path:`${paymentBasePath}/bin-query`,method:"POST",source:"system"},{path:`${paymentBasePath}/webhook`,method:"POST",source:"system"})}let discoveryRoutes=[];if(config.authorization?.endpointDiscovery?.enabled){let manifestAuth={bypassHeaders:["x-discovery-token"]};discoveryRoutes.push({path:"/authorization/route-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/route-manifest",method:"OPTIONS",source:"system"},{path:"/authorization/role-claims-manifest",method:"GET",source:"system",authenticateWhenCredentialed:manifestAuth},{path:"/authorization/role-claims-manifest",method:"OPTIONS",source:"system"})}let domainRoutes=[];if(config.domains?.enabled){let domainsBasePath=config.domains.basePath||"/domains";domainRoutes.push({path:`${basePath}${domainsBasePath}/resolve`,method:"GET",source:"system"})}let tenantRoutes=[];if(config.database?.isMultiTenant)tenantRoutes.push({path:`${basePath}/tenants/check-subdomain/:subdomain`,method:"GET",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/self-signup`,method:"POST",source:"system"}),tenantRoutes.push({path:`${basePath}/tenants/refresh`,method:"POST",source:"system"});let customRoutes=[{path:"/nucleus-core",method:"GET",source:"custom"},{path:"/public",method:"GET",source:"custom"},{path:"/docs",method:"GET",source:"custom"},{path:"/docs/json",method:"GET",source:"custom"},{path:"/swagger",method:"GET",source:"custom"},{path:"/swagger/json",method:"GET",source:"custom"}],configPublicPaths=config.authorization?.publicPaths||[],ALL_PUBLIC_METHODS=["GET","HEAD","POST","PUT","PATCH","DELETE","OPTIONS"],withHead=(path,source)=>[{path,method:"HEAD",source}],configPublicRoutes=configPublicPaths.flatMap((entry)=>{let trimmed=entry.trim(),qualified=trimmed.match(/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)\s+(.+)$/i);if(qualified?.[1]&&qualified[2]){let method=qualified[1].toUpperCase(),path=qualified[2].trim(),routes=[{path,method,source:"custom"}];if(method!=="OPTIONS")routes.push({path,method:"OPTIONS",source:"custom"});if(method==="GET")routes.push(...withHead(path,"custom"));return routes}if(trimmed.startsWith("/auth/"))return ALL_PUBLIC_METHODS.map((method)=>({path:trimmed,method,source:"custom"}));return logger.warn(`[Security] publicPaths entry "${trimmed}" is unqualified \u2014 exposing GET + HEAD + OPTIONS only. To make a write method public, use the explicit form, e.g. "POST ${trimmed}".`),[{path:trimmed,method:"GET",source:"custom"},...withHead(trimmed,"custom"),{path:trimmed,method:"OPTIONS",source:"custom"}]});return[...authRoutes,...entityRoutes,...systemRoutes,...pubsubRoutes,...paymentRoutes,...discoveryRoutes,...domainRoutes,...tenantRoutes,...customRoutes,...configPublicRoutes]}function isPublicRoute(publicRoutes,path,method,caller){return findPublicRoute(publicRoutes,path,method,caller)!==void 0}function findPublicRoute(publicRoutes,path,method,caller){if(/\/\/|\\|%2f|%2e|%5c/i.test(path))return;let normalizedPath=path.replace(/\/$/,""),normalizedMethod=method.toUpperCase();for(let route of publicRoutes){if(route.method!==normalizedMethod)continue;if(matchPath(route.path,normalizedPath)){let opt=route.authenticateWhenCredentialed;if(opt&&caller){if(!(opt.bypassHeaders??[]).some((name2)=>!!caller.headers.get(name2))&&caller.credentialed())continue}return route}}return}function matchPath(pattern,path){if(pattern===path)return!0;let patternParts=pattern.split("/").filter(Boolean),pathParts=path.split("/").filter(Boolean);if(patternParts.length!==pathParts.length)return!1;for(let i=0;i<patternParts.length;i++){let patternPart=patternParts[i],pathPart=pathParts[i];if(patternPart?.startsWith(":"))continue;if(patternPart!==pathPart)return!1}return!0}init_routeCollector();import{eq as eq22}from"drizzle-orm";init_passwordPolicy();init_requireGodmin();import{eq as eq21}from"drizzle-orm";var col7=(table,name2)=>{let tableRecord=table,snakeCase=name2.replace(/([A-Z])/g,"_$1").toLowerCase();return tableRecord[name2]||tableRecord[snakeCase]};async function requireGodmin(db,usersTable,userId){let user=(await db.select().from(usersTable).where(eq21(col7(usersTable,"id"),userId)).limit(1))[0];if(!user?.isGod)return!1;return accountStateRefusal(user)===null}function validatePassword(pwd,policy,identity){return validateAgainstPolicy(pwd,policy,identity)}var handleActivateUsers=(db,usersTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!1,lockedUntil:null,failedLoginAttempts:0,updatedAt:new Date}).where(eq22(col7(usersTable,"cohortId"),ctx.params.id)).returning();return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_ACTIVATE_USERS",userId,summary:`Activated ${result.length} users in cohort`}),{success:!0,data:{affected:result.length}}};init_assignDefaultRole();init_utils6();import{count,eq as eq24,inArray as inArray7}from"drizzle-orm";var handleBulkCreateUsers=(config,logger2)=>{let{db,usersTable,cohortsTable,rolesTable,userRolesTable,profilesTable}=config;return async(ctx)=>{if(!db||!usersTable||!cohortsTable)return ctx.set.status=500,{success:!1,message:"Server misconfigured"};let callerId=ctx.request.headers.get("x-user-id");if(!callerId||!await requireGodmin(db,usersTable,callerId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let cohortId=ctx.params.id;if((await db.select().from(cohortsTable).where(eq24(col7(cohortsTable,"id"),cohortId)).limit(1)).length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let{users:explicitUsers,emailPrefix,emailDomain,sharedPassword,count:userCount,roleIds}=ctx.body,userList=[];if(explicitUsers&&explicitUsers.length>0)for(let u of explicitUsers)userList.push({email:u.email.toLowerCase().trim(),password:u.password,firstName:u.profile?.firstName,lastName:u.profile?.lastName});else if(emailPrefix&&emailDomain&&sharedPassword&&userCount){let padLen=String(userCount).length;for(let i=1;i<=userCount;i++){let paddedNum=String(i).padStart(padLen,"0");userList.push({email:`${emailPrefix}-${paddedNum}@${emailDomain}`.toLowerCase(),password:sharedPassword})}}else return ctx.set.status=400,{success:!1,message:'Provide either "users" array or "emailPrefix" + "emailDomain" + "sharedPassword" + "count"'};if(userList.length>500)return ctx.set.status=400,{success:!1,message:"Maximum 500 users per batch"};for(let entry of userList){let validation=validatePassword(entry.password,config.passwordPolicy,entry.email);if(!validation.valid)return ctx.set.status=400,{success:!1,message:`Password too weak for ${entry.email}`,errors:validation.errors}}let emails=userList.map((u)=>u.email),existingRows=await db.select({email:col7(usersTable,"email")}).from(usersTable).where(inArray7(col7(usersTable,"email"),emails)),existingEmails=new Set(existingRows.map((r)=>String(r.email).toLowerCase())),created=[],skipped=[],now=new Date;for(let entry of userList){if(existingEmails.has(entry.email)){skipped.push(entry.email);continue}let hashedPw=await hashPassword(entry.password),newUser=(await db.insert(usersTable).values({email:entry.email,password:hashedPw,emailVerified:!0,verifiedAt:now,isLocked:!1,cohortId,createdAt:now,updatedAt:now}).returning())[0];if(!newUser)continue;let newUserId=String(newUser.id);if(created.push({id:newUserId,email:entry.email,password:entry.password}),roleIds&&roleIds.length>0&&rolesTable&&userRolesTable){let validIds=(await db.select({id:col7(rolesTable,"id")}).from(rolesTable).where(inArray7(col7(rolesTable,"id"),roleIds))).map((r)=>String(r.id));if(validIds.length>0)await db.insert(userRolesTable).values(validIds.map((roleId)=>({userId:newUserId,roleId})))}else{let cohortDefaultRoles=resolveDefaultRoleNames(config);if(cohortDefaultRoles.length>0)await assignDefaultRoles({db,userId:newUserId,roleNames:cohortDefaultRoles,rolesTable,userRolesTable,logger:logger2})}if((entry.firstName||entry.lastName)&&profilesTable)await db.insert(profilesTable).values({userId:newUserId,firstName:entry.firstName??null,lastName:entry.lastName??null,createdAt:now,updatedAt:now}).catch((err)=>{logger2.warn("[Cohort] Failed to create profile for user",{userId:newUserId,error:err.message})})}let countResult=await db.select({count:count()}).from(usersTable).where(eq24(col7(usersTable,"cohortId"),cohortId)),totalUsers=Number(countResult[0]?.count)||0;return await db.update(cohortsTable).set({userCount:totalUsers,updatedAt:new Date}).where(eq24(col7(cohortsTable,"id"),cohortId)),logger2.audit({entityName:"user_cohorts",entityId:cohortId,operation:"COHORT_BULK_CREATE",userId:callerId,summary:`Bulk created ${created.length} users in cohort (${skipped.length} skipped)`}),{success:!0,data:{created:created.length,skipped:skipped.length,skippedEmails:skipped,users:created}}}};var handleCreateCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let{name:name2,description,expiresAt,metadata}=ctx.body,now=new Date,inserted=await db.insert(cohortsTable).values({name:name2,description:description??null,createdBy:userId,expiresAt:expiresAt?new Date(expiresAt):null,userCount:0,metadata:metadata??{},createdAt:now,updatedAt:now}).returning();return logger2.audit({entityName:"user_cohorts",entityId:inserted[0]?.id,operation:"COHORT_CREATE",userId,summary:`Created cohort "${name2}"`}),{success:!0,data:inserted[0]}};init_revokeUserSessions();import{eq as eq25}from"drizzle-orm";var handleDeactivateUsers=(db,usersTable,logger2,sessionsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let result=await db.update(usersTable).set({isLocked:!0,updatedAt:new Date}).where(eq25(col7(usersTable,"cohortId"),ctx.params.id)).returning(),signedOut=await revokeUserSessions({db,sessionsTable,onError:(error)=>logger2.error("Cohort sessions could not be revoked after deactivating",{error,cohortId:ctx.params.id})},result.map((row)=>String(row.id)));return logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DEACTIVATE_USERS",userId,summary:`Deactivated ${result.length} users in cohort, ending ${signedOut} session(s)`}),{success:!0,data:{affected:result.length,signedOut}}};import{eq as eq26,inArray as inArray10}from"drizzle-orm";var handleDeleteUsers=(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userIds=(await db.select({id:col7(usersTable,"id")}).from(usersTable).where(eq26(col7(usersTable,"cohortId"),ctx.params.id))).map((u)=>String(u.id));if(userIds.length>0){if(userRolesTable)await db.delete(userRolesTable).where(inArray10(col7(userRolesTable,"userId"),userIds));if(profilesTable)await db.delete(profilesTable).where(inArray10(col7(profilesTable,"userId"),userIds));await db.delete(usersTable).where(inArray10(col7(usersTable,"id"),userIds))}return await db.update(cohortsTable).set({userCount:0,updatedAt:new Date}).where(eq26(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE_USERS",userId,summary:`Deleted ${userIds.length} users from cohort`}),{success:!0,data:{deleted:userIds.length}}};import{eq as eq27}from"drizzle-orm";var handleGetCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable).where(eq27(col7(cohortsTable,"id"),ctx.params.id)).limit(1);if(rows.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};let userRows=await db.select().from(usersTable).where(eq27(col7(usersTable,"cohortId"),ctx.params.id));return{success:!0,data:{...rows[0],users:userRows}}};import{eq as eq28}from"drizzle-orm";var csvCell=(value)=>{let s=value==null?"":String(value);if(/^[=+\-@\t\r]/.test(s))s=`'${s}`;if(/[",\n\r]/.test(s))s=`"${s.replace(/"/g,'""')}"`;return s},handleExportUsers=(db,usersTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let userRows=await db.select().from(usersTable).where(eq28(col7(usersTable,"cohortId"),ctx.params.id)),lines=["email,status,locked,created_at"];for(let row of userRows){let u=row;lines.push([csvCell(u.email),csvCell(u.isActive?"active":"inactive"),csvCell(u.isLocked?"yes":"no"),csvCell(u.createdAt)].join(","))}return ctx.set.headers["content-type"]="text/csv",ctx.set.headers["content-disposition"]=`attachment; filename="cohort-${ctx.params.id}-users.csv"`,lines.join(`
-`)};var handleListCohorts=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq29}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq29(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq30}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq30(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_Authorization();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(roles.includes(GODMIN_ROLE_NAME))return!0;if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and18,arrayContains,arrayOverlaps,asc,createTableRelationsHelpers,desc as desc5,eq as eq32,getTableName,gt,gte,ilike,inArray as inArray12,isNotNull,isNull as isNull4,like,lt as lt2,lte,ne as ne3,notInArray,or as or4,sql as sql8}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","verification_requirements","verification_instances","verification_flows","verification_steps","verification_edges","verification_verifier_configs","verification_notification_rules","verification_notification_recipients","verification_notification_channels","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();import{and as and16,eq as eq31,inArray as inArray11}from"drizzle-orm";async function activeVerificationExists(db,schemaTables,entityName,entityId){let instancesTable=schemaTables.verificationInstances;if(!instancesTable)return!1;let cols=instancesTable;if(!cols.entityName||!cols.entityId||!cols.status)return!1;try{return(await db.select().from(instancesTable).where(and16(inArray11(cols.entityName,bothSpellings(entityName)),eq31(cols.entityId,entityId),eq31(cols.status,"active"))).limit(1)).length>0}catch{return!1}}async function verifierAwaitedByVerification(db,schemaTables,who){if(!who.role&&!who.userId)return!1;let{verificationRequirements:reqTable,verificationInstances:instTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;try{let match=who.role?eq31(r.verifierRole,who.role):eq31(r.verifierUserId,who.userId);if(who.role&&!r.verifierRole)return!1;if(who.userId&&!r.verifierUserId)return!1;return(await db.select().from(reqTable).innerJoin(instTable,eq31(r.instanceId,i.id)).where(and16(eq31(r.status,"pending"),eq31(i.status,"active"),match)).limit(1)).length>0}catch{return!1}}function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column=rule.column;if(!column)return!1;let value2=payload[column]??payload[toCamelCase2(column)]??payload[toSnakeCase2(column)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-client-ip")?.trim()||headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase2(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}import{and as and17,or as or3,sql as sql7}from"drizzle-orm";var MAX_SEARCH_TOKENS=10,TURKISH_LETTERS="\u0130\u0131\u015E\u015F\u011E\u011F\xDC\xFC\xD6\xF6\xC7\xE7",ASCII_EQUIVALENTS="IiSsGgUuOoCc";function searchTokens(term){return term.split(/\s+/).filter(Boolean).slice(0,MAX_SEARCH_TOKENS)}function foldForSearch(value2){let folded="";for(let character of value2){let index=TURKISH_LETTERS.indexOf(character);folded+=index===-1?character:ASCII_EQUIVALENTS[index]}return folded.toLowerCase()}function asRegexLiteral(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,(character)=>`\\${character}`)}var WORD_START="(^|[^[:alnum:]])";function folded(column){return sql7`lower(translate(cast(${column} as text), ${TURKISH_LETTERS}, ${ASCII_EQUIVALENTS}))`}function buildSearchCondition(columns,term){let tokens=searchTokens(term);if(tokens.length===0||columns.length===0)return null;let perToken=tokens.map((token)=>{let pattern2=`${WORD_START}${asRegexLiteral(foldForSearch(token))}`;return or3(...columns.map((column)=>sql7`${folded(column)} ~ ${pattern2}`))}).filter((condition)=>condition!==void 0);if(perToken.length===0)return null;return and17(...perToken)??null}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq32(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text2=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text2(row.userId??row.user_id),roleId:text2(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq32(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq32(ur.roleId,r.id)).where(eq32(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or4(...subs):and18(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v;switch(filter.operator){case"eq":return eq32(sqlCol,coerce2(filter.value));case"neq":return ne3(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray12(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql8`cardinality(${sqlCol}) = 0`;case"isNull":return isNull4(sqlCol);case"isNotNull":return isNotNull(sqlCol);default:return null}}function describeIgnoredFields(fields){if(fields.length===0)return{};let unique=[...new Set(fields)];return{ignored_fields:unique,message:`Saved. These fields were ignored because they cannot be set this way: ${unique.join(", ")}.`}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq32(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},renameStrandsVerification=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.roles)return null;let newName=payload.name;if(typeof newName!=="string")return null;let oldName=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0]?.name;if(typeof oldName!=="string"||oldName===newName)return null;return await verifierAwaitedByVerification(database,schemaTables,{role:oldName})?oldName:null},deactivationStrandsVerification=async(id,payload)=>{if(!database)return null;let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return null;if(payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0];if(!row)return null;if(row.isActive===!1||row.is_active===!1)return null;let who=isRoles?{role:String(row.name??"")}:{userId:id};if(isRoles&&!who.role)return null;if(!await verifierAwaitedByVerification(database,schemaTables,who))return null;return isRoles?String(row.name):String(row.email??row.name??id)},strandsVerification=async(ids)=>{if(!database)return[];let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return[];let blocked=[];for(let id of ids){let who={userId:id};if(isRoles){let name2=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0]?.name;if(!name2)continue;who={role:String(name2)}}if(await verifierAwaitedByVerification(database,schemaTables,who))blocked.push(id)}return blocked},announceWrite=(request,operation,rows,writtenBy)=>{if(!config.onEntityWritten)return;for(let row of Array.isArray(rows)?rows:[rows]){let id=row?.id;if(!id)continue;config.onEntityWritten({entityName:tableName,entityId:String(id),operation,userId:writtenBy||void 0,request})}},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`;entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&!q.searchFields)return ctx.set.status=400,{success:!1,message:"A 'search' needs 'searchFields' naming the columns to search, e.g. searchFields=name,email \u2014 without it the term would be ignored and every row returned."};if(q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchColumns=q.searchFields.map((f)=>resolveCol2(f.trim())).filter((c)=>c!==null),searchCondition=buildSearchCondition(searchColumns,q.search);if(searchCondition)conditions.push(searchCondition)}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and18(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and18(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql8`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql8`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql8`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and18(...conditions):void 0,countResult=await database.select({n:sql8`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and18(eq32(idCol2,params.id),...getScope):eq32(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql8`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and18(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}},ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();announceWrite(ctx.request,"create",result,userId);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};let ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and18(eq32(cols.userId,payload.userId),eq32(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(announceWrite(ctx.request,"create",result,userId),tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable){let roleName=(await database.select().from(rolesTable).where(eq32(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!0}).where(eq32(usersTable.id,payload.userId));if(roleName)config.onRoleChanged?.({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole create")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and18(eq32(idCol2,params.id),...putFormScope):eq32(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putFormAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();announceWrite(ctx.request,"update",result,userId);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and18(eq32(idCol2,params.id),...putScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and18(eq32(idCol2,params.id),...patchScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and18(eq32(idCol2,params.id),...deleteScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await activeVerificationExists(database,schemaTables2,tableName,params.id))return ctx.set.status=409,{success:!1,message:`Cannot delete: this ${tableName} is in an active verification. Complete or reject it first.`};if((await strandsVerification([params.id])).length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this ${tableName} to decide a step. Complete or reject that verification first, or reassign the step.`};if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq32(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!1}).where(eq32(usersTable.id,deletedUserRole.userId));if(roleName)config.onRoleChanged?.({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole delete")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw,ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);announceWrite(ctx.request,"create",txResult,userId);for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data,ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray12(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and18(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and18(eq32(idCol2,id),...bulkPutScope):eq32(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row}))),announceWrite(ctx.request,"update",txResult,userId);let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),blocked=[];for(let id of ids)if(await activeVerificationExists(database,schemaTables,tableName,id))blocked.push(id);if(blocked.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: ${blocked.length} of these ${tableName} are in an active verification. Complete or reject it first. Blocked ids: ${blocked.join(", ")}`};let stranding=await strandsVerification(ids);if(stranding.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${stranding.length} of these ${tableName} to decide a step. Complete or reject those verifications first. Blocked ids: ${stranding.join(", ")}`};let removed=[];await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and18(eq32(idCol2,id),...bulkDeleteScope):eq32(idCol2,id)).returning();removed.push(...r)}});{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash4}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text2=await response.text().catch(()=>""),body=null;if(text2)try{body=JSON.parse(text2)}catch{body=text2}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash4("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text2=await response.text().catch(()=>""),json={};try{json=text2?JSON.parse(text2):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text2.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and19,eq as eq33,inArray as inArray13}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray13(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and19(eq33(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text2)=>text2.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder2=claimedUnique.get(field)?.get(value2);if(holder2===void 0)continue;if(holder2!==null&&holder2===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column,records){if(!column)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column,readValues:[...readValues]}}init_AccountLink();import{and as and20,eq as eq34,inArray as inArray14}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column,value2,extra){let row={...extra,[column]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and20(inArray14(idCol,chunk),...scope):inArray14(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and20(eq34(idCol,op.id),...scope):eq34(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and20(inArray14(idCol,chunk),...scope):inArray14(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and20(eq34(matchCol,link.matchValue),...scope):eq34(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
+`)};var handleListCohorts=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let rows=await db.select().from(cohortsTable);return{success:!0,data:{items:rows,meta:{totalItems:rows.length}}}};import{eq as eq29}from"drizzle-orm";var handleDeleteCohort=(db,usersTable,cohortsTable,logger2)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};return await db.update(usersTable).set({cohortId:null,updatedAt:new Date}).where(eq29(col7(usersTable,"cohortId"),ctx.params.id)),await db.delete(cohortsTable).where(eq29(col7(cohortsTable,"id"),ctx.params.id)),logger2.audit({entityName:"user_cohorts",entityId:ctx.params.id,operation:"COHORT_DELETE",userId,summary:`Deleted cohort ${ctx.params.id}`}),{success:!0,data:null}};import{eq as eq30}from"drizzle-orm";var handleUpdateCohort=(db,usersTable,cohortsTable)=>async(ctx)=>{let userId=ctx.request.headers.get("x-user-id");if(!userId||!await requireGodmin(db,usersTable,userId))return ctx.set.status=403,{success:!1,message:"Forbidden"};let updates={updatedAt:new Date};if(ctx.body.name!==void 0)updates.name=ctx.body.name;if(ctx.body.description!==void 0)updates.description=ctx.body.description;if(ctx.body.expiresAt!==void 0)updates.expiresAt=ctx.body.expiresAt?new Date(ctx.body.expiresAt):null;if(ctx.body.metadata!==void 0)updates.metadata=ctx.body.metadata;if(ctx.body.isActive!==void 0)updates.isActive=ctx.body.isActive;let updated=await db.update(cohortsTable).set(updates).where(eq30(col7(cohortsTable,"id"),ctx.params.id)).returning();if(updated.length===0)return ctx.set.status=404,{success:!1,message:"Cohort not found"};return{success:!0,data:updated[0]}};init_esm3();var CohortBodySchema=Type.Object({name:Type.String({minLength:1,maxLength:255}),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.String()),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown()))}),CohortUpdateSchema=Type.Object({name:Type.Optional(Type.String({minLength:1,maxLength:255})),description:Type.Optional(Type.String()),expiresAt:Type.Optional(Type.Union([Type.String(),Type.Null()])),metadata:Type.Optional(Type.Record(Type.String(),Type.Unknown())),isActive:Type.Optional(Type.Boolean())}),BulkCreateUserItem=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),profile:Type.Optional(Type.Object({firstName:Type.Optional(Type.String()),lastName:Type.Optional(Type.String())}))}),BulkCreateSchema=Type.Object({users:Type.Optional(Type.Array(BulkCreateUserItem)),emailPrefix:Type.Optional(Type.String()),emailDomain:Type.Optional(Type.String()),sharedPassword:Type.Optional(Type.String({minLength:8})),count:Type.Optional(Type.Integer({minimum:1,maximum:500})),roleIds:Type.Optional(Type.Array(Type.String()))});function createCohortRoutes(config){let{db,logger:logger2,cohortsTable,usersTable,userRolesTable,profilesTable,basePath}=config;if(!db||!cohortsTable||!usersTable)return logger2.warn("[Cohort] Skipped \u2014 missing tables",{hasDb:!!db,hasCohortsTable:!!cohortsTable,hasUsersTable:!!usersTable}),collectRoutes();let declared=[defineRoute({method:"GET",path:"/",handler:handleListCohorts(db,usersTable,cohortsTable)}),defineRoute({method:"GET",path:"/:id",handler:handleGetCohort(db,usersTable,cohortsTable)}),defineRoute({method:"POST",path:"/",body:CohortBodySchema,handler:handleCreateCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"PATCH",path:"/:id",body:CohortUpdateSchema,handler:handleUpdateCohort(db,usersTable,cohortsTable)}),defineRoute({method:"DELETE",path:"/:id",handler:handleDeleteCohort(db,usersTable,cohortsTable,logger2)}),defineRoute({method:"POST",path:"/:id/bulk-create",body:BulkCreateSchema,handler:handleBulkCreateUsers(config,logger2)}),defineRoute({method:"POST",path:"/:id/deactivate-users",handler:handleDeactivateUsers(db,usersTable,logger2,config.sessionsTable??null)}),defineRoute({method:"POST",path:"/:id/activate-users",handler:handleActivateUsers(db,usersTable,logger2)}),defineRoute({method:"POST",path:"/:id/delete-users",handler:handleDeleteUsers(db,usersTable,cohortsTable,userRolesTable,profilesTable,logger2)}),defineRoute({method:"GET",path:"/:id/export",handler:handleExportUsers(db,usersTable)})];return collectRoutes([{prefix:basePath,routes:declared}])}init_deviceInfo();function shouldNotifyDevice(question){if(question.isImpersonationLogin)return!1;if(!question.emailAvailable)return!1;if(question.requiresApproval)return!0;if(question.trustScore<question.lowTrustThreshold)return!0;return question.notifyOnNewDevice&&question.isNewDevice}init_routeCollector();init_storage2();init_esm3();init_routeCollector();init_Authorization();function getUserId(request){return request.headers.get("x-user-id")}function isChatModerator(request,moderatorRoles){let roles=decodeHeaderList(request.headers.get("x-user-roles"));if(roles.includes(GODMIN_ROLE_NAME))return!0;if(moderatorRoles.length===0)return!1;let allowed=new Set(moderatorRoles.map((role)=>role.toLowerCase()));return roles.some((role)=>allowed.has(role.toLowerCase()))}function chatErrorStatus(code){switch(code){case"forbidden":return 403;case"not_found":return 404;case"validation":return 400;case"conflict":return 409;case"disabled":return 409;default:return 400}}async function guard3(set2,logger2,fn){try{return{success:!0,data:await fn()}}catch(err){if(err instanceof ChatError)return set2.status=chatErrorStatus(err.code),{success:!1,message:err.message};return logger2.error("[Chat] Unhandled route error",{error:err instanceof Error?err.message:String(err)}),set2.status=500,{success:!1,message:"Internal server error"}}}function unauthorized(set2){return set2.status=401,{success:!1,message:"Authentication required"}}function createConversationRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations",handler:({request,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.listConversations(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0}))},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"List my conversations"}}),defineRoute({method:"POST",path:"/conversations",handler:({request,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>{if(input.type==="group"){if(!input.title)throw new ChatError("validation","A group title is required");return service.createGroup({creatorId:userId,title:input.title,description:input.description,avatarFileId:input.avatarFileId,participantIds:input.participantIds??[]})}if(!input.targetUserId)throw new ChatError("validation","targetUserId is required for a direct conversation");return service.getOrCreateDirect(userId,input.targetUserId)})},body:Type.Object({type:Type.Optional(Type.Union([Type.Literal("direct"),Type.Literal("group")])),targetUserId:Type.Optional(Type.String()),title:Type.Optional(Type.String()),description:Type.Optional(Type.String()),avatarFileId:Type.Optional(Type.String()),participantIds:Type.Optional(Type.Array(Type.String()))}),detail:{tags:["Chat"],summary:"Create or open a conversation"}}),defineRoute({method:"GET",path:"/conversations/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getConversation(params.id,userId))},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Get a conversation"}}),defineRoute({method:"POST",path:"/conversations/:id/participants",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{userIds}=body;return guard3(set2,logger2,()=>service.addParticipants(params.id,userId,userIds))},params:Type.Object({id:Type.String()}),body:Type.Object({userIds:Type.Array(Type.String())}),detail:{tags:["Chat"],summary:"Add group participants"}}),defineRoute({method:"DELETE",path:"/conversations/:id/participants/:userId",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,async()=>{return await service.removeParticipant(params.id,userId,params.userId),{removed:params.userId}})},params:Type.Object({id:Type.String(),userId:Type.String()}),detail:{tags:["Chat"],summary:"Remove a participant / leave group"}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}init_esm3();init_esm3();function FileSchema(){return Type.Object({size:Type.Number(),type:Type.String()},{format:"binary",additionalProperties:!0})}function FilesSchema(){return Type.Union([FileSchema(),Type.Array(FileSchema())])}init_routeCollector();init_storage2();var CONTENT_TYPE_SCHEMA=Type.Optional(Type.Union([Type.Literal("text"),Type.Literal("image"),Type.Literal("file"),Type.Literal("video"),Type.Literal("audio")]));function createMessageRoutes(deps){let{logger:logger2,getService}=deps,declared=[defineRoute({method:"GET",path:"/conversations/:id/messages",handler:({request,params,query,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request);return guard3(set2,logger2,()=>service.getMessages({conversationId:params.id,userId,limit:query.limit?Number(query.limit):void 0,before:query.before||void 0}))},params:Type.Object({id:Type.String()}),query:Type.Object({limit:Type.Optional(Type.String()),before:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Get conversation messages (newest first)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),input=body;return guard3(set2,logger2,()=>service.sendMessage({conversationId:params.id,senderId:userId,content:input.content,contentType:input.contentType,replyToId:input.replyToId,clientMessageId:input.clientMessageId,attachments:input.attachmentIds?.map((fileId)=>({fileId})),metadata:input.metadata}))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.Optional(Type.String()),contentType:CONTENT_TYPE_SCHEMA,replyToId:Type.Optional(Type.String()),clientMessageId:Type.Optional(Type.String()),attachmentIds:Type.Optional(Type.Array(Type.String())),metadata:Type.Optional(Type.Any())}),detail:{tags:["Chat"],summary:"Send a message (link pre-uploaded attachments)"}}),defineRoute({method:"POST",path:"/conversations/:id/messages/upload",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);if(!deps.attachmentsAvailable)return set2.status=409,{success:!1,message:"File attachments require storage and CDN to be enabled"};let{service,schemaTables}=getService(request);return guard3(set2,logger2,async()=>{let filesTable=resolveSchemaTable(schemaTables,"files",logger2);if(!filesTable)throw new ChatError("disabled","Files table unavailable in this schema");let{data,files}=parseFormDataBody(body,deps.storageConfig);if(files.length===0)throw new ChatError("validation","At least one file is required");let{records,failed}=await persistUploadedFiles({db:deps.db,filesTable,files,storageConfig:deps.storageConfig,subFolder:"chat",userId});if(records.length===0)throw new ChatError("validation",failed[0]?.error??"File upload failed");if(deps.cdnMedia)scheduleUploadMediaProcessing(records,{storagePath:deps.storageConfig.basePath,media:deps.cdnMedia,logger:logger2});let content=typeof data.content==="string"?data.content:void 0,replyToId=typeof data.replyToId==="string"?data.replyToId:void 0,clientMessageId=typeof data.clientMessageId==="string"?data.clientMessageId:void 0;return service.sendMessage({conversationId:params.id,senderId:userId,content,replyToId,clientMessageId,attachments:records.map((record3)=>({fileId:record3.id,originalName:record3.originalName,mimeType:record3.mimeType,size:record3.size}))})})},type:"formdata",params:Type.Object({id:Type.String()}),body:Type.Object({[deps.storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[deps.storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:["Chat"],summary:"Send a message with uploaded file attachments"}}),defineRoute({method:"POST",path:"/conversations/:id/read",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{messageId}=body;return guard3(set2,logger2,()=>service.markRead(params.id,userId,messageId))},params:Type.Object({id:Type.String()}),body:Type.Object({messageId:Type.Optional(Type.String())}),detail:{tags:["Chat"],summary:"Mark a conversation as read"}}),defineRoute({method:"POST",path:"/conversations/:id/typing",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{isTyping}=body;return guard3(set2,logger2,async()=>{return await service.setTyping(params.id,userId,isTyping??!0),{ok:!0}})},params:Type.Object({id:Type.String()}),body:Type.Object({isTyping:Type.Optional(Type.Boolean())}),detail:{tags:["Chat"],summary:"Broadcast a typing indicator"}}),defineRoute({method:"PATCH",path:"/messages/:id",handler:({request,params,body,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),{content}=body;return guard3(set2,logger2,()=>service.editMessage(params.id,userId,content))},params:Type.Object({id:Type.String()}),body:Type.Object({content:Type.String()}),detail:{tags:["Chat"],summary:"Edit a message"}}),defineRoute({method:"DELETE",path:"/messages/:id",handler:({request,params,set:set2})=>{let userId=getUserId(request);if(!userId)return unauthorized(set2);let{service}=getService(request),asModerator=isChatModerator(request,deps.config.moderatorRoles??[]);return guard3(set2,logger2,async()=>{if(await service.deleteMessage(params.id,userId,asModerator),asModerator)logger2.warn("[CHAT] Message deleted by a moderator",{actorId:userId,messageId:params.id});return{deleted:params.id}})},params:Type.Object({id:Type.String()}),detail:{tags:["Chat"],summary:"Delete a message",description:"Sender-only, unless the caller is godmin or holds a role from chat.moderatorRoles \u2014 then any message, and `deletionEnabled` does not apply."}})];return collectRoutes([{prefix:deps.config.basePath,routes:declared}])}function createChatRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,broadcaster,tenantRegistry,storageConfig,attachmentsAvailable,cdnBasePath,cdnMedia}=routeConfig,buildService=(tables)=>new ChatService({db,schemaTables:tables,config,logger:logger2,broadcaster,cdnBasePath,attachmentsAvailable,deleteStoredFile:(file)=>deleteFile(file.path,file.name,storageConfig.basePath)}),defaultService=buildService(schemaTables),deps={db,config,logger:logger2,storageConfig,attachmentsAvailable,getService:(request)=>{if(!tenantRegistry)return{service:defaultService,schemaTables};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{service:defaultService,schemaTables};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{service:defaultService,schemaTables};return{service:buildService(ctx.schemaTables),schemaTables:ctx.schemaTables}},cdnMedia},routes=collectRoutes();return routes.use(createConversationRoutes(deps)),routes.use(createMessageRoutes(deps)),logger2.info(`[Chat] Routes registered at ${config.basePath}`,{attachmentsAvailable,groupsEnabled:config.groupsEnabled}),{routes,chatService:defaultService}}init_esm3();init_routeCollector();init_godminGuard();init_helpers4();function createConfigRoutes(routeConfig){let{logger:logger2,resolvedOptions,configFilePath,basePath,onConfigUpdate,db,schemaTables,getRedis}=routeConfig,guard4=createGodminGuard2({logger:logger2,db:db??null,schemaTables,area:"config management"});logger2.info(`[ConfigManagement] Routes enabled at ${basePath}`);let declared=[defineRoute({method:"GET",path:"/",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions));return{isSuccess:!0,message:"Current running configuration",data:{config:maskSensitiveFields(configCopy),configFilePath,sections:buildSectionsMeta(resolvedOptions)}}},detail:{tags:["Config Management"],summary:"Get full running configuration",description:"Returns the full running configuration with sensitive fields masked."}}),defineRoute({method:"GET",path:"/sections",handler:()=>({isSuccess:!0,message:"Config section metadata",data:{sections:buildSectionsMeta(resolvedOptions)}}),detail:{tags:["Config Management"],summary:"List all config sections with metadata",description:"Section list is derived at runtime from the config object \u2014 no hardcoding."}}),defineRoute({method:"GET",path:"/env",handler:()=>{let configCopy=JSON.parse(JSON.stringify(resolvedOptions)),declared2=scanEnvVars(configCopy),declaredNames=new Set(declared2.map((e)=>e.envName)),undeclared=scanUndeclaredEnv(declaredNames),entries=[...declared2,...undeclared],resolvedCount=entries.filter((e)=>e.resolved).length,missingCount=entries.length-resolvedCount,unrecognizedCount=undeclared.length;return{isSuccess:!0,message:`Found ${entries.length} env vars (${resolvedCount} resolved, ${missingCount} missing, ${unrecognizedCount} unrecognized)`,data:{entries,totalCount:entries.length,resolvedCount,missingCount,unrecognizedCount}}},detail:{tags:["Config Management"],summary:"Get environment variables (declared + undeclared)",description:"Surfaces both (a) DECLARED env vars \u2014 UPPER_SNAKE_CASE references found in the config tree (recognized:true) \u2014 and (b) UNDECLARED env vars actually present in process.env but not declared (recognized:false), minus Kubernetes service-link and OS/interpreter infra noise, so orphaned / junk config surfaces for cleanup. Sensitive values are masked; AI-provider *_API_KEY vars are never surfaced."}}),defineRoute({method:"GET",path:"/overrides",handler:async()=>{let redis=getRedis();if(!redis)return{isSuccess:!0,message:"Redis not available \u2014 no overrides stored",data:{overrides:null,sectionCount:0,sections:[]}};let overrides=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),sections=overrides?Object.keys(overrides).filter((k)=>{let v=overrides[k];return v!==void 0&&v!==null&&(typeof v!=="object"||Object.keys(v).length>0)}):[];return{isSuccess:!0,message:sections.length>0?`${sections.length} section override(s) stored in Redis`:"No overrides in Redis",data:{overrides:overrides?maskSensitiveFields(overrides):null,sectionCount:sections.length,sections}}},detail:{tags:["Config Management"],summary:"View Redis config overrides",description:"Returns overrides stored in Redis that will be merged on next restart."}}),defineRoute({method:"DELETE",path:"/overrides",handler:async(ctx)=>{let redis=getRedis();if(!redis)return ctx.set.status=503,{isSuccess:!1,message:"Redis not available",data:null};let existing=await readOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),clearedSections=existing?Object.keys(existing):[];return await clearOverridesFromRedis(redis,resolvedOptions.appId||"nucleus"),logger2.info("[ConfigManagement] Redis overrides cleared",{clearedSections}),{isSuccess:!0,message:clearedSections.length>0?`Cleared ${clearedSections.length} override(s) from Redis. Restart to revert to config.json defaults.`:"No overrides to clear.",data:{message:"Redis overrides cleared",clearedSections}}},detail:{tags:["Config Management"],summary:"Clear all Redis config overrides",description:"Removes all stored overrides from Redis. Restart to revert to config.json defaults."}}),defineRoute({method:"GET",path:"/:section",handler:({params,set:set2})=>{let{section}=params;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};let sectionValue=extractSection(resolvedOptions,section),restart=isRestartRequired(section),maskedValue=sectionValue;if(typeof sectionValue==="object"&&sectionValue!==null&&!Array.isArray(sectionValue))maskedValue=maskSensitiveFields({[section]:sectionValue})[section];return{isSuccess:!0,message:`Config section: ${section}`,data:{section,config:maskedValue??null,restartRequired:restart}}},params:Type.Object({section:Type.String()}),detail:{tags:["Config Management"],summary:"Get a specific config section",description:"Returns a specific config section with sensitive fields masked."}}),defineRoute({method:"PATCH",path:"/:section",handler:async({params,body,set:set2})=>{let{section}=params,payload=body;if(!hasSection(resolvedOptions,section))return set2.status=404,{isSuccess:!1,message:`Unknown config section: ${section}`,data:null};if(!payload.config||typeof payload.config!=="object")return set2.status=400,{isSuccess:!1,message:'Request body must contain a "config" object',data:null};let restart=isRestartRequired(section),currentValue=extractSection(resolvedOptions,section),submitted=Array.isArray(currentValue)||currentValue===void 0||typeof currentValue==="string"||typeof currentValue==="number"||typeof currentValue==="boolean"?payload.config.value!==void 0?payload.config.value:payload.config:payload.config,incoming=restoreMaskedEchoes(section,currentValue,submitted),newValue;if(typeof currentValue==="object"&&currentValue!==null&&!Array.isArray(currentValue))newValue=deepMerge(currentValue,incoming);else newValue=incoming;if(applySectionUpdate(resolvedOptions,section,newValue),!restart)onConfigUpdate(section,newValue);let persistMethod="memory-only",persistWarning=null;if(configFilePath)try{await persistConfigToDisk(configFilePath,resolvedOptions),persistMethod="disk",logger2.info(`[ConfigManagement] Section "${section}" persisted to disk`)}catch(diskErr){let diskMsg=diskErr instanceof Error?diskErr.message:String(diskErr);logger2.warn(`[ConfigManagement] Disk persist failed: ${diskMsg}`);let redis=getRedis();if(redis)try{await persistSectionToRedis(redis,resolvedOptions.appId||"nucleus",section,newValue),persistMethod="redis",logger2.info(`[ConfigManagement] Section "${section}" persisted to Redis (disk unavailable)`)}catch(redisErr){let redisMsg=redisErr instanceof Error?redisErr.message:String(redisErr);logger2.error(`[ConfigManagement] Redis persist also failed: ${redisMsg}`),persistWarning=`Disk: ${diskMsg}. Redis: ${redisMsg}. Changes are in-memory only and will be lost on restart.`}else persistWarning=`Disk: ${diskMsg}. Redis not available. Changes are in-memory only and will be lost on restart.`}logger2.info(`[ConfigManagement] Section "${section}" updated (persist: ${persistMethod}, restart-required: ${restart})`);let updatedValue=extractSection(resolvedOptions,section),maskedUpdated=updatedValue;if(typeof updatedValue==="object"&&updatedValue!==null&&!Array.isArray(updatedValue))maskedUpdated=maskSensitiveFields({[section]:updatedValue})[section];let baseMsg=restart?`Config section "${section}" saved (${persistMethod}). Restart required for changes to take effect.`:`Config section "${section}" updated and applied (${persistMethod}).`;return{isSuccess:!0,message:persistWarning?`${baseMsg} Warning: ${persistWarning}`:baseMsg,data:{section,applied:!restart,restartRequired:restart,config:maskedUpdated}}},params:Type.Object({section:Type.String()}),body:Type.Object({config:Type.Record(Type.String(),Type.Unknown())}),detail:{tags:["Config Management"],summary:"Update a config section",description:"Deep-merges the payload into the section. Hot-reloadable sections apply immediately. Restart-required sections are saved to disk only."}}),defineRoute({method:"POST",path:"/restart",handler:({body})=>{let delayMs=body.delayMs??1000;logger2.info(`[ConfigManagement] Restart scheduled in ${delayMs}ms`);let scheduledAt=new Date().toISOString();return setTimeout(()=>{logger2.info("[ConfigManagement] Restarting process..."),process.exit(0)},delayMs),{isSuccess:!0,message:`Server restart scheduled in ${delayMs}ms`,data:{message:`Process will exit in ${delayMs}ms. Orchestrator (K8s/PM2/systemd) will restart it.`,scheduledAt}}},body:Type.Optional(Type.Object({delayMs:Type.Optional(Type.Number())})),detail:{tags:["Config Management"],summary:"Restart the server process",description:"Triggers a graceful process exit after a configurable delay. The orchestrator (K8s, PM2, systemd) is expected to restart the process automatically."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}init_routeMount();init_esm3();init_routeCollector();init_adminGuard();var requireAuth=(ctx)=>ctx.request.headers.get("x-user-id"),fail=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin=(ctx)=>hasGodminRole(ctx.request),ownsHostname=(ctx,record3)=>{if(isGodmin(ctx))return!0;let caller=callerSchemaOf(ctx);return record3.schemaName!=null&&record3.schemaName===caller};function createHostnameRoutes(config){let base=config.basePath,declared=[defineRoute({method:"POST",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let body=ctx.body,callerSchema=callerSchemaOf(ctx),schemaName=body.schemaName??null,tenantId=body.tenantId??null;if(!hasGodminRole(ctx.request)){if(schemaName&&schemaName!==callerSchema)return fail(ctx,403,"Cannot bind a hostname to another tenant's schema");schemaName=callerSchema;let ownTenantId=config.resolveTenantIdForSchema?.(callerSchema)??null;if(tenantId&&tenantId!==ownTenantId)return fail(ctx,403,"Cannot bind a hostname to another tenant");tenantId=ownTenantId}try{let result=await service.createHostname({hostname:body.hostname,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,schemaName,isPrimary:body.isPrimary});return{success:!0,message:"Custom hostname created",data:{hostname:result.hostname,instructions:result.instructions}}}catch(err){return fail(ctx,400,err instanceof Error?err.message:"Failed to create hostname")}},body:Type.Object({hostname:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),schemaName:Type.Optional(Type.String()),isPrimary:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Create custom hostname"}}),defineRoute({method:"GET",path:`${base}/hostnames`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin(ctx))items=await service.listHostnames({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let ownTenantId=config.resolveTenantIdForSchema?.(callerSchemaOf(ctx))??null;items=ownTenantId?await service.listHostnames({tenantId:ownTenantId}):[]}return{success:!0,message:`Found ${items.length} hostnames`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let record3=await service.getHostname(ctx.params.id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"Hostname found",data:record3}}}),defineRoute({method:"GET",path:`${base}/hostnames/:id/instructions`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");return{success:!0,message:"DNS instructions",data:{instructions:await service.getInstructions(id)}}}})],svc=(ctx)=>{let s=config.getDomainService();if(!s)return ctx.set.status=503,null;return s},lifecycle2=(suffix,run,summary)=>{declared.push(defineRoute({method:"POST",path:`${base}/hostnames/:id/${suffix}`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail(ctx,503,"Domains not available");if(!requireAuth(ctx))return fail(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getHostname(id);if(!record3||!ownsHostname(ctx,record3))return fail(ctx,404,"Hostname not found");try{let data=await run(service,id);if(!data)return fail(ctx,404,"Hostname not found");return{success:!0,message:summary,data}}catch(err){return fail(ctx,400,err instanceof Error?err.message:summary)}}}))};return lifecycle2("verify",(s,id)=>s.verifyHostname(id),"Verification processed"),lifecycle2("activate",(s,id)=>s.activateHostname(id),"Hostname activated"),lifecycle2("disable",(s,id)=>s.disableHostname(id),"Hostname disabled"),lifecycle2("make-primary",(s,id)=>s.makePrimary(id),"Primary hostname set"),lifecycle2("refresh-status",(s,id)=>s.refreshStatus(id),"Status refreshed"),collectRoutes([{routes:declared}])}init_esm3();init_routeCollector();init_adminGuard();var requireAuth2=(ctx)=>ctx.request.headers.get("x-user-id"),fail2=(ctx,status,message)=>{return ctx.set.status=status,{success:!1,message,data:null}},callerSchemaOf2=(ctx)=>ctx.request.headers.get("x-tenant-schema"),isGodmin2=(ctx)=>hasGodminRole(ctx.request);function createRegistrationRoutes(config){let base=config.basePath,svc=(ctx)=>{let s=config.getRegistrationService();if(!s)return ctx.set.status=503,null;return s},ownTenantId=(ctx)=>config.resolveTenantIdForSchema?.(callerSchemaOf2(ctx))??null,ownsRegistration=(ctx,record3)=>{if(isGodmin2(ctx))return!0;let own=ownTenantId(ctx);return record3.tenantId!=null&&own!=null&&record3.tenantId===own},declared=[defineRoute({method:"POST",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let body=ctx.body,tenantId=body.tenantId??null,registrantOwnerType=body.registrantOwnerType;if(!isGodmin2(ctx)){let own=ownTenantId(ctx);if(tenantId&&tenantId!==own)return fail2(ctx,403,"Cannot register a domain for another tenant");if(tenantId=own,registrantOwnerType==="platform")return fail2(ctx,403,"Only a platform admin may register as 'platform'");registrantOwnerType="customer"}try{return{success:!0,message:"Registration requested",data:await service.createRequest({requestedDomain:body.requestedDomain,ownerId:body.ownerId,ownerType:body.ownerType,tenantId,registrantOwnerType,termsVersion:body.termsVersion,termsAccepted:body.termsAccepted,autoRenew:body.autoRenew})}}catch(err){return fail2(ctx,400,err instanceof Error?err.message:"Failed to request registration")}},body:Type.Object({requestedDomain:Type.String(),ownerId:Type.String(),ownerType:Type.Optional(Type.Union([Type.Literal("tenant"),Type.Literal("organization"),Type.Literal("user"),Type.Literal("external")])),tenantId:Type.Optional(Type.String()),registrantOwnerType:Type.Optional(Type.Union([Type.Literal("customer"),Type.Literal("platform")])),termsVersion:Type.String(),termsAccepted:Type.Boolean(),autoRenew:Type.Optional(Type.Boolean())}),detail:{tags:["Domains"],summary:"Request managed domain registration"}}),defineRoute({method:"GET",path:`${base}/registrations`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let url=new URL(ctx.request.url),items;if(isGodmin2(ctx))items=await service.listRegistrations({ownerId:url.searchParams.get("ownerId")??void 0,tenantId:url.searchParams.get("tenantId")??void 0});else{let own=ownTenantId(ctx);items=own?await service.listRegistrations({tenantId:own}):[]}return{success:!0,message:`Found ${items.length} registrations`,data:{items}}}}),defineRoute({method:"GET",path:`${base}/registrations/:id`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let record3=await service.getRegistration(ctx.params.id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration found",data:record3}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/cancel`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let cancelled=await service.cancel(id);if(!cancelled)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Registration cancelled",data:cancelled}}}),defineRoute({method:"POST",path:`${base}/registrations/:id/transfer-out`,handler:async(ctx)=>{let service=svc(ctx);if(!service)return fail2(ctx,503,"Domains not available");if(!requireAuth2(ctx))return fail2(ctx,401,"Authentication required");let id=ctx.params.id,record3=await service.getRegistration(id);if(!record3||!ownsRegistration(ctx,record3))return fail2(ctx,404,"Registration not found");let out=await service.requestTransferOut(id);if(!out)return fail2(ctx,404,"Registration not found");return{success:!0,message:"Transfer-out requested",data:out}}})];return collectRoutes([{routes:declared}])}init_routeCollector();function createResolveRoute(config){let base=config.basePath,declared=[defineRoute({method:"GET",path:`${base}/resolve`,isPublic:!0,handler:async(ctx)=>{let service=config.getDomainService();if(!service)return ctx.set.status=503,{success:!1,message:"Domains not available",data:null};let hostname=new URL(ctx.request.url).searchParams.get("hostname")||ctx.request.headers.get("host")||"";if(!hostname)return ctx.set.status=400,{success:!1,message:"hostname is required",data:null};let match=await service.resolveHostname(hostname);if(!match)return ctx.set.status=404,{success:!1,message:"No active hostname matched",data:null};return{success:!0,message:"Resolved",data:match}},detail:{tags:["Domains"],summary:"Resolve hostname to tenant",description:"Public."}})];return collectRoutes([{routes:declared}])}function createDomainRoutes(app,config){return useRoutes(app,createResolveRoute(config)),useRoutes(app,createHostnameRoutes(config)),useRoutes(app,createRegistrationRoutes(config)),app}init_esm3();import{and as and18,arrayContains,arrayOverlaps,asc,createTableRelationsHelpers,desc as desc5,eq as eq32,getTableName,gt,gte,ilike,inArray as inArray12,isNotNull,isNull as isNull4,like,lt as lt2,lte,ne as ne3,notInArray,or as or4,sql as sql8}from"drizzle-orm";import{drizzle}from"drizzle-orm/node-postgres";init_AccountLink();init_Authorization();init_routeMount();init_utils5();init_revokeUserSessions();function decideRoleAssign(params){let{callerIsGod,callerRoleNames,allowRoles,targetRoleName,subjectIsGodmin,godminRoleName}=params,callerIsGodmin=callerIsGod||callerRoleNames.includes(godminRoleName);if(!(callerIsGodmin||callerRoleNames.some((name2)=>allowRoles.includes(name2))))return{allowed:!1,status:403,reason:"not_privileged"};if(targetRoleName===godminRoleName&&!callerIsGodmin)return{allowed:!1,status:403,reason:"godmin_assignment_forbidden"};if(subjectIsGodmin&&!callerIsGodmin)return{allowed:!1,status:403,reason:"target_is_godmin"};return{allowed:!0,callerIsGodmin}}var ROLE_ASSIGN_REFUSALS={not_privileged:"You are not allowed to assign roles.",godmin_assignment_forbidden:"Only a system administrator can grant this role.",target_is_godmin:"This person\u2019s roles can only be changed by a system administrator."};init_adminGuard();init_sensitiveColumns();var snakeToCamel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase()),SENSITIVE_SYSTEM_TABLE_SNAKE=["domain_hostnames","domain_registrations","domain_provider_records","domain_verification_challenges","domain_events","payment_sub_merchants","payment_invoices","payment_subscriptions","payment_customers","payment_transactions","payment_methods","payment_products","payment_prices","payment_commission_splits","payment_splits","payment_reserves","payment_ledger_entries","payment_payout_requests","payment_settlement_policies","payment_disputes","payment_webhook_logs","verifications","verification_requirements","verification_instances","verification_flows","verification_steps","verification_edges","verification_verifier_configs","verification_notification_rules","verification_notification_recipients","verification_notification_channels","api_keys","magic_link_tokens","user_sessions","trusted_devices","integration_sources","integration_endpoints","integration_mappings"],SENSITIVE_SYSTEM_TABLES=new Set(SENSITIVE_SYSTEM_TABLE_SNAKE.flatMap((name2)=>[name2,snakeToCamel2(name2)]));function isSensitiveSystemTable(tableName){return SENSITIVE_SYSTEM_TABLES.has(tableName)}function delegatedWriteRoles(question){if(question.isRbacTable)return new Set;let roles=(question.featureSet??[]).flatMap((feature)=>question.featureAdminRoles?.[feature]??[]);return new Set(roles.map((role)=>role.toLowerCase()))}function isFeatureAdmin(question){let allowed=delegatedWriteRoles(question);if(allowed.size===0)return!1;return question.callerRoles.some((role)=>allowed.has(role.toLowerCase()))}init_storage2();import{and as and16,eq as eq31,inArray as inArray11}from"drizzle-orm";async function activeVerificationExists(db,schemaTables,entityName,entityId){let instancesTable=schemaTables.verificationInstances;if(!instancesTable)return!1;let cols=instancesTable;if(!cols.entityName||!cols.entityId||!cols.status)return!1;try{return(await db.select().from(instancesTable).where(and16(inArray11(cols.entityName,bothSpellings(entityName)),eq31(cols.entityId,entityId),eq31(cols.status,"active"))).limit(1)).length>0}catch{return!1}}async function verifierAwaitedByVerification(db,schemaTables,who){if(!who.role&&!who.userId)return!1;let{verificationRequirements:reqTable,verificationInstances:instTable}=schemaTables;if(!reqTable||!instTable)return!1;let r=reqTable,i=instTable;if(!r.status||!i.status||!i.id||!r.instanceId)return!1;try{let match=who.role?eq31(r.verifierRole,who.role):eq31(r.verifierUserId,who.userId);if(who.role&&!r.verifierRole)return!1;if(who.userId&&!r.verifierUserId)return!1;return(await db.select().from(reqTable).innerJoin(instTable,eq31(r.instanceId,i.id)).where(and16(eq31(r.status,"pending"),eq31(i.status,"active"),match)).limit(1)).length>0}catch{return!1}}function isAnonymousCreate(table,payload){let rule=table.anonymous_create;if(!rule)return!1;if(rule===!0)return!0;let column=rule.column;if(!column)return!1;let value2=payload[column]??payload[toCamelCase2(column)]??payload[toSnakeCase2(column)];return isTruthy(value2)}function isTruthy(value2){if(typeof value2==="boolean")return value2;if(typeof value2==="number")return value2!==0;if(typeof value2==="string"){let normalized=value2.trim().toLowerCase();return normalized==="true"||normalized==="1"||normalized==="yes"||normalized==="on"}return!1}function createAuditIdentity(anonymous,userId,headers){if(anonymous)return{userId:void 0,ipAddress:"anonymous",userAgent:"anonymous"};return{userId:userId||void 0,ipAddress:headers.get("x-client-ip")?.trim()||headers.get("x-forwarded-for")?.split(",")[0]?.trim()||headers.get("x-real-ip")?.trim()||"unknown",userAgent:headers.get("user-agent")||"unknown"}}function toCamelCase2(value2){return value2.replace(/_([a-z0-9])/g,(_m,c)=>c.toUpperCase())}function toSnakeCase2(value2){return value2.replace(/[A-Z]/g,(c)=>`_${c.toLowerCase()}`)}var snakeToCamel3=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function forceCreateScope(payload,authResult,resolveColumn){let scopeFilters=authResult?.scopeFilters;if(!scopeFilters)return{ok:!0};for(let[field,value2]of Object.entries(scopeFilters)){if(!resolveColumn(field))return{ok:!1,field};payload[snakeToCamel3(field)]=value2}return{ok:!0}}function decideRelationExpansion(params){let{authEnabled,targetTable,relAuth,isTargetPublicGet}=params;if(!authEnabled||!targetTable)return{expand:!0};if(relAuth===null)return isTargetPublicGet?{expand:!0}:{expand:!1};if(!relAuth.authorized)return{expand:!1};let scope=relAuth.scopeFilters;if(scope&&Object.keys(scope).length>0)return{expand:!0,scope};return{expand:!0}}function resolveRelationScopeColumn(fields,key2,toCamel5){if(Object.hasOwn(fields,key2))return fields[key2];let camel=toCamel5(key2);return Object.hasOwn(fields,camel)?fields[camel]:void 0}import{and as and17,or as or3,sql as sql7}from"drizzle-orm";var MAX_SEARCH_TOKENS=10,TURKISH_LETTERS="\u0130\u0131\u015E\u015F\u011E\u011F\xDC\xFC\xD6\xF6\xC7\xE7",ASCII_EQUIVALENTS="IiSsGgUuOoCc";function searchTokens(term){return term.split(/\s+/).filter(Boolean).slice(0,MAX_SEARCH_TOKENS)}function foldForSearch(value2){let folded="";for(let character of value2){let index=TURKISH_LETTERS.indexOf(character);folded+=index===-1?character:ASCII_EQUIVALENTS[index]}return folded.toLowerCase()}function asRegexLiteral(value2){return value2.replace(/[.*+?^${}()|[\]\\]/g,(character)=>`\\${character}`)}var WORD_START="(^|[^[:alnum:]])";function folded(column){return sql7`lower(translate(cast(${column} as text), ${TURKISH_LETTERS}, ${ASCII_EQUIVALENTS}))`}function buildSearchCondition(columns,term){let tokens=searchTokens(term);if(tokens.length===0||columns.length===0)return null;let perToken=tokens.map((token)=>{let pattern2=`${WORD_START}${asRegexLiteral(foldForSearch(token))}`;return or3(...columns.map((column)=>sql7`${folded(column)} ~ ${pattern2}`))}).filter((condition)=>condition!==void 0);if(perToken.length===0)return null;return and17(...perToken)??null}init_Authorization();init_types3();function targetFromBody(body){let record3=body??{},read2=(...keys)=>{for(let key2 of keys){let value2=record3[key2];if(typeof value2==="string"&&value2.length>0)return value2}return null};return{userId:read2("userId","user_id"),roleId:read2("roleId","role_id")}}async function readRow(db,userRolesTable,rowId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),columns=userRolesTable,row=(await db.select().from(userRolesTable).where(eq32(columns.id,rowId)).limit(1))[0];if(!row)return{userId:null,roleId:null};let text2=(value2)=>typeof value2==="string"&&value2.length>0?value2:null;return{userId:text2(row.userId??row.user_id),roleId:text2(row.roleId??row.role_id)}}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the user_roles row",{error:err instanceof Error?err.message:String(err)}),{userId:null,roleId:null}}}async function roleNameOf(db,rolesTable,roleId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),columns=rolesTable,name2=(await db.select({name:columns.name}).from(rolesTable).where(eq32(columns.id,roleId)).limit(1))[0]?.name;return typeof name2==="string"&&name2.length>0?name2:null}catch(err){return logger2.warn("[UserRoleWrite] Failed to read the role name",{error:err instanceof Error?err.message:String(err)}),null}}async function isGodmin3(db,userRolesTable,rolesTable,userId,logger2){try{let{eq:eq32}=await import("drizzle-orm"),ur=userRolesTable,r=rolesTable;return(await db.select({roleName:r.name}).from(userRolesTable).innerJoin(rolesTable,eq32(ur.roleId,r.id)).where(eq32(ur.userId,userId))).some((row)=>isGodminRole(String(row.roleName??"")))}catch(err){return logger2.warn("[UserRoleWrite] Failed to check whether the subject is a godmin",{error:err instanceof Error?err.message:String(err)}),!0}}async function resolveUserRoleSubject(deps,write){let{db,schemaTables,logger:logger2}=deps,userRolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.userRoles],rolesTable=schemaTables[AUTHORIZATION_TABLE_KEYS.roles];if(!db||!userRolesTable||!rolesTable)return{targetRoleName:null,subjectIsGodmin:!0};let fromBody=targetFromBody(write.body),fromRow=write.rowId?await readRow(db,userRolesTable,write.rowId,logger2):{userId:null,roleId:null},roleIds=[fromRow.roleId,fromBody.roleId].filter((id)=>Boolean(id)),userIds=[fromRow.userId,fromBody.userId].filter((id)=>Boolean(id));if(roleIds.length===0||userIds.length===0)return{targetRoleName:null,subjectIsGodmin:!0};let names2=await Promise.all(roleIds.map((id)=>roleNameOf(db,rolesTable,id,logger2)));if(names2.some((name2)=>name2===null))return{targetRoleName:null,subjectIsGodmin:!0};let readable=names2.filter((name2)=>name2!==null),targetRoleName=readable.find((name2)=>isGodminRole(name2))??readable[0]??null,godminFlags=await Promise.all(userIds.map((id)=>isGodmin3(db,userRolesTable,rolesTable,id,logger2)));return{targetRoleName,subjectIsGodmin:godminFlags.some(Boolean)}}init_esm3();function buildBodySchemaFromEntityColumns(entityColumns){let properties={};if(!entityColumns||entityColumns.length===0)return Type.Object({},{additionalProperties:!0});for(let col8 of entityColumns)switch(col8.type?.toLowerCase()||"string"){case"integer":case"int":case"serial":case"bigserial":case"numeric":case"decimal":properties[col8.name]=col8.notNull?Type.Number():Type.Optional(Type.Number());break;case"boolean":properties[col8.name]=col8.notNull?Type.Boolean():Type.Optional(Type.Boolean());break;case"timestamp":case"timestamptz":case"date":properties[col8.name]=col8.notNull?Type.String({format:"date-time"}):Type.Optional(Type.String({format:"date-time"}));break;case"json":case"jsonb":properties[col8.name]=Type.Optional(Type.Unknown());break;case"uuid":properties[col8.name]=col8.notNull?Type.String({format:"uuid"}):Type.Optional(Type.String({format:"uuid"}));break;default:properties[col8.name]=col8.notNull?Type.String():Type.Optional(Type.String())}return Type.Object(properties,{additionalProperties:!0})}function createBulkUpdateSchema(entityColumns){return Type.Array(Type.Object({id:Type.String(),data:Type.Partial(buildBodySchemaFromEntityColumns(entityColumns))}))}var MAX_BULK_ITEMS=500;function collectFilterFields(filter,out=[]){if(filter.operator==="or"||filter.operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];for(let f of group)collectFilterFields(f,out)}else if(filter.field)out.push(String(filter.field));return out}function firstUnknownField(fields,resolveCol){for(let field of fields){let trimmed=field.trim();if(trimmed!==""&&!resolveCol(trimmed))return trimmed}return null}var FILTER_OPERATORS=new Set(["eq","neq","gt","gte","lt","lte","like","ilike","in","notIn","isNull","isNotNull","arrayOverlaps","arrayContains","arrayEmpty","or","and"]);function firstUnusableCondition(filter){let operator=filter.operator;if(typeof operator!=="string"||!FILTER_OPERATORS.has(operator))return`Unknown operator in filter: ${String(operator)}`;if(operator==="or"||operator==="and"){let group=Array.isArray(filter.value)?filter.value:[];if(group.length===0)return`Empty "${operator}" group in filter`;for(let sub of group){let unusable=firstUnusableCondition(sub);if(unusable)return unusable}return null}if(typeof filter.field!=="string"||filter.field.trim()==="")return'A filter condition needs a "field"';return null}function buildFilterCondition(filter,resolveCol){if(filter.operator==="or"||filter.operator==="and"){let subs=(Array.isArray(filter.value)?filter.value:[]).map((f)=>buildFilterCondition(f,resolveCol)).filter((c)=>c!==null);if(subs.length===0)return null;return(filter.operator==="or"?or4(...subs):and18(...subs))??null}if(!filter.field)return null;let col8=resolveCol(filter.field);if(!col8)return null;let sqlCol=col8,dataType=col8.dataType,coerce2=(v)=>dataType==="date"&&(typeof v==="string"||typeof v==="number")?new Date(v):v;switch(filter.operator){case"eq":return eq32(sqlCol,coerce2(filter.value));case"neq":return ne3(sqlCol,coerce2(filter.value));case"gt":return gt(sqlCol,coerce2(filter.value));case"gte":return gte(sqlCol,coerce2(filter.value));case"lt":return lt2(sqlCol,coerce2(filter.value));case"lte":return lte(sqlCol,coerce2(filter.value));case"like":return like(sqlCol,filter.value);case"ilike":return ilike(sqlCol,filter.value);case"in":return inArray12(sqlCol,filter.value);case"notIn":return notInArray(sqlCol,filter.value);case"arrayOverlaps":return arrayOverlaps(sqlCol,filter.value??[]);case"arrayContains":return arrayContains(sqlCol,filter.value??[]);case"arrayEmpty":return sql8`cardinality(${sqlCol}) = 0`;case"isNull":return isNull4(sqlCol);case"isNotNull":return isNotNull(sqlCol);default:return null}}function describeIgnoredFields(fields){if(fields.length===0)return{};let unique=[...new Set(fields)];return{ignored_fields:unique,message:`Saved. These fields were ignored because they cannot be set this way: ${unique.join(", ")}.`}}function createEntityRoutes(app,config){let{db,schemaTables,schemaRelations,entities,logger:logger2,dbPool,storage,cdnMedia,authorization,authMode,idpUrl,featureAdminRoles}=config,getRegistry=()=>config.getTenantRegistry?config.getTenantRegistry():config.tenantRegistry??null,getReqSchema=(request)=>{let tenantRegistry=getRegistry();if(!tenantRegistry)return{tables:schemaTables,relations:schemaRelations};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{tables:schemaTables,relations:schemaRelations};let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?{tables:ctx.schemaTables,relations:ctx.schemaRelations}:{tables:schemaTables,relations:schemaRelations}},storageConfig=mergeStorageConfig(storage),warmUploadedMedia=(uploaded)=>{if(!cdnMedia||!uploaded||uploaded.success.length===0)return;scheduleUploadMediaProcessing(uploaded.success,{storagePath:storageConfig.basePath,media:cdnMedia,logger:logger2})},authEnabled=authorization?.enabled??!1,enforceFieldWrites=authEnabled&&authorization?.enforceFieldWriteClaims!==!1,isConsumerMode=authMode==="consumer",filterWritePayload=(payload,authResult)=>{if(!enforceFieldWrites||!authResult?.allowedFields)return payload;return filterResponseFields(payload,authResult.allowedFields)},auditPathContext=(request)=>{let url=new URL(request.url);return{path:url.pathname,query:url.search}},auditIdentityFor=(table,payload,userId,headers)=>createAuditIdentity(isAnonymousCreate(table,payload),userId,headers),UUID_RE=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,auditEntityId=(id)=>{let s=id==null?"":String(id);return UUID_RE.test(s)?s:null},projectWrittenRow=(row,authResult)=>{let scoped2=authEnabled&&authResult?.allowedFields?filterResponseFields(row,[...authResult.allowedFields,...authResult.allowedRelations??[]]):row;return stripUnclaimedSensitive(redactSensitiveOutput(scoped2),authResult?.allowedFields)};if(!db)return app;function snakeToCamel4(s){return s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase())}let{entities:mergedEntities}=resolveEntities(SYSTEM_TABLES,entities),extendedByName=new Map(mergedEntities.filter((t)=>entities.some((e)=>e.table_name===t.table_name&&e.extends===!0)).map((t)=>[t.table_name,t])),effectiveEntities=entities.map((e)=>extendedByName.get(e.table_name)??e),allTables=Object.keys(schemaTables),entityTableNames=effectiveEntities.map((e)=>snakeToCamel4(e.table_name)),systemTableNames=allTables.filter((tbl)=>!entityTableNames.includes(tbl)),systemTableDefMap=new Map(SYSTEM_TABLES.map((t)=>[snakeToCamel4(t.table_name),t])),asMeta=(def)=>def??void 0,hasUnmetRequirement=(def)=>{let requires=def?.requires;if(!requires||requires.length===0)return null;for(let req of requires)if(req==="email"&&!config.isEmailServiceAvailable?.())return"email";return null},deriveGroupName=(def,fallback)=>{if(def?.group_name)return def.group_name;let primaryFeature=def?.feature_set?.[0];if(!primaryFeature)return fallback;return primaryFeature.charAt(0).toUpperCase()+primaryFeature.slice(1)},systemTables=systemTableNames.filter((name2)=>{let unmet=hasUnmetRequirement(asMeta(systemTableDefMap.get(name2)));if(unmet)return logger2.info(`Skipping ${name2} routes - missing required dependency: ${unmet}`),!1;return!0}).map((name2)=>{let def=systemTableDefMap.get(name2),meta=asMeta(def);return{table_name:def?.table_name??name2,group_name:deriveGroupName(meta,name2),is_form_data:def?.is_form_data===!0,bulk_endpoints_enabled:def?.bulk_endpoints_enabled??!1,excluded_methods:def?.excluded_methods?[...def.excluded_methods]:[],columns:def?.columns?[...def.columns]:void 0}}),allEntities=[...effectiveEntities,...systemTables],publicGetEntities=new Set;for(let e of allEntities)if(e.is_public?.GET===!0)publicGetEntities.add(e.table_name),publicGetEntities.add(snakeToCamel4(e.table_name));logger2.info(`All entities: ${allEntities.map((e)=>e.table_name).join(", ")}`);for(let table of allEntities){let rawTableName=table.table_name,tableName=snakeToCamel4(rawTableName),swaggerTag=table.group_name||rawTableName,writeFields=enforceFieldWrites?table.columns?.map((c)=>c.name):void 0,defaultDrizzleTable=schemaTables[tableName];if(!defaultDrizzleTable)continue;let tableRelations=schemaRelations[`${tableName}Relations`];logger2.info(`Creating routes for table: ${tableName}`);let relationTargetTable={};{let rels=tableRelations;if(rels?.table&&typeof rels?.config==="function")try{let built=rels.config(createTableRelationsHelpers(rels.table));for(let[relName,rel]of Object.entries(built))if(rel?.referencedTable)relationTargetTable[relName]=getTableName(rel.referencedTable)}catch(err){logger2.warn(`[Authorization] Could not map relations for ${tableName}`,{error:err instanceof Error?err.message:String(err)})}}let defaultTableColumns=defaultDrizzleTable,defaultIdCol=defaultTableColumns.id,database=db,drizzleTable=defaultDrizzleTable,tableColumns=defaultTableColumns,idCol=defaultIdCol,resolveCol=(field)=>{if(Object.hasOwn(tableColumns,field))return tableColumns[field];let camel=snakeToCamel4(field);return Object.hasOwn(tableColumns,camel)?tableColumns[camel]:void 0},getTableForRequest=(request)=>{if(!getRegistry())return{drizzleTable,tableColumns,idCol,resolveCol,schemaTables,schemaRelations};let reqSchema=getReqSchema(request),reqTable=reqSchema.tables[tableName]||drizzleTable,reqCols=reqTable,reqIdCol=reqCols.id;return{drizzleTable:reqTable,tableColumns:reqCols,idCol:reqIdCol,resolveCol:(field)=>{if(Object.hasOwn(reqCols,field))return reqCols[field];let camel=snakeToCamel4(field);return Object.hasOwn(reqCols,camel)?reqCols[camel]:void 0},schemaTables:reqSchema.tables,schemaRelations:reqSchema.relations}},bulkUpdateSchema=createBulkUpdateSchema(table.columns),bulkDeleteSchema=Type.Array(Type.String()),authzLog=logger2.scoped("authorization.check"),performAuthCheck=async(request,method,reqFields,reqRelations)=>{let result=await runAuthCheck(request,method,reqFields,reqRelations);if(result){let userId=request.headers.get("x-user-id"),requestId=request.headers.get("x-request-id")||void 0;if(!result.authorized)authzLog.warn(`Denied ${method} ${table.table_name}`,{requestId,userId,entity:table.table_name,method,reason:result.reason||"no reason provided",mode:isConsumerMode?idpUrl?"idp":"jwt":"local"});else if(result.scopeFilters||result.allowedFields||result.allowedRelations)authzLog.debug(`Allowed ${method} ${table.table_name} (restricted)`,{requestId,userId,entity:table.table_name,method,scopeFilters:result.scopeFilters,allowedFieldCount:result.allowedFields?.length,allowedRelations:result.allowedRelations})}return result},scopeConditionsFor=(authResult,resolveColumn)=>{if(!authEnabled||!authResult?.scopeFilters)return[];let{conditions,unresolvedFields}=buildScopeConditions(authResult.scopeFilters,resolveColumn);if(unresolvedFields.length>0)authzLog.error(`Scope references unknown column(s) on ${table.table_name}; failing closed (0 rows)`,{entity:table.table_name,unresolvedFields});return conditions},runAuthCheck=async(request,method,reqFields,reqRelations,entityName=table.table_name)=>{let userId=request.headers.get("x-user-id");if(!authEnabled||!userId)return null;if(isConsumerMode){let userClaims=decodeHeaderList(request.headers.get("x-user-claims")),userRoles=decodeHeaderList(request.headers.get("x-user-roles")),userClaimScopes=decodeClaimScopesHeader(request.headers.get("x-user-claim-scopes"));if(idpUrl&&authorization?.jwtClaimsMode==="resolve"){let accessToken=request.headers.get("x-access-token")||(request.headers.get("cookie")||"").match(/access_token=([^;]+)/)?.[1]||"";return checkAuthorizationViaIDP({idpUrl,accessToken,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2})}return checkAuthorizationFromJWT({userClaims,userRoles,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,claimScopes:userClaimScopes})}let reqCtx=getTableForRequest(request);return checkAuthorization({userId,method,entity:entityName,requestedFields:reqFields,requestedRelations:reqRelations,db:database,schemaTables:reqCtx.schemaTables,logger:logger2,requireClaimSpecificity:authorization?.requireClaimSpecificity,getUserData:async()=>{if(!database)return;let usersTbl=reqCtx.schemaTables[AUTHORIZATION_TABLE_KEYS.users];if(!usersTbl)return;let idCol2=usersTbl.id;if(!idCol2)return;return(await database.select().from(usersTbl).where(eq32(idCol2,userId)).limit(1))[0]}})},endSessionsForDeactivated=async(request,changed)=>{if(tableName!==AUTHORIZATION_TABLE_KEYS.users)return;let userIds=changed.filter((one)=>one.after?.isActive===!1&&one.before?.isActive!==!1).map((one)=>String(one.after?.id??"").trim()).filter(Boolean);if(userIds.length===0)return;let authTables=resolveAuthTablesForRequest(request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry});await revokeUserSessions({db:database,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error("[Entity] users rows were deactivated but their open sessions were not cleared",{error:error3,userIds})},userIds)},renameStrandsVerification=async(id,payload)=>{if(!database)return null;if(tableName!==AUTHORIZATION_TABLE_KEYS.roles)return null;let newName=payload.name;if(typeof newName!=="string")return null;let oldName=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0]?.name;if(typeof oldName!=="string"||oldName===newName)return null;return await verifierAwaitedByVerification(database,schemaTables,{role:oldName})?oldName:null},deactivationStrandsVerification=async(id,payload)=>{if(!database)return null;let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return null;if(payload.isActive!==!1&&payload.is_active!==!1)return null;let row=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0];if(!row)return null;if(row.isActive===!1||row.is_active===!1)return null;let who=isRoles?{role:String(row.name??"")}:{userId:id};if(isRoles&&!who.role)return null;if(!await verifierAwaitedByVerification(database,schemaTables,who))return null;return isRoles?String(row.name):String(row.email??row.name??id)},strandsVerification=async(ids)=>{if(!database)return[];let isRoles=tableName===AUTHORIZATION_TABLE_KEYS.roles,isUsers=tableName===AUTHORIZATION_TABLE_KEYS.users;if(!isRoles&&!isUsers)return[];let blocked=[];for(let id of ids){let who={userId:id};if(isRoles){let name2=(await database.select().from(drizzleTable).where(eq32(idCol,id)).limit(1))[0]?.name;if(!name2)continue;who={role:String(name2)}}if(await verifierAwaitedByVerification(database,schemaTables,who))blocked.push(id)}return blocked},announceWrite=(request,operation,rows,writtenBy)=>{if(!config.onEntityWritten)return;for(let row of Array.isArray(rows)?rows:[rows]){let id=row?.id;if(!id)continue;config.onEntityWritten({entityName:tableName,entityId:String(id),operation,userId:writtenBy||void 0,request})}},declared=[],entityGuards=[],listLog=logger2.scoped("entity.list"),isRbacTable=tableName===AUTHORIZATION_TABLE_KEYS.roles||tableName===AUTHORIZATION_TABLE_KEYS.claims||tableName===AUTHORIZATION_TABLE_KEYS.roleClaims,isUserRoleTable=tableName===AUTHORIZATION_TABLE_KEYS.userRoles,roleAssignRoles=featureAdminRoles?.authorization??[];if(isRbacTable||isUserRoleTable||isSensitiveSystemTable(tableName)){let denyMessage=isRbacTable?"Forbidden: managing roles and claims requires godmin privileges":isUserRoleTable?"Forbidden: assigning roles requires godmin privileges":`Forbidden: writing to '${tableName}' via the generic entity API requires godmin privileges \u2014 use the dedicated route`;entityGuards.push(async({request,set:set2,body,params})=>{let method=request.method.toUpperCase();if(method==="GET"||method==="HEAD"||method==="OPTIONS")return;if(hasGodminRole(request))return;if(isFeatureAdmin({isRbacTable:isRbacTable||isUserRoleTable,featureSet:table.feature_set,featureAdminRoles,callerRoles:decodeHeaderList(request.headers.get("x-user-roles"))}))return;if(isUserRoleTable&&roleAssignRoles.length>0){let subject=await resolveUserRoleSubject({db,schemaTables:getReqSchema(request).tables,logger:logger2},{rowId:typeof params?.id==="string"?params.id:null,body}),decision=decideRoleAssign({callerIsGod:!1,callerRoleNames:decodeHeaderList(request.headers.get("x-user-roles")),allowRoles:roleAssignRoles,targetRoleName:subject.targetRoleName??GODMIN_ROLE_NAME,subjectIsGodmin:subject.subjectIsGodmin,godminRoleName:GODMIN_ROLE_NAME});if(decision.allowed)return;if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,reason:decision.reason,message:ROLE_ASSIGN_REFUSALS[decision.reason]}}if(await userHasGodminRoleInDb(db,schemaTables,request.headers.get("x-user-id"),logger2))return;return set2.status=403,{success:!1,message:denyMessage}})}if(!table.excluded_methods?.includes("GET"))declared.push(defineRoute({method:"GET",path:"/",detail:{tags:[swaggerTag],summary:`List ${tableName}`,description:`Get paginated list of ${tableName} records with filtering, sorting, and search`},handler:async(ctx)=>{if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let{drizzleTable:drizzleTable2,resolveCol:resolveCol2,schemaRelations:schemaRelations2}=getTableForRequest(ctx.request),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=Object.keys(schemaRelations2).filter((k)=>k.startsWith(`${tableName}Relations`)).map((k)=>k.replace("Relations","")),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};let fieldQueryable=(field)=>{if(isSensitiveOutputKey(field))return!1;if(!sensitiveFieldQueryable(field,{authEnabled,allowedFields:authResult?.allowedFields}))return!1;if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(field))return!1;return!0},q=parseQueryParams(ctx.query);if(q.malformed)return ctx.set.status=400,{success:!1,message:`Malformed query parameter: ${q.malformed.join(", ")} (expected a JSON array)`};let conditions=[];if(conditions.push(...scopeConditionsFor(authResult,resolveCol2)),q.search&&!q.searchFields)return ctx.set.status=400,{success:!1,message:"A 'search' needs 'searchFields' naming the columns to search, e.g. searchFields=name,email \u2014 without it the term would be ignored and every row returned."};if(q.search&&q.searchFields){for(let f of q.searchFields)if(!fieldQueryable(f.trim()))return ctx.set.status=403,{success:!1,message:`Cannot search on field: ${f.trim()}`};let unknown3=firstUnknownField(q.searchFields,resolveCol2);if(unknown3)return ctx.set.status=400,{success:!1,message:`Unknown field in search: ${unknown3}`};let searchColumns=q.searchFields.map((f)=>resolveCol2(f.trim())).filter((c)=>c!==null),searchCondition=buildSearchCondition(searchColumns,q.search);if(searchCondition)conditions.push(searchCondition)}if(Array.isArray(q.filters))for(let filter of q.filters){let referenced=collectFilterFields(filter);for(let f of referenced)if(!fieldQueryable(f))return ctx.set.status=403,{success:!1,message:`Cannot filter on field: ${f}`};let unknownFilterField=firstUnknownField(referenced,resolveCol2);if(unknownFilterField)return ctx.set.status=400,{success:!1,message:`Unknown field in filter: ${unknownFilterField}`};let unusable=firstUnusableCondition(filter);if(unusable)return ctx.set.status=400,{success:!1,message:unusable};let cond=buildFilterCondition(filter,resolveCol2);if(cond)conditions.push(cond)}let projection;if(q.select&&q.select.length>0){let requested=[...new Set(["id",...q.select.map((f)=>f.trim())])].filter(Boolean),columns={};for(let field of requested){if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot select field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in select: ${field}`};columns[field]=col8}if(Object.keys(columns).length>0)projection=columns}let unprojected=database.select().from(drizzleTable2),baseQuery=projection?database.select(projection).from(drizzleTable2):unprojected;if(conditions.length>0){let combined=and18(...conditions);if(combined)baseQuery=baseQuery.where(combined)}if(q.sort&&q.sort.length>0){let orderClauses=[];for(let s of q.sort){let field=typeof s?.field==="string"?s.field.trim():"";if(field==="")return ctx.set.status=400,{success:!1,message:'Malformed query parameter: sort (every entry needs a "field")'};if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot sort on field: ${field}`};let col8=resolveCol2(field);if(!col8)return ctx.set.status=400,{success:!1,message:`Unknown field in sort: ${field}`};orderClauses.push(s.direction==="desc"?desc5(col8):asc(col8))}if(orderClauses.length>0)baseQuery=baseQuery.orderBy(...orderClauses)}let page=q.page??1,limit=q.limit??20,offset=q.offset??(page-1)*limit;if(q.groupBy){let field=q.groupBy.trim();if(!fieldQueryable(field))return ctx.set.status=403,{success:!1,message:`Cannot group by field: ${field}`};let groupCol=resolveCol2(field);if(!groupCol)return ctx.set.status=400,{success:!1,message:`Unknown field in groupBy: ${field}`};let where=conditions.length>0?and18(...conditions):void 0,col8=groupCol,distinctCount=await database.select({n:sql8`count(distinct ${col8})::int`}).from(drizzleTable2).where(where),totalGroups=Number(distinctCount[0]?.n??0);return{success:!0,data:{items:(await database.select({value:col8,count:sql8`count(*)::int`}).from(drizzleTable2).where(where).groupBy(col8).orderBy(sql8`count(*) desc`,col8).limit(limit).offset(offset)).map((g)=>({value:g.value,count:Number(g.count)})),meta:buildPaginationMeta(page,limit,offset,totalGroups)}}}let queryStart=performance.now(),combinedCount=conditions.length>0?and18(...conditions):void 0,countResult=await database.select({n:sql8`count(*)::int`}).from(drizzleTable2).where(combinedCount),totalItems=Number(countResult[0]?.n??0);baseQuery=baseQuery.limit(limit).offset(offset);let items=await baseQuery,meta=buildPaginationMeta(page,limit,offset,totalItems);if(listLog.debug(`List ${rawTableName}: ${items.length}/${totalItems} rows`,{requestId:ctx.request.headers.get("x-request-id")||void 0,table:rawTableName,page,limit,totalItems,returned:items.length,conditionCount:conditions.length,search:q.search||void 0,sort:Array.isArray(q.sort)?q.sort.map((s)=>`${s.field}:${s.direction}`):void 0,queryMs:Math.round(performance.now()-queryStart)}),authEnabled&&authResult?.allowedFields)items=filterResponseFields(items,authResult.allowedFields);return{success:!0,data:{items:items.map((r)=>stripUnclaimedSensitive(redactSensitiveOutput(r),authResult?.allowedFields)),meta}}}})),declared.push(defineRoute({method:"GET",path:"/:id",detail:{tags:[swaggerTag],summary:`Get ${tableName} by ID`,description:`Get a single ${tableName} record by its ID with optional relations`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,schemaRelations:schemaRelations2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,q=parseQueryParams(ctx.query),requestedFields=table.columns?.map((c)=>c.name),requestedRelations=q.with?.map((w)=>w.name),authResult=await performAuthCheck(ctx.request,"GET",requestedFields,requestedRelations);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(q.malformed?.includes("with"))return ctx.set.status=400,{success:!1,message:"Malformed query parameter: with (expected a JSON array)"};let getScope=scopeConditionsFor(authResult,resolveCol2),getWhere=getScope.length>0?and18(eq32(idCol2,params.id),...getScope):eq32(idCol2,params.id);if(q.with&&q.with.length>0&&tableRelations&&dbPool){let allowedWith=authEnabled&&authResult?.allowedRelations?q.with.filter((w)=>authResult.allowedRelations?.includes(w.name)??!1):q.with,dbWithRelations=drizzle(dbPool,{schema:{...schemaTables2,...schemaRelations2}}),withClause={};for(let rel of allowedWith){let targetTable=relationTargetTable[rel.name],relAuth=authEnabled&&targetTable?await runAuthCheck(ctx.request,"GET",void 0,void 0,targetTable):null,decision=decideRelationExpansion({authEnabled,targetTable,relAuth,isTargetPublicGet:targetTable?publicGetEntities.has(targetTable):!1});if(!decision.expand)continue;let relScope=decision.scope;if(relScope&&Object.keys(relScope).length>0)withClause[rel.name]={...rel.limit?{limit:rel.limit}:{},where:(fields,ops)=>{let preds=[],unresolved=!1;for(let[k,v]of Object.entries(relScope)){let col8=resolveRelationScopeColumn(fields,k,snakeToCamel4);if(col8)preds.push(ops.eq(col8,v));else unresolved=!0}if(unresolved)return sql8`1 = 0`;return preds.length>0?ops.and(...preds):void 0}};else withClause[rel.name]=rel.limit?{limit:rel.limit}:!0}let result2=await dbWithRelations.query[tableName]?.findFirst({where:getWhere,with:withClause});if(!result2)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result2=filterResponseFields(result2,[...authResult.allowedFields,...authResult.allowedRelations??[]]);if(authEnabled&&authResult?.allowedRelations)result2=filterResponseRelations(result2,authResult.allowedRelations);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result2),authResult?.allowedFields)}}let result=(await database.select().from(drizzleTable2).where(getWhere))[0]||null;if(!result)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(authEnabled&&authResult?.allowedFields)result=filterResponseFields(result,authResult.allowedFields);return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result),authResult?.allowedFields)}}})),declared.push(defineRoute({method:"GET",path:"/distinct/:field",detail:{tags:[swaggerTag],summary:`Get distinct ${tableName} values`,description:`Get distinct values for a specific field in ${tableName}`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let params=ctx.params,authResult=await performAuthCheck(ctx.request,"GET",[params.field],[]);if(authResult&&!authResult.authorized)return ctx.set.status=403,{success:!1,message:authResult.reason||"Forbidden"};if(authEnabled&&authResult?.allowedFields&&!authResult.allowedFields.includes(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(isSensitiveOutputKey(params.field))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};if(!sensitiveFieldQueryable(params.field,{authEnabled,allowedFields:authResult?.allowedFields}))return ctx.set.status=403,{success:!1,message:"Forbidden: field not permitted"};let col8=resolveCol2(params.field);if(!col8)return ctx.set.status=404,{success:!1,message:"Field not found"};let distinctScope=scopeConditionsFor(authResult,resolveCol2),distinctQuery=database.selectDistinct({value:col8}).from(drizzleTable2);return{success:!0,data:distinctScope.length>0?await distinctQuery.where(and18(...distinctScope)):await distinctQuery}}}));if(!table.excluded_methods?.includes("POST"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"POST",path:"/",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Create ${tableName} with files`,description:`Create a new ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let userId=ctx.request.headers.get("x-user-id"),postFormAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postFormAuthResult&&!postFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postFormAuthResult.reason||"Forbidden"};let{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,uploadedFiles=null;if(files.length>0){if(uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),uploadedFiles.failed.length>0&&uploadedFiles.success.length===0){let allRefused=uploadedFiles.failed.every((one)=>one.rejected===!0),aboutType=allRefused&&uploadedFiles.failed.some((one)=>one.error.includes("File type"));return ctx.set.status=allRefused?aboutType?415:400:500,{success:!1,message:allRefused?"File refused":"File upload failed",errors:uploadedFiles.failed}}warmUploadedMedia(uploadedFiles)}let mergeUploadedMetadata=()=>{let firstFile=uploadedFiles?.success[0];if(firstFile)payload={...payload,...buildFileRecordPayload(firstFile,userId)}},ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postFormAuthResult),mergeUploadedMetadata();else mergeUploadedMetadata();let scopedForm=forceCreateScope(payload,postFormAuthResult,resolveCol2);if(!scopedForm.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedForm.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;let result=await database.insert(drizzleTable2).values(payload).returning();announceWrite(ctx.request,"create",result,userId);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postFormAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));else declared.push(defineRoute({method:"POST",path:"/",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Create ${tableName}`,description:`Create a new ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let payload=ctx.body,userId=ctx.request.headers.get("x-user-id"),postAuthResult=await performAuthCheck(ctx.request,"POST",writeFields);if(postAuthResult&&!postAuthResult.authorized)return ctx.set.status=403,{success:!1,message:postAuthResult.reason||"Forbidden"};let ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,postAuthResult);let scoped2=forceCreateScope(payload,postAuthResult,resolveCol2);if(!scoped2.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scoped2.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let anonymous=isAnonymousCreate(table,payload);if(userId&&!anonymous)payload.createdBy=userId;if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.userId&&payload.roleId){let cols=drizzleTable2,existing=await database.select().from(drizzleTable2).where(and18(eq32(cols.userId,payload.userId),eq32(cols.roleId,payload.roleId))).limit(1);if(existing.length>0)return{success:!0,data:existing[0]}}let result=await database.insert(drizzleTable2).values(payload).returning();if(announceWrite(ctx.request,"create",result,userId),tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&payload.roleId&&payload.userId)try{let rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable){let roleName=(await database.select().from(rolesTable).where(eq32(rolesTable.id,payload.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!0}).where(eq32(usersTable.id,payload.userId));if(roleName)config.onRoleChanged?.({userId:String(payload.userId),roleName,assigned:!0,actorId:userId??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole create")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:String(result[0]?.id??""),operation:"CREATE",summary:`Created ${table.table_name}`,newValues:result[0],...createAuditIdentity(anonymous,userId,ctx.request.headers),path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),postAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PUT"))if(table.is_form_data&&storageConfig.enabled)declared.push(defineRoute({method:"PUT",path:"/:id",type:"formdata",body:Type.Object({[storageConfig.formData.dataField]:Type.Optional(Type.Union([Type.String(),Type.Any()])),[storageConfig.formData.filesField]:Type.Optional(FilesSchema())}),detail:{tags:[swaggerTag],summary:`Update ${tableName} with files`,description:`Full update of ${tableName} record with file upload support`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),putFormAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putFormAuthResult&&!putFormAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putFormAuthResult.reason||"Forbidden"};let putFormScope=scopeConditionsFor(putFormAuthResult,resolveCol2),putFormWhere=putFormScope.length>0?and18(eq32(idCol2,params.id),...putFormScope):eq32(idCol2,params.id),{data,files}=parseFormDataBody(ctx.body,storageConfig),payload=data,oldRecord=await database.select().from(drizzleTable2).where(putFormWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putFormAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}let uploadedFiles=null;if(files.length>0)uploadedFiles=await uploadFiles(files,storageConfig,table.table_name),warmUploadedMedia(uploadedFiles);let result=await database.update(drizzleTable2).set(payload).where(putFormWhere).returning();announceWrite(ctx.request,"update",result,userId);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:{record:result[0],files:uploadedFiles?.success||[],fileErrors:uploadedFiles?.failed||[]}}}}));else declared.push(defineRoute({method:"PUT",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Update ${tableName}`,description:`Full update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),putAuthResult=await performAuthCheck(ctx.request,"PUT",writeFields);if(putAuthResult&&!putAuthResult.authorized)return ctx.set.status=403,{success:!1,message:putAuthResult.reason||"Forbidden"};let putScope=scopeConditionsFor(putAuthResult,resolveCol2),putWhere=putScope.length>0?and18(eq32(idCol2,params.id),...putScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(putWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,putAuthResult);let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(putWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"UPDATE",userId:userId||void 0,summary:`Updated ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),putAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("PATCH"))declared.push(defineRoute({method:"PATCH",path:"/:id",body:Type.Object({},{additionalProperties:!0}),detail:{tags:[swaggerTag],summary:`Patch ${tableName}`,description:`Partial update of ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let{params,body:payload}=ctx,userId=ctx.request.headers.get("x-user-id"),patchAuthResult=await performAuthCheck(ctx.request,"PATCH",writeFields);if(patchAuthResult&&!patchAuthResult.authorized)return ctx.set.status=403,{success:!1,message:patchAuthResult.reason||"Forbidden"};let patchScope=scopeConditionsFor(patchAuthResult,resolveCol2),patchWhere=patchScope.length>0?and18(eq32(idCol2,params.id),...patchScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(patchWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};let ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,patchAuthResult);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;{let blockedName=await renameStrandsVerification(params.id,payload);if(blockedName)return ctx.set.status=409,{success:!1,message:`Cannot rename '${blockedName}': an approval chain is waiting on this role to decide a step. Complete or reject that verification first.`}}{let blockedOff=await deactivationStrandsVerification(params.id,payload);if(blockedOff)return ctx.set.status=409,{success:!1,message:`Cannot deactivate '${blockedOff}': an approval chain is waiting on them to decide a step, and nobody else can. Complete or reject that verification first, or unpublish the flow.`}}let result=await database.update(drizzleTable2).set(payload).where(patchWhere).returning();announceWrite(ctx.request,"update",result,userId),await endSessionsForDeactivated(ctx.request,[{before:oldRecord[0],after:result[0]}]);{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"PATCH",userId:userId||void 0,summary:`Patched ${table.table_name} (${params.id})`,oldValues:oldRecord[0],newValues:result[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:stripUnclaimedSensitive(redactSensitiveOutput(result[0]),patchAuthResult?.allowedFields),...describeIgnoredFields(ignoredFields)}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/:id",detail:{tags:[swaggerTag],summary:`Delete ${tableName}`,description:`Delete a ${tableName} record`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,schemaTables:schemaTables2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let params=ctx.params,userId=ctx.request.headers.get("x-user-id"),deleteAuthResult=await performAuthCheck(ctx.request,"DELETE");if(deleteAuthResult&&!deleteAuthResult.authorized)return ctx.set.status=403,{success:!1,message:deleteAuthResult.reason||"Forbidden"};let deleteScope=scopeConditionsFor(deleteAuthResult,resolveCol2),deleteWhere=deleteScope.length>0?and18(eq32(idCol2,params.id),...deleteScope):eq32(idCol2,params.id),oldRecord=await database.select().from(drizzleTable2).where(deleteWhere).limit(1);if(oldRecord.length===0)return ctx.set.status=404,{success:!1,message:`${tableName} not found`};if(await activeVerificationExists(database,schemaTables2,tableName,params.id))return ctx.set.status=409,{success:!1,message:`Cannot delete: this ${tableName} is in an active verification. Complete or reject it first.`};if((await strandsVerification([params.id])).length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on this ${tableName} to decide a step. Complete or reject that verification first, or reassign the step.`};if(await database.delete(drizzleTable2).where(deleteWhere),table.is_form_data&&storageConfig.enabled&&oldRecord[0]){let rec=oldRecord[0],filePath=rec.path,fileName=rec.name;if(typeof filePath==="string"&&typeof fileName==="string"){if(!await deleteFile(filePath,fileName,storageConfig.basePath))logger2.warn(`[Entity] Blob cleanup failed for ${table.table_name} (${params.id})`)}}if(oldRecord[0]){let link=accountLinkFor(config.accountLinks,tableName),userIds=link?accountIdsIn([oldRecord[0]],link.userColumn):[];if(userIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables2[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables2.userSessions??schemaTables2.sessions,schemaTables:schemaTables2,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${tableName} ${params.id} was deleted but its account could not be closed`,{error:error3})},userIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] Account behind ${tableName} ${params.id} was deactivated but its open sessions were not cleared`)}}if(tableName===AUTHORIZATION_TABLE_KEYS.roleClaims&&config.claimsCache)config.claimsCache.invalidate().catch(()=>{});if(tableName===AUTHORIZATION_TABLE_KEYS.userRoles&&oldRecord[0])try{let deletedUserRole=oldRecord[0],rolesTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.roles],usersTable=schemaTables2[AUTHORIZATION_TABLE_KEYS.users];if(rolesTable&&usersTable&&deletedUserRole.roleId&&deletedUserRole.userId){let roleName=(await database.select().from(rolesTable).where(eq32(rolesTable.id,deletedUserRole.roleId)).limit(1))[0]?.name;if(roleName===GODMIN_ROLE_NAME)await database.update(usersTable).set({isGod:!1}).where(eq32(usersTable.id,deletedUserRole.userId));if(roleName)config.onRoleChanged?.({userId:String(deletedUserRole.userId),roleName,assigned:!1,actorId:ctx.request.headers.get("x-user-id")??void 0})}}catch(_e){logger2.warn("[Entity] Failed to sync is_god flag on userRole delete")}{let reqUrl=new URL(ctx.request.url);logger2.audit({entityName:table.table_name,entityId:params.id,operation:"DELETE",userId:userId||void 0,summary:`Deleted ${table.table_name} (${params.id})`,oldValues:oldRecord[0],ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:reqUrl.pathname,query:reqUrl.search})}return{success:!0,data:null}}}));if(table.bulk_endpoints_enabled){if(!table.excluded_methods?.includes("POST"))declared.push(defineRoute({method:"POST",path:"/bulk",body:Type.Array(Type.Object({},{additionalProperties:!0})),detail:{tags:[swaggerTag],summary:`Bulk create ${tableName}`,description:`Create multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database)return ctx.set.status=500,{success:!1,message:"DB not initialized"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPostAuth=await performAuthCheck(ctx.request,"POST",writeFields);if(bulkPostAuth&&!bulkPostAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPostAuth.reason||"Forbidden"};let sanitizedItems=[];for(let raw of items){let payload=raw,ignoredFields=[];if(table.columns)payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPostAuth);let scopedItem=forceCreateScope(payload,bulkPostAuth,resolveCol2);if(!scopedItem.ok)return ctx.set.status=403,{success:!1,message:`Forbidden: ownership scope references a column '${scopedItem.field}' this entity does not have`};if(table.columns){let validation=validatePayload(payload,table.columns,!1);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(userId&&!isAnonymousCreate(table,payload))payload.createdBy=userId;sanitizedItems.push(payload)}let txResult=await database.transaction(async(tx)=>{let results=[];for(let payload of sanitizedItems){let result=await tx.insert(drizzleTable2).values(payload).returning();results.push(result[0])}return results}),auditPath=auditPathContext(ctx.request);announceWrite(ctx.request,"create",txResult,userId);for(let[i,row]of txResult.entries())await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"CREATE",summary:`Bulk created ${table.table_name} (${row.id})`,newValues:row,...auditIdentityFor(table,sanitizedItems[i]??{},userId,ctx.request.headers),...auditPath});return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPostAuth))}}}));if(!table.excluded_methods?.includes("PUT"))declared.push(defineRoute({method:"PUT",path:"/bulk",body:bulkUpdateSchema,detail:{tags:[swaggerTag],summary:`Bulk update ${tableName}`,description:`Update multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let items=ctx.body;if(!Array.isArray(items))return ctx.set.status=400,{success:!1,message:"Body must be an array"};if(items.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let userId=ctx.request.headers.get("x-user-id"),bulkPutAuth=await performAuthCheck(ctx.request,"PUT",writeFields);if(bulkPutAuth&&!bulkPutAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkPutAuth.reason||"Forbidden"};let bulkPutScope=scopeConditionsFor(bulkPutAuth,resolveCol2),prepared=[];for(let item of items){let payload=item.data,ignoredFields=[];if(table.columns){payload=sanitizePayload(payload,table.columns,{isFormData:table.is_form_data===!0,dropped:ignoredFields}),payload=filterWritePayload(payload,bulkPutAuth);let validation=validatePayload(payload,table.columns,!0);if(!validation.valid)return ctx.set.status=400,{success:!1,message:"Validation failed",errors:validation.errors}}if(payload.updatedAt=new Date,userId)payload.updatedBy=userId;prepared.push({id:item.id,payload})}let beforeById=new Map,txResult=await database.transaction(async(tx)=>{if(prepared.length>0){let idFilter=inArray12(idCol2,prepared.map((p)=>p.id)),beforeRows=await tx.select().from(drizzleTable2).where(bulkPutScope.length>0?and18(idFilter,...bulkPutScope):idFilter);for(let row of beforeRows)if(row.id!=null)beforeById.set(String(row.id),row)}let results=[];for(let{id,payload}of prepared){let result=await tx.update(drizzleTable2).set(payload).where(bulkPutScope.length>0?and18(eq32(idCol2,id),...bulkPutScope):eq32(idCol2,id)).returning();if(result[0])results.push(result[0])}return results});await endSessionsForDeactivated(ctx.request,txResult.map((row)=>({before:beforeById.get(String(row.id)),after:row}))),announceWrite(ctx.request,"update",txResult,userId);let auditPath=auditPathContext(ctx.request);for(let row of txResult){let rowId=String(row.id);await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"UPDATE",userId:userId||void 0,summary:`Bulk updated ${table.table_name} (${rowId})`,oldValues:beforeById.get(rowId),newValues:row,...auditPath})}return{success:!0,data:txResult.map((r)=>projectWrittenRow(r,bulkPutAuth))}}}));if(!table.excluded_methods?.includes("DELETE"))declared.push(defineRoute({method:"DELETE",path:"/bulk",body:bulkDeleteSchema,detail:{tags:[swaggerTag],summary:`Bulk delete ${tableName}`,description:`Delete multiple ${tableName} records`},handler:async(ctx)=>{let{drizzleTable:drizzleTable2,idCol:idCol2,resolveCol:resolveCol2}=getTableForRequest(ctx.request);if(!database||!idCol2)return ctx.set.status=500,{success:!1,message:"No id column or DB"};let ids=ctx.body;if(!Array.isArray(ids))return{success:!1,message:"Body must be an array of ids"};if(ids.length>MAX_BULK_ITEMS)return ctx.set.status=400,{success:!1,message:`Bulk request exceeds ${MAX_BULK_ITEMS} items`};let bulkDeleteAuth=await performAuthCheck(ctx.request,"DELETE");if(bulkDeleteAuth&&!bulkDeleteAuth.authorized)return ctx.set.status=403,{success:!1,message:bulkDeleteAuth.reason||"Forbidden"};let bulkDeleteScope=scopeConditionsFor(bulkDeleteAuth,resolveCol2),userId=ctx.request.headers.get("x-user-id"),blocked=[];for(let id of ids)if(await activeVerificationExists(database,schemaTables,tableName,id))blocked.push(id);if(blocked.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: ${blocked.length} of these ${tableName} are in an active verification. Complete or reject it first. Blocked ids: ${blocked.join(", ")}`};let stranding=await strandsVerification(ids);if(stranding.length>0)return ctx.set.status=409,{success:!1,message:`Cannot delete: an approval chain is waiting on ${stranding.length} of these ${tableName} to decide a step. Complete or reject those verifications first. Blocked ids: ${stranding.join(", ")}`};let removed=[];await database.transaction(async(tx)=>{for(let id of ids){let r=await tx.delete(drizzleTable2).where(bulkDeleteScope.length>0?and18(eq32(idCol2,id),...bulkDeleteScope):eq32(idCol2,id)).returning();removed.push(...r)}});{let link=accountLinkFor(config.accountLinks,tableName),bulkUserIds=link?accountIdsIn(removed,link.userColumn):[];if(bulkUserIds.length>0){let authTables=resolveAuthTablesForRequest(ctx.request,{usersTable:schemaTables[AUTHORIZATION_TABLE_KEYS.users],sessionsTable:schemaTables.userSessions??schemaTables.sessions,schemaTables,tenantRegistry:config.tenantRegistry,getTenantRegistry:config.getTenantRegistry}),result=await closeAccounts({db:database,usersTable:authTables.usersTable,sessionsTable:authTables.sessionsTable,onError:(error3)=>logger2.error(`[Entity] ${removed.length} ${tableName} rows were deleted but their accounts could not be closed`,{error:error3})},bulkUserIds);if(result.closed>0&&!result.signedOut)logger2.warn(`[Entity] ${result.closed} account(s) behind deleted ${tableName} rows were deactivated but their open sessions were not cleared`)}}let auditPath=auditPathContext(ctx.request);for(let row of removed)await logger2.audit({entityName:table.table_name,entityId:auditEntityId(row.id),operation:"DELETE",userId:userId||void 0,summary:`Bulk deleted ${table.table_name} (${row.id})`,oldValues:row,...auditPath});return{success:!0,data:{deleted:removed.length}}}}))}mountRoutes(app,[{prefix:`/${tableName}`,guards:entityGuards,routes:declared}])}return app}init_esm3();init_AccountLink();import{randomUUID as randomUUID9}from"crypto";var LOCK_TTL_SECONDS2=60,RENEW_INTERVAL_MS=20000,lockKeyFor=(mappingId)=>`integrations:run:${mappingId}`;async function acquireRunLock(store,mappingId,deps={}){let key2=lockKeyFor(mappingId),now=deps.now??Date.now,ttl=deps.ttlSeconds??LOCK_TTL_SECONDS2,token=randomUUID9(),existing=await store.read(key2);if(!existing.success)return{ok:!1,reason:"unavailable",error:existing.error};if(existing.data)return{ok:!1,reason:"held",heldSince:existing.data.acquiredAt??null};let created=await store.create(key2,{token,acquiredAt:now()},ttl);if(!created.success)return{ok:!1,reason:"unavailable",error:created.error};let readBack=await store.read(key2);if(!readBack.success)return{ok:!1,reason:"unavailable",error:readBack.error};if(readBack.data?.token!==token)return{ok:!1,reason:"held",heldSince:readBack.data?.acquiredAt??null};let held=!0,timer=setInterval(()=>{(async()=>{let current=await store.read(key2);if(!current.success)return;if(current.data?.token!==token){held=!1,clearInterval(timer),deps.logger?.warn("[Integrations] Run lock was taken over",{mappingId});return}await store.create(key2,current.data,ttl)})()},RENEW_INTERVAL_MS);return timer.unref?.(),{ok:!0,handle:{token,isHeld:()=>held,release:async()=>{if(clearInterval(timer),!held)return;held=!1;let current=await store.read(key2);if(current.success&&current.data?.token===token)await store.remove(key2)}}}}import{createHash as createHash4}from"crypto";function buildUrl(baseUrl,path7,params){let base=baseUrl.trim().replace(/\/+$/,"");if(!base)return{ok:!1,error:"The source has no base address."};let raw=(path7??"").trim();if(/^[a-z][a-z0-9+.-]*:\/\//i.test(raw)||raw.startsWith("//"))return{ok:!1,error:`The endpoint path points at another host (${raw}). A path must be relative to the source address.`};let suffix=raw===""?"":raw.startsWith("/")?raw:`/${raw}`,url;try{url=new URL(`${base}${suffix}`)}catch{return{ok:!1,error:`The source address is not a valid URL: ${baseUrl}`}}for(let[key2,value2]of Object.entries(params??{})){if(value2==null)continue;url.searchParams.set(key2,String(value2))}return{ok:!0,url}}function applyAuth(source,url){let headers={accept:"application/json",...source.extraHeaders??{}},token=source.token?.trim();if(!token)return{headers};switch(source.authType){case"bearer":case"oauth2":headers[source.authHeaderName||"Authorization"]=`Bearer ${token}`;break;case"api_key":if(source.authQueryParam)url.searchParams.set(source.authQueryParam,token);else headers[source.authHeaderName||"X-API-Key"]=token;break;case"basic":headers.Authorization=`Basic ${token}`;break;default:break}return{headers}}function describeTransportError(error3){let message=error3 instanceof Error?error3.message:String(error3),cause=error3?.cause,code=cause?.code??"",blob=`${message} ${code} ${cause?.message??""}`;if(/UNABLE_TO_GET_ISSUER_CERT|SELF_SIGNED|self.signed|CERT_|unable to verify|ERR_TLS|altnames/i.test(blob))return`Certificate verification failed (${code||"incomplete chain"}). If this server's certificate is knowingly self-signed or incomplete, turn off certificate verification for this source and try again.`;if(/ENOTFOUND|EAI_AGAIN|getaddrinfo|Unable to resolve/i.test(blob))return`The address could not be resolved (DNS${code?`: ${code}`:""}). Check the source address.`;if(/ECONNREFUSED/i.test(blob))return`The connection was refused (${code||"ECONNREFUSED"}). The address and port are reachable but nothing is listening.`;if(/ETIMEDOUT|timeout|timed out|aborted|AbortError|UND_ERR/i.test(blob))return`The connection timed out (${code||"timeout"}). Check network and firewall access to this address.`;if(/ECONNRESET|EPIPE/i.test(blob))return`The connection was closed by the other side (${code||"ECONNRESET"}).`;return`Connection error: ${message}`}async function fetchOnce(source,request,deps={}){let impl=deps.fetchImpl??fetch,headers={...request.headers},method=request.method.toUpperCase(),hasBody=request.body!==void 0&&method!=="GET"&&method!=="HEAD";if(hasBody&&!headers["content-type"]&&!headers["Content-Type"])headers["content-type"]="application/json";let init={method,headers,cache:"no-store",signal:AbortSignal.timeout(source.timeoutMs??30000),tls:{rejectUnauthorized:source.tlsVerify!==!1},...hasBody?{body:typeof request.body==="string"?request.body:JSON.stringify(request.body)}:{}},response;try{response=await impl(request.url.toString(),init)}catch(error3){return deps.logger?.warn("[Integrations] Outbound request failed",{sourceId:source.id,url:request.url.origin+request.url.pathname,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,status:0,body:null,linkHeader:null,error:describeTransportError(error3)}}let text2=await response.text().catch(()=>""),body=null;if(text2)try{body=JSON.parse(text2)}catch{body=text2}let linkHeader=response.headers.get("link");if(!response.ok){let detail=typeof body==="string"?body:body==null?"":JSON.stringify(body);return{ok:!1,status:response.status,body,linkHeader,error:`The source returned HTTP ${response.status}${detail?` \u2014 ${detail.slice(0,300)}`:""}`}}return{ok:!0,status:response.status,body,linkHeader}}var EXPIRY_SKEW_MS=5000,DEFAULT_TTL_MS=300000,DEFAULT_REFRESH_TTL_MS=1800000,FIELD_SEPARATOR="\x00";function credentialFingerprint(config){let material=[config.tokenUrl,config.grantType,config.clientId??"",config.clientSecret??"",config.username??"",config.password??"",config.scope??"",config.clientAuth??"basic"].join(FIELD_SEPARATOR);return createHash4("sha256").update(material).digest("hex").slice(0,32)}class TokenCache{entries=new Map;get(sourceId,fingerprint){let entry=this.entries.get(sourceId);if(!entry)return null;if(entry.fingerprint!==fingerprint)return this.entries.delete(sourceId),null;return entry}set(sourceId,token){this.entries.set(sourceId,token)}invalidate(sourceId){this.entries.delete(sourceId)}clear(){this.entries.clear()}}var isUsable=(token,now)=>token.expiresAt>now+EXPIRY_SKEW_MS,canRefresh=(token,now)=>Boolean(token.refreshToken)&&(token.refreshExpiresAt??0)>now+EXPIRY_SKEW_MS;function buildTokenRequest(config,form){let headers={"content-type":"application/x-www-form-urlencoded",accept:"application/json"};if(config.scope&&!form.has("scope"))form.set("scope",config.scope);let clientId=config.clientId??"",clientSecret=config.clientSecret??"";if((config.clientAuth??"basic")==="basic")headers.authorization=`Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;else{if(clientId)form.set("client_id",clientId);if(clientSecret)form.set("client_secret",clientSecret)}return{headers,body:form.toString()}}async function requestToken(config,form,now,fetchImpl){let{headers,body}=buildTokenRequest(config,form),response;try{response=await fetchImpl(config.tokenUrl,{method:"POST",headers,body,cache:"no-store",signal:AbortSignal.timeout(config.timeoutMs??30000),tls:{rejectUnauthorized:config.tlsVerify!==!1}})}catch(error3){return{ok:!1,error:`Token request failed \u2014 ${describeTransportError(error3)}`}}let text2=await response.text().catch(()=>""),json={};try{json=text2?JSON.parse(text2):{}}catch{}if(!response.ok||!json.access_token){let detail=json.error_description||json.error||text2.slice(0,200);return{ok:!1,error:`Could not obtain an OAuth2 token (HTTP ${response.status})${detail?`: ${detail}`:""}`}}return{ok:!0,token:{accessToken:json.access_token,expiresAt:now+(json.expires_in?json.expires_in*1000:DEFAULT_TTL_MS),refreshToken:json.refresh_token,refreshExpiresAt:json.refresh_token?now+(json.refresh_expires_in?json.refresh_expires_in*1000:DEFAULT_REFRESH_TTL_MS):void 0,fingerprint:credentialFingerprint(config)}}}async function getAccessToken(config,cache,deps={}){let fetchImpl=deps.fetchImpl??fetch,now=deps.now?.()??Date.now();if(!config.tokenUrl?.trim())return{ok:!1,error:"No token URL is configured for this source."};let fingerprint=credentialFingerprint(config),cached=cache.get(config.sourceId,fingerprint);if(cached&&isUsable(cached,now))return{ok:!0,accessToken:cached.accessToken,fromCache:!0};if(cached&&canRefresh(cached,now)){let refreshed=await requestToken(config,new URLSearchParams({grant_type:"refresh_token",refresh_token:cached.refreshToken}),now,fetchImpl);if(refreshed.ok)return cache.set(config.sourceId,refreshed.token),{ok:!0,accessToken:refreshed.token.accessToken,fromCache:!1}}let form=new URLSearchParams({grant_type:config.grantType});if(config.grantType==="password")form.set("username",config.username??""),form.set("password",config.password??"");let minted=await requestToken(config,form,now,fetchImpl);if(!minted.ok)return{ok:!1,error:minted.error};return cache.set(config.sourceId,minted.token),{ok:!0,accessToken:minted.token.accessToken,fromCache:!1}}import{and as and19,eq as eq33,inArray as inArray13}from"drizzle-orm";var DEFAULT_IGNORED=["updatedAt","updated_at","updatedBy","updated_by"];function planRevert(input){let ignored=new Set([...DEFAULT_IGNORED,...input.ignoreColumns??[]]),ops={deletes:[],restores:[],reinserts:[],conflicts:[]};for(let image of input.preImages)switch(image.action){case"create":{if(!image.rowId)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; deleting it would discard that edit."});break}ops.deletes.push(image.rowId);break}case"update":case"deactivate":{if(!image.rowId||!image.before)break;let now=input.current.get(image.rowId);if(!now)break;if(!input.force&&changedSince(image.after,now,ignored)){ops.conflicts.push({id:image.rowId,reason:"This record was edited after the import; restoring it would discard that edit."});break}ops.restores.push({id:image.rowId,row:image.before});break}case"delete":{if(!image.before)break;if(image.rowId&&input.current.has(image.rowId)){ops.conflicts.push({id:image.rowId,reason:"A record with this identifier exists again; it was not replaced."});break}ops.reinserts.push(image.before);break}default:break}return ops}function changedSince(after,now,ignored){if(!after)return!1;for(let[key2,value2]of Object.entries(after)){if(ignored.has(key2))continue;if(!sameValue(value2,now[key2]))return!0}return!1}function sameValue(a,b){if(a===b)return!0;if(a==null&&b==null)return!0;if(a instanceof Date&&b instanceof Date)return a.getTime()===b.getTime();if(a instanceof Date||b instanceof Date){let da=a instanceof Date?a:new Date(String(a)),db=b instanceof Date?b:new Date(String(b));return!Number.isNaN(da.getTime())&&!Number.isNaN(db.getTime())?da.getTime()===db.getTime():!1}if(typeof a==="object"||typeof b==="object")try{return JSON.stringify(a)===JSON.stringify(b)}catch{return!1}return String(a)===String(b)}var CHUNK=500;async function applyRevert(deps,ops,meta){let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,conflicts:ops.conflicts.length,error:`"${meta.targetEntity}" has no id column; its rows cannot be addressed.`};let now=new Date;try{let work=async(tx)=>{let deleted=0,restored=0,reinserted=0;for(let i=0;i<ops.deletes.length;i+=CHUNK){let chunk=ops.deletes.slice(i,i+CHUNK),removed=await tx.delete(deps.drizzleTable).where(inArray13(idCol,chunk)).returning();deleted+=removed.length}for(let restore of ops.restores){let{id:_id,createdAt:_c,createdBy:_cb,...rest3}=restore.row,written=await tx.update(deps.drizzleTable).set({...rest3,updatedAt:now,updatedBy:meta.userId}).where(and19(eq33(idCol,restore.id))).returning();restored+=written.length}if(ops.reinserts.length>0)for(let i=0;i<ops.reinserts.length;i+=CHUNK){let chunk=ops.reinserts.slice(i,i+CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();reinserted+=written.length}return{deleted,restored,reinserted}};return{ok:!0,...meta.tx?await work(meta.tx):await deps.db.transaction(work),conflicts:ops.conflicts.length}}catch(error3){return deps.logger.error("[Integrations] Revert transaction failed",{targetEntity:meta.targetEntity,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,conflicts:ops.conflicts.length,error:"The database rejected this undo; it was rolled back and nothing changed."}}}function groupPreImagesByEntity(preImages){let byEntity=new Map;for(let image of preImages){let list2=byEntity.get(image.targetEntity);if(list2)list2.push(image);else byEntity.set(image.targetEntity,[image])}return[...byEntity.entries()].map(([targetEntity,images])=>({targetEntity,preImages:images}))}function touchedRowIds(preImages){let ids=new Set;for(let image of preImages)if(image.rowId)ids.add(image.rowId);return[...ids]}var TREE_PARENT_KEY="__treeParent";function flattenTree(records,childrenPath){let out=[],truncated=!1,visit=(node,parent,depth)=>{if(!node||typeof node!=="object")return;if(depth>64){truncated=!0;return}let source=node,children=source[childrenPath],{[childrenPath]:_nested,...own}=source;if(out.push({...own,["__depth"]:depth,["__treeParent"]:parent??null}),!Array.isArray(children))return;for(let child of children)visit(child,own,depth+1)};for(let root of records)visit(root,null,0);return{records:out,truncated}}function treeChildrenPath(value2){let trimmed=(value2??"").trim();return trimmed.length>0?trimmed:null}function getByPath(obj,path7){if(!path7)return;let cur=obj;for(let part of path7.split(".")){if(cur==null||typeof cur!=="object")return;cur=cur[part]}return cur}function readSourceValue(external,parent,path7){return readOne(external,parent,path7)}function readOne(external,parent,path7){return path7.startsWith("__parent.")?getByPath(parent,path7.slice(9)):getByPath(external,path7)}var TEMPLATE_TOKEN=/\{([^{}]+)\}/g;function isTemplateSource(source){return TEMPLATE_TOKEN.lastIndex=0,TEMPLATE_TOKEN.test(source)}function renderTemplate(template,external,parent){let treeParentAbsent=external!=null&&typeof external==="object"&&TREE_PARENT_KEY in external&&external[TREE_PARENT_KEY]==null,readsTreeParent=(text2)=>text2.includes(`{${TREE_PARENT_KEY}.`),readToken=(token)=>{let[path7="",transform3]=token.split("|"),value2=readOne(external,parent,path7.trim());if(transform3===void 0)return value2;let result=applyTransform(value2,transform3.trim());return result.ok?result.value:value2};for(let alternative of template.split("||")){let candidate=alternative.trim();if(candidate==="")continue;if(treeParentAbsent&&readsTreeParent(candidate))continue;let complete=!0,rendered=candidate.replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(complete&&rendered.trim()!=="")return rendered}let last=template.split("||").pop()??template;if(treeParentAbsent&&readsTreeParent(last))return"";return last.trim().replace(TEMPLATE_TOKEN,(_match,token)=>{let value2=readToken(token);return value2==null?"":String(value2)})}function extractRecords(body,rootPath){if(rootPath){let at=getByPath(body,rootPath);if(Array.isArray(at))return at;return at&&typeof at==="object"?[at]:[]}let candidate=firstArrayLike(body)??deepFirstArrayOfObjects(body);return Array.isArray(candidate)?candidate:[]}var ENVELOPE_KEYS=["content","items","data","results","records","rows","list","value","responseObject"];function firstArrayLike(body){if(Array.isArray(body))return body;if(!body||typeof body!=="object")return;let b=body;for(let key2 of ENVELOPE_KEYS){let v=b[key2];if(Array.isArray(v))return v;if(v&&typeof v==="object"){let nested=v.items;if(Array.isArray(nested))return nested}}return}function deepFirstArrayOfObjects(body,depth=0){if(depth>5||body==null||typeof body!=="object"||body instanceof Date)return;if(Array.isArray(body))return body.length>0&&typeof body[0]==="object"&&body[0]!==null?body:void 0;let entries=Object.values(body);for(let v of entries)if(Array.isArray(v)&&v.length>0&&typeof v[0]==="object"&&v[0]!==null)return v;for(let v of entries)if(v&&typeof v==="object"&&!Array.isArray(v)){let found=deepFirstArrayOfObjects(v,depth+1);if(found)return found}for(let v of entries)if(Array.isArray(v))return v;return}var FOLD={\u{131}:"i",\u{130}:"I",\u{15f}:"s",\u{15e}:"S",\u{11f}:"g",\u{11e}:"G",\u{f8}:"o",\u{d8}:"O",\u{e6}:"ae",\u{c6}:"AE",\u{df}:"ss",\u{111}:"d",\u{110}:"D",\u{142}:"l",\u{141}:"L"};function foldToAscii(value2){return value2.replace(/[\u0131\u0130\u015F\u015E\u011F\u011E\u00F8\u00D8\u00E6\u00C6\u00DF\u0111\u0110\u0142\u0141]/g,(ch)=>FOLD[ch]??ch).normalize("NFD").replace(/[\u0300-\u036f]/g,"")}var TRUTHY=new Set(["true","1","yes","y","evet","e","on"]),FALSY=new Set(["false","0","no","n","hayir","hay\u0131r","h","off"]);function applyTransform(value2,transform3,locale){if(value2==null)return{ok:!0,value:value2};switch(transform3){case"trim":return{ok:!0,value:String(value2).trim()};case"upper":return{ok:!0,value:String(value2).trim().toLocaleUpperCase(locale)};case"lower":return{ok:!0,value:String(value2).trim().toLocaleLowerCase(locale)};case"toString":return{ok:!0,value:String(value2)};case"toNumber":{if(typeof value2==="boolean")return{ok:!1,reason:"not a number",raw:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let n=Number(s);return Number.isFinite(n)?{ok:!0,value:n}:{ok:!1,reason:"not a number",raw:value2}}case"toBoolean":{if(typeof value2==="boolean")return{ok:!0,value:value2};let s=String(value2).trim().toLocaleLowerCase("tr-TR");if(s==="")return{ok:!0,value:null};if(TRUTHY.has(s))return{ok:!0,value:!0};if(FALSY.has(s))return{ok:!0,value:!1};return{ok:!1,reason:"not a yes/no value",raw:value2}}case"emailSafe":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"")};case"slug":return{ok:!0,value:foldToAscii(String(value2)).toLowerCase().trim().replace(/[^a-z0-9]+/g,"-").replace(/-{2,}/g,"-").replace(/^-+|-+$/g,"")};case"pathLeaf":{let parts=String(value2).split(/[/\\>\u203A\u00BB]|->/).map((part)=>part.trim()).filter((part)=>part!=="");return{ok:!0,value:parts.length>0?parts[parts.length-1]:""}}case"toList":{if(Array.isArray(value2))return{ok:!0,value:value2};let s=String(value2).trim();if(s==="")return{ok:!0,value:[]};return{ok:!0,value:s.split(",").map((part)=>part.trim()).filter((part)=>part!=="")}}case"dateOnly":{let s=String(value2).trim();if(s==="")return{ok:!0,value:null};let leading=s.match(/^\d{4}-\d{2}-\d{2}/);if(leading)return{ok:!0,value:leading[0]};let d=new Date(s);return Number.isNaN(d.getTime())?{ok:!1,reason:"not a date",raw:value2}:{ok:!0,value:d.toISOString().slice(0,10)}}default:return{ok:!0,value:value2}}}function isEmpty(v){return v==null||typeof v==="string"&&v.trim()===""}function mapRecord(external,mappings,parent){let row={},problems=[];for(let fm of mappings){if(!fm.target)continue;let value2;if(fm.constant!=null&&fm.constant!=="")value2=fm.constant;else{let raw=isTemplateSource(fm.source)?renderTemplate(fm.source,external,parent):readOne(external,parent,fm.source),result=applyTransform(raw,fm.transform);if(!result.ok)problems.push(`${fm.source} \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null;else value2=result.value}if(isEmpty(value2)&&fm.fallback!=null&&fm.fallback!==""){let raw=isTemplateSource(fm.fallback)?renderTemplate(fm.fallback,external,parent):fm.fallback,result=applyTransform(raw,fm.transform);if(result.ok)value2=result.value;else problems.push(`fallback \u2192 ${fm.target}: ${result.reason} (${String(result.raw)})`),value2=null}if(value2!==void 0)row[fm.target]=value2}return{row,problems}}function buildMappedRecords(externalRecords,mappings,dedupTargetField,parents){let records=[],issues=[];return externalRecords.forEach((ext,i)=>{let{row,problems}=mapRecord(ext,mappings,parents?.[i]);for(let message of problems)issues.push({sourceIndex:i,kind:"invalid_value",message});let dedupKey=dedupTargetField&&!isEmpty(row[dedupTargetField])?String(row[dedupTargetField]).trim():null;records.push({data:row,dedupKey,sourceIndex:i,external:ext,parent:parents?.[i]})}),{records,issues}}function flattenKeys(obj,prefix="",out=[],depth=0){if(out.length>200||depth>4||obj==null||typeof obj!=="object")return out;if(Array.isArray(obj)){if(prefix)out.push(prefix);return out}for(let[k,v]of Object.entries(obj)){let path7=prefix?`${prefix}.${k}`:k;if(v!=null&&typeof v==="object"&&!Array.isArray(v))flattenKeys(v,path7,out,depth+1);else out.push(path7)}return out}var MAX_FANOUT_COMBINATIONS=5000;function resolvePath2(rawPath,values){let missing=new Set,used=new Set;return{path:rawPath.replace(/\{([a-zA-Z_][\w-]*)\}|:([a-zA-Z_]\w*)/g,(_full,brace,colon)=>{let key2=brace??colon,v=values[key2];if(v==null||v==="")return missing.add(key2),brace?`{${key2}}`:`:${key2}`;return used.add(key2),encodeURIComponent(String(v))}),missing:[...missing],used}}function planFetchOrder(endpoints,roots){let byId=new Map(endpoints.map((e)=>[e.id,e])),order=[],settled=new Set,onPath=[],onPathSet=new Set,visit=(id,requiredBy)=>{if(settled.has(id))return null;if(onPathSet.has(id))return{ok:!1,reason:"cycle",chain:[...onPath.slice(onPath.indexOf(id)),id]};let node=byId.get(id);if(!node)return{ok:!1,reason:"unknown_endpoint",missing:id,requiredBy:requiredBy??id};onPath.push(id),onPathSet.add(id);for(let binding of node.paramBindings??[]){if(binding.from!=="endpoint")continue;let failure=visit(binding.endpointId,id);if(failure)return failure}return onPath.pop(),onPathSet.delete(id),settled.add(id),order.push(id),null};for(let id of roots??endpoints.map((e)=>e.id)){let failure=visit(id,null);if(failure)return failure}return{ok:!0,order}}function expandBindings(bindings,sources,limit=MAX_FANOUT_COMBINATIONS){if(!bindings||bindings.length===0)return{ok:!0,calls:[{values:{}}]};let axes=[];for(let binding of bindings){if(binding.from==="static"){axes.push({param:binding.param,options:[{value:binding.value}]});continue}if(binding.from==="endpoint"){let options=(sources.parents?.[binding.endpointId]??[]).map((record3)=>({value:getByPath(record3,binding.field),parent:record3})).filter((o)=>o.value!=null&&o.value!=="");axes.push({param:binding.param,options});continue}let values=sources.entityValues?.[`${binding.entity}.${binding.field}`]??[];axes.push({param:binding.param,options:values.filter((v)=>v!=null&&v!=="").map((value2)=>({value:value2}))})}if(axes.some((a)=>a.options.length===0))return{ok:!0,calls:[]};let combinations=axes.reduce((n,a)=>n*a.options.length,1);if(combinations>limit)return{ok:!1,reason:"too_many",combinations,limit};let calls=[{values:{}}];for(let axis of axes){let next=[];for(let call of calls)for(let option of axis.options)next.push({values:{...call.values,[axis.param]:option.value},parent:option.parent??call.parent});calls=next}return{ok:!0,calls}}function parentEndpointIds(bindings){let ids=new Set;for(let b of bindings??[])if(b.from==="endpoint")ids.add(b.endpointId);return[...ids]}function entityValueKeys(bindings){let keys=new Set;for(let b of bindings??[])if(b.from==="entity")keys.add(`${b.entity}.${b.field}`);return[...keys]}var MAX_PAGES=1000,DEFAULT_PAGE_SIZE=200,initialState=()=>({pagesFetched:0,recordsFetched:0,cursor:null});function firstPageParams(profile){switch(profile.kind){case"page_number":{let params={[profile.pageParam]:String(profile.firstPage??0)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"offset":return{[profile.offsetParam]:"0",[profile.limitParam]:String(pageSize(profile))};case"cursor":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}case"link_header":{let params={};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return params}default:return{}}}function reportedTotal(profile,body){let path7=profile.kind==="page_number"||profile.kind==="offset"?profile.totalPath:void 0;if(!path7)return null;let raw=getByPath(body,path7);if(typeof raw==="number"&&Number.isFinite(raw)&&raw>=0)return Math.floor(raw);if(typeof raw==="string"&&raw.trim()!==""){let n=Number(raw);if(Number.isFinite(n)&&n>=0)return Math.floor(n)}return null}function nextPage(profile,state,observed){if(profile.kind==="none")return{kind:"done",reason:"single request"};if(state.pagesFetched>=MAX_PAGES)return{kind:"failed",reason:`Paging stopped after ${MAX_PAGES} requests without reaching the end. The source may not be honouring the paging parameters; importing this would be a partial read.`};if(observed.recordCount===0)return{kind:"done",reason:"empty page"};switch(profile.kind){case"page_number":{if(isLastPage(profile.lastPagePath,observed.body))return{kind:"done",reason:"source reported the last page"};let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};let next=(profile.firstPage??0)+state.pagesFetched,params={[profile.pageParam]:String(next)};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"offset":{let total=reportedTotal(profile,observed.body);if(total!==null&&state.recordsFetched>=total)return{kind:"done",reason:"reported total reached"};if(observed.recordCount<pageSize(profile))return{kind:"done",reason:"short page"};return{kind:"params",params:{[profile.offsetParam]:String(state.recordsFetched),[profile.limitParam]:String(pageSize(profile))}}}case"cursor":{let raw=getByPath(observed.body,profile.nextCursorPath),next=raw==null?"":String(raw).trim();if(next==="")return{kind:"done",reason:"no further cursor"};if(state.cursor!=null&&next===state.cursor)return{kind:"failed",reason:`The source returned the same cursor twice (${next}); paging would not advance.`};let params={[profile.cursorParam]:next};if(profile.sizeParam)params[profile.sizeParam]=String(pageSize(profile));return{kind:"params",params}}case"link_header":{let url=parseNextLink(observed.linkHeader);if(!url)return{kind:"done",reason:"no rel=next link"};return{kind:"url",url}}default:return{kind:"done",reason:"single request"}}}function pageSize(profile){let declared="pageSize"in profile?profile.pageSize:void 0;return declared&&declared>0?declared:DEFAULT_PAGE_SIZE}function isLastPage(path7,body){if(!path7)return!1;let raw=getByPath(body,path7);if(typeof raw==="boolean")return raw;if(typeof raw==="string")return raw.trim().toLowerCase()==="true";return!1}function parseNextLink(header){if(!header)return null;for(let part of splitLinks(header)){let match=part.match(/<([^>]*)>(.*)/);if(!match)continue;let url=(match[1]??"").trim(),attrs=match[2]??"";if(!url)continue;if(/;\s*rel\s*=\s*["']?\s*next\s*["']?(\s*;|\s*$)/i.test(attrs))return url}return null}function splitLinks(header){let parts=[],depth=0,current="";for(let ch of header){if(ch==="<")depth++;else if(ch===">")depth--;if(ch===","&&depth===0){parts.push(current),current="";continue}current+=ch}if(current.trim()!=="")parts.push(current);return parts}var DEFAULT_MAX_CONCURRENT=4,DEFAULT_MAX_RECORDS=50000;async function collectOne(source,endpoint,params,deps,counters){let profile=endpoint.pagination??{kind:"none"},maxRecords=deps.maxRecords??DEFAULT_MAX_RECORDS,values={...endpoint.queryParams??{},...params.values},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return{ok:!1,error:`This endpoint needs path parameter(s) ${resolved.missing.map((m)=>`{${m}}`).join(", ")} and nothing supplies them. Add a parameter binding, or a static value.`};let baseQuery={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;baseQuery[key2]=value2}let records=[],total=null,state=initialState(),pageParams=firstPageParams(profile),absoluteUrl=null;for(;;){if(deps.isCancelled?.())return{ok:!1,error:"Cancelled."};let url;if(absoluteUrl)try{url=new URL(absoluteUrl)}catch{return{ok:!1,error:`The source returned an unusable next-page link: ${absoluteUrl}`}}else{let built=buildUrl(source.baseUrl,resolved.path,{...baseQuery,...pageParams});if(!built.ok)return{ok:!1,error:built.error};url=built.url}let headers={accept:"application/json"};if(deps.bearerToken)headers.Authorization=`Bearer ${deps.bearerToken}`;counters.calls++;let outcome=await fetchOnce({...source,token:deps.bearerToken??source.token},{method:endpoint.method,url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl:deps.fetchImpl});if(!outcome.ok)return{ok:!1,error:outcome.error??`HTTP ${outcome.status}`};let raw=extractRecords(outcome.body,endpoint.responseRootPath),childrenPath=treeChildrenPath(endpoint.treeChildrenPath),flattened=childrenPath?flattenTree(raw,childrenPath):null;if(flattened?.truncated)return{ok:!1,error:"This source answered with a structure that nests into itself. Nothing was imported \u2014 a company that contains itself has no order to write it in."};let page=flattened?flattened.records:raw;if(records.push(...page),counters.records+=page.length,total===null)total=reportedTotal(profile,outcome.body);if(counters.records>maxRecords)return{ok:!1,error:`This run would hold more than ${maxRecords} records at once. Narrow the source with a filter, or raise maxRecordsPerRun.`};deps.onProgress?.(counters.records),state={pagesFetched:state.pagesFetched+1,recordsFetched:records.length,cursor:pageParams[cursorParamOf(profile)??""]??state.cursor};let next=nextPage(profile,state,{recordCount:page.length,body:outcome.body,linkHeader:outcome.linkHeader});if(next.kind==="done")break;if(next.kind==="failed")return{ok:!1,error:next.reason};if(next.kind==="url"){absoluteUrl=next.url,pageParams={};continue}absoluteUrl=null,pageParams=next.params}return{ok:!0,records,total}}function cursorParamOf(profile){return profile.kind==="cursor"?profile.cursorParam:null}function describeCallFailure(call,error3){let params=call.values??{},named=Object.entries(params).map(([key2,value2])=>`${key2}=${String(value2)}`).join(", ");return named?`${named}: ${error3}`:error3}async function collectEndpoint(source,endpoint,sources,deps={}){let counters={calls:0,records:0},expansion=expandBindings(endpoint.paramBindings??void 0,sources);if(!expansion.ok)return{ok:!1,callCount:0,error:`This endpoint would be called ${expansion.combinations} times (the ceiling is ${expansion.limit}). Narrow the parent list, or remove one of the parameter bindings.`};if(expansion.calls.length===0)return{ok:!0,records:[],reportedTotal:null,callCount:0};let limit=Math.max(1,deps.maxConcurrent??DEFAULT_MAX_CONCURRENT),collected=[],total=null,failure=null,partial3=[],cursor=0,worker=async()=>{for(;;){if(failure||deps.isCancelled?.())return;let index=cursor++,call=expansion.calls[index];if(!call)return;let result=await collectOne(source,endpoint,call,deps,counters);if(!result.ok){if(expansion.calls.length>1){partial3.push(describeCallFailure(call,result.error));continue}failure??=result.error;return}for(let record3 of result.records)collected.push({record:record3,parent:call.parent});if(expansion.calls.length===1)total=result.total}};if(await Promise.all(Array.from({length:Math.min(limit,expansion.calls.length)},worker)),failure)return{ok:!1,error:failure,callCount:counters.calls};if(deps.isCancelled?.())return{ok:!1,error:"Cancelled.",callCount:counters.calls};if(partial3.length>0&&collected.length===0&&partial3.length===expansion.calls.length)return{ok:!1,error:`Every call to this endpoint failed. First: ${partial3[0]}`,callCount:counters.calls};return{ok:!0,records:collected,reportedTotal:total,callCount:counters.calls,...partial3.length>0?{partialFailures:partial3}:{}}}function isDestructive(writeMode,missingPolicy){return writeMode==="replace"||missingPolicy==="delete"||missingPolicy==="deactivate"}function destructiveGate(input){if(!isDestructive(input.writeMode,input.missingPolicy))return{allowed:!0};if(input.partialFailures>0&&!input.scopedRemoval)return{allowed:!1,kind:"incomplete_source",message:`${input.partialFailures} call(s) in this source never answered, so part of it was not read. This run removes records the source does not send, and those unread records would be removed as if the source had dropped them. Fix the failing call, or switch this mapping to leave missing records alone.`};if(input.fetched===0)return{allowed:!1,kind:"incomplete_source",message:"The source returned no records at all. This run removes what the source does not send, so it would empty the target table. A source that is genuinely empty and one that could "+"not be read look the same from here, so this will not proceed on its own \u2014 preview it, "+"and if the source really is empty, remove the rows deliberately."};if(input.reported!==null&&input.fetched<input.reported)return{allowed:!1,kind:"incomplete_source",message:`The source reports ${input.reported} records but only ${input.fetched} were read. This run deletes what the source does not send, so it will not proceed on a partial read. Check the paging settings for this endpoint.`};return{allowed:!0}}function checkPlanVolume(input){if(input.maxShare<=0)return{allowed:!0};if(input.removing===0||input.existing===0)return{allowed:!0};let share=input.removing/input.existing;if(share<=input.maxShare)return{allowed:!0};let asPercent=(value2)=>`${Math.round(value2*100)}%`;return{allowed:!1,kind:"incomplete_source",message:`This run would remove ${input.removing} of ${input.existing} rows (${asPercent(share)}), which is above the ${asPercent(input.maxShare)} this mapping allows unattended. `+"A source can return perfectly good records and still produce a removal this large \u2014 a "+"changed dedup column, a repointed endpoint, a filter added upstream. Preview the run; if the removal is right, apply it deliberately."}}function orphanLinkNote(input){let{made,unresolved}=input;if(unresolved<=0)return null;let total=made+unresolved,share=total>0?unresolved/total:1,column=input.column?` (${input.column})`:"",consequence=`${unresolved} record${unresolved===1?"":"s"} could not find the parent to attach to${column} \u2014 `+"they are drawn at the TOP of the tree, at the same level as the chief executive.";if(share>=0.2)return`${consequence} Next to the ${made} that did attach, that is a large share: either the source is not sending a parent for these people, or one of the matching fields is written differently in the two places. Look at the source before trusting the chart.`;return`${consequence} ${made} link${made===1?" was":"s were"} made.`}function looksLikeKeyDrift(input){if(input.existing<=0)return!1;if(input.creating<=0||input.unmatched<=0)return!1;return input.creating/input.existing>=0.1&&input.unmatched/input.existing>=0.1}function keyDriftWarning(input){if(!looksLikeKeyDrift(input))return null;return`This run will add ${input.creating} rows, and the source no longer sends ${input.unmatched} of the rows already here. Both being this large points at the matching values in the `+"source having changed \u2014 so these are not new records, they are the same records under "+"new names. Run it with \u201Cmissing rows: leave alone\u201D and both generations survive: the "+`table grows to ${input.existing+input.creating} rows, and where records point at each other (an organisation tree, for instance) the new rows cannot find their old parents and the structure breaks. Either switch the policy to delete/deactivate and clean up `+"once, or correct the matching column to the source\u2019s new value."}var referenceKey=(check)=>`${check.entity}.${check.entityColumn}`,pointsAtOwnTable=(check,targetEntity)=>check.entity===targetEntity;function referenceValuesOf(raw){if(Array.isArray(raw))return{values:raw.map((item)=>String(item??"").trim()).filter((item)=>item!==""),wasList:!0};if(raw===null||raw===void 0)return{values:[],wasList:!1};let single=String(raw).trim();return{values:single===""?[]:[single],wasList:!1}}var isEmptyReference=(raw)=>referenceValuesOf(raw).values.length===0;function resolveReference(raw,ids){let{values,wasList}=referenceValuesOf(raw),found=[],unmatched=[];for(let value2 of values){let id=ids?.[value2];if(id===void 0)unmatched.push(value2);else if(!found.includes(id))found.push(id)}return{ids:found,unmatched,wasList}}function resolvedColumnValue(resolution){return resolution.wasList?resolution.ids:resolution.ids[0]??null}function applyReferenceIds(row,references,ids,targetEntity){let next={...row},deferred=[];for(let check of references){if(!check.writeIdTo)continue;let raw=row[check.column];if(pointsAtOwnTable(check,targetEntity)){if(next[check.writeIdTo]=Array.isArray(raw)?[]:null,!isEmptyReference(raw))deferred.push({check,raw});continue}next[check.writeIdTo]=resolvedColumnValue(resolveReference(raw,ids[referenceKey(check)]))}return{row:next,deferred}}function unambiguousIds(rows){let seen=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;seen.set(key2,seen.has(key2)?null:String(row.id))}let ids={};for(let[key2,id]of seen)if(id!==null)ids[key2]=id;return ids}function ambiguousValues(rows){let counts=new Map;for(let row of rows){if(row.value==null||row.id==null)continue;let key2=String(row.value).trim();if(key2==="")continue;counts.set(key2,(counts.get(key2)??0)+1)}return[...counts.entries()].filter(([,n])=>n>1).map(([key2])=>key2)}var UNRESOLVED_TEMPLATE=/^\s*(\$\{[^}]*\}|\{\{[^}]*\}\})\s*$/,isEmpty2=(v)=>v==null||typeof v==="string"&&(v.trim()===""||UNRESOLVED_TEMPLATE.test(v));function displayValue(value2){if(value2!==null&&typeof value2==="object")try{return JSON.stringify(value2)}catch{return"(a value that cannot be shown)"}return String(value2)}function buildFallbackIdentifier(format2,data){let complete=!0,rendered=format2.replace(/\{([^{}]+)\}/g,(_match,path7)=>{let value2=data[path7.trim()];if(value2==null||String(value2).trim()==="")complete=!1;return value2==null?"":String(value2)});if(!complete)return null;let cleaned=foldToAscii(rendered).toLowerCase().trim().replace(/[^a-z0-9._@+-]+/g,".").replace(/\.{2,}/g,".").replace(/\.*@\.*/g,"@").replace(/^[.\-_]+|[.\-_]+$/g,"");return cleaned===""?null:cleaned}function missingReferences(row,references,known){let broken=[];for(let check of references){let raw=row[check.column];if(isEmpty2(raw))continue;let value2=displayValue(raw).trim(),present=known[`${check.entity}.${check.entityColumn}`];if(!present)continue;if(!present.has(value2))broken.push({check,value:value2,raw})}return broken}async function loadReferenceValues(references,read2){let values={};for(let check of references){let key2=`${check.entity}.${check.entityColumn}`;if(values[key2])continue;let rows=await read2(check.entity,check.entityColumn);values[key2]=new Set(rows.filter((v)=>!isEmpty2(v)).map((v)=>String(v).trim()))}return values}async function loadReferenceIds(references,targetEntity,read2){let ids={},ambiguous={};for(let check of references){if(!check.writeIdTo)continue;if(pointsAtOwnTable(check,targetEntity))continue;let key2=referenceKey(check);if(ids[key2])continue;let pairs=await read2(check.entity,check.entityColumn);ids[key2]=unambiguousIds(pairs);let shared=ambiguousValues(pairs);if(shared.length>0)ambiguous[key2]=shared}return{ids,ambiguous}}function ambiguityWarnings(ambiguous){return Object.entries(ambiguous).map(([key2,values])=>{let shown=values.slice(0,5).join(", "),rest3=values.length>5?` and ${values.length-5} more`:"";return`${values.length} value(s) in ${key2} belong to more than one row \u2014 ${shown}${rest3}. Records pointing at them are left unlinked rather than linked to whichever row came first.`})}function planWrites(input){let{records,existing,dedupTargetField,writeMode,missingPolicy,missingColumn,missingValue,removalScope=null,originColumn,originValue,requiredFields=[],uniqueFields=[],createDefaults={},accountRule=null,existingAccounts={},references=[],referenceValues={},referenceIds={},targetEntity=""}=input,issues=[],warnings=[],creates=[],referenceInserts=[],accountInserts=[],accountJoinInserts=[],plannedAccounts=new Set,plannedRefs=new Set,updates=[],deletes=[],deactivates=[],departures=[],deferredLinks=[],dedupConfigured=Boolean(dedupTargetField),accountClaims=new Map,accountIdIsUnique=accountRule?uniqueFields.includes(accountRule.idColumn):!1,fillIdentifier=(data)=>{let format2=accountRule?.emailFormat?.trim();if(!accountRule||!format2)return data;if(!isEmpty2(data[accountRule.matchFrom]))return data;let built=buildFallbackIdentifier(format2,data);return built===null?data:{...data,[accountRule.matchFrom]:built}},withAccount=(record3,input2)=>{if(!accountRule)return input2;let data=fillIdentifier(input2),raw=data[accountRule.matchFrom];if(isEmpty2(raw))return issues.push({sourceIndex:record3.sourceIndex,kind:"account_unmatched",field:accountRule.matchFrom,message:`${accountRule.matchFrom} is empty, so this record gets no account \u2014 it is imported without one.`,dedupKey:record3.dedupKey,row:data}),data;let value2=String(raw).trim(),claimedBy=accountClaims.get(value2);if(claimedBy&&accountIdIsUnique)return issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field:accountRule.matchFrom,value:String(value2),message:`${accountRule.matchFrom} is \u201C${value2}\u201D, which another record in this import already uses \u2014 and ${accountRule.idColumn} allows one record per account. This one is left out.`,dedupKey:record3.dedupKey,row:data,keptRow:claimedBy.data}),null;accountClaims.set(value2,record3);let existingId=existingAccounts[value2];if(existingId)return{...data,[accountRule.idColumn]:existingId};if(!plannedAccounts.has(value2)){plannedAccounts.add(value2);let accountData={[accountRule.matchColumn]:value2};for(let pair of accountRule.values??[]){let from=data[pair.from];if(!isEmpty2(from))accountData[pair.column]=from}accountInserts.push({entity:accountRule.entity,matchColumn:accountRule.matchColumn,matchValue:value2,data:accountData});for(let join7 of accountRule.joins??[])accountJoinInserts.push({entity:join7.entity,accountColumn:join7.accountColumn,values:join7.values,matchValue:value2})}return data},hasDefaults=Object.keys(createDefaults).length>0,stamp2=originColumn?{[originColumn]:originValue}:{},newRecord=(data)=>hasDefaults?{...createDefaults,...data,...stamp2}:{...data,...stamp2},existingByKey=new Map;if(dedupTargetField)for(let row of existing){let value2=row.row[dedupTargetField];if(!isEmpty2(value2))existingByKey.set(String(value2).trim(),row)}let claimedUnique=new Map;for(let field of uniqueFields){let taken=new Map;for(let existingRow of existing){let value2=existingRow.row[field];if(!isEmpty2(value2))taken.set(String(value2).trim(),existingRow.id)}claimedUnique.set(field,taken)}let ownsRow=(row)=>{if(!originColumn)return!0;let value2=row.row[originColumn];return String(value2??"")===String(originValue??"")},matchedIds=new Set,seenIds=new Set,seenInBatch=new Map;for(let sourceRecord of records){let broken=missingReferences(sourceRecord.data,references,referenceValues),resolvedRow=applyReferenceIds(sourceRecord.data,references,referenceIds,targetEntity),record3={...sourceRecord,data:fillIdentifier(resolvedRow.row)};if(record3.dedupKey!=null){let carried=existingByKey.get(record3.dedupKey);if(carried)seenIds.add(carried.id)}for(let link of resolvedRow.deferred){if(!dedupTargetField)continue;let matchValue=record3.data[dedupTargetField];if(isEmpty2(matchValue))continue;deferredLinks.push({matchColumn:dedupTargetField,matchValue:String(matchValue).trim(),writeIdTo:link.check.writeIdTo,lookupColumn:link.check.entityColumn,raw:link.raw,isList:Array.isArray(link.raw)})}let blocking=broken.find((b)=>b.check.onMissing==="skipRecord");if(blocking){let{check,value:value2}=blocking;issues.push({sourceIndex:record3.sourceIndex,kind:"missing_reference",message:typeof blocking.raw==="object"&&blocking.raw!==null?`${check.column} is not a single value but a whole object \u2014 ${value2}. Point the mapping at one field of it, e.g. \`${check.column}.code\`, and it will have something to match against ${check.entity}.${check.entityColumn}.`:`${check.column} is \u201C${value2}\u201D, which does not exist in ${check.entity}.${check.entityColumn} \u2014 this record is left out.`,dedupKey:record3.dedupKey,row:record3.data,reference:{column:check.column,value:value2,entity:check.entity,entityColumn:check.entityColumn}});continue}let keepReferences=()=>{for(let{check,value:value2}of broken){if(check.onMissing!=="create")continue;let token=`${check.entity}.${check.entityColumn}::${value2}`;if(plannedRefs.has(token))continue;plannedRefs.add(token);let data={};for(let pair of check.createValues??[]){let fromSource=isTemplateSource(pair.from)?renderTemplate(pair.from,record3.external,record3.parent):readSourceValue(record3.external,record3.parent,pair.from),value3=isEmpty2(fromSource)?record3.data[pair.from]:fromSource;if(!isEmpty2(value3))data[pair.column]=value3}referenceInserts.push({entity:check.entity,column:check.entityColumn,value:value2,...Object.keys(data).length>0?{data}:{}})}},uniqueCollision=(data,ownRowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;let value2=String(raw).trim(),holder2=claimedUnique.get(field)?.get(value2);if(holder2===void 0)continue;if(holder2!==null&&holder2===ownRowId)continue;return{field,value:value2}}return null},claimUnique=(data,rowId)=>{for(let field of uniqueFields){let raw=data[field];if(isEmpty2(raw))continue;claimedUnique.get(field)?.set(String(raw).trim(),rowId)}},collide=(field,value2)=>{issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_value",field,value:String(value2),message:`${field} is \u201C${value2}\u201D, which something else already has \u2014 ${field} has to be unique, so this record is left out.`,dedupKey:record3.dedupKey,row:record3.data})},missingRequired=requiredFields.filter((f)=>isEmpty2(record3.data[f])&&isEmpty2(createDefaults[f]));if(missingRequired.length>0){issues.push({sourceIndex:record3.sourceIndex,kind:"missing_required",field:missingRequired.join(", "),message:`Required field(s) empty: ${missingRequired.join(", ")}`,dedupKey:record3.dedupKey,row:record3.data});continue}if(!dedupConfigured){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}if(record3.dedupKey==null){let clash2=uniqueCollision(record3.data,null);if(clash2){collide(clash2.field,clash2.value);continue}issues.push({sourceIndex:record3.sourceIndex,kind:"missing_dedup_key",message:"Deduplication field is empty on this record \u2014 it will be added as new."}),keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let claimedBy=seenInBatch.get(record3.dedupKey);if(claimedBy){issues.push({sourceIndex:record3.sourceIndex,kind:"duplicate_in_batch",value:String(record3.dedupKey??""),message:`The source carries this key more than once: ${record3.dedupKey} \u2014 this occurrence is skipped.`,dedupKey:record3.dedupKey,row:record3.data,keptRow:claimedBy});continue}if(seenInBatch.set(record3.dedupKey,record3.data),writeMode==="replace"||writeMode==="append"){let clash2=uniqueCollision(record3.data,null);if(clash2&&!(writeMode==="replace"&&claimedUnique.get(clash2.field)?.get(clash2.value))){collide(clash2.field,clash2.value);continue}keepReferences(),claimUnique(record3.data,null);let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex});continue}let match=existingByKey.get(record3.dedupKey),clash=uniqueCollision(record3.data,match?.id??null);if(clash){collide(clash.field,clash.value);continue}if(keepReferences(),claimUnique(record3.data,match?.id??null),match)matchedIds.add(match.id),updates.push({id:match.id,data:{...record3.data,...stamp2},before:match.row,sourceIndex:record3.sourceIndex});else{let withLogin=withAccount(record3,newRecord(record3.data));if(!withLogin)continue;creates.push({data:withLogin,sourceIndex:record3.sourceIndex})}}if(writeMode==="replace")deletes.push(...existing);else if(writeMode==="upsert"&&missingPolicy!=="ignore"){let wasRead=(row)=>{if(!removalScope)return!0;let value2=row.row[removalScope.column];if(isEmpty2(value2))return!1;return removalScope.readValues.includes(String(value2).trim())},gone=existing.filter((row)=>!seenIds.has(row.id)).filter((row)=>ownsRow(row)).filter(wasRead);if(missingPolicy==="delete")deletes.push(...gone);else deactivates.push(...gone);departures.push(...gone)}if(writeMode==="upsert"&&missingPolicy==="ignore"){let owned=existing.filter((row)=>ownsRow(row)),unmatched=owned.filter((row)=>!seenIds.has(row.id)).length,drift=keyDriftWarning({creating:creates.length,unmatched,existing:owned.length});if(drift)warnings.push(drift)}if(!dedupConfigured&&writeMode==="upsert")warnings.push("No deduplication field is set. Nothing can be matched against what is already here, so every record is added as new and each run will duplicate the last.");if(dedupConfigured&&records.length>0&&records.every((r)=>r.dedupKey==null))warnings.push(`The deduplication field is empty on every record \u2014 it is probably not among the mapped fields. As it stands nothing can ever match: all ${records.length} records will be re-added on every run.`);if(writeMode==="append"&&dedupConfigured)warnings.push("Append mode ignores the deduplication field: records already here will be added again.");if(writeMode==="replace"){if(warnings.push(`Replace mode: all ${existing.length} rows currently in the table are deleted and rebuilt from the source. Row identifiers change, so anything referring to them by id breaks.`),dedupConfigured)warnings.push('A deduplication field is set, so "update existing" would keep the current rows and their identifiers. Replace mode is only necessary when records cannot be matched at all.')}if(deactivates.length>0&&(!missingColumn||isEmpty2(missingValue)))warnings.push('The policy for records missing from the source is "deactivate", but no column and value are configured \u2014 those rows will be left untouched.'),deactivates.length=0;return{creates,updates,deletes,deactivates,departures,deferredLinks,issues,warnings,referenceInserts,accountInserts,accountJoinInserts}}var SKIPPING_ISSUE_KINDS=new Set(["missing_required","duplicate_in_batch","duplicate_value","invalid_value","missing_reference"]);function skippedRecordCount(issues){let records=new Set;for(let issue of issues){if(!SKIPPING_ISSUE_KINDS.has(issue.kind))continue;if(issue.sourceIndex<0)continue;records.add(issue.sourceIndex)}return records.size}function summarize(ops,meta){let sampleSize=meta.sampleSize??8,sample=[...ops.creates.map((c)=>c.data),...ops.updates.map((u)=>u.data)].slice(0,sampleSize);return{targetEntity:meta.targetEntity,writeMode:meta.writeMode,totalFetched:meta.totalFetched,reportedTotal:meta.reportedTotal,toCreate:ops.creates.length,toUpdate:ops.updates.length,toSkip:skippedRecordCount(ops.issues),missing:ops.deletes.length+ops.deactivates.length,missingPolicy:meta.missingPolicy,existingCount:meta.existingCount,dedupConfigured:meta.dedupConfigured,issues:ops.issues,warnings:ops.warnings,referenceInserts:ops.referenceInserts,accountsToCreate:ops.accountInserts.length,sample}}function removalScopeFor(column,records){if(!column)return null;let readValues=new Set;for(let record3 of records){let value2=record3.data[column];if(!isEmpty2(value2))readValues.add(String(value2).trim())}return{column,readValues:[...readValues]}}init_AccountLink();import{and as and20,eq as eq34,inArray as inArray14}from"drizzle-orm";var INSERT_CHUNK=500,DELETE_CHUNK=1000;function validateAll(ops,columns,validatePayload2){let issues=[];for(let op of ops.creates){let result=validatePayload2(op.data,columns,!1);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}for(let op of ops.updates){let result=validatePayload2(op.data,columns,!0);if(!result.valid)issues.push({sourceIndex:op.sourceIndex,kind:"invalid_value",message:result.errors.map((e)=>`${e.field}: ${e.message}`).join("; "),row:op.data})}return issues}function referenceRow(columns,column,value2,extra){let row={...extra,[column]:value2},unfillable=[];for(let col8 of columns){let name2=camel(col8.name);if(name2===column)continue;if(SYSTEM_COLUMNS.has(name2))continue;if(row[name2]!==void 0)continue;if(!(col8.notNull===!0&&col8.default===void 0&&!col8.defaultRaw&&!col8.nullable))continue;if(TEXTUAL_TYPES.has(String(col8.type)))row[name2]=value2;else unfillable.push(name2)}return unfillable.length>0?{ok:!1,unfillable}:{ok:!0,row}}var SYSTEM_COLUMNS=new Set(["id","createdAt","updatedAt","createdBy","updatedBy"]),TEXTUAL_TYPES=new Set(["text","varchar","char"]),camel=(s)=>s.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase());function linkAccount(data,rule,idByValue){let value2=data[rule.matchFrom];if(value2==null)return{};let id=idByValue.get(String(value2).trim());return id?{[rule.idColumn]:id}:{}}function groupDeferred(links){let groups=new Map;for(let link of links){let key2=`${link.writeIdTo}|${link.lookupColumn}|${link.matchColumn}`,group=groups.get(key2)??{writeIdTo:link.writeIdTo,lookupColumn:link.lookupColumn,matchColumn:link.matchColumn,links:[]};group.links.push(link),groups.set(key2,group)}return[...groups.values()]}async function applyWrites(deps,input){let{ops,targetEntity,userId}=input,scope=input.scopeConditions??[],writeIssues=[],cancelled=()=>input.isCancelled?.()===!0,invalid=validateAll(ops,deps.columns,deps.validatePayload);if(invalid.length>0)return{ok:!1,failure:{kind:"validation_failed",message:`${invalid.length} record(s) did not pass validation; nothing was written.`,issues:invalid}};let refGroups=new Map;for(let insert of ops.referenceInserts){let resolved=deps.resolveEntity?.(insert.entity);if(!resolved)return{ok:!1,failure:{kind:"write_failed",message:`This mapping would add \u201C${insert.value}\u201D to "${insert.entity}", which does not exist.`}};let built=referenceRow(resolved.columns,insert.column,insert.value,insert.data);if(!built.ok)return{ok:!1,failure:{kind:"write_failed",message:`\u201C${insert.value}\u201D cannot be added to "${insert.entity}" automatically: ${built.unfillable.join(", ")} is required and cannot be filled from a ${insert.column}. Add the missing ${insert.entity} by hand, or set this reference to leave those records out.`}};let group=refGroups.get(insert.entity)??{table:resolved.table,rows:[]};group.rows.push(built.row),refGroups.set(insert.entity,group)}let accountRule=input.account??null,accountEntity=ops.accountInserts[0]?.entity,accountTable=accountEntity?deps.resolveEntity?.(accountEntity):null;if(ops.accountInserts.length>0&&(!accountRule||!accountTable))return{ok:!1,failure:{kind:"write_failed",message:accountRule?`This import creates accounts in "${accountEntity}", which does not exist.`:"This import creates accounts but no password was supplied, so nothing was written."}};if(cancelled())return{ok:!1,failure:{kind:"cancelled",message:"Cancelled before writing."}};let idCol=deps.resolveCol("id");if(!idCol)return{ok:!1,failure:{kind:"write_failed",message:`Target "${targetEntity}" has no id column; the engine cannot address its rows.`}};let preImages=[],now=new Date,deactivating=ops.deactivates.length>0&&input.missingColumn&&input.missingValue!=null?{column:input.missingColumn,value:input.missingValue}:null;try{let linksMade=0,linksUnresolved=0;return{ok:!0,...await deps.db.transaction(async(tx)=>{let created=0,accountsCreated=0,referencesCreated=0,updated=0,deleted=0,deactivated=0,accountsClosed=0;if(ops.deletes.length>0){let ids=ops.deletes.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and20(inArray14(idCol,chunk),...scope):inArray14(idCol,chunk),removed=await tx.delete(deps.drizzleTable).where(where).returning();deleted+=removed.length;for(let row of removed)preImages.push({targetEntity,rowId:String(row.id),action:"delete",before:row,after:null})}}for(let op of ops.updates){if(cancelled())throw new CancelledError;let where=scope.length?and20(eq34(idCol,op.id),...scope):eq34(idCol,op.id),written=await tx.update(deps.drizzleTable).set({...op.data,updatedAt:now,updatedBy:userId}).where(where).returning();if(written.length===0)throw new ScopeError(op.id);updated+=written.length,preImages.push({targetEntity,rowId:op.id,action:"update",before:op.before,after:written[0]??null})}if(deactivating){let ids=ops.deactivates.map((r)=>r.id);for(let i=0;i<ids.length;i+=DELETE_CHUNK){if(cancelled())throw new CancelledError;let chunk=ids.slice(i,i+DELETE_CHUNK),where=scope.length?and20(inArray14(idCol,chunk),...scope):inArray14(idCol,chunk),written=await tx.update(deps.drizzleTable).set({[deactivating.column]:deactivating.value,updatedAt:now,updatedBy:userId}).where(where).returning();deactivated+=written.length;let beforeById=new Map(ops.deactivates.map((r)=>[r.id,r.row]));for(let row of written){let id=String(row.id);preImages.push({targetEntity,rowId:id,action:"deactivate",before:beforeById.get(id)??null,after:row})}}}if(deps.accountClosure){let written=new Set(preImages.filter((image)=>image.action==="delete"||image.action==="deactivate").map((image)=>image.rowId)),removedRows=ops.departures.filter((row)=>written.has(row.id)).map((row)=>row.row),leaverIds=accountIdsIn(removedRows,deps.accountClosure.userColumn);if(leaverIds.length>0){let closed=await closeAccounts({db:tx,usersTable:deps.accountClosure.usersTable,sessionsTable:deps.accountClosure.sessionsTable,atomic:!0,onError:(error3)=>{deps.logger.error("[Integrations] A departure\u2019s account stayed open",{error:error3})}},leaverIds);accountsClosed=closed.closed;for(let userId2 of closed.closedIds)preImages.push({targetEntity:deps.accountClosure.accountEntity,rowId:userId2,action:"update",before:{isActive:!0},after:{isActive:!1}});if(closed.closed>0&&!closed.signedOut)writeIssues.push({sourceIndex:-1,kind:"account_sessions_not_cleared",value:String(closed.closed),message:`${closed.closed} account(s) behind removed records were deactivated, but their open sessions could not be cleared \u2014 those people stay signed in until the session expires.`})}}for(let[entity,group]of refGroups){let rows=group.rows.map((r)=>({...r,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(group.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();referencesCreated+=written.length;for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}let accountIdByValue=new Map;if(accountRule&&accountTable&&ops.accountInserts.length>0){let rows=ops.accountInserts.map((account)=>({...account.data,[accountRule.passwordColumn]:accountRule.passwordHash,createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(accountTable.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();accountsCreated+=written.length;for(let row of written){let value2=row[accountRule.matchColumn];if(row.id!=null&&value2!=null)accountIdByValue.set(String(value2).trim(),String(row.id));preImages.push({targetEntity:ops.accountInserts[0]?.entity??"",rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(accountRule&&ops.accountJoinInserts.length>0){let byEntity=new Map;for(let join7 of ops.accountJoinInserts){let accountId=accountIdByValue.get(join7.matchValue);if(!accountId){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`No account was found for \u201C${join7.matchValue}\u201D, so its ${join7.entity} row was not written \u2014 that person can sign in and do nothing.`});continue}let rows=byEntity.get(join7.entity)??[];rows.push({...join7.values,[join7.accountColumn]:accountId,createdAt:now,updatedAt:now,createdBy:userId}),byEntity.set(join7.entity,rows)}for(let[entity,rows]of byEntity){let resolved=deps.resolveEntity?.(entity);if(!resolved){writeIssues.push({sourceIndex:-1,kind:"account_role_missing",message:`The \u201C${entity}\u201D table is not available here, so ${rows.length} role membership(s) were not written. The accounts exist but hold no role.`});continue}for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let written=await tx.insert(resolved.table).values(rows.slice(i,i+INSERT_CHUNK)).returning();for(let row of written)preImages.push({targetEntity:entity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}}if(ops.creates.length>0){let rows=ops.creates.map((c)=>({...c.data,...accountRule&&c.data[accountRule.idColumn]==null?linkAccount(c.data,accountRule,accountIdByValue):{},createdAt:now,updatedAt:now,createdBy:userId}));for(let i=0;i<rows.length;i+=INSERT_CHUNK){if(cancelled())throw new CancelledError;let chunk=rows.slice(i,i+INSERT_CHUNK),written=await tx.insert(deps.drizzleTable).values(chunk).returning();created+=written.length;for(let row of written)preImages.push({targetEntity,rowId:row.id?String(row.id):null,action:"create",before:null,after:row})}}if(ops.deferredLinks.length>0)for(let group of groupDeferred(ops.deferredLinks)){if(cancelled())throw new CancelledError;let lookupCol=deps.resolveCol(group.lookupColumn),matchCol=deps.resolveCol(group.matchColumn),targetCol=deps.resolveCol(group.writeIdTo);if(!lookupCol||!matchCol||!targetCol){deps.logger.error(`[Integrations] Cannot fill "${group.writeIdTo}": ${[!lookupCol?group.lookupColumn:null,!matchCol?group.matchColumn:null,!targetCol?group.writeIdTo:null].filter(Boolean).join(", ")} is not a column of "${targetEntity}".`);continue}let rows=await tx.select({v:lookupCol,id:idCol}).from(deps.drizzleTable),idByValue={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!idByValue[key2])idByValue[key2]=String(row.id)}let imageByMatch=new Map;for(let image of preImages){let value2=image.after?.[group.matchColumn];if(value2!=null)imageByMatch.set(String(value2).trim(),image)}for(let link of group.links){let resolution=resolveReference(link.raw,idByValue);if(resolution.ids.length===0){linksUnresolved+=1;continue}let value2=link.isList?resolution.ids:resolution.ids[0],where=scope.length?and20(eq34(matchCol,link.matchValue),...scope):eq34(matchCol,link.matchValue);if((await tx.update(deps.drizzleTable).set({[group.writeIdTo]:value2}).where(where).returning()).length===0){linksUnresolved+=1;continue}linksMade+=1;let image=imageByMatch.get(String(link.matchValue).trim());if(image?.after)image.after={...image.after,[group.writeIdTo]:value2}}}return{created,accountsCreated,referencesCreated,updated,deleted,deactivated,accountsClosed,linksMade,linksUnresolved}}),preImages,issues:writeIssues}}catch(error3){if(error3 instanceof CancelledError)return{ok:!1,failure:{kind:"cancelled",message:"Cancelled while writing; the transaction was rolled back and nothing changed."}};if(error3 instanceof ScopeError)return{ok:!1,failure:{kind:"write_failed",message:`Row ${error3.rowId} is outside what this account may write. Nothing was written.`}};return deps.logger.error(`[Integrations] Write transaction failed for "${targetEntity}": ${reasonOf2(error3)}`),{ok:!1,failure:{kind:"write_failed",message:"The database rejected this import; it was rolled back and nothing changed."}}}}function reasonOf2(error3){if(!(error3 instanceof Error))return String(error3);let extra=error3;return[error3.message,extra.detail?`detail: ${String(extra.detail)}`:"",extra.constraint?`constraint: ${String(extra.constraint)}`:"",extra.hint?`hint: ${String(extra.hint)}`:"",extra.code?`code: ${String(extra.code)}`:""].filter(Boolean).join(" \u2014 ")}class CancelledError extends Error{constructor(){super("cancelled");this.name="CancelledError"}}class ScopeError extends Error{rowId;constructor(rowId){super(`row ${rowId} outside scope`);this.rowId=rowId;this.name="ScopeError"}}var DAY_MS=86400000;async function executeRun(context,deps,lock){let{mapping,source}=context,empty={runId:null,status:"failed",failure:null,plan:null,created:0,accountsCreated:0,referencesCreated:0,updated:0,deleted:0,deactivated:0,externalCalls:0,issues:[]},opened=await deps.repo.openRun({mappingId:mapping.id,targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,trigger:context.trigger,userId:context.userId});if(!opened.ok)return{...empty,failure:{kind:"write_failed",message:`Could not open a run record: ${opened.error}`}};let runId=opened.runId;deps.onRunOpened?.(runId);let cancelChecked=0,cancelSeen=!1,isCancelled=()=>{if(cancelSeen)return!0;if(deps.abortSignal?.aborted)return cancelSeen=!0,!0;if(!lock.isHeld())return cancelSeen=!0,!0;return!1},refreshCancelFlag=async()=>{if(cancelChecked++,await deps.repo.isCancelRequested(runId))cancelSeen=!0},progress=(p)=>deps.publishProgress?.({runId,...p}),preImagesStored=!0,finish=async(outcome)=>{let revertible=outcome.status==="succeeded"&&preImagesStored;return await deps.repo.closeRun(runId,{status:outcome.status,totalFetched:outcome.plan?.totalFetched??0,sourceReportedTotal:outcome.plan?.reportedTotal??null,createdCount:outcome.created,accountsCreatedCount:outcome.accountsCreated,referencesCreatedCount:outcome.referencesCreated,updatedCount:outcome.updated,skippedCount:outcome.plan?.toSkip??0,deletedCount:outcome.deleted,deactivatedCount:outcome.deactivated,errorCount:outcome.failure?1:0,externalCallCount:outcome.externalCalls,issues:outcome.issues,errors:outcome.failure?[outcome.failure.message]:[],finishedAt:new Date,preImagesExpireAt:revertible?new Date(Date.now()+(deps.retainPreImagesMs??30*DAY_MS)):null}),progress({phase:"done",message:outcome.failure?.message}),{runId,...outcome}};progress({phase:"fetching"});let nodes=context.endpoints.map((e)=>({id:e.id,paramBindings:e.paramBindings??void 0})),order=planFetchOrder(nodes,[context.rootEndpointId]);if(!order.ok){let failure=order.reason==="cycle"?{kind:"cycle_detected",message:`These endpoints depend on each other in a loop (${order.chain.join(" \u2192 ")}), so there is no correct place to start.`,chain:order.chain}:{kind:"fetch_failed",message:`"${order.requiredBy}" takes a parameter from an endpoint that no longer exists (${order.missing}).`};return finish({...empty,failure,status:"failed"})}let bearerToken=null;if(context.oauth){let token=await getAccessToken(context.oauth,deps.tokenCache,{fetchImpl:deps.fetchImpl});if(!token.ok)return finish({...empty,failure:{kind:"fetch_failed",message:token.error}});bearerToken=token.accessToken}let byId=new Map(context.endpoints.map((e)=>[e.id,e])),parents={},entityValues={},externalCalls=0,rootRecords=[],fetchWarnings=[],reportedTotal2=null;for(let endpointId of order.order){let endpoint=byId.get(endpointId);if(!endpoint)continue;if(await refreshCancelFlag(),isCancelled())return finish({...empty,status:"cancelled",externalCalls,failure:{kind:"cancelled",message:"Cancelled before anything was written."}});for(let key2 of entityValueKeys(endpoint.paramBindings??void 0)){if(entityValues[key2])continue;let[entity,field]=key2.split(".");entityValues[key2]=await deps.repo.readEntityColumn(entity,field)}let collected=await collectEndpoint(source,endpoint,{parents,entityValues},{fetchImpl:deps.fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrentFanout,maxRecords:deps.maxRecordsPerRun,isCancelled,onProgress:(n)=>progress({phase:"fetching",processed:n})});if(externalCalls+=collected.callCount,!collected.ok){let cancelled=isCancelled();return finish({...empty,externalCalls,status:cancelled?"cancelled":"failed",failure:cancelled?{kind:"cancelled",message:"Cancelled before anything was written."}:{kind:"fetch_failed",message:collected.error}})}if(collected.partialFailures?.length)fetchWarnings.push(...collected.partialFailures.map((failure)=>`Could not read part of this source \u2014 ${failure}`));if(parents[endpointId]=collected.records.map((r)=>r.record),endpointId===context.rootEndpointId)rootRecords=collected.records,reportedTotal2=collected.reportedTotal}for(let id of Object.keys(parents))if(!(id===context.rootEndpointId||context.endpoints.some((e)=>parentEndpointIds(e.paramBindings??void 0).includes(id))))delete parents[id];let verdict=destructiveGate({writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,fetched:rootRecords.length,reported:reportedTotal2,partialFailures:fetchWarnings.length,scopedRemoval:Boolean(mapping.removalScopeColumn)});if(!verdict.allowed)return finish({...empty,externalCalls,failure:{kind:verdict.kind,message:fetchWarnings.length?`${verdict.message}
 ${fetchWarnings.join(`
-`)}`:verdict.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"mapping",total:rootRecords.length});let mapped3=buildMappedRecords(rootRecords.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,rootRecords.map((r)=>r.parent));if(await refreshCancelFlag(),isCancelled())return finish({...empty,externalCalls,status:"cancelled",failure:{kind:"cancelled",message:"Cancelled before anything was written."}});let existing=await deps.repo.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>deps.repo.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>deps.repo.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await deps.repo.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,removalScope:removalScopeFor(mapping.removalScopeColumn,mapped3.records),originColumn:mapping.originColumn,originValue:mapping.originValue,requiredFields:deps.repo.requiredFields(mapping.targetEntity),uniqueFields:deps.repo.uniqueFields(mapping.targetEntity),createDefaults:context.createDefaults??{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous)),ops.warnings.unshift(...fetchWarnings);let plan=summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:rootRecords.length,reportedTotal:reportedTotal2,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)}),volume=checkPlanVolume({removing:ops.deletes.length+ops.deactivates.length,existing:existing.length,maxShare:mapping.maxRemovalShare??0});if(!volume.allowed)return finish({...empty,externalCalls,failure:{kind:volume.kind,message:volume.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"writing",total:ops.creates.length+ops.updates.length});let applied=await applyWrites(deps.writer,{ops,targetEntity:mapping.targetEntity,userId:context.userId,account:mapping.accountRule&&context.accountPasswordHash?{idColumn:mapping.accountRule.idColumn,matchColumn:mapping.accountRule.matchColumn,matchFrom:mapping.accountRule.matchFrom,passwordColumn:mapping.accountRule.passwordColumn,passwordHash:context.accountPasswordHash}:null,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,isCancelled});if(!applied.ok){let failureIssues=applied.failure.kind==="validation_failed"?applied.failure.issues:[];return finish({...empty,plan,externalCalls,issues:[...ops.issues,...failureIssues],status:applied.failure.kind==="cancelled"?"cancelled":"failed",failure:applied.failure})}return preImagesStored=await deps.repo.savePreImages(runId,applied.preImages),deps.logger.info("[Integrations] Run finished",{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,cancelChecks:cancelChecked}),finish({...empty,status:"succeeded",plan,failure:null,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,issues:[...ops.issues,...applied.issues,...orphanIssues(applied)]})}function orphanIssues(applied){let note=orphanLinkNote({made:applied.linksMade,unresolved:applied.linksUnresolved});return note?[{sourceIndex:-1,kind:"parent_unresolved",message:note}]:[]}var RANGES=[[0,59],[0,23],[1,31],[1,12],[0,6]],NAMES=["minute","hour","day of month","month","day of week"];function expandField(raw,[min,max]){let values=new Set;for(let part of raw.split(",")){let[spec,stepText]=part.split("/"),step=stepText===void 0?1:Number(stepText);if(!Number.isInteger(step)||step<1)return null;let from,to;if(spec==="*")from=min,to=max;else if(spec?.includes("-")){let[a,b]=spec.split("-").map(Number);if(!Number.isInteger(a)||!Number.isInteger(b))return null;from=a,to=b}else{let one=Number(spec);if(!Number.isInteger(one))return null;from=one,to=stepText===void 0?one:max}if(from<min||to>max||from>to)return null;for(let v=from;v<=to;v+=step)values.add(v)}return values.size>0?values:null}function parseCron2(expression){let parts=expression.trim().split(/\s+/);if(parts.length!==5)return{ok:!1,error:`A schedule has five parts \u2014 minute hour day-of-month month day-of-week \u2014 and this has ${parts.length}. "0 2 * * *" is every night at 02:00.`};let sets2=[];for(let i=0;i<5;i++){let field=expandField(parts[i],RANGES[i]);if(!field)return{ok:!1,error:`The ${NAMES[i]} part ("${parts[i]}") is not something I can read.`};sets2.push(field)}return{ok:!0,fields:{minutes:sets2[0],hours:sets2[1],daysOfMonth:sets2[2],months:sets2[3],daysOfWeek:sets2[4],anyDayOfMonth:parts[2]==="*",anyDayOfWeek:parts[4]==="*"}}}function partsIn2(when,timeZone){let formatter=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",weekday:"short"}),parts={};for(let part of formatter.formatToParts(when))parts[part.type]=part.value;let weekdays=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{year:Number(parts.year),month:Number(parts.month),day:Number(parts.day),hour:Number(parts.hour)%24,minute:Number(parts.minute),weekday:Math.max(0,weekdays.indexOf(parts.weekday??"Sun"))}}function matchesCron(fields,when,timeZone){let at=partsIn2(when,timeZone);if(!fields.minutes.has(at.minute))return!1;if(!fields.hours.has(at.hour))return!1;if(!fields.months.has(at.month))return!1;let dayOfMonthMatches=fields.daysOfMonth.has(at.day),dayOfWeekMatches=fields.daysOfWeek.has(at.weekday);if(fields.anyDayOfMonth&&fields.anyDayOfWeek)return!0;if(fields.anyDayOfMonth)return dayOfWeekMatches;if(fields.anyDayOfWeek)return dayOfMonthMatches;return dayOfMonthMatches||dayOfWeekMatches}var CATCH_UP_MINUTES=1500,MINUTE_MS=60000;function isDue(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{due:!1,error:parsed.error};let zone=input.timeZone?.trim()||"UTC",nowMinute=Math.floor(input.now.getTime()/MINUTE_MS),lookBack=0;if(input.lastRunAt){let lastMinute=Math.floor(input.lastRunAt.getTime()/MINUTE_MS);if(lastMinute>=nowMinute)return{due:!1};lookBack=Math.min(nowMinute-lastMinute-1,CATCH_UP_MINUTES)}try{for(let back=0;back<=lookBack;back++){let at=new Date((nowMinute-back)*MINUTE_MS);if(matchesCron(parsed.fields,at,zone))return{due:!0}}}catch{return{due:!1,error:`"${zone}" is not a timezone this system knows.`}}return{due:!1}}function describeCron(expression,timeZone){let parsed=parseCron2(expression);if(!parsed.ok)return parsed.error;let zone=timeZone?.trim()||"UTC",parts=expression.trim().split(/\s+/),[minute,hour,dayOfMonth,month,dayOfWeek]=parts,everyMinutes=minute?.startsWith("*/")?Number(minute.slice(2)):null;if(everyMinutes&&hour==="*"&&dayOfMonth==="*"&&month==="*"&&dayOfWeek==="*")return`Every ${everyMinutes} minutes.`;let time2=minute!==void 0&&hour!==void 0&&!minute.includes("*")&&!hour.includes("*")?`${hour.padStart(2,"0")}:${minute.padStart(2,"0")}`:null,DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"];if(time2&&dayOfWeek!=="*"&&dayOfMonth==="*")return`Every ${[...parsed.fields.daysOfWeek??[]].map((d)=>DAYS[d]).join(", ")} at ${time2} (${zone}).`;if(time2&&dayOfMonth!=="*")return`On day ${dayOfMonth} of the month at ${time2} (${zone}).`;if(time2)return`Every day at ${time2} (${zone}).`;return`On the schedule "${expression}" (${zone}).`}function nextFireTimes(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{times:[],error:parsed.error};let zone=input.timeZone?.trim()||"UTC",count2=Math.max(1,Math.min(input.count??5,50)),horizon=Math.max(1,Math.min(input.horizonDays??400,400)),times=[],startMinute=Math.floor(input.from.getTime()/MINUTE_MS)+1,limit=horizon*24*60;try{for(let offset=0;offset<limit&&times.length<count2;offset+=1){let when=new Date((startMinute+offset)*MINUTE_MS);if(matchesCron(parsed.fields,when,zone))times.push(when)}}catch{return{times:[],error:`"${zone}" is not a timezone this system knows.`}}return{times}}var MINUTE2=60000;function dueMappings(mappings,now){let due=[],problems=[];for(let mapping of mappings){if(!mapping.scheduleCron?.trim())continue;let answer=isDue({expression:mapping.scheduleCron,timeZone:mapping.scheduleTimezone,now,lastRunAt:mapping.lastRunAt??null});if(answer.error){problems.push({mapping,error:answer.error});continue}if(answer.due)due.push(mapping)}return{due,problems}}function startScheduler(deps){let now=deps.now??(()=>new Date),reported=new Set,stopped=!1,tick=async()=>{if(stopped)return;let mappings;try{mappings=await deps.listScheduled()}catch(error3){deps.logger.error("[Integrations] Could not read the schedules",{error:error3 instanceof Error?error3.message:String(error3)});return}let{due,problems}=dueMappings(mappings,now());for(let problem of problems){let token=`${problem.mapping.id}:${problem.error}`;if(reported.has(token))continue;reported.add(token),deps.logger.error(`[Integrations] "${problem.mapping.name}" has a schedule that cannot run: ${problem.error}`)}for(let mapping of due)try{if(await deps.startRun(mapping.id))deps.logger.info(`[Integrations] Scheduled import started: ${mapping.name}`)}catch(error3){deps.logger.error(`[Integrations] Scheduled import failed to start: ${mapping.name}`,{error:error3 instanceof Error?error3.message:String(error3)})}},timer=setInterval(()=>{tick()},MINUTE2);if(typeof timer==="object"&&timer&&"unref"in timer)timer.unref();return{stop:()=>{stopped=!0,clearInterval(timer)}}}var asObject=(value2)=>value2&&typeof value2==="object"&&!Array.isArray(value2)?value2:null,asArray=(value2)=>Array.isArray(value2)?value2:[],text2=(value2)=>{if(value2==null)return null;let s=String(value2);return s===""?null:s};function buildTransferDocument(input){let{source,endpoints,mappings}=input,nameById=new Map;for(let endpoint of endpoints){let id=text2(endpoint.id),name2=text2(endpoint.name);if(id&&name2)nameById.set(id,name2)}return{version:1,exportedAt:input.exportedAt,secretsExcluded:!0,connection:{name:String(source.name??""),slug:String(source.slug??""),baseUrl:String(source.baseUrl??""),description:text2(source.description),authType:String(source.authType??"none"),authHeaderName:text2(source.authHeaderName),authQueryParam:text2(source.authQueryParam),extraHeaders:asObject(source.extraHeaders),tokenUrl:text2(source.tokenUrl),oauthGrantType:text2(source.oauthGrantType),oauthClientId:text2(source.oauthClientId),oauthUsername:text2(source.oauthUsername),oauthScope:text2(source.oauthScope),oauthClientAuth:text2(source.oauthClientAuth),tlsVerify:source.tlsVerify!==!1,timeoutMs:typeof source.timeoutMs==="number"?source.timeoutMs:null,enabled:source.enabled!==!1},endpoints:endpoints.map((endpoint)=>({name:String(endpoint.name??""),tag:String(endpoint.tag??""),method:String(endpoint.method??"GET"),path:String(endpoint.path??""),description:text2(endpoint.description),queryParams:asObject(endpoint.queryParams),requestBody:asObject(endpoint.requestBody),responseRootPath:text2(endpoint.responseRootPath),treeChildrenPath:text2(endpoint.treeChildrenPath),pagination:asObject(endpoint.pagination),paramBindings:asArray(endpoint.paramBindings).map((binding)=>{if(binding.from!=="endpoint")return{...binding};let{endpointId,...rest3}=binding;return{...rest3,endpointName:nameById.get(String(endpointId))??null}}),enabled:endpoint.enabled!==!1})),mappings:mappings.map((mapping)=>({name:String(mapping.name??""),endpointName:nameById.get(String(mapping.endpointId))??null,targetEntity:String(mapping.targetEntity??""),fieldMappings:asArray(mapping.fieldMappings),referenceChecks:asArray(mapping.referenceChecks),dedupSourceField:text2(mapping.dedupSourceField),dedupTargetField:text2(mapping.dedupTargetField),writeMode:String(mapping.writeMode??"upsert")??"upsert",missingRecordPolicy:String(mapping.missingRecordPolicy??"ignore")??"ignore",missingRecordColumn:text2(mapping.missingRecordColumn),missingRecordValue:text2(mapping.missingRecordValue),removalScopeColumn:text2(mapping.removalScopeColumn),passwordTargetColumn:text2(mapping.passwordTargetColumn),accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:text2(mapping.scheduleCron),scheduleTimezone:text2(mapping.scheduleTimezone),enabled:mapping.enabled!==!1}))}}function validateTransferDocument(value2){let problems=[],doc=asObject(value2);if(!doc)return{ok:!1,document:null,problems:[{path:"",message:"This is not an integration export file."}]};if(typeof doc.version!=="number")problems.push({path:"version",message:"The file does not say which format it is in."});else if(doc.version>1)problems.push({path:"version",message:`This file was written by a newer version (${doc.version}); this one understands up to 1.`});let connection=asObject(doc.connection);if(!connection)problems.push({path:"connection",message:"The file has no connection."});else{if(!text2(connection.name))problems.push({path:"connection.name",message:"Missing name."});if(!text2(connection.slug))problems.push({path:"connection.slug",message:"Missing slug."});if(!text2(connection.baseUrl))problems.push({path:"connection.baseUrl",message:"Missing base URL."})}let endpoints=asArray(doc.endpoints),endpointNames=new Set;return endpoints.forEach((endpoint,index)=>{let name2=text2(endpoint.name);if(!name2){problems.push({path:`endpoints[${index}].name`,message:"Missing name."});return}if(endpointNames.has(name2))problems.push({path:`endpoints[${index}].name`,message:`Two endpoints are called "${name2}"; names are how the rest of the file refers to them.`});if(endpointNames.add(name2),!text2(endpoint.path))problems.push({path:`endpoints[${index}].path`,message:"Missing path."});if(!text2(endpoint.tag))problems.push({path:`endpoints[${index}].tag`,message:"Missing tag."})}),endpoints.forEach((endpoint,index)=>{asArray(endpoint.paramBindings).forEach((binding,bindingIndex)=>{if(binding.from!=="endpoint")return;let target2=text2(binding.endpointName);if(!target2||!endpointNames.has(target2))problems.push({path:`endpoints[${index}].paramBindings[${bindingIndex}]`,message:`Takes its value from an endpoint called "${target2??"?"}", which is not in this file.`})})}),asArray(doc.mappings).forEach((mapping,index)=>{if(!text2(mapping.name))problems.push({path:`mappings[${index}].name`,message:"Missing name."});if(!text2(mapping.targetEntity))problems.push({path:`mappings[${index}].targetEntity`,message:"Missing target table."});let endpointName=text2(mapping.endpointName);if(!endpointName||!endpointNames.has(endpointName))problems.push({path:`mappings[${index}].endpointName`,message:`Reads from an endpoint called "${endpointName??"?"}", which is not in this file.`})}),{ok:problems.length===0,document:problems.length===0?doc:null,problems}}init_crypto();init_routeCollector();init_utils5();init_utils6();init_godminGuard();init_esm3();init_utils5();async function testConnection(chain,tokenCache,deps={}){let{source,oauth}=chain,fetchImpl=deps.fetchImpl;if(oauth){tokenCache.invalidate(source.id);let token=await getAccessToken(oauth,tokenCache,{fetchImpl});return token.ok?{ok:!0,detail:`A token was issued (${token.accessToken.length} characters). The credentials and token address are valid.`}:{ok:!1,error:token.error}}let built=buildUrl(source.baseUrl,"");if(!built.ok)return{ok:!1,error:built.error};let{headers}=applyAuth(source,built.url),outcome=await fetchOnce(source,{method:"GET",url:built.url,headers},{fetchImpl});if(outcome.status===0)return{ok:!1,error:outcome.error};return{ok:outcome.status<500,detail:`The address answered: HTTP ${outcome.status}.`,error:outcome.status>=500?outcome.error:void 0}}var PREVIEW_LIMIT=1500;async function sampleEndpoint(source,endpoint,pathParams,tokenCache,oauth,deps={}){let fetchImpl=deps.fetchImpl,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return blank({error:token.error});bearerToken=token.accessToken}let values={...endpoint.queryParams??{},...pathParams??{}},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return blank({error:`This endpoint needs a value for ${resolved.missing.map((m)=>`{${m}}`).join(", ")}. Enter an example value to test it (e.g. ${resolved.missing[0]} = 12345).`});let query={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;query[key2]=value2}let built=buildUrl(source.baseUrl,resolved.path,query);if(!built.ok)return blank({error:built.error});let{headers}=applyAuth({...source,token:bearerToken??source.token},built.url);if(bearerToken)headers.Authorization=`Bearer ${bearerToken}`;let outcome=await fetchOnce(source,{method:endpoint.method,url:built.url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl}),bodyKeys=outcome.body&&typeof outcome.body==="object"&&!Array.isArray(outcome.body)?Object.keys(outcome.body).slice(0,40):[];if(!outcome.ok)return blank({status:outcome.status,error:outcome.error??`HTTP ${outcome.status}`,bodyKeys,bodyPreview:previewBody(outcome.body)});let childrenPath=treeChildrenPath(endpoint.treeChildrenPath),extracted=extractRecords(outcome.body,endpoint.responseRootPath),flattened=childrenPath?flattenTree(extracted,childrenPath):null;if(flattened?.truncated)return blank({status:outcome.status,error:"This source answered with a structure that nests into itself, so it cannot be walked. Check the field named as the children.",bodyKeys,bodyPreview:previewBody(outcome.body)});let records=flattened?flattened.records:extracted;return{ok:!0,status:outcome.status,error:records.length===0?bodyKeys.length>0?`No record array was found. The response's top-level keys are: ${bodyKeys.join(", ")} \u2014 set the response root path to whichever holds the list.`:"No record array was found in the response.":null,recordCount:records.length,sample:records.slice(0,5),fields:records.length>0?flattenKeys(records[0]):[],bodyKeys,bodyPreview:previewBody(outcome.body)}}function blank(over){return{ok:!1,status:0,error:null,recordCount:0,sample:[],fields:[],bodyKeys:[],bodyPreview:null,...over}}function previewBody(body){if(body==null)return null;try{let text3=typeof body==="string"?body:JSON.stringify(body);return text3.length>PREVIEW_LIMIT?`${text3.slice(0,PREVIEW_LIMIT)}\u2026`:text3}catch{return null}}async function previewRun(chain,tokenCache,lookups,deps={}){let fetchImpl=deps.fetchImpl,{mapping,source,oauth}=chain,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return{ok:!1,error:token.error};bearerToken=token.accessToken}let root=chain.endpoints.find((e)=>e.id===chain.rootEndpointId);if(!root)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};let parents={},entityValues={},externalCalls=0;for(let binding of root.paramBindings??[]){if(binding.from==="endpoint"&&!parents[binding.endpointId]){let parentSpec=chain.endpoints.find((e)=>e.id===binding.endpointId);if(!parentSpec)continue;let collected2=await collectEndpoint(source,parentSpec,{},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected2.callCount,!collected2.ok)return{ok:!1,error:collected2.error};parents[binding.endpointId]=collected2.records.map((r)=>r.record)}if(binding.from==="entity"){let key2=`${binding.entity}.${binding.field}`;if(!entityValues[key2])entityValues[key2]=await lookups.readEntityColumn(binding.entity,binding.field)}}let collected=await collectEndpoint(source,root,{parents,entityValues},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected.callCount,!collected.ok)return{ok:!1,error:collected.error};let mapped3=buildMappedRecords(collected.records.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,collected.records.map((r)=>r.parent)),existing=await lookups.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>lookups.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>lookups.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await lookups.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,requiredFields:lookups.requiredFields(mapping.targetEntity),uniqueFields:lookups.uniqueFields(mapping.targetEntity),createDefaults:mapping.passwordColumn?{[mapping.passwordColumn]:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"}:{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous));let invalid=lookups.validateRows?.(ops.creates)??[];for(let problem of invalid){let create4=ops.creates.find((c)=>c.sourceIndex===problem.sourceIndex);ops.issues.push({sourceIndex:problem.sourceIndex,kind:"invalid_value",message:problem.message,row:create4?.data})}if(invalid.length>0){let refused=new Set(invalid.map((problem)=>problem.sourceIndex));ops.creates=ops.creates.filter((create4)=>!refused.has(create4.sourceIndex))}return{ok:!0,externalCalls,plan:summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:collected.records.length,reportedTotal:collected.reportedTotal,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)})}}init_crypto();import{and as and21,eq as eq35,inArray as inArray15}from"drizzle-orm";var camel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function tableFor(deps,entity){return deps.schemaTables[camel2(entity)]??null}var col8=(table,field)=>table?.[field]??table?.[camel2(field)];function open(deps,envelope,where){if(typeof envelope!=="string"||envelope==="")return"";let key2=deps.getEncryptionKey();if(!key2)return deps.logger.error("[Integrations] A stored credential cannot be read: no encryption key",{column:where}),"";try{return decryptSecret(envelope,key2)}catch{return deps.logger.error("[Integrations] A stored credential could not be decrypted \u2014 the encryption key has changed since it was saved. Re-enter it in the panel.",{column:where}),""}}async function resolveChain(deps,mappingId){let mappings=tableFor(deps,"integration_mappings"),endpoints=tableFor(deps,"integration_endpoints"),sources=tableFor(deps,"integration_sources");if(!mappings||!endpoints||!sources)return{ok:!1,error:"The integration tables are not present in this schema."};let[mappingRow]=await deps.db.select().from(mappings).where(eq35(col8(mappings,"id"),mappingId)).limit(1);if(!mappingRow)return{ok:!1,error:"This mapping no longer exists."};let row=mappingRow,[endpointRow]=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"id"),String(row.endpointId))).limit(1);if(!endpointRow)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};if(endpointRow.enabled===!1)return{ok:!1,error:"The call this mapping reads is switched off."};if(row.enabled===!1)return{ok:!1,error:"This mapping is switched off."};let sourceId=String(endpointRow.sourceId),siblingRows=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"The source this mapping reads no longer exists."};let s=sourceRow;if(s.enabled===!1)return{ok:!1,error:"This source is switched off."};let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{ok:!0,chain:{mapping:toMappingSpec(row),endpoints:siblingRows.map((e)=>toEndpointSpec(e)),rootEndpointId:String(endpointRow.id),source,oauth}}}async function resolveEndpointContext(deps,by){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints");if(!sources||!endpoints)return{ok:!1,error:"The integration tables are not present in this schema."};let endpointRow=null,sourceId=by.sourceId;if(by.endpointId){let[row]=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"id"),by.endpointId)).limit(1);if(!row)return{ok:!1,error:"This endpoint no longer exists."};endpointRow=row,sourceId=String(endpointRow.sourceId)}if(!sourceId)return{ok:!1,error:"No source was named."};let[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"This source no longer exists."};let{source,oauth}=toConnection(deps,sourceRow);return{ok:!0,context:{source,oauth,endpoint:endpointRow?toEndpointSpec(endpointRow):null}}}async function cacheEndpointSample(deps,endpointId,records){let endpoints=tableFor(deps,"integration_endpoints");if(!endpoints||records.length===0)return;try{await deps.db.update(endpoints).set({sampleResponse:{records:records.slice(0,3)},updatedAt:new Date}).where(eq35(col8(endpoints,"id"),endpointId))}catch(error3){deps.logger.warn("[Integrations] Could not cache the endpoint sample",{endpointId,error:error3 instanceof Error?error3.message:String(error3)})}}function toConnection(deps,s){let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{source,oauth}}function toMappingSpec(row){return{id:String(row.id),name:String(row.name??""),targetEntity:String(row.targetEntity??""),fieldMappings:Array.isArray(row.fieldMappings)?row.fieldMappings:[],references:Array.isArray(row.referenceChecks)?row.referenceChecks:[],dedupTargetField:row.dedupTargetField||null,writeMode:String(row.writeMode??"upsert")??"upsert",missingPolicy:String(row.missingRecordPolicy??"ignore")??"ignore",missingColumn:row.missingRecordColumn??null,removalScopeColumn:row.removalScopeColumn||null,missingValue:row.missingRecordValue??null,originColumn:row.originColumn??null,originValue:row.originValue??null,maxRemovalShare:Number(row.maxRemovalShare??0)||0,passwordColumn:row.passwordTargetColumn||null,accountRule:row.accountRule??null}}function toEndpointSpec(row){let pagination=row.pagination;return{id:String(row.id),method:String(row.method??"GET"),path:String(row.path??""),queryParams:row.queryParams??null,requestBody:row.requestBody??null,responseRootPath:row.responseRootPath||null,treeChildrenPath:row.treeChildrenPath||null,pagination:pagination&&typeof pagination==="object"&&"kind"in pagination?pagination:{kind:"none"},paramBindings:Array.isArray(row.paramBindings)?row.paramBindings:null}}async function readConnectionBundle(deps,sourceId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return null;let[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return null;let endpointRows=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),ids=new Set(endpointRows.map((row)=>String(row.id))),allMappings=await deps.db.select().from(mappings);return{source:sourceRow,endpoints:endpointRows,mappings:allMappings.filter((row)=>ids.has(String(row.endpointId)))}}async function applyTransferDocument(deps,document,userId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return{ok:!1,error:"The integration tables are not present in this schema."};return deps.db.transaction(async(tx)=>{let now=new Date,c=document.connection,connectionValues={name:c.name,slug:c.slug,baseUrl:c.baseUrl,description:c.description??null,authType:c.authType,authHeaderName:c.authHeaderName??null,authQueryParam:c.authQueryParam??null,extraHeaders:c.extraHeaders??null,tokenUrl:c.tokenUrl??null,oauthGrantType:c.oauthGrantType??null,oauthClientId:c.oauthClientId??null,oauthUsername:c.oauthUsername??null,oauthScope:c.oauthScope??null,oauthClientAuth:c.oauthClientAuth??null,tlsVerify:c.tlsVerify!==!1,timeoutMs:c.timeoutMs??null,enabled:c.enabled!==!1,updatedAt:now,updatedBy:userId},[existingSource]=await tx.select().from(sources).where(eq35(col8(sources,"slug"),c.slug)).limit(1),sourceId,created=!1;if(existingSource)sourceId=String(existingSource.id),await tx.update(sources).set(connectionValues).where(eq35(col8(sources,"id"),sourceId));else{let[row]=await tx.insert(sources).values({...connectionValues,createdAt:now,createdBy:userId}).returning();if(!row?.id)return{ok:!1,error:"The connection could not be created."};sourceId=String(row.id),created=!0}let existingEndpoints=await tx.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),endpointIdByName=new Map;for(let row of existingEndpoints)endpointIdByName.set(String(row.name),String(row.id));for(let endpoint of document.endpoints){let values={sourceId,name:endpoint.name,tag:endpoint.tag,method:endpoint.method,path:endpoint.path,description:endpoint.description??null,queryParams:endpoint.queryParams??null,requestBody:endpoint.requestBody??null,responseRootPath:endpoint.responseRootPath??null,treeChildrenPath:endpoint.treeChildrenPath??null,pagination:endpoint.pagination??null,enabled:endpoint.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=endpointIdByName.get(endpoint.name);if(existingId)await tx.update(endpoints).set(values).where(eq35(col8(endpoints,"id"),existingId));else{let[row]=await tx.insert(endpoints).values({...values,paramBindings:[],createdAt:now,createdBy:userId}).returning();if(row?.id)endpointIdByName.set(endpoint.name,String(row.id))}}for(let endpoint of document.endpoints){let id=endpointIdByName.get(endpoint.name);if(!id)continue;let bindings=(endpoint.paramBindings??[]).map((binding)=>{if(binding.from!=="endpoint")return binding;let{endpointName,...rest3}=binding;return{...rest3,endpointId:endpointIdByName.get(String(endpointName))??""}});await tx.update(endpoints).set({paramBindings:bindings,updatedAt:now}).where(eq35(col8(endpoints,"id"),id))}let allMappings=await tx.select().from(mappings),ownIds=new Set(endpointIdByName.values()),mappingIdByName=new Map;for(let row of allMappings)if(ownIds.has(String(row.endpointId)))mappingIdByName.set(String(row.name),String(row.id));let mappingCount=0;for(let mapping of document.mappings){let endpointId=mapping.endpointName?endpointIdByName.get(mapping.endpointName):void 0;if(!endpointId)continue;let values={endpointId,name:mapping.name,targetEntity:mapping.targetEntity,fieldMappings:mapping.fieldMappings??[],referenceChecks:mapping.referenceChecks??[],dedupSourceField:mapping.dedupSourceField??null,dedupTargetField:mapping.dedupTargetField??null,writeMode:mapping.writeMode,missingRecordPolicy:mapping.missingRecordPolicy,missingRecordColumn:mapping.missingRecordColumn??null,missingRecordValue:mapping.missingRecordValue??null,removalScopeColumn:mapping.removalScopeColumn??null,passwordTargetColumn:mapping.passwordTargetColumn??null,accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:mapping.scheduleCron??null,scheduleTimezone:mapping.scheduleTimezone??null,enabled:mapping.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=mappingIdByName.get(mapping.name);if(existingId)await tx.update(mappings).set(values).where(eq35(col8(mappings,"id"),existingId));else await tx.insert(mappings).values({...values,createdAt:now,createdBy:userId});mappingCount++}return{ok:!0,sourceId,created,endpoints:endpointIdByName.size,mappings:mappingCount}})}async function readScheduledMappings(deps){let mappings=tableFor(deps,"integration_mappings");if(!mappings)return[];return(await deps.db.select().from(mappings)).filter((row)=>row.scheduleEnabled===!0&&row.enabled!==!1).filter((row)=>typeof row.scheduleCron==="string"&&row.scheduleCron.trim()!=="").map((row)=>({id:String(row.id),name:String(row.name??""),scheduleCron:String(row.scheduleCron),scheduleTimezone:row.scheduleTimezone??null,lastRunAt:row.lastRunAt?new Date(row.lastRunAt):null,needsPassword:Boolean(row.passwordTargetColumn)||row.accountRule!=null}))}function requiredFieldsOf(entities,targetEntity){return(entities.find((e)=>e.table_name===targetEntity)?.columns??[]).filter((c)=>c.notNull===!0&&c.default===void 0&&!c.defaultRaw&&!c.nullable).map((c)=>camel2(c.name))}function uniqueFieldsOf(entities,targetEntity){let entity=entities.find((e)=>e.table_name===targetEntity),columns=entity?.columns??[],fields=new Set;for(let column of columns)if(column.unique===!0||column.primaryKey===!0)fields.add(camel2(column.name));for(let index of entity?.indexes??[])if(index.unique===!0&&index.columns.length===1&&index.columns[0])fields.add(camel2(index.columns[0]));return fields.delete("id"),[...fields]}function createRunRepository(deps,entities){let runs=()=>tableFor(deps,"integration_runs"),runItems=()=>tableFor(deps,"integration_run_items");return{async openRun(input){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let id=(await deps.db.insert(table).values({mappingId:input.mappingId,targetEntity:input.targetEntity,writeMode:input.writeMode,trigger:input.trigger,status:"running",startedAt:new Date,createdBy:input.userId??null}).returning())[0]?.id;return id?{ok:!0,runId:String(id)}:{ok:!1,error:"The run record was created but returned no identifier."}}catch(error3){return{ok:!1,error:error3 instanceof Error?error3.message:String(error3)}}},async closeRun(runId,patch){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let mappingId=(await deps.db.update(table).set({...patch,updatedAt:new Date}).where(eq35(col8(table,"id"),runId)).returning())[0]?.mappingId,finishedAt=patch.finishedAt,mappings=tableFor(deps,"integration_mappings");if(mappings&&mappingId&&finishedAt)await deps.db.update(mappings).set({lastRunAt:finishedAt,updatedAt:new Date}).where(eq35(col8(mappings,"id"),String(mappingId)));return{ok:!0}}catch(error3){return deps.logger.error("[Integrations] Could not close the run record",{runId,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,error:"Could not write the run record."}}},async savePreImages(runId,images){let table=runItems();if(!table)return!1;if(images.length===0)return!0;let CHUNK2=500;try{return await deps.db.transaction(async(tx)=>{for(let i=0;i<images.length;i+=CHUNK2)await tx.insert(table).values(images.slice(i,i+CHUNK2).map((image)=>({runId,targetEntity:image.targetEntity,rowId:image.rowId,action:image.action,before:image.before,after:image.after})))}),!0}catch(error3){return deps.logger.error("[Integrations] The run succeeded but its before-images could not be stored; it cannot be undone",{runId,error:error3 instanceof Error?error3.message:String(error3)}),!1}},async isCancelRequested(runId){let table=runs();if(!table)return!1;try{let[row]=await deps.db.select().from(table).where(eq35(col8(table,"id"),runId)).limit(1);return row?.cancelRequested===!0}catch{return!1}},async readExistingRows(targetEntity){let table=tableFor(deps,targetEntity);if(!table)return[];return(await deps.db.select().from(table)).map((row)=>({id:String(row.id),row}))},async readEntityColumn(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0;if(!table||!column)return[];return(await deps.db.selectDistinct({v:column}).from(table)).map((r)=>r.v).filter((v)=>v!=null&&v!=="")},async readEntityIdsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return{};let rows=await deps.db.select({v:column,id:idColumn}).from(table),map3={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!map3[key2])map3[key2]=String(row.id)}return map3},async readEntityPairsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return[];return await deps.db.select({value:column,id:idColumn}).from(table)},requiredFields:(targetEntity)=>requiredFieldsOf(entities,targetEntity),uniqueFields:(targetEntity)=>uniqueFieldsOf(entities,targetEntity)}}async function readRowsById(deps,targetEntity,ids){let table=tableFor(deps,targetEntity),result=new Map;if(!table||ids.length===0)return result;let CHUNK2=1000;for(let i=0;i<ids.length;i+=CHUNK2){let rows=await deps.db.select().from(table).where(inArray15(col8(table,"id"),ids.slice(i,i+CHUNK2)));for(let row of rows)result.set(String(row.id),row)}return result}async function readPreImages(deps,runId){let table=tableFor(deps,"integration_run_items");if(!table)return[];return(await deps.db.select().from(table).where(eq35(col8(table,"runId"),runId))).map((row)=>({targetEntity:String(row.targetEntity),rowId:row.rowId?String(row.rowId):null,action:String(row.action),before:row.before??null,after:row.after??null}))}async function readRun(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return null;let[row]=await deps.db.select().from(table).where(eq35(col8(table,"id"),runId)).limit(1);return row??null}async function requestCancel(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return!1;return(await deps.db.update(table).set({cancelRequested:!0,updatedAt:new Date}).where(and21(eq35(col8(table,"id"),runId),eq35(col8(table,"status"),"running"))).returning()).length>0}var fail3=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createInspectRoutes(routeConfig,deps,tokenCache){let settings=routeConfig.resolvedOptions.integrations??{};return[defineRoute({method:"POST",path:"/sources/:id/test",detail:{tags:["Integrations"],summary:"Check a source is reachable and its credentials are accepted"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{sourceId:params.id});if(!context.ok)return fail3(set2,404,context.error);let result=await testConnection(context.context,tokenCache);return{isSuccess:result.ok,message:result.ok?result.detail??"Connected.":result.error??"Could not connect.",data:result}}}),defineRoute({method:"POST",path:"/endpoints/:id/sample",body:Type.Optional(Type.Object({pathParams:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})),detail:{tags:["Integrations"],summary:"Call one endpoint once and report its real shape"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{endpointId:params.id});if(!context.ok)return fail3(set2,404,context.error);let{source,oauth,endpoint}=context.context;if(!endpoint)return fail3(set2,404,"This endpoint no longer exists.");let result=await sampleEndpoint(source,endpoint,body?.pathParams,tokenCache,oauth);if(result.ok&&result.sample.length>0)await cacheEndpointSample(repoDeps,params.id,result.sample);return{isSuccess:result.ok,message:result.error??"Sampled.",data:result}}}),defineRoute({method:"POST",path:"/preview",body:Type.Object({mappingId:Type.String()}),detail:{tags:["Integrations"],summary:"Dry-run an import: counts, warnings and a sample, with no writes"},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let repo=createRunRepository(repoDeps,repoDeps.entities),result=await previewRun(chain.chain,tokenCache,{readExistingRows:repo.readExistingRows,readEntityColumn:repo.readEntityColumn,requiredFields:repo.requiredFields,uniqueFields:repo.uniqueFields,readEntityIdsBy:repo.readEntityIdsBy,readEntityPairsBy:repo.readEntityPairsBy,validateRows:(rows)=>{let columns=repoDeps.entities.find((e)=>e.table_name===chain.chain.mapping.targetEntity)?.columns??[],problems=[];for(let row of rows){let result2=validatePayload(row.data,columns,!1);if(!result2.valid)problems.push({sourceIndex:row.sourceIndex,message:result2.errors.map((e)=>`${e.field}: ${e.message}`).join("; ")})}return problems}},{maxRecords:settings.maxRecordsPerRun,maxConcurrent:settings.maxConcurrentFanout});if(!result.ok)return fail3(set2,422,result.error);return{isSuccess:!0,message:"Nothing was written.",data:{plan:result.plan,externalCalls:result.externalCalls}}}}),defineRoute({method:"POST",path:"/schedule-check",body:Type.Object({mappingId:Type.String(),at:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Simulate the schedule: the next firings, and whether a given moment is one",description:"Writes nothing and starts nothing. Answers the question a schedule cannot otherwise be asked until the night it runs: does this expression name the minute I meant, in the clock I meant."},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let raw=chain.chain.mapping,expression=String(raw.scheduleCron??"").trim(),timeZone=String(raw.scheduleTimezone??"").trim()||"UTC";if(expression==="")return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression:"",timeZone,times:[]}};let at=body.at?new Date(body.at):new Date;if(Number.isNaN(at.getTime()))return fail3(set2,400,"That is not a moment I can read.");let upcoming=nextFireTimes({expression,timeZone,from:at,count:5}),verdict=isDue({expression,timeZone,now:at,lastRunAt:null});return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression,timeZone,describes:describeCron(expression,timeZone),at:at.toISOString(),wouldFireAtThatMoment:verdict.due,error:verdict.error??upcoming.error??null,times:upcoming.times.map((t)=>t.toISOString())}}}})]}var fail4=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};async function closeAbandonedRuns(repoDeps,mappingId,logger2){try{let runsTable=tableFor(repoDeps,"integration_runs");if(!runsTable)return;let{and:and22,eq:eq36,inArray:inArray16}=await import("drizzle-orm"),closed=await repoDeps.db.update(runsTable).set({status:"failed",finishedAt:new Date,errors:["This import stopped without finishing \u2014 the process running it went away (a restart, a deploy, or a crash). Whatever it had already written is still there; run it again, or check the target table."],updatedAt:new Date}).where(and22(eq36(runsTable.mappingId,mappingId),inArray16(runsTable.status,["running","queued"]))).returning();if(closed.length>0)logger2.warn(`[Integrations] ${closed.length} run(s) of this mapping were left open by a process that went away; marked as failed.`)}catch(error3){logger2.error("[Integrations] Could not close abandoned runs",error3)}}var tokenCache=new TokenCache;function createIntegrationRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,resolvedOptions,getEncryptionKey,getLockStore,publish}=routeConfig,entities=resolveEntities(SYSTEM_TABLES,resolvedOptions.entities??[],{consumerMode:resolvedOptions.authentication?.mode==="consumer"}).entities,settings=resolvedOptions.integrations??{},topicPrefix=settings.realtimeTopicPrefix||"integrations",guard4=createGodminGuard({logger:logger2,db,schemaTables,area:"data integrations",allowedRoles:routeConfig.adminRoles??settings.adminRoles}),deps=()=>db?{db,schemaTables,entities,logger:logger2,getEncryptionKey}:null,inspectRoutes=createInspectRoutes(routeConfig,deps,tokenCache),writerFor=(repoDeps,targetEntity)=>{let table=tableFor(repoDeps,targetEntity);if(!table)return null;let entity=entities.find((e)=>e.table_name===targetEntity);return{db:repoDeps.db,drizzleTable:table,resolveCol:(field)=>table[field]??table[field.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase())],columns:entity?.columns??[],logger:logger2,validatePayload,resolveEntity:(name2)=>{let refTable=tableFor(repoDeps,name2);if(!refTable)return null;let refEntity=entities.find((e)=>e.table_name===name2);return{table:refTable,columns:refEntity?.columns??[]}},accountClosure:accountClosureFor(targetEntity)}};function accountClosureFor(targetEntity){let link=accountLinkFor(routeConfig.resolvedOptions.authentication?.accountLinks,targetEntity);if(!link)return null;let usersTable=schemaTables.users;if(!usersTable)return null;let sessionsTable=schemaTables.userSessions??schemaTables.sessions;return{userColumn:link.userColumn,accountEntity:"users",usersTable,sessionsTable:sessionsTable??null}}let routePostRuns=defineRoute({method:"POST",path:"/runs",body:Type.Object({mappingId:Type.String(),confirm:Type.Optional(Type.Boolean()),sharedPassword:Type.Optional(Type.String()),referenceMode:Type.Optional(Type.Union([Type.Literal("create"),Type.Literal("skipRecord")]))}),detail:{tags:["Integrations"],summary:"Start an import; answers 202 with the run identifier"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail4(set2,404,chain.error);let declared2=chain.chain.mapping,answer=body.referenceMode,mapping=answer?{...declared2,references:(declared2.references??[]).map((check)=>check.onMissing==="ignore"?check:{...check,onMissing:answer})}:declared2,wantsPassword=Boolean(mapping.passwordColumn||mapping.accountRule),createDefaults,accountPasswordHash=null;if(wantsPassword){let supplied=typeof body.sharedPassword==="string"?body.sharedPassword:"";if(supplied.length<8)return fail4(set2,422,mapping.accountRule?"This import creates a login for every new record, so it needs a password to create them with: send sharedPassword, at least 8 characters. It is used once, for this run, and is stored nowhere.":`This mapping writes a password into "${mapping.passwordColumn}", so it needs one to write: send sharedPassword, at least 8 characters. It is used for the accounts this run creates and is not stored anywhere.`);let hash=await hashPassword(supplied);if(accountPasswordHash=hash,mapping.passwordColumn)createDefaults={[mapping.passwordColumn]:hash}}if(isDestructive(mapping.writeMode,mapping.missingPolicy)&&body.confirm!==!0)return set2.status=428,{isSuccess:!1,message:mapping.writeMode==="replace"?"This mapping rebuilds the whole table. Send confirm: true to proceed.":mapping.missingPolicy==="deactivate"?"This mapping deactivates records the source no longer carries. Send confirm: true to proceed.":"This mapping deletes records the source no longer carries. Send confirm: true to proceed.",data:null};let lockStore=getLockStore();if(!lockStore)return fail4(set2,503,"The lock service is unavailable, so a second run of this mapping could not be prevented. Runs are refused until it is back.");let lock=await acquireRunLock(lockStore,mapping.id,{logger:logger2});if(!lock.ok){if(lock.reason==="unavailable")return fail4(set2,503,`The lock service is unavailable: ${lock.error}`);return set2.status=409,{isSuccess:!1,message:"This mapping is already importing. Wait for it to finish, or cancel it.",data:{heldSince:lock.heldSince}}}await closeAbandonedRuns(repoDeps,mapping.id,logger2);let writer=writerFor(repoDeps,mapping.targetEntity);if(!writer)return await lock.handle.release(),fail4(set2,422,`This mapping targets "${mapping.targetEntity}", which does not exist.`);let userId=request.headers.get("x-user-id")??"unknown",repo=createRunRepository(repoDeps,entities),announce=()=>{},runIdReady=new Promise((resolve2)=>{announce=resolve2}),started=executeRun({...chain.chain,mapping,userId,trigger:"manual",createDefaults,accountPasswordHash},{repo,writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),onRunOpened:(id)=>announce(id),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle),runId=await Promise.race([runIdReady,started.then((outcome)=>outcome.runId)]);return started.catch(async(error3)=>{let reason=error3 instanceof Error?error3.message:String(error3);logger2.error("[Integrations] Run threw outside its own error handling",{mappingId:mapping.id,error:reason});let openedId=await runIdReady.catch(()=>null);if(openedId)await repo.closeRun(openedId,{status:"failed",finishedAt:new Date,errors:[reason]}).catch(()=>{})}).finally(()=>lock.handle.release()),set2.status=202,{isSuccess:!0,message:"The import has started.",data:{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity}}}}),startScheduledRun=async(mappingId)=>{let repoDeps=deps();if(!repoDeps)return!1;let chain=await resolveChain(repoDeps,mappingId);if(!chain.ok)return logger2.error(`[Integrations] Scheduled import cannot run: ${chain.error}`),!1;let lockStore=getLockStore();if(!lockStore)return!1;let lock=await acquireRunLock(lockStore,mappingId,{logger:logger2});if(!lock.ok)return!1;let writer=writerFor(repoDeps,chain.chain.mapping.targetEntity);if(!writer)return await lock.handle.release(),logger2.error(`[Integrations] Scheduled import targets "${chain.chain.mapping.targetEntity}", which does not exist.`),!1;return executeRun({...chain.chain,userId:null,trigger:"schedule"},{repo:createRunRepository(repoDeps,entities),writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle).then((outcome)=>{if(outcome.status!=="succeeded")logger2.error(`[Integrations] Scheduled import "${chain.chain.mapping.name}" ${outcome.status}: ${outcome.failure?.message??"no reason recorded"}`)}).catch((error3)=>{logger2.error("[Integrations] Scheduled import threw outside its own error handling",{mappingId,error:error3 instanceof Error?error3.message:String(error3)})}).finally(()=>lock.handle.release()),!0},unattendable=new Set;if(settings.schedulesEnabled!==!1)startScheduler({logger:logger2,listScheduled:async()=>{let repoDeps=deps();if(!repoDeps)return[];return(await readScheduledMappings(repoDeps)).filter((row)=>{if(!row.needsPassword)return!0;if(!unattendable.has(row.id))unattendable.add(row.id),logger2.error(`[Integrations] "${row.name}" is scheduled but creates logins, which need a password nobody can type at that hour. It will not run on its own \u2014 start it by hand, or turn the login off.`);return!1})},startRun:(mappingId)=>startScheduledRun(mappingId)});let routeGetSourcesIdExport=defineRoute({method:"GET",path:"/sources/:id/export",detail:{tags:["Integrations"],summary:"Export a connection, its calls and its mappings \u2014 without any secret"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let bundle=await readConnectionBundle(repoDeps,params.id);if(!bundle)return fail4(set2,404,"This connection no longer exists.");let document=buildTransferDocument({...bundle,exportedAt:new Date().toISOString()});return{isSuccess:!0,message:`${document.endpoints.length} call(s) and ${document.mappings.length} mapping(s). Credentials are NOT included \u2014 they are asked for again on the other side.`,data:document}}}),routePostImport=defineRoute({method:"POST",path:"/import",body:Type.Object({document:Type.Unknown()}),detail:{tags:["Integrations"],summary:"Bring in an exported connection; re-running it updates rather than duplicates"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let checked=validateTransferDocument(body?.document);if(!checked.ok||!checked.document)return set2.status=422,{isSuccess:!1,message:"This file cannot be imported as it stands.",data:{problems:checked.problems}};let userId=request.headers.get("x-user-id")??"unknown",result=await applyTransferDocument(repoDeps,checked.document,userId);if(!result.ok)return fail4(set2,422,result.error);return{isSuccess:!0,message:`Connection "${checked.document.connection.name}" is here: ${result.endpoints} call(s) and ${result.mappings} mapping(s). Its credentials are not \u2014 enter them before running anything.`,data:result}}}),routePostRunsIdCancel=defineRoute({method:"POST",path:"/runs/:id/cancel",detail:{tags:["Integrations"],summary:"Ask a running import to stop"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");if(!await requestCancel(repoDeps,params.id))return fail4(set2,409,"This run is not running, so there is nothing to cancel.");return{isSuccess:!0,message:"Cancellation requested. The import stops at its next checkpoint and anything it had written is rolled back.",data:{runId:params.id}}}}),routePostRunsIdRevert=defineRoute({method:"POST",path:"/runs/:id/revert",body:Type.Optional(Type.Object({force:Type.Optional(Type.Boolean())})),detail:{tags:["Integrations"],summary:"Undo a run that succeeded"},handler:async({params,body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let run=await readRun(repoDeps,params.id);if(!run)return fail4(set2,404,"This run no longer exists.");if(run.status!=="succeeded")return fail4(set2,409,`Only a run that finished successfully can be undone; this one is "${String(run.status)}".`);let expiry=run.preImagesExpireAt?new Date(String(run.preImagesExpireAt)):null;if(expiry&&expiry.getTime()<Date.now())return fail4(set2,410,"This run is too old to undo: the records of what it replaced have been cleared.");let targetEntity=String(run.targetEntity??""),preImages=await readPreImages(repoDeps,params.id);if(preImages.length===0)return fail4(set2,410,"There is no record of what this run replaced, so it cannot be undone.");let groups=groupPreImagesByEntity(preImages).sort((a,b)=>a.targetEntity===targetEntity?-1:b.targetEntity===targetEntity?1:0),planned=[];for(let group of groups){let current=await readRowsById(repoDeps,group.targetEntity,touchedRowIds(group.preImages));planned.push({targetEntity:group.targetEntity,ops:planRevert({preImages:group.preImages,current,force:body?.force===!0})})}let ops={deletes:planned.flatMap((p)=>p.ops.deletes),restores:planned.flatMap((p)=>p.ops.restores),reinserts:planned.flatMap((p)=>p.ops.reinserts),conflicts:planned.flatMap((p)=>p.ops.conflicts)};if(ops.deletes.length===0&&ops.restores.length===0&&ops.reinserts.length===0&&ops.conflicts.length>0)return set2.status=409,{isSuccess:!1,message:"Every record this run touched has been edited since. Undoing would discard those edits; send force: true to overwrite them anyway.",data:{conflicts:ops.conflicts}};let userId=request.headers.get("x-user-id")??"unknown";for(let group of planned)if(!writerFor(repoDeps,group.targetEntity))return fail4(set2,422,`"${group.targetEntity}" no longer exists.`);let undone={deleted:0,restored:0,reinserted:0},failure=null;try{await repoDeps.db.transaction(async(tx)=>{for(let group of planned){let groupWriter=writerFor(repoDeps,group.targetEntity),result2=await applyRevert(groupWriter,group.ops,{targetEntity:group.targetEntity,userId,tx});if(!result2.ok)throw failure=result2.error??"The undo could not be completed.",Error(failure);undone={deleted:undone.deleted+(result2.deleted??0),restored:undone.restored+(result2.restored??0),reinserted:undone.reinserted+(result2.reinserted??0)}}})}catch(error3){let message=failure??(error3 instanceof Error?error3.message:"The undo could not be completed.");return fail4(set2,500,`${message} Nothing was undone \u2014 every table was rolled back together.`)}let result={ok:!0,...undone,conflicts:ops.conflicts.length},finished=ops.conflicts.length===0,runsTable=tableFor(repoDeps,"integration_runs");if(runsTable&&finished){let{eq:eq36}=await import("drizzle-orm");await repoDeps.db.update(runsTable).set({status:"reverted",revertedAt:new Date,revertedBy:userId}).where(eq36(runsTable.id,params.id))}return{isSuccess:!0,message:finished?"The import was undone.":`Undone except for ${ops.conflicts.length} record(s) edited since the import. They were left as they are \u2014 send force: true to overwrite them too.`,data:{deleted:result.deleted,restored:result.restored,reinserted:result.reinserted,conflicts:ops.conflicts}}}}),routePutSourcesIdCredentials=defineRoute({method:"PUT",path:"/sources/:id/credentials",body:Type.Object({token:Type.Optional(Type.String()),oauthClientSecret:Type.Optional(Type.String()),oauthPassword:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Store a source credential; only a masked preview is returned"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let key2=getEncryptionKey();if(!key2)return fail4(set2,503,"No encryption key is configured, so a credential stored now could never be read back.");let table=tableFor(repoDeps,"integration_sources");if(!table)return fail4(set2,503,"The integration tables are not present in this schema.");let patch={},hints={},apply=(value2,column,hintColumn,name2)=>{if(value2===void 0)return;let trimmed=value2.trim();if(trimmed===""){patch[column]=null,patch[hintColumn]=null,hints[name2]=null;return}patch[column]=encryptSecret(trimmed,key2),patch[hintColumn]=previewOf(trimmed),hints[name2]=previewOf(trimmed)};if(apply(body.token,"authTokenEncrypted","authTokenHint","token"),apply(body.oauthClientSecret,"oauthClientSecretEncrypted","oauthClientSecretHint","clientSecret"),apply(body.oauthPassword,"oauthPasswordEncrypted","oauthPasswordHint","password"),Object.keys(patch).length===0)return{isSuccess:!0,message:"Nothing to change.",data:{hints}};let{eq:eq36}=await import("drizzle-orm");return await repoDeps.db.update(table).set({...patch,updatedAt:new Date}).where(eq36(table.id,params.id)),tokenCache.invalidate(params.id),{isSuccess:!0,message:"Saved.",data:{hints}}}});logger2.info(`[Integrations] Routes enabled at ${basePath}`);let declared=[routePostRuns,routeGetSourcesIdExport,routePostImport,routePostRunsIdCancel,routePostRunsIdRevert,routePutSourcesIdCredentials,...inspectRoutes];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function parseDuration(value2){if(!value2)return;let match=value2.trim().match(/^(\d+)\s*([smhd])$/i);if(!match)return;let amount=Number(match[1]),unit=(match[2]??"d").toLowerCase();return amount*(unit==="s"?1000:unit==="m"?60000:unit==="h"?3600000:86400000)}init_esm3();init_routeCollector();init_adminGuard();var STREAM_HEADERS={"Content-Type":"text/event-stream; charset=utf-8","Cache-Control":"no-cache, no-transform",Connection:"keep-alive"},textEncoder=new TextEncoder,encodeEvent=(event,data)=>{let payload=typeof data==="string"?data:JSON.stringify(data);return textEncoder.encode(`event: ${event}
+`)}`:verdict.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"mapping",total:rootRecords.length});let mapped3=buildMappedRecords(rootRecords.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,rootRecords.map((r)=>r.parent));if(await refreshCancelFlag(),isCancelled())return finish({...empty,externalCalls,status:"cancelled",failure:{kind:"cancelled",message:"Cancelled before anything was written."}});let existing=await deps.repo.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>deps.repo.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>deps.repo.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await deps.repo.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,removalScope:removalScopeFor(mapping.removalScopeColumn,mapped3.records),originColumn:mapping.originColumn,originValue:mapping.originValue,requiredFields:deps.repo.requiredFields(mapping.targetEntity),uniqueFields:deps.repo.uniqueFields(mapping.targetEntity),createDefaults:context.createDefaults??{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous)),ops.warnings.unshift(...fetchWarnings);let plan=summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:rootRecords.length,reportedTotal:reportedTotal2,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)}),volume=checkPlanVolume({removing:ops.deletes.length+ops.deactivates.length,existing:existing.length,maxShare:mapping.maxRemovalShare??0});if(!volume.allowed)return finish({...empty,externalCalls,failure:{kind:volume.kind,message:volume.message,fetched:rootRecords.length,reported:reportedTotal2??0}});progress({phase:"writing",total:ops.creates.length+ops.updates.length});let applied=await applyWrites(deps.writer,{ops,targetEntity:mapping.targetEntity,userId:context.userId,account:mapping.accountRule&&context.accountPasswordHash?{idColumn:mapping.accountRule.idColumn,matchColumn:mapping.accountRule.matchColumn,matchFrom:mapping.accountRule.matchFrom,passwordColumn:mapping.accountRule.passwordColumn,passwordHash:context.accountPasswordHash}:null,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,isCancelled});if(!applied.ok){let failureIssues=applied.failure.kind==="validation_failed"?applied.failure.issues:[];return finish({...empty,plan,externalCalls,issues:[...ops.issues,...failureIssues],status:applied.failure.kind==="cancelled"?"cancelled":"failed",failure:applied.failure})}return preImagesStored=await deps.repo.savePreImages(runId,applied.preImages),deps.logger.info("[Integrations] Run finished",{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,cancelChecks:cancelChecked}),finish({...empty,status:"succeeded",plan,failure:null,created:applied.created,accountsCreated:applied.accountsCreated,referencesCreated:applied.referencesCreated,updated:applied.updated,deleted:applied.deleted,deactivated:applied.deactivated,externalCalls,issues:[...ops.issues,...applied.issues,...orphanIssues(applied)]})}function orphanIssues(applied){let note=orphanLinkNote({made:applied.linksMade,unresolved:applied.linksUnresolved});return note?[{sourceIndex:-1,kind:"parent_unresolved",message:note}]:[]}var RANGES=[[0,59],[0,23],[1,31],[1,12],[0,6]],NAMES=["minute","hour","day of month","month","day of week"];function expandField(raw,[min,max]){let values=new Set;for(let part of raw.split(",")){let[spec,stepText]=part.split("/"),step=stepText===void 0?1:Number(stepText);if(!Number.isInteger(step)||step<1)return null;let from,to;if(spec==="*")from=min,to=max;else if(spec?.includes("-")){let[a,b]=spec.split("-").map(Number);if(!Number.isInteger(a)||!Number.isInteger(b))return null;from=a,to=b}else{let one=Number(spec);if(!Number.isInteger(one))return null;from=one,to=stepText===void 0?one:max}if(from<min||to>max||from>to)return null;for(let v=from;v<=to;v+=step)values.add(v)}return values.size>0?values:null}function parseCron2(expression){let parts=expression.trim().split(/\s+/);if(parts.length!==5)return{ok:!1,error:`A schedule has five parts \u2014 minute hour day-of-month month day-of-week \u2014 and this has ${parts.length}. "0 2 * * *" is every night at 02:00.`};let sets2=[];for(let i=0;i<5;i++){let field=expandField(parts[i],RANGES[i]);if(!field)return{ok:!1,error:`The ${NAMES[i]} part ("${parts[i]}") is not something I can read.`};sets2.push(field)}return{ok:!0,fields:{minutes:sets2[0],hours:sets2[1],daysOfMonth:sets2[2],months:sets2[3],daysOfWeek:sets2[4],anyDayOfMonth:parts[2]==="*",anyDayOfWeek:parts[4]==="*"}}}function partsIn2(when,timeZone){let formatter=new Intl.DateTimeFormat("en-US",{timeZone,hour12:!1,year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",weekday:"short"}),parts={};for(let part of formatter.formatToParts(when))parts[part.type]=part.value;let weekdays=["Sun","Mon","Tue","Wed","Thu","Fri","Sat"];return{year:Number(parts.year),month:Number(parts.month),day:Number(parts.day),hour:Number(parts.hour)%24,minute:Number(parts.minute),weekday:Math.max(0,weekdays.indexOf(parts.weekday??"Sun"))}}function matchesCron(fields,when,timeZone){let at=partsIn2(when,timeZone);if(!fields.minutes.has(at.minute))return!1;if(!fields.hours.has(at.hour))return!1;if(!fields.months.has(at.month))return!1;let dayOfMonthMatches=fields.daysOfMonth.has(at.day),dayOfWeekMatches=fields.daysOfWeek.has(at.weekday);if(fields.anyDayOfMonth&&fields.anyDayOfWeek)return!0;if(fields.anyDayOfMonth)return dayOfWeekMatches;if(fields.anyDayOfWeek)return dayOfMonthMatches;return dayOfMonthMatches||dayOfWeekMatches}var CATCH_UP_MINUTES=1500,MINUTE_MS=60000;function isDue(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{due:!1,error:parsed.error};let zone=input.timeZone?.trim()||"UTC",nowMinute=Math.floor(input.now.getTime()/MINUTE_MS),lookBack=0;if(input.lastRunAt){let lastMinute=Math.floor(input.lastRunAt.getTime()/MINUTE_MS);if(lastMinute>=nowMinute)return{due:!1};lookBack=Math.min(nowMinute-lastMinute-1,CATCH_UP_MINUTES)}try{for(let back=0;back<=lookBack;back++){let at=new Date((nowMinute-back)*MINUTE_MS);if(matchesCron(parsed.fields,at,zone))return{due:!0}}}catch{return{due:!1,error:`"${zone}" is not a timezone this system knows.`}}return{due:!1}}function describeCron(expression,timeZone){let parsed=parseCron2(expression);if(!parsed.ok)return parsed.error;let zone=timeZone?.trim()||"UTC",parts=expression.trim().split(/\s+/),[minute,hour,dayOfMonth,month,dayOfWeek]=parts,everyMinutes=minute?.startsWith("*/")?Number(minute.slice(2)):null;if(everyMinutes&&hour==="*"&&dayOfMonth==="*"&&month==="*"&&dayOfWeek==="*")return`Every ${everyMinutes} minutes.`;let time2=minute!==void 0&&hour!==void 0&&!minute.includes("*")&&!hour.includes("*")?`${hour.padStart(2,"0")}:${minute.padStart(2,"0")}`:null,DAYS=["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"];if(time2&&dayOfWeek!=="*"&&dayOfMonth==="*")return`Every ${[...parsed.fields.daysOfWeek??[]].map((d)=>DAYS[d]).join(", ")} at ${time2} (${zone}).`;if(time2&&dayOfMonth!=="*")return`On day ${dayOfMonth} of the month at ${time2} (${zone}).`;if(time2)return`Every day at ${time2} (${zone}).`;return`On the schedule "${expression}" (${zone}).`}function nextFireTimes(input){let parsed=parseCron2(input.expression);if(!parsed.ok)return{times:[],error:parsed.error};let zone=input.timeZone?.trim()||"UTC",count2=Math.max(1,Math.min(input.count??5,50)),horizon=Math.max(1,Math.min(input.horizonDays??400,400)),times=[],startMinute=Math.floor(input.from.getTime()/MINUTE_MS)+1,limit=horizon*24*60;try{for(let offset=0;offset<limit&&times.length<count2;offset+=1){let when=new Date((startMinute+offset)*MINUTE_MS);if(matchesCron(parsed.fields,when,zone))times.push(when)}}catch{return{times:[],error:`"${zone}" is not a timezone this system knows.`}}return{times}}var MINUTE2=60000;function dueMappings(mappings,now){let due=[],problems=[];for(let mapping of mappings){if(!mapping.scheduleCron?.trim())continue;let answer=isDue({expression:mapping.scheduleCron,timeZone:mapping.scheduleTimezone,now,lastRunAt:mapping.lastRunAt??null});if(answer.error){problems.push({mapping,error:answer.error});continue}if(answer.due)due.push(mapping)}return{due,problems}}function startScheduler(deps){let now=deps.now??(()=>new Date),reported=new Set,stopped=!1,tick=async()=>{if(stopped)return;let mappings;try{mappings=await deps.listScheduled()}catch(error3){deps.logger.error("[Integrations] Could not read the schedules",{error:error3 instanceof Error?error3.message:String(error3)});return}let{due,problems}=dueMappings(mappings,now());for(let problem of problems){let token=`${problem.mapping.id}:${problem.error}`;if(reported.has(token))continue;reported.add(token),deps.logger.error(`[Integrations] "${problem.mapping.name}" has a schedule that cannot run: ${problem.error}`)}for(let mapping of due)try{if(await deps.startRun(mapping.id))deps.logger.info(`[Integrations] Scheduled import started: ${mapping.name}`)}catch(error3){deps.logger.error(`[Integrations] Scheduled import failed to start: ${mapping.name}`,{error:error3 instanceof Error?error3.message:String(error3)})}},timer=setInterval(()=>{tick()},MINUTE2);if(typeof timer==="object"&&timer&&"unref"in timer)timer.unref();return{stop:()=>{stopped=!0,clearInterval(timer)}}}var asObject=(value2)=>value2&&typeof value2==="object"&&!Array.isArray(value2)?value2:null,asArray=(value2)=>Array.isArray(value2)?value2:[],text2=(value2)=>{if(value2==null)return null;let s=String(value2);return s===""?null:s};function buildTransferDocument(input){let{source,endpoints,mappings}=input,nameById=new Map;for(let endpoint of endpoints){let id=text2(endpoint.id),name2=text2(endpoint.name);if(id&&name2)nameById.set(id,name2)}return{version:1,exportedAt:input.exportedAt,secretsExcluded:!0,connection:{name:String(source.name??""),slug:String(source.slug??""),baseUrl:String(source.baseUrl??""),description:text2(source.description),authType:String(source.authType??"none"),authHeaderName:text2(source.authHeaderName),authQueryParam:text2(source.authQueryParam),extraHeaders:asObject(source.extraHeaders),tokenUrl:text2(source.tokenUrl),oauthGrantType:text2(source.oauthGrantType),oauthClientId:text2(source.oauthClientId),oauthUsername:text2(source.oauthUsername),oauthScope:text2(source.oauthScope),oauthClientAuth:text2(source.oauthClientAuth),tlsVerify:source.tlsVerify!==!1,timeoutMs:typeof source.timeoutMs==="number"?source.timeoutMs:null,enabled:source.enabled!==!1},endpoints:endpoints.map((endpoint)=>({name:String(endpoint.name??""),tag:String(endpoint.tag??""),method:String(endpoint.method??"GET"),path:String(endpoint.path??""),description:text2(endpoint.description),queryParams:asObject(endpoint.queryParams),requestBody:asObject(endpoint.requestBody),responseRootPath:text2(endpoint.responseRootPath),treeChildrenPath:text2(endpoint.treeChildrenPath),pagination:asObject(endpoint.pagination),paramBindings:asArray(endpoint.paramBindings).map((binding)=>{if(binding.from!=="endpoint")return{...binding};let{endpointId,...rest3}=binding;return{...rest3,endpointName:nameById.get(String(endpointId))??null}}),enabled:endpoint.enabled!==!1})),mappings:mappings.map((mapping)=>({name:String(mapping.name??""),endpointName:nameById.get(String(mapping.endpointId))??null,targetEntity:String(mapping.targetEntity??""),fieldMappings:asArray(mapping.fieldMappings),referenceChecks:asArray(mapping.referenceChecks),dedupSourceField:text2(mapping.dedupSourceField),dedupTargetField:text2(mapping.dedupTargetField),writeMode:String(mapping.writeMode??"upsert")??"upsert",missingRecordPolicy:String(mapping.missingRecordPolicy??"ignore")??"ignore",missingRecordColumn:text2(mapping.missingRecordColumn),missingRecordValue:text2(mapping.missingRecordValue),removalScopeColumn:text2(mapping.removalScopeColumn),passwordTargetColumn:text2(mapping.passwordTargetColumn),accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:text2(mapping.scheduleCron),scheduleTimezone:text2(mapping.scheduleTimezone),enabled:mapping.enabled!==!1}))}}function validateTransferDocument(value2){let problems=[],doc=asObject(value2);if(!doc)return{ok:!1,document:null,problems:[{path:"",message:"This is not an integration export file."}]};if(typeof doc.version!=="number")problems.push({path:"version",message:"The file does not say which format it is in."});else if(doc.version>1)problems.push({path:"version",message:`This file was written by a newer version (${doc.version}); this one understands up to 1.`});let connection=asObject(doc.connection);if(!connection)problems.push({path:"connection",message:"The file has no connection."});else{if(!text2(connection.name))problems.push({path:"connection.name",message:"Missing name."});if(!text2(connection.slug))problems.push({path:"connection.slug",message:"Missing slug."});if(!text2(connection.baseUrl))problems.push({path:"connection.baseUrl",message:"Missing base URL."})}let endpoints=asArray(doc.endpoints),endpointNames=new Set;return endpoints.forEach((endpoint,index)=>{let name2=text2(endpoint.name);if(!name2){problems.push({path:`endpoints[${index}].name`,message:"Missing name."});return}if(endpointNames.has(name2))problems.push({path:`endpoints[${index}].name`,message:`Two endpoints are called "${name2}"; names are how the rest of the file refers to them.`});if(endpointNames.add(name2),!text2(endpoint.path))problems.push({path:`endpoints[${index}].path`,message:"Missing path."});if(!text2(endpoint.tag))problems.push({path:`endpoints[${index}].tag`,message:"Missing tag."})}),endpoints.forEach((endpoint,index)=>{asArray(endpoint.paramBindings).forEach((binding,bindingIndex)=>{if(binding.from!=="endpoint")return;let target2=text2(binding.endpointName);if(!target2||!endpointNames.has(target2))problems.push({path:`endpoints[${index}].paramBindings[${bindingIndex}]`,message:`Takes its value from an endpoint called "${target2??"?"}", which is not in this file.`})})}),asArray(doc.mappings).forEach((mapping,index)=>{if(!text2(mapping.name))problems.push({path:`mappings[${index}].name`,message:"Missing name."});if(!text2(mapping.targetEntity))problems.push({path:`mappings[${index}].targetEntity`,message:"Missing target table."});let endpointName=text2(mapping.endpointName);if(!endpointName||!endpointNames.has(endpointName))problems.push({path:`mappings[${index}].endpointName`,message:`Reads from an endpoint called "${endpointName??"?"}", which is not in this file.`})}),{ok:problems.length===0,document:problems.length===0?doc:null,problems}}init_crypto();init_routeCollector();init_utils5();init_utils6();init_godminGuard();init_esm3();init_utils5();async function testConnection(chain,tokenCache,deps={}){let{source,oauth}=chain,fetchImpl=deps.fetchImpl;if(oauth){tokenCache.invalidate(source.id);let token=await getAccessToken(oauth,tokenCache,{fetchImpl});return token.ok?{ok:!0,detail:`A token was issued (${token.accessToken.length} characters). The credentials and token address are valid.`}:{ok:!1,error:token.error}}let built=buildUrl(source.baseUrl,"");if(!built.ok)return{ok:!1,error:built.error};let{headers}=applyAuth(source,built.url),outcome=await fetchOnce(source,{method:"GET",url:built.url,headers},{fetchImpl});if(outcome.status===0)return{ok:!1,error:outcome.error};return{ok:outcome.status<500,detail:`The address answered: HTTP ${outcome.status}.`,error:outcome.status>=500?outcome.error:void 0}}var PREVIEW_LIMIT=1500;async function sampleEndpoint(source,endpoint,pathParams,tokenCache,oauth,deps={}){let fetchImpl=deps.fetchImpl,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return blank({error:token.error});bearerToken=token.accessToken}let values={...endpoint.queryParams??{},...pathParams??{}},resolved=resolvePath2(endpoint.path,values);if(resolved.missing.length>0)return blank({error:`This endpoint needs a value for ${resolved.missing.map((m)=>`{${m}}`).join(", ")}. Enter an example value to test it (e.g. ${resolved.missing[0]} = 12345).`});let query={};for(let[key2,value2]of Object.entries(values)){if(value2==null||resolved.used.has(key2))continue;query[key2]=value2}let built=buildUrl(source.baseUrl,resolved.path,query);if(!built.ok)return blank({error:built.error});let{headers}=applyAuth({...source,token:bearerToken??source.token},built.url);if(bearerToken)headers.Authorization=`Bearer ${bearerToken}`;let outcome=await fetchOnce(source,{method:endpoint.method,url:built.url,headers,body:endpoint.method.toUpperCase()==="GET"?void 0:endpoint.requestBody??{}},{fetchImpl}),bodyKeys=outcome.body&&typeof outcome.body==="object"&&!Array.isArray(outcome.body)?Object.keys(outcome.body).slice(0,40):[];if(!outcome.ok)return blank({status:outcome.status,error:outcome.error??`HTTP ${outcome.status}`,bodyKeys,bodyPreview:previewBody(outcome.body)});let childrenPath=treeChildrenPath(endpoint.treeChildrenPath),extracted=extractRecords(outcome.body,endpoint.responseRootPath),flattened=childrenPath?flattenTree(extracted,childrenPath):null;if(flattened?.truncated)return blank({status:outcome.status,error:"This source answered with a structure that nests into itself, so it cannot be walked. Check the field named as the children.",bodyKeys,bodyPreview:previewBody(outcome.body)});let records=flattened?flattened.records:extracted;return{ok:!0,status:outcome.status,error:records.length===0?bodyKeys.length>0?`No record array was found. The response's top-level keys are: ${bodyKeys.join(", ")} \u2014 set the response root path to whichever holds the list.`:"No record array was found in the response.":null,recordCount:records.length,sample:records.slice(0,5),fields:records.length>0?flattenKeys(records[0]):[],bodyKeys,bodyPreview:previewBody(outcome.body)}}function blank(over){return{ok:!1,status:0,error:null,recordCount:0,sample:[],fields:[],bodyKeys:[],bodyPreview:null,...over}}function previewBody(body){if(body==null)return null;try{let text3=typeof body==="string"?body:JSON.stringify(body);return text3.length>PREVIEW_LIMIT?`${text3.slice(0,PREVIEW_LIMIT)}\u2026`:text3}catch{return null}}async function previewRun(chain,tokenCache,lookups,deps={}){let fetchImpl=deps.fetchImpl,{mapping,source,oauth}=chain,bearerToken=null;if(oauth){let token=await getAccessToken(oauth,tokenCache,{fetchImpl});if(!token.ok)return{ok:!1,error:token.error};bearerToken=token.accessToken}let root=chain.endpoints.find((e)=>e.id===chain.rootEndpointId);if(!root)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};let parents={},entityValues={},externalCalls=0;for(let binding of root.paramBindings??[]){if(binding.from==="endpoint"&&!parents[binding.endpointId]){let parentSpec=chain.endpoints.find((e)=>e.id===binding.endpointId);if(!parentSpec)continue;let collected2=await collectEndpoint(source,parentSpec,{},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected2.callCount,!collected2.ok)return{ok:!1,error:collected2.error};parents[binding.endpointId]=collected2.records.map((r)=>r.record)}if(binding.from==="entity"){let key2=`${binding.entity}.${binding.field}`;if(!entityValues[key2])entityValues[key2]=await lookups.readEntityColumn(binding.entity,binding.field)}}let collected=await collectEndpoint(source,root,{parents,entityValues},{fetchImpl,bearerToken,maxConcurrent:deps.maxConcurrent,maxRecords:deps.maxRecords});if(externalCalls+=collected.callCount,!collected.ok)return{ok:!1,error:collected.error};let mapped3=buildMappedRecords(collected.records.map((r)=>r.record),mapping.fieldMappings,mapping.dedupTargetField,collected.records.map((r)=>r.parent)),existing=await lookups.readExistingRows(mapping.targetEntity),referenceValues=await loadReferenceValues(mapping.references??[],(entity,column)=>lookups.readEntityColumn(entity,column)),references=await loadReferenceIds(mapping.references??[],mapping.targetEntity,(entity,column)=>lookups.readEntityPairsBy(entity,column)),referenceIds=references.ids,existingAccounts=mapping.accountRule?await lookups.readEntityIdsBy(mapping.accountRule.entity,mapping.accountRule.matchColumn):{},ops=planWrites({records:mapped3.records,existing,dedupTargetField:mapping.dedupTargetField,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,missingColumn:mapping.missingColumn,missingValue:mapping.missingValue,requiredFields:lookups.requiredFields(mapping.targetEntity),uniqueFields:lookups.uniqueFields(mapping.targetEntity),createDefaults:mapping.passwordColumn?{[mapping.passwordColumn]:"\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"}:{},accountRule:mapping.accountRule??null,existingAccounts,references:mapping.references??[],referenceValues,referenceIds,targetEntity:mapping.targetEntity});ops.issues.unshift(...mapped3.issues),ops.warnings.push(...ambiguityWarnings(references.ambiguous));let invalid=lookups.validateRows?.(ops.creates)??[];for(let problem of invalid){let create4=ops.creates.find((c)=>c.sourceIndex===problem.sourceIndex);ops.issues.push({sourceIndex:problem.sourceIndex,kind:"invalid_value",message:problem.message,row:create4?.data})}if(invalid.length>0){let refused=new Set(invalid.map((problem)=>problem.sourceIndex));ops.creates=ops.creates.filter((create4)=>!refused.has(create4.sourceIndex))}return{ok:!0,externalCalls,plan:summarize(ops,{targetEntity:mapping.targetEntity,writeMode:mapping.writeMode,missingPolicy:mapping.missingPolicy,totalFetched:collected.records.length,reportedTotal:collected.reportedTotal,existingCount:existing.length,dedupConfigured:Boolean(mapping.dedupTargetField)})}}init_crypto();import{and as and21,eq as eq35,inArray as inArray15}from"drizzle-orm";var camel2=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function tableFor(deps,entity){return deps.schemaTables[camel2(entity)]??null}var col8=(table,field)=>table?.[field]??table?.[camel2(field)];function open(deps,envelope,where){if(typeof envelope!=="string"||envelope==="")return"";let key2=deps.getEncryptionKey();if(!key2)return deps.logger.error("[Integrations] A stored credential cannot be read: no encryption key",{column:where}),"";try{return decryptSecret(envelope,key2)}catch{return deps.logger.error("[Integrations] A stored credential could not be decrypted \u2014 the encryption key has changed since it was saved. Re-enter it in the panel.",{column:where}),""}}async function resolveChain(deps,mappingId){let mappings=tableFor(deps,"integration_mappings"),endpoints=tableFor(deps,"integration_endpoints"),sources=tableFor(deps,"integration_sources");if(!mappings||!endpoints||!sources)return{ok:!1,error:"The integration tables are not present in this schema."};let[mappingRow]=await deps.db.select().from(mappings).where(eq35(col8(mappings,"id"),mappingId)).limit(1);if(!mappingRow)return{ok:!1,error:"This mapping no longer exists."};let row=mappingRow,[endpointRow]=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"id"),String(row.endpointId))).limit(1);if(!endpointRow)return{ok:!1,error:"The endpoint this mapping reads no longer exists."};if(endpointRow.enabled===!1)return{ok:!1,error:"The call this mapping reads is switched off."};if(row.enabled===!1)return{ok:!1,error:"This mapping is switched off."};let sourceId=String(endpointRow.sourceId),siblingRows=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"The source this mapping reads no longer exists."};let s=sourceRow;if(s.enabled===!1)return{ok:!1,error:"This source is switched off."};let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{ok:!0,chain:{mapping:toMappingSpec(row),endpoints:siblingRows.map((e)=>toEndpointSpec(e)),rootEndpointId:String(endpointRow.id),source,oauth}}}async function resolveEndpointContext(deps,by){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints");if(!sources||!endpoints)return{ok:!1,error:"The integration tables are not present in this schema."};let endpointRow=null,sourceId=by.sourceId;if(by.endpointId){let[row]=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"id"),by.endpointId)).limit(1);if(!row)return{ok:!1,error:"This endpoint no longer exists."};endpointRow=row,sourceId=String(endpointRow.sourceId)}if(!sourceId)return{ok:!1,error:"No source was named."};let[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return{ok:!1,error:"This source no longer exists."};let{source,oauth}=toConnection(deps,sourceRow);return{ok:!0,context:{source,oauth,endpoint:endpointRow?toEndpointSpec(endpointRow):null}}}async function cacheEndpointSample(deps,endpointId,records){let endpoints=tableFor(deps,"integration_endpoints");if(!endpoints||records.length===0)return;try{await deps.db.update(endpoints).set({sampleResponse:{records:records.slice(0,3)},updatedAt:new Date}).where(eq35(col8(endpoints,"id"),endpointId))}catch(error3){deps.logger.warn("[Integrations] Could not cache the endpoint sample",{endpointId,error:error3 instanceof Error?error3.message:String(error3)})}}function toConnection(deps,s){let authType=String(s.authType??"none"),source={id:String(s.id),baseUrl:String(s.baseUrl??""),authType,token:authType==="oauth2"?null:open(deps,s.authTokenEncrypted,"auth_token_encrypted"),authHeaderName:s.authHeaderName??null,authQueryParam:s.authQueryParam??null,extraHeaders:s.extraHeaders??null,tlsVerify:s.tlsVerify!==!1,timeoutMs:Number(s.timeoutMs??30000)},oauth=authType==="oauth2"?{sourceId:source.id,tokenUrl:String(s.tokenUrl??""),grantType:String(s.oauthGrantType??"password")==="client_credentials"?"client_credentials":"password",clientId:s.oauthClientId??null,clientSecret:open(deps,s.oauthClientSecretEncrypted,"oauth_client_secret_encrypted"),username:s.oauthUsername??null,password:open(deps,s.oauthPasswordEncrypted,"oauth_password_encrypted"),scope:s.oauthScope??null,clientAuth:String(s.oauthClientAuth??"basic")==="body"?"body":"basic",tlsVerify:source.tlsVerify,timeoutMs:source.timeoutMs}:null;return{source,oauth}}function toMappingSpec(row){return{id:String(row.id),name:String(row.name??""),targetEntity:String(row.targetEntity??""),fieldMappings:Array.isArray(row.fieldMappings)?row.fieldMappings:[],references:Array.isArray(row.referenceChecks)?row.referenceChecks:[],dedupTargetField:row.dedupTargetField||null,writeMode:String(row.writeMode??"upsert")??"upsert",missingPolicy:String(row.missingRecordPolicy??"ignore")??"ignore",missingColumn:row.missingRecordColumn??null,removalScopeColumn:row.removalScopeColumn||null,missingValue:row.missingRecordValue??null,originColumn:row.originColumn??null,originValue:row.originValue??null,maxRemovalShare:Number(row.maxRemovalShare??0)||0,passwordColumn:row.passwordTargetColumn||null,accountRule:row.accountRule??null}}function toEndpointSpec(row){let pagination=row.pagination;return{id:String(row.id),method:String(row.method??"GET"),path:String(row.path??""),queryParams:row.queryParams??null,requestBody:row.requestBody??null,responseRootPath:row.responseRootPath||null,treeChildrenPath:row.treeChildrenPath||null,pagination:pagination&&typeof pagination==="object"&&"kind"in pagination?pagination:{kind:"none"},paramBindings:Array.isArray(row.paramBindings)?row.paramBindings:null}}async function readConnectionBundle(deps,sourceId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return null;let[sourceRow]=await deps.db.select().from(sources).where(eq35(col8(sources,"id"),sourceId)).limit(1);if(!sourceRow)return null;let endpointRows=await deps.db.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),ids=new Set(endpointRows.map((row)=>String(row.id))),allMappings=await deps.db.select().from(mappings);return{source:sourceRow,endpoints:endpointRows,mappings:allMappings.filter((row)=>ids.has(String(row.endpointId)))}}async function applyTransferDocument(deps,document,userId){let sources=tableFor(deps,"integration_sources"),endpoints=tableFor(deps,"integration_endpoints"),mappings=tableFor(deps,"integration_mappings");if(!sources||!endpoints||!mappings)return{ok:!1,error:"The integration tables are not present in this schema."};return deps.db.transaction(async(tx)=>{let now=new Date,c=document.connection,connectionValues={name:c.name,slug:c.slug,baseUrl:c.baseUrl,description:c.description??null,authType:c.authType,authHeaderName:c.authHeaderName??null,authQueryParam:c.authQueryParam??null,extraHeaders:c.extraHeaders??null,tokenUrl:c.tokenUrl??null,oauthGrantType:c.oauthGrantType??null,oauthClientId:c.oauthClientId??null,oauthUsername:c.oauthUsername??null,oauthScope:c.oauthScope??null,oauthClientAuth:c.oauthClientAuth??null,tlsVerify:c.tlsVerify!==!1,timeoutMs:c.timeoutMs??null,enabled:c.enabled!==!1,updatedAt:now,updatedBy:userId},[existingSource]=await tx.select().from(sources).where(eq35(col8(sources,"slug"),c.slug)).limit(1),sourceId,created=!1;if(existingSource)sourceId=String(existingSource.id),await tx.update(sources).set(connectionValues).where(eq35(col8(sources,"id"),sourceId));else{let[row]=await tx.insert(sources).values({...connectionValues,createdAt:now,createdBy:userId}).returning();if(!row?.id)return{ok:!1,error:"The connection could not be created."};sourceId=String(row.id),created=!0}let existingEndpoints=await tx.select().from(endpoints).where(eq35(col8(endpoints,"sourceId"),sourceId)),endpointIdByName=new Map;for(let row of existingEndpoints)endpointIdByName.set(String(row.name),String(row.id));for(let endpoint of document.endpoints){let values={sourceId,name:endpoint.name,tag:endpoint.tag,method:endpoint.method,path:endpoint.path,description:endpoint.description??null,queryParams:endpoint.queryParams??null,requestBody:endpoint.requestBody??null,responseRootPath:endpoint.responseRootPath??null,treeChildrenPath:endpoint.treeChildrenPath??null,pagination:endpoint.pagination??null,enabled:endpoint.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=endpointIdByName.get(endpoint.name);if(existingId)await tx.update(endpoints).set(values).where(eq35(col8(endpoints,"id"),existingId));else{let[row]=await tx.insert(endpoints).values({...values,paramBindings:[],createdAt:now,createdBy:userId}).returning();if(row?.id)endpointIdByName.set(endpoint.name,String(row.id))}}for(let endpoint of document.endpoints){let id=endpointIdByName.get(endpoint.name);if(!id)continue;let bindings=(endpoint.paramBindings??[]).map((binding)=>{if(binding.from!=="endpoint")return binding;let{endpointName,...rest3}=binding;return{...rest3,endpointId:endpointIdByName.get(String(endpointName))??""}});await tx.update(endpoints).set({paramBindings:bindings,updatedAt:now}).where(eq35(col8(endpoints,"id"),id))}let allMappings=await tx.select().from(mappings),ownIds=new Set(endpointIdByName.values()),mappingIdByName=new Map;for(let row of allMappings)if(ownIds.has(String(row.endpointId)))mappingIdByName.set(String(row.name),String(row.id));let mappingCount=0;for(let mapping of document.mappings){let endpointId=mapping.endpointName?endpointIdByName.get(mapping.endpointName):void 0;if(!endpointId)continue;let values={endpointId,name:mapping.name,targetEntity:mapping.targetEntity,fieldMappings:mapping.fieldMappings??[],referenceChecks:mapping.referenceChecks??[],dedupSourceField:mapping.dedupSourceField??null,dedupTargetField:mapping.dedupTargetField??null,writeMode:mapping.writeMode,missingRecordPolicy:mapping.missingRecordPolicy,missingRecordColumn:mapping.missingRecordColumn??null,missingRecordValue:mapping.missingRecordValue??null,removalScopeColumn:mapping.removalScopeColumn??null,passwordTargetColumn:mapping.passwordTargetColumn??null,accountRule:mapping.accountRule??null,scheduleEnabled:mapping.scheduleEnabled===!0,scheduleCron:mapping.scheduleCron??null,scheduleTimezone:mapping.scheduleTimezone??null,enabled:mapping.enabled!==!1,updatedAt:now,updatedBy:userId},existingId=mappingIdByName.get(mapping.name);if(existingId)await tx.update(mappings).set(values).where(eq35(col8(mappings,"id"),existingId));else await tx.insert(mappings).values({...values,createdAt:now,createdBy:userId});mappingCount++}return{ok:!0,sourceId,created,endpoints:endpointIdByName.size,mappings:mappingCount}})}async function readScheduledMappings(deps){let mappings=tableFor(deps,"integration_mappings");if(!mappings)return[];return(await deps.db.select().from(mappings)).filter((row)=>row.scheduleEnabled===!0&&row.enabled!==!1).filter((row)=>typeof row.scheduleCron==="string"&&row.scheduleCron.trim()!=="").map((row)=>({id:String(row.id),name:String(row.name??""),scheduleCron:String(row.scheduleCron),scheduleTimezone:row.scheduleTimezone??null,lastRunAt:row.lastRunAt?new Date(row.lastRunAt):null,needsPassword:Boolean(row.passwordTargetColumn)||row.accountRule!=null}))}function requiredFieldsOf(entities,targetEntity){return(entities.find((e)=>e.table_name===targetEntity)?.columns??[]).filter((c)=>c.notNull===!0&&c.default===void 0&&!c.defaultRaw&&!c.nullable).map((c)=>camel2(c.name))}function uniqueFieldsOf(entities,targetEntity){let entity=entities.find((e)=>e.table_name===targetEntity),columns=entity?.columns??[],fields=new Set;for(let column of columns)if(column.unique===!0||column.primaryKey===!0)fields.add(camel2(column.name));for(let index of entity?.indexes??[])if(index.unique===!0&&index.columns.length===1&&index.columns[0])fields.add(camel2(index.columns[0]));return fields.delete("id"),[...fields]}function createRunRepository(deps,entities){let runs=()=>tableFor(deps,"integration_runs"),runItems=()=>tableFor(deps,"integration_run_items");return{async openRun(input){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let id=(await deps.db.insert(table).values({mappingId:input.mappingId,targetEntity:input.targetEntity,writeMode:input.writeMode,trigger:input.trigger,status:"running",startedAt:new Date,createdBy:input.userId??null}).returning())[0]?.id;return id?{ok:!0,runId:String(id)}:{ok:!1,error:"The run record was created but returned no identifier."}}catch(error3){return{ok:!1,error:error3 instanceof Error?error3.message:String(error3)}}},async closeRun(runId,patch){let table=runs();if(!table)return{ok:!1,error:"integration_runs is missing from this schema."};try{let mappingId=(await deps.db.update(table).set({...patch,updatedAt:new Date}).where(eq35(col8(table,"id"),runId)).returning())[0]?.mappingId,finishedAt=patch.finishedAt,mappings=tableFor(deps,"integration_mappings");if(mappings&&mappingId&&finishedAt)await deps.db.update(mappings).set({lastRunAt:finishedAt,updatedAt:new Date}).where(eq35(col8(mappings,"id"),String(mappingId)));return{ok:!0}}catch(error3){return deps.logger.error("[Integrations] Could not close the run record",{runId,error:error3 instanceof Error?error3.message:String(error3)}),{ok:!1,error:"Could not write the run record."}}},async savePreImages(runId,images){let table=runItems();if(!table)return!1;if(images.length===0)return!0;let CHUNK2=500;try{return await deps.db.transaction(async(tx)=>{for(let i=0;i<images.length;i+=CHUNK2)await tx.insert(table).values(images.slice(i,i+CHUNK2).map((image)=>({runId,targetEntity:image.targetEntity,rowId:image.rowId,action:image.action,before:image.before,after:image.after})))}),!0}catch(error3){return deps.logger.error("[Integrations] The run succeeded but its before-images could not be stored; it cannot be undone",{runId,error:error3 instanceof Error?error3.message:String(error3)}),!1}},async isCancelRequested(runId){let table=runs();if(!table)return!1;try{let[row]=await deps.db.select().from(table).where(eq35(col8(table,"id"),runId)).limit(1);return row?.cancelRequested===!0}catch{return!1}},async readExistingRows(targetEntity){let table=tableFor(deps,targetEntity);if(!table)return[];return(await deps.db.select().from(table)).map((row)=>({id:String(row.id),row}))},async readEntityColumn(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0;if(!table||!column)return[];return(await deps.db.selectDistinct({v:column}).from(table)).map((r)=>r.v).filter((v)=>v!=null&&v!=="")},async readEntityIdsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return{};let rows=await deps.db.select({v:column,id:idColumn}).from(table),map3={};for(let row of rows){if(row.v==null||row.v===""||row.id==null)continue;let key2=String(row.v).trim();if(!map3[key2])map3[key2]=String(row.id)}return map3},async readEntityPairsBy(entity,field){let table=tableFor(deps,entity),column=table?col8(table,field):void 0,idColumn=table?col8(table,"id"):void 0;if(!table||!column||!idColumn)return[];return await deps.db.select({value:column,id:idColumn}).from(table)},requiredFields:(targetEntity)=>requiredFieldsOf(entities,targetEntity),uniqueFields:(targetEntity)=>uniqueFieldsOf(entities,targetEntity)}}async function readRowsById(deps,targetEntity,ids){let table=tableFor(deps,targetEntity),result=new Map;if(!table||ids.length===0)return result;let CHUNK2=1000;for(let i=0;i<ids.length;i+=CHUNK2){let rows=await deps.db.select().from(table).where(inArray15(col8(table,"id"),ids.slice(i,i+CHUNK2)));for(let row of rows)result.set(String(row.id),row)}return result}async function readPreImages(deps,runId){let table=tableFor(deps,"integration_run_items");if(!table)return[];return(await deps.db.select().from(table).where(eq35(col8(table,"runId"),runId))).map((row)=>({targetEntity:String(row.targetEntity),rowId:row.rowId?String(row.rowId):null,action:String(row.action),before:row.before??null,after:row.after??null}))}async function readRun(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return null;let[row]=await deps.db.select().from(table).where(eq35(col8(table,"id"),runId)).limit(1);return row??null}async function requestCancel(deps,runId){let table=tableFor(deps,"integration_runs");if(!table)return!1;return(await deps.db.update(table).set({cancelRequested:!0,updatedAt:new Date}).where(and21(eq35(col8(table,"id"),runId),eq35(col8(table,"status"),"running"))).returning()).length>0}var fail3=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createInspectRoutes(routeConfig,deps,tokenCache){let settings=routeConfig.resolvedOptions.integrations??{};return[defineRoute({method:"POST",path:"/sources/:id/test",detail:{tags:["Integrations"],summary:"Check a source is reachable and its credentials are accepted"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{sourceId:params.id});if(!context.ok)return fail3(set2,404,context.error);let result=await testConnection(context.context,tokenCache);return{isSuccess:result.ok,message:result.ok?result.detail??"Connected.":result.error??"Could not connect.",data:result}}}),defineRoute({method:"POST",path:"/endpoints/:id/sample",body:Type.Optional(Type.Object({pathParams:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})),detail:{tags:["Integrations"],summary:"Call one endpoint once and report its real shape"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let context=await resolveEndpointContext(repoDeps,{endpointId:params.id});if(!context.ok)return fail3(set2,404,context.error);let{source,oauth,endpoint}=context.context;if(!endpoint)return fail3(set2,404,"This endpoint no longer exists.");let result=await sampleEndpoint(source,endpoint,body?.pathParams,tokenCache,oauth);if(result.ok&&result.sample.length>0)await cacheEndpointSample(repoDeps,params.id,result.sample);return{isSuccess:result.ok,message:result.error??"Sampled.",data:result}}}),defineRoute({method:"POST",path:"/preview",body:Type.Object({mappingId:Type.String()}),detail:{tags:["Integrations"],summary:"Dry-run an import: counts, warnings and a sample, with no writes"},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let repo=createRunRepository(repoDeps,repoDeps.entities),result=await previewRun(chain.chain,tokenCache,{readExistingRows:repo.readExistingRows,readEntityColumn:repo.readEntityColumn,requiredFields:repo.requiredFields,uniqueFields:repo.uniqueFields,readEntityIdsBy:repo.readEntityIdsBy,readEntityPairsBy:repo.readEntityPairsBy,validateRows:(rows)=>{let columns=repoDeps.entities.find((e)=>e.table_name===chain.chain.mapping.targetEntity)?.columns??[],problems=[];for(let row of rows){let result2=validatePayload(row.data,columns,!1);if(!result2.valid)problems.push({sourceIndex:row.sourceIndex,message:result2.errors.map((e)=>`${e.field}: ${e.message}`).join("; ")})}return problems}},{maxRecords:settings.maxRecordsPerRun,maxConcurrent:settings.maxConcurrentFanout});if(!result.ok)return fail3(set2,422,result.error);return{isSuccess:!0,message:"Nothing was written.",data:{plan:result.plan,externalCalls:result.externalCalls}}}}),defineRoute({method:"POST",path:"/schedule-check",body:Type.Object({mappingId:Type.String(),at:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Simulate the schedule: the next firings, and whether a given moment is one",description:"Writes nothing and starts nothing. Answers the question a schedule cannot otherwise be asked until the night it runs: does this expression name the minute I meant, in the clock I meant."},handler:async({body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail3(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail3(set2,404,chain.error);let raw=chain.chain.mapping,expression=String(raw.scheduleCron??"").trim(),timeZone=String(raw.scheduleTimezone??"").trim()||"UTC";if(expression==="")return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression:"",timeZone,times:[]}};let at=body.at?new Date(body.at):new Date;if(Number.isNaN(at.getTime()))return fail3(set2,400,"That is not a moment I can read.");let upcoming=nextFireTimes({expression,timeZone,from:at,count:5}),verdict=isDue({expression,timeZone,now:at,lastRunAt:null});return{isSuccess:!0,message:"Nothing was written.",data:{enabled:raw.scheduleEnabled===!0,expression,timeZone,describes:describeCron(expression,timeZone),at:at.toISOString(),wouldFireAtThatMoment:verdict.due,error:verdict.error??upcoming.error??null,times:upcoming.times.map((t)=>t.toISOString())}}}})]}var fail4=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};async function closeAbandonedRuns(repoDeps,mappingId,logger2){try{let runsTable=tableFor(repoDeps,"integration_runs");if(!runsTable)return;let{and:and22,eq:eq36,inArray:inArray16}=await import("drizzle-orm"),closed=await repoDeps.db.update(runsTable).set({status:"failed",finishedAt:new Date,errors:["This import stopped without finishing \u2014 the process running it went away (a restart, a deploy, or a crash). Whatever it had already written is still there; run it again, or check the target table."],updatedAt:new Date}).where(and22(eq36(runsTable.mappingId,mappingId),inArray16(runsTable.status,["running","queued"]))).returning();if(closed.length>0)logger2.warn(`[Integrations] ${closed.length} run(s) of this mapping were left open by a process that went away; marked as failed.`)}catch(error3){logger2.error("[Integrations] Could not close abandoned runs",error3)}}var tokenCache=new TokenCache;function createIntegrationRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,resolvedOptions,getEncryptionKey,getLockStore,publish}=routeConfig,entities=resolveEntities(SYSTEM_TABLES,resolvedOptions.entities??[],{consumerMode:resolvedOptions.authentication?.mode==="consumer"}).entities,settings=resolvedOptions.integrations??{},topicPrefix=settings.realtimeTopicPrefix||"integrations",guard4=createGodminGuard2({logger:logger2,db,schemaTables,area:"data integrations",allowedRoles:routeConfig.adminRoles??settings.adminRoles}),deps=()=>db?{db,schemaTables,entities,logger:logger2,getEncryptionKey}:null,inspectRoutes=createInspectRoutes(routeConfig,deps,tokenCache),writerFor=(repoDeps,targetEntity)=>{let table=tableFor(repoDeps,targetEntity);if(!table)return null;let entity=entities.find((e)=>e.table_name===targetEntity);return{db:repoDeps.db,drizzleTable:table,resolveCol:(field)=>table[field]??table[field.replace(/_([a-z])/g,(_m,l)=>l.toUpperCase())],columns:entity?.columns??[],logger:logger2,validatePayload,resolveEntity:(name2)=>{let refTable=tableFor(repoDeps,name2);if(!refTable)return null;let refEntity=entities.find((e)=>e.table_name===name2);return{table:refTable,columns:refEntity?.columns??[]}},accountClosure:accountClosureFor(targetEntity)}};function accountClosureFor(targetEntity){let link=accountLinkFor(routeConfig.resolvedOptions.authentication?.accountLinks,targetEntity);if(!link)return null;let usersTable=schemaTables.users;if(!usersTable)return null;let sessionsTable=schemaTables.userSessions??schemaTables.sessions;return{userColumn:link.userColumn,accountEntity:"users",usersTable,sessionsTable:sessionsTable??null}}let routePostRuns=defineRoute({method:"POST",path:"/runs",body:Type.Object({mappingId:Type.String(),confirm:Type.Optional(Type.Boolean()),sharedPassword:Type.Optional(Type.String()),referenceMode:Type.Optional(Type.Union([Type.Literal("create"),Type.Literal("skipRecord")]))}),detail:{tags:["Integrations"],summary:"Start an import; answers 202 with the run identifier"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let chain=await resolveChain(repoDeps,body.mappingId);if(!chain.ok)return fail4(set2,404,chain.error);let declared2=chain.chain.mapping,answer=body.referenceMode,mapping=answer?{...declared2,references:(declared2.references??[]).map((check)=>check.onMissing==="ignore"?check:{...check,onMissing:answer})}:declared2,wantsPassword=Boolean(mapping.passwordColumn||mapping.accountRule),createDefaults,accountPasswordHash=null;if(wantsPassword){let supplied=typeof body.sharedPassword==="string"?body.sharedPassword:"";if(supplied.length<8)return fail4(set2,422,mapping.accountRule?"This import creates a login for every new record, so it needs a password to create them with: send sharedPassword, at least 8 characters. It is used once, for this run, and is stored nowhere.":`This mapping writes a password into "${mapping.passwordColumn}", so it needs one to write: send sharedPassword, at least 8 characters. It is used for the accounts this run creates and is not stored anywhere.`);let hash=await hashPassword(supplied);if(accountPasswordHash=hash,mapping.passwordColumn)createDefaults={[mapping.passwordColumn]:hash}}if(isDestructive(mapping.writeMode,mapping.missingPolicy)&&body.confirm!==!0)return set2.status=428,{isSuccess:!1,message:mapping.writeMode==="replace"?"This mapping rebuilds the whole table. Send confirm: true to proceed.":mapping.missingPolicy==="deactivate"?"This mapping deactivates records the source no longer carries. Send confirm: true to proceed.":"This mapping deletes records the source no longer carries. Send confirm: true to proceed.",data:null};let lockStore=getLockStore();if(!lockStore)return fail4(set2,503,"The lock service is unavailable, so a second run of this mapping could not be prevented. Runs are refused until it is back.");let lock=await acquireRunLock(lockStore,mapping.id,{logger:logger2});if(!lock.ok){if(lock.reason==="unavailable")return fail4(set2,503,`The lock service is unavailable: ${lock.error}`);return set2.status=409,{isSuccess:!1,message:"This mapping is already importing. Wait for it to finish, or cancel it.",data:{heldSince:lock.heldSince}}}await closeAbandonedRuns(repoDeps,mapping.id,logger2);let writer=writerFor(repoDeps,mapping.targetEntity);if(!writer)return await lock.handle.release(),fail4(set2,422,`This mapping targets "${mapping.targetEntity}", which does not exist.`);let userId=request.headers.get("x-user-id")??"unknown",repo=createRunRepository(repoDeps,entities),announce=()=>{},runIdReady=new Promise((resolve2)=>{announce=resolve2}),started=executeRun({...chain.chain,mapping,userId,trigger:"manual",createDefaults,accountPasswordHash},{repo,writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),onRunOpened:(id)=>announce(id),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle),runId=await Promise.race([runIdReady,started.then((outcome)=>outcome.runId)]);return started.catch(async(error3)=>{let reason=error3 instanceof Error?error3.message:String(error3);logger2.error("[Integrations] Run threw outside its own error handling",{mappingId:mapping.id,error:reason});let openedId=await runIdReady.catch(()=>null);if(openedId)await repo.closeRun(openedId,{status:"failed",finishedAt:new Date,errors:[reason]}).catch(()=>{})}).finally(()=>lock.handle.release()),set2.status=202,{isSuccess:!0,message:"The import has started.",data:{runId,mappingId:mapping.id,targetEntity:mapping.targetEntity}}}}),startScheduledRun=async(mappingId)=>{let repoDeps=deps();if(!repoDeps)return!1;let chain=await resolveChain(repoDeps,mappingId);if(!chain.ok)return logger2.error(`[Integrations] Scheduled import cannot run: ${chain.error}`),!1;let lockStore=getLockStore();if(!lockStore)return!1;let lock=await acquireRunLock(lockStore,mappingId,{logger:logger2});if(!lock.ok)return!1;let writer=writerFor(repoDeps,chain.chain.mapping.targetEntity);if(!writer)return await lock.handle.release(),logger2.error(`[Integrations] Scheduled import targets "${chain.chain.mapping.targetEntity}", which does not exist.`),!1;return executeRun({...chain.chain,userId:null,trigger:"schedule"},{repo:createRunRepository(repoDeps,entities),writer,logger:logger2,tokenCache,publishProgress:(progress)=>publish?.(`${topicPrefix}.run`,progress),maxRecordsPerRun:settings.maxRecordsPerRun,maxConcurrentFanout:settings.maxConcurrentFanout,retainPreImagesMs:parseDuration(settings.retainPreImagesFor)},lock.handle).then((outcome)=>{if(outcome.status!=="succeeded")logger2.error(`[Integrations] Scheduled import "${chain.chain.mapping.name}" ${outcome.status}: ${outcome.failure?.message??"no reason recorded"}`)}).catch((error3)=>{logger2.error("[Integrations] Scheduled import threw outside its own error handling",{mappingId,error:error3 instanceof Error?error3.message:String(error3)})}).finally(()=>lock.handle.release()),!0},unattendable=new Set;if(settings.schedulesEnabled!==!1)startScheduler({logger:logger2,listScheduled:async()=>{let repoDeps=deps();if(!repoDeps)return[];return(await readScheduledMappings(repoDeps)).filter((row)=>{if(!row.needsPassword)return!0;if(!unattendable.has(row.id))unattendable.add(row.id),logger2.error(`[Integrations] "${row.name}" is scheduled but creates logins, which need a password nobody can type at that hour. It will not run on its own \u2014 start it by hand, or turn the login off.`);return!1})},startRun:(mappingId)=>startScheduledRun(mappingId)});let routeGetSourcesIdExport=defineRoute({method:"GET",path:"/sources/:id/export",detail:{tags:["Integrations"],summary:"Export a connection, its calls and its mappings \u2014 without any secret"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let bundle=await readConnectionBundle(repoDeps,params.id);if(!bundle)return fail4(set2,404,"This connection no longer exists.");let document=buildTransferDocument({...bundle,exportedAt:new Date().toISOString()});return{isSuccess:!0,message:`${document.endpoints.length} call(s) and ${document.mappings.length} mapping(s). Credentials are NOT included \u2014 they are asked for again on the other side.`,data:document}}}),routePostImport=defineRoute({method:"POST",path:"/import",body:Type.Object({document:Type.Unknown()}),detail:{tags:["Integrations"],summary:"Bring in an exported connection; re-running it updates rather than duplicates"},handler:async({body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let checked=validateTransferDocument(body?.document);if(!checked.ok||!checked.document)return set2.status=422,{isSuccess:!1,message:"This file cannot be imported as it stands.",data:{problems:checked.problems}};let userId=request.headers.get("x-user-id")??"unknown",result=await applyTransferDocument(repoDeps,checked.document,userId);if(!result.ok)return fail4(set2,422,result.error);return{isSuccess:!0,message:`Connection "${checked.document.connection.name}" is here: ${result.endpoints} call(s) and ${result.mappings} mapping(s). Its credentials are not \u2014 enter them before running anything.`,data:result}}}),routePostRunsIdCancel=defineRoute({method:"POST",path:"/runs/:id/cancel",detail:{tags:["Integrations"],summary:"Ask a running import to stop"},handler:async({params,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");if(!await requestCancel(repoDeps,params.id))return fail4(set2,409,"This run is not running, so there is nothing to cancel.");return{isSuccess:!0,message:"Cancellation requested. The import stops at its next checkpoint and anything it had written is rolled back.",data:{runId:params.id}}}}),routePostRunsIdRevert=defineRoute({method:"POST",path:"/runs/:id/revert",body:Type.Optional(Type.Object({force:Type.Optional(Type.Boolean())})),detail:{tags:["Integrations"],summary:"Undo a run that succeeded"},handler:async({params,body,set:set2,request})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let run=await readRun(repoDeps,params.id);if(!run)return fail4(set2,404,"This run no longer exists.");if(run.status!=="succeeded")return fail4(set2,409,`Only a run that finished successfully can be undone; this one is "${String(run.status)}".`);let expiry=run.preImagesExpireAt?new Date(String(run.preImagesExpireAt)):null;if(expiry&&expiry.getTime()<Date.now())return fail4(set2,410,"This run is too old to undo: the records of what it replaced have been cleared.");let targetEntity=String(run.targetEntity??""),preImages=await readPreImages(repoDeps,params.id);if(preImages.length===0)return fail4(set2,410,"There is no record of what this run replaced, so it cannot be undone.");let groups=groupPreImagesByEntity(preImages).sort((a,b)=>a.targetEntity===targetEntity?-1:b.targetEntity===targetEntity?1:0),planned=[];for(let group of groups){let current=await readRowsById(repoDeps,group.targetEntity,touchedRowIds(group.preImages));planned.push({targetEntity:group.targetEntity,ops:planRevert({preImages:group.preImages,current,force:body?.force===!0})})}let ops={deletes:planned.flatMap((p)=>p.ops.deletes),restores:planned.flatMap((p)=>p.ops.restores),reinserts:planned.flatMap((p)=>p.ops.reinserts),conflicts:planned.flatMap((p)=>p.ops.conflicts)};if(ops.deletes.length===0&&ops.restores.length===0&&ops.reinserts.length===0&&ops.conflicts.length>0)return set2.status=409,{isSuccess:!1,message:"Every record this run touched has been edited since. Undoing would discard those edits; send force: true to overwrite them anyway.",data:{conflicts:ops.conflicts}};let userId=request.headers.get("x-user-id")??"unknown";for(let group of planned)if(!writerFor(repoDeps,group.targetEntity))return fail4(set2,422,`"${group.targetEntity}" no longer exists.`);let undone={deleted:0,restored:0,reinserted:0},failure=null;try{await repoDeps.db.transaction(async(tx)=>{for(let group of planned){let groupWriter=writerFor(repoDeps,group.targetEntity),result2=await applyRevert(groupWriter,group.ops,{targetEntity:group.targetEntity,userId,tx});if(!result2.ok)throw failure=result2.error??"The undo could not be completed.",Error(failure);undone={deleted:undone.deleted+(result2.deleted??0),restored:undone.restored+(result2.restored??0),reinserted:undone.reinserted+(result2.reinserted??0)}}})}catch(error3){let message=failure??(error3 instanceof Error?error3.message:"The undo could not be completed.");return fail4(set2,500,`${message} Nothing was undone \u2014 every table was rolled back together.`)}let result={ok:!0,...undone,conflicts:ops.conflicts.length},finished=ops.conflicts.length===0,runsTable=tableFor(repoDeps,"integration_runs");if(runsTable&&finished){let{eq:eq36}=await import("drizzle-orm");await repoDeps.db.update(runsTable).set({status:"reverted",revertedAt:new Date,revertedBy:userId}).where(eq36(runsTable.id,params.id))}return{isSuccess:!0,message:finished?"The import was undone.":`Undone except for ${ops.conflicts.length} record(s) edited since the import. They were left as they are \u2014 send force: true to overwrite them too.`,data:{deleted:result.deleted,restored:result.restored,reinserted:result.reinserted,conflicts:ops.conflicts}}}}),routePutSourcesIdCredentials=defineRoute({method:"PUT",path:"/sources/:id/credentials",body:Type.Object({token:Type.Optional(Type.String()),oauthClientSecret:Type.Optional(Type.String()),oauthPassword:Type.Optional(Type.String())}),detail:{tags:["Integrations"],summary:"Store a source credential; only a masked preview is returned"},handler:async({params,body,set:set2})=>{let repoDeps=deps();if(!repoDeps)return fail4(set2,503,"The database is not available.");let key2=getEncryptionKey();if(!key2)return fail4(set2,503,"No encryption key is configured, so a credential stored now could never be read back.");let table=tableFor(repoDeps,"integration_sources");if(!table)return fail4(set2,503,"The integration tables are not present in this schema.");let patch={},hints={},apply=(value2,column,hintColumn,name2)=>{if(value2===void 0)return;let trimmed=value2.trim();if(trimmed===""){patch[column]=null,patch[hintColumn]=null,hints[name2]=null;return}patch[column]=encryptSecret(trimmed,key2),patch[hintColumn]=previewOf(trimmed),hints[name2]=previewOf(trimmed)};if(apply(body.token,"authTokenEncrypted","authTokenHint","token"),apply(body.oauthClientSecret,"oauthClientSecretEncrypted","oauthClientSecretHint","clientSecret"),apply(body.oauthPassword,"oauthPasswordEncrypted","oauthPasswordHint","password"),Object.keys(patch).length===0)return{isSuccess:!0,message:"Nothing to change.",data:{hints}};let{eq:eq36}=await import("drizzle-orm");return await repoDeps.db.update(table).set({...patch,updatedAt:new Date}).where(eq36(table.id,params.id)),tokenCache.invalidate(params.id),{isSuccess:!0,message:"Saved.",data:{hints}}}});logger2.info(`[Integrations] Routes enabled at ${basePath}`);let declared=[routePostRuns,routeGetSourcesIdExport,routePostImport,routePostRunsIdCancel,routePostRunsIdRevert,routePutSourcesIdCredentials,...inspectRoutes];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function parseDuration(value2){if(!value2)return;let match=value2.trim().match(/^(\d+)\s*([smhd])$/i);if(!match)return;let amount=Number(match[1]),unit=(match[2]??"d").toLowerCase();return amount*(unit==="s"?1000:unit==="m"?60000:unit==="h"?3600000:86400000)}init_esm3();init_routeCollector();init_adminGuard();var STREAM_HEADERS={"Content-Type":"text/event-stream; charset=utf-8","Cache-Control":"no-cache, no-transform",Connection:"keep-alive"},textEncoder=new TextEncoder,encodeEvent=(event,data)=>{let payload=typeof data==="string"?data:JSON.stringify(data);return textEncoder.encode(`event: ${event}
 data: ${payload}
-`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard2({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();var CHANNELS=["portal","email","telegram","webhook"];function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0,type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},body:Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))}),detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual3}from"crypto";init_ack_manager();var DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let clients=new Map,presenceBroadcastDebounce=new Map,{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}function sweepStaleClients(){let payload=JSON.stringify({type:"ping",data:{at:Date.now()}}),dropped=0,checked=clients.size;for(let[clientId,client]of[...clients])try{client.ws.send(payload)}catch{clients.delete(clientId),dropped++}return{checked,dropped}}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sweepStaleClients,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual3(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{let{checked,dropped}=clientManager.sweepStaleClients();if(dropped>0)logger2.info("[PubSub] Dropped clients whose socket no longer accepts a write",{checked,dropped,remaining:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text3=await request.text();eventData=JSON.parse(text3)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text3=await response.text(),json={};try{json=JSON.parse(text3)}catch{json=Object.fromEntries(new URLSearchParams(text3))}return{status:response.status,json,text:text3}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;if((contentType||"").toLowerCase().includes("application/x-www-form-urlencoded"))try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}return}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}function requiredBodyCeiling(input){if(!input.storageEnabled)return null;let perFile=input.maxFileSizeBytes;if(!perFile||!Number.isFinite(perFile)||perFile<=0)return null;let files=Math.max(1,Math.floor(input.maxFiles??1));return perFile*files+8388608}function bodyCeilingComplaint(input){if(input.required===null)return null;if((input.configured??134217728)>=input.required)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,source=input.configured==null?`the host passed no \`serve.maxRequestBodySize\`, so Bun's default of ${mb2(134217728)} applies`:`the host passed ${mb2(input.configured)}`;return`Uploads are configured up to ${mb2(input.required)}, but ${source}. `+"Anything larger is refused by the server before this application sees it \u2014 "+`the upload appears to run and then fails with nothing to show. Fix: raise \`storage.maxFileSizeBytes\` / \`security.maxRequestBodyBytes\` in the config, or pass \`maxRequestBodyBytes\` to \`createNucleusServer\`. The server needs ${input.required} bytes of headroom.`}function bunBodyCeilingFor(input){let wanted=Math.max(input.storageRequired??0,input.guardCeiling??0);return wanted>134217728?wanted:void 0}var APP_BASELINE_BYTES=268435456,COPIES_IN_FLIGHT=2;function memoryCeilingComplaint(input){if(input.required===null||input.cgroupLimit===null||input.cgroupLimit<=0)return null;let needed=input.required*COPIES_IN_FLIGHT+APP_BASELINE_BYTES;if(input.cgroupLimit>=needed)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,affordable=Math.max(0,Math.floor((input.cgroupLimit-APP_BASELINE_BYTES)/COPIES_IN_FLIGHT));return`Uploads are configured up to ${mb2(input.required)}, but this container is capped at ${mb2(input.cgroupLimit)} and an upload is held in memory twice on top of the ~${mb2(APP_BASELINE_BYTES)} `+`the app already holds \u2014 it needs ~${mb2(needed)}. The kernel will kill the process mid-upload. Fix: raise the container's memory limit to at least ${mb2(needed)}, or lower storage.maxFileSizeBytes to about ${mb2(affordable)}.`}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=socketIp?.trim()||"",chain=(forwardedFor||"").split(",").map((s)=>s.trim()).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq37=trimmed.indexOf("=");if(eq37>0)out[trimmed.slice(0,eq37)]=trimmed.slice(eq37+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){let out={};return headers.forEach((value2,key2)=>{out[key2]=SENSITIVE_HEADER_NAMES.has(key2.toLowerCase())?"[REDACTED]":value2}),out}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq37}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq37(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();import{eq as eq38}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log3=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq38(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq38(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(db,tenantRegistry,userId)=>{let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq38(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry3)=>{let schemaNames=registry3.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry3.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();import{eq as eq39}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log3=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};if(!(await db.select().from(usersTable).where(eq39(col11(usersTable,"id"),requestingUserId)).limit(1))[0]?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq39(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log3.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq39(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_passwordPolicy();init_utils6();import{eq as eq40}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log3=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log3.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq40(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq40(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let strength=validateAgainstPolicy(body.password,void 0,body.email);if(!strength.valid)return ctx.set.status=400,{success:!1,message:"Password too weak",errors:strength.errors};let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq40(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log3.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq40(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log3.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log3.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log3.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq40(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log3.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq40(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_routeCollector();init_adminGuard();init_buildServices();function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,{verificationService:defaultVerificationService,notificationService:defaultNotificationService}=buildVerificationServices({db,schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService}),getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};return buildVerificationServices({db,schemaTables:ctx.schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService})},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},mayStartFor=(request,entityName)=>{if(hasGodminRole(request))return!0;let claims=decodeHeaderList(request.headers.get("x-user-claims"));if(claims.length===0)return!1;let wanted=new Set;for(let name2 of bothSpellings(entityName))for(let verb of["post","patch","put"])wanted.add(`${verb}.${name2}`);return claims.some((c)=>{for(let w of wanted)if(c===w||c.startsWith(`${w}.`))return!0;return!1})},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff})},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request,set:set2})=>{if(!hasGodminRole(request))return set2.status=403,{success:!1,message:"Forbidden: operator privileges required"};let{verificationService}=getServicesForRequest(request);return{success:!0,data:await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0})}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[];if(config.endpoints?.enabled!==!1)groups.push({prefix:basePath,guards:[requireUser],routes:verificationDeclared}),logger2.info(`[Verification] Routes registered at ${basePath}`);else logger2.info("[Verification] endpoints.enabled is false; review routes not mounted");if(config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,message:"Flow not found"};return{success:!0,data:result}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())})})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/:flow_id/unpublish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.unpublishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard2({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}function unappliedSettings(config,swagger){let notes=[],say=(option,reality)=>notes.push(`${option} \u2014 ${reality}`);if(swagger?.provider&&swagger.provider!=="scalar")say(`swagger.provider: '${swagger.provider}'`,"only the Scalar viewer is shipped; the document itself is unaffected");if(swagger?.excludeStaticFile!==void 0)say("swagger.excludeStaticFile","nothing distinguishes a static-asset route from any other, so no route is excluded by it. Use `swagger.exclude` to name paths");let pubsub=config.pubsub;if(pubsub?.pubsubName)say("pubsub.pubsubName","names a Dapr component for a publish call this build never makes; realtime delivery goes straight to the connected sockets");if(pubsub?.ack?.retryIntervalMs!==void 0)say("pubsub.ack.retryIntervalMs","there is no interval-based retry loop; unacknowledged messages are redelivered when a client reconnects");if(config.domains?.cloudflare?.fallbackOrigin)say("domains.cloudflare.fallbackOrigin","never sent to Cloudflare; set the fallback origin on the zone itself");if(config.domains?.verification?.defaultMethod&&config.domains.verification.defaultMethod!=="txt")say(`domains.verification.defaultMethod: '${config.domains.verification.defaultMethod}'`,"ownership is always proved with a TXT record; cname and http are not implemented");if(config.database?.type)say("database.type","Postgres is the only engine this build talks to");let schemas=config.database?.schemas;if(Array.isArray(schemas)&&schemas.length>1)say(`database.schemas (${schemas.length} named)`,`only the first is used (\`${schemas[0]}\`); the rest are ignored`);let verification=config.authentication?.register?.emailVerification;if(verification?.provider)say(`authentication.register.emailVerification.provider: '${verification.provider}'`,"the sender is chosen globally from the `email` config and the secrets store, not per mail");let templates=verification?.templates,withTemplatePath=Object.entries(templates??{}).filter(([,t])=>t?.htmlTemplatePath).map(([name2])=>name2);if(withTemplatePath.length>0)say(`authentication.register.emailVerification.templates.${withTemplatePath.join("/")}.htmlTemplatePath`,"the mail bodies are built in code; only `subject` is taken from this config");return notes}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text3=asText(path7);if(!text3)return;return text3.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text3=asText(raw);if(!text3)return"Invalid request";let payload;try{payload=JSON.parse(text3)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column)=>({name:column.name,type:column.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})});if(mountRoutes(plugin,[{routes:[routeGetHealth]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
+`)};function parseTimeToMs2(time2){let match=time2.match(/^(\d+)(ms|s|m|h)$/);if(!match?.[1]||!match[2])return 5000;let value2=parseInt(match[1],10);switch(match[2]){case"ms":return value2;case"s":return value2*1000;case"m":return value2*60*1000;case"h":return value2*60*60*1000;default:return 5000}}function createMonitoringRoutes(config){let{getService,logger:logger2,endpoints,db,schemaTables}=config,snapshotOrNull=async()=>await getService()?.getLatestSnapshot()??null,alertsOrEmpty=()=>getService()?.getActiveAlerts()??[],guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"monitoring",{allowRoles:endpoints.allowRoles}),mount=(routes2)=>collectRoutes([{prefix:endpoints.basePath,guards:[guard4],routes:routes2}]);if(!endpoints.enabled)return mount([]);logger2.info(`[Monitoring] Routes enabled at ${endpoints.basePath} (stream: ${endpoints.stream.enabled}, snapshot: ${endpoints.snapshot.enabled}, history: ${endpoints.history.enabled}, alerts: ${endpoints.alerts.enabled})`);let routes=[];if(endpoints.stream.enabled)routes.push(defineRoute({method:"GET",path:endpoints.stream.path,handler:({request})=>{let intervalMs=parseTimeToMs2(endpoints.stream.interval),abortSignal=request.signal;logger2.info("[Monitoring] SSE stream connected");let cleanup,stream=new ReadableStream({start(controller){let closed=!1,send=(event,data)=>{if(closed)return;controller.enqueue(encodeEvent(event,data))},cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(timer),abortSignal?.removeEventListener("abort",cleanupHandler),logger2.info("[Monitoring] SSE stream disconnected");try{controller.close()}catch{}};cleanup=cleanupHandler;let tick=async()=>{if(closed)return;let snapshot=await snapshotOrNull();if(snapshot)send("snapshot",snapshot);let alerts=alertsOrEmpty();if(alerts.length>0)send("alerts",alerts)},timer=setInterval(tick,intervalMs);abortSignal?.addEventListener("abort",cleanupHandler),send("open",{interval:intervalMs}),tick()},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Monitoring"],summary:"Stream real-time monitoring data",description:"Server-Sent Events stream for real-time monitoring metrics"}}));if(endpoints.snapshot.enabled)routes.push(defineRoute({method:"GET",path:endpoints.snapshot.path,handler:async()=>{let snapshot=await snapshotOrNull();if(!snapshot)return{isSuccess:!0,message:"No monitoring data available yet",data:null};return{isSuccess:!0,message:"Current monitoring snapshot",data:snapshot}},detail:{tags:["Monitoring"],summary:"Get current monitoring snapshot",description:"Returns the latest monitoring metrics snapshot"}}));if(endpoints.history.enabled)routes.push(defineRoute({method:"GET",path:endpoints.history.path,handler:async({query})=>{let minutes=Math.min(query.minutes?parseInt(String(query.minutes),10):60,endpoints.history.maxMinutes),history=await getService()?.getHistory(minutes)??[];return{isSuccess:!0,message:`Monitoring history for last ${minutes} minutes`,data:{minutes,count:history.length,snapshots:history}}},query:Type.Object({minutes:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Get monitoring history",description:"Returns historical monitoring data for the specified time range"}}));if(endpoints.alerts.enabled)routes.push(defineRoute({method:"GET",path:endpoints.alerts.path,handler:()=>{let alerts=alertsOrEmpty();return{isSuccess:!0,message:"Active alerts",data:{count:alerts.length,alerts}}},detail:{tags:["Monitoring"],summary:"Get active alerts",description:"Returns all currently active monitoring alerts"}})),routes.push(defineRoute({method:"POST",path:`${endpoints.alerts.path}/:alertId/acknowledge`,handler:({params,set:set2})=>{let service=getService();if(!service)return set2.status=503,{isSuccess:!1,message:"Monitoring service is not available",data:null};if(!service.acknowledgeAlert(params.alertId))return set2.status=404,{isSuccess:!1,message:"Alert not found",data:null};return{isSuccess:!0,message:"Alert acknowledged",data:{alertId:params.alertId}}},params:Type.Object({alertId:Type.String()}),detail:{tags:["Monitoring"],summary:"Acknowledge an alert",description:"Mark an alert as acknowledged"}}));return mount(routes)}init_esm3();init_routeCollector();init_adminGuard();function createLiveMonitoringRoutes(config){let{getService,getLifecycleRecorder,logger:logger2,basePath,streamInterval,db,schemaTables}=config,guard4=createGodminGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"live monitoring"),requireService=()=>{let svc=getService();if(!svc)throw Error("Live monitoring service not initialized");return svc};logger2.info(`[LiveMonitoring] Routes enabled at ${basePath} (stream interval: ${streamInterval}ms)`);let routes=[defineRoute({method:"GET",path:"/health",handler:()=>{let svc=getService();return{status:svc?"ok":"initializing",timestamp:Date.now(),monitoring:svc?.isEnabled()??!1}},detail:{tags:["Live Monitoring"],summary:"Health check for live monitoring"}}),defineRoute({method:"GET",path:"/settings",handler:()=>{return requireService().getSettings()},detail:{tags:["Live Monitoring"],summary:"Get live monitoring settings"}}),defineRoute({method:"PATCH",path:"/settings",handler:({body})=>{return requireService().changeSettings(body)},body:Type.Partial(Type.Object({logMemory:Type.Boolean(),logCpu:Type.Boolean(),logDapr:Type.Boolean(),logWebSocket:Type.Boolean(),memoryLogInterval:Type.Number(),cpuLogInterval:Type.Number(),memoryLogLimit:Type.Number(),cpuLogLimit:Type.Number(),daprLogLimit:Type.Number(),wsLogLimit:Type.Number(),requestLogLimit:Type.Number()})),detail:{tags:["Live Monitoring"],summary:"Change live monitoring settings"}}),defineRoute({method:"GET",path:"/incidents",handler:async({query})=>{let raw=Number(query?.limit),limit=Number.isFinite(raw)&&raw>0?Math.min(raw,50):20,recorder=getLifecycleRecorder?.();if(!recorder)return{available:!1,incidents:[]};return{available:!0,incidents:await recorder.incidents(limit)}},query:Type.Optional(Type.Object({limit:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Why previous runs of this process ended"}}),defineRoute({method:"GET",path:"/realtime",handler:({query})=>{let raw=Number(query?.windowMinutes),minutes=Number.isFinite(raw)&&raw>0?Math.min(raw,1440):void 0;return requireService().getRealtimeHealth(minutes?minutes*60000:void 0)},query:Type.Optional(Type.Object({windowMinutes:Type.Optional(Type.String())})),detail:{tags:["Live Monitoring"],summary:"Realtime (WebSocket) health digest"}}),defineRoute({method:"GET",path:"/logs",handler:()=>{return requireService().getLogs()},detail:{tags:["Live Monitoring"],summary:"Get all live monitoring logs"}}),defineRoute({method:"GET",path:"/logs/stream",handler:({request})=>{let abortSignal=request.signal,cleanup,svc=requireService(),snapshot=svc.getSnapshot(),lastTimestamps={memory:snapshot.memory.length?snapshot.memory[snapshot.memory.length-1]?.timestamp??0:0,cpu:snapshot.cpu.length?snapshot.cpu[snapshot.cpu.length-1]?.timestamp??0:0,request:snapshot.requests.length?snapshot.requests[snapshot.requests.length-1]?.timestamp??0:0,dapr:snapshot.dapr.length?snapshot.dapr[snapshot.dapr.length-1]?.timestamp??0:0,ws:snapshot.ws.length?snapshot.ws[snapshot.ws.length-1]?.timestamp??0:0},stream=new ReadableStream({start(controller){let closed=!1;controller.enqueue(encodeEvent("snapshot",snapshot));let interval=setInterval(()=>{if(closed)return;let update=svc.getUpdatesSince(lastTimestamps);if(!update){controller.enqueue(encodeEvent("heartbeat",{timestamp:Date.now()}));return}if(update.memory.length)lastTimestamps.memory=update.memory[update.memory.length-1]?.timestamp??lastTimestamps.memory;if(update.cpu.length)lastTimestamps.cpu=update.cpu[update.cpu.length-1]?.timestamp??lastTimestamps.cpu;if(update.requests.length)lastTimestamps.request=update.requests[update.requests.length-1]?.timestamp??lastTimestamps.request;if(update.dapr.length)lastTimestamps.dapr=update.dapr[update.dapr.length-1]?.timestamp??lastTimestamps.dapr;if(update.ws.length)lastTimestamps.ws=update.ws[update.ws.length-1]?.timestamp??lastTimestamps.ws;controller.enqueue(encodeEvent("update",update))},streamInterval),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(interval),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},detail:{tags:["Live Monitoring"],summary:"Stream real-time live monitoring data via SSE"}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_routeCollector();init_adminGuard();var LOG_LEVELS=["debug","info","warn","error","fatal"],SOURCES=["logger","stdout","stderr"];function parseLevels(raw){if(!raw)return;let parsed=raw.split(",").map((value2)=>value2.trim().toLowerCase()).filter((value2)=>LOG_LEVELS.includes(value2));return parsed.length>0?parsed:void 0}function parseSource(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return SOURCES.includes(value2)?value2:void 0}function parseMinLevel(raw){if(!raw)return;let value2=raw.trim().toLowerCase();return LOG_LEVELS.includes(value2)?value2:void 0}function parseCursor(raw){if(raw===void 0||raw===null||raw==="")return;let value2=Number(raw);return Number.isFinite(value2)&&value2>=0?value2:void 0}function buildQuery(query){return{levels:parseLevels(query.levels),minLevel:parseMinLevel(query.minLevel),scope:query.scope?.trim()||void 0,search:query.search||void 0,source:parseSource(query.source),after:parseCursor(query.after),before:parseCursor(query.before),limit:parseCursor(query.limit)}}var STREAM_KEEPALIVE_MS=25000;function createServerLogRoutes(config){let{buffer,logger:logger2,basePath,path:path7,allowRoles,streamEnabled=!0,clearEnabled=!0,db,schemaTables}=config,guard4=createPrivilegedGuard({db:db??null,schemaTables:schemaTables??{},logger:logger2},"server logs",{allowRoles}),routes=[defineRoute({method:"GET",path:path7,handler:({query})=>{return{isSuccess:!0,message:"Server logs",data:{...buffer.query(buildQuery(query)),scopes:buffer.scopes(),levelCounts:buffer.levelCounts()}}},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number()),before:Type.Optional(Type.Number()),limit:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Read buffered server logs",description:"Filtered, cursor-paged view of the in-memory server log buffer. Use `after` to tail forward and `before` to page backwards."}})];if(streamEnabled)routes.push(defineRoute({method:"GET",path:`${path7}/stream`,handler:({request,query})=>{let tailQuery=buildQuery(query),{after,before:_before,limit:_limit,...filter}=tailQuery,abortSignal=request.signal,cleanup,stream=new ReadableStream({start(controller){let closed=!1,backlog=buffer.query({...filter,...after!==void 0?{after}:{},limit:200});controller.enqueue(encodeEvent("backlog",backlog));let unsubscribe=buffer.subscribe((record3)=>{if(closed)return;if(!buffer.query({...filter,after:record3.seq-1,limit:1}).records.some((r)=>r.seq===record3.seq))return;try{controller.enqueue(encodeEvent("logs",[record3]))}catch{cleanup?.()}}),heartbeat=setInterval(()=>{if(closed)return;try{controller.enqueue(encodeEvent("ping",{timestamp:Date.now()}))}catch{cleanup?.()}},STREAM_KEEPALIVE_MS),cleanupHandler=()=>{if(closed)return;closed=!0,clearInterval(heartbeat),unsubscribe(),abortSignal?.removeEventListener("abort",cleanupHandler);try{controller.close()}catch{}};cleanup=cleanupHandler,abortSignal?.addEventListener("abort",cleanupHandler)},cancel(){cleanup?.()}});return new Response(stream,{headers:STREAM_HEADERS})},query:Type.Object({levels:Type.Optional(Type.String()),minLevel:Type.Optional(Type.String()),scope:Type.Optional(Type.String()),search:Type.Optional(Type.String()),source:Type.Optional(Type.String()),after:Type.Optional(Type.Number())}),detail:{tags:["Monitoring"],summary:"Tail server logs",description:"Server-Sent Events tail of the server log buffer, filtered server-side."}}));if(clearEnabled)routes.push(defineRoute({method:"DELETE",path:path7,handler:()=>{return buffer.clear(),logger2.info("[ServerLogs] Buffer cleared from the admin panel"),{isSuccess:!0,message:"Server log buffer cleared",data:null}},detail:{tags:["Monitoring"],summary:"Clear the server log buffer"}}));return logger2.info(`[ServerLogs] Routes enabled at ${basePath}${path7} (capacity: ${buffer.getCapacity()}, stream: ${streamEnabled})`),collectRoutes([{prefix:basePath,guards:[guard4],routes}])}init_esm3();init_Notification();init_routeCollector();init_adminGuard();var CHANNELS=["portal","email","telegram","webhook"];function createNotificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry,getEmailService}=routeConfig,basePath=routeConfig.basePath||config.endpoints?.basePath||"/notifications",buildService=(tables)=>new NotificationService({db,schemaTables:tables,config,logger:logger2,getEmailService}),defaultService=buildService(schemaTables),serviceFor=(request)=>{if(!tenantRegistry)return defaultService;let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return defaultService;let ctx=tenantRegistry.getSchemaContext(schemaName);return ctx?buildService(ctx.schemaTables):defaultService},allowedSendRoles=new Set((config.endpoints?.sendRoles??[]).map((role)=>role.toLowerCase())),canSend=async(request)=>{if(allowedSendRoles.size>0){if(decodeHeaderList(request.headers.get("x-user-roles")).some((role)=>allowedSendRoles.has(role.toLowerCase())))return!0}return isGodminRequest(request,{db,schemaTables,logger:logger2})},requireUser=(request,set2)=>{let userId=request.headers.get("x-user-id");if(!userId)return set2.status=401,null;return userId},declared=[defineRoute({method:"GET",path:"/",handler:async({request,query,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:await serviceFor(request).getNotifications(userId,{limit:query.limit?Number(query.limit):void 0,offset:query.offset?Number(query.offset):void 0,type:query.type||void 0})}},query:Type.Object({limit:Type.Optional(Type.String()),offset:Type.Optional(Type.String()),type:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"List the caller\u2019s notifications"}}),defineRoute({method:"GET",path:"/unseen-count",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).getUnseenCount(userId)}}},detail:{tags:["Notifications"],summary:"Unseen notification count"}}),defineRoute({method:"POST",path:"/:notification_id/seen",handler:async({params,request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};if(!await serviceFor(request).markAsSeen(params.notification_id,userId))return set2.status=404,{success:!1,message:"Notification not found"};return{success:!0,message:"Marked as seen"}},params:Type.Object({notification_id:Type.String()}),detail:{tags:["Notifications"],summary:"Mark one notification as seen"}}),defineRoute({method:"POST",path:"/seen-all",handler:async({request,set:set2})=>{let userId=requireUser(request,set2);if(!userId)return{success:!1,message:"User ID required"};return{success:!0,data:{count:await serviceFor(request).markAllAsSeen(userId)}}},detail:{tags:["Notifications"],summary:"Mark every notification as seen"}}),defineRoute({method:"POST",path:"/send",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending notifications requires godmin or an allowed role"};let recipients=body.userIds??(body.userId?[body.userId]:[]);if(recipients.length===0)return set2.status=400,{success:!1,message:"userId or userIds is required"};let channels=body.channels??[config.defaultChannel??"portal"],service=serviceFor(request),failed=(await Promise.allSettled(recipients.map((user_id)=>service.send({user_id,title:body.title,body:body.body,entity_name:body.entityName,entity_id:body.entityId,type:body.type??"custom",source:body.source,channels})))).map((result,index)=>{let userId=recipients[index];if(result.status==="rejected"){let reason=result.reason;return{userId,sent:!1,reason:reason instanceof Error?reason.message:String(reason)}}if(result.value.delivered.length>0)return{userId,sent:!0,reason:""};return{userId,sent:!1,reason:result.value.undelivered.map((one)=>`${one.channel}: ${one.reason}`).join("; ")||"no channel was requested"}}).filter((one)=>!one.sent),sentCount=recipients.length-failed.length,reasons=[...new Set(failed.map((one)=>one.reason))].join("; ");if(sentCount===0)set2.status=503;return{success:failed.length===0,message:failed.length===0?`Sent to ${recipients.length} recipient(s)`:`Sent to ${sentCount}, failed for ${failed.length}: ${reasons}`,data:{sent:sentCount,failed:failed.map((one)=>one.userId)}}},body:Type.Object({userId:Type.Optional(Type.String()),userIds:Type.Optional(Type.Array(Type.String())),title:Type.String(),body:Type.Optional(Type.String()),entityName:Type.Optional(Type.String()),entityId:Type.Optional(Type.String()),type:Type.Optional(Type.Union([Type.Literal("verification"),Type.Literal("system"),Type.Literal("custom")])),source:Type.Optional(Type.String()),channels:Type.Optional(Type.Array(Type.Union(CHANNELS.map((c)=>Type.Literal(c)))))}),detail:{tags:["Notifications"],summary:"Send a notification to one or more users",description:"Privileged. Delivers over the requested channels (portal, email, telegram, webhook). Email uses the configured provider \u2014 credentials resolve through the secrets store, so a rotation applies immediately."}}),defineRoute({method:"POST",path:"/email",handler:async({body,request,set:set2})=>{if(!requireUser(request,set2))return{success:!1,message:"Authentication required"};if(!await canSend(request))return set2.status=403,{success:!1,message:"Sending email requires godmin or an allowed role"};let emailService=getEmailService?.()??null;if(!emailService?.isAvailable())return set2.status=503,{success:!1,message:"No email provider is configured or available"};let result=await emailService.sendEmail({to:body.to,subject:body.subject,html:body.html,text:body.text,replyTo:body.replyTo});if(!result.success)return set2.status=502,{success:!1,message:result.error??"Email delivery failed"};return logger2.info("[Notification] Transactional email sent",{recipients:Array.isArray(body.to)?body.to.length:1,subject:body.subject}),{success:!0,message:"Email sent",data:null}},body:Type.Object({to:Type.Union([Type.String(),Type.Array(Type.String())]),subject:Type.String(),html:Type.Optional(Type.String()),text:Type.Optional(Type.String()),replyTo:Type.Optional(Type.String())}),detail:{tags:["Notifications"],summary:"Send a transactional email to explicit recipients",description:"Backend-to-backend send through the configured provider \u2014 an app never needs an email SDK or the provider credentials of its own. Privileged, same gate as /send."}})];return{routes:collectRoutes([{prefix:basePath,routes:declared}]),notificationService:defaultService}}init_routeCollector();init_routeRecording();init_websocket();init_ack_manager();import{timingSafeEqual as timingSafeEqual3}from"crypto";init_ack_manager();var DEFAULT_MAX_TOPICS_PER_CLIENT=512;function createClientManager(config){let clients=new Map,presenceBroadcastDebounce=new Map,{redis,logger:logger2}=config,ackTtl=config.ack.ttlSeconds,ackEnabled=config.ack.enabled,maxRetries=config.ack.maxRetries,presenceEnabled=config.presence.enabled,presenceDebounceMs=config.presence.debounceMs,maxClientsPerUser=config.maxClientsPerUser,maxTopicsPerClient=config.maxTopicsPerClient??DEFAULT_MAX_TOPICS_PER_CLIENT,MAX_TOPIC_LENGTH=256;function generateClientId(){return`client_${Date.now()}_${Math.random().toString(36).substring(2,9)}`}function capTopics(topics){let accepted=[],dropped=[],seen=new Set;for(let t of topics){if(typeof t!=="string")continue;let trimmed=t.length>256?t.slice(0,256):t;if(seen.has(trimmed))continue;if(seen.add(trimmed),accepted.length>=maxTopicsPerClient){dropped.push(trimmed);continue}accepted.push(trimmed)}return{accepted,dropped}}function reportDropped(context,clientId,userId,dropped){if(dropped.length===0)return;logger2.warn("[PubSub] Topic subscription capped \u2014 events for these will NOT be delivered",{context,clientId,userId,cap:maxTopicsPerClient,droppedCount:dropped.length,dropped})}function registerClient(clientId,ws,userId,topics){let existingClients=getClientsByUser(userId);if(existingClients.length>=maxClientsPerUser){let oldestClientId=existingClients[0];if(oldestClientId)logger2.info("[PubSub] Max clients reached, closing oldest",{userId,oldestClientId}),unregisterClient(oldestClientId)}let{accepted,dropped}=capTopics(topics);return clients.set(clientId,{ws,userId,subscribedTopics:new Set(accepted),connectedAt:Date.now(),pendingAcks:new Map}),logger2.info("[PubSub] Client registered",{clientId,userId,topics:accepted,requestedCount:topics.length,subscribedCount:accepted.length,totalClients:clients.size}),reportDropped("registerClient",clientId,userId,dropped),{accepted,dropped}}function unregisterClient(clientId){let client=clients.get(clientId);if(!client)return;let userId=client.userId;if(clients.delete(clientId),logger2.info("[PubSub] Client unregistered",{clientId,userId,totalClients:clients.size}),presenceEnabled&&userId){if(getClientsByUser(userId).length===0)broadcastPresenceToOthers(userId,"offline")}}function updateClientTopics(clientId,topics){let client=clients.get(clientId);if(!client)return{accepted:[],dropped:[]};let{accepted,dropped}=capTopics(topics);return client.subscribedTopics=new Set(accepted),reportDropped("updateClientTopics",clientId,client.userId,dropped),{accepted,dropped}}function getClientsByUser(userId){let result=[];for(let[clientId,client]of clients)if(client.userId===userId)result.push(clientId);return result}function getConnectedUserIds(){let userIds=new Set;for(let[,client]of clients)if(client.userId)userIds.add(client.userId);return userIds}function getClientCount(){return clients.size}function sendToClient(clientId,message){let client=clients.get(clientId);if(!client)return!1;try{return client.ws.send(JSON.stringify(message)),!0}catch{return clients.delete(clientId),!1}}function broadcastEvent(topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0;for(let[clientId,client]of clients)if(client.subscribedTopics.has("*")||client.subscribedTopics.has(topic))try{if(client.ws.send(payload),sentCount++,ackEnabled){if(client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent(),client.userId)storePendingMessage(redis,{messageId,topic,clientId,userId:client.userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{})}}catch{clients.delete(clientId)}logger2.info("[PubSub] Broadcasted event",{topic,messageId,sentCount})}function broadcastToUser(userId,topic,event){let messageId=generateMessageId(),timestamp=Date.now(),payload=JSON.stringify({type:"event",messageId:ackEnabled?messageId:void 0,topic,data:event,timestamp}),sentCount=0,sentToAnyClient=!1;for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{if(client.ws.send(payload),sentCount++,sentToAnyClient=!0,ackEnabled)client.pendingAcks.set(messageId,{sentAt:timestamp,retryCount:0}),recordSent()}catch{clients.delete(clientId)}}if(ackEnabled)storePendingMessage(redis,{messageId,topic,clientId:sentToAnyClient?"delivered":"pending",userId,data:event,sentAt:timestamp,retryCount:0,maxRetries},ackTtl).catch(()=>{});logger2.info("[PubSub] Broadcasted to user",{userId,topic,messageId,sentCount,storedForOffline:!sentToAnyClient})}function broadcastToUserNoAck(userId,topic,event){let timestamp=Date.now(),payload=JSON.stringify({type:"event",topic,data:event,timestamp});for(let[clientId,client]of clients){if(client.userId!==userId)continue;if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(topic))continue;try{client.ws.send(payload)}catch{clients.delete(clientId)}}}function broadcastPresenceToOthers(userId,status){let debounceKey=`${userId}:${status}`,now=Date.now(),lastBroadcast=presenceBroadcastDebounce.get(debounceKey);if(lastBroadcast&&now-lastBroadcast<presenceDebounceMs)return;if(presenceBroadcastDebounce.set(debounceKey,now),presenceBroadcastDebounce.size>1000){let cutoff=now-presenceDebounceMs*2;for(let[key2,timestamp]of presenceBroadcastDebounce)if(timestamp<cutoff)presenceBroadcastDebounce.delete(key2)}let connectedUserIds=getConnectedUserIds();for(let targetUserId of connectedUserIds)if(targetUserId!==userId)broadcastToUserNoAck(targetUserId,"user-presence",{type:"user-presence",data:{userId,status}})}async function handleClientAck(clientId,messageId){if(!ackEnabled)return!0;let client=clients.get(clientId);if(!client)return!1;if(client.pendingAcks.get(messageId))client.pendingAcks.delete(messageId);if(client.userId)return acknowledgeMessage(redis,client.userId,messageId,ackTtl);return!0}async function deliverPendingMessages(userId,clientId){if(!ackEnabled)return 0;let client=clients.get(clientId);if(!client||client.userId!==userId)return 0;let pendingMessages=await getPendingMessagesForUser(redis,userId);if(pendingMessages.length===0)return 0;logger2.info("[PubSub] Delivering pending messages",{userId,count:pendingMessages.length});let deliveredCount=0;for(let message of pendingMessages){if(!client.subscribedTopics.has("*")&&!client.subscribedTopics.has(message.topic))continue;let payload=JSON.stringify({type:"event",messageId:message.messageId,topic:message.topic,data:message.data,timestamp:message.sentAt,isRedelivery:!0});try{client.ws.send(payload),client.pendingAcks.set(message.messageId,{sentAt:Date.now(),retryCount:message.retryCount+1}),await incrementRetryCount(redis,userId,message.messageId,ackTtl,maxRetries),deliveredCount++}catch{break}}return deliveredCount}function sweepStaleClients(){let payload=JSON.stringify({type:"ping",data:{at:Date.now()}}),dropped=0,checked=clients.size;for(let[clientId,client]of[...clients])try{client.ws.send(payload)}catch{clients.delete(clientId),dropped++}return{checked,dropped}}return{generateClientId,registerClient,unregisterClient,updateClientTopics,getClientsByUser,getConnectedUserIds,getClientCount,sweepStaleClients,sendToClient,broadcastEvent,broadcastToUser,broadcastToUserNoAck,broadcastPresenceToOthers,handleClientAck,deliverPendingMessages,getPendingMessageCount:(userId)=>getPendingMessageCount(redis,userId)}}var OPAQUE_RUN=/[A-Za-z0-9_-]{24,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g;function previewOf2(frame){return frame.slice(0,120).replace(OPAQUE_RUN,(match)=>`[redacted ${match.length} chars]`)}function classifyClientFrame(message){if(typeof message==="string"){if(message.trim()==="")return{kind:"ignore"};let parsed;try{parsed=JSON.parse(message)}catch{return{kind:"malformed",preview:previewOf2(message)}}return asMessage(parsed,message.length)}if(message&&typeof message==="object")return asMessage(message,approximateSize(message));return{kind:"ignore"}}function approximateSize(value2){if(ArrayBuffer.isView(value2))return value2.byteLength;if(value2 instanceof ArrayBuffer)return value2.byteLength;try{return JSON.stringify(value2)?.length??0}catch{return 0}}function asMessage(value2,size){if(!value2||typeof value2!=="object"||Array.isArray(value2))return{kind:"ignore"};let record3=value2,type4=record3.type;if(typeof type4!=="string"||type4==="")return{kind:"ignore"};return{kind:"message",parsed:record3,type:type4,size}}function tokensMatch(a,b){let ba=Buffer.from(a),bb=Buffer.from(b);if(ba.length!==bb.length)return!1;return timingSafeEqual3(ba,bb)}var HEARTBEAT_WS_TYPES=new Set(["ping","pong","ack"]);function buildHandshakeHeaders(rawHeaders,queryToken){let headers=new Headers;if(rawHeaders&&typeof rawHeaders==="object"){for(let[key2,value2]of Object.entries(rawHeaders))if(typeof value2==="string")headers.set(key2,value2)}if(queryToken)headers.set("authorization",`Bearer ${queryToken}`),headers.delete("cookie");return headers}function createPubSubRoutes(config){let{logger:logger2,getLiveMonitoringService}=config,clientManager=createClientManager(config);if(config.ack.enabled)initAckCleanup();let cleanupTimer=null,daprApiToken=config.daprApiToken||process.env.APP_API_TOKEN||process.env.DAPR_API_TOKEN,warnedNoDaprToken=!1;recordBootStep(()=>{if(config.cleanupIntervalMs>0)cleanupTimer=setInterval(()=>{let{checked,dropped}=clientManager.sweepStaleClients();if(dropped>0)logger2.info("[PubSub] Dropped clients whose socket no longer accepts a write",{checked,dropped,remaining:clientManager.getClientCount()})},config.cleanupIntervalMs);logger2.info("[PubSub] Routes initialized",{basePath:config.basePath,wsPath:config.wsPath,ackEnabled:config.ack.enabled,presenceEnabled:config.presence.enabled})}),recordShutdownStep(()=>{if(cleanupTimer)clearInterval(cleanupTimer),cleanupTimer=null});let routePostTopic=defineRoute({method:"POST",path:"/:topic",handler:async({params,body,request,set:set2})=>{let topic=params.topic;if(daprApiToken){let presented=request.headers.get("dapr-api-token")??"";if(!tokensMatch(presented,daprApiToken))return logger2.warn("[PubSub] Rejected Dapr event: missing/invalid dapr-api-token",{topic}),set2.status=403,{status:"DROP"}}else if(!warnedNoDaprToken)warnedNoDaprToken=!0,logger2.warn("[PubSub] Dapr subscription endpoint is UNAUTHENTICATED \u2014 set config.pubsub.daprApiToken or the APP_API_TOKEN/DAPR_API_TOKEN env so only the Dapr sidecar can inject events");let eventData;try{if(!body){let text3=await request.text();eventData=JSON.parse(text3)}else eventData=body}catch{return set2.status=200,{status:"DROP"}}logger2.info("[PubSub] Dapr event received",{topic,eventId:eventData.id,source:eventData.source});let userId=eventData.data?.user_id;if(userId)clientManager.broadcastToUser(userId,topic,eventData);else clientManager.broadcastEvent(topic,eventData);return getLiveMonitoringService?.()?.recordDaprEvent("pubsub_subscribe",{topic,success:!0,metadata:{eventId:eventData.id,source:eventData.source,userId:userId||null}}),set2.status=200,{status:"SUCCESS"}}}),routes=collectRoutes([{prefix:config.basePath,routes:[routePostTopic]}]),socketRoute=defineWebSocketRoute({path:config.wsPath,idleTimeout:config.wsIdleTimeout,async open(ws){let data=ws.data,query=data.query,userId;if(config.authenticate){let handshakeHeaders=buildHandshakeHeaders(data.headers,query.token),authResult=await config.authenticate(handshakeHeaders);if(!authResult||!("userId"in authResult)){let reason=authResult?.reason??"unspecified";ws.send(JSON.stringify({type:"error",error:"Unauthorized: a valid session is required for this connection",reason,timestamp:Date.now()})),ws.close(4001,`Unauthorized: ${reason}`),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:`Unauthorized WebSocket handshake: ${reason}`,metadata:{reason}});return}userId=authResult.userId}else userId=query.userId;if(!userId){ws.send(JSON.stringify({type:"error",error:"userId is required for WebSocket connection",timestamp:Date.now()})),ws.close(4001,"userId is required"),getLiveMonitoringService?.()?.recordWsEvent("error",{success:!1,error:"userId is required"});return}let clientId=clientManager.generateClientId(),topics=query.topics?.split(",").map((t)=>t.trim())||["*"];ws.data.clientId=clientId,ws.data.openedAt=Date.now();let registration=clientManager.registerClient(clientId,ws,userId,topics);if(ws.send(JSON.stringify({type:"connected",clientId,subscribedTopics:registration.accepted,...registration.dropped.length>0?{droppedTopics:registration.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})),getLiveMonitoringService?.()?.recordWsEvent("connection",{clientId,userId,topic:topics.join(","),success:!0}),config.presence.enabled)clientManager.broadcastPresenceToOthers(userId,"online");let connectedUserId=userId;if(config.ack.enabled&&connectedUserId)clientManager.getPendingMessageCount(connectedUserId).then((count2)=>{if(count2>0)logger2.info("[PubSub] Delivering pending messages",{userId:connectedUserId,count:count2}),clientManager.deliverPendingMessages(connectedUserId,clientId).catch(()=>{})}).catch(()=>{})},message(ws,message){let clientId=ws.data.clientId,frame=classifyClientFrame(message);if(frame.kind==="ignore")return;if(frame.kind==="malformed"){logger2.debug("[PubSub] Failed to parse client message",{clientId,frame:frame.preview});return}let{parsed}=frame;try{if(!HEARTBEAT_WS_TYPES.has(frame.type))getLiveMonitoringService?.()?.recordWsEvent("message",{clientId,messageType:frame.type,success:!0,dataSize:frame.size});switch(frame.type){case"subscribe":if(Array.isArray(parsed.topics)){let update=clientManager.updateClientTopics(clientId,parsed.topics);clientManager.sendToClient(clientId,{type:"subscribed",topics:update.accepted,...update.dropped.length>0?{droppedTopics:update.dropped,topicCap:config.maxTopicsPerClient}:{},timestamp:Date.now()})}break;case"unsubscribe":logger2.info("[PubSub] Unsubscribe request",{clientId,topics:parsed.topics});break;case"ping":clientManager.sendToClient(clientId,{type:"pong",timestamp:Date.now()});break;case"ack":if(parsed.messageId)clientManager.handleClientAck(clientId,parsed.messageId).catch(()=>{});break}}catch(error3){logger2.error("[PubSub] Client message handler failed",error3,{clientId,messageType:frame.type})}},close(ws,code,reason){let state=ws.data,clientId=state.clientId,openedAt=state.openedAt,livedMs=typeof openedAt==="number"?Date.now()-openedAt:null;if(!clientId)return;clientManager.unregisterClient(clientId),getLiveMonitoringService?.()?.recordWsEvent("close",{clientId,success:!0,metadata:{code,reason:reason||"",livedMs,shortLived:livedMs!==null&&livedMs<60000}}),logger2.info("[PubSub] Client disconnected",{clientId,code,reason,livedMs})}});return{routes,socket:socketRoute,clientManager}}init_JWT();init_utils5();init_sessionBinding();function classifyRefusal(error3){if(!error3)return"unspecified";switch(error3){case"Token expired":return"expired";case"Invalid signature":return"invalid-signature";case"Invalid token format: expected 3 parts":case"Invalid token format: missing parts":case"Invalid header: failed to decode":case"Invalid header: typ must be JWT":case"Invalid payload: failed to decode":return"malformed";case"Invalid issuer":case"Invalid audience":return"wrong-audience";case"Token issued in the future":return"not-yet-valid";default:if(error3.startsWith("Unsupported algorithm:"))return"malformed";return"unspecified"}}function createHandshakeAuthenticator(deps){return async(headers)=>{let wsTokens=parseTokenValuesFromHeaders(headers,deps.tokenNames);if(!wsTokens.access_token)return deps.logger.debug("[PubSub] WS handshake rejected: no access token presented"),{reason:"no-token"};let jwtResult=verifyJWT(wsTokens.access_token,deps.accessTokenSecret,{issuer:deps.issuer,audience:deps.audience});if(!jwtResult.valid){let reason=classifyRefusal(jwtResult.error);return deps.logger.warn("[PubSub] WS handshake rejected: JWT verification failed",{reason:jwtResult.error,classified:reason}),{reason}}let sub=jwtResult.payload?.sub;if(typeof sub!=="string"||sub.length===0)return{reason:"token-without-subject"};if(!deps.requireLiveSession)return{userId:sub};let boundSessionId=typeof jwtResult.payload.sessionId==="string"?jwtResult.payload.sessionId:"";if(!boundSessionId)return deps.logger.warn("[PubSub] WS handshake rejected: token carries no session",{userId:sub}),{reason:"session-unbound"};let tenant=typeof jwtResult.payload.tenant==="string"?jwtResult.payload.tenant:void 0,sessionsTable=deps.resolveSessionsTable?.(tenant)??null,session;try{session=await refreshSessionIsAlive({sessionId:boundSessionId,db:deps.db,sessionsTable})}catch(error3){return deps.logger.warn("[PubSub] WS handshake rejected: session store unreadable",{userId:sub,sessionId:boundSessionId,error:error3 instanceof Error?error3.message:String(error3)}),{reason:"session-unreadable"}}if(!session.alive)return deps.logger.warn("[PubSub] WS handshake rejected: session is no longer active",{userId:sub,sessionId:boundSessionId,reason:session.reason}),{reason:"session-revoked"};if(session.userId&&session.userId!==sub)return deps.logger.warn("[PubSub] WS handshake rejected: token subject is not the session owner",{userId:sub,sessionId:boundSessionId,sessionOwner:session.userId}),{reason:"session-subject-mismatch"};return{userId:sub}}}init_esm3();init_Secrets();var timed=async(fn)=>{let started=performance.now();return{result:await fn(),durationMs:Math.round(performance.now()-started)}},postForm=async(url,body)=>{let response=await fetch(url,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams(body).toString(),signal:AbortSignal.timeout(12000)}),text3=await response.text(),json={};try{json=JSON.parse(text3)}catch{json=Object.fromEntries(new URLSearchParams(text3))}return{status:response.status,json,text:text3}},describeError=(error3)=>{if(error3 instanceof Error){if(error3.name==="TimeoutError")return"Provider did not respond within 12s";return error3.message}return String(error3)},MICROSOFT_TOKEN_URL=(tenant)=>`https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,DEFAULT_TOKEN_URLS={google:"https://oauth2.googleapis.com/token",github:"https://github.com/login/oauth/access_token"},describeRedirectUri=(value2)=>{let trimmed=value2?.trim();if(!trimmed)return"The reply URL (Redirect URI) is empty \u2014 sign-in cannot complete";if(/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))return`The reply URL looks like an environment variable name ("${trimmed}") and that variable is not set`;let parsed;try{parsed=new URL(trimmed)}catch{return`The reply URL is not a valid URL: "${trimmed}"`}if(parsed.protocol!=="https:"&&parsed.hostname!=="localhost")return`The reply URL must be https (it is "${parsed.protocol}//")`;return null};async function testOAuthProvider(provider,config){if(!config.clientId||!config.clientSecret)return{ok:!1,status:"failed",message:"Client ID and Client Secret must both be filled in",durationMs:0};let redirectProblem=describeRedirectUri(config.redirectUri);if(redirectProblem)return{ok:!1,status:"failed",message:redirectProblem,durationMs:0};try{if(provider==="microsoft"){let tenant=config.tenantId||"common";if(tenant==="common"||tenant==="organizations"||tenant==="consumers")return await probeWithBogusCode(MICROSOFT_TOKEN_URL(tenant),config);let{result,durationMs}=await timed(()=>postForm(MICROSOFT_TOKEN_URL(tenant),{grant_type:"client_credentials",client_id:config.clientId,client_secret:config.clientSecret,scope:"https://graph.microsoft.com/.default"}));if(result.status===200&&result.json.access_token)return{ok:!0,status:"ok",message:`Entra credentials verified (tenant ${tenant})`,durationMs};let code=String(result.json.error??result.status);return{ok:!1,status:"failed",message:String(result.json.error_description??result.text).slice(0,400),code,durationMs}}let tokenUrl=config.tokenUrl||DEFAULT_TOKEN_URLS[provider];if(!tokenUrl)return{ok:!1,status:"unknown",message:`No token URL is known for "${provider}" \u2014 enter a tokenUrl`,durationMs:0};return await probeWithBogusCode(tokenUrl,config)}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function probeWithBogusCode(tokenUrl,config){let{result,durationMs}=await timed(()=>postForm(tokenUrl,{grant_type:"authorization_code",code:"nucleus-credential-probe",client_id:config.clientId,client_secret:config.clientSecret,redirect_uri:config.redirectUri||"https://localhost/callback"})),code=String(result.json.error??""),description=String(result.json.error_description??result.text).slice(0,400);if(code==="invalid_grant"||code==="bad_verification_code")return{ok:!0,status:"ok",message:"The provider accepted these credentials",code,durationMs};if(code==="invalid_client"||code==="unauthorized_client"||result.status===401)return{ok:!1,status:"failed",message:description||"The provider refused this Client ID/Secret pair",code:code||"invalid_client",durationMs};if(description.includes("AADSTS7000215")||description.includes("AADSTS700016"))return{ok:!1,status:"failed",message:description,code,durationMs};return{ok:!1,status:"unknown",message:description||"The provider returned an unexpected answer",code:code||String(result.status),durationMs}}async function testStorageProvider(provider){if(!provider)return{ok:!1,status:"failed",message:"No storage provider is configured",durationMs:0};try{let{result,durationMs}=await timed(()=>provider.isAvailable());return result?{ok:!0,status:"ok",message:`Connection verified: ${provider.describe}`,durationMs}:{ok:!1,status:"failed",message:`Unreachable: ${provider.describe} \u2014 check the server, the share name and the credentials`,durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}async function testEmailProvider(service,recipient){if(!service)return{ok:!1,status:"failed",message:"No email provider is configured",durationMs:0};if(!service.isAvailable())return{ok:!1,status:"failed",message:"The provider could not be started with these credentials",durationMs:0};if(!recipient)return{ok:!0,status:"ok",message:"The provider started \u2014 enter a recipient address to send for real",durationMs:0};try{let{result,durationMs}=await timed(()=>service.sendEmail({to:recipient,subject:"Nucleus connection test",html:"<p>This email was sent by a connection test run from the admin panel.</p>"}));return result.success?{ok:!0,status:"ok",message:`Test email sent to ${recipient}`,durationMs}:{ok:!1,status:"failed",message:result.error??"Sending failed",durationMs}}catch(error3){return{ok:!1,status:"failed",message:describeError(error3),durationMs:0}}}init_routeCollector();init_godminGuard();var SECRET_KINDS=["text","password","json","connection_string","pem","boolean","list"];var SCOPE_PATTERN=/^[A-Za-z0-9_.-]{1,200}$/,KEY_PATTERN=/^[A-Za-z0-9_-]{1,120}$/,fail5=(set2,status,message)=>{return set2.status=status,{isSuccess:!1,message,data:null}};function createSecretsRoutes(routeConfig){let{logger:logger2,basePath,db,schemaTables,getService,resolvedOptions,getEmailService,getStorageProvider:getStorageProvider2}=routeConfig,guard4=createGodminGuard2({logger:logger2,db,schemaTables,area:"secrets management",allowedRoles:routeConfig.adminRoles}),requireService=(set2)=>{let service=getService();if(!service)return set2.status=503,null;return service},actorOf=(request)=>request.headers.get("x-user-id")??void 0,declared=[defineRoute({method:"GET",path:"/slots",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled \u2014 set secrets.enabled and provide an encryption key",data:null};let slots=await service.describe(resolvedOptions),groups=[...new Set(slots.map((s)=>s.group))].sort();return{isSuccess:!0,message:"Credential slots",data:{slots,groups,counts:{total:slots.length,fromDb:slots.filter((s)=>s.source==="db").length,fromEnv:slots.filter((s)=>s.source==="env").length,missing:slots.filter((s)=>s.source==="missing").length,missingRequired:slots.filter((s)=>s.source==="missing"&&s.required).length}}}},detail:{tags:["Secrets"],summary:"List credential slots discovered from the running config",description:"Slots are derived by walking the config tree, so a new integration appears without a code change. Values are never returned \u2014 only a masked preview and the resolution source."}}),defineRoute({method:"GET",path:"/",handler:async({set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};return{isSuccess:!0,message:"Stored credentials",data:{secrets:await service.list()}}},detail:{tags:["Secrets"],summary:"List stored credentials",description:"Metadata only \u2014 the encrypted value is never returned."}}),defineRoute({method:"PUT",path:"/:scope/:key",handler:async({params,body,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{scope,key:key2}=params;if(!SCOPE_PATTERN.test(scope))return fail5(set2,400,"Invalid scope");if(!KEY_PATTERN.test(key2))return fail5(set2,400,"Invalid key");let value2=body.value;if(typeof value2!=="string"||value2.length===0)return fail5(set2,400,"value is required");if(value2.length>65536)return fail5(set2,400,"value exceeds 64KB");if(body.kind==="json")try{JSON.parse(value2)}catch{return fail5(set2,400,"value is not valid JSON")}let saved=await service.set({scope,key:key2,value:value2,kind:body.kind,description:body.description,actorId:actorOf(request)});if(!saved)return fail5(set2,500,"Could not store the credential");return{isSuccess:!0,message:"Credential stored",data:{secret:saved}}},params:Type.Object({scope:Type.String(),key:Type.String()}),body:Type.Object({value:Type.String(),kind:Type.Optional(Type.Union(SECRET_KINDS.map((kind)=>Type.Literal(kind)))),description:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Set or rotate a credential",description:"Stores the value encrypted (AES-256-GCM). Rotating retains the previous value for a one-step rollback. Takes effect within seconds on every pod \u2014 no restart."}}),defineRoute({method:"POST",path:"/:scope/:key/rollback",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let restored=await service.rollback(params.scope,params.key,actorOf(request));if(!restored)return fail5(set2,404,"No previous value to roll back to");return{isSuccess:!0,message:"Previous credential restored",data:{secret:restored}}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Roll back to the value replaced by the last rotation"}}),defineRoute({method:"DELETE",path:"/:scope/:key",handler:async({params,set:set2,request})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!await service.remove(params.scope,params.key,actorOf(request)))return fail5(set2,404,"Credential not found");return{isSuccess:!0,message:"Credential removed \u2014 the config falls back to env or literal",data:null}},params:Type.Object({scope:Type.String(),key:Type.String()}),detail:{tags:["Secrets"],summary:"Delete a stored credential",description:"Resolution falls back to the env var or literal declared in config."}}),defineRoute({method:"POST",path:"/test",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};let{target:target2}=body,result;if(target2==="email")result=await testEmailProvider(getEmailService?.()??null,body.recipient);else if(target2==="oauth"){let provider=body.provider;if(!provider)return fail5(set2,400,"provider is required for an oauth test");let scope=`authentication.oauth.providers.${provider}`,providerConfig=(resolvedOptions.authentication?.oauth?.providers??{})[provider]??{},declaredString=(key2)=>{let raw=providerConfig[key2];return typeof raw==="string"?raw:void 0};result=await testOAuthProvider(provider,{clientId:service.value(scope,"clientId",declaredString("clientId")),clientSecret:service.value(scope,"clientSecret",declaredString("clientSecret")),tenantId:service.value(scope,"tenantId",declaredString("tenantId")),tokenUrl:declaredString("tokenUrl"),redirectUri:service.value(scope,"redirectUri",declaredString("redirectUri"))})}else if(target2==="storage")result=await testStorageProvider(getStorageProvider2?.()??null);else return fail5(set2,400,`Unsupported test target "${target2}"`);return logger2.info("[Secrets] Connection test",{target:target2,provider:body.provider,status:result.status,durationMs:result.durationMs}),{isSuccess:result.ok,message:result.message,data:{result}}},body:Type.Object({target:Type.Union([Type.Literal("oauth"),Type.Literal("email"),Type.Literal("storage")]),provider:Type.Optional(Type.String()),recipient:Type.Optional(Type.String())}),detail:{tags:["Secrets"],summary:"Test a credential against the real provider",description:"Backend-to-backend only. OAuth uses client_credentials where the provider supports it and a client-authentication probe otherwise; email optionally sends a real test message."}}),defineRoute({method:"POST",path:"/reencrypt",handler:async({body,set:set2})=>{let service=requireService(set2);if(!service)return{isSuccess:!1,message:"Secrets management is disabled",data:null};if(!body.newMasterKey||body.newMasterKey.length<16)return fail5(set2,400,"newMasterKey must be at least 16 characters");let result=await service.reencryptAll(body.newMasterKey),uncovered="Credentials stored outside this store \u2014 an integration connection\u2019s token, client secret and service password \u2014 are NOT re-encrypted by this. Re-enter them from the integrations panel after the new key is deployed.";return{isSuccess:result.failed.length===0,message:result.failed.length===0?`Re-encrypted ${result.migrated} credentials \u2014 deploy the new key before the next restart. ${uncovered}`:`Nothing was re-encrypted: ${result.failed.length} credential(s) could not be read with the current key, so none were rewritten.`,data:{...result,uncovered}}},body:Type.Object({newMasterKey:Type.String()}),detail:{tags:["Secrets"],summary:"Re-encrypt every credential under a new master key",description:"Rotates the key protecting the store. The new key must be deployed to the environment before the next restart, or nothing will decrypt."}}),defineRoute({method:"GET",path:"/discover",handler:()=>({isSuccess:!0,message:"Slots discovered from the running config",data:{slots:discoverSlots(resolvedOptions).map(({configValue:_configValue,...slot})=>slot)}}),detail:{tags:["Secrets"],summary:"Show which credential slots the config declares",description:"Diagnostics \u2014 resolution state is not consulted and no value is read."}}),defineRoute({method:"POST",path:"/storage/migrate",handler:async(ctx)=>{let body=ctx.body,build=routeConfig.buildStorageProvider;if(!build)return fail5(ctx.set,503,"Storage is not configured");let destination=build(body.to),source=build(body.to==="smb"?"local":"smb");if(!source||!destination)return fail5(ctx.set,503,"Storage is not configured");if(!await destination.isAvailable())return fail5(ctx.set,422,`The destination store is unreachable (${destination.describe}) \u2014 test the connection first`);if(body.dryRun){let preview=await migrateStorage({from:source,to:Object.assign(Object.create(Object.getPrototypeOf(destination)),destination,{exists:async()=>!1,write:async()=>{},ensureDir:async()=>{}}),maxFiles:1e5},{logger:logger2});return{isSuccess:!0,message:`${preview.copied} file${preview.copied===1?"":"s"} would be copied`,data:{preview}}}let report=await migrateStorage({from:source,to:destination},{logger:logger2}),clean=report.failed===0&&!report.truncated;return logger2.warn("[Storage] Migration run from the admin panel",{to:body.to,copied:report.copied,skipped:report.skipped,failed:report.failed,truncated:report.truncated}),{isSuccess:clean,message:clean?`${report.copied} file${report.copied===1?"":"s"} copied, ${report.skipped} already present`:`${report.copied} copied, ${report.failed} failed${report.truncated?", list truncated":""}`,data:{report}}},body:Type.Object({to:Type.Union([Type.Literal("local"),Type.Literal("smb")]),dryRun:Type.Optional(Type.Boolean())}),detail:{tags:["Secrets"],summary:"Copy every stored file to the other backend",description:"Copy-only: the source is never deleted, and a file already on the target is skipped so a re-run resumes. Run BEFORE switching storage.provider."}})];return collectRoutes([{prefix:basePath,guards:[guard4],routes:declared}])}function readAttemptedIdentity(parsedBody,rawBodyText,contentType){let fromJson=parsedBody.email;if(typeof fromJson==="string"&&fromJson.trim())return fromJson;if(!rawBodyText)return;if((contentType||"").toLowerCase().includes("application/x-www-form-urlencoded"))try{let value2=new URLSearchParams(rawBodyText).get("email");return value2?.trim()?value2:void 0}catch{return}return}var snakeToCamel4=(s)=>s.replace(/_([a-z])/g,(_,l)=>l.toUpperCase());function warnOnEntityBasePathCollision(feature,basePath,entities,logger2){let segment=basePath.replace(/^\/+|\/+$/g,"");if(!segment||segment.includes("/"))return!1;let clash=(entities??[]).find((entity)=>snakeToCamel4(entity.table_name)===segment);if(!clash)return!1;return logger2.error(`[${feature}] basePath "${basePath}" is also the generated entity route for "${clash.table_name}". Both are registered and one will shadow the other. Move the feature (e.g. "/nucleus${basePath}") or rename the entity.`),!0}function requiredBodyCeiling(input){if(!input.storageEnabled)return null;let perFile=input.maxFileSizeBytes;if(!perFile||!Number.isFinite(perFile)||perFile<=0)return null;let files=Math.max(1,Math.floor(input.maxFiles??1));return perFile*files+8388608}function bodyCeilingComplaint(input){if(input.required===null)return null;if((input.configured??134217728)>=input.required)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,source=input.configured==null?`the host passed no \`serve.maxRequestBodySize\`, so Bun's default of ${mb2(134217728)} applies`:`the host passed ${mb2(input.configured)}`;return`Uploads are configured up to ${mb2(input.required)}, but ${source}. `+"Anything larger is refused by the server before this application sees it \u2014 "+`the upload appears to run and then fails with nothing to show. Fix: raise \`storage.maxFileSizeBytes\` / \`security.maxRequestBodyBytes\` in the config, or pass \`maxRequestBodyBytes\` to \`createNucleusServer\`. The server needs ${input.required} bytes of headroom.`}function bunBodyCeilingFor(input){let wanted=Math.max(input.storageRequired??0,input.guardCeiling??0);return wanted>134217728?wanted:void 0}var APP_BASELINE_BYTES=268435456,COPIES_IN_FLIGHT=2;function memoryCeilingComplaint(input){if(input.required===null||input.cgroupLimit===null||input.cgroupLimit<=0)return null;let needed=input.required*COPIES_IN_FLIGHT+APP_BASELINE_BYTES;if(input.cgroupLimit>=needed)return null;let mb2=(bytes)=>`${Math.round(bytes/1048576)} MB`,affordable=Math.max(0,Math.floor((input.cgroupLimit-APP_BASELINE_BYTES)/COPIES_IN_FLIGHT));return`Uploads are configured up to ${mb2(input.required)}, but this container is capped at ${mb2(input.cgroupLimit)} and an upload is held in memory twice on top of the ~${mb2(APP_BASELINE_BYTES)} `+`the app already holds \u2014 it needs ~${mb2(needed)}. The kernel will kill the process mid-upload. Fix: raise the container's memory limit to at least ${mb2(needed)}, or lower storage.maxFileSizeBytes to about ${mb2(affordable)}.`}var ipMatches=(ip,entry)=>entry.includes("/")?isIpInCidr(ip,entry):ip===entry;function resolveClientIp(socketIp,forwardedFor,trustedProxies=[]){let peer=socketIp?.trim()||"",chain=(forwardedFor||"").split(",").map((s)=>s.trim()).filter(Boolean);if(!peer)return chain[0]||"unknown";if(trustedProxies.length===0)return peer;let trusted=(ip)=>trustedProxies.some((p)=>ipMatches(ip,p));if(!trusted(peer))return peer;for(let i=chain.length-1;i>=0;i--){let hop=chain[i];if(hop&&!trusted(hop))return hop}return chain[0]||peer}var isNonDiscriminatingPeer=(ip)=>ip==="::1"||ip==="unknown"||/^(::ffff:)?127\./.test(ip);function createPeerDiversityWatcher(sampleSize=200){let seen=new Set,seenCount=0,settled=!1;return{observe(ip){if(settled)return null;if(seenCount++,seen.add(ip),seen.size>1)return settled=!0,null;if(seenCount>=sampleSize)return settled=!0,ip;return null}}}var DEFAULTS={cookieName:"csrf_token",headerName:"x-csrf-token"},resolveCsrfConfig=(raw)=>{if(raw===!0)return{enabled:!0,...DEFAULTS};if(!raw)return{enabled:!1,...DEFAULTS};return{enabled:raw.enabled!==!1,cookieName:raw.cookieName||DEFAULTS.cookieName,headerName:(raw.headerName||DEFAULTS.headerName).toLowerCase()}},parseCookies=(cookieHeader)=>{let out={};if(!cookieHeader)return out;for(let part of cookieHeader.split(";")){let trimmed=part.trim(),eq37=trimmed.indexOf("=");if(eq37>0)out[trimmed.slice(0,eq37)]=trimmed.slice(eq37+1)}return out},SAFE_METHODS=new Set(["GET","HEAD","OPTIONS"]),isStateChanging=(method)=>!SAFE_METHODS.has(method.toUpperCase()),requiresCsrf=(params)=>{if(!isStateChanging(params.method))return!1;if(params.hasAuthorizationHeader)return!1;return params.authCookieNames.some((n)=>!!params.cookies[n])},csrfTokenMatches=(csrfCookie,csrfHeader)=>{if(!csrfCookie||!csrfHeader)return!1;return csrfCookie===csrfHeader};var SENSITIVE_HEADER_NAMES=new Set(["authorization","proxy-authorization","cookie","set-cookie","x-access-token","x-refresh-token","x-session-id","x-user-id","x-user-roles","x-user-claims","x-user-email","x-api-key","x-api-key-id","x-api-key-owner-type","x-auth-type"]);function redactSensitiveHeaders(headers){let out={};return headers.forEach((value2,key2)=>{out[key2]=SENSITIVE_HEADER_NAMES.has(key2.toLowerCase())?"[REDACTED]":value2}),out}init_sensitiveColumns();var TENANT_CLAIM="tenant",verifyTenantBinding=(tokenTenant,resolvedSchema,mode="lenient")=>{if(mode==="off")return{ok:!0};if(!resolvedSchema)return{ok:!0};let claim=typeof tokenTenant==="string"&&tokenTenant.length>0?tokenTenant:void 0;if(!claim)return mode==="strict"?{ok:!1,reason:"token is not bound to a tenant"}:{ok:!0};return claim===resolvedSchema?{ok:!0}:{ok:!1,reason:"token tenant does not match the requested tenant"}};init_storage2();init_routeMount();init_esm3();init_routeCollector();import{eq as eq37}from"drizzle-orm";var RESERVED_SUBDOMAINS=["www","api","app","admin","dashboard","mail","ftp","cdn","static","assets","docs","help","support","status","blog","dev","staging","test","demo","localhost"],DEFAULT_SELF_SIGNUP_LIMITS={maxSignupsPerIpPerWindow:3,ipWindowMs:3600000,maxTenantsPerEmail:1};var col9=(table,name2)=>table[name2];function createCheckSubdomainRoute(config){let declared=[defineRoute({method:"GET",path:"/tenants/check-subdomain/:subdomain",handler:async(ctx)=>{let{subdomain}=ctx.params,normalized=subdomain.toLowerCase().trim();if(!/^[a-z][a-z0-9-]*$/.test(normalized)||normalized.length<2||normalized.length>63)return ctx.set.status=400,{isSuccess:!1,message:"Invalid subdomain format. Must start with a letter, contain only lowercase letters, numbers, and hyphens, and be 2-63 characters.",data:{available:!1,subdomain:normalized}};if(RESERVED_SUBDOMAINS.includes(normalized))return{isSuccess:!0,message:"Subdomain is reserved",data:{available:!1,subdomain:normalized}};let tenantRegistry=config.getTenantRegistry(),db=config.getDb();if(tenantRegistry){if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===normalized))return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}if(db&&tenantRegistry){let tenantsTable=tenantRegistry.getMainContext().schemaTables.tenants;if(tenantsTable)try{if((await db.select().from(tenantsTable).where(eq37(col9(tenantsTable,"subdomain"),normalized)).limit(1)).length>0)return{isSuccess:!0,message:"Subdomain is already taken",data:{available:!1,subdomain:normalized}}}catch{}}return{isSuccess:!0,message:"Subdomain is available",data:{available:!0,subdomain:normalized}}},params:Type.Object({subdomain:Type.String({minLength:2,maxLength:63})}),detail:{tags:["Tenants"],summary:"Check subdomain availability",description:"Public endpoint to check if a subdomain is available for registration. No authentication required."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Logger2();init_routeCollector();import{eq as eq38}from"drizzle-orm";var col10=(table,name2)=>table[name2];function createManageRoutes(config){let log3=config.logger.scoped(TENANT_SUSPEND),declared=[defineRoute({method:"GET",path:"/tenants",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let allTenants=[...tenantRegistry.getActiveTenants(),...Array.from(getAllTenants(tenantRegistry)).filter((t)=>t.status!=="active")];return{success:!0,message:`Found ${allTenants.length} tenants`,data:{items:allTenants.map((t)=>({id:t.id,subdomain:t.subdomain,schemaName:t.schemaName,companyId:t.companyId,companyName:t.companyName,godAdminEmail:t.godAdminEmail,status:t.status,plan:t.plan,domain:t.domain,maxUsers:t.maxUsers,provisionedAt:t.provisionedAt,suspendedAt:t.suspendedAt})),totalCount:allTenants.length}}},detail:{tags:["Tenants"],summary:"List tenants",description:"List all tenants in the platform. Requires godmin privileges."}}),defineRoute({method:"GET",path:"/tenants/:id",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available",data:null};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required",data:null};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required",data:null};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found",data:null};let features=tenantRegistry.getTenantFeatures(id);return{success:!0,message:"Tenant found",data:{...tenant,features:features.map((f)=>({featureName:f.featureName,enabled:f.enabled}))}}},detail:{tags:["Tenants"],summary:"Get tenant details",description:"Get detailed information about a specific tenant. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/suspend",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,body=ctx.body,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status==="suspended")return ctx.set.status=400,{success:!1,message:"Tenant is already suspended"};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"suspended",suspendedAt:now,suspendedReason:body.reason||"Suspended by godmin",updatedAt:now}).where(eq38(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"suspended",eventData:JSON.stringify({reason:body.reason||"Suspended by godmin"}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record suspend event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant suspended",{tenantId:id,reason:body.reason}),{success:!0,message:`Tenant "${tenant.subdomain}" suspended`}},body:Type.Object({reason:Type.Optional(Type.String())}),detail:{tags:["Tenants"],summary:"Suspend tenant",description:"Suspend a tenant, preventing all access. Requires godmin privileges."}}),defineRoute({method:"POST",path:"/tenants/:id/reactivate",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant management not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};if(!await verifyGodmin(db,tenantRegistry,requestingUserId))return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let{id}=ctx.params,tenant=tenantRegistry.getTenantById(id);if(!tenant)return ctx.set.status=404,{success:!1,message:"Tenant not found"};if(tenant.status!=="suspended")return ctx.set.status=400,{success:!1,message:`Tenant is not suspended (current: ${tenant.status})`};let mainContext=tenantRegistry.getMainContext(),tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available"};let now=new Date;await db.update(tenantsTable).set({status:"active",suspendedAt:null,suspendedReason:null,updatedAt:now}).where(eq38(col10(tenantsTable,"id"),id));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId:id,eventType:"reactivated",eventData:JSON.stringify({previousReason:tenant.suspendedReason}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-client-ip")?.trim()||ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record reactivate event")}return await tenantRegistry.refreshTenant(id),log3.info("Tenant reactivated",{tenantId:id}),{success:!0,message:`Tenant "${tenant.subdomain}" reactivated`}},detail:{tags:["Tenants"],summary:"Reactivate tenant",description:"Reactivate a suspended tenant. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}var verifyGodmin=async(db,tenantRegistry,userId)=>{let usersTable=tenantRegistry.getMainContext().schemaTables.users;if(!usersTable)return!1;return(await db.select().from(usersTable).where(eq38(col10(usersTable,"id"),userId)).limit(1))[0]?.isGod===!0},getAllTenants=(registry3)=>{let schemaNames=registry3.getAllSchemaNames(),tenants=[];for(let name2 of schemaNames){let ctx=registry3.getSchemaContext(name2);if(ctx?.tenant)tenants.push(ctx.tenant)}return tenants};init_esm3();init_Logger2();init_routeCollector();init_utils6();import{eq as eq39}from"drizzle-orm";var col11=(table,name2)=>table[name2],ProvisionBodySchema=Type.Object({subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),companyId:Type.String({format:"uuid"}),companyName:Type.Optional(Type.String()),godAdminEmail:Type.String({format:"email"}),plan:Type.Optional(Type.String()),domain:Type.Optional(Type.String())});function createProvisionRoute(config){let log3=config.logger.scoped(TENANT_PROVISION),declared=[defineRoute({method:"POST",path:"/tenants/provision",handler:async(ctx)=>{let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let requestingUserId=ctx.request.headers.get("x-user-id");if(!requestingUserId)return ctx.set.status=401,{success:!1,message:"Authentication required"};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users;if(!usersTable)return ctx.set.status=503,{success:!1,message:"Users table not available"};if(!(await db.select().from(usersTable).where(eq39(col11(usersTable,"id"),requestingUserId)).limit(1))[0]?.isGod)return ctx.set.status=403,{success:!1,message:"Godmin privileges required"};let body=ctx.body,tenantSchemaName=`tenant_${body.subdomain.replace(/-/g,"_")}`;if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===body.subdomain))return ctx.set.status=409,{success:!1,message:`Subdomain "${body.subdomain}" is already taken`};let tenantsTable=mainContext.schemaTables.tenants;if(!tenantsTable)return ctx.set.status=503,{success:!1,message:"Tenants table not available in main schema"};let tenantId=crypto.randomUUID(),now=new Date;try{await db.insert(tenantsTable).values({id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Failed to insert tenant record",{error:msg}),ctx.set.status=500,{success:!1,message:`Failed to create tenant record: ${msg}`}}try{let tenantRecord={id:tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName,companyId:body.companyId,companyName:body.companyName||null,godAdminEmail:body.godAdminEmail,status:"provisioning",plan:body.plan||null,domain:body.domain||null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable){let godminId=crypto.randomUUID(),tempPassword=crypto.randomUUID().slice(0,16),hashedPassword=await hashPassword(tempPassword);await db.insert(tenantUsersTable).values({id:godminId,email:body.godAdminEmail,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin user seeded",{tenantId,godminEmail:body.godAdminEmail,godminId})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq39(col11(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"provisioned",eventData:JSON.stringify({schemaName:tenantSchemaName,godAdminEmail:body.godAdminEmail,plan:body.plan||null}),performedBy:requestingUserId,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",createdAt:now,updatedAt:now})}catch{log3.warn("Failed to record tenant_event, continuing")}return await tenantRegistry.refreshTenant(tenantId),log3.info("Provisioning complete",{tenantId,subdomain:body.subdomain,schemaName:tenantSchemaName}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"PROVISION",userId:requestingUserId,summary:`Tenant "${body.subdomain}" provisioned by godmin`,ipAddress:ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||"unknown",userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant provisioned successfully",data:{tenantId,schemaName:tenantSchemaName,subdomain:body.subdomain,godAdminEmail:body.godAdminEmail,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq39(col11(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:`Provisioning failed: ${msg}`}}},body:ProvisionBodySchema,detail:{tags:["Tenants"],summary:"Provision new tenant",description:"Create a new tenant with its own schema, tables, and godmin user. Requires godmin privileges."}})];return collectRoutes([{routes:declared}])}init_esm3();init_Authorization();init_Logger2();init_routeCollector();init_passwordPolicy();init_utils6();import{eq as eq40}from"drizzle-orm";var col12=(table,name2)=>table[name2],ipRateMap=new Map,lastCleanup=Date.now();function cleanupRateMap(windowMs){let now=Date.now();if(now-lastCleanup<600000)return;lastCleanup=now;for(let[key2,entry]of ipRateMap.entries())if(now-entry.windowStart>windowMs)ipRateMap.delete(key2)}function isIpRateLimited(ip,maxPerWindow,windowMs){let now=Date.now(),entry=ipRateMap.get(ip);if(!entry||now-entry.windowStart>windowMs)return ipRateMap.set(ip,{count:1,windowStart:now}),!1;return entry.count++,entry.count>maxPerWindow}var SelfSignupBodySchema=Type.Object({email:Type.String({format:"email"}),password:Type.String({minLength:8}),subdomain:Type.String({minLength:2,maxLength:63,pattern:"^[a-z][a-z0-9-]*$"}),plan:Type.Optional(Type.String()),companyName:Type.Optional(Type.String())});function createSelfSignupRoute(config){let log3=config.logger.scoped(TENANT_SELF_SIGNUP),limits={...DEFAULT_SELF_SIGNUP_LIMITS,...config.selfSignupLimits},declared=[defineRoute({method:"POST",path:"/tenants/self-signup",handler:async(ctx)=>{cleanupRateMap(limits.ipWindowMs);let db=config.getDb(),tenantRegistry=config.getTenantRegistry();if(!db||!tenantRegistry)return ctx.set.status=503,{success:!1,message:"Tenant provisioning not available"};let ip=ctx.request.headers.get("x-forwarded-for")?.split(",")[0]?.trim()||ctx.request.headers.get("x-real-ip")?.trim()||"unknown";if(isIpRateLimited(ip,limits.maxSignupsPerIpPerWindow,limits.ipWindowMs))return log3.warn("Self-signup rate limited",{ip}),ctx.set.status=429,{success:!1,message:"Too many signup attempts. Please try again later."};let body=ctx.body,email=body.email.toLowerCase().trim(),subdomain=body.subdomain.toLowerCase().trim();if(RESERVED_SUBDOMAINS.includes(subdomain))return ctx.set.status=400,{success:!1,message:"This subdomain is reserved."};let mainContext=tenantRegistry.getMainContext(),usersTable=mainContext.schemaTables.users,tenantsTable=mainContext.schemaTables.tenants;if(!usersTable||!tenantsTable)return ctx.set.status=503,{success:!1,message:"Required tables not available."};if(tenantRegistry.getActiveTenants().find((t)=>t.subdomain===subdomain))return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."};try{if((await db.select().from(tenantsTable).where(eq40(col12(tenantsTable,"subdomain"),subdomain)).limit(1)).length>0)return ctx.set.status=409,{success:!1,message:"This subdomain is already taken."}}catch{}try{if((await db.select().from(tenantsTable).where(eq40(col12(tenantsTable,"godAdminEmail"),email))).length>=limits.maxTenantsPerEmail)return ctx.set.status=409,{success:!1,message:`Tenant limit reached. Maximum ${limits.maxTenantsPerEmail} tenant(s) per account.`}}catch{}let strength=validateAgainstPolicy(body.password,void 0,body.email);if(!strength.valid)return ctx.set.status=400,{success:!1,message:"Password too weak",errors:strength.errors};let userId,hashedPassword=await hashPassword(body.password),now=new Date,existingUsers=await db.select().from(usersTable).where(eq40(col12(usersTable,"email"),email)).limit(1);if(existingUsers.length>0)userId=existingUsers[0].id,log3.info("Self-signup: existing user resolved",{userId,email});else{userId=crypto.randomUUID();try{await db.insert(usersTable).values({id:userId,email,password:hashedPassword,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Self-signup: user created",{userId,email})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Self-signup: user creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create account."}}}let tenantId=crypto.randomUUID(),tenantSchemaName=`tenant_${subdomain.replace(/-/g,"_")}`;try{await db.insert(tenantsTable).values({id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,createdAt:now,updatedAt:now}),log3.info("Tenant record created",{tenantId,subdomain})}catch(err){let msg=err instanceof Error?err.message:String(err);return log3.error("Tenant record creation failed",{error:msg}),ctx.set.status=500,{success:!1,message:"Failed to create tenant."}}try{let tenantRecord={id:tenantId,subdomain,schemaName:tenantSchemaName,companyId:userId,companyName:body.companyName||subdomain,godAdminEmail:email,status:"provisioning",plan:body.plan||null,domain:null,settings:{},trustedSources:[],maxUsers:null,provisionedAt:null,suspendedAt:null,suspendedReason:null},tenantContext=await tenantRegistry.provisionTenant(tenantRecord);log3.info("Schema provisioned",{tenantId,schemaName:tenantSchemaName,tableCount:Object.keys(tenantContext.schemaTables).length});let tenantUsersTable=tenantContext.schemaTables.users;if(tenantUsersTable)await db.insert(tenantUsersTable).values({id:userId,email,password:hashedPassword,isGod:!0,isActive:!0,createdAt:now,updatedAt:now}),log3.info("Godmin seeded in tenant schema",{tenantId,email,userId});let tenantRolesTable=tenantContext.schemaTables.roles,tenantUserRolesTable=tenantContext.schemaTables.userRoles;if(tenantRolesTable&&tenantUserRolesTable)try{let godminRoles=await db.select().from(tenantRolesTable).where(eq40(tenantRolesTable.name,GODMIN_ROLE_NAME)).limit(1),godminRoleId;if(godminRoles.length>0)godminRoleId=godminRoles[0].id;else{let[newRole]=await db.insert(tenantRolesTable).values({name:GODMIN_ROLE_NAME,description:"God mode administrator - bypasses all authorization checks"}).returning();godminRoleId=newRole.id,log3.info("Created godmin role in tenant schema",{tenantId,roleId:godminRoleId})}if(godminRoleId)await db.insert(tenantUserRolesTable).values({userId,roleId:godminRoleId}),log3.info("Assigned godmin role to signup user",{tenantId,userId,roleId:godminRoleId})}catch(roleErr){log3.warn("Failed to assign godmin role to signup user",{tenantId,userId,error:roleErr instanceof Error?roleErr.message:String(roleErr)})}await db.update(tenantsTable).set({status:"active",provisionedAt:now,updatedAt:now}).where(eq40(col12(tenantsTable,"id"),tenantId));let tenantEventsTable=mainContext.schemaTables.tenantEvents;if(tenantEventsTable)try{await db.insert(tenantEventsTable).values({id:crypto.randomUUID(),tenantId,eventType:"self_signup",eventData:JSON.stringify({email,subdomain,plan:body.plan||null}),performedBy:userId,ipAddress:ip,createdAt:now,updatedAt:now})}catch{}return await tenantRegistry.refreshTenant(tenantId),log3.info("Self-signup complete",{tenantId,subdomain,email}),await config.logger.audit({entityName:"tenants",entityId:tenantId,operation:"SELF_SIGNUP",userId,summary:`Self-signup: tenant "${subdomain}" provisioned by ${email}`,ipAddress:ip,userAgent:ctx.request.headers.get("user-agent")||"unknown",path:new URL(ctx.request.url).pathname,query:""}),{success:!0,message:"Tenant created successfully",data:{tenantId,subdomain,schemaName:tenantSchemaName,userId,email,status:"active"}}}catch(err){let msg=err instanceof Error?err.message:String(err);log3.error("Self-signup provisioning failed",{error:msg,tenantId});try{await db.update(tenantsTable).set({status:"provisioning",updatedAt:now}).where(eq40(col12(tenantsTable,"id"),tenantId))}catch{}return ctx.set.status=500,{success:!1,message:"Provisioning failed. Please try again."}}},body:SelfSignupBodySchema,detail:{tags:["Tenants"],summary:"Self-service tenant signup",description:"Public endpoint for self-service signup. Creates user account, provisions tenant schema, and seeds godmin. Rate-limited by IP with configurable max tenants per email."}})];return collectRoutes([{routes:declared}])}function createTenantRoutes(app,config){return useRoutes(app,createCheckSubdomainRoute(config)),useRoutes(app,createProvisionRoute(config)),useRoutes(app,createSelfSignupRoute(config)),useRoutes(app,createManageRoutes(config)),app}init_esm3();init_routeCollector();init_adminGuard();init_buildServices();function createVerificationRoutes(routeConfig){let{db,schemaTables,config,logger:logger2,tenantRegistry}=routeConfig,{verificationService:defaultVerificationService,notificationService:defaultNotificationService}=buildVerificationServices({db,schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService}),getServicesForRequest=(request)=>{if(!tenantRegistry)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let schemaName=request.headers.get("x-tenant-schema");if(!schemaName)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};let ctx=tenantRegistry.getSchemaContext(schemaName);if(!ctx)return{verificationService:defaultVerificationService,notificationService:defaultNotificationService};return buildVerificationServices({db,schemaTables:ctx.schemaTables,config,notificationConfig:routeConfig.notificationConfig,logger:logger2,getEmailService:routeConfig.getEmailService})},basePath=config.endpoints?.basePath||"/verifications",flowBasePath=config.flowEndpoints?.basePath||"/verification-flows",requireUser=({request,set:set2})=>{if(!request.headers.get("x-user-id"))return set2.status=401,{success:!1,message:"Authentication required"}},mayStartFor=(request,entityName)=>{if(hasGodminRole(request))return!0;let claims=decodeHeaderList(request.headers.get("x-user-claims"));if(claims.length===0)return!1;let wanted=new Set;for(let name2 of bothSpellings(entityName))for(let verb of["post","patch","put"])wanted.add(`${verb}.${name2}`);return claims.some((c)=>{for(let w of wanted)if(c===w||c.startsWith(`${w}.`))return!0;return!1})},verificationDeclared=[defineRoute({method:"GET",path:"/status/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:status}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/:entity_name/:entity_id/decide",handler:async({params,body,request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return await verificationService.decide({entity_name:params.entity_name,entity_id:params.entity_id,user_id:userId,decision:body.decision,reason:body.reason,signature_id:body.signature_id,diff:body.diff})},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()}),body:Type.Object({decision:Type.Union([Type.Literal("approved"),Type.Literal("rejected")]),reason:Type.Optional(Type.String()),signature_id:Type.Optional(Type.String()),diff:Type.Optional(Type.Record(Type.String(),Type.Unknown()))})}),defineRoute({method:"GET",path:"/pending",handler:async({request})=>{let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");if(!userId)return{success:!1,message:"User ID required",status:401};return{success:!0,data:await verificationService.getPending(userId)}}}),defineRoute({method:"GET",path:"/history/:entity_name/:entity_id",handler:async({params,request,set:set2})=>{let{verificationService}=getServicesForRequest(request),status=await verificationService.getStatus(params.entity_name,params.entity_id),startedBy=status.instance?.started_by;if(!hasGodminRole(request)&&startedBy!=null&&String(startedBy)!==String(request.headers.get("x-user-id")))return set2.status=403,{success:!1,message:"Forbidden"};return{success:!0,data:{verifications:status.verifications,current_step:status.current_step,total_steps:status.total_steps,is_completed:status.is_completed,is_rejected:status.is_rejected}}},params:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlow({flow_id:body.flow_id,entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"POST",path:"/start-for-entity",handler:async({body,request,set:set2})=>{if(!mayStartFor(request,body.entity_name))return set2.status=403,{success:!1,message:`Forbidden: putting a ${body.entity_name} into review needs write access to it.`};let{verificationService}=getServicesForRequest(request),userId=request.headers.get("x-user-id");return await verificationService.startFlowForEntity({entity_name:body.entity_name,entity_id:body.entity_id,started_by:userId||void 0})},body:Type.Object({entity_name:Type.String(),entity_id:Type.String()})}),defineRoute({method:"GET",path:"/statuses/:entity_name",handler:async({params,query,request,set:set2})=>{if(!hasGodminRole(request))return set2.status=403,{success:!1,message:"Forbidden: operator privileges required"};let{verificationService}=getServicesForRequest(request);return{success:!0,data:await verificationService.listEntityStatuses({entity_name:params.entity_name,status:query.status||void 0,page:query.page?Number(query.page):void 0,limit:query.limit?Number(query.limit):void 0})}},params:Type.Object({entity_name:Type.String()}),query:Type.Object({status:Type.Optional(Type.String()),page:Type.Optional(Type.String()),limit:Type.Optional(Type.String())})})],groups=[];if(config.endpoints?.enabled!==!1)groups.push({prefix:basePath,guards:[requireUser],routes:verificationDeclared}),logger2.info(`[Verification] Routes registered at ${basePath}`);else logger2.info("[Verification] endpoints.enabled is false; review routes not mounted");if(config.flowEndpoints?.enabled!==!1){let flowDeclared=[defineRoute({method:"GET",path:"/",handler:async({query,request})=>{let{verificationService:vs}=getServicesForRequest(request);return{success:!0,data:await vs.listFlows(query.entity_name||void 0)}},query:Type.Object({entity_name:Type.Optional(Type.String())})}),defineRoute({method:"GET",path:"/:flow_id",handler:async({params,request,set:set2})=>{let{verificationService:vs}=getServicesForRequest(request),result=await vs.getFlow(params.flow_id);if(!result)return set2.status=404,{success:!1,message:"Flow not found"};return{success:!0,data:result}},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/",handler:async({body,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.saveFlow(body)},body:Type.Object({flow_id:Type.String(),entity_name:Type.String(),name:Type.String(),description:Type.Optional(Type.String()),trigger_on:Type.Union([Type.Literal("create"),Type.Literal("update"),Type.Literal("delete"),Type.Literal("manual")]),trigger_fields:Type.Optional(Type.Array(Type.String())),is_draft:Type.Boolean(),viewport:Type.Optional(Type.Object({x:Type.Number(),y:Type.Number(),zoom:Type.Number()})),graph:Type.Object({steps:Type.Array(Type.Any()),edges:Type.Array(Type.Any()),verifier_configs:Type.Array(Type.Any()),notification_rules:Type.Array(Type.Any()),notification_recipients:Type.Array(Type.Any()),notification_channels:Type.Array(Type.Any())})})}),defineRoute({method:"POST",path:"/:flow_id/publish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.publishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"POST",path:"/:flow_id/unpublish",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.unpublishFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})}),defineRoute({method:"DELETE",path:"/:flow_id",handler:async({params,request})=>{let{verificationService:vs}=getServicesForRequest(request);return await vs.deleteFlow(params.flow_id)},params:Type.Object({flow_id:Type.String()})})];groups.push({prefix:flowBasePath,guards:[createGodminGuard({db,schemaTables,logger:logger2},"verification flow management")],routes:flowDeclared}),logger2.info(`[Verification] Flow routes registered at ${flowBasePath}`)}return{routes:collectRoutes(groups),verificationService:defaultVerificationService,notificationService:defaultNotificationService}}function createNucleusRuntime(deps){return{sendEmail:async(payload)=>{let mailer=deps.getEmailService();if(!mailer?.isAvailable())return{success:!1,error:"No email provider is configured or available"};return mailer.sendEmail(payload)},emailProvider:()=>deps.activeEmailProvider(),isEmailAvailable:()=>!!deps.getEmailService()?.isAvailable(),emailSenderAddress:()=>deps.getEmailService()?.getSenderAddress?.()??""}}function unappliedSettings(config,swagger){let notes=[],say=(option,reality)=>notes.push(`${option} \u2014 ${reality}`);if(swagger?.provider&&swagger.provider!=="scalar")say(`swagger.provider: '${swagger.provider}'`,"only the Scalar viewer is shipped; the document itself is unaffected");if(swagger?.excludeStaticFile!==void 0)say("swagger.excludeStaticFile","nothing distinguishes a static-asset route from any other, so no route is excluded by it. Use `swagger.exclude` to name paths");let pubsub=config.pubsub;if(pubsub?.pubsubName)say("pubsub.pubsubName","names a Dapr component for a publish call this build never makes; realtime delivery goes straight to the connected sockets");if(pubsub?.ack?.retryIntervalMs!==void 0)say("pubsub.ack.retryIntervalMs","there is no interval-based retry loop; unacknowledged messages are redelivered when a client reconnects");if(config.domains?.cloudflare?.fallbackOrigin)say("domains.cloudflare.fallbackOrigin","never sent to Cloudflare; set the fallback origin on the zone itself");if(config.domains?.verification?.defaultMethod&&config.domains.verification.defaultMethod!=="txt")say(`domains.verification.defaultMethod: '${config.domains.verification.defaultMethod}'`,"ownership is always proved with a TXT record; cname and http are not implemented");if(config.database?.type)say("database.type","Postgres is the only engine this build talks to");let schemas=config.database?.schemas;if(Array.isArray(schemas)&&schemas.length>1)say(`database.schemas (${schemas.length} named)`,`only the first is used (\`${schemas[0]}\`); the rest are ignored`);let verification=config.authentication?.register?.emailVerification;if(verification?.provider)say(`authentication.register.emailVerification.provider: '${verification.provider}'`,"the sender is chosen globally from the `email` config and the secrets store, not per mail");let templates=verification?.templates,withTemplatePath=Object.entries(templates??{}).filter(([,t])=>t?.htmlTemplatePath).map(([name2])=>name2);if(withTemplatePath.length>0)say(`authentication.register.emailVerification.templates.${withTemplatePath.join("/")}.htmlTemplatePath`,"the mail bodies are built in code; only `subject` is taken from this config");return notes}init_utils5();function asText(value2){return typeof value2==="string"&&value2.trim()?value2.trim():void 0}function fieldOf(path7){let text3=asText(path7);if(!text3)return;return text3.replace(/^\//,"").replace(/\//g,".")||void 0}function fromValidator(error3){let candidate=error3;if(typeof candidate?.validator?.Errors!=="function")return;try{let fields=[],reason;for(let item of candidate.validator.Errors(candidate.value)){let field=fieldOf(item?.path);if(field&&!fields.includes(field))fields.push(field);if(reason??=asText(item?.message),fields.length>=4)break}return fields.length||reason?{fields,reason}:void 0}catch{return}}function compose(where,reason){if(where&&reason)return`Invalid request: ${where} \u2014 ${reason}`;if(where)return`Invalid request: ${where}`;if(reason)return`Invalid request: ${reason}`;return"Invalid request"}function fromMessage(raw){let text3=asText(raw);if(!text3)return"Invalid request";let payload;try{payload=JSON.parse(text3)}catch{return}if(!payload||typeof payload!=="object"||payload.type!=="validation")return;let on=asText(payload.on),property=fieldOf(payload.property),reason=asText(payload.summary)??asText(payload.message),where=property&&property!=="root"?`${on?`${on}.`:""}${property}`:on?`the request ${on}`:void 0;return compose(where,reason)}function describeValidationError(error3){if(typeof error3!=="string"&&error3){let detail=fromValidator(error3);if(detail){let on=asText(error3.type),where=detail.fields.length?detail.fields.map((field)=>on?`${on}.${field}`:field).join(", "):on?`the request ${on}`:void 0;return compose(where,detail.reason)}return fromMessage(error3.message)}return fromMessage(error3)}function statusOfError(code,error3){if(typeof code==="number")return code;let carried=error3?.status;if(typeof carried==="number"&&carried>=100&&carried<=599)return carried;return 500}init_auth();init_backup();init_payment();init_marketplace();init_storage2();var mergeEntitiesByName=(entities)=>{let entityMap=new Map;for(let entity of entities){let existing=entityMap.get(entity.table_name),mergedColumns=entity.columns??existing?.columns;entityMap.set(entity.table_name,{...existing||{},...entity,columns:mergedColumns})}return Array.from(entityMap.values())},effectiveConfigEntities=(configEntities)=>{if(!configEntities.some((e)=>e.extends))return configEntities;let{entities:resolved}=resolveEntities(SYSTEM_TABLES,configEntities),byName=new Map(resolved.map((t)=>[t.table_name,t]));return configEntities.map((e)=>e.extends?byName.get(e.table_name)??e:e)},normalizeSystemTable=(table)=>({table_name:table.table_name,excluded_methods:table.excluded_methods?[...table.excluded_methods]:void 0,columns:table.columns?table.columns.map((column)=>({name:column.name,type:column.type})):void 0}),extractSchemaTableEntities=(schemaTables)=>{let entities=[];for(let[_key,tableValue]of Object.entries(schemaTables)){if(!tableValue||typeof tableValue!=="object")continue;let tableObj=tableValue,underscoreMeta=tableObj._;if(underscoreMeta?.name){entities.push({table_name:underscoreMeta.name});continue}let symbols3=Object.getOwnPropertySymbols(tableObj);for(let sym of symbols3){let symValue=tableObj[sym];if(symValue&&typeof symValue==="object"){let symMeta=symValue;if(symMeta.name&&typeof symMeta.name==="string"){entities.push({table_name:symMeta.name});break}}}}return entities},lastMountedGroups=[];function getMountedRuntime2(){return getMountedRuntime()}function getResolvedOptions2(){return getResolvedOptions()}function getMountedRouteGroups(){return lastMountedGroups}var lastMountedSocket=null;function getMountedSocket(){return lastMountedSocket}var lastStaticAssets=null;function getMountedStaticAssets(){return lastStaticAssets}var lastBootSteps=null,lastShutdownSteps=null,lastAuthMiddleware=null,lastErrorHandler=null,lastAfterHandler=null;function getAfterHandler(){return lastAfterHandler}function getErrorHandler(){if(!lastErrorHandler)throw Error("getErrorHandler() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastErrorHandler}function getAuthMiddleware(){if(!lastAuthMiddleware)throw Error("getAuthMiddleware() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastAuthMiddleware}function getBootSteps(){if(!lastBootSteps)throw Error("getBootSteps() before NucleusElysiaPlugin() \u2014 nothing has been built yet");return lastBootSteps}function getShutdownSteps(){return lastShutdownSteps??[]}function resolveOverrides(groups,logger2){let claim=new Map,dropped=[],kept=[];for(let index=groups.length-1;index>=0;index--){let group=groups[index];if(!group)continue;let routes=[];for(let position=group.routes.length-1;position>=0;position--){let route=group.routes[position];if(!route)continue;let declared=route.path==="/"?"":route.path,key2=`${route.method} ${`${group.prefix??""}${declared}`||"/"}`,winner=claim.get(key2);if(winner){let summary=route.detail?.summary??"(no summary)";dropped.push(`${key2} \u2014 kept "${winner.summary}", dropped "${summary}"`);continue}claim.set(key2,{summary:route.detail?.summary??"(no summary)"}),routes.unshift(route)}if(routes.length>0)kept.unshift({...group,routes})}if(dropped.length>0)logger2.warn(`[Routes] ${dropped.length} route(s) replaced by a later declaration of the same path`,{replaced:dropped});return kept}async function buildNucleus(config){beginRouteRecording();let plugin=collectRoutes(),routeGetHealth=defineRoute({method:"GET",path:"/health",handler:()=>({status:"ok",timestamp:Date.now()})});if(mountRoutes(plugin,[{routes:[routeGetHealth]}]),config.staticAssets!==!1){let path8=__require("path"),fs3=__require("fs"),assetsPath;if(typeof config.staticAssets==="string")assetsPath=config.staticAssets;else{let localPath=path8.join(process.cwd(),"public"),resolvedPkgPath="";for(let pkgName of["nucleus-core-ts","nucleus-core"])try{let pkgJson=__require.resolve(`${pkgName}/package.json`),candidate=path8.join(path8.dirname(pkgJson),"public");if(fs3.existsSync(candidate)){resolvedPkgPath=candidate;break}}catch{}if(resolvedPkgPath)assetsPath=resolvedPkgPath;else if(fs3.existsSync(localPath))assetsPath=localPath;else assetsPath=localPath}recordStaticAssets(assetsPath)}let publicRoutes=[],resolvedOptions,configDir=process.cwd(),configFilePath=null;if(typeof config.options==="string"){let fs3=__require("fs"),path8=__require("path"),configPath=path8.isAbsolute(config.options)?config.options:path8.resolve(process.cwd(),config.options);configDir=path8.dirname(configPath),configFilePath=configPath;let configContent=fs3.readFileSync(configPath,"utf-8");resolvedOptions=JSON.parse(configContent)}else resolvedOptions=config.options;if(resolvedOptions.email?.gmail?.json_file_path){let path8=__require("path"),gmailPath=resolvedOptions.email.gmail.json_file_path;if(!path8.isAbsolute(gmailPath))resolvedOptions.email.gmail.json_file_path=path8.resolve(configDir,gmailPath)}recordResolvedOptions(resolvedOptions);let{authentication,audit,entities,database}=resolvedOptions,isDev=resolvedOptions.mode==="development",loggingConfig=resolvedOptions.logging,logger2=new Logger({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],auditEnabled:audit?.enabled??!1,...audit?.suppressReasons!==void 0?{auditSuppressReasons:audit.suppressReasons}:{},...audit?.minSeverity!==void 0?{auditMinSeverity:audit.minSeverity}:{},enabledScopes:loggingConfig?.scopes||["*"]});Logger.getInstance().configure({service:resolvedOptions.appId||"nucleus",level:loggingConfig?.level||(isDev?"debug":"info"),prettyPrint:loggingConfig?.prettyPrint??isDev,colorize:loggingConfig?.colorize??isDev,includeCallerInfo:loggingConfig?.includeCallerInfo??isDev,redactKeys:loggingConfig?.redactKeys||[],enabledScopes:loggingConfig?.scopes||["*"]});let serverLogsConfig=resolvedOptions.monitoring?.serverLogs,serverLogBuffer=serverLogsConfig?.enabled===!0?getServerLogBuffer({capacity:serverLogsConfig.capacity??2000,maxLineLength:serverLogsConfig.maxLineLength}):null;if(serverLogBuffer){let transport=new ServerLogTransport(serverLogBuffer);if(logger2.addTransport(transport),Logger.getInstance().addTransport(transport),serverLogsConfig?.captureStdout!==!1)attachStreamCapture(serverLogBuffer);logger2.info(`[ServerLogs] Buffer active (capacity: ${serverLogBuffer.getCapacity()}, stdout capture: ${serverLogsConfig?.captureStdout!==!1})`)}{let{entities:resolvedForBoot,errors:extendErrors,warnings:extendWarnings}=resolveEntities(SYSTEM_TABLES,entities??[],{consumerMode:authentication?.mode==="consumer"});for(let warning of extendWarnings)logger2.warn(warning);let syncErrors=[],syncMappings=resolvedOptions.authentication?.oauth?.profileSync?.mappings??[];if(syncMappings.length>0){let columnsFor=(name2)=>{return(resolvedForBoot.find((t)=>t.table_name===name2)?.columns??[]).map((c)=>c.name)};syncErrors.push(...validateProfileSyncTargets(syncMappings,{users:columnsFor("users"),profiles:columnsFor("profiles")}))}if(extendErrors.length>0||syncErrors.length>0){let detail=[...extendErrors.map((e)=>`  ${e.code}: ${e.message}`),...syncErrors.map((m)=>`  PROFILE_SYNC_TARGET: ${m}`)].join(`
 `);throw Error(`Invalid Nucleus config:
 ${detail}`)}let sensitiveNames=resolvedForBoot.flatMap((e)=>e.columns??[]).filter((c)=>c.sensitive===!0).map((c)=>c.name);{registerSensitiveColumns(sensitiveNames);let redactUnion=[...loggingConfig?.redactKeys||[],...sensitiveColumnNames()];if(logger2.configure({redactKeys:redactUnion}),Logger.getInstance().configure({redactKeys:redactUnion}),sensitiveNames.length>0)logger2.info("[Schema] Sensitive columns registered",{columns:sensitiveNames})}}let requestLogConfig={enabled:loggingConfig?.requests?.enabled!==!1,logArrival:loggingConfig?.requests?.logArrival===!0,includeQuery:loggingConfig?.requests?.includeQuery!==!1,slowThresholdMs:loggingConfig?.requests?.slowThresholdMs??3000,excludePaths:loggingConfig?.requests?.excludePaths??["/health"]},isRequestLogExcluded=(pathname)=>requestLogConfig.excludePaths.some((p)=>p.endsWith("*")?pathname.startsWith(p.slice(0,-1)):pathname===p),envValidation=validateEnvVariables(resolvedOptions);if(!envValidation.valid){for(let error3 of envValidation.errors)logger2.error(`[CONFIG] ${error3.message}`,{field:error3.field,envName:error3.envName});throw Error("Nucleus configuration error: Missing required environment variables. Check logs for details.")}let{resolved:envResolved}=envValidation;{let secretEntries=[["accessToken",envResolved.accessTokenSecret],["refreshToken",envResolved.refreshTokenSecret],["sessionToken",envResolved.sessionTokenSecret]];for(let[name2,value2]of secretEntries)if(value2&&value2.length<32)logger2.warn(`[Security] authentication.${name2}.secret is only ${value2.length} chars \u2014 use at least ${"32"} random bytes.`);let present=secretEntries.map(([,v])=>v).filter((v)=>!!v);if(present.length>1&&new Set(present).size<present.length)logger2.warn("[Security] Two or more of the access/refresh/session token secrets are identical \u2014 use a distinct secret for each.")}let tokenNames={access_token:authentication?.accessToken?.name||"access_token",refresh_token:authentication?.refreshToken?.name||"refresh_token",session_token:authentication?.sessionToken?.name||"session_token"},csrfConfig=resolveCsrfConfig(authentication?.csrf),csrfAuthCookieNames=[tokenNames.session_token,tokenNames.access_token],targetSchemaName=database?.sharedSchema||database?.schemas?.[0]||"main",targetSchema=pgSchema2(targetSchemaName);if(envResolved.databaseUrl)await ensureDatabaseExists(envResolved.databaseUrl,logger2,envResolved.databaseAuthMode);let db=null,dbPool=null,dbAuthMode=envResolved.databaseAuthMode||"password",backgroundIntervals=[],trackInterval=(timer)=>{timer.unref?.(),backgroundIntervals.push(timer)};if(envResolved.databaseUrl){let{Pool:Pool2}=await import("pg"),poolOptions=resolveDbPoolConfig(database?.pool);if(dbAuthMode==="password")dbPool=new Pool2({connectionString:envResolved.databaseUrl,...poolOptions});else{let{getPostgresToken:getPostgresToken2}=await Promise.resolve().then(() => (init_Azure(),exports_Azure));await getPostgresToken2(),dbPool=new Pool2({connectionString:envResolved.databaseUrl,password:getPostgresToken2,ssl:{rejectUnauthorized:!0},...poolOptions}),logger2.info(`[Database] Using Entra ID auth mode: ${dbAuthMode}`)}db=drizzle2(dbPool),dbPool.on("error",(err)=>{logger2.warn("[Database] idle pool client error",{error:err instanceof Error?err.message:String(err)})})}let isMultiTenant=database?.isMultiTenant===!0,tenantRegistry=null,schemaTables={},schemaRelations={},claimsCache=null;if(config.schema){let schemasPath=__require("path").resolve(process.cwd(),config.schema),schemas=__require(schemasPath);schemaTables=schemas.createAllTablesForSchema?schemas.createAllTablesForSchema(targetSchema):{}}if(config.relations){let relationsPath=__require("path").resolve(process.cwd(),config.relations);schemaRelations=__require(relationsPath)}let secretsService=null;if(resolvedOptions.secrets?.enabled){let masterKey=resolveMasterKey(resolvedOptions.secrets.encryptionKey);if(!db)logger2.warn("[Secrets] secrets.enabled=true but no database is configured \u2014 disabled");else if(!masterKey)logger2.error("[Secrets] secrets.enabled=true but no encryption key resolved \u2014 set secrets.encryptionKey or NUCLEUS_SECRETS_KEY. Credential storage is disabled; env and literal values still work.");else if(!schemaTables[SECRETS_TABLE])logger2.error(`[Secrets] secrets.enabled=true but the "${SECRETS_TABLE}" table is missing from the generated schema \u2014 re-run schema generation. Credential storage is disabled.`);else{secretsService=new SecretsService({store:new SecretsStore({db,resolveTable:(tableName)=>schemaTables[tableName],masterKey}),logger:logger2,refreshIntervalMs:resolvedOptions.secrets.refreshIntervalMs,getRedis:()=>getRedisManager()}),logger2.info("[Secrets] Credential store enabled");try{if(await secretsService.refresh(),secretsService.isReady())logger2.info("[Secrets] Credentials preloaded for boot-time resolution",{storedCredentials:secretsService.size()})}catch(error3){logger2.warn("[Secrets] Preload failed \u2014 env and literal values still resolve",{error:error3 instanceof Error?error3.message:String(error3)})}}}let resolveCredential=(scope,key2,configValue)=>{if(secretsService)return secretsService.value(scope,key2,configValue);if(!configValue)return;let fromEnv=process.env[configValue];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(configValue)?void 0:configValue},resolveRedirectUrl=(value2)=>{if(!value2)return;let fromEnv=process.env[value2];if(fromEnv)return fromEnv;return/^[A-Z][A-Z0-9_]{2,}$/.test(value2)?void 0:value2},withResolvedRedirects=(node,keys)=>{if(!node)return node;let resolved={...node};for(let key2 of keys)if(typeof node[key2]==="string")resolved[key2]=resolveRedirectUrl(node[key2]);return resolved},trustedAppOrigins=()=>{let configured=normalizeTrustedOrigins(resolvedOptions.authentication?.trustedAppOrigins);if(!secretsService)return configured;let resolved=secretsService.listValue("authentication","trustedAppOrigins",configured);return resolved.length>0?resolved:configured},liveOAuthProviders=(resolvedProviders)=>{if(!secretsService)return resolvedProviders;let declared=resolvedOptions.authentication?.oauth?.providers??{},live={};for(let[providerName,providerConfig]of Object.entries(resolvedProviders)){let declaredConfig=declared[providerName]??{},entry={...providerConfig};for(let key2 of["clientId","clientSecret","tenantId","redirectUri"]){let declaredValue=declaredConfig[key2],bootValue=providerConfig[key2];Object.defineProperty(entry,key2,{get:()=>{let resolved=secretsService?.value(`authentication.oauth.providers.${providerName}`,key2,typeof declaredValue==="string"?declaredValue:void 0);if(resolved!==void 0)return resolved;return looksLikeEnvName(typeof bootValue==="string"?bootValue:void 0)?void 0:bootValue},enumerable:!0,configurable:!0})}live[providerName]=entry}return live},storageProvider=null;if(resolvedOptions.storage?.enabled){let storageBase=resolvedOptions.storage.basePath||"./uploads";storageProvider=createStorageProvider({provider:resolvedOptions.storage.provider,basePath:storageBase,smb:resolvedOptions.storage.smb,resolveCredential},{logger:logger2}),setStorageProvider(storageProvider)}let buildStorageProvider=(kind)=>{if(!resolvedOptions.storage?.enabled)return null;return createStorageProvider({provider:kind,basePath:resolvedOptions.storage.basePath||"./uploads",smb:resolvedOptions.storage.smb,resolveCredential:(scope,key2,configValue)=>scope==="storage"&&key2==="provider"?kind:resolveCredential(scope,key2,configValue)},{logger:logger2})};recordSwagger(config.swagger);let systemTables=config.systemTables||[];publicRoutes=buildPublicRoutes(resolvedOptions,systemTables,"",targetSchemaName);for(let note of unhonouredIsPublicDeclarations(resolvedOptions))logger2.warn(`[Auth] ${note}`);let unapplied=unappliedSettings(resolvedOptions,config.swagger);if(unapplied.length>0)logger2.warn(`[Config] ${unapplied.length} setting(s) are accepted but do nothing in this build:
   ${unapplied.join(`