@calimero-network/mero-js 19.15.0 → 19.16.0

package/dist/index.browser.mjs

@@ -1,3 +1,3 @@
-function ae(r){let e=r.filter(Boolean);if(e.length===0)return;let t=AbortSignal;if(typeof t.any=="function")try{return t.any(e)}catch{}let n=new AbortController,s=o=>{n.abort(o.target.reason);for(let i of e)i.removeEventListener("abort",s)};for(let o of e){if(o.aborted)return AbortSignal.abort(o.reason);o.addEventListener("abort",s,{once:!0})}return n.signal}function ce(r){if(typeof AbortSignal.timeout=="function")return AbortSignal.timeout(r);let e=new AbortController;return setTimeout(()=>{e.abort(new DOMException("Timeout","TimeoutError"))},r),e.signal}var gt=new Set(["token_reuse","token_revoked"]);function mt(r){if(r)try{let e=JSON.parse(r),t=e?.error;if(typeof t=="string"&&t.trim()!=="")return t;let n=t?.message;if(typeof n=="string"&&n.trim()!=="")return n;let s=e?.detail;if(typeof s=="string"&&s.trim()!=="")return s}catch{}}var R=class extends Error{constructor(t,n,s,o,i){let a=mt(i);super(a?`HTTP ${t} ${n}: ${a}`:`HTTP ${t} ${n}`);this.status=t;this.statusText=n;this.url=s;this.headers=o;this.bodyText=i;this.name="HTTPError"}toJSON(){return{status:this.status,statusText:this.statusText,url:this.url,headers:Ee(this.headers),bodyText:this.bodyText}}},T=class extends R{constructor(t,n,s,o,i,a){super(n,s,o,i,a);this.reason=t;this.name="AuthRevokedError";this.message=`Authentication revoked (${t}): HTTP ${n} ${s}`}};function Ee(r){let e={};return r.forEach((t,n)=>{e[n]=t}),e}var L=class{constructor(e){this.transport=e;this.refreshTokenPromise=null;this.onTokenRefreshPromise=null}async get(e,t){return this.request(e,{...t,method:"GET"})}async post(e,t,n){return this.request(e,{...n,method:"POST",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...n?.headers}})}async put(e,t,n){return this.request(e,{...n,method:"PUT",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...n?.headers}})}async delete(e,t){return this.request(e,{...t,method:"DELETE"})}async patch(e,t,n){return this.request(e,{...n,method:"PATCH",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...n?.headers}})}async head(e,t){let n=await this.makeRequest(e,{...t,method:"HEAD",parse:"response"});return{headers:Ee(n.headers),status:n.status}}async request(e,t){return this.makeRequest(e,t)}async makeRequest(e,t,n=0,s){let i=this.buildUrl(e),a=s??Date.now(),l=this.createAbortSignal(t),u=await this.buildHeaders(t?.headers),h;u instanceof Headers?(h={},u.forEach((g,S)=>{h[S]=g})):h=u;let m={method:t?.method||"GET",headers:h},f=t?.body instanceof ReadableStream||typeof t?.body=="object"&&t?.body!==null&&"getReader"in t.body&&!(t.body instanceof Blob);(t?.body!==void 0&&!f||t?.body!==void 0&&f&&n===0)&&(m.body=t.body);let b;if(n>0&&s!==void 0){let g=t?.timeoutMs||this.transport.timeoutMs;if(g){let S=Date.now()-a,D=Math.max(0,g-S);b=this.createAbortSignal({...t,timeoutMs:D})}else b=this.createAbortSignal(t)}else b=l;b&&(m.signal=b),this.transport.credentials!==void 0&&(m.credentials=this.transport.credentials),t?.mode!==void 0&&(m.mode=t.mode),t?.cache!==void 0&&(m.cache=t.cache),t?.redirect!==void 0&&(m.redirect=t.redirect),t?.referrer!==void 0&&(m.referrer=t.referrer),t?.referrerPolicy!==void 0&&(m.referrerPolicy=t.referrerPolicy),t?.integrity!==void 0&&(m.integrity=t.integrity),t?.keepalive!==void 0&&(m.keepalive=t.keepalive);try{let g=await this.transport.fetch(i,m);if(!g.ok){let S=await this.getBodyText(g),D=new R(g.status,g.statusText,i,g.headers,S),I=g.headers.get("x-auth-error");if((g.status===401||g.status===403)&&I&&gt.has(I)){if(this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,this.transport.onAuthRevoked)try{await this.transport.onAuthRevoked()}catch{}throw new T(I,g.status,g.statusText,i,g.headers,S)}let q=t?.signal?.aborted===!0;if(g.status===401&&this.transport.refreshToken&&I==="token_expired"&&n<1&&!f&&!q)try{let v=this.refreshTokenPromise;v||(v=this.transport.refreshToken(),this.refreshTokenPromise=v);let ie=await v;if(!ie||ie.trim()==="")throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,new Error("Refresh token returned empty token");if(!this.transport.onTokenRefresh)throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,new Error("onTokenRefresh callback is required when refreshToken is provided. The callback must update the token storage so getAuthToken() returns the new token.");let V=this.onTokenRefreshPromise;V||(V=this.transport.onTokenRefresh(ie),this.onTokenRefreshPromise=V),await V,this.refreshTokenPromise=null,this.onTokenRefreshPromise=null;let Pe=t?.timeoutMs||this.transport.timeoutMs;if(Pe&&s!==void 0){let dt=Date.now()-a;if(Pe-dt<=0)throw D}return this.makeRequest(e,t,n+1,a)}catch(v){throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,v instanceof Error&&v.message.includes("onTokenRefresh")?v:D}throw D}return this.parseResponse(g,t?.parse)}catch(g){throw g instanceof R||g instanceof Error&&g.message.includes("onTokenRefresh")?g:new R(0,"Network Error",i,new Headers,g instanceof Error?g.message:"Unknown error")}}buildUrl(e){if(e.startsWith("http://")||e.startsWith("https://"))return e;let t=this.transport.baseUrl;return e.startsWith("/")?`${t.endsWith("/")?t.slice(0,-1):t}${e}`:`${t.endsWith("/")?t:`${t}/`}${e}`}createAbortSignal(e){let t=[];this.transport.defaultAbortSignal&&t.push(this.transport.defaultAbortSignal),e?.signal&&t.push(e.signal);let n=e?.timeoutMs||this.transport.timeoutMs;return n&&t.push(ce(n)),t.length>0?ae(t):void 0}async buildHeaders(e){let t={...this.transport.defaultHeaders};if(this.transport.getAuthToken)try{let n=await this.transport.getAuthToken();n&&n.trim()!==""&&(t.Authorization=`Bearer ${n}`)}catch{}return e&&(e instanceof Headers?e.forEach((n,s)=>{t[s]=n}):Array.isArray(e)?e.forEach(([n,s])=>{t[n]=s}):Object.assign(t,e)),t}async parseResponse(e,t){switch(t){case"text":return await e.text();case"blob":return await e.blob();case"arrayBuffer":return await e.arrayBuffer();case"response":return e;default:{let n=await e.text();if(!n)return null;try{return JSON.parse(n)}catch{throw new Error(`Expected a JSON response (status ${e.status}) but body was not JSON: ${n.slice(0,200)}`)}}}}async getBodyText(e){try{let t=await e.text();return t.length>65536?t.slice(0,65536)+"...":t}catch{return""}}};function le(r){return new L(r)}function U(r){let e={fetch:(t,n)=>globalThis.fetch(t,n),baseUrl:r.baseUrl,getAuthToken:r.getAuthToken,onTokenRefresh:r.onTokenRefresh,refreshToken:r.refreshToken,onAuthRevoked:r.onAuthRevoked,defaultHeaders:r.defaultHeaders,timeoutMs:r.timeoutMs,credentials:r.credentials,defaultAbortSignal:r.defaultAbortSignal};return le(e)}function J(r){let e=r.fetch??globalThis.fetch;if(!e)throw new Error("No fetch implementation available. Please provide a fetch implementation (e.g., undici.fetch) or use Node.js 18+ which has native fetch support.");let n={fetch:e===globalThis.fetch?(s,o)=>globalThis.fetch(s,o):(s,o)=>e(s,o),baseUrl:r.baseUrl,getAuthToken:r.getAuthToken,onTokenRefresh:r.onTokenRefresh,refreshToken:r.refreshToken,onAuthRevoked:r.onAuthRevoked,defaultHeaders:r.defaultHeaders,timeoutMs:r.timeoutMs,credentials:r.credentials,defaultAbortSignal:r.defaultAbortSignal};return le(n)}function ue(r){return typeof window<"u"?U(r):J(r)}function ht(r,e){if(e<=0)return!1;let n=r?.name;if(n==="TimeoutError")return!0;if(n==="AbortError")return!1;let s=r;if("status"in s&&typeof s.status=="number"){let o=s.status;return o>=500||o===429}return n==="TypeError"}function ft(r){let t=250*Math.pow(2,r-1),n=(Math.random()-.5)*.4*t;return Math.max(0,t+n)}async function F(r,e={}){let{attempts:t=3}=e,n;for(let s=1;s<=t;s++)try{return await r(s)}catch(o){if(n=o,!ht(n,t-s))throw n;let i=ft(s),u=n.headers?.get?.("Retry-After");if(u){let h=parseInt(u,10);if(!isNaN(h))i=Math.max(i,h*1e3);else{let m=new Date(u);if(!isNaN(m.getTime())){let f=Math.max(0,m.getTime()-Date.now());i=Math.max(i,Math.min(f,6e4))}}}await new Promise(h=>setTimeout(h,i))}throw n||new Error("Retry failed without error")}function yt(r,e={}){return async(...t)=>F(()=>r(...t),e)}var P=class{constructor(e){this.httpClient=e}async getHealth(){let e=await this.httpClient.get("/auth/health");if(!e.data)throw new Error("Health response data is null");return e.data}async getIdentity(){let e=await this.httpClient.get("/admin/identity");if(!e.data)throw new Error("Identity response data is null");return e.data}async getProviders(){let e=await this.httpClient.get("/auth/providers");if(!e.data)throw new Error("Providers response data is null");return e.data}async getLoginPage(){return this.httpClient.get("/auth/login",{parse:"text"})}async generateTokens(e){return this.httpClient.post("/auth/token",e)}async refreshToken(e){return this.httpClient.post("/auth/refresh",e)}async generateMockTokens(e){return this.httpClient.post("/auth/mock-token",e)}async validateToken(e){try{let t=await this.validateTokenGet(e);return{valid:t.status===200,headers:t.headers,status:t.status}}catch{return{valid:!1,headers:{},status:401}}}async validateTokenGet(e){let t=await this.httpClient.head("/auth/validate",{headers:{Authorization:`Bearer ${e}`}});return{status:t.status,headers:t.headers}}async revokeTokens(e){let t=await this.httpClient.post("/admin/revoke",e);if(!t.data)throw new Error("Revoke tokens response data is null");return t.data}async listRootKeys(){let e=await this.httpClient.get("/admin/keys");if(!e.data)throw new Error("Root keys response data is null");return e.data}async createRootKey(e){let t=await this.httpClient.post("/admin/keys",e);if(!t.data)throw new Error("Create root key response data is null");return t.data}async deleteRootKey(e){return this.httpClient.delete(`/admin/keys/${e}`)}async listClientKeys(){let e=await this.httpClient.get("/admin/keys/clients");if(!e.data)throw new Error("Client keys response data is null");return e.data}async generateClientKey(e){return this.httpClient.post("/admin/client-key",e)}async deleteClientKey(e,t){return this.httpClient.delete(`/admin/keys/${e}/clients/${t}`)}async getKeyPermissions(e){return this.httpClient.get(`/admin/keys/${e}/permissions`)}async updateKeyPermissions(e,t){return this.httpClient.put(`/admin/keys/${e}/permissions`,{add:t.add,remove:t.remove})}};var H=class{async get(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async post(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async put(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async delete(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async patch(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async head(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async request(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}};function An(r){let e=new H;return new P(e)}function vn(r){let e=new H;return new P(e)}function kn(r){let e=new H;return new P(e)}function Me(r,e){return new P(r)}var $={CAN_CREATE_CONTEXT:1,CAN_INVITE_MEMBERS:2,CAN_JOIN_OPEN_SUBGROUPS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CAN_CREATE_SUBGROUP:32,CAN_DELETE_SUBGROUP:64,CAN_MANAGE_VISIBILITY:128,CAN_MANAGE_METADATA:256,CAN_AUTHOR_ON_BEHALF:512};function pe(r,e){let t=e>>>0;return(r&t)>>>0===t}function de(r,e){return(r|e)>>>0}function Sn(r,e){return(r&~e)>>>0}function c(r){return r?.data}function bt(r,e){let[t,n]=_e(r),[s,o]=_e(e),i=t.split("."),a=s.split("."),l=Math.max(i.length,a.length);for(let f=0;f<l;f++){let b=Ue(i[f]??"0",a[f]??"0");if(b!==0)return b}if(n===void 0&&o===void 0)return 0;if(n===void 0)return 1;if(o===void 0)return-1;let u=n.split("."),h=o.split("."),m=Math.max(u.length,h.length);for(let f=0;f<m;f++){if(f>=u.length)return-1;if(f>=h.length)return 1;let b=Ue(u[f],h[f]);if(b!==0)return b}return 0}function _e(r){let e=r.split("+",1)[0],t=e.indexOf("-");return t===-1?[e,void 0]:[e.slice(0,t),e.slice(t+1)]}function Ue(r,e){let t=/^\d+$/.test(r),n=/^\d+$/.test(e);if(t&&n){let s=Number(r)-Number(e);return s<0?-1:s>0?1:0}return t?-1:n?1:r<e?-1:r>e?1:0}async function Rt(r,e,t){return F(async()=>{let n=await fetch(r,{signal:AbortSignal.timeout(1e4)});if(!n.ok){let s=new Error(`registry ${e} fetch failed (${n.status}) for ${t}`);throw s.status=n.status,s}return n},{attempts:3})}var E=class{constructor(e){this.httpClient=e}async healthCheck(){return c(await this.httpClient.get("/admin-api/health"))}async isAuthed(){return this.httpClient.get("/admin-api/is-authed")}async installApplication(e){return c(await this.httpClient.post("/admin-api/install-application",e))}async getRegistryVersions(e,t){let n=new URL("/api/v2/bundles",new URL(e).origin);n.searchParams.set("package",t);let o=await(await Rt(n.toString(),"versions",t)).json();return(Array.isArray(o)?o:[]).map(i=>i.appVersion).filter(i=>typeof i=="string").sort((i,a)=>bt(a,i))}async installDevApplication(e){return c(await this.httpClient.post("/admin-api/install-dev-application",e))}async uninstallApplication(e){return c(await this.httpClient.delete(`/admin-api/applications/${e}`))}async listApplications(){return c(await this.httpClient.get("/admin-api/applications"))}async getApplication(e){return c(await this.httpClient.get(`/admin-api/applications/${e}`))}async listApplicationVersions(e){return c(await this.httpClient.get(`/admin-api/applications/${e}/versions`))}async getApplicationAbi(e,t){let n=t?`?service_name=${encodeURIComponent(t)}`:"";return c(await this.httpClient.get(`/admin-api/applications/${e}/abi${n}`))}async listPackages(){let e=await this.httpClient.get("/admin-api/packages");return e?.data??e}async listPackageVersions(e){let t=await this.httpClient.get(`/admin-api/packages/${encodeURIComponent(e)}/versions`);return t?.data??t}async getLatestPackageVersion(e){return this.httpClient.get(`/admin-api/packages/${encodeURIComponent(e)}/latest`)}async createContext(e){let t={...e,initializationParams:e.initializationParams??[]};return c(await this.httpClient.post("/admin-api/contexts",t))}async deleteContext(e){return c(await this.httpClient.delete(`/admin-api/contexts/${e}`))}async getContexts(){return c(await this.httpClient.get("/admin-api/contexts"))}async getContext(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}`))}async getContextsForApplication(e){return c(await this.httpClient.get(`/admin-api/contexts/for-application/${e}`))}async generateContextIdentity(){return c(await this.httpClient.post("/admin-api/identity/context",{}))}async getContextIdentities(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/identities`))}async getContextIdentitiesOwned(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/identities-owned`))}async joinContext(e){return c(await this.httpClient.post(`/admin-api/contexts/${e}/join`,{}))}async getContextGroup(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/group`))}async getContextStorage(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/storage`))}async syncContext(e){let t=e?`/admin-api/contexts/sync/${e}`:"/admin-api/contexts/sync";await this.httpClient.post(t,{})}async resyncContext(e,t={}){return await this.httpClient.post(`/admin-api/contexts/${e}/resync`,t)??{contextId:e,resyncStarted:!0}}async inviteSpecializedNode(e){return c(await this.httpClient.post("/admin-api/contexts/invite-specialized-node",e))}async updateContextApplication(e,t){await this.httpClient.post(`/admin-api/contexts/${e}/application`,t)}async getContextsWithExecutorsForApplication(e){let t=await this.httpClient.get(`/admin-api/contexts/with-executors/for-application/${e}`);return Array.isArray(t)?t:t?.contexts??t?.data??[]}async uploadBlob(e){let t=new URLSearchParams;e.hash&&t.set("hash",e.hash),e.contextId&&t.set("context_id",e.contextId);let n=t.toString(),s=n?`/admin-api/blobs?${n}`:"/admin-api/blobs",o=c(await this.httpClient.request(s,{method:"PUT",body:e.data,headers:{"Content-Type":"application/octet-stream"}}));return{blobId:o.blob_id,size:o.size}}async deleteBlob(e){let t=await this.httpClient.delete(`/admin-api/blobs/${e}`);return{blobId:t.blob_id,deleted:t.deleted}}async listBlobs(){return{blobs:c(await this.httpClient.get("/admin-api/blobs")).blobs.map(t=>({blobId:t.blob_id,size:t.size}))}}blobPath(e,t){if(!t?.contextId)return`/admin-api/blobs/${e}`;let n=new URLSearchParams({context_id:t.contextId});return`/admin-api/blobs/${e}?${n.toString()}`}async getBlob(e,t){return this.httpClient.get(this.blobPath(e,t),{parse:"arrayBuffer"})}async getBlobInfo(e,t){let{headers:n}=await this.httpClient.head(this.blobPath(e,t)),s=Number(n["content-length"]);return{blobId:n["x-blob-id"]??e,size:Number.isFinite(s)?s:0,hash:n["x-blob-hash"],mimeType:n["x-blob-mime-type"],source:n["x-blob-source"]}}async createContextAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/context",{alias:e.alias,contextId:e.contextId}))}async createApplicationAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/application",{alias:e.alias,applicationId:e.applicationId}))}async lookupContextAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/context/${encodeURIComponent(e)}`,{}))}async lookupApplicationAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/application/${encodeURIComponent(e)}`,{}))}async deleteContextAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/context/${encodeURIComponent(e)}`,{}))}async deleteApplicationAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/application/${encodeURIComponent(e)}`,{}))}async listContextAliases(){return c(await this.httpClient.get("/admin-api/alias/list/context"))}async listApplicationAliases(){return c(await this.httpClient.get("/admin-api/alias/list/application"))}async createDeviceAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/device",{alias:e.alias,deviceId:e.deviceId}))}async lookupDeviceAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/device/${encodeURIComponent(e)}`,{}))}async deleteDeviceAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/device/${encodeURIComponent(e)}`,{}))}async listDeviceAliases(){return c(await this.httpClient.get("/admin-api/alias/list/device"))}async listNamespaces(){return c(await this.httpClient.get("/admin-api/namespaces"))}async getNamespace(e){return c(await this.httpClient.get(`/admin-api/namespaces/${e}`))}async getNodeIdentity(){return c(await this.httpClient.get("/admin-api/identity"))}async getNamespaceIdentity(e){let t=await this.getNodeIdentity();return{namespaceId:e,publicKey:t.publicKey,account:t.accountId}}async performIntent(e,t){return c(await this.httpClient.post(`/admin-api/contexts/${e}/intents`,t))}async getIntentRelay(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/intents`))}async listNamespacesForApplication(e){return c(await this.httpClient.get(`/admin-api/namespaces/for-application/${e}`))}async createNamespace(e){return c(await this.httpClient.post("/admin-api/namespaces",e))}async deleteNamespace(e){return c(await this.httpClient.request(`/admin-api/namespaces/${e}`,{method:"DELETE",body:"{}",headers:{"Content-Type":"application/json"}}))}async createNamespaceInvitation(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/invite`,t??{}))}async admitJoin(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/admit`,t,{timeoutMs:65e3}))}async joinNamespace(e,t){let n=c(await this.httpClient.post(`/admin-api/namespaces/${e}/join`,t,{timeoutMs:65e3}));return n&&n.namespaceId===void 0&&n.groupId!==void 0?{...n,namespaceId:n.groupId}:n}async createGroupInNamespace(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/groups`,t??{}))}async listNamespaceGroups(e){return c(await this.httpClient.get(`/admin-api/namespaces/${e}/groups`))}async initAccountPairing(e){return c(await this.httpClient.post("/admin-api/account/pair-init",e))}async completeAccountPairing(e){return c(await this.httpClient.post("/admin-api/account/pair-complete",e))}async relinkAccountDevice(e,t){return c(await this.httpClient.post(`/admin-api/account/devices/${e}/relink`,t??{}))}async rescopeAccountDevice(e,t){return c(await this.httpClient.put(`/admin-api/account/devices/${encodeURIComponent(e)}/scope`,t))}async signWithAccountRoot(e){return c(await this.httpClient.post("/admin-api/account/sign-with-root",e))}async labelAccountDevice(e,t){return c(await this.httpClient.put(`/admin-api/account/devices/${encodeURIComponent(e)}/label`,t))}async listAccountDevices(){return(await this.httpClient.get("/admin-api/account/devices")).devices}async listAccountApplications(){return(await this.httpClient.get("/admin-api/account/applications")).applications}async revokeAccountDevice(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/account/revoke`,t))}async getGroupInfo(e){return c(await this.httpClient.get(`/admin-api/groups/${e}`))}async getDefaultCapabilities(e){return(await this.getGroupInfo(e)).defaultCapabilities}async getSubgroupVisibility(e){return(await this.getGroupInfo(e)).subgroupVisibility}async deleteGroup(e){return c(await this.httpClient.request(`/admin-api/groups/${e}`,{method:"DELETE",body:"{}",headers:{"Content-Type":"application/json"}}))}async listGroupMembers(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/members`);if(!Array.isArray(t?.members)){let n=String(e).replace(/[\r\n\t\s]/g,"").slice(0,64);throw new Error(`Invalid listGroupMembers response for group ${n}: missing or non-array \`members\` field`)}return t}async listGroupContexts(e){return c(await this.httpClient.get(`/admin-api/groups/${e}/contexts`))}async addGroupMembers(e,t){await this.httpClient.post(`/admin-api/groups/${e}/members`,t)}async removeGroupMembers(e,t){await this.httpClient.post(`/admin-api/groups/${e}/members/remove`,t)}async updateMemberRole(e,t,n){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/role`,n)}async getMemberCapabilities(e,t){return c(await this.httpClient.get(`/admin-api/groups/${e}/members/${t}/capabilities`))}async setMemberCapabilities(e,t,n){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/capabilities`,n)}async setDefaultCapabilities(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/default-capabilities`,t)}async openToDelegatedExecution(e){let t=await this.getDefaultCapabilities(e);if(pe(t,$.CAN_AUTHOR_ON_BEHALF))return{changed:!1,defaultCapabilities:t};let n=de(t,$.CAN_AUTHOR_ON_BEHALF);return await this.setDefaultCapabilities(e,{defaultCapabilities:n}),{changed:!0,defaultCapabilities:n}}async grantAuthorship(e,t){let{capabilities:n}=await this.getMemberCapabilities(e,t);if(pe(n,$.CAN_AUTHOR_ON_BEHALF))return{changed:!1,capabilities:n};let s=de(n,$.CAN_AUTHOR_ON_BEHALF);return await this.setMemberCapabilities(e,t,{capabilities:s}),{changed:!0,capabilities:s}}async setSubgroupVisibility(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/subgroup-visibility`,t)}async setTeeAdmissionPolicy(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/tee-admission-policy`,t)}async getTeeAdmissionPolicy(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/settings/tee-admission-policy`);return t.data??t}async setGroupMetadata(e,t){await this.httpClient.put(`/admin-api/groups/${e}/metadata`,t)}async getGroupMetadata(e){return(await this.httpClient.get(`/admin-api/groups/${e}/metadata`))?.data??null}async setMemberMetadata(e,t,n){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/metadata`,n)}async getMemberMetadata(e,t){return(await this.httpClient.get(`/admin-api/groups/${e}/members/${t}/metadata`))?.data??null}async setContextMetadata(e,t,n){await this.httpClient.put(`/admin-api/groups/${e}/contexts/${t}/metadata`,n)}async getContextMetadata(e,t){return(await this.httpClient.get(`/admin-api/groups/${e}/contexts/${t}/metadata`))?.data??null}async syncGroup(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/sync`,{}))}async upgradeGroup(e,t){return c(await this.httpClient.post(`/admin-api/groups/${e}/upgrade`,t))}async getGroupUpgradeStatus(e){return c(await this.httpClient.get(`/admin-api/groups/${e}/upgrade/status`))}async getMigrationStatus(e){let t=encodeURIComponent(e);return this.httpClient.get(`/admin-api/groups/${t}/migration-status`)}async getCascadeStatus(e){let t=encodeURIComponent(e);return c(await this.httpClient.get(`/admin-api/groups/${t}/cascade-status`))}async retryGroupUpgrade(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/upgrade/retry`,{}))}async reparentGroup(e,t){let n=await this.httpClient.post(`/admin-api/groups/${e}/reparent`,t);return n?.data??n}async listSubgroups(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/subgroups`);return t.subgroups??t.data??[]}async detachContextFromGroup(e,t){await this.httpClient.post(`/admin-api/groups/${e}/contexts/${t}/remove`,{})}async createGroupInvitation(e,t){return c(await this.httpClient.post(`/admin-api/groups/${e}/invite`,t??{}))}async joinGroup(e){return c(await this.httpClient.post("/admin-api/groups/join",e))}async joinSubgroupInheritance(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/join-via-inheritance`,{}))}async getTeeInfo(){return c(await this.httpClient.get("/admin-api/tee/info"))}async teeAttest(e){return c(await this.httpClient.post("/admin-api/tee/attest",e))}async teeVerifyQuote(e){return c(await this.httpClient.post("/admin-api/tee/verify-quote",e))}async getPeersCount(){return this.httpClient.get("/admin-api/peers")}async getNetworkStatus(){return this.httpClient.get("/admin-api/network/status")}async getUsage(){return this.httpClient.get("/admin-api/usage")}async getCertificate(){return this.httpClient.get("/admin-api/certificate",{parse:"text"})}async createGroup(e){return c(await this.httpClient.post("/admin-api/groups",e))}async leaveGroup(e){await this.httpClient.post(`/admin-api/groups/${e}/leave`,{})}async leaveContext(e){await this.httpClient.post(`/admin-api/contexts/${e}/leave`,{})}async leaveNamespace(e){await this.httpClient.post(`/admin-api/namespaces/${e}/leave`,{})}async issueOwnershipProof(e,t){return this.httpClient.post(`/admin-api/groups/${e}/issue-ownership-proof`,t)}async issueNamespaceOwnershipProof(e,t){return this.httpClient.post(`/admin-api/groups/${e}/issue-namespace-ownership-proof`,t)}async setMemberAutoFollow(e,t,n){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/auto-follow`,n)}async abortMigration(e){return this.httpClient.post(`/admin-api/groups/${e}/migration/abort`,{})}};function _n(r){return Array.from(new TextEncoder().encode(r),e=>e.toString(16).padStart(2,"0")).join("")}function Ln(r){return new E(U(r))}function Hn(r){return new E(J(r))}function $n(r){return new E(ue(r))}function Ne(r,e){return new E(r)}function ge(r){try{let e=r.indexOf("#");if(e===-1)return null;let t=r.substring(e+1),n=new URLSearchParams(t),s=n.get("access_token");return s?{accessToken:s,refreshToken:n.get("refresh_token")??"",applicationId:n.get("application_id")??"",contextId:n.get("context_id")??"",contextIdentity:n.get("context_identity")??"",nodeUrl:n.get("node_url")??""}:null}catch{return null}}function me(r,e){let t=new URLSearchParams;return t.set("callback-url",e.callbackUrl),e.permissions&&e.permissions.length>0&&t.set("permissions",e.permissions.join(",")),t.set("mode",e.mode),e.packageName&&(t.set("package-name",e.packageName),e.packageVersion&&t.set("package-version",e.packageVersion),e.registryUrl&&t.set("registry-url",e.registryUrl)),`${r.replace(/\/+$/,"")}/auth/login?${t.toString()}`}var z=class extends Error{constructor(e,t,n,s){super(t),this.name="RpcError",this.code=e,this.data=n,this.type=s}};async function he(r,e,t){let n=await r.post("/jsonrpc",{jsonrpc:"2.0",id:1,method:e,params:t});if(n.error){let s=n.error;throw new z(s.code??-1,s.message??s.type??"RPC error",s.data,s.type)}return n.result}var O=class{constructor(e){this.httpClient=e.httpClient}async execute(e){let t=await he(this.httpClient,"execute",{contextId:e.contextId,method:e.method,argsJson:e.argsJson??{}});return t&&"output"in t?t.output:t}async migrateMyEntries(e){return this.execute({contextId:e,method:"migrate_my_entries"})}async countMyPending(e){return this.execute({contextId:e,method:"count_my_pending"})}};var xt=new Set(["MigrationStarted","MigrationProgress","CascadeProgress","MigrationCompleted"]);function Ge(r){return r.type!==void 0&&xt.has(r.type)}var wt=new Set(["token_reuse","token_revoked"]),Ct=new Set([401,403]);function qe(r){let e=r.headers.get("x-auth-error");return!e||!Ct.has(r.status)?null:wt.has(e)?e:null}var N=class{constructor(e){this.sessionId=null;this.abortController=null;this.reconnectTimer=null;this.subscribedContextIds=new Set;this.subscribedGroupIds=new Set;this.closed=!1;this.listeners={connect:[],event:[],error:[]};this.baseUrl=e.baseUrl.replace(/\/+$/,""),this.getAuthToken=e.getAuthToken,this.reconnectDelayMs=e.reconnectDelayMs??3e3}on(e,t){let n=e;if(n in this.listeners){let s=this.listeners[n];s.includes(t)||s.push(t)}}off(e,t){let n=e;if(n in this.listeners){let s=this.listeners[n],o=s.indexOf(t);o!==-1&&s.splice(o,1)}}onAppVersionChanged(e){let t=n=>{if(n.type!=="AppVersionChanged")return;let s=n.data;e({contextId:n.contextId,fromVersion:s?.fromVersion,toVersion:s?.toVersion})};return this.on("event",t),()=>this.off("event",t)}onMigrationEvent(e){let t=n=>{Ge(n)&&e(n)};return this.on("event",t),()=>this.off("event",t)}emit(e,t){let n=e;if(n in this.listeners)for(let s of this.listeners[n])try{s(t)}catch{}}async connect(){if(!(this.abortController&&!this.closed)){this.closed=!1,this.abortController=new AbortController;try{let e=await this.getAuthToken(),t=`${this.baseUrl}/sse`,n=await fetch(t,{headers:{Authorization:`Bearer ${e}`,Accept:"text/event-stream"},signal:this.abortController.signal});if(!n.ok){let s=qe(n),o=await n.text().catch(()=>{});throw s?new T(s,n.status,n.statusText,t,n.headers,o):new R(n.status,n.statusText,t,n.headers,o)}if(!n.body)throw new Error("SSE response has no body");this.readStream(n.body).catch(s=>{if(this.closed)return;let o=s instanceof Error?s:new Error(String(s));this.emit("error",o),this.scheduleReconnect()})}catch(e){if(this.closed)return;let t=e instanceof Error?e:new Error(String(e));if(this.emit("error",t),t instanceof T)return;this.scheduleReconnect()}}}async readStream(e){let t=e.getReader(),n=new TextDecoder,s="";try{for(;;){let{done:o,value:i}=await t.read();if(o)break;s+=n.decode(i,{stream:!0});let a=s.split(`
-`);s=a.pop()??"";for(let l of a)if(l.startsWith("data:")){let u=l.slice(5).trim();u&&this.handleMessage(u)}}if(s+=n.decode(),s.startsWith("data:")){let o=s.slice(5).trim();o&&this.handleMessage(o)}}catch(o){if(this.closed)return;let i=o instanceof Error?o:new Error(String(o));this.emit("error",i)}this.closed||this.scheduleReconnect()}handleMessage(e){try{let t=JSON.parse(e);if(t.type==="connect"&&t.session_id){this.sessionId=t.session_id,this.emit("connect",t.session_id),(this.subscribedContextIds.size>0||this.subscribedGroupIds.size>0)&&this.sendSubscription("subscribe",{contextIds:[...this.subscribedContextIds],groupIds:[...this.subscribedGroupIds]});return}if(!t.result)return;let n=t.result.data;if(Array.isArray(n))try{let s=new Uint8Array(n),o=new TextDecoder().decode(s);n=JSON.parse(o)}catch{}if(t.result.contextId){this.emit("event",{contextId:t.result.contextId,type:t.result.type,data:n});return}t.result.groupId&&this.emit("event",{groupId:t.result.groupId,type:t.result.type,data:n})}catch{}}async subscribe(e){let t=Array.isArray(e)?{contextIds:e}:e,n=(t.contextIds??[]).filter(o=>!this.subscribedContextIds.has(o)),s=(t.groupIds??[]).filter(o=>!this.subscribedGroupIds.has(o));for(let o of t.contextIds??[])this.subscribedContextIds.add(o);for(let o of t.groupIds??[])this.subscribedGroupIds.add(o);(n.length>0||s.length>0)&&this.sessionId&&await this.sendSubscription("subscribe",{contextIds:n,groupIds:s})}async unsubscribe(e){let t=Array.isArray(e)?{contextIds:e}:e,n=(t.contextIds??[]).filter(o=>this.subscribedContextIds.has(o)),s=(t.groupIds??[]).filter(o=>this.subscribedGroupIds.has(o));for(let o of t.contextIds??[])this.subscribedContextIds.delete(o);for(let o of t.groupIds??[])this.subscribedGroupIds.delete(o);(n.length>0||s.length>0)&&this.sessionId&&await this.sendSubscription("unsubscribe",{contextIds:n,groupIds:s})}async sendSubscription(e,t){try{let n=await this.getAuthToken(),s={};t.contextIds&&t.contextIds.length>0&&(s.contextIds=t.contextIds),t.groupIds&&t.groupIds.length>0&&(s.groupIds=t.groupIds);let o=await fetch(`${this.baseUrl}/sse/subscription`,{method:"POST",headers:{Authorization:`Bearer ${n}`,"Content-Type":"application/json"},body:JSON.stringify({id:this.sessionId,method:e,params:s})});if(!o.ok){let i=qe(o),a=await o.text().catch(()=>{});this.emit("error",i?new T(i,o.status,o.statusText,`${this.baseUrl}/sse/subscription`,o.headers,a):new R(o.status,o.statusText,`${this.baseUrl}/sse/subscription`,o.headers,a))}}catch(n){this.emit("error",n instanceof Error?n:new Error(`SSE ${e} failed`))}}forceReconnect(){this.abortController&&(this.abortController.abort(),this.abortController=null),this.sessionId=null,this.connect()}scheduleReconnect(){this.closed||(this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.forceReconnect()},this.reconnectDelayMs))}close(){this.closed=!0,this.abortController&&(this.abortController.abort(),this.abortController=null),this.reconnectTimer&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=null),this.sessionId=null,this.subscribedContextIds.clear(),this.subscribedGroupIds.clear()}};var Q=class Q{constructor(e){this.ws=null;this.closed=!1;this.reconnectAttempt=0;this.reconnectTimer=null;this.subscribedContextIds=new Set;this.subscribedGroupIds=new Set;this.listeners={connect:[],event:[],error:[]};this.baseUrl=e.baseUrl.replace(/\/+$/,""),this.getAuthToken=e.getAuthToken}on(e,t){let n=e;if(n in this.listeners){let s=this.listeners[n];s.includes(t)||s.push(t)}}off(e,t){let n=e;if(n in this.listeners){let s=this.listeners[n],o=s.indexOf(t);o!==-1&&s.splice(o,1)}}emit(e,t){let n=e;if(n in this.listeners)for(let s of this.listeners[n])try{s(t)}catch{}}async connect(){if(!(this.ws&&(this.ws.readyState===0||this.ws.readyState===1))){this.closed=!1;try{let e=await this.getAuthToken();if(!e)throw new Error("No authentication token available for WebSocket connection");let t=this.baseUrl.replace(/^http/,"ws");this.ws=new WebSocket(`${t}/ws?token=${encodeURIComponent(e)}`),this.ws.onopen=()=>{this.reconnectAttempt=0,this.emit("connect"),this.resubscribeAfterReconnect()},this.ws.onmessage=n=>{this.handleMessage(n.data)},this.ws.onerror=()=>{this.emit("error",new Error("WebSocket error"))},this.ws.onclose=()=>{this.closed||this.scheduleReconnect()}}catch(e){if(this.closed)return;let t=e instanceof Error?e:new Error(String(e));this.emit("error",t),this.scheduleReconnect()}}}handleMessage(e){if(typeof e=="string")try{let t=JSON.parse(e);if(!t.result)return;let n=t.result.data;if(Array.isArray(n))try{let s=new Uint8Array(n),o=new TextDecoder().decode(s);n=JSON.parse(o)}catch{}if(t.result.contextId){this.emit("event",{contextId:t.result.contextId,type:t.result.type,data:n});return}t.result.groupId&&this.emit("event",{groupId:t.result.groupId,type:t.result.type,data:n})}catch{}}subscribe(e){let t=Array.isArray(e)?{contextIds:e}:e;for(let n of t.contextIds??[])this.subscribedContextIds.add(n);for(let n of t.groupIds??[])this.subscribedGroupIds.add(n);this.ws&&this.ws.readyState===1&&this.sendMessage({id:null,method:"subscribe",params:this.buildSubscriptionParams(t.contextIds??[],t.groupIds??[])})}unsubscribe(e){let t=Array.isArray(e)?{contextIds:e}:e;for(let n of t.contextIds??[])this.subscribedContextIds.delete(n);for(let n of t.groupIds??[])this.subscribedGroupIds.delete(n);this.ws&&this.ws.readyState===1&&this.sendMessage({id:null,method:"unsubscribe",params:this.buildSubscriptionParams(t.contextIds??[],t.groupIds??[])})}resubscribeAfterReconnect(){this.subscribedContextIds.size===0&&this.subscribedGroupIds.size===0||this.sendMessage({id:null,method:"subscribe",params:this.buildSubscriptionParams([...this.subscribedContextIds],[...this.subscribedGroupIds])})}buildSubscriptionParams(e,t){let n={};return e.length>0&&(n.contextIds=e),t.length>0&&(n.groupIds=t),n}sendMessage(e){this.ws&&this.ws.readyState===1&&this.ws.send(JSON.stringify(e))}scheduleReconnect(){if(this.closed)return;this.reconnectTimer&&clearTimeout(this.reconnectTimer);let e=Math.min(1e3*Math.pow(2,this.reconnectAttempt),Q.MAX_BACKOFF_MS);this.reconnectAttempt++,this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},e)}close(){this.closed=!0,this.reconnectTimer&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=null),this.ws&&(this.ws.onclose=null,this.ws.close(),this.ws=null),this.subscribedContextIds.clear(),this.subscribedGroupIds.clear()}};Q.MAX_BACKOFF_MS=3e4;var G=Q;function X(){return{encode(r){return Array.from(new TextEncoder().encode(JSON.stringify(r)))},decode(r){return JSON.parse(new TextDecoder().decode(new Uint8Array(r)))}}}var j=class{constructor(e){this.httpClient=e.httpClient,this.sse=e.sse}async set(e,t,n=X()){await he(this.httpClient,"set_ephemeral",{contextId:e,state:n.encode(t)})}subscribe(e,t,n=X()){let s=o=>{let i=o;if(i.type!=="Ephemeral"||i.contextId!==e)return;let a=i.data;if(!a?.author)return;let l=!!a.removed,u={author:a.author,state:l||a.state===void 0?void 0:n.decode(a.state),removed:l};a.ageMs!==void 0&&(u.ageMs=a.ageMs),t(u)};return this.sse.on("event",s),this.sse.connect().catch(()=>{}),this.sse.subscribe([e]).catch(()=>{}),()=>{this.sse.off("event",s)}}};var Le=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]);function x(r){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,r,!0),e}function y(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function p(r,e,t){let n=r.trim();if(!/^[0-9a-fA-F]*$/.test(n)||n.length!==t*2)throw new Error(`${e} must be ${t*2} hex characters, got ${n.length}`);let s=new Uint8Array(t);for(let o=0;o<t;o+=1)s[o]=Number.parseInt(n.slice(o*2,o*2+2),16);return s}function w(r){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(r),!0),e}function d(...r){let e=new Uint8Array(r.reduce((n,s)=>n+s.length,0)),t=0;for(let n of r)e.set(n,t),t+=n.length;return e}async function k(r,e){let t=[w(r.length),r];for(let n of e)t.push(w(n.length),n);return new Uint8Array(await crypto.subtle.digest("SHA-256",d(...t)))}async function C(r){let e=p(r,"deviceSecret",32),t=d(Le,e);try{return await crypto.subtle.importKey("pkcs8",t,{name:"Ed25519"},!1,["sign"])}catch(n){let s=n instanceof Error?`: ${n.message}`:"";throw new Error("this runtime has no WebCrypto Ed25519, so a warrant cannot be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; otherwise mint the warrant with `merod account warrant`"+s)}}async function A(r){let e=p(r,"deviceSecret",32),t=d(Le,e),n=await crypto.subtle.importKey("pkcs8",t,{name:"Ed25519"},!0,["sign"]),o=(await crypto.subtle.exportKey("jwk",n)).x;return Uint8Array.from(atob(o.replace(/-/g,"+").replace(/_/g,"/")),i=>i.charCodeAt(0))}var At=new TextEncoder().encode("calimero.device.cert.v1"),He=new TextEncoder().encode("calimero.account.genesis.v1"),vt=new TextEncoder().encode("calimero.device.id.v1"),fe=2;async function $e(r,e){if(e.length!==16)throw new Error(`nonce must be 16 bytes, got ${e.length}`);let t=p(r,"account",32);return y(await k(vt,[t,e]))}async function ye(r){return k(At,[p(r.account,"account",32),p(r.device,"device",32),p(r.signPublicKey,"signPublicKey",32),p(r.kemPublicKey,"kemPublicKey",32),x(r.keyEpoch),x(r.deviceEpoch)])}function Oe(r){return d(new Uint8Array([fe]),r.rootPublicKey,x(0),p(r.account,"account",32),p(r.device,"device",32),p(r.signPublicKey,"signPublicKey",32),p(r.kemPublicKey,"kemPublicKey",32),x(r.keyEpoch),x(r.deviceEpoch),r.signature)}async function je(r){let e=await A(r.rootSecret),t=y(await k(He,[d(new Uint8Array([fe]),e)])),n=0,s=await ye({account:t,device:r.device,signPublicKey:r.signPublicKey,kemPublicKey:r.kemPublicKey,keyEpoch:n,deviceEpoch:r.deviceEpoch}),o=await C(r.rootSecret),i=new Uint8Array(await crypto.subtle.sign("Ed25519",o,s)),a=Oe({rootPublicKey:e,account:t,device:r.device,signPublicKey:r.signPublicKey,kemPublicKey:r.kemPublicKey,keyEpoch:n,deviceEpoch:r.deviceEpoch,signature:i});return y(a)}async function Y(r){let e=await A(r);return y(await k(He,[d(new Uint8Array([fe]),e)]))}var be=["abandon","ability","able","about","above","absent","absorb","abstract","absurd","abuse","access","accident","account","accuse","achieve","acid","acoustic","acquire","across","act","action","actor","actress","actual","adapt","add","addict","address","adjust","admit","adult","advance","advice","aerobic","affair","afford","afraid","again","age","agent","agree","ahead","aim","air","airport","aisle","alarm","album","alcohol","alert","alien","all","alley","allow","almost","alone","alpha","already","also","alter","always","amateur","amazing","among","amount","amused","analyst","anchor","ancient","anger","angle","angry","animal","ankle","announce","annual","another","answer","antenna","antique","anxiety","any","apart","apology","appear","apple","approve","april","arch","arctic","area","arena","argue","arm","armed","armor","army","around","arrange","arrest","arrive","arrow","art","artefact","artist","artwork","ask","aspect","assault","asset","assist","assume","asthma","athlete","atom","attack","attend","attitude","attract","auction","audit","august","aunt","author","auto","autumn","average","avocado","avoid","awake","aware","away","awesome","awful","awkward","axis","baby","bachelor","bacon","badge","bag","balance","balcony","ball","bamboo","banana","banner","bar","barely","bargain","barrel","base","basic","basket","battle","beach","bean","beauty","because","become","beef","before","begin","behave","behind","believe","below","belt","bench","benefit","best","betray","better","between","beyond","bicycle","bid","bike","bind","biology","bird","birth","bitter","black","blade","blame","blanket","blast","bleak","bless","blind","blood","blossom","blouse","blue","blur","blush","board","boat","body","boil","bomb","bone","bonus","book","boost","border","boring","borrow","boss","bottom","bounce","box","boy","bracket","brain","brand","brass","brave","bread","breeze","brick","bridge","brief","bright","bring","brisk","broccoli","broken","bronze","broom","brother","brown","brush","bubble","buddy","budget","buffalo","build","bulb","bulk","bullet","bundle","bunker","burden","burger","burst","bus","business","busy","butter","buyer","buzz","cabbage","cabin","cable","cactus","cage","cake","call","calm","camera","camp","can","canal","cancel","candy","cannon","canoe","canvas","canyon","capable","capital","captain","car","carbon","card","cargo","carpet","carry","cart","case","cash","casino","castle","casual","cat","catalog","catch","category","cattle","caught","cause","caution","cave","ceiling","celery","cement","census","century","cereal","certain","chair","chalk","champion","change","chaos","chapter","charge","chase","chat","cheap","check","cheese","chef","cherry","chest","chicken","chief","child","chimney","choice","choose","chronic","chuckle","chunk","churn","cigar","cinnamon","circle","citizen","city","civil","claim","clap","clarify","claw","clay","clean","clerk","clever","click","client","cliff","climb","clinic","clip","clock","clog","close","cloth","cloud","clown","club","clump","cluster","clutch","coach","coast","coconut","code","coffee","coil","coin","collect","color","column","combine","come","comfort","comic","common","company","concert","conduct","confirm","congress","connect","consider","control","convince","cook","cool","copper","copy","coral","core","corn","correct","cost","cotton","couch","country","couple","course","cousin","cover","coyote","crack","cradle","craft","cram","crane","crash","crater","crawl","crazy","cream","credit","creek","crew","cricket","crime","crisp","critic","crop","cross","crouch","crowd","crucial","cruel","cruise","crumble","crunch","crush","cry","crystal","cube","culture","cup","cupboard","curious","current","curtain","curve","cushion","custom","cute","cycle","dad","damage","damp","dance","danger","daring","dash","daughter","dawn","day","deal","debate","debris","decade","december","decide","decline","decorate","decrease","deer","defense","define","defy","degree","delay","deliver","demand","demise","denial","dentist","deny","depart","depend","deposit","depth","deputy","derive","describe","desert","design","desk","despair","destroy","detail","detect","develop","device","devote","diagram","dial","diamond","diary","dice","diesel","diet","differ","digital","dignity","dilemma","dinner","dinosaur","direct","dirt","disagree","discover","disease","dish","dismiss","disorder","display","distance","divert","divide","divorce","dizzy","doctor","document","dog","doll","dolphin","domain","donate","donkey","donor","door","dose","double","dove","draft","dragon","drama","drastic","draw","dream","dress","drift","drill","drink","drip","drive","drop","drum","dry","duck","dumb","dune","during","dust","dutch","duty","dwarf","dynamic","eager","eagle","early","earn","earth","easily","east","easy","echo","ecology","economy","edge","edit","educate","effort","egg","eight","either","elbow","elder","electric","elegant","element","elephant","elevator","elite","else","embark","embody","embrace","emerge","emotion","employ","empower","empty","enable","enact","end","endless","endorse","enemy","energy","enforce","engage","engine","enhance","enjoy","enlist","enough","enrich","enroll","ensure","enter","entire","entry","envelope","episode","equal","equip","era","erase","erode","erosion","error","erupt","escape","essay","essence","estate","eternal","ethics","evidence","evil","evoke","evolve","exact","example","excess","exchange","excite","exclude","excuse","execute","exercise","exhaust","exhibit","exile","exist","exit","exotic","expand","expect","expire","explain","expose","express","extend","extra","eye","eyebrow","fabric","face","faculty","fade","faint","faith","fall","false","fame","family","famous","fan","fancy","fantasy","farm","fashion","fat","fatal","father","fatigue","fault","favorite","feature","february","federal","fee","feed","feel","female","fence","festival","fetch","fever","few","fiber","fiction","field","figure","file","film","filter","final","find","fine","finger","finish","fire","firm","first","fiscal","fish","fit","fitness","fix","flag","flame","flash","flat","flavor","flee","flight","flip","float","flock","floor","flower","fluid","flush","fly","foam","focus","fog","foil","fold","follow","food","foot","force","forest","forget","fork","fortune","forum","forward","fossil","foster","found","fox","fragile","frame","frequent","fresh","friend","fringe","frog","front","frost","frown","frozen","fruit","fuel","fun","funny","furnace","fury","future","gadget","gain","galaxy","gallery","game","gap","garage","garbage","garden","garlic","garment","gas","gasp","gate","gather","gauge","gaze","general","genius","genre","gentle","genuine","gesture","ghost","giant","gift","giggle","ginger","giraffe","girl","give","glad","glance","glare","glass","glide","glimpse","globe","gloom","glory","glove","glow","glue","goat","goddess","gold","good","goose","gorilla","gospel","gossip","govern","gown","grab","grace","grain","grant","grape","grass","gravity","great","green","grid","grief","grit","grocery","group","grow","grunt","guard","guess","guide","guilt","guitar","gun","gym","habit","hair","half","hammer","hamster","hand","happy","harbor","hard","harsh","harvest","hat","have","hawk","hazard","head","health","heart","heavy","hedgehog","height","hello","helmet","help","hen","hero","hidden","high","hill","hint","hip","hire","history","hobby","hockey","hold","hole","holiday","hollow","home","honey","hood","hope","horn","horror","horse","hospital","host","hotel","hour","hover","hub","huge","human","humble","humor","hundred","hungry","hunt","hurdle","hurry","hurt","husband","hybrid","ice","icon","idea","identify","idle","ignore","ill","illegal","illness","image","imitate","immense","immune","impact","impose","improve","impulse","inch","include","income","increase","index","indicate","indoor","industry","infant","inflict","inform","inhale","inherit","initial","inject","injury","inmate","inner","innocent","input","inquiry","insane","insect","inside","inspire","install","intact","interest","into","invest","invite","involve","iron","island","isolate","issue","item","ivory","jacket","jaguar","jar","jazz","jealous","jeans","jelly","jewel","job","join","joke","journey","joy","judge","juice","jump","jungle","junior","junk","just","kangaroo","keen","keep","ketchup","key","kick","kid","kidney","kind","kingdom","kiss","kit","kitchen","kite","kitten","kiwi","knee","knife","knock","know","lab","label","labor","ladder","lady","lake","lamp","language","laptop","large","later","latin","laugh","laundry","lava","law","lawn","lawsuit","layer","lazy","leader","leaf","learn","leave","lecture","left","leg","legal","legend","leisure","lemon","lend","length","lens","leopard","lesson","letter","level","liar","liberty","library","license","life","lift","light","like","limb","limit","link","lion","liquid","list","little","live","lizard","load","loan","lobster","local","lock","logic","lonely","long","loop","lottery","loud","lounge","love","loyal","lucky","luggage","lumber","lunar","lunch","luxury","lyrics","machine","mad","magic","magnet","maid","mail","main","major","make","mammal","man","manage","mandate","mango","mansion","manual","maple","marble","march","margin","marine","market","marriage","mask","mass","master","match","material","math","matrix","matter","maximum","maze","meadow","mean","measure","meat","mechanic","medal","media","melody","melt","member","memory","mention","menu","mercy","merge","merit","merry","mesh","message","metal","method","middle","midnight","milk","million","mimic","mind","minimum","minor","minute","miracle","mirror","misery","miss","mistake","mix","mixed","mixture","mobile","model","modify","mom","moment","monitor","monkey","monster","month","moon","moral","more","morning","mosquito","mother","motion","motor","mountain","mouse","move","movie","much","muffin","mule","multiply","muscle","museum","mushroom","music","must","mutual","myself","mystery","myth","naive","name","napkin","narrow","nasty","nation","nature","near","neck","need","negative","neglect","neither","nephew","nerve","nest","net","network","neutral","never","news","next","nice","night","noble","noise","nominee","noodle","normal","north","nose","notable","note","nothing","notice","novel","now","nuclear","number","nurse","nut","oak","obey","object","oblige","obscure","observe","obtain","obvious","occur","ocean","october","odor","off","offer","office","often","oil","okay","old","olive","olympic","omit","once","one","onion","online","only","open","opera","opinion","oppose","option","orange","orbit","orchard","order","ordinary","organ","orient","original","orphan","ostrich","other","outdoor","outer","output","outside","oval","oven","over","own","owner","oxygen","oyster","ozone","pact","paddle","page","pair","palace","palm","panda","panel","panic","panther","paper","parade","parent","park","parrot","party","pass","patch","path","patient","patrol","pattern","pause","pave","payment","peace","peanut","pear","peasant","pelican","pen","penalty","pencil","people","pepper","perfect","permit","person","pet","phone","photo","phrase","physical","piano","picnic","picture","piece","pig","pigeon","pill","pilot","pink","pioneer","pipe","pistol","pitch","pizza","place","planet","plastic","plate","play","please","pledge","pluck","plug","plunge","poem","poet","point","polar","pole","police","pond","pony","pool","popular","portion","position","possible","post","potato","pottery","poverty","powder","power","practice","praise","predict","prefer","prepare","present","pretty","prevent","price","pride","primary","print","priority","prison","private","prize","problem","process","produce","profit","program","project","promote","proof","property","prosper","protect","proud","provide","public","pudding","pull","pulp","pulse","pumpkin","punch","pupil","puppy","purchase","purity","purpose","purse","push","put","puzzle","pyramid","quality","quantum","quarter","question","quick","quit","quiz","quote","rabbit","raccoon","race","rack","radar","radio","rail","rain","raise","rally","ramp","ranch","random","range","rapid","rare","rate","rather","raven","raw","razor","ready","real","reason","rebel","rebuild","recall","receive","recipe","record","recycle","reduce","reflect","reform","refuse","region","regret","regular","reject","relax","release","relief","rely","remain","remember","remind","remove","render","renew","rent","reopen","repair","repeat","replace","report","require","rescue","resemble","resist","resource","response","result","retire","retreat","return","reunion","reveal","review","reward","rhythm","rib","ribbon","rice","rich","ride","ridge","rifle","right","rigid","ring","riot","ripple","risk","ritual","rival","river","road","roast","robot","robust","rocket","romance","roof","rookie","room","rose","rotate","rough","round","route","royal","rubber","rude","rug","rule","run","runway","rural","sad","saddle","sadness","safe","sail","salad","salmon","salon","salt","salute","same","sample","sand","satisfy","satoshi","sauce","sausage","save","say","scale","scan","scare","scatter","scene","scheme","school","science","scissors","scorpion","scout","scrap","screen","script","scrub","sea","search","season","seat","second","secret","section","security","seed","seek","segment","select","sell","seminar","senior","sense","sentence","series","service","session","settle","setup","seven","shadow","shaft","shallow","share","shed","shell","sheriff","shield","shift","shine","ship","shiver","shock","shoe","shoot","shop","short","shoulder","shove","shrimp","shrug","shuffle","shy","sibling","sick","side","siege","sight","sign","silent","silk","silly","silver","similar","simple","since","sing","siren","sister","situate","six","size","skate","sketch","ski","skill","skin","skirt","skull","slab","slam","sleep","slender","slice","slide","slight","slim","slogan","slot","slow","slush","small","smart","smile","smoke","smooth","snack","snake","snap","sniff","snow","soap","soccer","social","sock","soda","soft","solar","soldier","solid","solution","solve","someone","song","soon","sorry","sort","soul","sound","soup","source","south","space","spare","spatial","spawn","speak","special","speed","spell","spend","sphere","spice","spider","spike","spin","spirit","split","spoil","sponsor","spoon","sport","spot","spray","spread","spring","spy","square","squeeze","squirrel","stable","stadium","staff","stage","stairs","stamp","stand","start","state","stay","steak","steel","stem","step","stereo","stick","still","sting","stock","stomach","stone","stool","story","stove","strategy","street","strike","strong","struggle","student","stuff","stumble","style","subject","submit","subway","success","such","sudden","suffer","sugar","suggest","suit","summer","sun","sunny","sunset","super","supply","supreme","sure","surface","surge","surprise","surround","survey","suspect","sustain","swallow","swamp","swap","swarm","swear","sweet","swift","swim","swing","switch","sword","symbol","symptom","syrup","system","table","tackle","tag","tail","talent","talk","tank","tape","target","task","taste","tattoo","taxi","teach","team","tell","ten","tenant","tennis","tent","term","test","text","thank","that","theme","then","theory","there","they","thing","this","thought","three","thrive","throw","thumb","thunder","ticket","tide","tiger","tilt","timber","time","tiny","tip","tired","tissue","title","toast","tobacco","today","toddler","toe","together","toilet","token","tomato","tomorrow","tone","tongue","tonight","tool","tooth","top","topic","topple","torch","tornado","tortoise","toss","total","tourist","toward","tower","town","toy","track","trade","traffic","tragic","train","transfer","trap","trash","travel","tray","treat","tree","trend","trial","tribe","trick","trigger","trim","trip","trophy","trouble","truck","true","truly","trumpet","trust","truth","try","tube","tuition","tumble","tuna","tunnel","turkey","turn","turtle","twelve","twenty","twice","twin","twist","two","type","typical","ugly","umbrella","unable","unaware","uncle","uncover","under","undo","unfair","unfold","unhappy","uniform","unique","unit","universe","unknown","unlock","until","unusual","unveil","update","upgrade","uphold","upon","upper","upset","urban","urge","usage","use","used","useful","useless","usual","utility","vacant","vacuum","vague","valid","valley","valve","van","vanish","vapor","various","vast","vault","vehicle","velvet","vendor","venture","venue","verb","verify","version","very","vessel","veteran","viable","vibrant","vicious","victory","video","view","village","vintage","violin","virtual","virus","visa","visit","visual","vital","vivid","vocal","voice","void","volcano","volume","vote","voyage","wage","wagon","wait","walk","wall","walnut","want","warfare","warm","warrior","wash","wasp","waste","water","wave","way","wealth","weapon","wear","weasel","weather","web","wedding","weekend","weird","welcome","west","wet","whale","what","wheat","wheel","when","where","whip","whisper","wide","width","wife","wild","will","win","window","wine","wing","wink","winner","winter","wire","wisdom","wise","wish","witness","wolf","woman","wonder","wood","wool","word","work","world","worry","worth","wrap","wreck","wrestle","wrist","write","wrong","yard","year","yellow","you","young","youth","zebra","zero","zone","zoo"];var kt=new TextEncoder().encode("calimero.mdma.account-link.v1\0"),It=new TextEncoder().encode("calimero.mdma.account-login.v1\0"),K=256,Ke=K/32,Re=(K+Ke)/11;async function Be(){let r=crypto.getRandomValues(new Uint8Array(K/8));return Ve(y(r),await Tt(r))}async function We(r){let e=St(r);return Ve(y(await Dt(e)),e.join(" "))}async function M(r){return p(r,"secret",32),{secret:r,publicKey:y(await A(r)),accountId:await Y(r)}}async function B(r){if(!r.nonce)throw new Error("nonce is required to sign an account link");let e=await C(r.rootSecret),t=new Uint8Array(await crypto.subtle.sign("Ed25519",e,d(kt,new TextEncoder().encode(r.nonce))));return ze(t)}async function Z(r){if(!r.nonce)throw new Error("nonce is required to sign an account login");let e=await C(r.rootSecret),t=new Uint8Array(await crypto.subtle.sign("Ed25519",e,d(It,new TextEncoder().encode(r.nonce))));return ze(t)}async function Ve(r,e){return{...await M(r),phrase:e}}function St(r){let e=r.normalize("NFKD").toLowerCase().trim().split(/\s+/),t=e[0]===""?0:e.length;if(t!==Re)throw new Error(`recovery phrase must be ${Re} words, got ${t}`);return e}async function Tt(r){let e=Fe(r)+await Je(r),t=[];for(let n=0;n<Re;n+=1){let s=Number.parseInt(e.slice(n*11,n*11+11),2);t.push(be[s])}return t.join(" ")}async function Dt(r){let e="";for(let n of r){let s=be.indexOf(n);if(s<0)throw new Error(`"${n}" is not a word in the recovery phrase list`);e+=s.toString(2).padStart(11,"0")}let t=new Uint8Array(K/8);for(let n=0;n<t.length;n+=1)t[n]=Number.parseInt(e.slice(n*8,n*8+8),2);if(e.slice(K)!==await Je(t))throw new Error("recovery phrase checksum failed \u2014 check for a mistyped or transposed word");return t}async function Je(r){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",r));return Fe(e).slice(0,Ke)}function Fe(r){let e="";for(let t of r)e+=t.toString(2).padStart(8,"0");return e}function ze(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}var Pt=new TextEncoder().encode("calimero.mdma.routing-read.v1\0");async function Qe(r,e){p(e,"deviceSecret",32);let t=await C(e),n=d(Pt,new TextEncoder().encode(r)),s=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},t,n));return Et(s)}async function ee(r,e){return{"X-Calimero-Credential":e.credential,"X-Calimero-Nonce":r.nonce,"X-Calimero-Signature":await Qe(r.nonce,e.deviceSecret)}}function Et(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}var Mt="https://cloud.calimero.network",_t="x-mdma-session-refresh",Ut="x-mdma-session-expires",_=class{constructor(e={}){this.session=null;this.baseUrl=(e.cloudBaseUrl||Mt).replace(/\/+$/,""),this.onSession=e.onSession;let t=e.fetch;this.fetchImpl=t?(n,s)=>t(n,s):(n,s)=>globalThis.fetch(n,s),this.timeoutMs=e.timeoutMs??1e4,this.routingCredential=e.routingCredential,e.sessionToken&&(this.session={sessionToken:e.sessionToken,expiresAt:0,user:{email:""}})}getSession(){return this.session}isSignedIn(){return this.session!==null}async signInWithGoogle(e){let t=await this.request("POST","/api/auth/google",{body:{id_token:e},anonymous:!0});return this.adoptSession(t)}async signInWithAccount(e){let t=await M(e),{nonce:n}=await this.getAccountLoginChallenge();return this.submitAccountLogin({rootPublicKey:t.publicKey,nonce:n,signature:await Z({rootSecret:e,nonce:n})})}async getAccountLoginChallenge(){let e=await this.request("GET","/api/auth/account/challenge",{anonymous:!0});return{nonce:e.nonce,expiresAtMs:e.expires_at_ms}}async submitAccountLogin(e){let t=await this.request("POST","/api/auth/account",{body:{root_public_key:e.rootPublicKey,nonce:e.nonce,signature:e.signature},anonymous:!0});return this.adoptSession(t)}async refreshSession(){let e=await this.request("POST","/api/auth/refresh");return this.adoptSession(e)}async signOut(){try{this.session&&await this.request("POST","/api/auth/logout",{parse:"none"})}finally{this.session=null,this.notifySession(null)}}async getMyNamespaces(){return(await this.request("GET","/api/cloud/me/namespaces")).map(t=>({namespaceId:String(t.namespace_id??t.group_id??""),groupId:String(t.group_id??t.namespace_id??""),haStatus:String(t.ha_status??"none"),haEnabledAt:t.ha_enabled_at??null,contexts:Array.isArray(t.contexts)?t.contexts:[],fleetReplicas:t.fleet_replicas}))}async getNamespaceRelays(e){return((await this.request("GET",`/api/cloud/me/namespaces/${encodeURIComponent(e)}/relays`)).relays??[]).map(n=>({peerId:String(n.peer_id??""),relayUrl:n.relay_url??null,executorAccount:n.executor_account??null,status:String(n.status??""),authorshipReady:n.authorship_ready===!0,lastSeenAt:n.last_seen_at??null,confirmedAt:n.confirmed_at??null}))}async findExecutingRelay(e){return(await this.getNamespaceRelays(e)).find(n=>n.authorshipReady&&n.relayUrl!==null&&n.executorAccount!==null)??null}async getNamespaceRouting(e){let t=await this.request("GET",`/api/cloud/namespaces/${encodeURIComponent(e)}/admitters`,{anonymous:!0,headers:await this.routingProof(e)});return{namespaceId:String(t.namespace_id??e),nodes:(t.admitters??[]).map(n=>({peerId:String(n.peer_id??""),account:n.account??null,relayUrl:n.relay_url??null,admitUrl:n.admit_url??null,status:String(n.status??""),fresh:n.fresh===!0,canAdmit:n.can_admit===!0,authorshipReady:n.authorship_ready===!0,canExecute:n.can_execute===!0})),servable:t.servable===!0,writable:t.writable===!0}}async getRoutingChallenge(e){let t=await this.request("GET",`/api/cloud/namespaces/${encodeURIComponent(e)}/challenge`,{anonymous:!0});return{namespaceId:String(t.namespace_id??e),nonce:String(t.nonce??""),expiresAtMs:Number(t.expires_at_ms??0)}}async routingProof(e){if(!this.routingCredential)return;let t=await this.getRoutingChallenge(e);return ee(t,this.routingCredential)}async getAccountRelaysChallenge(e){let t=await this.request("GET",`/api/cloud/accounts/${encodeURIComponent(e)}/challenge`,{anonymous:!0});return{accountId:String(t.account_id??e),nonce:String(t.nonce??""),expiresAtMs:Number(t.expires_at_ms??0)}}async getAccountRelays(e){if(!this.routingCredential)throw new Error("getAccountRelays needs a routingCredential: construct the client with the device certificate and its signing secret, since this read is proven by the device, not by a session.");let t=await this.getAccountRelaysChallenge(e);return((await this.request("GET",`/api/cloud/accounts/${encodeURIComponent(e)}/relays`,{anonymous:!0,headers:await ee(t,this.routingCredential)})).relays??[]).map(s=>({peerId:String(s.peer_id??""),relayUrl:s.relay_url??null,fresh:s.fresh===!0}))}async findAdmitter(e,t){let{nodes:n}=await this.getNamespaceRouting(e),s=t&&t.length>0?new Set(t.map(o=>o.toLowerCase())):null;return n.find(o=>o.canAdmit&&(s===null||o.account!==null&&s.has(o.account.toLowerCase())))??null}async getMyMachines(){return((await this.request("GET","/api/cloud/me/machines")).machines??[]).map(t=>({peerId:String(t.peer_id??""),relayUrl:t.relay_url??null,executorAccount:t.executor_account??null,canExecute:t.can_execute===!0,namespaces:(Array.isArray(t.namespaces)?t.namespaces:[]).map(n=>{let s=n;return{namespaceId:String(s.namespace_id??""),status:String(s.status??""),authorshipReady:s.authorship_ready===!0,fresh:s.fresh===!0,confirmedAt:s.confirmed_at??null,lastSeenAt:s.last_seen_at??null}})}))}async claimNamespace(e,t){await this.request("POST","/api/cloud/namespaces/claim",{body:{namespace_id:e,ownership_proof:t}})}async enableNamespaceHa(e){return this.request("POST",`/api/cloud/namespaces/${encodeURIComponent(e)}/enable-ha`,{body:{}})}async disableNamespaceHa(e){return this.request("POST",`/api/cloud/namespaces/${encodeURIComponent(e)}/disable-ha`,{body:{}})}async getMyNode(){return(await this.request("GET","/api/cloud/me/node")).node??null}enableHA(e){let t=new URLSearchParams({group_id:e.groupId,context_id:e.contextId});e.redirectUrl&&t.set("redirect_url",e.redirectUrl),window.open(`${this.baseUrl}/enable-ha?${t.toString()}`)}disableHA(e){let t=new URLSearchParams({group_id:e.groupId,context_id:e.contextId});e.redirectUrl&&t.set("redirect_url",e.redirectUrl),window.open(`${this.baseUrl}/disable-ha?${t.toString()}`)}async linkAccount(e){let t=await M(e),{nonce:n}=await this.getAccountLinkChallenge();return this.submitAccountLink({accountId:t.accountId,rootPublicKey:t.publicKey,nonce:n,signature:await B({rootSecret:e,nonce:n})})}async getAccountLinkChallenge(){let e=await this.request("GET","/api/cloud/me/accounts/challenge");return{nonce:e.nonce,expiresAtMs:e.expires_at_ms??null}}async submitAccountLink(e){let t=await this.request("POST","/api/cloud/me/accounts",{body:{account_id:e.accountId,root_public_key:e.rootPublicKey,nonce:e.nonce,signature:e.signature}});return{accountId:String(t.account_id??e.accountId),linkedAt:t.linked_at??null,alreadyLinked:t.already_linked===!0}}static accountLinkHandoff(e){let t=e.portalUrl.replace(/\/+$/,""),n=new URLSearchParams({"link-account":e.accountId,"callback-url":e.callbackUrl});return{url:`${t}/?${n.toString()}`,accountId:e.accountId}}static readAccountLinkCallback(e){let t=e??(typeof window>"u"?"":window.location.href);if(!t)return{};let n;try{n=new URL(t).hash}catch{return{}}let s=new URLSearchParams(n.replace(/^#/,"")),o=s.get("grant"),i=s.get("account"),a=s.get("error"),l={};return o&&(l.grant=o),i&&(l.accountId=i),a&&(l.error=a),l}async linkAccountWithGrant(e){let t=await M(e.rootSecret),n=await this.request("POST","/api/cloud/accounts/link",{body:{grant:e.grant,root_public_key:t.publicKey,signature:await B({rootSecret:e.rootSecret,nonce:e.grant})},anonymous:!0});return{accountId:String(n.account_id??t.accountId),linkedAt:n.linked_at??null,alreadyLinked:n.already_linked===!0}}async getMyAccounts(){let e=await this.request("GET","/api/cloud/me/accounts");return{accounts:(e.accounts??[]).map(t=>({accountId:String(t.account_id??""),linkedAt:t.linked_at??null,hasRecoveryEnvelope:t.has_recovery_envelope===!0})),limit:e.limit??null}}adoptSession(e){return this.session={sessionToken:e.session_token,expiresAt:e.expires_at,user:e.user},this.notifySession(this.session),this.session}async notifySession(e){try{await this.onSession?.(e)}catch{}}async request(e,t,n={}){if(!n.anonymous&&!this.session)throw new Error("Not signed in to Calimero Cloud: call signInWithGoogle() or construct the client with a sessionToken");let s={...n.headers,Accept:"application/json"};n.body!==void 0&&(s["Content-Type"]="application/json"),!n.anonymous&&this.session&&(s.Authorization=`Bearer ${this.session.sessionToken}`);let o=new AbortController,i=setTimeout(()=>o.abort(),this.timeoutMs),a;try{a=await this.fetchImpl(`${this.baseUrl}${t}`,{method:e,headers:s,body:n.body===void 0?void 0:JSON.stringify(n.body),signal:o.signal})}catch(l){throw new R(0,l instanceof Error?l.name:"NetworkError",`${this.baseUrl}${t}`,new Headers,l instanceof Error?l.message:String(l))}finally{clearTimeout(i)}if(this.adoptRollingRefresh(a),!a.ok){let l=await a.text().catch(()=>{});throw new R(a.status,a.statusText,`${this.baseUrl}${t}`,a.headers,l)}if(!(n.parse==="none"||a.status===204))return await a.json()}adoptRollingRefresh(e){let t=e.headers.get(_t);if(!t||!this.session)return;let n=e.headers.get(Ut),s=Number(n);this.session={sessionToken:t,expiresAt:Number.isFinite(s)&&s>0?s:this.session.expiresAt,user:this.session.user},this.notifySession(this.session)}};var Nt="mero-js:token-refresh";function Gt(){let e=globalThis.navigator?.locks;return e&&typeof e.request=="function"?e:null}function xe(r,e){try{let t=r.split(".");if(t.length===3){let n=t[1].replace(/-/g,"+").replace(/_/g,"/");for(;n.length%4;)n+="=";let s=JSON.parse(atob(n));if(typeof s.exp=="number")return s.exp*1e3}}catch{}return e}var te=class{constructor(e){this.tokenData=null;this.refreshPromise=null;this.rpcClient=null;this.sseClient=null;this.wsClient=null;this.wsWarned=!1;this.config={timeoutMs:1e4,...e},this.tokenStore=e.tokenStore??null,this.tokenStore&&(this.tokenData=this.tokenStore.getTokens());let t=typeof window<"u"&&"__TAURI_INTERNALS__"in window;this.httpClient=U({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",refreshToken:async()=>(await this.performTokenRefresh()).access_token,onTokenRefresh:async n=>{this.tokenData&&(this.tokenData.access_token=n,this.tokenStore?.setTokens(this.tokenData))},onAuthRevoked:async()=>{this.clearToken();try{await this.config.onAuthRevoked?.()}catch{}},timeoutMs:this.config.timeoutMs,credentials:this.config.requestCredentials??(t?"omit":void 0)}),this.authClient=Me(this.httpClient,{baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",timeoutMs:this.config.timeoutMs}),this.adminClient=Ne(this.httpClient,{baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",timeoutMs:this.config.timeoutMs})}get auth(){return this.authClient}get admin(){return this.adminClient}get rpc(){return this.rpcClient||(this.rpcClient=new O({httpClient:this.httpClient})),this.rpcClient}get events(){return this.sseClient||(this.sseClient=new N({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||""})),this.sseClient}get ephemeral(){return this.ephemeralClient||(this.ephemeralClient=new j({httpClient:this.httpClient,sse:this.events})),this.ephemeralClient}get cloud(){return this.cloudClient||(this.cloudClient=new _(this.config.cloud??{})),this.cloudClient}get ws(){return this.wsWarned||(this.wsWarned=!0,console.warn("[mero-js] WsClient is experimental. Use mero.events (SSE) for production.")),this.wsClient||(this.wsClient=new G({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||""})),this.wsClient}async authenticate(e){let t=e||this.config.credentials;if(!t)throw new Error("No credentials provided for authentication");try{let n={auth_method:"user_password",public_key:t.username,client_name:"mero-js-sdk",permissions:["admin"],timestamp:Math.floor(Date.now()/1e3),provider_data:{username:t.username,password:t.password}},s=await this.authClient.generateTokens(n),o=s.data.access_token;return this.tokenData={access_token:o,refresh_token:s.data.refresh_token,expires_at:xe(o,Date.now()+36e5)},this.tokenStore?.setTokens(this.tokenData),this.tokenData}catch(n){throw new Error(`Authentication failed: ${n instanceof Error?n.message:"Unknown error"}`)}}async getValidToken(){return this.tokenData}async performTokenRefresh(){if(this.refreshPromise)return this.refreshPromise;let e=this.tokenData?.access_token,t=this.withRefreshLock(()=>this.performTokenRefreshLocked(e));this.refreshPromise=t;try{return await t}finally{this.refreshPromise===t&&(this.refreshPromise=null)}}withRefreshLock(e){let t=Gt();return t?t.request(Nt,e):e()}async performTokenRefreshLocked(e){let t=this.tokenStore?.getTokens()??null;if(t?.refresh_token&&(this.tokenData=t,e&&t.access_token!==e))return t;if(!this.tokenData?.refresh_token)throw new Error("No refresh token available");try{let n=await this.authClient.refreshToken({access_token:this.tokenData.access_token,refresh_token:this.tokenData.refresh_token}),s=n.data.access_token;return this.tokenData={access_token:s,refresh_token:n.data.refresh_token,expires_at:xe(s,Date.now()+36e5)},this.tokenStore?.setTokens(this.tokenData),this.tokenData}catch(n){throw new Error(`Token refresh failed: ${n instanceof Error?n.message:"Unknown error"}`)}}clearToken(){this.refreshPromise=null,this.tokenData=null,this.tokenStore?.clear()}isAuthenticated(){return this.tokenData!==null}setTokenData(e){let t=e.expires_at||xe(e.access_token,Date.now()+36e5);this.tokenData={...e,expires_at:t},this.tokenStore?.setTokens(this.tokenData)}getTokenData(){return this.tokenData}close(){this.sseClient?.close(),this.wsClient?.close()}static parseAuthCallback(e){return ge(e)}static buildAuthLoginUrl(e,t){return me(e,t)}};function qt(r){return new te(r)}var we=class{constructor(){this.tokens=null}getTokens(){return this.tokens}setTokens(e){this.tokens=e}clear(){this.tokens=null}},Lt="mero-tokens",Ce=class{constructor(e=Lt){this.key=e}getTokens(){try{if(typeof localStorage>"u")return null;let e=localStorage.getItem(this.key);if(!e)return null;let t=JSON.parse(e);return t&&t.access_token&&t.refresh_token?{access_token:t.access_token,refresh_token:t.refresh_token,expires_at:typeof t.expires_at=="number"?t.expires_at:Date.now()+36e5}:null}catch{return null}}setTokens(e){try{if(typeof localStorage>"u")return;localStorage.setItem(this.key,JSON.stringify(e))}catch{}}clear(){try{if(typeof localStorage>"u")return;localStorage.removeItem(this.key)}catch{}}};var Ht=new TextEncoder().encode("calimero.warrant.v2"),$t=new TextEncoder().encode("calimero.warrant.intent.v1"),Xe=64,Ot="00".repeat(32);async function Ae(r,e){let t=new TextEncoder().encode(JSON.stringify(e));return k($t,[new TextEncoder().encode(r),t])}async function ne(r){let e=p(r.context,"context",32),t=p(r.authorAccount,"authorAccount",32),n=p(r.executor,"executor",32),s=p(r.appVersion??Ot,"appVersion",32),o=Ye(r.accountHeads,"accountHeads"),i=Ye(r.governanceFloor,"governanceFloor"),a=await C(r.deviceSecret),l=await A(r.deviceSecret),u=new TextEncoder().encode(r.method),h=await Ae(r.method,r.argsJson),m=w(r.nonce),f=w(r.notAfter),b=await k(Ht,[e,t,l,n,s,u,h,w(o.length),...o,w(i.length),...i,m,f]),g=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},a,b));return y(d(e,t,l,n,s,x(u.length),u,h,x(o.length),...o,x(i.length),...i,m,f,g))}function Ye(r,e){let t=r??[];if(t.length>Xe)throw new Error(`${e} cites ${t.length} heads, over the ${Xe} a node accepts`);return t.map((n,s)=>p(n,`${e}[${s}]`,32))}var jt=300,re=class extends Error{constructor(t,n,s){super(`relay refused the intent (HTTP ${s}): ${t}`);this.reason=t;this.retryable=n;this.status=s;this.name="IntentRefusedError"}},W=class{constructor(e){this.config=e,this.baseUrl=e.relayUrl.replace(/\/+$/,""),this.executorAccount=e.executorAccount;let t=e.fetch;this.fetchImpl=t?(n,s)=>t(n,s):(n,s)=>globalThis.fetch(n,s),this.timeoutMs=e.timeoutMs??1e4}async describe(e){let t=await this.json("GET",`/admin-api/contexts/${encodeURIComponent(e)}/intents`);return this.executorAccount=t.data.executorAccount,t.data}async execute(e,t,n={}){let s=this.executorAccount??(await this.describe(e)).executorAccount,o=await this.config.nonces.next(),i=this.config.ttlSeconds??jt,a=await ne({context:e,authorAccount:this.config.authorAccount,executor:s,method:t,argsJson:n,nonce:o,notAfter:BigInt(Math.floor(Date.now()/1e3))+BigInt(i),deviceSecret:this.config.deviceSecret}),l=await this.json("POST",`/admin-api/contexts/${encodeURIComponent(e)}/intents`,{method:t,argsJson:n,warrant:a,authorProof:this.config.authorProof});return{rootHash:l.data.rootHash,returns:l.data.returns??null}}async json(e,t,n){let s={Accept:"application/json"};n!==void 0&&(s["Content-Type"]="application/json");let o=new AbortController,i=setTimeout(()=>o.abort(),this.timeoutMs),a;try{a=await this.fetchImpl(`${this.baseUrl}${t}`,{method:e,headers:s,body:n===void 0?void 0:JSON.stringify(n),signal:o.signal})}catch(l){throw new R(0,l instanceof Error?l.name:"NetworkError",`${this.baseUrl}${t}`,new Headers,l instanceof Error?l.message:String(l))}finally{clearTimeout(i)}if(!a.ok){let l=await a.text().catch(()=>"");if(a.status===400||a.status===403){let u=Kt(l);throw new re(u,/nonce/i.test(u),a.status)}throw new R(a.status,a.statusText,`${this.baseUrl}${t}`,a.headers,l)}return await a.json()}};function Kt(r){if(!r)return"no reason given";try{let e=JSON.parse(r);for(let t of[e.error,e.message])if(typeof t=="string"&&t)return t}catch{}return r}function ve(r=1){let e=BigInt(r);if(e<1n)throw new Error("nonce sequence starts at 1");return{next(){let t=e;return e+=1n,Promise.resolve(t)}}}function ke(r,e){let t=e??globalThis.localStorage;if(!t)throw new Error("no localStorage in this runtime: pass a storage implementation, or use createMemoryNonceSource for a process that owns its whole sequence");return{next(){let n=t.getItem(r),s=0n;if(n!==null&&n!=="")try{let i=BigInt(n);i>0n&&(s=i)}catch{s=0n}let o=s+1n;return t.setItem(r,o.toString()),Promise.resolve(o)}}}async function Bt(r){if(!r.sessionToken&&!r.googleIdToken)throw new Error("connectCloud needs either a sessionToken or a googleIdToken");let e=new _({cloudBaseUrl:r.cloudBaseUrl,sessionToken:r.sessionToken,onSession:r.onSession,fetch:r.fetch,timeoutMs:r.timeoutMs});!r.sessionToken&&r.googleIdToken&&await e.signInWithGoogle(r.googleIdToken);let t=await e.getMyNamespaces(),n=Wt(t,r.namespaceId),s=await e.getNamespaceRelays(n.namespaceId),o=s.find(a=>a.authorshipReady&&a.relayUrl!==null&&a.executorAccount!==null)??null;if(!o)throw new Error(Vt(n,s));let i=new W({relayUrl:o.relayUrl,executorAccount:o.executorAccount,authorAccount:r.authorAccount,authorProof:r.authorProof,deviceSecret:r.deviceSecret,nonces:r.nonces??await Jt(r.deviceSecret),ttlSeconds:r.ttlSeconds,fetch:r.fetch,timeoutMs:r.timeoutMs});return{cloud:e,relay:i,namespaceId:n.namespaceId,namespace:n,relayInfo:o,execute:(a,l,u)=>i.execute(a,l,u)}}function Wt(r,e){if(e){let t=r.find(n=>n.namespaceId===e);if(!t)throw new Error(`this account owns no namespace ${e}; it owns: ${r.map(n=>n.namespaceId).join(", ")||"(none)"}`);return t}if(r.length===0)throw new Error("this account owns no namespaces in the cloud: claim one first, then enable HA on it so a relay is assigned");if(r.length>1)throw new Error(`this account owns ${r.length} namespaces \u2014 pass namespaceId to say which: ${r.map(t=>t.namespaceId).join(", ")}`);return r[0]}function Vt(r,e){if(e.length===0)return r.haStatus==="enabled"?`namespace ${r.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly`:`namespace ${r.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;let t=e.filter(n=>!n.authorshipReady);return t.length===e.length?`every relay on namespace ${r.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${t.map(n=>n.executorAccount??n.peerId).join(", ")||"the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`:`namespace ${r.namespaceId} has ${e.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`}async function Jt(r){let e=`mero-js:warrant-nonce:${y(await A(r))}`;try{return ke(e)}catch{return ve(1)}}var Se=8,Ft=new TextEncoder().encode("calimero.namespace.v1"),zt=0,Ze={GroupCreated:0,GroupReparented:1,GroupDeleted:2,AdminChanged:3,PolicyUpdated:4,MemberJoined:5,KeyDelivery:6,MemberJoinedOpen:7,MemberJoinedAt:8,NamespaceCreated:9,MemberJoinedViaTeeAttestation:10};function Ie(r,e){if(r.length!==32)throw new Error(`${e} must be 32 bytes, got ${r.length}`);return new Uint8Array(r)}function et(r,e){if(r==null)return new Uint8Array([0]);if(r.length!==32)throw new Error(`${e} must be 32 bytes, got ${r.length}`);return d(new Uint8Array([1]),new Uint8Array(r))}function tt(r){let e=new TextEncoder().encode(r);return d(x(e.length),e)}function se(r){let e=r.invitation,t=e.admitters??[],n=r.admitter_addrs??[];return d(Ie(e.inviter_identity,"inviter_identity"),Ie(e.group_id,"group_id"),w(e.expiration_timestamp),Ie(e.secret_salt,"secret_salt"),new Uint8Array([e.invited_role]),x(t.length),...t.map((s,o)=>p(s,`admitters[${o}]`,32)),tt(r.inviter_signature),r.inviter_account?d(new Uint8Array([1]),p(r.inviter_account,"inviter_account",32)):new Uint8Array([0]),x(n.length),...n.map(tt),et(r.application_id,"application_id"),et(r.app_key,"app_key"))}async function nt(r){let e=r.parentOpHashes??[],t=p(r.credential,"credential",r.credential.length/2),n=BigInt(r.invitation.invitation.expiration_timestamp??0)!==0n,s=r.joinedAt??BigInt(Math.floor(Date.now()/1e3)),o=n?d(new Uint8Array([Ze.MemberJoinedAt]),p(r.member,"member",32),se(r.invitation),w(s),t):d(new Uint8Array([Ze.MemberJoined]),p(r.member,"member",32),se(r.invitation),t),i=d(new Uint8Array([zt]),o),a=await C(r.deviceSecret),l=await A(r.deviceSecret),u=d(new Uint8Array([Se]),p(r.namespaceId,"namespaceId",32),x(e.length),...e.map((f,b)=>p(f,`parentOpHashes[${b}]`,32)),l,w(r.nonce),i),h=new Uint8Array(await crypto.subtle.sign("Ed25519",a,d(Ft,u))),m=new Uint8Array([0]);return y(d(u,h,m))}var Qt=new TextEncoder().encode("calimero.auth.request.v1"),Xt=new TextEncoder().encode("calimero.auth.request.body.v1");function rt(r){let e=new TextEncoder().encode(r);return d(x(e.length),e)}async function Te(r=new Uint8Array(0)){let e=typeof r=="string"?new TextEncoder().encode(r):r;return k(Xt,[e])}async function st(r){let e=await C(r.signerSecret),t=await Te(r.body),n=w(r.issuedAt),s=w(r.expiresAt),o=new TextEncoder,i=await k(Qt,[o.encode(r.method),o.encode(r.path),t,n,s]),a=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},e,i));return y(d(rt(r.method),rt(r.path),t,n,s,a))}var Yt=new TextEncoder().encode("calimero.auth.login.v1"),ot={webOrigin:0,codeSigningId:1,cli:2};function it(r){let e=new TextEncoder;switch(r.kind){case"webOrigin":return e.encode(r.origin);case"codeSigningId":return e.encode(r.id);case"cli":return new Uint8Array(0)}}function Zt(r){return d(Uint8Array.from([ot[r.kind]]),it(r))}function en(r){let e=Uint8Array.from([ot[r.kind]]);if(r.kind==="cli")return e;let t=it(r);return d(e,x(t.length),t)}async function oe(r){let e=p(r.node,"node",32),t=p(r.challenge,"challenge",32),n=p(r.sessionKey,"sessionKey",32),s=await C(r.deviceSecret),o=await A(r.deviceSecret),i=w(r.issuedAt),a=w(r.expiresAt),l=await k(Yt,[e,Zt(r.audience),t,n,o,i,a]),u=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},s,l));return y(d(e,en(r.audience),t,n,o,i,a,u))}var tn=300;async function De(){let r=y(crypto.getRandomValues(new Uint8Array(32)));return{publicKey:y(await A(r)),secret:r}}function nn(r){switch(r.kind){case"webOrigin":return r.origin;case"codeSigningId":return r.id;case"cli":return"cli"}}async function at(r){let e=r.nodeUrl.replace(/\/+$/,""),t=r.fetch??globalThis.fetch,n=r.timeoutMs??1e4,s=async(b,g)=>{let S=new AbortController,D=setTimeout(()=>S.abort(),n),I;try{I=await t(`${e}${b}`,{...g,signal:S.signal})}catch(v){throw new R(0,v instanceof Error?v.name:"NetworkError",`${e}${b}`,new Headers,v instanceof Error?v.message:String(v))}finally{clearTimeout(D)}let q=await I.text().catch(()=>"");if(!I.ok)throw new R(I.status,I.statusText,`${e}${b}`,I.headers,q);return q?JSON.parse(q):{}},o=await s("/auth/challenge",{method:"GET",headers:{Accept:"application/json"}}),i=o.challenge??o.data?.challenge;if(!i)throw new Error("the node issued no challenge");let a=await De(),l=Math.floor(Date.now()/1e3),u=await oe({node:r.node,audience:r.audience,challenge:i,sessionKey:a.publicKey,issuedAt:l,expiresAt:l+(r.ttlSeconds??tn),deviceSecret:r.deviceSecret}),h=await s("/auth/token",{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({auth_method:"account_proof",public_key:a.publicKey,client_name:r.clientName??nn(r.audience),timestamp:l,provider_data:{challenge:i,login_statement:u,account_proof:r.accountProof}})}),m=h.access_token??h.data?.access_token,f=h.refresh_token??h.data?.refresh_token;if(!m)throw new Error("the node minted no session");return{accessToken:m,refreshToken:f??"",sessionKey:a.publicKey,sessionSecret:a.secret}}var ct=[2428,2429,2528,2529],rn="localhost",sn=2e3;function lt(r){return`http://${rn}:${r}`}function ut(r,e){let t=r.endsWith("/")?r:`${r}/`;return new URL(e,t).toString()}async function pt(r,e={}){let{timeoutMs:t=sn,signal:n}=e;if(n?.aborted)return!1;let s=new AbortController,o=()=>s.abort(),i=n;i&&i.addEventListener("abort",o,{once:!0});let a=setTimeout(()=>s.abort(),t);try{let l=ut(r,"admin-api/health"),u=await fetch(l,{method:"GET",signal:s.signal});if(!u.ok)return!1;try{let h=await u.json(),m=h?.data?.status!==void 0?h?.data?.status:h?.status;return m===void 0?!0:typeof m=="string"&&m.toLowerCase()==="alive"}catch{return!0}}catch{return!1}finally{clearTimeout(a),i&&i.removeEventListener("abort",o)}}async function on(r={}){let{ports:e=ct,timeoutMs:t,signal:n}=r;return(await Promise.all(e.map(async o=>{let i=lt(o);return await pt(i,{timeoutMs:t,signal:n})?i:null}))).filter(o=>o!==null)}export{E as AdminApiClient,P as AuthApiClient,T as AuthRevokedError,$ as CAPABILITIES,_ as CloudClient,ct as DEFAULT_LOCAL_NODE_PORTS,j as EphemeralClient,R as HTTPError,re as IntentRefusedError,Ce as LocalStorageTokenStore,we as MemoryTokenStore,te as MeroJs,W as RelayClient,O as RpcClient,z as RpcError,Se as SIGNED_NAMESPACE_OP_SCHEMA_VERSION,N as SseClient,L as WebHttpClient,G as WsClient,Y as accountForRoot,We as accountRootFromPhrase,M as accountRootFromSecret,me as buildAuthLoginUrl,ae as combineSignals,bt as compareSemver,Bt as connectCloud,$n as createAdminApiClient,Ne as createAdminApiClientFromHttpClient,kn as createAuthApiClient,Me as createAuthApiClientFromHttpClient,Ln as createBrowserAdminApiClient,An as createBrowserAuthApiClient,U as createBrowserHttpClient,le as createHttpClient,ke as createLocalStorageNonceSource,ve as createMemoryNonceSource,qt as createMeroJs,Hn as createNodeAdminApiClient,vn as createNodeAuthApiClient,J as createNodeHttpClient,yt as createRetryableMethod,ce as createTimeoutSignal,ue as createUniversalHttpClient,ye as deviceCertPayload,on as discoverLocalNodes,se as encodeSignedInvitation,Be as generateAccountRoot,De as generateSessionKey,pe as hasCap,_n as hexEncodeUtf8,Ae as intentHash,X as jsonCodec,lt as localNodeUrl,at as login,$e as mintDeviceId,ut as nodeEndpoint,ge as parseAuthCallback,pt as probeNodeHealth,Te as requestBodyHash,ee as routingProofHeaders,B as signAccountLink,Z as signAccountLogin,je as signDeviceCert,oe as signLoginStatement,nt as signMemberJoinOp,st as signRequest,Qe as signRoutingChallenge,ne as signWarrant,de as withCap,F as withRetry,Sn as withoutCap};
+function ue(n){let e=n.filter(Boolean);if(e.length===0)return;let t=AbortSignal;if(typeof t.any=="function")try{return t.any(e)}catch{}let r=new AbortController,s=o=>{r.abort(o.target.reason);for(let i of e)i.removeEventListener("abort",s)};for(let o of e){if(o.aborted)return AbortSignal.abort(o.reason);o.addEventListener("abort",s,{once:!0})}return r.signal}function pe(n){if(typeof AbortSignal.timeout=="function")return AbortSignal.timeout(n);let e=new AbortController;return setTimeout(()=>{e.abort(new DOMException("Timeout","TimeoutError"))},n),e.signal}var ft=new Set(["token_reuse","token_revoked"]);function yt(n){if(n)try{let e=JSON.parse(n),t=e?.error;if(typeof t=="string"&&t.trim()!=="")return t;let r=t?.message;if(typeof r=="string"&&r.trim()!=="")return r;let s=e?.detail;if(typeof s=="string"&&s.trim()!=="")return s}catch{}}var R=class extends Error{constructor(t,r,s,o,i){let a=yt(i);super(a?`HTTP ${t} ${r}: ${a}`:`HTTP ${t} ${r}`);this.status=t;this.statusText=r;this.url=s;this.headers=o;this.bodyText=i;this.name="HTTPError"}toJSON(){return{status:this.status,statusText:this.statusText,url:this.url,headers:Ue(this.headers),bodyText:this.bodyText}}},P=class extends R{constructor(t,r,s,o,i,a){super(r,s,o,i,a);this.reason=t;this.name="AuthRevokedError";this.message=`Authentication revoked (${t}): HTTP ${r} ${s}`}};function Ue(n){let e={};return n.forEach((t,r)=>{e[r]=t}),e}function bt(n){try{return new URL(n).pathname}catch{let e=n.indexOf("?");return e===-1?n:n.slice(0,e)}}var L=class{constructor(e){this.transport=e;this.refreshTokenPromise=null;this.onTokenRefreshPromise=null}async get(e,t){return this.request(e,{...t,method:"GET"})}async post(e,t,r){return this.request(e,{...r,method:"POST",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...r?.headers}})}async put(e,t,r){return this.request(e,{...r,method:"PUT",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...r?.headers}})}async delete(e,t){return this.request(e,{...t,method:"DELETE"})}async patch(e,t,r){return this.request(e,{...r,method:"PATCH",body:t?JSON.stringify(t):void 0,headers:{"Content-Type":"application/json",...r?.headers}})}async head(e,t){let r=await this.makeRequest(e,{...t,method:"HEAD",parse:"response"});return{headers:Ue(r.headers),status:r.status}}async request(e,t){return this.makeRequest(e,t)}async makeRequest(e,t,r=0,s){let i=this.buildUrl(e),a=s??Date.now(),l=this.createAbortSignal(t),u=await this.buildHeaders(t?.headers),h;u instanceof Headers?(h={},u.forEach((g,S)=>{h[S]=g})):h=u;let m={method:t?.method||"GET",headers:h},f=t?.body instanceof ReadableStream||typeof t?.body=="object"&&t?.body!==null&&"getReader"in t.body&&!(t.body instanceof Blob);(t?.body!==void 0&&!f||t?.body!==void 0&&f&&r===0)&&(m.body=t.body);let b;if(r>0&&s!==void 0){let g=t?.timeoutMs||this.transport.timeoutMs;if(g){let S=Date.now()-a,T=Math.max(0,g-S);b=this.createAbortSignal({...t,timeoutMs:T})}else b=this.createAbortSignal(t)}else b=l;if(b&&(m.signal=b),this.transport.credentials!==void 0&&(m.credentials=this.transport.credentials),t?.mode!==void 0&&(m.mode=t.mode),t?.cache!==void 0&&(m.cache=t.cache),t?.redirect!==void 0&&(m.redirect=t.redirect),t?.referrer!==void 0&&(m.referrer=t.referrer),t?.referrerPolicy!==void 0&&(m.referrerPolicy=t.referrerPolicy),t?.integrity!==void 0&&(m.integrity=t.integrity),t?.keepalive!==void 0&&(m.keepalive=t.keepalive),this.transport.getProof){let g=await this.transport.getProof({method:m.method??"GET",path:bt(i),body:m.body});g&&(h["X-Calimero-Proof"]=g)}try{let g=await this.transport.fetch(i,m);if(!g.ok){let S=await this.getBodyText(g),T=new R(g.status,g.statusText,i,g.headers,S),I=g.headers.get("x-auth-error");if((g.status===401||g.status===403)&&I&&ft.has(I)){if(this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,this.transport.onAuthRevoked)try{await this.transport.onAuthRevoked()}catch{}throw new P(I,g.status,g.statusText,i,g.headers,S)}let q=t?.signal?.aborted===!0;if(g.status===401&&this.transport.refreshToken&&I==="token_expired"&&r<1&&!f&&!q)try{let v=this.refreshTokenPromise;v||(v=this.transport.refreshToken(),this.refreshTokenPromise=v);let le=await v;if(!le||le.trim()==="")throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,new Error("Refresh token returned empty token");if(!this.transport.onTokenRefresh)throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,new Error("onTokenRefresh callback is required when refreshToken is provided. The callback must update the token storage so getAuthToken() returns the new token.");let V=this.onTokenRefreshPromise;V||(V=this.transport.onTokenRefresh(le),this.onTokenRefreshPromise=V),await V,this.refreshTokenPromise=null,this.onTokenRefreshPromise=null;let _e=t?.timeoutMs||this.transport.timeoutMs;if(_e&&s!==void 0){let ht=Date.now()-a;if(_e-ht<=0)throw T}return this.makeRequest(e,t,r+1,a)}catch(v){throw this.refreshTokenPromise=null,this.onTokenRefreshPromise=null,v instanceof Error&&v.message.includes("onTokenRefresh")?v:T}throw T}return this.parseResponse(g,t?.parse)}catch(g){throw g instanceof R||g instanceof Error&&g.message.includes("onTokenRefresh")?g:new R(0,"Network Error",i,new Headers,g instanceof Error?g.message:"Unknown error")}}buildUrl(e){if(e.startsWith("http://")||e.startsWith("https://"))return e;let t=this.transport.baseUrl;return e.startsWith("/")?`${t.endsWith("/")?t.slice(0,-1):t}${e}`:`${t.endsWith("/")?t:`${t}/`}${e}`}createAbortSignal(e){let t=[];this.transport.defaultAbortSignal&&t.push(this.transport.defaultAbortSignal),e?.signal&&t.push(e.signal);let r=e?.timeoutMs||this.transport.timeoutMs;return r&&t.push(pe(r)),t.length>0?ue(t):void 0}async buildHeaders(e){let t={...this.transport.defaultHeaders};if(this.transport.getAuthToken)try{let r=await this.transport.getAuthToken();r&&r.trim()!==""&&(t.Authorization=`Bearer ${r}`)}catch{}return e&&(e instanceof Headers?e.forEach((r,s)=>{t[s]=r}):Array.isArray(e)?e.forEach(([r,s])=>{t[r]=s}):Object.assign(t,e)),t}async parseResponse(e,t){switch(t){case"text":return await e.text();case"blob":return await e.blob();case"arrayBuffer":return await e.arrayBuffer();case"response":return e;default:{let r=await e.text();if(!r)return null;try{return JSON.parse(r)}catch{throw new Error(`Expected a JSON response (status ${e.status}) but body was not JSON: ${r.slice(0,200)}`)}}}}async getBodyText(e){try{let t=await e.text();return t.length>65536?t.slice(0,65536)+"...":t}catch{return""}}};function de(n){return new L(n)}function U(n){let e={fetch:(t,r)=>globalThis.fetch(t,r),baseUrl:n.baseUrl,getAuthToken:n.getAuthToken,getProof:n.getProof,onTokenRefresh:n.onTokenRefresh,refreshToken:n.refreshToken,onAuthRevoked:n.onAuthRevoked,defaultHeaders:n.defaultHeaders,timeoutMs:n.timeoutMs,credentials:n.credentials,defaultAbortSignal:n.defaultAbortSignal};return de(e)}function J(n){let e=n.fetch??globalThis.fetch;if(!e)throw new Error("No fetch implementation available. Please provide a fetch implementation (e.g., undici.fetch) or use Node.js 18+ which has native fetch support.");let r={fetch:e===globalThis.fetch?(s,o)=>globalThis.fetch(s,o):(s,o)=>e(s,o),baseUrl:n.baseUrl,getAuthToken:n.getAuthToken,getProof:n.getProof,onTokenRefresh:n.onTokenRefresh,refreshToken:n.refreshToken,onAuthRevoked:n.onAuthRevoked,defaultHeaders:n.defaultHeaders,timeoutMs:n.timeoutMs,credentials:n.credentials,defaultAbortSignal:n.defaultAbortSignal};return de(r)}function ge(n){return typeof window<"u"?U(n):J(n)}function Rt(n,e){if(e<=0)return!1;let r=n?.name;if(r==="TimeoutError")return!0;if(r==="AbortError")return!1;let s=n;if("status"in s&&typeof s.status=="number"){let o=s.status;return o>=500||o===429}return r==="TypeError"}function xt(n){let t=250*Math.pow(2,n-1),r=(Math.random()-.5)*.4*t;return Math.max(0,t+r)}async function F(n,e={}){let{attempts:t=3}=e,r;for(let s=1;s<=t;s++)try{return await n(s)}catch(o){if(r=o,!Rt(r,t-s))throw r;let i=xt(s),u=r.headers?.get?.("Retry-After");if(u){let h=parseInt(u,10);if(!isNaN(h))i=Math.max(i,h*1e3);else{let m=new Date(u);if(!isNaN(m.getTime())){let f=Math.max(0,m.getTime()-Date.now());i=Math.max(i,Math.min(f,6e4))}}}await new Promise(h=>setTimeout(h,i))}throw r||new Error("Retry failed without error")}function wt(n,e={}){return async(...t)=>F(()=>n(...t),e)}var D=class{constructor(e){this.httpClient=e}async getHealth(){let e=await this.httpClient.get("/auth/health");if(!e.data)throw new Error("Health response data is null");return e.data}async getIdentity(){let e=await this.httpClient.get("/admin/identity");if(!e.data)throw new Error("Identity response data is null");return e.data}async getProviders(){let e=await this.httpClient.get("/auth/providers");if(!e.data)throw new Error("Providers response data is null");return e.data}async getLoginPage(){return this.httpClient.get("/auth/login",{parse:"text"})}async generateTokens(e){return this.httpClient.post("/auth/token",e)}async refreshToken(e){return this.httpClient.post("/auth/refresh",e)}async generateMockTokens(e){return this.httpClient.post("/auth/mock-token",e)}async validateToken(e){try{let t=await this.validateTokenGet(e);return{valid:t.status===200,headers:t.headers,status:t.status}}catch{return{valid:!1,headers:{},status:401}}}async validateTokenGet(e){let t=await this.httpClient.head("/auth/validate",{headers:{Authorization:`Bearer ${e}`}});return{status:t.status,headers:t.headers}}async revokeTokens(e){let t=await this.httpClient.post("/admin/revoke",e);if(!t.data)throw new Error("Revoke tokens response data is null");return t.data}async listRootKeys(){let e=await this.httpClient.get("/admin/keys");if(!e.data)throw new Error("Root keys response data is null");return e.data}async createRootKey(e){let t=await this.httpClient.post("/admin/keys",e);if(!t.data)throw new Error("Create root key response data is null");return t.data}async deleteRootKey(e){return this.httpClient.delete(`/admin/keys/${e}`)}async listClientKeys(){let e=await this.httpClient.get("/admin/keys/clients");if(!e.data)throw new Error("Client keys response data is null");return e.data}async generateClientKey(e){return this.httpClient.post("/admin/client-key",e)}async deleteClientKey(e,t){return this.httpClient.delete(`/admin/keys/${e}/clients/${t}`)}async getKeyPermissions(e){return this.httpClient.get(`/admin/keys/${e}/permissions`)}async updateKeyPermissions(e,t){return this.httpClient.put(`/admin/keys/${e}/permissions`,{add:t.add,remove:t.remove})}};var H=class{async get(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async post(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async put(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async delete(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async patch(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async head(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}async request(){throw new Error("HTTP client not implemented - use createAuthApiClientFromHttpClient with a real HTTP client")}};function Pn(n){let e=new H;return new D(e)}function Tn(n){let e=new H;return new D(e)}function Dn(n){let e=new H;return new D(e)}function Ne(n,e){return new D(n)}var $={CAN_CREATE_CONTEXT:1,CAN_INVITE_MEMBERS:2,CAN_JOIN_OPEN_SUBGROUPS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CAN_CREATE_SUBGROUP:32,CAN_DELETE_SUBGROUP:64,CAN_MANAGE_VISIBILITY:128,CAN_MANAGE_METADATA:256,CAN_AUTHOR_ON_BEHALF:512};function me(n,e){let t=e>>>0;return(n&t)>>>0===t}function he(n,e){return(n|e)>>>0}function Mn(n,e){return(n&~e)>>>0}function c(n){return n?.data}function Ct(n,e){let[t,r]=Ge(n),[s,o]=Ge(e),i=t.split("."),a=s.split("."),l=Math.max(i.length,a.length);for(let f=0;f<l;f++){let b=qe(i[f]??"0",a[f]??"0");if(b!==0)return b}if(r===void 0&&o===void 0)return 0;if(r===void 0)return 1;if(o===void 0)return-1;let u=r.split("."),h=o.split("."),m=Math.max(u.length,h.length);for(let f=0;f<m;f++){if(f>=u.length)return-1;if(f>=h.length)return 1;let b=qe(u[f],h[f]);if(b!==0)return b}return 0}function Ge(n){let e=n.split("+",1)[0],t=e.indexOf("-");return t===-1?[e,void 0]:[e.slice(0,t),e.slice(t+1)]}function qe(n,e){let t=/^\d+$/.test(n),r=/^\d+$/.test(e);if(t&&r){let s=Number(n)-Number(e);return s<0?-1:s>0?1:0}return t?-1:r?1:n<e?-1:n>e?1:0}async function At(n,e,t){return F(async()=>{let r=await fetch(n,{signal:AbortSignal.timeout(1e4)});if(!r.ok){let s=new Error(`registry ${e} fetch failed (${r.status}) for ${t}`);throw s.status=r.status,s}return r},{attempts:3})}var E=class{constructor(e){this.httpClient=e}async healthCheck(){return c(await this.httpClient.get("/admin-api/health"))}async isAuthed(){return this.httpClient.get("/admin-api/is-authed")}async installApplication(e){return c(await this.httpClient.post("/admin-api/install-application",e))}async getRegistryVersions(e,t){let r=new URL("/api/v2/bundles",new URL(e).origin);r.searchParams.set("package",t);let o=await(await At(r.toString(),"versions",t)).json();return(Array.isArray(o)?o:[]).map(i=>i.appVersion).filter(i=>typeof i=="string").sort((i,a)=>Ct(a,i))}async installDevApplication(e){return c(await this.httpClient.post("/admin-api/install-dev-application",e))}async uninstallApplication(e){return c(await this.httpClient.delete(`/admin-api/applications/${e}`))}async listApplications(){return c(await this.httpClient.get("/admin-api/applications"))}async getApplication(e){return c(await this.httpClient.get(`/admin-api/applications/${e}`))}async listApplicationVersions(e){return c(await this.httpClient.get(`/admin-api/applications/${e}/versions`))}async getApplicationAbi(e,t){let r=t?`?service_name=${encodeURIComponent(t)}`:"";return c(await this.httpClient.get(`/admin-api/applications/${e}/abi${r}`))}async listPackages(){let e=await this.httpClient.get("/admin-api/packages");return e?.data??e}async listPackageVersions(e){let t=await this.httpClient.get(`/admin-api/packages/${encodeURIComponent(e)}/versions`);return t?.data??t}async getLatestPackageVersion(e){return this.httpClient.get(`/admin-api/packages/${encodeURIComponent(e)}/latest`)}async createContext(e){let t={...e,initializationParams:e.initializationParams??[]};return c(await this.httpClient.post("/admin-api/contexts",t))}async deleteContext(e){return c(await this.httpClient.delete(`/admin-api/contexts/${e}`))}async getContexts(){return c(await this.httpClient.get("/admin-api/contexts"))}async getContext(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}`))}async getContextsForApplication(e){return c(await this.httpClient.get(`/admin-api/contexts/for-application/${e}`))}async generateContextIdentity(){return c(await this.httpClient.post("/admin-api/identity/context",{}))}async getContextIdentities(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/identities`))}async getContextIdentitiesOwned(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/identities-owned`))}async joinContext(e){return c(await this.httpClient.post(`/admin-api/contexts/${e}/join`,{}))}async getContextGroup(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/group`))}async getContextStorage(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/storage`))}async syncContext(e){let t=e?`/admin-api/contexts/sync/${e}`:"/admin-api/contexts/sync";await this.httpClient.post(t,{})}async resyncContext(e,t={}){return await this.httpClient.post(`/admin-api/contexts/${e}/resync`,t)??{contextId:e,resyncStarted:!0}}async inviteSpecializedNode(e){return c(await this.httpClient.post("/admin-api/contexts/invite-specialized-node",e))}async updateContextApplication(e,t){await this.httpClient.post(`/admin-api/contexts/${e}/application`,t)}async getContextsWithExecutorsForApplication(e){let t=await this.httpClient.get(`/admin-api/contexts/with-executors/for-application/${e}`);return Array.isArray(t)?t:t?.contexts??t?.data??[]}async uploadBlob(e){let t=new URLSearchParams;e.hash&&t.set("hash",e.hash),e.contextId&&t.set("context_id",e.contextId);let r=t.toString(),s=r?`/admin-api/blobs?${r}`:"/admin-api/blobs",o=c(await this.httpClient.request(s,{method:"PUT",body:e.data,headers:{"Content-Type":"application/octet-stream"}}));return{blobId:o.blob_id,size:o.size}}async deleteBlob(e){let t=await this.httpClient.delete(`/admin-api/blobs/${e}`);return{blobId:t.blob_id,deleted:t.deleted}}async listBlobs(){return{blobs:c(await this.httpClient.get("/admin-api/blobs")).blobs.map(t=>({blobId:t.blob_id,size:t.size}))}}blobPath(e,t){if(!t?.contextId)return`/admin-api/blobs/${e}`;let r=new URLSearchParams({context_id:t.contextId});return`/admin-api/blobs/${e}?${r.toString()}`}async getBlob(e,t){return this.httpClient.get(this.blobPath(e,t),{parse:"arrayBuffer"})}async getBlobInfo(e,t){let{headers:r}=await this.httpClient.head(this.blobPath(e,t)),s=Number(r["content-length"]);return{blobId:r["x-blob-id"]??e,size:Number.isFinite(s)?s:0,hash:r["x-blob-hash"],mimeType:r["x-blob-mime-type"],source:r["x-blob-source"]}}async createContextAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/context",{alias:e.alias,contextId:e.contextId}))}async createApplicationAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/application",{alias:e.alias,applicationId:e.applicationId}))}async lookupContextAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/context/${encodeURIComponent(e)}`,{}))}async lookupApplicationAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/application/${encodeURIComponent(e)}`,{}))}async deleteContextAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/context/${encodeURIComponent(e)}`,{}))}async deleteApplicationAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/application/${encodeURIComponent(e)}`,{}))}async listContextAliases(){return c(await this.httpClient.get("/admin-api/alias/list/context"))}async listApplicationAliases(){return c(await this.httpClient.get("/admin-api/alias/list/application"))}async createDeviceAlias(e){return c(await this.httpClient.post("/admin-api/alias/create/device",{alias:e.alias,deviceId:e.deviceId}))}async lookupDeviceAlias(e){return c(await this.httpClient.post(`/admin-api/alias/lookup/device/${encodeURIComponent(e)}`,{}))}async deleteDeviceAlias(e){return c(await this.httpClient.post(`/admin-api/alias/delete/device/${encodeURIComponent(e)}`,{}))}async listDeviceAliases(){return c(await this.httpClient.get("/admin-api/alias/list/device"))}async listNamespaces(){return c(await this.httpClient.get("/admin-api/namespaces"))}async getNamespace(e){return c(await this.httpClient.get(`/admin-api/namespaces/${e}`))}async getNodeIdentity(){return c(await this.httpClient.get("/admin-api/identity"))}async getNamespaceIdentity(e){let t=await this.getNodeIdentity();return{namespaceId:e,publicKey:t.publicKey,account:t.accountId}}async performIntent(e,t){return c(await this.httpClient.post(`/admin-api/contexts/${e}/intents`,t))}async getIntentRelay(e){return c(await this.httpClient.get(`/admin-api/contexts/${e}/intents`))}async listNamespacesForApplication(e){return c(await this.httpClient.get(`/admin-api/namespaces/for-application/${e}`))}async createNamespace(e){return c(await this.httpClient.post("/admin-api/namespaces",e))}async deleteNamespace(e){return c(await this.httpClient.request(`/admin-api/namespaces/${e}`,{method:"DELETE",body:"{}",headers:{"Content-Type":"application/json"}}))}async createNamespaceInvitation(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/invite`,t??{}))}async admitJoin(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/admit`,t,{timeoutMs:65e3}))}async joinNamespace(e,t){let r=c(await this.httpClient.post(`/admin-api/namespaces/${e}/join`,t,{timeoutMs:65e3}));return r&&r.namespaceId===void 0&&r.groupId!==void 0?{...r,namespaceId:r.groupId}:r}async createGroupInNamespace(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/groups`,t??{}))}async listNamespaceGroups(e){return c(await this.httpClient.get(`/admin-api/namespaces/${e}/groups`))}async initAccountPairing(e){return c(await this.httpClient.post("/admin-api/account/pair-init",e))}async completeAccountPairing(e){return c(await this.httpClient.post("/admin-api/account/pair-complete",e))}async relinkAccountDevice(e,t){return c(await this.httpClient.post(`/admin-api/account/devices/${e}/relink`,t??{}))}async rescopeAccountDevice(e,t){return c(await this.httpClient.put(`/admin-api/account/devices/${encodeURIComponent(e)}/scope`,t))}async signWithAccountRoot(e){return c(await this.httpClient.post("/admin-api/account/sign-with-root",e))}async labelAccountDevice(e,t){return c(await this.httpClient.put(`/admin-api/account/devices/${encodeURIComponent(e)}/label`,t))}async listAccountDevices(){return(await this.httpClient.get("/admin-api/account/devices")).devices}async listAccountApplications(){return(await this.httpClient.get("/admin-api/account/applications")).applications}async revokeAccountDevice(e,t){return c(await this.httpClient.post(`/admin-api/namespaces/${e}/account/revoke`,t))}async getGroupInfo(e){return c(await this.httpClient.get(`/admin-api/groups/${e}`))}async getDefaultCapabilities(e){return(await this.getGroupInfo(e)).defaultCapabilities}async getSubgroupVisibility(e){return(await this.getGroupInfo(e)).subgroupVisibility}async deleteGroup(e){return c(await this.httpClient.request(`/admin-api/groups/${e}`,{method:"DELETE",body:"{}",headers:{"Content-Type":"application/json"}}))}async listGroupMembers(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/members`);if(!Array.isArray(t?.members)){let r=String(e).replace(/[\r\n\t\s]/g,"").slice(0,64);throw new Error(`Invalid listGroupMembers response for group ${r}: missing or non-array \`members\` field`)}return t}async listGroupContexts(e){return c(await this.httpClient.get(`/admin-api/groups/${e}/contexts`))}async addGroupMembers(e,t){await this.httpClient.post(`/admin-api/groups/${e}/members`,t)}async removeGroupMembers(e,t){await this.httpClient.post(`/admin-api/groups/${e}/members/remove`,t)}async updateMemberRole(e,t,r){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/role`,r)}async getMemberCapabilities(e,t){return c(await this.httpClient.get(`/admin-api/groups/${e}/members/${t}/capabilities`))}async setMemberCapabilities(e,t,r){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/capabilities`,r)}async setDefaultCapabilities(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/default-capabilities`,t)}async openToDelegatedExecution(e){let t=await this.getDefaultCapabilities(e);if(me(t,$.CAN_AUTHOR_ON_BEHALF))return{changed:!1,defaultCapabilities:t};let r=he(t,$.CAN_AUTHOR_ON_BEHALF);return await this.setDefaultCapabilities(e,{defaultCapabilities:r}),{changed:!0,defaultCapabilities:r}}async grantAuthorship(e,t){let{capabilities:r}=await this.getMemberCapabilities(e,t);if(me(r,$.CAN_AUTHOR_ON_BEHALF))return{changed:!1,capabilities:r};let s=he(r,$.CAN_AUTHOR_ON_BEHALF);return await this.setMemberCapabilities(e,t,{capabilities:s}),{changed:!0,capabilities:s}}async setSubgroupVisibility(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/subgroup-visibility`,t)}async setTeeAdmissionPolicy(e,t){await this.httpClient.put(`/admin-api/groups/${e}/settings/tee-admission-policy`,t)}async getTeeAdmissionPolicy(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/settings/tee-admission-policy`);return t.data??t}async setGroupMetadata(e,t){await this.httpClient.put(`/admin-api/groups/${e}/metadata`,t)}async getGroupMetadata(e){return(await this.httpClient.get(`/admin-api/groups/${e}/metadata`))?.data??null}async setMemberMetadata(e,t,r){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/metadata`,r)}async getMemberMetadata(e,t){return(await this.httpClient.get(`/admin-api/groups/${e}/members/${t}/metadata`))?.data??null}async setContextMetadata(e,t,r){await this.httpClient.put(`/admin-api/groups/${e}/contexts/${t}/metadata`,r)}async getContextMetadata(e,t){return(await this.httpClient.get(`/admin-api/groups/${e}/contexts/${t}/metadata`))?.data??null}async syncGroup(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/sync`,{}))}async upgradeGroup(e,t){return c(await this.httpClient.post(`/admin-api/groups/${e}/upgrade`,t))}async getGroupUpgradeStatus(e){return c(await this.httpClient.get(`/admin-api/groups/${e}/upgrade/status`))}async getMigrationStatus(e){let t=encodeURIComponent(e);return this.httpClient.get(`/admin-api/groups/${t}/migration-status`)}async getCascadeStatus(e){let t=encodeURIComponent(e);return c(await this.httpClient.get(`/admin-api/groups/${t}/cascade-status`))}async retryGroupUpgrade(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/upgrade/retry`,{}))}async reparentGroup(e,t){let r=await this.httpClient.post(`/admin-api/groups/${e}/reparent`,t);return r?.data??r}async listSubgroups(e){let t=await this.httpClient.get(`/admin-api/groups/${e}/subgroups`);return t.subgroups??t.data??[]}async detachContextFromGroup(e,t){await this.httpClient.post(`/admin-api/groups/${e}/contexts/${t}/remove`,{})}async createGroupInvitation(e,t){return c(await this.httpClient.post(`/admin-api/groups/${e}/invite`,t??{}))}async joinGroup(e){return c(await this.httpClient.post("/admin-api/groups/join",e))}async joinSubgroupInheritance(e){return c(await this.httpClient.post(`/admin-api/groups/${e}/join-via-inheritance`,{}))}async getTeeInfo(){return c(await this.httpClient.get("/admin-api/tee/info"))}async teeAttest(e){return c(await this.httpClient.post("/admin-api/tee/attest",e))}async teeVerifyQuote(e){return c(await this.httpClient.post("/admin-api/tee/verify-quote",e))}async getPeersCount(){return this.httpClient.get("/admin-api/peers")}async getNetworkStatus(){return this.httpClient.get("/admin-api/network/status")}async getUsage(){return this.httpClient.get("/admin-api/usage")}async getCertificate(){return this.httpClient.get("/admin-api/certificate",{parse:"text"})}async createGroup(e){return c(await this.httpClient.post("/admin-api/groups",e))}async leaveGroup(e){await this.httpClient.post(`/admin-api/groups/${e}/leave`,{})}async leaveContext(e){await this.httpClient.post(`/admin-api/contexts/${e}/leave`,{})}async leaveNamespace(e){await this.httpClient.post(`/admin-api/namespaces/${e}/leave`,{})}async issueOwnershipProof(e,t){return this.httpClient.post(`/admin-api/groups/${e}/issue-ownership-proof`,t)}async issueNamespaceOwnershipProof(e,t){return this.httpClient.post(`/admin-api/groups/${e}/issue-namespace-ownership-proof`,t)}async setMemberAutoFollow(e,t,r){await this.httpClient.put(`/admin-api/groups/${e}/members/${t}/auto-follow`,r)}async abortMigration(e){return this.httpClient.post(`/admin-api/groups/${e}/migration/abort`,{})}};function Ln(n){return Array.from(new TextEncoder().encode(n),e=>e.toString(16).padStart(2,"0")).join("")}function Kn(n){return new E(U(n))}function Bn(n){return new E(J(n))}function Wn(n){return new E(ge(n))}function Le(n,e){return new E(n)}function fe(n){try{let e=n.indexOf("#");if(e===-1)return null;let t=n.substring(e+1),r=new URLSearchParams(t),s=r.get("access_token");return s?{accessToken:s,refreshToken:r.get("refresh_token")??"",applicationId:r.get("application_id")??"",contextId:r.get("context_id")??"",contextIdentity:r.get("context_identity")??"",nodeUrl:r.get("node_url")??""}:null}catch{return null}}function ye(n,e){let t=new URLSearchParams;return t.set("callback-url",e.callbackUrl),e.permissions&&e.permissions.length>0&&t.set("permissions",e.permissions.join(",")),t.set("mode",e.mode),e.packageName&&(t.set("package-name",e.packageName),e.packageVersion&&t.set("package-version",e.packageVersion),e.registryUrl&&t.set("registry-url",e.registryUrl)),`${n.replace(/\/+$/,"")}/auth/login?${t.toString()}`}var z=class extends Error{constructor(e,t,r,s){super(t),this.name="RpcError",this.code=e,this.data=r,this.type=s}};async function be(n,e,t){let r=await n.post("/jsonrpc",{jsonrpc:"2.0",id:1,method:e,params:t});if(r.error){let s=r.error;throw new z(s.code??-1,s.message??s.type??"RPC error",s.data,s.type)}return r.result}var O=class{constructor(e){this.httpClient=e.httpClient}async execute(e){let t=await be(this.httpClient,"execute",{contextId:e.contextId,method:e.method,argsJson:e.argsJson??{}});return t&&"output"in t?t.output:t}async migrateMyEntries(e){return this.execute({contextId:e,method:"migrate_my_entries"})}async countMyPending(e){return this.execute({contextId:e,method:"count_my_pending"})}};var vt=new Set(["MigrationStarted","MigrationProgress","CascadeProgress","MigrationCompleted"]);function He(n){return n.type!==void 0&&vt.has(n.type)}var kt=new Set(["token_reuse","token_revoked"]),It=new Set([401,403]);function $e(n){let e=n.headers.get("x-auth-error");return!e||!It.has(n.status)?null:kt.has(e)?e:null}var N=class{constructor(e){this.sessionId=null;this.abortController=null;this.reconnectTimer=null;this.subscribedContextIds=new Set;this.subscribedGroupIds=new Set;this.closed=!1;this.listeners={connect:[],event:[],error:[]};this.baseUrl=e.baseUrl.replace(/\/+$/,""),this.getAuthToken=e.getAuthToken,this.reconnectDelayMs=e.reconnectDelayMs??3e3}on(e,t){let r=e;if(r in this.listeners){let s=this.listeners[r];s.includes(t)||s.push(t)}}off(e,t){let r=e;if(r in this.listeners){let s=this.listeners[r],o=s.indexOf(t);o!==-1&&s.splice(o,1)}}onAppVersionChanged(e){let t=r=>{if(r.type!=="AppVersionChanged")return;let s=r.data;e({contextId:r.contextId,fromVersion:s?.fromVersion,toVersion:s?.toVersion})};return this.on("event",t),()=>this.off("event",t)}onMigrationEvent(e){let t=r=>{He(r)&&e(r)};return this.on("event",t),()=>this.off("event",t)}emit(e,t){let r=e;if(r in this.listeners)for(let s of this.listeners[r])try{s(t)}catch{}}async connect(){if(!(this.abortController&&!this.closed)){this.closed=!1,this.abortController=new AbortController;try{let e=await this.getAuthToken(),t=`${this.baseUrl}/sse`,r=await fetch(t,{headers:{Authorization:`Bearer ${e}`,Accept:"text/event-stream"},signal:this.abortController.signal});if(!r.ok){let s=$e(r),o=await r.text().catch(()=>{});throw s?new P(s,r.status,r.statusText,t,r.headers,o):new R(r.status,r.statusText,t,r.headers,o)}if(!r.body)throw new Error("SSE response has no body");this.readStream(r.body).catch(s=>{if(this.closed)return;let o=s instanceof Error?s:new Error(String(s));this.emit("error",o),this.scheduleReconnect()})}catch(e){if(this.closed)return;let t=e instanceof Error?e:new Error(String(e));if(this.emit("error",t),t instanceof P)return;this.scheduleReconnect()}}}async readStream(e){let t=e.getReader(),r=new TextDecoder,s="";try{for(;;){let{done:o,value:i}=await t.read();if(o)break;s+=r.decode(i,{stream:!0});let a=s.split(`
+`);s=a.pop()??"";for(let l of a)if(l.startsWith("data:")){let u=l.slice(5).trim();u&&this.handleMessage(u)}}if(s+=r.decode(),s.startsWith("data:")){let o=s.slice(5).trim();o&&this.handleMessage(o)}}catch(o){if(this.closed)return;let i=o instanceof Error?o:new Error(String(o));this.emit("error",i)}this.closed||this.scheduleReconnect()}handleMessage(e){try{let t=JSON.parse(e);if(t.type==="connect"&&t.session_id){this.sessionId=t.session_id,this.emit("connect",t.session_id),(this.subscribedContextIds.size>0||this.subscribedGroupIds.size>0)&&this.sendSubscription("subscribe",{contextIds:[...this.subscribedContextIds],groupIds:[...this.subscribedGroupIds]});return}if(!t.result)return;let r=t.result.data;if(Array.isArray(r))try{let s=new Uint8Array(r),o=new TextDecoder().decode(s);r=JSON.parse(o)}catch{}if(t.result.contextId){this.emit("event",{contextId:t.result.contextId,type:t.result.type,data:r});return}t.result.groupId&&this.emit("event",{groupId:t.result.groupId,type:t.result.type,data:r})}catch{}}async subscribe(e){let t=Array.isArray(e)?{contextIds:e}:e,r=(t.contextIds??[]).filter(o=>!this.subscribedContextIds.has(o)),s=(t.groupIds??[]).filter(o=>!this.subscribedGroupIds.has(o));for(let o of t.contextIds??[])this.subscribedContextIds.add(o);for(let o of t.groupIds??[])this.subscribedGroupIds.add(o);(r.length>0||s.length>0)&&this.sessionId&&await this.sendSubscription("subscribe",{contextIds:r,groupIds:s})}async unsubscribe(e){let t=Array.isArray(e)?{contextIds:e}:e,r=(t.contextIds??[]).filter(o=>this.subscribedContextIds.has(o)),s=(t.groupIds??[]).filter(o=>this.subscribedGroupIds.has(o));for(let o of t.contextIds??[])this.subscribedContextIds.delete(o);for(let o of t.groupIds??[])this.subscribedGroupIds.delete(o);(r.length>0||s.length>0)&&this.sessionId&&await this.sendSubscription("unsubscribe",{contextIds:r,groupIds:s})}async sendSubscription(e,t){try{let r=await this.getAuthToken(),s={};t.contextIds&&t.contextIds.length>0&&(s.contextIds=t.contextIds),t.groupIds&&t.groupIds.length>0&&(s.groupIds=t.groupIds);let o=await fetch(`${this.baseUrl}/sse/subscription`,{method:"POST",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},body:JSON.stringify({id:this.sessionId,method:e,params:s})});if(!o.ok){let i=$e(o),a=await o.text().catch(()=>{});this.emit("error",i?new P(i,o.status,o.statusText,`${this.baseUrl}/sse/subscription`,o.headers,a):new R(o.status,o.statusText,`${this.baseUrl}/sse/subscription`,o.headers,a))}}catch(r){this.emit("error",r instanceof Error?r:new Error(`SSE ${e} failed`))}}forceReconnect(){this.abortController&&(this.abortController.abort(),this.abortController=null),this.sessionId=null,this.connect()}scheduleReconnect(){this.closed||(this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.forceReconnect()},this.reconnectDelayMs))}close(){this.closed=!0,this.abortController&&(this.abortController.abort(),this.abortController=null),this.reconnectTimer&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=null),this.sessionId=null,this.subscribedContextIds.clear(),this.subscribedGroupIds.clear()}};var Q=class Q{constructor(e){this.ws=null;this.closed=!1;this.reconnectAttempt=0;this.reconnectTimer=null;this.subscribedContextIds=new Set;this.subscribedGroupIds=new Set;this.listeners={connect:[],event:[],error:[]};this.baseUrl=e.baseUrl.replace(/\/+$/,""),this.getAuthToken=e.getAuthToken}on(e,t){let r=e;if(r in this.listeners){let s=this.listeners[r];s.includes(t)||s.push(t)}}off(e,t){let r=e;if(r in this.listeners){let s=this.listeners[r],o=s.indexOf(t);o!==-1&&s.splice(o,1)}}emit(e,t){let r=e;if(r in this.listeners)for(let s of this.listeners[r])try{s(t)}catch{}}async connect(){if(!(this.ws&&(this.ws.readyState===0||this.ws.readyState===1))){this.closed=!1;try{let e=await this.getAuthToken();if(!e)throw new Error("No authentication token available for WebSocket connection");let t=this.baseUrl.replace(/^http/,"ws");this.ws=new WebSocket(`${t}/ws?token=${encodeURIComponent(e)}`),this.ws.onopen=()=>{this.reconnectAttempt=0,this.emit("connect"),this.resubscribeAfterReconnect()},this.ws.onmessage=r=>{this.handleMessage(r.data)},this.ws.onerror=()=>{this.emit("error",new Error("WebSocket error"))},this.ws.onclose=()=>{this.closed||this.scheduleReconnect()}}catch(e){if(this.closed)return;let t=e instanceof Error?e:new Error(String(e));this.emit("error",t),this.scheduleReconnect()}}}handleMessage(e){if(typeof e=="string")try{let t=JSON.parse(e);if(!t.result)return;let r=t.result.data;if(Array.isArray(r))try{let s=new Uint8Array(r),o=new TextDecoder().decode(s);r=JSON.parse(o)}catch{}if(t.result.contextId){this.emit("event",{contextId:t.result.contextId,type:t.result.type,data:r});return}t.result.groupId&&this.emit("event",{groupId:t.result.groupId,type:t.result.type,data:r})}catch{}}subscribe(e){let t=Array.isArray(e)?{contextIds:e}:e;for(let r of t.contextIds??[])this.subscribedContextIds.add(r);for(let r of t.groupIds??[])this.subscribedGroupIds.add(r);this.ws&&this.ws.readyState===1&&this.sendMessage({id:null,method:"subscribe",params:this.buildSubscriptionParams(t.contextIds??[],t.groupIds??[])})}unsubscribe(e){let t=Array.isArray(e)?{contextIds:e}:e;for(let r of t.contextIds??[])this.subscribedContextIds.delete(r);for(let r of t.groupIds??[])this.subscribedGroupIds.delete(r);this.ws&&this.ws.readyState===1&&this.sendMessage({id:null,method:"unsubscribe",params:this.buildSubscriptionParams(t.contextIds??[],t.groupIds??[])})}resubscribeAfterReconnect(){this.subscribedContextIds.size===0&&this.subscribedGroupIds.size===0||this.sendMessage({id:null,method:"subscribe",params:this.buildSubscriptionParams([...this.subscribedContextIds],[...this.subscribedGroupIds])})}buildSubscriptionParams(e,t){let r={};return e.length>0&&(r.contextIds=e),t.length>0&&(r.groupIds=t),r}sendMessage(e){this.ws&&this.ws.readyState===1&&this.ws.send(JSON.stringify(e))}scheduleReconnect(){if(this.closed)return;this.reconnectTimer&&clearTimeout(this.reconnectTimer);let e=Math.min(1e3*Math.pow(2,this.reconnectAttempt),Q.MAX_BACKOFF_MS);this.reconnectAttempt++,this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},e)}close(){this.closed=!0,this.reconnectTimer&&(clearTimeout(this.reconnectTimer),this.reconnectTimer=null),this.ws&&(this.ws.onclose=null,this.ws.close(),this.ws=null),this.subscribedContextIds.clear(),this.subscribedGroupIds.clear()}};Q.MAX_BACKOFF_MS=3e4;var G=Q;function X(){return{encode(n){return Array.from(new TextEncoder().encode(JSON.stringify(n)))},decode(n){return JSON.parse(new TextDecoder().decode(new Uint8Array(n)))}}}var j=class{constructor(e){this.httpClient=e.httpClient,this.sse=e.sse}async set(e,t,r=X()){await be(this.httpClient,"set_ephemeral",{contextId:e,state:r.encode(t)})}subscribe(e,t,r=X()){let s=o=>{let i=o;if(i.type!=="Ephemeral"||i.contextId!==e)return;let a=i.data;if(!a?.author)return;let l=!!a.removed,u={author:a.author,state:l||a.state===void 0?void 0:r.decode(a.state),removed:l};a.ageMs!==void 0&&(u.ageMs=a.ageMs),t(u)};return this.sse.on("event",s),this.sse.connect().catch(()=>{}),this.sse.subscribe([e]).catch(()=>{}),()=>{this.sse.off("event",s)}}};var Oe=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,112,4,34,4,32]);function x(n){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,n,!0),e}function y(n){return Array.from(n,e=>e.toString(16).padStart(2,"0")).join("")}function p(n,e,t){let r=n.trim();if(!/^[0-9a-fA-F]*$/.test(r)||r.length!==t*2)throw new Error(`${e} must be ${t*2} hex characters, got ${r.length}`);let s=new Uint8Array(t);for(let o=0;o<t;o+=1)s[o]=Number.parseInt(r.slice(o*2,o*2+2),16);return s}function Y(n,e){let t=n.trim();if(!/^[0-9a-fA-F]*$/.test(t)||t.length%2!==0)throw new Error(`${e} must be an even number of hex characters`);let r=new Uint8Array(t.length/2);for(let s=0;s<r.length;s+=1)r[s]=Number.parseInt(t.slice(s*2,s*2+2),16);return r}function w(n){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(n),!0),e}function d(...n){let e=new Uint8Array(n.reduce((r,s)=>r+s.length,0)),t=0;for(let r of n)e.set(r,t),t+=r.length;return e}async function k(n,e){let t=[w(n.length),n];for(let r of e)t.push(w(r.length),r);return new Uint8Array(await crypto.subtle.digest("SHA-256",d(...t)))}async function C(n){let e=p(n,"deviceSecret",32),t=d(Oe,e);try{return await crypto.subtle.importKey("pkcs8",t,{name:"Ed25519"},!1,["sign"])}catch(r){let s=r instanceof Error?`: ${r.message}`:"";throw new Error("this runtime has no WebCrypto Ed25519, so a warrant cannot be signed here. Node 18.4+, Safari 17+, Firefox 129+ and Chrome 137+ have it; otherwise mint the warrant with `merod account warrant`"+s)}}async function A(n){let e=p(n,"deviceSecret",32),t=d(Oe,e),r=await crypto.subtle.importKey("pkcs8",t,{name:"Ed25519"},!0,["sign"]),o=(await crypto.subtle.exportKey("jwk",r)).x;return Uint8Array.from(atob(o.replace(/-/g,"+").replace(/_/g,"/")),i=>i.charCodeAt(0))}var St=new TextEncoder().encode("calimero.device.cert.v1"),je=new TextEncoder().encode("calimero.account.genesis.v1"),Pt=new TextEncoder().encode("calimero.device.id.v1"),Re=2;async function Ke(n,e){if(e.length!==16)throw new Error(`nonce must be 16 bytes, got ${e.length}`);let t=p(n,"account",32);return y(await k(Pt,[t,e]))}async function xe(n){return k(St,[p(n.account,"account",32),p(n.device,"device",32),p(n.signPublicKey,"signPublicKey",32),p(n.kemPublicKey,"kemPublicKey",32),x(n.keyEpoch),x(n.deviceEpoch)])}function Be(n){return d(new Uint8Array([Re]),n.rootPublicKey,x(0),p(n.account,"account",32),p(n.device,"device",32),p(n.signPublicKey,"signPublicKey",32),p(n.kemPublicKey,"kemPublicKey",32),x(n.keyEpoch),x(n.deviceEpoch),n.signature)}async function We(n){let e=await A(n.rootSecret),t=y(await k(je,[d(new Uint8Array([Re]),e)])),r=0,s=await xe({account:t,device:n.device,signPublicKey:n.signPublicKey,kemPublicKey:n.kemPublicKey,keyEpoch:r,deviceEpoch:n.deviceEpoch}),o=await C(n.rootSecret),i=new Uint8Array(await crypto.subtle.sign("Ed25519",o,s)),a=Be({rootPublicKey:e,account:t,device:n.device,signPublicKey:n.signPublicKey,kemPublicKey:n.kemPublicKey,keyEpoch:r,deviceEpoch:n.deviceEpoch,signature:i});return y(a)}async function Z(n){let e=await A(n);return y(await k(je,[d(new Uint8Array([Re]),e)]))}var we=["abandon","ability","able","about","above","absent","absorb","abstract","absurd","abuse","access","accident","account","accuse","achieve","acid","acoustic","acquire","across","act","action","actor","actress","actual","adapt","add","addict","address","adjust","admit","adult","advance","advice","aerobic","affair","afford","afraid","again","age","agent","agree","ahead","aim","air","airport","aisle","alarm","album","alcohol","alert","alien","all","alley","allow","almost","alone","alpha","already","also","alter","always","amateur","amazing","among","amount","amused","analyst","anchor","ancient","anger","angle","angry","animal","ankle","announce","annual","another","answer","antenna","antique","anxiety","any","apart","apology","appear","apple","approve","april","arch","arctic","area","arena","argue","arm","armed","armor","army","around","arrange","arrest","arrive","arrow","art","artefact","artist","artwork","ask","aspect","assault","asset","assist","assume","asthma","athlete","atom","attack","attend","attitude","attract","auction","audit","august","aunt","author","auto","autumn","average","avocado","avoid","awake","aware","away","awesome","awful","awkward","axis","baby","bachelor","bacon","badge","bag","balance","balcony","ball","bamboo","banana","banner","bar","barely","bargain","barrel","base","basic","basket","battle","beach","bean","beauty","because","become","beef","before","begin","behave","behind","believe","below","belt","bench","benefit","best","betray","better","between","beyond","bicycle","bid","bike","bind","biology","bird","birth","bitter","black","blade","blame","blanket","blast","bleak","bless","blind","blood","blossom","blouse","blue","blur","blush","board","boat","body","boil","bomb","bone","bonus","book","boost","border","boring","borrow","boss","bottom","bounce","box","boy","bracket","brain","brand","brass","brave","bread","breeze","brick","bridge","brief","bright","bring","brisk","broccoli","broken","bronze","broom","brother","brown","brush","bubble","buddy","budget","buffalo","build","bulb","bulk","bullet","bundle","bunker","burden","burger","burst","bus","business","busy","butter","buyer","buzz","cabbage","cabin","cable","cactus","cage","cake","call","calm","camera","camp","can","canal","cancel","candy","cannon","canoe","canvas","canyon","capable","capital","captain","car","carbon","card","cargo","carpet","carry","cart","case","cash","casino","castle","casual","cat","catalog","catch","category","cattle","caught","cause","caution","cave","ceiling","celery","cement","census","century","cereal","certain","chair","chalk","champion","change","chaos","chapter","charge","chase","chat","cheap","check","cheese","chef","cherry","chest","chicken","chief","child","chimney","choice","choose","chronic","chuckle","chunk","churn","cigar","cinnamon","circle","citizen","city","civil","claim","clap","clarify","claw","clay","clean","clerk","clever","click","client","cliff","climb","clinic","clip","clock","clog","close","cloth","cloud","clown","club","clump","cluster","clutch","coach","coast","coconut","code","coffee","coil","coin","collect","color","column","combine","come","comfort","comic","common","company","concert","conduct","confirm","congress","connect","consider","control","convince","cook","cool","copper","copy","coral","core","corn","correct","cost","cotton","couch","country","couple","course","cousin","cover","coyote","crack","cradle","craft","cram","crane","crash","crater","crawl","crazy","cream","credit","creek","crew","cricket","crime","crisp","critic","crop","cross","crouch","crowd","crucial","cruel","cruise","crumble","crunch","crush","cry","crystal","cube","culture","cup","cupboard","curious","current","curtain","curve","cushion","custom","cute","cycle","dad","damage","damp","dance","danger","daring","dash","daughter","dawn","day","deal","debate","debris","decade","december","decide","decline","decorate","decrease","deer","defense","define","defy","degree","delay","deliver","demand","demise","denial","dentist","deny","depart","depend","deposit","depth","deputy","derive","describe","desert","design","desk","despair","destroy","detail","detect","develop","device","devote","diagram","dial","diamond","diary","dice","diesel","diet","differ","digital","dignity","dilemma","dinner","dinosaur","direct","dirt","disagree","discover","disease","dish","dismiss","disorder","display","distance","divert","divide","divorce","dizzy","doctor","document","dog","doll","dolphin","domain","donate","donkey","donor","door","dose","double","dove","draft","dragon","drama","drastic","draw","dream","dress","drift","drill","drink","drip","drive","drop","drum","dry","duck","dumb","dune","during","dust","dutch","duty","dwarf","dynamic","eager","eagle","early","earn","earth","easily","east","easy","echo","ecology","economy","edge","edit","educate","effort","egg","eight","either","elbow","elder","electric","elegant","element","elephant","elevator","elite","else","embark","embody","embrace","emerge","emotion","employ","empower","empty","enable","enact","end","endless","endorse","enemy","energy","enforce","engage","engine","enhance","enjoy","enlist","enough","enrich","enroll","ensure","enter","entire","entry","envelope","episode","equal","equip","era","erase","erode","erosion","error","erupt","escape","essay","essence","estate","eternal","ethics","evidence","evil","evoke","evolve","exact","example","excess","exchange","excite","exclude","excuse","execute","exercise","exhaust","exhibit","exile","exist","exit","exotic","expand","expect","expire","explain","expose","express","extend","extra","eye","eyebrow","fabric","face","faculty","fade","faint","faith","fall","false","fame","family","famous","fan","fancy","fantasy","farm","fashion","fat","fatal","father","fatigue","fault","favorite","feature","february","federal","fee","feed","feel","female","fence","festival","fetch","fever","few","fiber","fiction","field","figure","file","film","filter","final","find","fine","finger","finish","fire","firm","first","fiscal","fish","fit","fitness","fix","flag","flame","flash","flat","flavor","flee","flight","flip","float","flock","floor","flower","fluid","flush","fly","foam","focus","fog","foil","fold","follow","food","foot","force","forest","forget","fork","fortune","forum","forward","fossil","foster","found","fox","fragile","frame","frequent","fresh","friend","fringe","frog","front","frost","frown","frozen","fruit","fuel","fun","funny","furnace","fury","future","gadget","gain","galaxy","gallery","game","gap","garage","garbage","garden","garlic","garment","gas","gasp","gate","gather","gauge","gaze","general","genius","genre","gentle","genuine","gesture","ghost","giant","gift","giggle","ginger","giraffe","girl","give","glad","glance","glare","glass","glide","glimpse","globe","gloom","glory","glove","glow","glue","goat","goddess","gold","good","goose","gorilla","gospel","gossip","govern","gown","grab","grace","grain","grant","grape","grass","gravity","great","green","grid","grief","grit","grocery","group","grow","grunt","guard","guess","guide","guilt","guitar","gun","gym","habit","hair","half","hammer","hamster","hand","happy","harbor","hard","harsh","harvest","hat","have","hawk","hazard","head","health","heart","heavy","hedgehog","height","hello","helmet","help","hen","hero","hidden","high","hill","hint","hip","hire","history","hobby","hockey","hold","hole","holiday","hollow","home","honey","hood","hope","horn","horror","horse","hospital","host","hotel","hour","hover","hub","huge","human","humble","humor","hundred","hungry","hunt","hurdle","hurry","hurt","husband","hybrid","ice","icon","idea","identify","idle","ignore","ill","illegal","illness","image","imitate","immense","immune","impact","impose","improve","impulse","inch","include","income","increase","index","indicate","indoor","industry","infant","inflict","inform","inhale","inherit","initial","inject","injury","inmate","inner","innocent","input","inquiry","insane","insect","inside","inspire","install","intact","interest","into","invest","invite","involve","iron","island","isolate","issue","item","ivory","jacket","jaguar","jar","jazz","jealous","jeans","jelly","jewel","job","join","joke","journey","joy","judge","juice","jump","jungle","junior","junk","just","kangaroo","keen","keep","ketchup","key","kick","kid","kidney","kind","kingdom","kiss","kit","kitchen","kite","kitten","kiwi","knee","knife","knock","know","lab","label","labor","ladder","lady","lake","lamp","language","laptop","large","later","latin","laugh","laundry","lava","law","lawn","lawsuit","layer","lazy","leader","leaf","learn","leave","lecture","left","leg","legal","legend","leisure","lemon","lend","length","lens","leopard","lesson","letter","level","liar","liberty","library","license","life","lift","light","like","limb","limit","link","lion","liquid","list","little","live","lizard","load","loan","lobster","local","lock","logic","lonely","long","loop","lottery","loud","lounge","love","loyal","lucky","luggage","lumber","lunar","lunch","luxury","lyrics","machine","mad","magic","magnet","maid","mail","main","major","make","mammal","man","manage","mandate","mango","mansion","manual","maple","marble","march","margin","marine","market","marriage","mask","mass","master","match","material","math","matrix","matter","maximum","maze","meadow","mean","measure","meat","mechanic","medal","media","melody","melt","member","memory","mention","menu","mercy","merge","merit","merry","mesh","message","metal","method","middle","midnight","milk","million","mimic","mind","minimum","minor","minute","miracle","mirror","misery","miss","mistake","mix","mixed","mixture","mobile","model","modify","mom","moment","monitor","monkey","monster","month","moon","moral","more","morning","mosquito","mother","motion","motor","mountain","mouse","move","movie","much","muffin","mule","multiply","muscle","museum","mushroom","music","must","mutual","myself","mystery","myth","naive","name","napkin","narrow","nasty","nation","nature","near","neck","need","negative","neglect","neither","nephew","nerve","nest","net","network","neutral","never","news","next","nice","night","noble","noise","nominee","noodle","normal","north","nose","notable","note","nothing","notice","novel","now","nuclear","number","nurse","nut","oak","obey","object","oblige","obscure","observe","obtain","obvious","occur","ocean","october","odor","off","offer","office","often","oil","okay","old","olive","olympic","omit","once","one","onion","online","only","open","opera","opinion","oppose","option","orange","orbit","orchard","order","ordinary","organ","orient","original","orphan","ostrich","other","outdoor","outer","output","outside","oval","oven","over","own","owner","oxygen","oyster","ozone","pact","paddle","page","pair","palace","palm","panda","panel","panic","panther","paper","parade","parent","park","parrot","party","pass","patch","path","patient","patrol","pattern","pause","pave","payment","peace","peanut","pear","peasant","pelican","pen","penalty","pencil","people","pepper","perfect","permit","person","pet","phone","photo","phrase","physical","piano","picnic","picture","piece","pig","pigeon","pill","pilot","pink","pioneer","pipe","pistol","pitch","pizza","place","planet","plastic","plate","play","please","pledge","pluck","plug","plunge","poem","poet","point","polar","pole","police","pond","pony","pool","popular","portion","position","possible","post","potato","pottery","poverty","powder","power","practice","praise","predict","prefer","prepare","present","pretty","prevent","price","pride","primary","print","priority","prison","private","prize","problem","process","produce","profit","program","project","promote","proof","property","prosper","protect","proud","provide","public","pudding","pull","pulp","pulse","pumpkin","punch","pupil","puppy","purchase","purity","purpose","purse","push","put","puzzle","pyramid","quality","quantum","quarter","question","quick","quit","quiz","quote","rabbit","raccoon","race","rack","radar","radio","rail","rain","raise","rally","ramp","ranch","random","range","rapid","rare","rate","rather","raven","raw","razor","ready","real","reason","rebel","rebuild","recall","receive","recipe","record","recycle","reduce","reflect","reform","refuse","region","regret","regular","reject","relax","release","relief","rely","remain","remember","remind","remove","render","renew","rent","reopen","repair","repeat","replace","report","require","rescue","resemble","resist","resource","response","result","retire","retreat","return","reunion","reveal","review","reward","rhythm","rib","ribbon","rice","rich","ride","ridge","rifle","right","rigid","ring","riot","ripple","risk","ritual","rival","river","road","roast","robot","robust","rocket","romance","roof","rookie","room","rose","rotate","rough","round","route","royal","rubber","rude","rug","rule","run","runway","rural","sad","saddle","sadness","safe","sail","salad","salmon","salon","salt","salute","same","sample","sand","satisfy","satoshi","sauce","sausage","save","say","scale","scan","scare","scatter","scene","scheme","school","science","scissors","scorpion","scout","scrap","screen","script","scrub","sea","search","season","seat","second","secret","section","security","seed","seek","segment","select","sell","seminar","senior","sense","sentence","series","service","session","settle","setup","seven","shadow","shaft","shallow","share","shed","shell","sheriff","shield","shift","shine","ship","shiver","shock","shoe","shoot","shop","short","shoulder","shove","shrimp","shrug","shuffle","shy","sibling","sick","side","siege","sight","sign","silent","silk","silly","silver","similar","simple","since","sing","siren","sister","situate","six","size","skate","sketch","ski","skill","skin","skirt","skull","slab","slam","sleep","slender","slice","slide","slight","slim","slogan","slot","slow","slush","small","smart","smile","smoke","smooth","snack","snake","snap","sniff","snow","soap","soccer","social","sock","soda","soft","solar","soldier","solid","solution","solve","someone","song","soon","sorry","sort","soul","sound","soup","source","south","space","spare","spatial","spawn","speak","special","speed","spell","spend","sphere","spice","spider","spike","spin","spirit","split","spoil","sponsor","spoon","sport","spot","spray","spread","spring","spy","square","squeeze","squirrel","stable","stadium","staff","stage","stairs","stamp","stand","start","state","stay","steak","steel","stem","step","stereo","stick","still","sting","stock","stomach","stone","stool","story","stove","strategy","street","strike","strong","struggle","student","stuff","stumble","style","subject","submit","subway","success","such","sudden","suffer","sugar","suggest","suit","summer","sun","sunny","sunset","super","supply","supreme","sure","surface","surge","surprise","surround","survey","suspect","sustain","swallow","swamp","swap","swarm","swear","sweet","swift","swim","swing","switch","sword","symbol","symptom","syrup","system","table","tackle","tag","tail","talent","talk","tank","tape","target","task","taste","tattoo","taxi","teach","team","tell","ten","tenant","tennis","tent","term","test","text","thank","that","theme","then","theory","there","they","thing","this","thought","three","thrive","throw","thumb","thunder","ticket","tide","tiger","tilt","timber","time","tiny","tip","tired","tissue","title","toast","tobacco","today","toddler","toe","together","toilet","token","tomato","tomorrow","tone","tongue","tonight","tool","tooth","top","topic","topple","torch","tornado","tortoise","toss","total","tourist","toward","tower","town","toy","track","trade","traffic","tragic","train","transfer","trap","trash","travel","tray","treat","tree","trend","trial","tribe","trick","trigger","trim","trip","trophy","trouble","truck","true","truly","trumpet","trust","truth","try","tube","tuition","tumble","tuna","tunnel","turkey","turn","turtle","twelve","twenty","twice","twin","twist","two","type","typical","ugly","umbrella","unable","unaware","uncle","uncover","under","undo","unfair","unfold","unhappy","uniform","unique","unit","universe","unknown","unlock","until","unusual","unveil","update","upgrade","uphold","upon","upper","upset","urban","urge","usage","use","used","useful","useless","usual","utility","vacant","vacuum","vague","valid","valley","valve","van","vanish","vapor","various","vast","vault","vehicle","velvet","vendor","venture","venue","verb","verify","version","very","vessel","veteran","viable","vibrant","vicious","victory","video","view","village","vintage","violin","virtual","virus","visa","visit","visual","vital","vivid","vocal","voice","void","volcano","volume","vote","voyage","wage","wagon","wait","walk","wall","walnut","want","warfare","warm","warrior","wash","wasp","waste","water","wave","way","wealth","weapon","wear","weasel","weather","web","wedding","weekend","weird","welcome","west","wet","whale","what","wheat","wheel","when","where","whip","whisper","wide","width","wife","wild","will","win","window","wine","wing","wink","winner","winter","wire","wisdom","wise","wish","witness","wolf","woman","wonder","wood","wool","word","work","world","worry","worth","wrap","wreck","wrestle","wrist","write","wrong","yard","year","yellow","you","young","youth","zebra","zero","zone","zoo"];var Tt=new TextEncoder().encode("calimero.mdma.account-link.v1\0"),Dt=new TextEncoder().encode("calimero.mdma.account-login.v1\0"),K=256,Ve=K/32,Ce=(K+Ve)/11;async function Je(){let n=crypto.getRandomValues(new Uint8Array(K/8));return ze(y(n),await Mt(n))}async function Fe(n){let e=Et(n);return ze(y(await _t(e)),e.join(" "))}async function M(n){return p(n,"secret",32),{secret:n,publicKey:y(await A(n)),accountId:await Z(n)}}async function B(n){if(!n.nonce)throw new Error("nonce is required to sign an account link");let e=await C(n.rootSecret),t=new Uint8Array(await crypto.subtle.sign("Ed25519",e,d(Tt,new TextEncoder().encode(n.nonce))));return Ye(t)}async function ee(n){if(!n.nonce)throw new Error("nonce is required to sign an account login");let e=await C(n.rootSecret),t=new Uint8Array(await crypto.subtle.sign("Ed25519",e,d(Dt,new TextEncoder().encode(n.nonce))));return Ye(t)}async function ze(n,e){return{...await M(n),phrase:e}}function Et(n){let e=n.normalize("NFKD").toLowerCase().trim().split(/\s+/),t=e[0]===""?0:e.length;if(t!==Ce)throw new Error(`recovery phrase must be ${Ce} words, got ${t}`);return e}async function Mt(n){let e=Xe(n)+await Qe(n),t=[];for(let r=0;r<Ce;r+=1){let s=Number.parseInt(e.slice(r*11,r*11+11),2);t.push(we[s])}return t.join(" ")}async function _t(n){let e="";for(let r of n){let s=we.indexOf(r);if(s<0)throw new Error(`"${r}" is not a word in the recovery phrase list`);e+=s.toString(2).padStart(11,"0")}let t=new Uint8Array(K/8);for(let r=0;r<t.length;r+=1)t[r]=Number.parseInt(e.slice(r*8,r*8+8),2);if(e.slice(K)!==await Qe(t))throw new Error("recovery phrase checksum failed \u2014 check for a mistyped or transposed word");return t}async function Qe(n){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",n));return Xe(e).slice(0,Ve)}function Xe(n){let e="";for(let t of n)e+=t.toString(2).padStart(8,"0");return e}function Ye(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e)}var Ut=new TextEncoder().encode("calimero.mdma.routing-read.v1\0");async function Ze(n,e){p(e,"deviceSecret",32);let t=await C(e),r=d(Ut,new TextEncoder().encode(n)),s=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},t,r));return Nt(s)}async function te(n,e){return{"X-Calimero-Credential":e.credential,"X-Calimero-Nonce":n.nonce,"X-Calimero-Signature":await Ze(n.nonce,e.deviceSecret)}}function Nt(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e)}var Gt="https://cloud.calimero.network",qt="x-mdma-session-refresh",Lt="x-mdma-session-expires",_=class{constructor(e={}){this.session=null;this.baseUrl=(e.cloudBaseUrl||Gt).replace(/\/+$/,""),this.onSession=e.onSession;let t=e.fetch;this.fetchImpl=t?(r,s)=>t(r,s):(r,s)=>globalThis.fetch(r,s),this.timeoutMs=e.timeoutMs??1e4,this.routingCredential=e.routingCredential,e.sessionToken&&(this.session={sessionToken:e.sessionToken,expiresAt:0,user:{email:""}})}getSession(){return this.session}isSignedIn(){return this.session!==null}async signInWithGoogle(e){let t=await this.request("POST","/api/auth/google",{body:{id_token:e},anonymous:!0});return this.adoptSession(t)}async signInWithAccount(e){let t=await M(e),{nonce:r}=await this.getAccountLoginChallenge();return this.submitAccountLogin({rootPublicKey:t.publicKey,nonce:r,signature:await ee({rootSecret:e,nonce:r})})}async getAccountLoginChallenge(){let e=await this.request("GET","/api/auth/account/challenge",{anonymous:!0});return{nonce:e.nonce,expiresAtMs:e.expires_at_ms}}async submitAccountLogin(e){let t=await this.request("POST","/api/auth/account",{body:{root_public_key:e.rootPublicKey,nonce:e.nonce,signature:e.signature},anonymous:!0});return this.adoptSession(t)}async refreshSession(){let e=await this.request("POST","/api/auth/refresh");return this.adoptSession(e)}async signOut(){try{this.session&&await this.request("POST","/api/auth/logout",{parse:"none"})}finally{this.session=null,this.notifySession(null)}}async getMyNamespaces(){return(await this.request("GET","/api/cloud/me/namespaces")).map(t=>({namespaceId:String(t.namespace_id??t.group_id??""),groupId:String(t.group_id??t.namespace_id??""),haStatus:String(t.ha_status??"none"),haEnabledAt:t.ha_enabled_at??null,contexts:Array.isArray(t.contexts)?t.contexts:[],fleetReplicas:t.fleet_replicas}))}async getNamespaceRelays(e){return((await this.request("GET",`/api/cloud/me/namespaces/${encodeURIComponent(e)}/relays`)).relays??[]).map(r=>({peerId:String(r.peer_id??""),relayUrl:r.relay_url??null,executorAccount:r.executor_account??null,status:String(r.status??""),authorshipReady:r.authorship_ready===!0,lastSeenAt:r.last_seen_at??null,confirmedAt:r.confirmed_at??null}))}async findExecutingRelay(e){return(await this.getNamespaceRelays(e)).find(r=>r.authorshipReady&&r.relayUrl!==null&&r.executorAccount!==null)??null}async getNamespaceRouting(e){let t=await this.request("GET",`/api/cloud/namespaces/${encodeURIComponent(e)}/admitters`,{anonymous:!0,headers:await this.routingProof(e)});return{namespaceId:String(t.namespace_id??e),nodes:(t.admitters??[]).map(r=>({peerId:String(r.peer_id??""),account:r.account??null,relayUrl:r.relay_url??null,admitUrl:r.admit_url??null,status:String(r.status??""),fresh:r.fresh===!0,canAdmit:r.can_admit===!0,authorshipReady:r.authorship_ready===!0,canExecute:r.can_execute===!0})),servable:t.servable===!0,writable:t.writable===!0}}async getRoutingChallenge(e){let t=await this.request("GET",`/api/cloud/namespaces/${encodeURIComponent(e)}/challenge`,{anonymous:!0});return{namespaceId:String(t.namespace_id??e),nonce:String(t.nonce??""),expiresAtMs:Number(t.expires_at_ms??0)}}async routingProof(e){if(!this.routingCredential)return;let t=await this.getRoutingChallenge(e);return te(t,this.routingCredential)}async getAccountRelaysChallenge(e){let t=await this.request("GET",`/api/cloud/accounts/${encodeURIComponent(e)}/challenge`,{anonymous:!0});return{accountId:String(t.account_id??e),nonce:String(t.nonce??""),expiresAtMs:Number(t.expires_at_ms??0)}}async getAccountRelays(e){if(!this.routingCredential)throw new Error("getAccountRelays needs a routingCredential: construct the client with the device certificate and its signing secret, since this read is proven by the device, not by a session.");let t=await this.getAccountRelaysChallenge(e);return((await this.request("GET",`/api/cloud/accounts/${encodeURIComponent(e)}/relays`,{anonymous:!0,headers:await te(t,this.routingCredential)})).relays??[]).map(s=>({peerId:String(s.peer_id??""),relayUrl:s.relay_url??null,fresh:s.fresh===!0}))}async findAdmitter(e,t){let{nodes:r}=await this.getNamespaceRouting(e),s=t&&t.length>0?new Set(t.map(o=>o.toLowerCase())):null;return r.find(o=>o.canAdmit&&(s===null||o.account!==null&&s.has(o.account.toLowerCase())))??null}async getMyMachines(){return((await this.request("GET","/api/cloud/me/machines")).machines??[]).map(t=>({peerId:String(t.peer_id??""),relayUrl:t.relay_url??null,executorAccount:t.executor_account??null,canExecute:t.can_execute===!0,namespaces:(Array.isArray(t.namespaces)?t.namespaces:[]).map(r=>{let s=r;return{namespaceId:String(s.namespace_id??""),status:String(s.status??""),authorshipReady:s.authorship_ready===!0,fresh:s.fresh===!0,confirmedAt:s.confirmed_at??null,lastSeenAt:s.last_seen_at??null}})}))}async claimNamespace(e,t){await this.request("POST","/api/cloud/namespaces/claim",{body:{namespace_id:e,ownership_proof:t}})}async enableNamespaceHa(e){return this.request("POST",`/api/cloud/namespaces/${encodeURIComponent(e)}/enable-ha`,{body:{}})}async disableNamespaceHa(e){return this.request("POST",`/api/cloud/namespaces/${encodeURIComponent(e)}/disable-ha`,{body:{}})}async getMyNode(){return(await this.request("GET","/api/cloud/me/node")).node??null}enableHA(e){let t=new URLSearchParams({group_id:e.groupId,context_id:e.contextId});e.redirectUrl&&t.set("redirect_url",e.redirectUrl),window.open(`${this.baseUrl}/enable-ha?${t.toString()}`)}disableHA(e){let t=new URLSearchParams({group_id:e.groupId,context_id:e.contextId});e.redirectUrl&&t.set("redirect_url",e.redirectUrl),window.open(`${this.baseUrl}/disable-ha?${t.toString()}`)}async linkAccount(e){let t=await M(e),{nonce:r}=await this.getAccountLinkChallenge();return this.submitAccountLink({accountId:t.accountId,rootPublicKey:t.publicKey,nonce:r,signature:await B({rootSecret:e,nonce:r})})}async getAccountLinkChallenge(){let e=await this.request("GET","/api/cloud/me/accounts/challenge");return{nonce:e.nonce,expiresAtMs:e.expires_at_ms??null}}async submitAccountLink(e){let t=await this.request("POST","/api/cloud/me/accounts",{body:{account_id:e.accountId,root_public_key:e.rootPublicKey,nonce:e.nonce,signature:e.signature}});return{accountId:String(t.account_id??e.accountId),linkedAt:t.linked_at??null,alreadyLinked:t.already_linked===!0}}static accountLinkHandoff(e){let t=e.portalUrl.replace(/\/+$/,""),r=new URLSearchParams({"link-account":e.accountId,"callback-url":e.callbackUrl});return{url:`${t}/?${r.toString()}`,accountId:e.accountId}}static readAccountLinkCallback(e){let t=e??(typeof window>"u"?"":window.location.href);if(!t)return{};let r;try{r=new URL(t).hash}catch{return{}}let s=new URLSearchParams(r.replace(/^#/,"")),o=s.get("grant"),i=s.get("account"),a=s.get("error"),l={};return o&&(l.grant=o),i&&(l.accountId=i),a&&(l.error=a),l}async linkAccountWithGrant(e){let t=await M(e.rootSecret),r=await this.request("POST","/api/cloud/accounts/link",{body:{grant:e.grant,root_public_key:t.publicKey,signature:await B({rootSecret:e.rootSecret,nonce:e.grant})},anonymous:!0});return{accountId:String(r.account_id??t.accountId),linkedAt:r.linked_at??null,alreadyLinked:r.already_linked===!0}}async getMyAccounts(){let e=await this.request("GET","/api/cloud/me/accounts");return{accounts:(e.accounts??[]).map(t=>({accountId:String(t.account_id??""),linkedAt:t.linked_at??null,hasRecoveryEnvelope:t.has_recovery_envelope===!0})),limit:e.limit??null}}adoptSession(e){return this.session={sessionToken:e.session_token,expiresAt:e.expires_at,user:e.user},this.notifySession(this.session),this.session}async notifySession(e){try{await this.onSession?.(e)}catch{}}async request(e,t,r={}){if(!r.anonymous&&!this.session)throw new Error("Not signed in to Calimero Cloud: call signInWithGoogle() or construct the client with a sessionToken");let s={...r.headers,Accept:"application/json"};r.body!==void 0&&(s["Content-Type"]="application/json"),!r.anonymous&&this.session&&(s.Authorization=`Bearer ${this.session.sessionToken}`);let o=new AbortController,i=setTimeout(()=>o.abort(),this.timeoutMs),a;try{a=await this.fetchImpl(`${this.baseUrl}${t}`,{method:e,headers:s,body:r.body===void 0?void 0:JSON.stringify(r.body),signal:o.signal})}catch(l){throw new R(0,l instanceof Error?l.name:"NetworkError",`${this.baseUrl}${t}`,new Headers,l instanceof Error?l.message:String(l))}finally{clearTimeout(i)}if(this.adoptRollingRefresh(a),!a.ok){let l=await a.text().catch(()=>{});throw new R(a.status,a.statusText,`${this.baseUrl}${t}`,a.headers,l)}if(!(r.parse==="none"||a.status===204))return await a.json()}adoptRollingRefresh(e){let t=e.headers.get(qt);if(!t||!this.session)return;let r=e.headers.get(Lt),s=Number(r);this.session={sessionToken:t,expiresAt:Number.isFinite(s)&&s>0?s:this.session.expiresAt,user:this.session.user},this.notifySession(this.session)}};var Ht="mero-js:token-refresh";function $t(){let e=globalThis.navigator?.locks;return e&&typeof e.request=="function"?e:null}function Ae(n,e){try{let t=n.split(".");if(t.length===3){let r=t[1].replace(/-/g,"+").replace(/_/g,"/");for(;r.length%4;)r+="=";let s=JSON.parse(atob(r));if(typeof s.exp=="number")return s.exp*1e3}}catch{}return e}var ne=class{constructor(e){this.tokenData=null;this.refreshPromise=null;this.rpcClient=null;this.sseClient=null;this.wsClient=null;this.wsWarned=!1;this.config={timeoutMs:1e4,...e},this.tokenStore=e.tokenStore??null,this.tokenStore&&(this.tokenData=this.tokenStore.getTokens());let t=typeof window<"u"&&"__TAURI_INTERNALS__"in window;this.httpClient=U({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",refreshToken:async()=>(await this.performTokenRefresh()).access_token,onTokenRefresh:async r=>{this.tokenData&&(this.tokenData.access_token=r,this.tokenStore?.setTokens(this.tokenData))},onAuthRevoked:async()=>{this.clearToken();try{await this.config.onAuthRevoked?.()}catch{}},timeoutMs:this.config.timeoutMs,credentials:this.config.requestCredentials??(t?"omit":void 0)}),this.authClient=Ne(this.httpClient,{baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",timeoutMs:this.config.timeoutMs}),this.adminClient=Le(this.httpClient,{baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||"",timeoutMs:this.config.timeoutMs})}get auth(){return this.authClient}get admin(){return this.adminClient}get rpc(){return this.rpcClient||(this.rpcClient=new O({httpClient:this.httpClient})),this.rpcClient}get events(){return this.sseClient||(this.sseClient=new N({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||""})),this.sseClient}get ephemeral(){return this.ephemeralClient||(this.ephemeralClient=new j({httpClient:this.httpClient,sse:this.events})),this.ephemeralClient}get cloud(){return this.cloudClient||(this.cloudClient=new _(this.config.cloud??{})),this.cloudClient}get ws(){return this.wsWarned||(this.wsWarned=!0,console.warn("[mero-js] WsClient is experimental. Use mero.events (SSE) for production.")),this.wsClient||(this.wsClient=new G({baseUrl:this.config.baseUrl,getAuthToken:async()=>(await this.getValidToken())?.access_token||""})),this.wsClient}async authenticate(e){let t=e||this.config.credentials;if(!t)throw new Error("No credentials provided for authentication");try{let r={auth_method:"user_password",public_key:t.username,client_name:"mero-js-sdk",permissions:["admin"],timestamp:Math.floor(Date.now()/1e3),provider_data:{username:t.username,password:t.password}},s=await this.authClient.generateTokens(r),o=s.data.access_token;return this.tokenData={access_token:o,refresh_token:s.data.refresh_token,expires_at:Ae(o,Date.now()+36e5)},this.tokenStore?.setTokens(this.tokenData),this.tokenData}catch(r){throw new Error(`Authentication failed: ${r instanceof Error?r.message:"Unknown error"}`)}}async getValidToken(){return this.tokenData}async performTokenRefresh(){if(this.refreshPromise)return this.refreshPromise;let e=this.tokenData?.access_token,t=this.withRefreshLock(()=>this.performTokenRefreshLocked(e));this.refreshPromise=t;try{return await t}finally{this.refreshPromise===t&&(this.refreshPromise=null)}}withRefreshLock(e){let t=$t();return t?t.request(Ht,e):e()}async performTokenRefreshLocked(e){let t=this.tokenStore?.getTokens()??null;if(t?.refresh_token&&(this.tokenData=t,e&&t.access_token!==e))return t;if(!this.tokenData?.refresh_token)throw new Error("No refresh token available");try{let r=await this.authClient.refreshToken({access_token:this.tokenData.access_token,refresh_token:this.tokenData.refresh_token}),s=r.data.access_token;return this.tokenData={access_token:s,refresh_token:r.data.refresh_token,expires_at:Ae(s,Date.now()+36e5)},this.tokenStore?.setTokens(this.tokenData),this.tokenData}catch(r){throw new Error(`Token refresh failed: ${r instanceof Error?r.message:"Unknown error"}`)}}clearToken(){this.refreshPromise=null,this.tokenData=null,this.tokenStore?.clear()}isAuthenticated(){return this.tokenData!==null}setTokenData(e){let t=e.expires_at||Ae(e.access_token,Date.now()+36e5);this.tokenData={...e,expires_at:t},this.tokenStore?.setTokens(this.tokenData)}getTokenData(){return this.tokenData}close(){this.sseClient?.close(),this.wsClient?.close()}static parseAuthCallback(e){return fe(e)}static buildAuthLoginUrl(e,t){return ye(e,t)}};function Ot(n){return new ne(n)}var ve=class{constructor(){this.tokens=null}getTokens(){return this.tokens}setTokens(e){this.tokens=e}clear(){this.tokens=null}},jt="mero-tokens",ke=class{constructor(e=jt){this.key=e}getTokens(){try{if(typeof localStorage>"u")return null;let e=localStorage.getItem(this.key);if(!e)return null;let t=JSON.parse(e);return t&&t.access_token&&t.refresh_token?{access_token:t.access_token,refresh_token:t.refresh_token,expires_at:typeof t.expires_at=="number"?t.expires_at:Date.now()+36e5}:null}catch{return null}}setTokens(e){try{if(typeof localStorage>"u")return;localStorage.setItem(this.key,JSON.stringify(e))}catch{}}clear(){try{if(typeof localStorage>"u")return;localStorage.removeItem(this.key)}catch{}}};var Kt=new TextEncoder().encode("calimero.warrant.v2"),Bt=new TextEncoder().encode("calimero.warrant.intent.v1"),et=64,Wt="00".repeat(32);async function Ie(n,e){let t=new TextEncoder().encode(JSON.stringify(e));return k(Bt,[new TextEncoder().encode(n),t])}async function re(n){let e=p(n.context,"context",32),t=p(n.authorAccount,"authorAccount",32),r=p(n.executor,"executor",32),s=p(n.appVersion??Wt,"appVersion",32),o=tt(n.accountHeads,"accountHeads"),i=tt(n.governanceFloor,"governanceFloor"),a=await C(n.deviceSecret),l=await A(n.deviceSecret),u=new TextEncoder().encode(n.method),h=await Ie(n.method,n.argsJson),m=w(n.nonce),f=w(n.notAfter),b=await k(Kt,[e,t,l,r,s,u,h,w(o.length),...o,w(i.length),...i,m,f]),g=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},a,b));return y(d(e,t,l,r,s,x(u.length),u,h,x(o.length),...o,x(i.length),...i,m,f,g))}function tt(n,e){let t=n??[];if(t.length>et)throw new Error(`${e} cites ${t.length} heads, over the ${et} a node accepts`);return t.map((r,s)=>p(r,`${e}[${s}]`,32))}var Vt=300,se=class extends Error{constructor(t,r,s){super(`relay refused the intent (HTTP ${s}): ${t}`);this.reason=t;this.retryable=r;this.status=s;this.name="IntentRefusedError"}},W=class{constructor(e){this.config=e,this.baseUrl=e.relayUrl.replace(/\/+$/,""),this.executorAccount=e.executorAccount;let t=e.fetch;this.fetchImpl=t?(r,s)=>t(r,s):(r,s)=>globalThis.fetch(r,s),this.timeoutMs=e.timeoutMs??1e4}async describe(e){let t=await this.json("GET",`/admin-api/contexts/${encodeURIComponent(e)}/intents`);return this.executorAccount=t.data.executorAccount,t.data}async execute(e,t,r={}){let s=this.executorAccount??(await this.describe(e)).executorAccount,o=await this.config.nonces.next(),i=this.config.ttlSeconds??Vt,a=await re({context:e,authorAccount:this.config.authorAccount,executor:s,method:t,argsJson:r,nonce:o,notAfter:BigInt(Math.floor(Date.now()/1e3))+BigInt(i),deviceSecret:this.config.deviceSecret}),l=await this.json("POST",`/admin-api/contexts/${encodeURIComponent(e)}/intents`,{method:t,argsJson:r,warrant:a,authorProof:this.config.authorProof});return{rootHash:l.data.rootHash,returns:l.data.returns??null}}async json(e,t,r){let s={Accept:"application/json"};r!==void 0&&(s["Content-Type"]="application/json");let o=new AbortController,i=setTimeout(()=>o.abort(),this.timeoutMs),a;try{a=await this.fetchImpl(`${this.baseUrl}${t}`,{method:e,headers:s,body:r===void 0?void 0:JSON.stringify(r),signal:o.signal})}catch(l){throw new R(0,l instanceof Error?l.name:"NetworkError",`${this.baseUrl}${t}`,new Headers,l instanceof Error?l.message:String(l))}finally{clearTimeout(i)}if(!a.ok){let l=await a.text().catch(()=>"");if(a.status===400||a.status===403){let u=Jt(l);throw new se(u,/nonce/i.test(u),a.status)}throw new R(a.status,a.statusText,`${this.baseUrl}${t}`,a.headers,l)}return await a.json()}};function Jt(n){if(!n)return"no reason given";try{let e=JSON.parse(n);for(let t of[e.error,e.message])if(typeof t=="string"&&t)return t}catch{}return n}function Se(n=1){let e=BigInt(n);if(e<1n)throw new Error("nonce sequence starts at 1");return{next(){let t=e;return e+=1n,Promise.resolve(t)}}}function Pe(n,e){let t=e??globalThis.localStorage;if(!t)throw new Error("no localStorage in this runtime: pass a storage implementation, or use createMemoryNonceSource for a process that owns its whole sequence");return{next(){let r=t.getItem(n),s=0n;if(r!==null&&r!=="")try{let i=BigInt(r);i>0n&&(s=i)}catch{s=0n}let o=s+1n;return t.setItem(n,o.toString()),Promise.resolve(o)}}}async function Ft(n){if(!n.sessionToken&&!n.googleIdToken)throw new Error("connectCloud needs either a sessionToken or a googleIdToken");let e=new _({cloudBaseUrl:n.cloudBaseUrl,sessionToken:n.sessionToken,onSession:n.onSession,fetch:n.fetch,timeoutMs:n.timeoutMs});!n.sessionToken&&n.googleIdToken&&await e.signInWithGoogle(n.googleIdToken);let t=await e.getMyNamespaces(),r=zt(t,n.namespaceId),s=await e.getNamespaceRelays(r.namespaceId),o=s.find(a=>a.authorshipReady&&a.relayUrl!==null&&a.executorAccount!==null)??null;if(!o)throw new Error(Qt(r,s));let i=new W({relayUrl:o.relayUrl,executorAccount:o.executorAccount,authorAccount:n.authorAccount,authorProof:n.authorProof,deviceSecret:n.deviceSecret,nonces:n.nonces??await Xt(n.deviceSecret),ttlSeconds:n.ttlSeconds,fetch:n.fetch,timeoutMs:n.timeoutMs});return{cloud:e,relay:i,namespaceId:r.namespaceId,namespace:r,relayInfo:o,execute:(a,l,u)=>i.execute(a,l,u)}}function zt(n,e){if(e){let t=n.find(r=>r.namespaceId===e);if(!t)throw new Error(`this account owns no namespace ${e}; it owns: ${n.map(r=>r.namespaceId).join(", ")||"(none)"}`);return t}if(n.length===0)throw new Error("this account owns no namespaces in the cloud: claim one first, then enable HA on it so a relay is assigned");if(n.length>1)throw new Error(`this account owns ${n.length} namespaces \u2014 pass namespaceId to say which: ${n.map(t=>t.namespaceId).join(", ")}`);return n[0]}function Qt(n,e){if(e.length===0)return n.haStatus==="enabled"?`namespace ${n.namespaceId} has HA enabled but no relay has been assigned to it yet \u2014 retry shortly`:`namespace ${n.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;let t=e.filter(r=>!r.authorshipReady);return t.length===e.length?`every relay on namespace ${n.namespaceId} is waiting for the authorship grant: an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${t.map(r=>r.executorAccount??r.peerId).join(", ")||"the relay account"} \u2014 with AdminClient.grantAuthorship(namespaceId, account) for these relays, and AdminClient.openToDelegatedExecution(namespaceId) so relays assigned later need no further op`:`namespace ${n.namespaceId} has ${e.length} relay(s), but none reported both a URL and an executor account yet \u2014 retry shortly`}async function Xt(n){let e=`mero-js:warrant-nonce:${y(await A(n))}`;try{return Pe(e)}catch{return Se(1)}}var De=8,Yt=new TextEncoder().encode("calimero.namespace.v1"),Zt=0,nt={GroupCreated:0,GroupReparented:1,GroupDeleted:2,AdminChanged:3,PolicyUpdated:4,MemberJoined:5,KeyDelivery:6,MemberJoinedOpen:7,MemberJoinedAt:8,NamespaceCreated:9,MemberJoinedViaTeeAttestation:10};function Te(n,e){if(n.length!==32)throw new Error(`${e} must be 32 bytes, got ${n.length}`);return new Uint8Array(n)}function rt(n,e){if(n==null)return new Uint8Array([0]);if(n.length!==32)throw new Error(`${e} must be 32 bytes, got ${n.length}`);return d(new Uint8Array([1]),new Uint8Array(n))}function st(n){let e=new TextEncoder().encode(n);return d(x(e.length),e)}function oe(n){let e=n.invitation,t=e.admitters??[],r=n.admitter_addrs??[];return d(Te(e.inviter_identity,"inviter_identity"),Te(e.group_id,"group_id"),w(e.expiration_timestamp),Te(e.secret_salt,"secret_salt"),new Uint8Array([e.invited_role]),x(t.length),...t.map((s,o)=>p(s,`admitters[${o}]`,32)),st(n.inviter_signature),n.inviter_account?d(new Uint8Array([1]),p(n.inviter_account,"inviter_account",32)):new Uint8Array([0]),x(r.length),...r.map(st),rt(n.application_id,"application_id"),rt(n.app_key,"app_key"))}async function ot(n){let e=n.parentOpHashes??[],t=p(n.credential,"credential",n.credential.length/2),r=BigInt(n.invitation.invitation.expiration_timestamp??0)!==0n,s=n.joinedAt??BigInt(Math.floor(Date.now()/1e3)),o=r?d(new Uint8Array([nt.MemberJoinedAt]),p(n.member,"member",32),oe(n.invitation),w(s),t):d(new Uint8Array([nt.MemberJoined]),p(n.member,"member",32),oe(n.invitation),t),i=d(new Uint8Array([Zt]),o),a=await C(n.deviceSecret),l=await A(n.deviceSecret),u=d(new Uint8Array([De]),p(n.namespaceId,"namespaceId",32),x(e.length),...e.map((f,b)=>p(f,`parentOpHashes[${b}]`,32)),l,w(n.nonce),i),h=new Uint8Array(await crypto.subtle.sign("Ed25519",a,d(Yt,u))),m=new Uint8Array([0]);return y(d(u,h,m))}var en=new TextEncoder().encode("calimero.auth.request.v1"),tn=new TextEncoder().encode("calimero.auth.request.body.v1");function it(n){let e=new TextEncoder().encode(n);return d(x(e.length),e)}async function Ee(n=new Uint8Array(0)){let e=typeof n=="string"?new TextEncoder().encode(n):n;return k(tn,[e])}async function ie(n){let e=await C(n.signerSecret),t=await Ee(n.body),r=w(n.issuedAt),s=w(n.expiresAt),o=new TextEncoder,i=await k(en,[o.encode(n.method),o.encode(n.path),t,r,s]),a=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},e,i));return y(d(it(n.method),it(n.path),t,r,s,a))}function ae(n){let e=Y(n.credential,"credential"),t=Y(n.request,"request signature"),r=n.session===void 0?new Uint8Array([0]):d(new Uint8Array([1]),Y(n.session,"session statement"));return y(d(e,r,t))}function nn(n){if(n==null)return new Uint8Array(0);if(typeof n=="string"||n instanceof Uint8Array)return n;if(n instanceof ArrayBuffer)return new Uint8Array(n);if(ArrayBuffer.isView(n))return new Uint8Array(n.buffer,n.byteOffset,n.byteLength);throw new Error(`a request-carried proof cannot commit to a ${n?.constructor?.name??typeof n} body: pass a string or bytes, or use a session for this call`)}function at(n){let e=n.ttlSeconds??120,t=n.now??(()=>Math.floor(Date.now()/1e3));return async r=>{let s=t();return ae({credential:n.credential,session:n.session,request:await ie({method:r.method,path:r.path,body:nn(r.body),issuedAt:s,expiresAt:s+e,signerSecret:n.signerSecret})})}}var rn=new TextEncoder().encode("calimero.auth.login.v1"),ct={webOrigin:0,codeSigningId:1,cli:2};function lt(n){let e=new TextEncoder;switch(n.kind){case"webOrigin":return e.encode(n.origin);case"codeSigningId":return e.encode(n.id);case"cli":return new Uint8Array(0)}}function sn(n){return d(Uint8Array.from([ct[n.kind]]),lt(n))}function on(n){let e=Uint8Array.from([ct[n.kind]]);if(n.kind==="cli")return e;let t=lt(n);return d(e,x(t.length),t)}async function ce(n){let e=p(n.node,"node",32),t=p(n.challenge,"challenge",32),r=p(n.sessionKey,"sessionKey",32),s=await C(n.deviceSecret),o=await A(n.deviceSecret),i=w(n.issuedAt),a=w(n.expiresAt),l=await k(rn,[e,sn(n.audience),t,r,o,i,a]),u=new Uint8Array(await crypto.subtle.sign({name:"Ed25519"},s,l));return y(d(e,on(n.audience),t,r,o,i,a,u))}var an=300;async function Me(){let n=y(crypto.getRandomValues(new Uint8Array(32)));return{publicKey:y(await A(n)),secret:n}}function cn(n){switch(n.kind){case"webOrigin":return n.origin;case"codeSigningId":return n.id;case"cli":return"cli"}}async function ut(n){let e=n.nodeUrl.replace(/\/+$/,""),t=n.fetch??globalThis.fetch,r=n.timeoutMs??1e4,s=async(b,g)=>{let S=new AbortController,T=setTimeout(()=>S.abort(),r),I;try{I=await t(`${e}${b}`,{...g,signal:S.signal})}catch(v){throw new R(0,v instanceof Error?v.name:"NetworkError",`${e}${b}`,new Headers,v instanceof Error?v.message:String(v))}finally{clearTimeout(T)}let q=await I.text().catch(()=>"");if(!I.ok)throw new R(I.status,I.statusText,`${e}${b}`,I.headers,q);return q?JSON.parse(q):{}},o=await s("/auth/challenge",{method:"GET",headers:{Accept:"application/json"}}),i=o.challenge??o.data?.challenge;if(!i)throw new Error("the node issued no challenge");let a=await Me(),l=Math.floor(Date.now()/1e3),u=await ce({node:n.node,audience:n.audience,challenge:i,sessionKey:a.publicKey,issuedAt:l,expiresAt:l+(n.ttlSeconds??an),deviceSecret:n.deviceSecret}),h=await s("/auth/token",{method:"POST",headers:{"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({auth_method:"account_proof",public_key:a.publicKey,client_name:n.clientName??cn(n.audience),timestamp:l,provider_data:{challenge:i,login_statement:u,account_proof:n.accountProof}})}),m=h.access_token??h.data?.access_token,f=h.refresh_token??h.data?.refresh_token;if(!m)throw new Error("the node minted no session");return{accessToken:m,refreshToken:f??"",sessionKey:a.publicKey,sessionSecret:a.secret}}var pt=[2428,2429,2528,2529],ln="localhost",un=2e3;function dt(n){return`http://${ln}:${n}`}function gt(n,e){let t=n.endsWith("/")?n:`${n}/`;return new URL(e,t).toString()}async function mt(n,e={}){let{timeoutMs:t=un,signal:r}=e;if(r?.aborted)return!1;let s=new AbortController,o=()=>s.abort(),i=r;i&&i.addEventListener("abort",o,{once:!0});let a=setTimeout(()=>s.abort(),t);try{let l=gt(n,"admin-api/health"),u=await fetch(l,{method:"GET",signal:s.signal});if(!u.ok)return!1;try{let h=await u.json(),m=h?.data?.status!==void 0?h?.data?.status:h?.status;return m===void 0?!0:typeof m=="string"&&m.toLowerCase()==="alive"}catch{return!0}}catch{return!1}finally{clearTimeout(a),i&&i.removeEventListener("abort",o)}}async function pn(n={}){let{ports:e=pt,timeoutMs:t,signal:r}=n;return(await Promise.all(e.map(async o=>{let i=dt(o);return await mt(i,{timeoutMs:t,signal:r})?i:null}))).filter(o=>o!==null)}export{E as AdminApiClient,D as AuthApiClient,P as AuthRevokedError,$ as CAPABILITIES,_ as CloudClient,pt as DEFAULT_LOCAL_NODE_PORTS,j as EphemeralClient,R as HTTPError,se as IntentRefusedError,ke as LocalStorageTokenStore,ve as MemoryTokenStore,ne as MeroJs,W as RelayClient,O as RpcClient,z as RpcError,De as SIGNED_NAMESPACE_OP_SCHEMA_VERSION,N as SseClient,L as WebHttpClient,G as WsClient,Z as accountForRoot,Fe as accountRootFromPhrase,M as accountRootFromSecret,ye as buildAuthLoginUrl,ae as callerProof,ue as combineSignals,Ct as compareSemver,Ft as connectCloud,Wn as createAdminApiClient,Le as createAdminApiClientFromHttpClient,Dn as createAuthApiClient,Ne as createAuthApiClientFromHttpClient,Kn as createBrowserAdminApiClient,Pn as createBrowserAuthApiClient,U as createBrowserHttpClient,de as createHttpClient,Pe as createLocalStorageNonceSource,Se as createMemoryNonceSource,Ot as createMeroJs,Bn as createNodeAdminApiClient,Tn as createNodeAuthApiClient,J as createNodeHttpClient,at as createProofSigner,wt as createRetryableMethod,pe as createTimeoutSignal,ge as createUniversalHttpClient,xe as deviceCertPayload,pn as discoverLocalNodes,oe as encodeSignedInvitation,Je as generateAccountRoot,Me as generateSessionKey,me as hasCap,Ln as hexEncodeUtf8,Ie as intentHash,X as jsonCodec,dt as localNodeUrl,ut as login,Ke as mintDeviceId,gt as nodeEndpoint,fe as parseAuthCallback,mt as probeNodeHealth,Ee as requestBodyHash,te as routingProofHeaders,B as signAccountLink,ee as signAccountLogin,We as signDeviceCert,ce as signLoginStatement,ot as signMemberJoinOp,ie as signRequest,Ze as signRoutingChallenge,re as signWarrant,he as withCap,F as withRetry,Mn as withoutCap};
 //# sourceMappingURL=index.browser.mjs.map