@calimero-network/mero-js 28.0.0 → 28.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/dist/cloud-v2/approvals.d.ts +4 -0
  2. package/dist/cloud-v2/client.d.ts +245 -3
  3. package/dist/cloud-v2/client.js +163 -6
  4. package/dist/cloud-v2/index.d.ts +2 -2
  5. package/dist/cloud-v2/index.js +1 -1
  6. package/dist/index.browser.mjs +4 -4
  7. package/dist/index.browser.mjs.map +3 -3
  8. package/dist/index.cjs +148 -6
  9. package/dist/index.cjs.map +2 -2
  10. package/dist/index.mjs +148 -6
  11. package/dist/index.mjs.map +2 -2
  12. package/package.json +3 -2
package/dist/index.browser.mjs CHANGED
@@ -1,9 +1,9 @@
1
- function R(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function fe(r,e,t){let n=r.trim();if(!/^[0-9a-fA-F]*$/.test(n)||n.length!==t*2)throw new Error(`${e} must be ${t*2} hex characters, got ${n.length}`);let i=new Uint8Array(t);for(let s=0;s<t;s+=1)i[s]=Number.parseInt(n.slice(s*2,s*2+2),16);return i}function y(...r){let e=new Uint8Array(r.reduce((n,i)=>n+i.length,0)),t=0;for(let n of r)e.set(n,t),t+=n.length;return e}var br="Noise_NK_25519_AESGCM_SHA256",$e=32,Er=16,Rr=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,110,4,34,4,32]),Ke=class r{constructor(e){this.k=null;this.n=0;this.ck=e,this.h=e}static async initialize(){let e=new TextEncoder().encode(br),t=new Uint8Array(32);return t.set(e),new r(t)}async mixHash(e){this.h=await Pr(y(this.h,e))}async mixKey(e){let[t,n]=await ft(this.ck,e);this.ck=t,this.k=await crypto.subtle.importKey("raw",n,"AES-GCM",!1,["encrypt","decrypt"]),this.n=0}async encryptAndHash(e){if(!this.k)throw new Error("Noise: no cipher key yet");let t=new Uint8Array(await crypto.subtle.encrypt({name:"AES-GCM",iv:pt(this.n),additionalData:this.h},this.k,e));return this.n+=1,await this.mixHash(t),t}async decryptAndHash(e){if(!this.k)throw new Error("Noise: no cipher key yet");let t=new Uint8Array(await crypto.subtle.decrypt({name:"AES-GCM",iv:pt(this.n),additionalData:this.h},this.k,e));return this.n+=1,await this.mixHash(e),t}split(){return ft(this.ck,new Uint8Array)}};async function yt(r,e,t){let n=await Ke.initialize();await n.mixHash(e),await n.mixHash(r);let i=await G(t);return await n.mixHash(i.publicKey),await n.mixKey(await X(i.privateKey,r)),{message1:y(i.publicKey,await n.encryptAndHash(new Uint8Array)),async finish(o){if(o.length<$e+Er)throw new Error("Noise: message 2 is too short");let a=o.slice(0,$e);return await n.mixHash(a),await n.mixKey(await X(i.privateKey,a)),{payload:await n.decryptAndHash(o.slice($e)),split:await n.split()}}}}async function G(r){if(!r){let n;try{n=await crypto.subtle.generateKey({name:"X25519"},!0,["deriveBits"])}catch(s){throw new Error(`Sealed transport needs WebCrypto with X25519, which this runtime lacks (${s?.name??"no crypto.subtle"}). Current browsers and Node have it; in React Native, install react-native-quick-crypto as the global crypto.`)}let i=new Uint8Array(await crypto.subtle.exportKey("raw",n.publicKey));return{privateKey:n.privateKey,publicKey:i}}let e=await crypto.subtle.importKey("pkcs8",y(Rr,r),{name:"X25519"},!0,["deriveBits"]),t=await crypto.subtle.exportKey("jwk",e);return{privateKey:e,publicKey:Ur(t.x)}}async function X(r,e){let t=await crypto.subtle.importKey("raw",e,{name:"X25519"},!1,[]);return new Uint8Array(await crypto.subtle.deriveBits({name:"X25519",public:t},r,256))}function pt(r){let e=new Uint8Array(12);return new DataView(e.buffer).setBigUint64(4,BigInt(r),!1),e}async function Pr(r){return new Uint8Array(await crypto.subtle.digest("SHA-256",r))}async function Be(r,e){let t=await crypto.subtle.importKey("raw",r,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",t,e))}async function ft(r,e){let t=await Be(r,e),n=await Be(t,new Uint8Array([1])),i=await Be(t,y(n,new Uint8Array([2])));return[n,i]}function Ur(r){let e=r.replace(/-/g,"+").replace(/_/g,"/"),t=atob(e+"=".repeat((4-e.length%4)%4));return Uint8Array.from(t,n=>n.charCodeAt(0))}var At="/sealed/v2/handshake",bt="/sealed/v2",te="application/vnd.calimero.sealed",Ve=2,xr=new TextEncoder().encode("calimero/sealed-http/v2"),ee=16,Tr=1+ee+8,Sr=0,Cr=1,vr=2,kr=1+64*1024+16,Ir=1024,Or=6e4,Dr="calimero.tee-attest.transport-key.v1",Nr=[101,204,205,304],Et=new TextEncoder,re=class extends Error{constructor(){super("The node no longer holds the attested transport key; attest again for the current one");this.name="StaleTransportKeyError"}},C=class extends Error{constructor(t,n,i,s){super(i);this.status=t;this.code=n;this.retryAfterMs=s;this.name="SealedTransportError"}};async function Le(r,e){let t=await crypto.subtle.digest("SHA-256",y(Et.encode(Dr),r,e));return new Uint8Array(t)}function He(r){let e=new URL(r.baseUrl),t=e.pathname.replace(/\/+$/,""),n=`${e.origin}${t}`,i=r.fetch??((g,p)=>fetch(g,p)),s=typeof r.transportPublicKey=="function"?r.transportPublicKey:void 0,o=s?Promise.resolve().then(s):Promise.resolve(r.transportPublicKey);o.catch(()=>{});let a,c=async()=>{try{return await mt(i,n,await ht(o))}catch(g){if(!(g instanceof re)||!s)throw g;return o=Promise.resolve().then(s),mt(i,n,await ht(o))}},l=async()=>{let g=a??u(void 0),p=await g;if(Date.now()<p.renewAt)return[p,g];let h=u(g);return[await h,h]},u=g=>{if(a===g){let p=c();a=p,p.catch(()=>{a===p&&(a=void 0)})}return a};return async(g,p)=>{let h=new Request(g,p),f=new URL(h.url);if(f.origin!==e.origin||!f.pathname.startsWith(`${t}/`))throw new Error(`Refusing to send ${f.href} outside the sealed node at ${r.baseUrl}`);let b=[];h.headers.forEach((P,L)=>b.push([L,P]));let N={method:h.method,path:f.pathname.slice(t.length)+f.search,headers:b},E=new Uint8Array(await h.arrayBuffer()),x=p?.signal??(g instanceof Request?g.signal:void 0),M=async P=>{let{requestId:L,header:W,envelope:pe}=await _r(P,N,E),H=await i(`${n}${bt}`,{method:"POST",headers:{"content-type":te},body:pe,signal:x});if(H.headers.get("content-type")!==te)throw await Pt(H);return Br(H,P.responseKey,W,L)},[De,Ne]=await l();try{return await M(De)}catch(P){if(!(P instanceof C)||P.code!=="unknown_session")throw P;return M(await u(Ne))}}}async function ht(r){let e=await r;if(e.length!==32)throw new Error("transportPublicKey must be 32 bytes");return e}async function mt(r,e,t){try{return await wt(r,e,t)}catch(n){if(!(n instanceof C)||n.code!=="busy")throw n;return await new Promise(i=>setTimeout(i,n.retryAfterMs??1e3)),wt(r,e,t)}}async function wt(r,e,t){let n=await yt(t,xr),i=await r(`${e}${At}`,{method:"POST",headers:{"content-type":te},body:y(new Uint8Array([Ve]),t,n.message1)});if(i.headers.get("content-type")!==te)throw await Pt(i);let s=await Vr(i,Ir);return Mr(n,s)}async function Mr(r,e){if(e[0]!==Ve)throw new Error("The handshake reply is malformed");let t;try{t=await r.finish(e.slice(1))}catch{throw new Error("The handshake reply did not open: it did not come from the attested node")}let{payload:n,split:i}=t;if(n.length!==ee+4)throw new Error("The handshake reply is malformed");let s=n.slice(0,ee),o=new DataView(n.buffer,n.byteOffset).getUint32(ee,!1),[a,c]=await Promise.all([crypto.subtle.importKey("raw",i[0],"AES-GCM",!1,["encrypt"]),crypto.subtle.importKey("raw",i[1],"AES-GCM",!1,["decrypt"])]);return i[0].fill(0),i[1].fill(0),{requestKey:a,responseKey:c,nextRequestId:1,renewAt:Date.now()+o*1e3-Or,header(l){let u=new Uint8Array(Tr);return u[0]=Ve,u.set(s,1),new DataView(u.buffer).setBigUint64(1+ee,BigInt(l),!1),u}}}async function _r(r,e,t){let n=r.nextRequestId;r.nextRequestId+=1;let i=r.header(n),s=await crypto.subtle.encrypt({name:"AES-GCM",iv:Rt(n,0),additionalData:i},r.requestKey,$r(e,t));return{requestId:n,header:i,envelope:y(i,new Uint8Array(s))}}function Rt(r,e){let t=new Uint8Array(12),n=new DataView(t.buffer);return n.setBigUint64(0,BigInt(r),!1),n.setUint32(8,e,!1),t}function $r(r,e){let t=Et.encode(JSON.stringify(r)),n=new Uint8Array(4);return new DataView(n.buffer).setUint32(0,t.length,!1),y(n,t,e)}async function Br(r,e,t,n){if(!r.body)throw new Error("The sealed response has no body");let i=Kr(r.body.getReader()),s=0,o=async()=>{let u=await i.next();if(!u)return null;let g;try{g=new Uint8Array(await crypto.subtle.decrypt({name:"AES-GCM",iv:Rt(n,s),additionalData:t},e,u))}catch{throw new Error("A sealed response frame did not open: it was not sealed by the attested node")}return s+=1,{kind:g[0],data:g.slice(1)}},a=await o();if(!a||a.kind!==Sr)throw new Error("The sealed response is malformed");let c=JSON.parse(new TextDecoder().decode(a.data));if(Nr.includes(c.status))return await i.cancel(),new Response(null,{status:c.status,headers:c.headers});let l=new ReadableStream({async pull(u){try{let g=await o();g?g.kind===Cr?u.enqueue(g.data):g.kind===vr?(u.close(),await i.cancel()):u.error(new Error("The sealed response is malformed")):u.error(new Error("The sealed response was cut short"))}catch(g){u.error(g)}},cancel(){return i.cancel()}});return new Response(l,{status:c.status,headers:c.headers})}function Kr(r){let e=new Uint8Array,t=async n=>{for(;e.length<n;){let{done:i,value:s}=await r.read();if(i)return!1;e=y(e,s)}return!0};return{async next(){if(!await t(4))return null;let n=new DataView(e.buffer,e.byteOffset).getUint32(0,!1);if(n>kr)throw await r.cancel(),new Error("The sealed response is malformed: a frame is larger than the node sends");if(!await t(4+n))return null;let i=e.slice(4,4+n);return e=e.slice(4+n),i},cancel:()=>r.cancel()}}async function Vr(r,e){if(!r.body)return new Uint8Array;let t=r.body.getReader(),n=new Uint8Array;for(;;){let{done:i,value:s}=await t.read();if(i)return n;if(n=y(n,s),n.length>e)throw await t.cancel(),new Error("The handshake reply is malformed: it is too long")}}async function Pt(r){let e,t=`Sealed request refused: HTTP ${r.status}`;try{let s=await r.json();e=s?.error?.code,s?.error?.message&&(t=`Sealed request refused: ${s.error.message}`)}catch{}if(e==="stale_transport_key")return new re;let n=Number(r.headers.get("retry-after")),i=Number.isFinite(n)&&n>0?Math.min(n,5)*1e3:void 0;return new C(r.status,e,t,i)}var Ut=[{uri:"https://fulcio.sigstore.dev",validFor:{start:"2021-03-07T03:20:29Z",end:"2022-12-31T23:59:59.999Z"},certChain:["MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="]},{uri:"https://fulcio.sigstore.dev",validFor:{start:"2022-04-13T20:06:15Z"},certChain:["MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow=","MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"]}],xt=[{baseUrl:"https://rekor.sigstore.dev",logId:"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",publicKey:"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",validFor:{start:"2021-01-12T11:53:27Z"}}];var Lr="1.2.840.10045.2.1",Hr={"1.2.840.10045.3.1.7":"P-256","1.3.132.0.34":"P-384"},Fr={"P-256":32,"P-384":48},Gr={"1.2.840.10045.4.3.2":"SHA-256","1.2.840.10045.4.3.3":"SHA-384"};function Tt(r,e,t){if(e+2>t)throw new Error("it is truncated");let n=r[e];if((n&31)===31)throw new Error("it uses a tag this parser does not read");let i=r[e+1],s=e+2;if(i&128){let a=i&127;if(a===0||a>4||s+a>t)throw new Error("it has a length this parser does not read");i=0;for(let c=0;c<a;c+=1)i=i*256+r[s+c];s+=a}let o=s+i;if(o>t)throw new Error("it is truncated");return{tag:n,bytes:r,offset:e,start:s,end:o}}function q(r){let e=Tt(r,0,r.length);if(e.end!==r.length)throw new Error("it has trailing bytes");return e}function A(r){let e=[];for(let t=r.start;t<r.end;){let n=Tt(r.bytes,t,r.end);e.push(n),t=n.end}return e}function m(r,e,t){if(!r||r.tag!==e)throw new Error(`${t} is not where it should be`);return r}function v(r){return r.bytes.slice(r.start,r.end)}function ye(r){return r.bytes.slice(r.offset,r.end)}function j(r){let e=v(m(r,6,"An object identifier"));if(e.length===0||e[e.length-1]&128)throw new Error("it has a malformed object identifier");let t=[],n=0;for(let o of e)n=n*128+(o&127),o&128||(t.push(n),n=0);let i=t.shift();return[...i<80?[Math.floor(i/40),i%40]:[2,i-80],...t].join(".")}function jr(r){let e=new TextDecoder().decode(v(r)),t=r.tag===23?/^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(e):null,n=r.tag===24?/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(e):null,i=t??n;if(!i)throw new Error(`it holds the time ${JSON.stringify(e)}, which is not one a certificate may hold`);let s=Number(i[1]);t&&(s+=s<50?2e3:1900);let[o,a,c,l,u]=i.slice(2).map(Number);return Date.UTC(s,o-1,a,c,l,u)}function Fe(r){try{let[e,t,n,...i]=A(m(q(r),48,"The certificate"));if(i.length>0)throw new Error("it has fields after its signature");let s=A(m(e,48,"The signed part")),o=s[0]?.tag===160?1:0,[a,c,l,u,g,p,...h]=s.slice(o);m(a,2,"The serial number");let f=j(A(m(t,48,"The signature algorithm"))[0]);if(j(A(m(c,48,"The signature algorithm"))[0])!==f)throw new Error("it names two different signature algorithms");let N=Gr[f];if(!N)throw new Error(`it is signed with ${f}, not ECDSA with SHA-256 or SHA-384`);let[E,x]=A(m(u,48,"The validity")).map(jr);if(x===void 0)throw new Error("its validity is incomplete");let[M,De]=A(m(p,48,"The public key"));m(De,3,"The public key");let[Ne,P]=A(m(M,48,"The key algorithm"));if(j(Ne)!==Lr)throw new Error("its key is not an elliptic-curve key");let L=Hr[j(P)];if(!L)throw new Error("its key is on a curve other than P-256 or P-384");let W=new Map,pe=h.find(Me=>Me.tag===163);if(pe){let[Me]=A(pe);for(let Ar of A(m(Me,48,"The extensions"))){let F=A(m(Ar,48,"An extension"));if(F.length===3)m(F[1],1,"An extension's critical flag");else if(F.length!==2)throw new Error("it has a malformed extension");let _e=j(F[0]);if(W.has(_e))throw new Error(`it has extension ${_e} twice`);W.set(_e,v(m(F[F.length-1],4,"An extension value")))}}let H=v(m(n,3,"The signature"));if(H[0]!==0)throw new Error("its signature is not a whole number of bytes");return{der:r,tbs:ye(e),signatureHash:N,signature:H.slice(1),issuer:ye(m(l,48,"The issuer")),subject:ye(m(g,48,"The subject")),notBefore:E,notAfter:x,spki:ye(p),curve:L,extensions:W}}catch(e){throw new Error(`The certificate is malformed: ${e.message}`)}}function St(r){return A(m(q(r),48,"The list")).map(j)}function qr(r,e){let t=Fr[e],n=A(m(q(r),48,"The signature"));if(n.length!==2)throw new Error("The signature is not an ECDSA signature");let i=new Uint8Array(t*2);return n.forEach((s,o)=>{let a=v(m(s,2,"The signature"));if(a.length===0||a[0]&128)throw new Error("The signature is not an ECDSA signature");for(;a.length>1&&a[0]===0;)a=a.subarray(1);if(a.length>t)throw new Error("The signature is not an ECDSA signature");i.set(a,o*t+t-a.length)}),i}async function he(r,e,t,n,i){let s;try{s=qr(n,e)}catch{return!1}let o=await crypto.subtle.importKey("spki",r,{name:"ECDSA",namedCurve:e},!1,["verify"]);return crypto.subtle.verify({name:"ECDSA",hash:t},o,s,i)}function U(r,e){let t=r.replace(/\s+/g,"");if(!/^[A-Za-z0-9+/]*={0,2}$/.test(t)||t.length%4!==0)throw new Error(`${e} is not base64`);let n=atob(t),i=new Uint8Array(n.length);for(let s=0;s<n.length;s+=1)i[s]=n.charCodeAt(s);return i}function Ge(r,e){let t=[...r.matchAll(/-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g)];if(t.length!==1||r.replace(t[0][0],"").trim()!=="")throw new Error(`${e} is not exactly one PEM certificate`);return U(t[0][1],e)}var Qr="2.5.29.17",Jr="2.5.29.37",zr="1.3.6.1.5.5.7.3.3",Yr="1.3.6.1.4.1.57264.1.8",Zr="1.3.6.1.4.1.57264.1.1",Wr=134,Xr=12,en=48,tn=new TextEncoder,Q=r=>new TextDecoder().decode(r);async function me(r,e,t,n){let{base64Signature:i,cert:s,rekorBundle:o}=on(e),a=o.Payload;if(n!==void 0&&n.trim()!==i.trim())throw new Error("The detached signature is not the one in the bundle");let c=U(i,"The bundle signature"),l=Ge(Q(U(s,"The bundle certificate")),"The bundle certificate"),u=Fe(l),g=xt.find(x=>x.logId===a.logID.toLowerCase());if(!g)throw new Error(`The bundle names Rekor log ${a.logID}, which the Sigstore trust root does not know`);let p=tn.encode(`{"body":${JSON.stringify(a.body)},"integratedTime":${a.integratedTime},"logID":${JSON.stringify(a.logID)},"logIndex":${a.logIndex}}`);if(!await he(U(g.publicKey,"The Rekor key"),"P-256","SHA-256",U(o.SignedEntryTimestamp,"The signed entry timestamp"),p))throw new Error("Rekor's signed entry timestamp does not verify: the log entry, its time or its index was altered");let f=a.integratedTime*1e3;if(!kt(f,g.validFor))throw new Error(`Rekor log ${g.baseUrl} was not in use at ${ne(f)}, when the entry says it was logged`);let b=an(a.body),N=R(new Uint8Array(await crypto.subtle.digest("SHA-256",r)));if(b.hash!==N)throw new Error("The file's SHA-256 is not the one Rekor logged: the file is not the one signed");if(!je(U(b.signature,"The logged signature"),c))throw new Error("The bundle's signature is not the one Rekor logged");let E=Ge(Q(U(b.publicKey,"The logged certificate")),"The logged certificate");if(!je(E,l))throw new Error("The bundle's certificate is not the one Rekor logged");if(u.curve!=="P-256"||!await he(u.spki,"P-256","SHA-256",c,r))throw new Error("The signature over the file does not verify with the bundle's certificate");return await rn(u,f),sn(u,t),{integratedTime:a.integratedTime}}async function rn(r,e){if(!vt(r,e))throw new Error(`The signing certificate was valid ${ne(r.notBefore)} to ${ne(r.notAfter)}, not at ${ne(e)} when Rekor logged it`);let t=[];for(let n of Ut){let i=n.certChain.map(o=>Fe(U(o,"A Fulcio certificate")));if(!await Ct(r,i[0]))continue;let s=await nn(i,n.validFor,e);if(!s)return;t.push(`${n.uri} (valid from ${n.validFor.start}): ${s}`)}throw new Error(t.length>0?`The signing certificate's CA is not trusted at ${ne(e)}: ${t.join("; ")}`:"The signing certificate was not issued by a Fulcio CA in the Sigstore trust root")}async function nn(r,e,t){if(!kt(t,e))return"the trust root says it was not issuing certificates then";for(let[n,i]of r.entries()){if(!vt(i,t))return`its certificate ${n} was not valid then`;let s=r[n+1]??i;if(!await Ct(i,s))return`its certificate ${n} is not signed by the next`}}async function Ct(r,e){return je(r.issuer,e.subject)?he(e.spki,e.curve,r.signatureHash,r.signature,r.tbs):!1}function sn(r,e){let t=r.extensions.get(Qr);if(!t)throw new Error("The signing certificate names no identity");let n=A(m(q(t),en,"The subject alternative name")),i=n.filter(l=>l.tag===Wr).map(l=>Q(v(l)));if(i.length!==1||n.length!==1||i[0]!==e.identity)throw new Error(`The release was signed by ${JSON.stringify(i.length===1?i[0]:i)}, not by ${e.identity}`);let s=r.extensions.get(Yr),o=r.extensions.get(Zr),a=s?Q(v(m(q(s),Xr,"The OIDC issuer"))):o?Q(o):void 0;if(a!==e.issuer)throw new Error(`The signing certificate's OIDC issuer is ${a===void 0?"missing":JSON.stringify(a)}, not ${e.issuer}`);let c=r.extensions.get(Jr);if(!c||!St(c).includes(zr))throw new Error("The signing certificate is not for code signing")}function on(r){let e=r;if(typeof e=="string")try{e=JSON.parse(e)}catch{throw new Error("The bundle is not JSON")}let t=e,n=t?.rekorBundle?.Payload;if(!(typeof t?.base64Signature=="string"&&typeof t.cert=="string"&&typeof t.rekorBundle?.SignedEntryTimestamp=="string"&&typeof n?.body=="string"&&typeof n.logID=="string"&&/^[0-9a-fA-F]{64}$/.test(n.logID)&&Number.isSafeInteger(n.integratedTime)&&n.integratedTime>=0&&Number.isSafeInteger(n.logIndex)&&n.logIndex>=0))throw new Error("The bundle is not a cosign bundle with a Rekor entry");return t}function an(r){let e;try{e=JSON.parse(Q(U(r,"The logged entry")))}catch{throw new Error("The logged entry is not JSON")}let t=e?.spec?.data?.hash,n=e?.spec?.signature;if(e?.kind!=="hashedrekord"||t?.algorithm!=="sha256"||typeof t.value!="string"||typeof n?.content!="string"||typeof n.publicKey?.content!="string")throw new Error("The logged entry is not a SHA-256 hashedrekord");return{hash:t.value.toLowerCase(),signature:n.content,publicKey:n.publicKey.content}}function vt(r,e){return r.notBefore<=e&&e<=r.notAfter}function kt(r,e){return Date.parse(e.start)<=r&&(e.end===void 0||r<=Date.parse(e.end))}function ne(r){return new Date(r).toISOString()}function je(r,e){return r.length===e.length&&r.every((t,n)=>t===e[n])}var cn=/^[0-9a-f]{96}$/,ln=["mrtd","rtmr0","rtmr1","rtmr2","rtmr3"];function $(r){let e=J(r.allowedMrtd??[],"allowedMrtd"),t=(r.allowedMeasurements??[]).map((a,c)=>{let l=`allowedMeasurements[${c}]`;return ln.map(u=>J([a?.[u]??""],`${l}.${u}`)[0]).join()}),n=[J(r.allowedRtmr0??[],"allowedRtmr0"),J(r.allowedRtmr1??[],"allowedRtmr1"),J(r.allowedRtmr2??[],"allowedRtmr2"),J(r.allowedRtmr3??[],"allowedRtmr3")];if(r.allowedMeasurements!==void 0&&t.length===0)throw new Error("allowedMeasurements is empty, so no quote would ever be accepted");if(t.length===0){if(e.length===0)throw new Error("No image is trusted: give allowedMeasurements, or allowedMrtd with allowedRtmr1-3");if(n.slice(1).some(a=>a.length===0))throw new Error("allowedMrtd alone does not name an image: the MRTD measures the TD firmware, which images share, and the image is in RTMR1-3. Give allowedMeasurements, or allowedRtmr1-3 too")}let i=r.allowedTcbStatuses??["UpToDate"],s=r.now??Date.now;return Object.assign(async({quoteB64:a,nonce:c,reportDataSuffix:l,collateral:u})=>{let g=dn(a),p=u??await r.fetchCollateral?.(g);if(!p)throw new Error("The node sent no collateral for its quote, and no fetchCollateral was given to get it");let h;try{h=r.dcapVerify(g,p,Math.floor(s()/1e3))}catch(E){throw new Error(`The quote did not verify: ${E?.message??String(E)}`)}if(h.status==="Revoked"||!i.includes(h.status))throw new Error(`The platform's TCB status is ${h.status}, which is not accepted`);let f=un(h.report);if(f.tdAttributes?.length!==8||(f.tdAttributes[0]&1)!==0)throw new Error("The quote is from a debug TD, or its TD attributes cannot be read");let b=[f.mrTd,f.rtMr0,f.rtMr1,f.rtMr2,f.rtMr3].map(E=>R(E));if(t.length>0&&!t.includes(b.join()))throw new Error(`The measurements (MRTD ${b[0]}, RTMR0-3 ${b.slice(1).join(", ")}) are not an image this verifier trusts`);if(e.length>0&&!e.includes(b[0]))throw new Error(`MRTD ${b[0]} is not an image this verifier trusts`);if([f.rtMr0,f.rtMr1,f.rtMr2,f.rtMr3].forEach((E,x)=>{let M=n[x];if(M.length>0&&!M.includes(R(E)))throw new Error(`RTMR${x} ${R(E)} is not one this verifier trusts`)}),R(f.reportData)!==`${c}${l}`.toLowerCase())throw new Error("The quote does not commit to this nonce and binding");return!0},{includeCollateral:!0})}function J(r,e){return r.map(t=>{let n=t.trim().toLowerCase();if(!cn.test(n))throw new Error(`${e} holds ${JSON.stringify(t)}, which is not a 48-byte hex measurement`);return n})}function un(r){let e=r.data;if(r.type==="td10"&&e)return e;if(r.type==="td15"&&e?.base)return e.base;throw new Error(`The quote is a ${r.type} quote, not a TDX one`)}function dn(r){let e=atob(r),t=new Uint8Array(e.length);for(let n=0;n<e.length;n+=1)t[n]=e.charCodeAt(n);return t}var gn=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"],_="locked-read-only";function qe(r,{profile:e,allowDebugProfile:t=!1}){if(r.length===0)throw new Error("No release given, so no image would be trusted");let n,i=r.map((s,o)=>{let a=s?.tag??`releases[${o}]`;if(s?.role!==void 0&&s.role!=="node")throw new Error(`${a} lists the measurements of a ${s.role}, not of a node image`);let c=s?.profiles?.[e];if(!c){let u=Object.keys(s?.profiles??{}).join(", ")||"none";throw new Error(`${a} has no profile ${JSON.stringify(e)} (it has: ${u})`)}if(e!==_&&!t)throw new Error(`${JSON.stringify(e)} is not a production profile: its image is readable by whoever operates the node. Trust ${JSON.stringify(_)}, or pass allowDebugProfile to test`);let l=(c.allowed_tcb_statuses??["uptodate"]).map(u=>pn(u,a));return n=n===void 0?l:n.filter(u=>l.includes(u)),{mrtd:c.mrtd,rtmr0:c.rtmr0,rtmr1:c.rtmr1,rtmr2:c.rtmr2,rtmr3:c.rtmr3}});if(!n||n.length===0)throw new Error("The releases given accept no TCB status in common");return{allowedMeasurements:i,allowedTcbStatuses:n}}function pn(r,e){let t=gn.find(n=>n.toLowerCase()===String(r).toLowerCase());if(!t)throw new Error(`${e} accepts TCB status ${JSON.stringify(r)}, which this verifier does not know`);return t}var Qe=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-node-image-gcp.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),fn=["mrtd","rtmr0","rtmr1","rtmr2","rtmr3"],we="https://cloud.calimero.network",Je=`${we}/api/tee/pcs`;async function Ot(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??Qe.identity,issuer:t.issuer??Qe.issuer},t.signature);let i;try{i=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed release is not JSON")}if(i?.role!=="node")throw new Error(`The signed release is a ${JSON.stringify(i?.role)} release, not a node one`);let s=Object.values(i.profiles??{}),o=a=>fn.every(c=>/^[0-9a-f]{96}$/i.test(String(a?.[c])));if(typeof i.tag!="string"||s.length===0||!s.every(o))throw new Error("The signed file is not a release's published-mrtds.json: it lists no measured profiles");if(t.expectedVersion!==void 0&&i.tag!==t.expectedVersion)throw new Error(`The signed release is ${i.tag}, not ${t.expectedVersion}`);return i}async function ze(r,e={}){let t=await(e.fetch??fetch)(r,{headers:{accept:"application/json"}});if(!t.ok)throw new Error(`Fetching the node release from ${r} failed: HTTP ${t.status}`);let n;try{n=(await t.json())?.data}catch{throw new Error(`${r} did not answer with JSON`)}if(typeof n?.version!="string"||typeof n.publishedMrtds!="string"||typeof n.bundle!="string")throw new Error(`${r} did not answer with a signed node release`);return{version:n.version,publishedMrtds:n.publishedMrtds,bundle:n.bundle}}var Dt="https://github.com/calimero-network/mero-tee/releases/download";async function Ye(r,e={}){let t=`mero-tee-v${k(r,"version")}`,n=`${(e.base??Dt).replace(/\/+$/,"")}/${t}/published-mrtds.json`,i=async a=>{let c=await(e.fetch??fetch)(a);if(!c.ok)throw new Error(`Fetching ${a} failed: HTTP ${c.status}`);return c.text()},[s,o]=await Promise.all([i(n),i(`${n}.bundle.json`)]);return{version:r,publishedMrtds:s,bundle:o}}function Ze(r,e){return`${r.replace(/\/+$/,"")}/api/tee/node-releases/${k(e,"version")}`}async function Ae(r){let e=k(r.minReleaseVersion,"minReleaseVersion"),t=k(r.release?.version,"The release version"),n=await Ot(r.release.publishedMrtds,r.release.bundle,{expectedVersion:t,identity:r.identity,issuer:r.issuer});if(ie(t,e)<0)throw new Error(`Release ${t} is older than the minimum trusted, ${e}`);return qe([n],{profile:r.profile,allowDebugProfile:r.allowDebugProfile})}function yn(r){return k(r.minReleaseVersion,"minReleaseVersion"),Object.assign(async t=>{let n=await Ae({release:await r.release(),profile:r.profile,allowDebugProfile:r.allowDebugProfile,minReleaseVersion:r.minReleaseVersion,identity:r.identity,issuer:r.issuer});return $({dcapVerify:r.dcapVerify,fetchCollateral:r.fetchCollateral,now:r.now,...n})(t)},{includeCollateral:!0})}var Nt=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;function k(r,e){let t=typeof r=="string"?Nt.exec(r):null,n=t?.[4];if(!t||n!==void 0&&n.split(".").some(i=>i===""))throw new Error(`${e} is ${JSON.stringify(r)}, not a release version like 2.3.87`);return r}function ie(r,e){let[t,n]=It(r),[i,s]=It(e);for(let c=0;c<3;c+=1)if(t[c]!==i[c])return t[c]<i[c]?-1:1;if(n===void 0||s===void 0)return n===s?0:n===void 0?1:-1;let o=n.split("."),a=s.split(".");for(let c=0;c<Math.max(o.length,a.length);c+=1){let[l,u]=[o[c],a[c]];if(l===void 0||u===void 0)return l===void 0?-1:1;let[g,p]=[/^\d+$/.test(l),/^\d+$/.test(u)],h=g&&p?Math.sign(Number(l)-Number(u)):g!==p?g?-1:1:l<u?-1:l>u?1:0;if(h!==0)return h}return 0}function It(r){let e=Nt.exec(r);return[[Number(e[1]),Number(e[2]),Number(e[3])],e[4]]}var _t="MOCK_TDX_QUOTE_V1";function hn(r){let e=atob(r),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);return t}function We(r,e){if(r.length!==e.length)return!1;let t=0;for(let n=0;n<r.length;n++)t|=r[n]^e[n];return t===0}var Mt;async function Xe(r){Mt??(Mt=import("@phala/dcap-qvl"));let e=await Mt,t=typeof e[r]=="function"?e[r]:e.default?.[r];if(typeof t!="function")throw new TypeError(`@phala/dcap-qvl loaded without ${r}`);return t}function $t(r,e){let t=k(e,"minReleaseVersion"),n=String(r.release?.version??"").trim().replace(/^mero-tee-v/,"").replace(/^v/,""),i=k(n,"The release the node names");if(ie(i,t)<0)throw new Error(`mero-tee release ${i} is older than the minimum ${t}`);return i}async function mn(r,e,t){let n=e.releaseSource;return typeof n=="function"?n(r):n==="github"?Ye(r,{fetch:t}):ze(Ze(n??we,r),{fetch:t})}function wn(r){let e=r.collateralSource??Je;return e==="intel"?async t=>(await Xe("getCollateralFromPcs"))(t):async t=>(await Xe("getCollateral"))(e,t)}function Bt(r,e){let t=e.maxCollateralAgeDays;return t===void 0?r:async n=>{let i=await r(n),s;try{s=Date.parse(JSON.parse(i.tcb_info).issueDate??"")}catch{s=Number.NaN}if(!Number.isFinite(s))throw new Error("The quote's collateral names no TCB info issue date");let o=((e.now??Date.now)()-s)/864e5;if(o>t)throw new Error(`The quote's collateral was issued ${Math.floor(o)} days ago, more than the ${t} this client accepts`);return i}}async function An(r,e,t,n){let i=$t(r,t.minReleaseVersion),s=await Ae({release:await mn(i,t,n),profile:t.profile??_,allowDebugProfile:t.allowDebugProfile,minReleaseVersion:t.minReleaseVersion,identity:t.identity,issuer:t.issuer}),o=Bt(t.fetchCollateral??wn(t),t);return $({dcapVerify:t.dcapVerify??await Xe("verify"),fetchCollateral:o,now:t.now,...s})(e)}async function et(r,e,t=(n,i)=>fetch(n,i)){let n=R(crypto.getRandomValues(new Uint8Array(32))),i=new URL(`${r.replace(/\/+$/,"")}/attestation`);i.searchParams.set("nonce",n),e.appHash&&i.searchParams.set("appHash",e.appHash);let s=await t(i.toString());if(!s.ok)throw new Error(`The node refused to attest: HTTP ${s.status}`);let o=await s.json(),a=fe(o.transportKey,"transportKey",32),c=e.appHash?fe(e.appHash,"appHash",32):new Uint8Array(32),l=await Le(c,a),u=hn(o.quote),g=new TextEncoder().encode(_t);if(We(u.slice(0,g.length),g)){if(!e.allowMock)throw new Error("mock quote refused: this client only trusts real TEEs");let f=u.slice(g.length,g.length+64);if(!We(f.slice(0,32),fe(n,"nonce",32))||!We(f.slice(32),l))throw new Error("the quote does not bind this transport key, app and nonce");return a}let p={quoteB64:o.quote,nonce:n,reportDataSuffix:R(l)},h;if(e.verifyQuote)h=await e.verifyQuote(p);else if(e.release)h=await An(o,p,e.release,t);else throw new Error("real quote refused: this client trusts no TD image (set policy.release)");if(!h)throw new Error("The attestation did not verify, so its transport key is not trusted");return a}var tt="https://manager.cloud.calimero.network/api/v2/directory";var T=class extends Error{constructor(t,n,i,s,o){super(`directory for cluster ${t}: ${i}`);this.cluster=t;this.reason=n;this.status=s;this.cause=o;this.name="DirectoryError"}};function bn(r,e){return`${r.replace(/\/+$/,"")}/${encodeURIComponent(e)}`}async function rt(r,e,t){let n;try{n=await t(bn(r,e),{method:"GET",headers:{accept:"application/json"}})}catch(u){throw new T(e,"unreachable",`could not be reached: ${String(u)}`,void 0,u)}if(n.status===404)throw new T(e,"not-found","unknown cluster",404);if(!n.ok)throw new T(e,"unreachable",`answered ${n.status}`,n.status);let i;try{i=await n.json()}catch(u){throw new T(e,"bad-response","answered something other than JSON",n.status,u)}let s=i;if(!s||typeof s!="object"||!Array.isArray(s.nodes))throw new T(e,"bad-response","answered no node list",n.status);let o=[],a=new Set;for(let u of s.nodes){let g=En(u);g&&!a.has(g.url)&&(a.add(g.url),o.push(g))}if(o.length===0)throw new T(e,"empty","lists no usable node",n.status);let c=s.refreshAfterSeconds,l=typeof c=="number"&&Number.isFinite(c)&&c>=1?c:60;return{nodes:o,refreshAfterSeconds:l}}function En(r){if(!r||typeof r!="object")return;let{url:e,zone:t,weight:n}=r;if(typeof e!="string"||typeof n!="number"||!Number.isInteger(n)||n<1)return;let i;try{i=new URL(e)}catch{return}if(!(i.protocol!=="https:"&&i.protocol!=="http:"))return{url:e.replace(/\/+$/,""),zone:typeof t=="string"?t:void 0,weight:n}}function nt(r,e,t){let n=e===void 0?[]:r.filter(s=>s.zone===e),i=e===void 0?r:r.filter(s=>s.zone!==e);return[...Kt(n,t),...Kt(i,t)]}function Kt(r,e){let t=[...r],n=[];for(;t.length>0;){let i=e()*t.reduce((o,a)=>o+a.weight,0),s=0;for(;s<t.length-1&&i>=t[s].weight;)i-=t[s++].weight;n.push(t.splice(s,1)[0].url)}return n}var w=class extends Error{constructor(t,n,i,s={}){super(`${t} ${n}: ${i}`);this.status=t;this.code=n;this.details=s;this.name="CalimeroError"}},z=class extends w{constructor(e,t={}){super(401,"UNAUTHENTICATED",e,t),this.name="LoginRequired"}},B=class extends w{constructor(e,t={}){super(421,"WRONG_NODE",e,t),this.name="WrongNode"}},be=class extends w{constructor(e,t={}){super(404,"NOT_FOUND",e,t),this.name="NotFound"}},Y=class extends w{constructor(e,t={}){super(412,"CONFIRM_REQUIRED",e,t),this.name="ConfirmRequired"}},se=class extends Error{constructor(t){super("the passkey confirmation was cancelled");this.cause=t;this.name="ConfirmCancelled"}},Ee=class extends w{constructor(e,t={}){super(413,"ARGS_TOO_LARGE",e,t),this.name="ArgsTooLarge"}},Re=class extends w{constructor(e,t={}){super(409,"IDEMPOTENCY_MISMATCH",e,t),this.name="IdempotencyMismatch"}},Pe=class extends w{constructor(e,t={}){super(409,"RELEASE_DEADLINE",e,t),this.name="ReleaseDeadlineError",this.release=typeof t.release=="string"?t.release:"",this.after=typeof t.after=="string"?t.after:""}},Ue=class extends w{constructor(e,t={}){super(409,"CONSENT_STALE",e,t),this.name="ConsentStale"}},xe=class extends w{constructor(e,t={}){super(422,"APP_ERROR",e,t),this.name="AppError";let{appCode:n,fields:i}=Rn(t);this.appCode=n,this.fields=i}},Te=class extends w{constructor(e,t={}){super(422,"TRAP",e,t),this.name="TrapError",this.kind=typeof t.kind=="string"?t.kind:""}},K=class extends w{constructor(e,t,n={},i,s){super(503,e,t,n),this.name="UnavailableError",this.reason=e.toLowerCase(),this.committed=e==="TIMEOUT"||e==="MIGRATING"?!1:"unknown",this.retryAfter=i,this.cause=s}};function Se(r){return r&&typeof r=="object"&&!Array.isArray(r)?r:{}}function Rn(r){let e=typeof r.code=="string"?r:Se(r.error);return{appCode:typeof e.code=="string"?e.code:"",fields:{...Se(e.fields)}}}function Pn(r,e){for(let t of[r.retryAfter,e==null?void 0:Number(e)])if(typeof t=="number"&&Number.isFinite(t)&&t>=0)return t}function Ce(r,e,t){let n=Se(e),i=typeof n.error=="string"?n.error:"ERROR",s=typeof n.message=="string"?n.message:"",o=Se(n.details);if(r===503)return new K(i,s,o,Pn(o,t));switch(`${r} ${i}`){case"401 UNAUTHENTICATED":return new z(s,o);case"421 WRONG_NODE":return new B(s,o);case"404 NOT_FOUND":return new be(s,o);case"409 IDEMPOTENCY_MISMATCH":return new Re(s,o);case"409 RELEASE_DEADLINE":return new Pe(s,o);case"409 CONSENT_STALE":return new Ue(s,o);case"412 CONFIRM_REQUIRED":return new Y(s,o);case"413 ARGS_TOO_LARGE":return new Ee(s,o);case"422 APP_ERROR":return new xe(s,o);case"422 TRAP":return new Te(s,o);default:return new w(r,i,s,o)}}function S(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function I(r){let e=r.replace(/-/g,"+").replace(/_/g,"/")+"===".slice((r.length+3)%4),t=atob(e),n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i);return n}var oe=r=>r.buffer.slice(r.byteOffset,r.byteOffset+r.byteLength);function Vt(r){let e=new Error(r);return e.name="NotAllowedError",e}function Un(){return{async create(r){let e=r,t=await navigator.credentials.create({publicKey:{challenge:oe(I(e.challenge)),rp:e.rp,user:{...e.user,id:oe(I(e.user.id))},pubKeyCredParams:e.pubKeyCredParams,excludeCredentials:(e.excludeCredentials??[]).map(i=>({type:i.type,id:oe(I(i.id))})),authenticatorSelection:e.authenticatorSelection,attestation:"none",timeout:e.timeout}});if(!t)throw Vt("passkey creation was cancelled");let n=t.response;return{attestationObject:S(new Uint8Array(n.attestationObject)),clientDataJson:S(new Uint8Array(n.clientDataJSON))}},async get(r,e,t){let n=await navigator.credentials.get({publicKey:{challenge:oe(r),rpId:e,userVerification:"preferred",allowCredentials:(t??[]).map(s=>({type:"public-key",id:oe(I(s))}))}});if(!n)throw Vt("passkey sign-in was cancelled");let i=n.response;return{credentialId:S(new Uint8Array(n.rawId)),authenticatorData:S(new Uint8Array(i.authenticatorData)),clientDataJson:S(new Uint8Array(i.clientDataJSON)),signature:S(new Uint8Array(i.signature))}}}}var it=100;function ce(r={}){let e=new URLSearchParams;if(r.after!==void 0&&e.set("after",r.after),r.limit!==void 0){if(!Number.isInteger(r.limit)||r.limit<1||r.limit>it)throw new RangeError(`limit is 1 to ${it}`);e.set("limit",String(r.limit))}let t=e.toString();return t?`?${t}`:""}function ae(r,e){try{return ie(r,e)}catch{return r<e?-1:r>e?1:0}}function Lt(r,e,t=Date.now()/1e3){if(r===null||r.length===0)return null;let n=r.reduce((s,o)=>ae(s,o)>=0?s:o),i=null;for(let s of e)s.afterSecs<=t&&ae(n,s.version)<0&&(i===null||ae(s.version,i.version)>0)&&(i=s);return i}function Ht(r,e,t,n){return`calimero-publisher-binding/v1
1
+ function R(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function fe(r,e,t){let n=r.trim();if(!/^[0-9a-fA-F]*$/.test(n)||n.length!==t*2)throw new Error(`${e} must be ${t*2} hex characters, got ${n.length}`);let s=new Uint8Array(t);for(let i=0;i<t;i+=1)s[i]=Number.parseInt(n.slice(i*2,i*2+2),16);return s}function y(...r){let e=new Uint8Array(r.reduce((n,s)=>n+s.length,0)),t=0;for(let n of r)e.set(n,t),t+=n.length;return e}var Er="Noise_NK_25519_AESGCM_SHA256",_e=32,Rr=16,Pr=new Uint8Array([48,46,2,1,0,48,5,6,3,43,101,110,4,34,4,32]),Ke=class r{constructor(e){this.k=null;this.n=0;this.ck=e,this.h=e}static async initialize(){let e=new TextEncoder().encode(Er),t=new Uint8Array(32);return t.set(e),new r(t)}async mixHash(e){this.h=await Ur(y(this.h,e))}async mixKey(e){let[t,n]=await yt(this.ck,e);this.ck=t,this.k=await crypto.subtle.importKey("raw",n,"AES-GCM",!1,["encrypt","decrypt"]),this.n=0}async encryptAndHash(e){if(!this.k)throw new Error("Noise: no cipher key yet");let t=new Uint8Array(await crypto.subtle.encrypt({name:"AES-GCM",iv:ft(this.n),additionalData:this.h},this.k,e));return this.n+=1,await this.mixHash(t),t}async decryptAndHash(e){if(!this.k)throw new Error("Noise: no cipher key yet");let t=new Uint8Array(await crypto.subtle.decrypt({name:"AES-GCM",iv:ft(this.n),additionalData:this.h},this.k,e));return this.n+=1,await this.mixHash(e),t}split(){return yt(this.ck,new Uint8Array)}};async function ht(r,e,t){let n=await Ke.initialize();await n.mixHash(e),await n.mixHash(r);let s=await G(t);return await n.mixHash(s.publicKey),await n.mixKey(await W(s.privateKey,r)),{message1:y(s.publicKey,await n.encryptAndHash(new Uint8Array)),async finish(o){if(o.length<_e+Rr)throw new Error("Noise: message 2 is too short");let a=o.slice(0,_e);return await n.mixHash(a),await n.mixKey(await W(s.privateKey,a)),{payload:await n.decryptAndHash(o.slice(_e)),split:await n.split()}}}}async function G(r){if(!r){let n;try{n=await crypto.subtle.generateKey({name:"X25519"},!0,["deriveBits"])}catch(i){throw new Error(`Sealed transport needs WebCrypto with X25519, which this runtime lacks (${i?.name??"no crypto.subtle"}). Current browsers and Node have it; in React Native, install react-native-quick-crypto as the global crypto.`)}let s=new Uint8Array(await crypto.subtle.exportKey("raw",n.publicKey));return{privateKey:n.privateKey,publicKey:s}}let e=await crypto.subtle.importKey("pkcs8",y(Pr,r),{name:"X25519"},!0,["deriveBits"]),t=await crypto.subtle.exportKey("jwk",e);return{privateKey:e,publicKey:xr(t.x)}}async function W(r,e){let t=await crypto.subtle.importKey("raw",e,{name:"X25519"},!1,[]);return new Uint8Array(await crypto.subtle.deriveBits({name:"X25519",public:t},r,256))}function ft(r){let e=new Uint8Array(12);return new DataView(e.buffer).setBigUint64(4,BigInt(r),!1),e}async function Ur(r){return new Uint8Array(await crypto.subtle.digest("SHA-256",r))}async function Be(r,e){let t=await crypto.subtle.importKey("raw",r,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",t,e))}async function yt(r,e){let t=await Be(r,e),n=await Be(t,new Uint8Array([1])),s=await Be(t,y(n,new Uint8Array([2])));return[n,s]}function xr(r){let e=r.replace(/-/g,"+").replace(/_/g,"/"),t=atob(e+"=".repeat((4-e.length%4)%4));return Uint8Array.from(t,n=>n.charCodeAt(0))}var bt="/sealed/v2/handshake",Et="/sealed/v2",te="application/vnd.calimero.sealed",Ve=2,Tr=new TextEncoder().encode("calimero/sealed-http/v2"),ee=16,Cr=1+ee+8,Sr=0,kr=1,vr=2,Ir=1+64*1024+16,Dr=1024,Or=6e4,Nr="calimero.tee-attest.transport-key.v1",Mr=[101,204,205,304],Rt=new TextEncoder,re=class extends Error{constructor(){super("The node no longer holds the attested transport key; attest again for the current one");this.name="StaleTransportKeyError"}},S=class extends Error{constructor(t,n,s,i){super(s);this.status=t;this.code=n;this.retryAfterMs=i;this.name="SealedTransportError"}};async function Le(r,e){let t=await crypto.subtle.digest("SHA-256",y(Rt.encode(Nr),r,e));return new Uint8Array(t)}function He(r){let e=new URL(r.baseUrl),t=e.pathname.replace(/\/+$/,""),n=`${e.origin}${t}`,s=r.fetch??((g,p)=>fetch(g,p)),i=typeof r.transportPublicKey=="function"?r.transportPublicKey:void 0,o=i?Promise.resolve().then(i):Promise.resolve(r.transportPublicKey);o.catch(()=>{});let a,c=async()=>{try{return await wt(s,n,await mt(o))}catch(g){if(!(g instanceof re)||!i)throw g;return o=Promise.resolve().then(i),wt(s,n,await mt(o))}},d=async()=>{let g=a??u(void 0),p=await g;if(Date.now()<p.renewAt)return[p,g];let h=u(g);return[await h,h]},u=g=>{if(a===g){let p=c();a=p,p.catch(()=>{a===p&&(a=void 0)})}return a};return async(g,p)=>{let h=new Request(g,p),f=new URL(h.url);if(f.origin!==e.origin||!f.pathname.startsWith(`${t}/`))throw new Error(`Refusing to send ${f.href} outside the sealed node at ${r.baseUrl}`);let b=[];h.headers.forEach((P,L)=>b.push([L,P]));let N={method:h.method,path:f.pathname.slice(t.length)+f.search,headers:b},E=new Uint8Array(await h.arrayBuffer()),x=p?.signal??(g instanceof Request?g.signal:void 0),M=async P=>{let{requestId:L,header:X,envelope:pe}=await _r(P,N,E),H=await s(`${n}${Et}`,{method:"POST",headers:{"content-type":te},body:pe,signal:x});if(H.headers.get("content-type")!==te)throw await Ut(H);return Kr(H,P.responseKey,X,L)},[Oe,Ne]=await d();try{return await M(Oe)}catch(P){if(!(P instanceof S)||P.code!=="unknown_session")throw P;return M(await u(Ne))}}}async function mt(r){let e=await r;if(e.length!==32)throw new Error("transportPublicKey must be 32 bytes");return e}async function wt(r,e,t){try{return await At(r,e,t)}catch(n){if(!(n instanceof S)||n.code!=="busy")throw n;return await new Promise(s=>setTimeout(s,n.retryAfterMs??1e3)),At(r,e,t)}}async function At(r,e,t){let n=await ht(t,Tr),s=await r(`${e}${bt}`,{method:"POST",headers:{"content-type":te},body:y(new Uint8Array([Ve]),t,n.message1)});if(s.headers.get("content-type")!==te)throw await Ut(s);let i=await Lr(s,Dr);return $r(n,i)}async function $r(r,e){if(e[0]!==Ve)throw new Error("The handshake reply is malformed");let t;try{t=await r.finish(e.slice(1))}catch{throw new Error("The handshake reply did not open: it did not come from the attested node")}let{payload:n,split:s}=t;if(n.length!==ee+4)throw new Error("The handshake reply is malformed");let i=n.slice(0,ee),o=new DataView(n.buffer,n.byteOffset).getUint32(ee,!1),[a,c]=await Promise.all([crypto.subtle.importKey("raw",s[0],"AES-GCM",!1,["encrypt"]),crypto.subtle.importKey("raw",s[1],"AES-GCM",!1,["decrypt"])]);return s[0].fill(0),s[1].fill(0),{requestKey:a,responseKey:c,nextRequestId:1,renewAt:Date.now()+o*1e3-Or,header(d){let u=new Uint8Array(Cr);return u[0]=Ve,u.set(i,1),new DataView(u.buffer).setBigUint64(1+ee,BigInt(d),!1),u}}}async function _r(r,e,t){let n=r.nextRequestId;r.nextRequestId+=1;let s=r.header(n),i=await crypto.subtle.encrypt({name:"AES-GCM",iv:Pt(n,0),additionalData:s},r.requestKey,Br(e,t));return{requestId:n,header:s,envelope:y(s,new Uint8Array(i))}}function Pt(r,e){let t=new Uint8Array(12),n=new DataView(t.buffer);return n.setBigUint64(0,BigInt(r),!1),n.setUint32(8,e,!1),t}function Br(r,e){let t=Rt.encode(JSON.stringify(r)),n=new Uint8Array(4);return new DataView(n.buffer).setUint32(0,t.length,!1),y(n,t,e)}async function Kr(r,e,t,n){if(!r.body)throw new Error("The sealed response has no body");let s=Vr(r.body.getReader()),i=0,o=async()=>{let u=await s.next();if(!u)return null;let g;try{g=new Uint8Array(await crypto.subtle.decrypt({name:"AES-GCM",iv:Pt(n,i),additionalData:t},e,u))}catch{throw new Error("A sealed response frame did not open: it was not sealed by the attested node")}return i+=1,{kind:g[0],data:g.slice(1)}},a=await o();if(!a||a.kind!==Sr)throw new Error("The sealed response is malformed");let c=JSON.parse(new TextDecoder().decode(a.data));if(Mr.includes(c.status))return await s.cancel(),new Response(null,{status:c.status,headers:c.headers});let d=new ReadableStream({async pull(u){try{let g=await o();g?g.kind===kr?u.enqueue(g.data):g.kind===vr?(u.close(),await s.cancel()):u.error(new Error("The sealed response is malformed")):u.error(new Error("The sealed response was cut short"))}catch(g){u.error(g)}},cancel(){return s.cancel()}});return new Response(d,{status:c.status,headers:c.headers})}function Vr(r){let e=new Uint8Array,t=async n=>{for(;e.length<n;){let{done:s,value:i}=await r.read();if(s)return!1;e=y(e,i)}return!0};return{async next(){if(!await t(4))return null;let n=new DataView(e.buffer,e.byteOffset).getUint32(0,!1);if(n>Ir)throw await r.cancel(),new Error("The sealed response is malformed: a frame is larger than the node sends");if(!await t(4+n))return null;let s=e.slice(4,4+n);return e=e.slice(4+n),s},cancel:()=>r.cancel()}}async function Lr(r,e){if(!r.body)return new Uint8Array;let t=r.body.getReader(),n=new Uint8Array;for(;;){let{done:s,value:i}=await t.read();if(s)return n;if(n=y(n,i),n.length>e)throw await t.cancel(),new Error("The handshake reply is malformed: it is too long")}}async function Ut(r){let e,t=`Sealed request refused: HTTP ${r.status}`;try{let i=await r.json();e=i?.error?.code,i?.error?.message&&(t=`Sealed request refused: ${i.error.message}`)}catch{}if(e==="stale_transport_key")return new re;let n=Number(r.headers.get("retry-after")),s=Number.isFinite(n)&&n>0?Math.min(n,5)*1e3:void 0;return new S(r.status,e,t,s)}var xt=[{uri:"https://fulcio.sigstore.dev",validFor:{start:"2021-03-07T03:20:29Z",end:"2022-12-31T23:59:59.999Z"},certChain:["MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="]},{uri:"https://fulcio.sigstore.dev",validFor:{start:"2022-04-13T20:06:15Z"},certChain:["MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow=","MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"]}],Tt=[{baseUrl:"https://rekor.sigstore.dev",logId:"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",publicKey:"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",validFor:{start:"2021-01-12T11:53:27Z"}}];var Hr="1.2.840.10045.2.1",Fr={"1.2.840.10045.3.1.7":"P-256","1.3.132.0.34":"P-384"},Gr={"P-256":32,"P-384":48},jr={"1.2.840.10045.4.3.2":"SHA-256","1.2.840.10045.4.3.3":"SHA-384"};function Ct(r,e,t){if(e+2>t)throw new Error("it is truncated");let n=r[e];if((n&31)===31)throw new Error("it uses a tag this parser does not read");let s=r[e+1],i=e+2;if(s&128){let a=s&127;if(a===0||a>4||i+a>t)throw new Error("it has a length this parser does not read");s=0;for(let c=0;c<a;c+=1)s=s*256+r[i+c];i+=a}let o=i+s;if(o>t)throw new Error("it is truncated");return{tag:n,bytes:r,offset:e,start:i,end:o}}function q(r){let e=Ct(r,0,r.length);if(e.end!==r.length)throw new Error("it has trailing bytes");return e}function A(r){let e=[];for(let t=r.start;t<r.end;){let n=Ct(r.bytes,t,r.end);e.push(n),t=n.end}return e}function m(r,e,t){if(!r||r.tag!==e)throw new Error(`${t} is not where it should be`);return r}function k(r){return r.bytes.slice(r.start,r.end)}function ye(r){return r.bytes.slice(r.offset,r.end)}function j(r){let e=k(m(r,6,"An object identifier"));if(e.length===0||e[e.length-1]&128)throw new Error("it has a malformed object identifier");let t=[],n=0;for(let o of e)n=n*128+(o&127),o&128||(t.push(n),n=0);let s=t.shift();return[...s<80?[Math.floor(s/40),s%40]:[2,s-80],...t].join(".")}function qr(r){let e=new TextDecoder().decode(k(r)),t=r.tag===23?/^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(e):null,n=r.tag===24?/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(e):null,s=t??n;if(!s)throw new Error(`it holds the time ${JSON.stringify(e)}, which is not one a certificate may hold`);let i=Number(s[1]);t&&(i+=i<50?2e3:1900);let[o,a,c,d,u]=s.slice(2).map(Number);return Date.UTC(i,o-1,a,c,d,u)}function Fe(r){try{let[e,t,n,...s]=A(m(q(r),48,"The certificate"));if(s.length>0)throw new Error("it has fields after its signature");let i=A(m(e,48,"The signed part")),o=i[0]?.tag===160?1:0,[a,c,d,u,g,p,...h]=i.slice(o);m(a,2,"The serial number");let f=j(A(m(t,48,"The signature algorithm"))[0]);if(j(A(m(c,48,"The signature algorithm"))[0])!==f)throw new Error("it names two different signature algorithms");let N=jr[f];if(!N)throw new Error(`it is signed with ${f}, not ECDSA with SHA-256 or SHA-384`);let[E,x]=A(m(u,48,"The validity")).map(qr);if(x===void 0)throw new Error("its validity is incomplete");let[M,Oe]=A(m(p,48,"The public key"));m(Oe,3,"The public key");let[Ne,P]=A(m(M,48,"The key algorithm"));if(j(Ne)!==Hr)throw new Error("its key is not an elliptic-curve key");let L=Fr[j(P)];if(!L)throw new Error("its key is on a curve other than P-256 or P-384");let X=new Map,pe=h.find(Me=>Me.tag===163);if(pe){let[Me]=A(pe);for(let br of A(m(Me,48,"The extensions"))){let F=A(m(br,48,"An extension"));if(F.length===3)m(F[1],1,"An extension's critical flag");else if(F.length!==2)throw new Error("it has a malformed extension");let $e=j(F[0]);if(X.has($e))throw new Error(`it has extension ${$e} twice`);X.set($e,k(m(F[F.length-1],4,"An extension value")))}}let H=k(m(n,3,"The signature"));if(H[0]!==0)throw new Error("its signature is not a whole number of bytes");return{der:r,tbs:ye(e),signatureHash:N,signature:H.slice(1),issuer:ye(m(d,48,"The issuer")),subject:ye(m(g,48,"The subject")),notBefore:E,notAfter:x,spki:ye(p),curve:L,extensions:X}}catch(e){throw new Error(`The certificate is malformed: ${e.message}`)}}function St(r){return A(m(q(r),48,"The list")).map(j)}function Qr(r,e){let t=Gr[e],n=A(m(q(r),48,"The signature"));if(n.length!==2)throw new Error("The signature is not an ECDSA signature");let s=new Uint8Array(t*2);return n.forEach((i,o)=>{let a=k(m(i,2,"The signature"));if(a.length===0||a[0]&128)throw new Error("The signature is not an ECDSA signature");for(;a.length>1&&a[0]===0;)a=a.subarray(1);if(a.length>t)throw new Error("The signature is not an ECDSA signature");s.set(a,o*t+t-a.length)}),s}async function he(r,e,t,n,s){let i;try{i=Qr(n,e)}catch{return!1}let o=await crypto.subtle.importKey("spki",r,{name:"ECDSA",namedCurve:e},!1,["verify"]);return crypto.subtle.verify({name:"ECDSA",hash:t},o,i,s)}function U(r,e){let t=r.replace(/\s+/g,"");if(!/^[A-Za-z0-9+/]*={0,2}$/.test(t)||t.length%4!==0)throw new Error(`${e} is not base64`);let n=atob(t),s=new Uint8Array(n.length);for(let i=0;i<n.length;i+=1)s[i]=n.charCodeAt(i);return s}function Ge(r,e){let t=[...r.matchAll(/-----BEGIN CERTIFICATE-----([^-]*)-----END CERTIFICATE-----/g)];if(t.length!==1||r.replace(t[0][0],"").trim()!=="")throw new Error(`${e} is not exactly one PEM certificate`);return U(t[0][1],e)}var Jr="2.5.29.17",zr="2.5.29.37",Yr="1.3.6.1.5.5.7.3.3",Zr="1.3.6.1.4.1.57264.1.8",Xr="1.3.6.1.4.1.57264.1.1",Wr=134,en=12,tn=48,rn=new TextEncoder,Q=r=>new TextDecoder().decode(r);async function me(r,e,t,n){let{base64Signature:s,cert:i,rekorBundle:o}=an(e),a=o.Payload;if(n!==void 0&&n.trim()!==s.trim())throw new Error("The detached signature is not the one in the bundle");let c=U(s,"The bundle signature"),d=Ge(Q(U(i,"The bundle certificate")),"The bundle certificate"),u=Fe(d),g=Tt.find(x=>x.logId===a.logID.toLowerCase());if(!g)throw new Error(`The bundle names Rekor log ${a.logID}, which the Sigstore trust root does not know`);let p=rn.encode(`{"body":${JSON.stringify(a.body)},"integratedTime":${a.integratedTime},"logID":${JSON.stringify(a.logID)},"logIndex":${a.logIndex}}`);if(!await he(U(g.publicKey,"The Rekor key"),"P-256","SHA-256",U(o.SignedEntryTimestamp,"The signed entry timestamp"),p))throw new Error("Rekor's signed entry timestamp does not verify: the log entry, its time or its index was altered");let f=a.integratedTime*1e3;if(!It(f,g.validFor))throw new Error(`Rekor log ${g.baseUrl} was not in use at ${ne(f)}, when the entry says it was logged`);let b=cn(a.body),N=R(new Uint8Array(await crypto.subtle.digest("SHA-256",r)));if(b.hash!==N)throw new Error("The file's SHA-256 is not the one Rekor logged: the file is not the one signed");if(!je(U(b.signature,"The logged signature"),c))throw new Error("The bundle's signature is not the one Rekor logged");let E=Ge(Q(U(b.publicKey,"The logged certificate")),"The logged certificate");if(!je(E,d))throw new Error("The bundle's certificate is not the one Rekor logged");if(u.curve!=="P-256"||!await he(u.spki,"P-256","SHA-256",c,r))throw new Error("The signature over the file does not verify with the bundle's certificate");return await nn(u,f),on(u,t),{integratedTime:a.integratedTime}}async function nn(r,e){if(!vt(r,e))throw new Error(`The signing certificate was valid ${ne(r.notBefore)} to ${ne(r.notAfter)}, not at ${ne(e)} when Rekor logged it`);let t=[];for(let n of xt){let s=n.certChain.map(o=>Fe(U(o,"A Fulcio certificate")));if(!await kt(r,s[0]))continue;let i=await sn(s,n.validFor,e);if(!i)return;t.push(`${n.uri} (valid from ${n.validFor.start}): ${i}`)}throw new Error(t.length>0?`The signing certificate's CA is not trusted at ${ne(e)}: ${t.join("; ")}`:"The signing certificate was not issued by a Fulcio CA in the Sigstore trust root")}async function sn(r,e,t){if(!It(t,e))return"the trust root says it was not issuing certificates then";for(let[n,s]of r.entries()){if(!vt(s,t))return`its certificate ${n} was not valid then`;let i=r[n+1]??s;if(!await kt(s,i))return`its certificate ${n} is not signed by the next`}}async function kt(r,e){return je(r.issuer,e.subject)?he(e.spki,e.curve,r.signatureHash,r.signature,r.tbs):!1}function on(r,e){let t=r.extensions.get(Jr);if(!t)throw new Error("The signing certificate names no identity");let n=A(m(q(t),tn,"The subject alternative name")),s=n.filter(d=>d.tag===Wr).map(d=>Q(k(d)));if(s.length!==1||n.length!==1||s[0]!==e.identity)throw new Error(`The release was signed by ${JSON.stringify(s.length===1?s[0]:s)}, not by ${e.identity}`);let i=r.extensions.get(Zr),o=r.extensions.get(Xr),a=i?Q(k(m(q(i),en,"The OIDC issuer"))):o?Q(o):void 0;if(a!==e.issuer)throw new Error(`The signing certificate's OIDC issuer is ${a===void 0?"missing":JSON.stringify(a)}, not ${e.issuer}`);let c=r.extensions.get(zr);if(!c||!St(c).includes(Yr))throw new Error("The signing certificate is not for code signing")}function an(r){let e=r;if(typeof e=="string")try{e=JSON.parse(e)}catch{throw new Error("The bundle is not JSON")}let t=e,n=t?.rekorBundle?.Payload;if(!(typeof t?.base64Signature=="string"&&typeof t.cert=="string"&&typeof t.rekorBundle?.SignedEntryTimestamp=="string"&&typeof n?.body=="string"&&typeof n.logID=="string"&&/^[0-9a-fA-F]{64}$/.test(n.logID)&&Number.isSafeInteger(n.integratedTime)&&n.integratedTime>=0&&Number.isSafeInteger(n.logIndex)&&n.logIndex>=0))throw new Error("The bundle is not a cosign bundle with a Rekor entry");return t}function cn(r){let e;try{e=JSON.parse(Q(U(r,"The logged entry")))}catch{throw new Error("The logged entry is not JSON")}let t=e?.spec?.data?.hash,n=e?.spec?.signature;if(e?.kind!=="hashedrekord"||t?.algorithm!=="sha256"||typeof t.value!="string"||typeof n?.content!="string"||typeof n.publicKey?.content!="string")throw new Error("The logged entry is not a SHA-256 hashedrekord");return{hash:t.value.toLowerCase(),signature:n.content,publicKey:n.publicKey.content}}function vt(r,e){return r.notBefore<=e&&e<=r.notAfter}function It(r,e){return Date.parse(e.start)<=r&&(e.end===void 0||r<=Date.parse(e.end))}function ne(r){return new Date(r).toISOString()}function je(r,e){return r.length===e.length&&r.every((t,n)=>t===e[n])}var ln=/^[0-9a-f]{96}$/,dn=["mrtd","rtmr0","rtmr1","rtmr2","rtmr3"];function _(r){let e=J(r.allowedMrtd??[],"allowedMrtd"),t=(r.allowedMeasurements??[]).map((a,c)=>{let d=`allowedMeasurements[${c}]`;return dn.map(u=>J([a?.[u]??""],`${d}.${u}`)[0]).join()}),n=[J(r.allowedRtmr0??[],"allowedRtmr0"),J(r.allowedRtmr1??[],"allowedRtmr1"),J(r.allowedRtmr2??[],"allowedRtmr2"),J(r.allowedRtmr3??[],"allowedRtmr3")];if(r.allowedMeasurements!==void 0&&t.length===0)throw new Error("allowedMeasurements is empty, so no quote would ever be accepted");if(t.length===0){if(e.length===0)throw new Error("No image is trusted: give allowedMeasurements, or allowedMrtd with allowedRtmr1-3");if(n.slice(1).some(a=>a.length===0))throw new Error("allowedMrtd alone does not name an image: the MRTD measures the TD firmware, which images share, and the image is in RTMR1-3. Give allowedMeasurements, or allowedRtmr1-3 too")}let s=r.allowedTcbStatuses??["UpToDate"],i=r.now??Date.now;return Object.assign(async({quoteB64:a,nonce:c,reportDataSuffix:d,collateral:u})=>{let g=gn(a),p=u??await r.fetchCollateral?.(g);if(!p)throw new Error("The node sent no collateral for its quote, and no fetchCollateral was given to get it");let h;try{h=r.dcapVerify(g,p,Math.floor(i()/1e3))}catch(E){throw new Error(`The quote did not verify: ${E?.message??String(E)}`)}if(h.status==="Revoked"||!s.includes(h.status))throw new Error(`The platform's TCB status is ${h.status}, which is not accepted`);let f=un(h.report);if(f.tdAttributes?.length!==8||(f.tdAttributes[0]&1)!==0)throw new Error("The quote is from a debug TD, or its TD attributes cannot be read");let b=[f.mrTd,f.rtMr0,f.rtMr1,f.rtMr2,f.rtMr3].map(E=>R(E));if(t.length>0&&!t.includes(b.join()))throw new Error(`The measurements (MRTD ${b[0]}, RTMR0-3 ${b.slice(1).join(", ")}) are not an image this verifier trusts`);if(e.length>0&&!e.includes(b[0]))throw new Error(`MRTD ${b[0]} is not an image this verifier trusts`);if([f.rtMr0,f.rtMr1,f.rtMr2,f.rtMr3].forEach((E,x)=>{let M=n[x];if(M.length>0&&!M.includes(R(E)))throw new Error(`RTMR${x} ${R(E)} is not one this verifier trusts`)}),R(f.reportData)!==`${c}${d}`.toLowerCase())throw new Error("The quote does not commit to this nonce and binding");return!0},{includeCollateral:!0})}function J(r,e){return r.map(t=>{let n=t.trim().toLowerCase();if(!ln.test(n))throw new Error(`${e} holds ${JSON.stringify(t)}, which is not a 48-byte hex measurement`);return n})}function un(r){let e=r.data;if(r.type==="td10"&&e)return e;if(r.type==="td15"&&e?.base)return e.base;throw new Error(`The quote is a ${r.type} quote, not a TDX one`)}function gn(r){let e=atob(r),t=new Uint8Array(e.length);for(let n=0;n<e.length;n+=1)t[n]=e.charCodeAt(n);return t}var pn=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"],$="locked-read-only";function qe(r,{profile:e,allowDebugProfile:t=!1}){if(r.length===0)throw new Error("No release given, so no image would be trusted");let n,s=r.map((i,o)=>{let a=i?.tag??`releases[${o}]`;if(i?.role!==void 0&&i.role!=="node")throw new Error(`${a} lists the measurements of a ${i.role}, not of a node image`);let c=i?.profiles?.[e];if(!c){let u=Object.keys(i?.profiles??{}).join(", ")||"none";throw new Error(`${a} has no profile ${JSON.stringify(e)} (it has: ${u})`)}if(e!==$&&!t)throw new Error(`${JSON.stringify(e)} is not a production profile: its image is readable by whoever operates the node. Trust ${JSON.stringify($)}, or pass allowDebugProfile to test`);let d=(c.allowed_tcb_statuses??["uptodate"]).map(u=>fn(u,a));return n=n===void 0?d:n.filter(u=>d.includes(u)),{mrtd:c.mrtd,rtmr0:c.rtmr0,rtmr1:c.rtmr1,rtmr2:c.rtmr2,rtmr3:c.rtmr3}});if(!n||n.length===0)throw new Error("The releases given accept no TCB status in common");return{allowedMeasurements:s,allowedTcbStatuses:n}}function fn(r,e){let t=pn.find(n=>n.toLowerCase()===String(r).toLowerCase());if(!t)throw new Error(`${e} accepts TCB status ${JSON.stringify(r)}, which this verifier does not know`);return t}var Qe=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-node-image-gcp.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),yn=["mrtd","rtmr0","rtmr1","rtmr2","rtmr3"],we="https://cloud.calimero.network",Je=`${we}/api/tee/pcs`;async function Ot(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??Qe.identity,issuer:t.issuer??Qe.issuer},t.signature);let s;try{s=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed release is not JSON")}if(s?.role!=="node")throw new Error(`The signed release is a ${JSON.stringify(s?.role)} release, not a node one`);let i=Object.values(s.profiles??{}),o=a=>yn.every(c=>/^[0-9a-f]{96}$/i.test(String(a?.[c])));if(typeof s.tag!="string"||i.length===0||!i.every(o))throw new Error("The signed file is not a release's published-mrtds.json: it lists no measured profiles");if(t.expectedVersion!==void 0&&s.tag!==t.expectedVersion)throw new Error(`The signed release is ${s.tag}, not ${t.expectedVersion}`);return s}async function ze(r,e={}){let t=await(e.fetch??fetch)(r,{headers:{accept:"application/json"}});if(!t.ok)throw new Error(`Fetching the node release from ${r} failed: HTTP ${t.status}`);let n;try{n=(await t.json())?.data}catch{throw new Error(`${r} did not answer with JSON`)}if(typeof n?.version!="string"||typeof n.publishedMrtds!="string"||typeof n.bundle!="string")throw new Error(`${r} did not answer with a signed node release`);return{version:n.version,publishedMrtds:n.publishedMrtds,bundle:n.bundle}}var Nt="https://github.com/calimero-network/mero-tee/releases/download";async function Ye(r,e={}){let t=`mero-tee-v${v(r,"version")}`,n=`${(e.base??Nt).replace(/\/+$/,"")}/${t}/published-mrtds.json`,s=async a=>{let c=await(e.fetch??fetch)(a);if(!c.ok)throw new Error(`Fetching ${a} failed: HTTP ${c.status}`);return c.text()},[i,o]=await Promise.all([s(n),s(`${n}.bundle.json`)]);return{version:r,publishedMrtds:i,bundle:o}}function Ze(r,e){return`${r.replace(/\/+$/,"")}/api/tee/node-releases/${v(e,"version")}`}async function Ae(r){let e=v(r.minReleaseVersion,"minReleaseVersion"),t=v(r.release?.version,"The release version"),n=await Ot(r.release.publishedMrtds,r.release.bundle,{expectedVersion:t,identity:r.identity,issuer:r.issuer});if(se(t,e)<0)throw new Error(`Release ${t} is older than the minimum trusted, ${e}`);return qe([n],{profile:r.profile,allowDebugProfile:r.allowDebugProfile})}function hn(r){return v(r.minReleaseVersion,"minReleaseVersion"),Object.assign(async t=>{let n=await Ae({release:await r.release(),profile:r.profile,allowDebugProfile:r.allowDebugProfile,minReleaseVersion:r.minReleaseVersion,identity:r.identity,issuer:r.issuer});return _({dcapVerify:r.dcapVerify,fetchCollateral:r.fetchCollateral,now:r.now,...n})(t)},{includeCollateral:!0})}var Mt=/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;function v(r,e){let t=typeof r=="string"?Mt.exec(r):null,n=t?.[4];if(!t||n!==void 0&&n.split(".").some(s=>s===""))throw new Error(`${e} is ${JSON.stringify(r)}, not a release version like 2.3.87`);return r}function se(r,e){let[t,n]=Dt(r),[s,i]=Dt(e);for(let c=0;c<3;c+=1)if(t[c]!==s[c])return t[c]<s[c]?-1:1;if(n===void 0||i===void 0)return n===i?0:n===void 0?1:-1;let o=n.split("."),a=i.split(".");for(let c=0;c<Math.max(o.length,a.length);c+=1){let[d,u]=[o[c],a[c]];if(d===void 0||u===void 0)return d===void 0?-1:1;let[g,p]=[/^\d+$/.test(d),/^\d+$/.test(u)],h=g&&p?Math.sign(Number(d)-Number(u)):g!==p?g?-1:1:d<u?-1:d>u?1:0;if(h!==0)return h}return 0}function Dt(r){let e=Mt.exec(r);return[[Number(e[1]),Number(e[2]),Number(e[3])],e[4]]}var _t="MOCK_TDX_QUOTE_V1";function mn(r){let e=atob(r),t=new Uint8Array(e.length);for(let n=0;n<e.length;n++)t[n]=e.charCodeAt(n);return t}function Xe(r,e){if(r.length!==e.length)return!1;let t=0;for(let n=0;n<r.length;n++)t|=r[n]^e[n];return t===0}var $t;async function We(r){$t??($t=import("@phala/dcap-qvl"));let e=await $t,t=typeof e[r]=="function"?e[r]:e.default?.[r];if(typeof t!="function")throw new TypeError(`@phala/dcap-qvl loaded without ${r}`);return t}function Bt(r,e){let t=v(e,"minReleaseVersion"),n=String(r.release?.version??"").trim().replace(/^mero-tee-v/,"").replace(/^v/,""),s=v(n,"The release the node names");if(se(s,t)<0)throw new Error(`mero-tee release ${s} is older than the minimum ${t}`);return s}async function wn(r,e,t){let n=e.releaseSource;return typeof n=="function"?n(r):n==="github"?Ye(r,{fetch:t}):ze(Ze(n??we,r),{fetch:t})}function An(r){let e=r.collateralSource??Je;return e==="intel"?async t=>(await We("getCollateralFromPcs"))(t):async t=>(await We("getCollateral"))(e,t)}function Kt(r,e){let t=e.maxCollateralAgeDays;return t===void 0?r:async n=>{let s=await r(n),i;try{i=Date.parse(JSON.parse(s.tcb_info).issueDate??"")}catch{i=Number.NaN}if(!Number.isFinite(i))throw new Error("The quote's collateral names no TCB info issue date");let o=((e.now??Date.now)()-i)/864e5;if(o>t)throw new Error(`The quote's collateral was issued ${Math.floor(o)} days ago, more than the ${t} this client accepts`);return s}}async function bn(r,e,t,n){let s=Bt(r,t.minReleaseVersion),i=await Ae({release:await wn(s,t,n),profile:t.profile??$,allowDebugProfile:t.allowDebugProfile,minReleaseVersion:t.minReleaseVersion,identity:t.identity,issuer:t.issuer}),o=Kt(t.fetchCollateral??An(t),t);return _({dcapVerify:t.dcapVerify??await We("verify"),fetchCollateral:o,now:t.now,...i})(e)}async function et(r,e,t=(n,s)=>fetch(n,s)){let n=R(crypto.getRandomValues(new Uint8Array(32))),s=new URL(`${r.replace(/\/+$/,"")}/attestation`);s.searchParams.set("nonce",n),e.appHash&&s.searchParams.set("appHash",e.appHash);let i=await t(s.toString());if(!i.ok)throw new Error(`The node refused to attest: HTTP ${i.status}`);let o=await i.json(),a=fe(o.transportKey,"transportKey",32),c=e.appHash?fe(e.appHash,"appHash",32):new Uint8Array(32),d=await Le(c,a),u=mn(o.quote),g=new TextEncoder().encode(_t);if(Xe(u.slice(0,g.length),g)){if(!e.allowMock)throw new Error("mock quote refused: this client only trusts real TEEs");let f=u.slice(g.length,g.length+64);if(!Xe(f.slice(0,32),fe(n,"nonce",32))||!Xe(f.slice(32),d))throw new Error("the quote does not bind this transport key, app and nonce");return a}let p={quoteB64:o.quote,nonce:n,reportDataSuffix:R(d)},h;if(e.verifyQuote)h=await e.verifyQuote(p);else if(e.release)h=await bn(o,p,e.release,t);else throw new Error("real quote refused: this client trusts no TD image (set policy.release)");if(!h)throw new Error("The attestation did not verify, so its transport key is not trusted");return a}var tt="https://manager.cloud.calimero.network/api/v2/directory";var T=class extends Error{constructor(t,n,s,i,o){super(`directory for cluster ${t}: ${s}`);this.cluster=t;this.reason=n;this.status=i;this.cause=o;this.name="DirectoryError"}};function En(r,e){return`${r.replace(/\/+$/,"")}/${encodeURIComponent(e)}`}async function rt(r,e,t){let n;try{n=await t(En(r,e),{method:"GET",headers:{accept:"application/json"}})}catch(u){throw new T(e,"unreachable",`could not be reached: ${String(u)}`,void 0,u)}if(n.status===404)throw new T(e,"not-found","unknown cluster",404);if(!n.ok)throw new T(e,"unreachable",`answered ${n.status}`,n.status);let s;try{s=await n.json()}catch(u){throw new T(e,"bad-response","answered something other than JSON",n.status,u)}let i=s;if(!i||typeof i!="object"||!Array.isArray(i.nodes))throw new T(e,"bad-response","answered no node list",n.status);let o=[],a=new Set;for(let u of i.nodes){let g=Rn(u);g&&!a.has(g.url)&&(a.add(g.url),o.push(g))}if(o.length===0)throw new T(e,"empty","lists no usable node",n.status);let c=i.refreshAfterSeconds,d=typeof c=="number"&&Number.isFinite(c)&&c>=1?c:60;return{nodes:o,refreshAfterSeconds:d}}function Rn(r){if(!r||typeof r!="object")return;let{url:e,zone:t,weight:n}=r;if(typeof e!="string"||typeof n!="number"||!Number.isInteger(n)||n<1)return;let s;try{s=new URL(e)}catch{return}if(!(s.protocol!=="https:"&&s.protocol!=="http:"))return{url:e.replace(/\/+$/,""),zone:typeof t=="string"?t:void 0,weight:n}}function nt(r,e,t){let n=e===void 0?[]:r.filter(i=>i.zone===e),s=e===void 0?r:r.filter(i=>i.zone!==e);return[...Vt(n,t),...Vt(s,t)]}function Vt(r,e){let t=[...r],n=[];for(;t.length>0;){let s=e()*t.reduce((o,a)=>o+a.weight,0),i=0;for(;i<t.length-1&&s>=t[i].weight;)s-=t[i++].weight;n.push(t.splice(i,1)[0].url)}return n}var w=class extends Error{constructor(t,n,s,i={}){super(`${t} ${n}: ${s}`);this.status=t;this.code=n;this.details=i;this.name="CalimeroError"}},z=class extends w{constructor(e,t={}){super(401,"UNAUTHENTICATED",e,t),this.name="LoginRequired"}},B=class extends w{constructor(e,t={}){super(421,"WRONG_NODE",e,t),this.name="WrongNode"}},be=class extends w{constructor(e,t={}){super(404,"NOT_FOUND",e,t),this.name="NotFound"}},Y=class extends w{constructor(e,t={}){super(412,"CONFIRM_REQUIRED",e,t),this.name="ConfirmRequired"}},ie=class extends Error{constructor(t){super("the passkey confirmation was cancelled");this.cause=t;this.name="ConfirmCancelled"}},Ee=class extends w{constructor(e,t={}){super(413,"ARGS_TOO_LARGE",e,t),this.name="ArgsTooLarge"}},Re=class extends w{constructor(e,t={}){super(409,"IDEMPOTENCY_MISMATCH",e,t),this.name="IdempotencyMismatch"}},Pe=class extends w{constructor(e,t={}){super(409,"RELEASE_DEADLINE",e,t),this.name="ReleaseDeadlineError",this.release=typeof t.release=="string"?t.release:"",this.after=typeof t.after=="string"?t.after:""}},Ue=class extends w{constructor(e,t={}){super(409,"CONSENT_STALE",e,t),this.name="ConsentStale"}},xe=class extends w{constructor(e,t={}){super(422,"APP_ERROR",e,t),this.name="AppError";let{appCode:n,fields:s}=Pn(t);this.appCode=n,this.fields=s}},Te=class extends w{constructor(e,t={}){super(422,"TRAP",e,t),this.name="TrapError",this.kind=typeof t.kind=="string"?t.kind:""}},K=class extends w{constructor(e,t,n={},s,i){super(503,e,t,n),this.name="UnavailableError",this.reason=e.toLowerCase(),this.committed=e==="TIMEOUT"||e==="MIGRATING"?!1:"unknown",this.retryAfter=s,this.cause=i}};function Ce(r){return r&&typeof r=="object"&&!Array.isArray(r)?r:{}}function Pn(r){let e=typeof r.code=="string"?r:Ce(r.error);return{appCode:typeof e.code=="string"?e.code:"",fields:{...Ce(e.fields)}}}function Un(r,e){for(let t of[r.retryAfter,e==null?void 0:Number(e)])if(typeof t=="number"&&Number.isFinite(t)&&t>=0)return t}function Se(r,e,t){let n=Ce(e),s=typeof n.error=="string"?n.error:"ERROR",i=typeof n.message=="string"?n.message:"",o=Ce(n.details);if(r===503)return new K(s,i,o,Un(o,t));switch(`${r} ${s}`){case"401 UNAUTHENTICATED":return new z(i,o);case"421 WRONG_NODE":return new B(i,o);case"404 NOT_FOUND":return new be(i,o);case"409 IDEMPOTENCY_MISMATCH":return new Re(i,o);case"409 RELEASE_DEADLINE":return new Pe(i,o);case"409 CONSENT_STALE":return new Ue(i,o);case"412 CONFIRM_REQUIRED":return new Y(i,o);case"413 ARGS_TOO_LARGE":return new Ee(i,o);case"422 APP_ERROR":return new xe(i,o);case"422 TRAP":return new Te(i,o);default:return new w(r,s,i,o)}}function C(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function I(r){let e=r.replace(/-/g,"+").replace(/_/g,"/")+"===".slice((r.length+3)%4),t=atob(e),n=new Uint8Array(t.length);for(let s=0;s<t.length;s++)n[s]=t.charCodeAt(s);return n}var oe=r=>r.buffer.slice(r.byteOffset,r.byteOffset+r.byteLength);function Lt(r){let e=new Error(r);return e.name="NotAllowedError",e}function xn(){return{async create(r){let e=r,t=await navigator.credentials.create({publicKey:{challenge:oe(I(e.challenge)),rp:e.rp,user:{...e.user,id:oe(I(e.user.id))},pubKeyCredParams:e.pubKeyCredParams,excludeCredentials:(e.excludeCredentials??[]).map(s=>({type:s.type,id:oe(I(s.id))})),authenticatorSelection:e.authenticatorSelection,attestation:"none",timeout:e.timeout}});if(!t)throw Lt("passkey creation was cancelled");let n=t.response;return{attestationObject:C(new Uint8Array(n.attestationObject)),clientDataJson:C(new Uint8Array(n.clientDataJSON))}},async get(r,e,t){let n=await navigator.credentials.get({publicKey:{challenge:oe(r),rpId:e,userVerification:"preferred",allowCredentials:(t??[]).map(i=>({type:"public-key",id:oe(I(i))}))}});if(!n)throw Lt("passkey sign-in was cancelled");let s=n.response;return{credentialId:C(new Uint8Array(n.rawId)),authenticatorData:C(new Uint8Array(s.authenticatorData)),clientDataJson:C(new Uint8Array(s.clientDataJSON)),signature:C(new Uint8Array(s.signature))}}}}var st=100;function ce(r={}){let e=new URLSearchParams;if(r.after!==void 0&&e.set("after",r.after),r.limit!==void 0){if(!Number.isInteger(r.limit)||r.limit<1||r.limit>st)throw new RangeError(`limit is 1 to ${st}`);e.set("limit",String(r.limit))}let t=e.toString();return t?`?${t}`:""}function ae(r,e){try{return se(r,e)}catch{return r<e?-1:r>e?1:0}}function Ht(r,e,t=Date.now()/1e3){if(r===null||r.length===0)return null;let n=r.reduce((i,o)=>ae(i,o)>=0?i:o),s=null;for(let i of e)i.afterSecs<=t&&ae(n,i.version)<0&&(s===null||ae(i.version,s.version)>0)&&(s=i);return s}function Ft(r,e,t,n){return`calimero-publisher-binding/v1
2
2
  ${r}
3
3
  ${e}
4
4
  ${t}
5
- ${n}`}function xn(r,e,t,n){return new TextEncoder().encode(Ht(r,e,t,n))}var Tn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";async function st(r){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(r))),t=(e[0]<<24|e[1]<<16|e[2]<<8|e[3])>>>0,n="";for(let i=0;i<6;i++)i===3&&(n+="-"),n+=Tn[t>>>27-5*i&31];return n}function Sn(r){let e=typeof r=="string"?new URL(r):r,t=e.searchParams.get("request_id"),n=e.searchParams.get("result");return!t||n!=="approved"&&n!=="declined"?null:{requestId:t,result:n}}var Ft="https://mero-tee.vercel.app";function Gt(r){return`https://github.com/calimero-network/mero-tee/releases/tag/mero-tee-v${encodeURIComponent(r)}`}function jt(r){return`${Ft}/mero-tee?release_tag=${encodeURIComponent(`mero-tee-v${r}`)}`}function ot(r,e,t=Date.now()/1e3){let n=c=>e.deadlines.find(l=>l.version===c)??null,i=r.governance.releases==="owner",s=r.governance.appUpgrades==="owner",o=r.clusterReleases.filter(c=>!c.approved).sort((c,l)=>ae(l.release,c.release)).map(c=>({version:c.release,nodes:c.nodes,actionable:i,releaseNotesUrl:Gt(c.release),verifyUrl:jt(c.release),deadline:n(c.release)})),a=[];for(let c of r.apps){let l=c.availableVersions??[];c.package===null||l.length===0||a.push({app:c.app,name:c.name??null,package:c.package.package,from:c.package.version,to:l[l.length-1],available:l,actionable:s})}return{scope:r.scope,governance:r.governance,approvedReleases:r.approvedReleases,releases:o,upgrades:a,stalledBy:Lt(r.approvedReleases,e.deadlines,t),actionable:o.some(c=>c.actionable)||a.some(c=>c.actionable)}}function qt(r,e,t,n={}){return{kind:"release",scope:r.kind==="org"?{org:r.org}:"account",subject:n.withdraw?{version:e,withdraw:!0}:{version:e},returnTo:t}}function Cn(r,e,t){return qt(r,e,t,{withdraw:!0})}function vn(r,e,t){return{kind:"upgrade",subject:{app:r,toVersion:e},returnTo:t}}function d(r){return encodeURIComponent(r)}function kn(r){return r instanceof C&&r.status===413?Ce(413,{error:"TOO_LARGE",message:r.message.replace(/^Sealed request refused: /,"")}):r}async function Qt(r){let e=await r.text().catch(()=>""),t={};try{t=e?JSON.parse(e):{}}catch{t={message:e}}return Ce(r.status,t,r.headers.get("retry-after"))}async function*In(r){let e=r.getReader(),t=new TextDecoder,n="";for(;;){let{value:i,done:s}=await e.read();if(s)return;n+=t.decode(i,{stream:!0});let o;for(;(o=n.indexOf(`
5
+ ${n}`}function Tn(r,e,t,n){return new TextEncoder().encode(Ft(r,e,t,n))}var Cn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";async function it(r){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(r))),t=(e[0]<<24|e[1]<<16|e[2]<<8|e[3])>>>0,n="";for(let s=0;s<6;s++)s===3&&(n+="-"),n+=Cn[t>>>27-5*s&31];return n}function Sn(r){let e=typeof r=="string"?new URL(r):r,t=e.searchParams.get("request_id"),n=e.searchParams.get("result");return!t||n!=="approved"&&n!=="declined"?null:{requestId:t,result:n}}var Gt="https://mero-tee.vercel.app";function jt(r){return`https://github.com/calimero-network/mero-tee/releases/tag/mero-tee-v${encodeURIComponent(r)}`}function qt(r){return`${Gt}/mero-tee?release_tag=${encodeURIComponent(`mero-tee-v${r}`)}`}function ot(r,e,t=Date.now()/1e3){let n=c=>e.deadlines.find(d=>d.version===c)??null,s=r.governance.releases==="owner",i=r.governance.appUpgrades==="owner",o=r.clusterReleases.filter(c=>!c.approved).sort((c,d)=>ae(d.release,c.release)).map(c=>({version:c.release,nodes:c.nodes,actionable:s,releaseNotesUrl:jt(c.release),verifyUrl:qt(c.release),deadline:n(c.release)})),a=[];for(let c of r.apps){let d=c.availableVersions??[];c.package===null||d.length===0||a.push({app:c.app,name:c.name??null,package:c.package.package,from:c.package.version,to:d[d.length-1],available:d,actionable:i})}return{scope:r.scope,governance:r.governance,approvedReleases:r.approvedReleases,releases:o,upgrades:a,stalledBy:Ht(r.approvedReleases,e.deadlines,t),actionable:o.some(c=>c.actionable)||a.some(c=>c.actionable)}}function Qt(r,e,t,n={}){return{kind:"release",scope:r.kind==="org"?{org:r.org}:"account",subject:n.withdraw?{version:e,withdraw:!0}:{version:e},returnTo:t}}function kn(r,e,t){return Qt(r,e,t,{withdraw:!0})}function vn(r,e,t){return{kind:"upgrade",subject:{app:r,toVersion:e},returnTo:t}}function Zt(r){return"account"in r?`account:${r.account}`:`org:${r.org}`}async function In(r,e=fetch){let t=r??globalThis.location?.origin;if(!t)throw new Error("no page origin to read the frontend manifest from; pass `origin`");let n=await e(new URL("/.well-known/calimero.json",t).toString());if(!n.ok)throw await at(n);let s=await n.json();return{...s,deployments:s.deployments??[]}}function Dn(r){let e=r??globalThis.location?.href;if(!e)return null;try{return new URL(e).searchParams.get("deployment")||null}catch{return null}}function l(r){return encodeURIComponent(r)}function On(r){return r instanceof S&&r.status===413?Se(413,{error:"TOO_LARGE",message:r.message.replace(/^Sealed request refused: /,"")}):r}async function at(r){let e=await r.text().catch(()=>""),t={};try{t=e?JSON.parse(e):{}}catch{t={message:e}}return Se(r.status,t,r.headers.get("retry-after"))}async function*Nn(r){let e=r.getReader(),t=new TextDecoder,n="";for(;;){let{value:s,done:i}=await e.read();if(i)return;n+=t.decode(s,{stream:!0});let o;for(;(o=n.indexOf(`
6
6
 
7
- `))>=0;){let a=n.slice(0,o);n=n.slice(o+2);let c="",l="",u="";for(let p of a.split(`
8
- `))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?l=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!l&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:l,data:g}}}}function Jt(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function zt(){return`node:c-${S(crypto.getRandomValues(new Uint8Array(16)))}`}var On={retries:6,baseDelayMs:200,maxDelayMs:2e3};function Dn(r,e){return Math.min(e.baseDelayMs*2**r,e.maxDelayMs)}function Yt(r){return r==="auth/refresh"||r.startsWith("auth/passkey/")}var at=class r{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;let t=s=>s.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(t))],this.policy=e.policy,this.retry={...On,...e.retry};let n=e.fetch??((s,o)=>fetch(s,o)),i=async(s,o)=>{try{return await n(s,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=i}static async connect(e){let t=e.directory??tt,n=e.random??Math.random,i=e.fetch??((l,u)=>fetch(l,u)),s=await rt(t,e.cluster,i),[o,...a]=nt(s.nodes,e.zone,n),c=new r({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:t,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+s.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let t=this.channels.get(e);return t||(t=He({baseUrl:e,transportPublicKey:()=>et(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,t)),t}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,t){if(this.nodeUrl!==e&&!t.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let i=1;i<n;i++){let s=(this.at+i)%n;if(!t.has(this.nodeUrls[s]))return this.at=s,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=rt(e.directory,e.cluster,this.raw).then(t=>{let n=this.nodeUrl,i=nt(t.nodes,e.zone,e.random);this.nodeUrls=[n,...i.filter(s=>s!==n)],this.at=0,e.due=Date.now()+t.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,t,n,i,s="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;i?(a["content-type"]=s,c=i):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let l=this.nodeUrl;try{return await this.channel(l)(`${l}/${t}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw kn(u)}}async send(e,t,n,i,s,o){let a=!1,c=!1;for(;;){let[l,u]=[this.auth,this.nodeUrl],g=await this.request(e,t,n,i,s,o);if(g.ok)return g;let p=await Qt(g);if(p instanceof B&&!c){if(c=!0,this.moveOn(u)&&!Yt(t))continue}else if(p instanceof z&&!a&&this.mayRefresh(l,t)){a=!0,await this.renew(l);continue}throw p}}mayRefresh(e,t){return e!==void 0&&this.current!==void 0&&!Yt(t)}async renew(e){this.auth===e&&await this.refresh()}async json(e,t,n,i,s){let a=await(await this.send(e,t,n,i,s)).text();return a?JSON.parse(a):{}}async retried(e,t,n,i=!1){let s=i?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let l=0;;l++){c=this.nodeUrl,o.add(c);try{return await this.json(e,t,n)}catch(g){if(g instanceof K)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new K("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(l>=s)break;let u=Dn(l,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(i||!this.failOver(c,o))throw a}}post(e,t={}){return this.json("POST",e,t)}get(e){return this.json("GET",e)}put(e,t={}){return this.json("PUT",e,t)}delete(e,t){return this.json("DELETE",e,t)}async signUp(e,t){let n=await this.post("auth/passkey/register/begin",{name:t}),i=await e.create(n.options),s=await this.post("auth/passkey/register/finish",{challengeId:n.challengeId,registration:i});return this.useSession(s),s}async signIn(e){let t=await this.post("auth/passkey/login/begin"),n=await e.get(I(t.options.challenge),t.options.rpId),i=await this.post("auth/passkey/login/finish",{challengeId:t.challengeId,assertion:n});return this.useSession(i),i}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let t=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(t,t)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let t;for(let n=1;t===void 0;n++)try{t=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(i){if(!(i instanceof B)||n>=this.nodeUrls.length)throw i}return this.current===e&&this.useSession(t),t}async signOut(){await this.post("auth/logout"),this.auth=void 0,this.current=void 0}async signOutEverywhere(){await this.post("auth/logout-all"),this.auth=void 0,this.current=void 0}me(){return this.get("auth/me")}async addPasskey(e,t){let n=await this.post("auth/passkeys/add/begin"),i=await e.create(n.options),{credentialId:s}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:i},t);return s}async removePasskey(e,t){await this.deleteConfirmed(`auth/passkeys/${d(e)}`,t)}async labelPasskey(e,t){await this.post(`auth/passkeys/${d(e)}`,{label:t})}usage(){return this.get("auth/usage")}async attestation(){let e=Jt(crypto.getRandomValues(new Uint8Array(32))),t=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!t.ok)throw await Qt(t);return await t.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e){await this.delete(`auth/apikeys/${d(e)}`)}createApiKey(e,t){return this.postConfirmed("auth/apikeys",{...e},t)}async uploadBundle(e){let{hash:t}=await this.json("POST","bundles",void 0,e);return t}uploadBlob(e,t){return this.json("POST",`apps/${d(e)}/blobs`,void 0,t)}async downloadBlob(e,t){let n=await this.send("GET",`apps/${d(e)}/blobs/${d(t)}`);return new Uint8Array(await n.arrayBuffer())}async listBlobs(e){let{blobs:t}=await this.get(`apps/${d(e)}/blobs`);return t}blobInfo(e,t){return this.get(`apps/${d(e)}/blobs/${d(t)}/info`)}async deleteBlob(e,t){await this.delete(`apps/${d(e)}/blobs/${d(t)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,t){return this.post("packages/install",{package:e,version:t})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${d(e)}`)}uninstallPackage(e,t){return this.delete(t===void 0?`packages/${d(e)}`:`packages/${d(e)}/${d(t)}`)}async listApps(e={}){let t=new URLSearchParams;e.package&&t.set("package",e.package),e.bundle&&t.set("bundle",e.bundle);let n=t.toString(),{apps:i}=await this.get(n?`apps?${n}`:"apps");return i}getApp(e){return this.get(`apps/${d(e)}`)}async deleteApp(e){await this.delete(`apps/${d(e)}`)}async setAccess(e,t){await this.post(`apps/${d(e)}/access`,{access:t})}async setAppMetadata(e,t){await this.post(`apps/${d(e)}/metadata`,{metadata:t})}appStorage(e){return this.get(`apps/${d(e)}/storage`)}appAbi(e){return this.get(`apps/${d(e)}/abi`)}async transferApp(e,t,n){await this.postConfirmed(`apps/${d(e)}/transfer`,{to:t},n)}upgradeApp(e,t,n){let i=`apps/${d(e)}/upgrade`;return n?this.postConfirmed(i,t,n):this.post(i,t)}postConfirmed(e,t,n){return this.confirmed("POST",e,t,n)}deleteConfirmed(e,t,n={}){return this.confirmed("DELETE",e,n,t)}async confirmed(e,t,n,i,s=o=>this.json(e,t,o)){try{return await s(n)}catch(o){if(!(o instanceof Y)||!i)throw o;let a=o.details,c;try{c=await i.get(I(a.challenge),a.rpId,a.allowCredentials)}catch(l){let u=l?.name;throw u==="NotAllowedError"||u==="AbortError"?new se(l):l}return s({...n,confirm:{challengeId:a.challengeId,assertion:c}})}}async createApp(e,t,n={}){let i=typeof t=="string"?{bundle:t}:t,{appId:s}=await this.post("apps",{name:e,...i,...n});return s}call(e,t,n={},i){let s=i??zt();return this.retried("POST",`apps/${d(e)}/intents`,{method:t,args:n,idempotencyKey:s})}async callConfirmed(e,t,n,i,s){let o=`apps/${d(e)}/intents`,a=s??zt();return this.confirmed("POST",o,{method:t,args:n,idempotencyKey:a},i,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,t,n={},i={}){return this.retried("POST",`apps/${d(e)}/views`,{method:t,args:n,consistency:i.stale?"stale":"strong",minIndex:i.minIndex??0})}events(e,t=0,n){return this.stream(`apps/${d(e)}/events?from=${t}`,n)}async*stream(e,t){let n=await this.send("GET",e,void 0,void 0,void 0,t);if(!n.body)throw new w(n.status,"EVENTS","the event stream has no body");yield*In(n.body)}async publishPresence(e,t,n){await this.post(`apps/${d(e)}/presence`,{seq:t,state:n===null?null:Jt(n)})}async presence(e){let{present:t}=await this.get(`apps/${d(e)}/presence`);return t}presenceStream(e,t){return this.stream(`apps/${d(e)}/presence/stream`,t)}async setAlias(e,t){await this.put(`auth/aliases/${d(e)}`,{app:t})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:t}=await this.get(`auth/aliases/${d(e)}`);return t}async deleteAlias(e){await this.delete(`auth/aliases/${d(e)}`)}async createOrg(e){let{orgId:t}=await this.post("orgs",{name:e});return t}getOrg(e){return this.get(`orgs/${d(e)}`)}async deleteOrg(e,t){await this.deleteConfirmed(`orgs/${d(e)}`,t)}async setOrgMetadata(e,t){await this.post(`orgs/${d(e)}/metadata`,{metadata:t})}async setMemberMetadata(e,t,n){await this.post(`orgs/${d(e)}/members/${d(t)}/metadata`,{metadata:n})}upgradeOrg(e,t,n){return this.postConfirmed(`orgs/${d(e)}/upgrade`,{...t},n)}upgradeRun(e,t){return this.get(`orgs/${d(e)}/upgrades/${d(t)}`)}retryUpgradeRun(e,t,n){return this.postConfirmed(`orgs/${d(e)}/upgrades/${d(t)}/retry`,{},n)}async approveRelease(e,t,n,i=!0){let s=e===null?"auth/releases":`orgs/${d(e)}/releases`;return this.postConfirmed(s,{version:t,approved:i},n)}async approveOutbound(e,t,n,i={}){let s=e===null?"auth/outbound":`orgs/${d(e)}/outbound`;return this.postConfirmed(s,{package:t,prefixes:i.prefixes??"manifest",replace:i.replace??!1},n)}appsReport(e,t={}){let n=e===null?"auth/apps":`orgs/${d(e)}/apps`;return this.get(`${n}${ce(t)}`)}async appsReportAll(e){let t=await this.appsReport(e),n=[...t.apps],i=t.next;for(;i!==null;){let s=await this.appsReport(e,{after:i});n.push(...s.apps),i=s.next}return{...t,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[t,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return ot(t,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,t={}){let n=typeof t=="function"?{navigate:t}:t,i=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),s=await this.requestConsent(e);if(s.code!==void 0){let o=await st(s.requestId);if(s.code!==o)throw new w(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:s.requestId,code:s.code,expected:o})}return n.confirm&&!await n.confirm(s)||i(s.url),s}consentResult(e){return this.get(`consent/${d(e)}/result`)}async waitForConsent(e,t={}){let n=t.intervalMs??2e3;for(;;){let i=await this.consentResult(e);if(i.status!=="pending"||t.signal?.aborted||t.expiresAt!==void 0&&Date.now()/1e3>=t.expiresAt)return i;await new Promise(s=>setTimeout(s,n))}}publisherBinding(e){return this.get(`publishers/${d(e)}`)}bindPublisher(e,t,n){return this.postConfirmed(`orgs/${d(e)}/publishers`,{...t},n)}upgradePublished(e,t,n,i){return this.postConfirmed(`orgs/${d(e)}/packages/${d(t)}/upgrade`,{...n},i)}opsApps(e={}){return this.get(`ops/apps${ce(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ce(e)}`)}async setReleaseDeadline(e,t){let n=typeof t=="string"?t:t.toISOString();await this.post(`ops/releases/${d(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${d(e)}/deadline`)}async setMember(e,t,n,i){await this.postConfirmed(`orgs/${d(e)}/members`,{account:t,role:n},i)}removeMember(e,t,n){return this.deleteConfirmed(`orgs/${d(e)}/members/${d(t)}`,n)}async setCapabilities(e,t,n,i={}){await this.postConfirmed(`orgs/${d(e)}/capabilities`,{capabilities:t,...i},n)}async createTeam(e,t,n,i){let{teamId:s}=await this.post(`orgs/${d(e)}/teams`,{name:t,join:n,parent:i});return s}getTeam(e,t){return this.get(`orgs/${d(e)}/teams/${d(t)}`)}async updateTeam(e,t,n){await this.post(`orgs/${d(e)}/teams/${d(t)}`,n)}async deleteTeam(e,t){await this.delete(`orgs/${d(e)}/teams/${d(t)}`)}async setTeamMember(e,t,n,i,s={}){await this.postConfirmed(`orgs/${d(e)}/teams/${d(t)}/members`,{account:n,...s},i)}async removeTeamMember(e,t,n,i){await this.deleteConfirmed(`orgs/${d(e)}/teams/${d(t)}/members/${d(n)}`,i)}async invite(e,t,n,i=[],s={}){let{token:o}=await this.postConfirmed(`orgs/${d(e)}/invites`,{role:t,teams:i,...s},n);return o}redeemInvite(e){return this.post(`invites/${d(e)}/redeem`)}};var ct={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},Nn=ct.JOIN_OPEN_TEAMS;function Mn(...r){return r.reduce((e,t)=>e|ct[t],0)}function ve(r,e){return(r<<e|r>>>32-e)>>>0}function O(r,e,t,n,i){r[e]=r[e]+r[t]>>>0,r[i]=ve(r[i]^r[e],16),r[n]=r[n]+r[i]>>>0,r[t]=ve(r[t]^r[n],12),r[e]=r[e]+r[t]>>>0,r[i]=ve(r[i]^r[e],8),r[n]=r[n]+r[i]>>>0,r[t]=ve(r[t]^r[n],7)}function Zt(r,e){return(r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24)>>>0}function er(r,e,t){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=Zt(r,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=Zt(t,o*4);let i=n.slice();for(let o=0;o<10;o+=1)O(i,0,4,8,12),O(i,1,5,9,13),O(i,2,6,10,14),O(i,3,7,11,15),O(i,0,5,10,15),O(i,1,6,11,12),O(i,2,7,8,13),O(i,3,4,9,14);let s=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=i[o]+n[o]>>>0;s[o*4]=a&255,s[o*4+1]=a>>>8&255,s[o*4+2]=a>>>16&255,s[o*4+3]=a>>>24&255}return s}function _n(r,e,t,n){let i=new Uint8Array(n.length);for(let s=0,o=e;s<n.length;s+=64,o+=1){let a=er(r,o,t),c=Math.min(s+64,n.length);for(let l=s;l<c;l+=1)i[l]=n[l]^a[l-s]}return i}function lt(r){let e=0n;for(let t=r.length-1;t>=0;t-=1)e=e<<8n|BigInt(r[t]);return e}var $n=(1n<<130n)-5n;function Bn(r,e){let t=lt(r.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=lt(r.subarray(16,32)),i=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),l=lt(c)+(1n<<BigInt(8*c.length));i=(i+l)*t%$n}let s=i+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(s&0xffn),s>>=8n;return o}function Wt(r){return new Uint8Array((16-r%16)%16)}function Xt(r){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(r),!0),e}function Kn(r,e){let t=[r,Wt(r.length),e,Wt(e.length),Xt(r.length),Xt(e.length)],n=new Uint8Array(t.reduce((s,o)=>s+o.length,0)),i=0;for(let s of t)n.set(s,i),i+=s.length;return n}function Vn(r,e){if(r.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function tr(r,e,t,n=new Uint8Array(0)){Vn(r,e);let i=er(r,0,e).subarray(0,32),s=_n(r,1,e,t),o=Bn(i,Kn(n,s)),a=new Uint8Array(s.length+16);return a.set(s),a.set(o,s.length),a}var nr=32,Ln=1,Hn=3,Fn=2,Gn=32,jn=32,qn=12,Z=r=>new TextEncoder().encode(r),ue=r=>new Uint8Array([r>>8&255,r&255]),rr=y(Z("KEM"),ue(nr)),le=y(Z("HPKE"),ue(nr),ue(Ln),ue(Hn));async function ir(r,e){let t=r.length===0?new Uint8Array(32):r,n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function Qn(r,e,t){let n=new Uint8Array(t),i=new Uint8Array(0);for(let s=1,o=0;o<t;s+=1)i=await ir(r,y(i,e,new Uint8Array([s]))),n.set(i.subarray(0,Math.min(i.length,t-o)),o),o+=i.length;return n}function ke(r,e,t,n){return ir(e,y(Z("HPKE-v1"),r,Z(t),n))}function ut(r,e,t,n,i){return Qn(e,y(ue(i),Z("HPKE-v1"),r,Z(t),n),i)}async function Jn(r,e){let t=await ke(rr,new Uint8Array(0),"eae_prk",r);return ut(rr,t,"shared_secret",e,Gn)}async function zn(r,e){let t=new Uint8Array(0),n=await ke(le,t,"psk_id_hash",t),i=await ke(le,t,"info_hash",e),s=y(new Uint8Array([Fn]),n,i),o=await ke(le,r,"secret",t);return{key:await ut(le,o,"key",s,jn),nonce:await ut(le,o,"base_nonce",s,qn)}}async function sr(r,e,t,n,i=new Uint8Array(0),s){if(r.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await G(s),a=await G(e),c=y(await X(o.privateKey,r),await X(a.privateKey,r)),l=await Jn(c,y(o.publicKey,r,a.publicKey)),{key:u,nonce:g}=await zn(l,t);return{enc:o.publicKey,ciphertext:tr(u,g,n,i)}}var cr="mero-agent-gate/attest/v3",lr="mero-agent-gate/provision/v2",Yn=/^[a-z0-9][a-z0-9-]{0,62}$/,Zn=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,or=64,ar=64*1024,D=class extends Error{constructor(t,n,i){super(t);this.status=n;this.code=i;this.name="AgentGateError"}};function ur(r){if(!Yn.test(r))throw new Error(`Agent id ${JSON.stringify(r)} must match [a-z0-9][a-z0-9-]{0,62}`)}function de(r){return new TextEncoder().encode(r)}function dr(r){let e=de(r);return y(new Uint8Array([e.length]),e)}function V(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}function Ie(r,e,t){let n;try{n=Uint8Array.from(atob(r.trim()),i=>i.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(t!==void 0&&n.length!==t)throw new Error(`${e} is not ${t} bytes`);return n}async function gr(r,e,t,n){let i=new Uint8Array(32),s=y(de(cr),r,dr(e),t??i,n??i);return new Uint8Array(await crypto.subtle.digest("SHA-256",s))}function pr(r,e){return y(de(lr),r,dr(e))}async function Wn(){let r=crypto.getRandomValues(new Uint8Array(32));return{secret:r,publicKey:await Oe(r)}}async function Oe(r){if(r.length!==32)throw new Error("An owner key is 32 bytes");return V((await G(r)).publicKey)}function fr(r,e){return`${r.replace(/\/+$/,"")}${e}`}async function yr(r,e,t){let n=await r(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),i=await n.text(),s;try{s=i?JSON.parse(i):void 0}catch{}if(!n.ok){let o=s;throw new D(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??i.slice(0,200)}`,n.status,o?.error)}return s}async function dt(r){let e=r.agentId??"";e&&ur(e);let t=crypto.getRandomValues(new Uint8Array(32)),n=await yr(r.fetch??fetch,fr(r.gateUrl,"/attest"),{nonceB64:V(t),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let i=Ie(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),s=n.signingPublicKeyB64?Ie(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ie(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!s!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await gr(i,e,s,o);return await r.verifier({quoteB64:n.quoteB64,nonce:R(t),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:V(i),...s?{signingPublicKey:V(s)}:{},...o?{ownerPublicKey:V(o)}:{}}}async function hr(r,e){let t=await Oe(e);if(r.ownerPublicKey&&r.ownerPublicKey!==t)throw new D(`This agent is claimed by another key (${r.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return t}function Xn(r){let e=Object.keys(r);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>or)throw new Error(`At most ${or} secrets at once`);for(let t of e){if(!Zn.test(t))throw new Error(`Secret name ${JSON.stringify(t)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof r[t]!="string")throw new Error(`Secret ${t} is not a string`);if(de(r[t]).length>ar)throw new Error(`Secret ${t} is over ${ar} bytes`)}}async function mr(r,e,t,n,i,s){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await hr(n,i),a=Ie(n.provisioningPublicKey,"provisioningPublicKey",32),c=await sr(a,i,pr(a,n.agentId),de(JSON.stringify(s)));return yr(r,fr(e,t),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:V(c.enc),ciphertextB64:V(c.ciphertext)})}async function ei(r){Xn(r.secrets);let e=r.fetch??fetch,t=await mr(e,r.gateUrl,"/provision",r.agent,r.ownerSecret,{secrets:r.secrets}),n=await dt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e}),i=await Oe(r.ownerSecret);if(n.ownerPublicKey!==i||!n.signingPublicKey)throw new D("The gate accepted the secrets, but its quote does not name your key as owner");if(r.agent.signingPublicKey&&r.agent.signingPublicKey!==n.signingPublicKey)throw new D("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:i,written:t?.written??[],claimed:t?.claimed===!0}}async function ti(r){if(!r.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=r.fetch??fetch;if(await mr(e,r.gateUrl,"/release",r.agent,r.ownerSecret,{release:!0}),(await dt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e})).ownerPublicKey)throw new D("The gate says it released the agent, but its quote still names an owner")}var gt=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),ri=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function ni(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??gt.identity,issuer:t.issuer??gt.issuer});let i;try{i=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let s=t.role??"agent";if(i?.role!==s)throw new Error(`The signed file is a ${JSON.stringify(i?.role)} policy, not an ${s} one`);let o=t.profile??_;if(i.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(i.profile)} profile, not ${o}`);if(t.expectedVersion!==void 0&&i.version!==t.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(i.version)}, not ${t.expectedVersion}`);return wr(i),i}function wr(r){for(let e of ri)if(!Array.isArray(r?.[e])||r[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var ii=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function si(r){let e=ii.find(t=>t.toLowerCase()===r.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(r)}`);return e}var ge=r=>r.trim().replace(/^0x/i,"");function oi(r,e){return wr(r),$({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:r.allowed_tcb_statuses.map(si),allowedMrtd:r.allowed_mrtd.map(ge),allowedRtmr0:r.allowed_rtmr0.map(ge),allowedRtmr1:r.allowed_rtmr1.map(ge),allowedRtmr2:r.allowed_rtmr2.map(ge),allowedRtmr3:r.allowed_rtmr3.map(ge)})}export{cr as AGENT_ATTEST_DOMAIN,lr as AGENT_PROVISION_INFO_DOMAIN,D as AgentGateError,xe as AppError,Ee as ArgsTooLarge,at as CalimeroClient,w as CalimeroError,se as ConfirmCancelled,Y as ConfirmRequired,Ue as ConsentStale,Je as DEFAULT_COLLATERAL_MIRROR,tt as DEFAULT_DIRECTORY,Nn as DEFAULT_ORG_CAPABILITIES,we as DEFAULT_RELEASE_MIRROR,T as DirectoryError,Dt as GITHUB_RELEASES,At as HANDSHAKE_PATH,Re as IdempotencyMismatch,gt as KMS_RELEASE_SIGNER,z as LoginRequired,it as MAX_REPORT_PAGE,_t as MOCK_QUOTE_HEADER,Qe as NODE_RELEASE_SIGNER,be as NotFound,ct as ORG_CAPABILITIES,_ as PRODUCTION_PROFILE,Ft as RELEASE_VERIFIER,Pe as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,bt as SEALED_PATH,C as SealedTransportError,re as StaleTransportKeyError,Te as TrapError,K as UnavailableError,B as WrongNode,gr as agentKeyBinding,oi as agentQuoteVerifier,dt as attestAgent,S as b64url,Un as browserPasskey,hr as checkOwner,$t as claimedRelease,Ze as cloudNodeReleaseUrl,ae as compareVersions,st as confirmationCode,Sn as consentReturn,$ as createQuoteVerifier,He as createSealedFetch,yn as createSignedReleaseVerifier,Ce as errorFrom,et as fetchAttestedKey,Ye as fetchGithubNodeRelease,ze as fetchNodeRelease,Bt as freshCollateral,I as fromB64url,Wn as generateOwnerKey,Mn as orgCapabilities,Oe as ownerPublicKey,ce as pageQuery,ot as pendingApprovalsFrom,ei as provisionAgent,pr as provisionInfo,xn as publisherBindingBytes,Ht as publisherBindingMessage,ti as releaseAgent,qt as releaseConsent,Gt as releaseNotesUrl,Lt as stalledBy,Le as transportKeyBinding,Ae as trustSignedRelease,qe as trustedMeasurementsFromReleases,vn as upgradeConsent,ur as validateAgentId,jt as verifyReleaseUrl,ni as verifySignedAgentPolicy,Ot as verifySignedNodeRelease,Cn as withdrawConsent};
7
+ `))>=0;){let a=n.slice(0,o);n=n.slice(o+2);let c="",d="",u="";for(let p of a.split(`
8
+ `))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?d=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!d&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:d,data:g}}}}function Jt(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function zt(){return`node:c-${C(crypto.getRandomValues(new Uint8Array(16)))}`}var Mn={retries:6,baseDelayMs:200,maxDelayMs:2e3};function $n(r,e){return Math.min(e.baseDelayMs*2**r,e.maxDelayMs)}function Yt(r){return r==="auth/refresh"||r.startsWith("auth/passkey/")}var ct=class r{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;let t=i=>i.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(t))],this.policy=e.policy,this.retry={...Mn,...e.retry};let n=e.fetch??((i,o)=>fetch(i,o)),s=async(i,o)=>{try{return await n(i,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=s}static async connect(e){let t=e.directory??tt,n=e.random??Math.random,s=e.fetch??((d,u)=>fetch(d,u)),i=await rt(t,e.cluster,s),[o,...a]=nt(i.nodes,e.zone,n),c=new r({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:t,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+i.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let t=this.channels.get(e);return t||(t=He({baseUrl:e,transportPublicKey:()=>et(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,t)),t}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,t){if(this.nodeUrl!==e&&!t.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let s=1;s<n;s++){let i=(this.at+s)%n;if(!t.has(this.nodeUrls[i]))return this.at=i,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=rt(e.directory,e.cluster,this.raw).then(t=>{let n=this.nodeUrl,s=nt(t.nodes,e.zone,e.random);this.nodeUrls=[n,...s.filter(i=>i!==n)],this.at=0,e.due=Date.now()+t.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,t,n,s,i="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;s?(a["content-type"]=i,c=s):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let d=this.nodeUrl;try{return await this.channel(d)(`${d}/${t}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw On(u)}}async send(e,t,n,s,i,o){let a=!1,c=!1;for(;;){let[d,u]=[this.auth,this.nodeUrl],g=await this.request(e,t,n,s,i,o);if(g.ok)return g;let p=await at(g);if(p instanceof B&&!c){if(c=!0,this.moveOn(u)&&!Yt(t))continue}else if(p instanceof z&&!a&&this.mayRefresh(d,t)){a=!0,await this.renew(d);continue}throw p}}mayRefresh(e,t){return e!==void 0&&this.current!==void 0&&!Yt(t)}async renew(e){this.auth===e&&await this.refresh()}async json(e,t,n,s,i){let a=await(await this.send(e,t,n,s,i)).text();return a?JSON.parse(a):{}}async retried(e,t,n,s=!1){let i=s?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let d=0;;d++){c=this.nodeUrl,o.add(c);try{return await this.json(e,t,n)}catch(g){if(g instanceof K)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new K("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(d>=i)break;let u=$n(d,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(s||!this.failOver(c,o))throw a}}post(e,t={}){return this.json("POST",e,t)}get(e){return this.json("GET",e)}put(e,t={}){return this.json("PUT",e,t)}delete(e,t){return this.json("DELETE",e,t)}async signUp(e,t){let n=await this.post("auth/passkey/register/begin",{name:t}),s=await e.create(n.options),i=await this.post("auth/passkey/register/finish",{challengeId:n.challengeId,registration:s});return this.useSession(i),i}async signIn(e){let t=await this.post("auth/passkey/login/begin"),n=await e.get(I(t.options.challenge),t.options.rpId),s=await this.post("auth/passkey/login/finish",{challengeId:t.challengeId,assertion:n});return this.useSession(s),s}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let t=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(t,t)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let t;for(let n=1;t===void 0;n++)try{t=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(s){if(!(s instanceof B)||n>=this.nodeUrls.length)throw s}return this.current===e&&this.useSession(t),t}async signOut(){await this.post("auth/logout"),this.auth=void 0,this.current=void 0}async signOutEverywhere(){await this.post("auth/logout-all"),this.auth=void 0,this.current=void 0}me(){return this.get("auth/me")}async addPasskey(e,t){let n=await this.post("auth/passkeys/add/begin"),s=await e.create(n.options),{credentialId:i}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:s},t);return i}async removePasskey(e,t){await this.deleteConfirmed(`auth/passkeys/${l(e)}`,t)}async labelPasskey(e,t){await this.post(`auth/passkeys/${l(e)}`,{label:t})}usage(){return this.get("auth/usage")}async attestation(){let e=Jt(crypto.getRandomValues(new Uint8Array(32))),t=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!t.ok)throw await at(t);return await t.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e){await this.delete(`auth/apikeys/${l(e)}`)}createApiKey(e,t){return this.postConfirmed("auth/apikeys",{...e},t)}async uploadBundle(e){let{hash:t}=await this.json("POST","bundles",void 0,e);return t}uploadBlob(e,t,n={}){let s=(typeof n=="string"?n:n.contentType)??"application/octet-stream";return this.json("POST",`apps/${l(e)}/blobs`,void 0,t,s)}async downloadBlob(e,t){return(await this.blobContent(e,t)).data}async downloadBlobGranted(e,t,n){return(await this.blobContent(e,t,{grant:n})).data}async blobContent(e,t,n={}){let s=n.grant===void 0?"":`?grant=${encodeURIComponent(n.grant)}`,i=await this.send("GET",`apps/${l(e)}/blobs/${l(t)}${s}`);return{data:new Uint8Array(await i.arrayBuffer()),contentType:i.headers.get("content-type")??"application/octet-stream"}}async listBlobs(e){let{blobs:t}=await this.get(`apps/${l(e)}/blobs`);return t}blobInfo(e,t){return this.get(`apps/${l(e)}/blobs/${l(t)}/info`)}async deleteBlob(e,t){await this.delete(`apps/${l(e)}/blobs/${l(t)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,t){return this.post("packages/install",{package:e,version:t})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${l(e)}`)}uninstallPackage(e,t){return this.delete(t===void 0?`packages/${l(e)}`:`packages/${l(e)}/${l(t)}`)}async listApps(e={}){let t=new URLSearchParams;e.package&&t.set("package",e.package),e.bundle&&t.set("bundle",e.bundle);let n=t.toString(),{apps:s}=await this.get(n?`apps?${n}`:"apps");return s}getApp(e){return this.get(`apps/${l(e)}`)}async deleteApp(e){await this.delete(`apps/${l(e)}`)}async setAccess(e,t){await this.post(`apps/${l(e)}/access`,{access:t})}async setAppMetadata(e,t){await this.post(`apps/${l(e)}/metadata`,{metadata:t})}appXcalls(e){return this.get(`apps/${l(e)}/xcalls`)}appStorage(e){return this.get(`apps/${l(e)}/storage`)}appAbi(e){return this.get(`apps/${l(e)}/abi`)}async transferApp(e,t,n){await this.postConfirmed(`apps/${l(e)}/transfer`,{to:t},n)}upgradeApp(e,t,n){let s=`apps/${l(e)}/upgrade`;return n?this.postConfirmed(s,t,n):this.post(s,t)}postConfirmed(e,t,n){return this.confirmed("POST",e,t,n)}deleteConfirmed(e,t,n={}){return this.confirmed("DELETE",e,n,t)}async confirmed(e,t,n,s,i=o=>this.json(e,t,o)){try{return await i(n)}catch(o){if(!(o instanceof Y)||!s)throw o;let a=o.details,c;try{c=await s.get(I(a.challenge),a.rpId,a.allowCredentials)}catch(d){let u=d?.name;throw u==="NotAllowedError"||u==="AbortError"?new ie(d):d}return i({...n,confirm:{challengeId:a.challengeId,assertion:c}})}}async createApp(e,t,n={}){let s=typeof t=="string"?{bundle:t}:t,{appId:i}=await this.post("apps",{name:e,...s,...n});return i}call(e,t,n={},s){let i=s??zt();return this.retried("POST",`apps/${l(e)}/intents`,{method:t,args:n,idempotencyKey:i})}async callConfirmed(e,t,n,s,i){let o=`apps/${l(e)}/intents`,a=i??zt();return this.confirmed("POST",o,{method:t,args:n,idempotencyKey:a},s,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,t,n={},s={}){return this.retried("POST",`apps/${l(e)}/views`,{method:t,args:n,consistency:s.stale?"stale":"strong",minIndex:s.minIndex??0})}events(e,t=0,n){return this.stream(`apps/${l(e)}/events?from=${t}`,n)}async*stream(e,t){let n=await this.send("GET",e,void 0,void 0,void 0,t);if(!n.body)throw new w(n.status,"EVENTS","the event stream has no body");yield*Nn(n.body)}async publishPresence(e,t,n){await this.post(`apps/${l(e)}/presence`,{seq:t,state:n===null?null:Jt(n)})}async presence(e){let{present:t}=await this.get(`apps/${l(e)}/presence`);return t}presenceStream(e,t){return this.stream(`apps/${l(e)}/presence/stream`,t)}async setAlias(e,t){await this.put(`auth/aliases/${l(e)}`,{app:t})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:t}=await this.get(`auth/aliases/${l(e)}`);return t}async deleteAlias(e){await this.delete(`auth/aliases/${l(e)}`)}async createOrg(e){let{orgId:t}=await this.post("orgs",{name:e});return t}getOrg(e){return this.get(`orgs/${l(e)}`)}async deleteOrg(e,t){await this.deleteConfirmed(`orgs/${l(e)}`,t)}async setOrgMetadata(e,t){await this.post(`orgs/${l(e)}/metadata`,{metadata:t})}async setMemberMetadata(e,t,n){await this.post(`orgs/${l(e)}/members/${l(t)}/metadata`,{metadata:n})}upgradeOrg(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrade`,{...t},n)}upgradeRun(e,t){return this.get(`orgs/${l(e)}/upgrades/${l(t)}`)}retryUpgradeRun(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrades/${l(t)}/retry`,{},n)}async approveRelease(e,t,n,s=!0){let i=e===null?"auth/releases":`orgs/${l(e)}/releases`;return this.postConfirmed(i,{version:t,approved:s},n)}async approveOutbound(e,t,n,s={}){let i=e===null?"auth/outbound":`orgs/${l(e)}/outbound`;return this.postConfirmed(i,{package:t,prefixes:s.prefixes??"manifest",replace:s.replace??!1},n)}appsReport(e,t={}){let n=e===null?"auth/apps":`orgs/${l(e)}/apps`;return this.get(`${n}${ce(t)}`)}async appsReportAll(e){let t=await this.appsReport(e),n=[...t.apps],s=t.next;for(;s!==null;){let i=await this.appsReport(e,{after:s});n.push(...i.apps),s=i.next}return{...t,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[t,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return ot(t,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,t={}){let n=typeof t=="function"?{navigate:t}:t,s=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),i=await this.requestConsent(e);if(i.code!==void 0){let o=await it(i.requestId);if(i.code!==o)throw new w(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:i.requestId,code:i.code,expected:o})}return n.confirm&&!await n.confirm(i)||s(i.url),i}consentResult(e){return this.get(`consent/${l(e)}/result`)}async waitForConsent(e,t={}){let n=t.intervalMs??2e3;for(;;){let s=await this.consentResult(e);if(s.status!=="pending"||t.signal?.aborted||t.expiresAt!==void 0&&Date.now()/1e3>=t.expiresAt)return s;await new Promise(i=>setTimeout(i,n))}}publisherBinding(e){return this.get(`publishers/${l(e)}`)}bindPublisher(e,t,n){return this.postConfirmed(`orgs/${l(e)}/publishers`,{...t},n)}upgradePublished(e,t,n,s){return this.postConfirmed(`orgs/${l(e)}/packages/${l(t)}/upgrade`,{...n},s)}opsApps(e={}){return this.get(`ops/apps${ce(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ce(e)}`)}async setReleaseDeadline(e,t){let n=typeof t=="string"?t:t.toISOString();await this.post(`ops/releases/${l(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${l(e)}/deadline`)}async setMember(e,t,n,s){await this.postConfirmed(`orgs/${l(e)}/members`,{account:t,role:n},s)}removeMember(e,t,n){return this.deleteConfirmed(`orgs/${l(e)}/members/${l(t)}`,n)}async setCapabilities(e,t,n,s={}){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{capabilities:t,...s},n)}async createTeam(e,t,n,s){let{teamId:i}=await this.post(`orgs/${l(e)}/teams`,{name:t,join:n,parent:s});return i}getTeam(e,t){return this.get(`orgs/${l(e)}/teams/${l(t)}`)}async updateTeam(e,t,n){await this.post(`orgs/${l(e)}/teams/${l(t)}`,n)}async deleteTeam(e,t){await this.delete(`orgs/${l(e)}/teams/${l(t)}`)}async setTeamMember(e,t,n,s,i={}){await this.postConfirmed(`orgs/${l(e)}/teams/${l(t)}/members`,{account:n,...i},s)}async removeTeamMember(e,t,n,s){await this.deleteConfirmed(`orgs/${l(e)}/teams/${l(t)}/members/${l(n)}`,s)}async invite(e,t,n,s=[],i={}){let{token:o}=await this.postConfirmed(`orgs/${l(e)}/invites`,{role:t,teams:s,...i},n);return o}redeemInvite(e){return this.post(`invites/${l(e)}/redeem`)}grantDeployer(e,t,n={}){let s=n.until instanceof Date?n.until.toISOString():n.until;return this.postConfirmed("deployers",{deployer:e,...s===void 0?{}:{until:s}},t)}deployers(){return this.get("deployers")}async revokeDeployer(e,t){let n=typeof e=="string"?e:Zt(e);await this.deleteConfirmed(`deployers/${l(n)}`,t)}async createDeployment(e,t,n){let{id:s}=await this.postConfirmed("deployments",{name:e,owner:t},n);return s}async deployments(){let{deployments:e}=await this.get("deployments");return e}deployment(e){return this.get(`deployments/${l(e)}`)}async deleteDeployment(e,t){await this.deleteConfirmed(`deployments/${l(e)}`,t)}offerApp(e,t,n){return this.postConfirmed(`deployments/${l(e)}/apps`,{...t},n)}async withdrawApp(e,t,n){await this.deleteConfirmed(`deployments/${l(e)}/apps/${l(t)}`,n)}deploymentOrgs(e){return this.get(`deployments/${l(e)}/orgs`)}};var lt={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},_n=lt.JOIN_OPEN_TEAMS;function Bn(...r){return r.reduce((e,t)=>e|lt[t],0)}function ke(r,e){return(r<<e|r>>>32-e)>>>0}function D(r,e,t,n,s){r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],16),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],12),r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],8),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],7)}function Xt(r,e){return(r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24)>>>0}function tr(r,e,t){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=Xt(r,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=Xt(t,o*4);let s=n.slice();for(let o=0;o<10;o+=1)D(s,0,4,8,12),D(s,1,5,9,13),D(s,2,6,10,14),D(s,3,7,11,15),D(s,0,5,10,15),D(s,1,6,11,12),D(s,2,7,8,13),D(s,3,4,9,14);let i=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=s[o]+n[o]>>>0;i[o*4]=a&255,i[o*4+1]=a>>>8&255,i[o*4+2]=a>>>16&255,i[o*4+3]=a>>>24&255}return i}function Kn(r,e,t,n){let s=new Uint8Array(n.length);for(let i=0,o=e;i<n.length;i+=64,o+=1){let a=tr(r,o,t),c=Math.min(i+64,n.length);for(let d=i;d<c;d+=1)s[d]=n[d]^a[d-i]}return s}function dt(r){let e=0n;for(let t=r.length-1;t>=0;t-=1)e=e<<8n|BigInt(r[t]);return e}var Vn=(1n<<130n)-5n;function Ln(r,e){let t=dt(r.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=dt(r.subarray(16,32)),s=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),d=dt(c)+(1n<<BigInt(8*c.length));s=(s+d)*t%Vn}let i=s+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(i&0xffn),i>>=8n;return o}function Wt(r){return new Uint8Array((16-r%16)%16)}function er(r){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(r),!0),e}function Hn(r,e){let t=[r,Wt(r.length),e,Wt(e.length),er(r.length),er(e.length)],n=new Uint8Array(t.reduce((i,o)=>i+o.length,0)),s=0;for(let i of t)n.set(i,s),s+=i.length;return n}function Fn(r,e){if(r.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function rr(r,e,t,n=new Uint8Array(0)){Fn(r,e);let s=tr(r,0,e).subarray(0,32),i=Kn(r,1,e,t),o=Ln(s,Hn(n,i)),a=new Uint8Array(i.length+16);return a.set(i),a.set(o,i.length),a}var sr=32,Gn=1,jn=3,qn=2,Qn=32,Jn=32,zn=12,Z=r=>new TextEncoder().encode(r),de=r=>new Uint8Array([r>>8&255,r&255]),nr=y(Z("KEM"),de(sr)),le=y(Z("HPKE"),de(sr),de(Gn),de(jn));async function ir(r,e){let t=r.length===0?new Uint8Array(32):r,n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function Yn(r,e,t){let n=new Uint8Array(t),s=new Uint8Array(0);for(let i=1,o=0;o<t;i+=1)s=await ir(r,y(s,e,new Uint8Array([i]))),n.set(s.subarray(0,Math.min(s.length,t-o)),o),o+=s.length;return n}function ve(r,e,t,n){return ir(e,y(Z("HPKE-v1"),r,Z(t),n))}function ut(r,e,t,n,s){return Yn(e,y(de(s),Z("HPKE-v1"),r,Z(t),n),s)}async function Zn(r,e){let t=await ve(nr,new Uint8Array(0),"eae_prk",r);return ut(nr,t,"shared_secret",e,Qn)}async function Xn(r,e){let t=new Uint8Array(0),n=await ve(le,t,"psk_id_hash",t),s=await ve(le,t,"info_hash",e),i=y(new Uint8Array([qn]),n,s),o=await ve(le,r,"secret",t);return{key:await ut(le,o,"key",i,Jn),nonce:await ut(le,o,"base_nonce",i,zn)}}async function or(r,e,t,n,s=new Uint8Array(0),i){if(r.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await G(i),a=await G(e),c=y(await W(o.privateKey,r),await W(a.privateKey,r)),d=await Zn(c,y(o.publicKey,r,a.publicKey)),{key:u,nonce:g}=await Xn(d,t);return{enc:o.publicKey,ciphertext:rr(u,g,n,s)}}var lr="mero-agent-gate/attest/v3",dr="mero-agent-gate/provision/v2",Wn=/^[a-z0-9][a-z0-9-]{0,62}$/,es=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,ar=64,cr=64*1024,O=class extends Error{constructor(t,n,s){super(t);this.status=n;this.code=s;this.name="AgentGateError"}};function ur(r){if(!Wn.test(r))throw new Error(`Agent id ${JSON.stringify(r)} must match [a-z0-9][a-z0-9-]{0,62}`)}function ue(r){return new TextEncoder().encode(r)}function gr(r){let e=ue(r);return y(new Uint8Array([e.length]),e)}function V(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}function Ie(r,e,t){let n;try{n=Uint8Array.from(atob(r.trim()),s=>s.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(t!==void 0&&n.length!==t)throw new Error(`${e} is not ${t} bytes`);return n}async function pr(r,e,t,n){let s=new Uint8Array(32),i=y(ue(lr),r,gr(e),t??s,n??s);return new Uint8Array(await crypto.subtle.digest("SHA-256",i))}function fr(r,e){return y(ue(dr),r,gr(e))}async function ts(){let r=crypto.getRandomValues(new Uint8Array(32));return{secret:r,publicKey:await De(r)}}async function De(r){if(r.length!==32)throw new Error("An owner key is 32 bytes");return V((await G(r)).publicKey)}function yr(r,e){return`${r.replace(/\/+$/,"")}${e}`}async function hr(r,e,t){let n=await r(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),s=await n.text(),i;try{i=s?JSON.parse(s):void 0}catch{}if(!n.ok){let o=i;throw new O(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??s.slice(0,200)}`,n.status,o?.error)}return i}async function gt(r){let e=r.agentId??"";e&&ur(e);let t=crypto.getRandomValues(new Uint8Array(32)),n=await hr(r.fetch??fetch,yr(r.gateUrl,"/attest"),{nonceB64:V(t),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let s=Ie(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),i=n.signingPublicKeyB64?Ie(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ie(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!i!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await pr(s,e,i,o);return await r.verifier({quoteB64:n.quoteB64,nonce:R(t),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:V(s),...i?{signingPublicKey:V(i)}:{},...o?{ownerPublicKey:V(o)}:{}}}async function mr(r,e){let t=await De(e);if(r.ownerPublicKey&&r.ownerPublicKey!==t)throw new O(`This agent is claimed by another key (${r.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return t}function rs(r){let e=Object.keys(r);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>ar)throw new Error(`At most ${ar} secrets at once`);for(let t of e){if(!es.test(t))throw new Error(`Secret name ${JSON.stringify(t)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof r[t]!="string")throw new Error(`Secret ${t} is not a string`);if(ue(r[t]).length>cr)throw new Error(`Secret ${t} is over ${cr} bytes`)}}async function wr(r,e,t,n,s,i){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await mr(n,s),a=Ie(n.provisioningPublicKey,"provisioningPublicKey",32),c=await or(a,s,fr(a,n.agentId),ue(JSON.stringify(i)));return hr(r,yr(e,t),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:V(c.enc),ciphertextB64:V(c.ciphertext)})}async function ns(r){rs(r.secrets);let e=r.fetch??fetch,t=await wr(e,r.gateUrl,"/provision",r.agent,r.ownerSecret,{secrets:r.secrets}),n=await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e}),s=await De(r.ownerSecret);if(n.ownerPublicKey!==s||!n.signingPublicKey)throw new O("The gate accepted the secrets, but its quote does not name your key as owner");if(r.agent.signingPublicKey&&r.agent.signingPublicKey!==n.signingPublicKey)throw new O("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:s,written:t?.written??[],claimed:t?.claimed===!0}}async function ss(r){if(!r.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=r.fetch??fetch;if(await wr(e,r.gateUrl,"/release",r.agent,r.ownerSecret,{release:!0}),(await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e})).ownerPublicKey)throw new O("The gate says it released the agent, but its quote still names an owner")}var pt=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),is=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function os(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??pt.identity,issuer:t.issuer??pt.issuer});let s;try{s=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let i=t.role??"agent";if(s?.role!==i)throw new Error(`The signed file is a ${JSON.stringify(s?.role)} policy, not an ${i} one`);let o=t.profile??$;if(s.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(s.profile)} profile, not ${o}`);if(t.expectedVersion!==void 0&&s.version!==t.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(s.version)}, not ${t.expectedVersion}`);return Ar(s),s}function Ar(r){for(let e of is)if(!Array.isArray(r?.[e])||r[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var as=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function cs(r){let e=as.find(t=>t.toLowerCase()===r.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(r)}`);return e}var ge=r=>r.trim().replace(/^0x/i,"");function ls(r,e){return Ar(r),_({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:r.allowed_tcb_statuses.map(cs),allowedMrtd:r.allowed_mrtd.map(ge),allowedRtmr0:r.allowed_rtmr0.map(ge),allowedRtmr1:r.allowed_rtmr1.map(ge),allowedRtmr2:r.allowed_rtmr2.map(ge),allowedRtmr3:r.allowed_rtmr3.map(ge)})}export{lr as AGENT_ATTEST_DOMAIN,dr as AGENT_PROVISION_INFO_DOMAIN,O as AgentGateError,xe as AppError,Ee as ArgsTooLarge,ct as CalimeroClient,w as CalimeroError,ie as ConfirmCancelled,Y as ConfirmRequired,Ue as ConsentStale,Je as DEFAULT_COLLATERAL_MIRROR,tt as DEFAULT_DIRECTORY,_n as DEFAULT_ORG_CAPABILITIES,we as DEFAULT_RELEASE_MIRROR,T as DirectoryError,Nt as GITHUB_RELEASES,bt as HANDSHAKE_PATH,Re as IdempotencyMismatch,pt as KMS_RELEASE_SIGNER,z as LoginRequired,st as MAX_REPORT_PAGE,_t as MOCK_QUOTE_HEADER,Qe as NODE_RELEASE_SIGNER,be as NotFound,lt as ORG_CAPABILITIES,$ as PRODUCTION_PROFILE,Gt as RELEASE_VERIFIER,Pe as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,Et as SEALED_PATH,S as SealedTransportError,re as StaleTransportKeyError,Te as TrapError,K as UnavailableError,B as WrongNode,pr as agentKeyBinding,ls as agentQuoteVerifier,gt as attestAgent,C as b64url,xn as browserPasskey,mr as checkOwner,Bt as claimedRelease,Ze as cloudNodeReleaseUrl,ae as compareVersions,it as confirmationCode,Sn as consentReturn,_ as createQuoteVerifier,He as createSealedFetch,hn as createSignedReleaseVerifier,Zt as deployerKey,Se as errorFrom,et as fetchAttestedKey,Ye as fetchGithubNodeRelease,ze as fetchNodeRelease,Kt as freshCollateral,I as fromB64url,In as frontendManifest,ts as generateOwnerKey,Bn as orgCapabilities,De as ownerPublicKey,Dn as pageDeployment,ce as pageQuery,ot as pendingApprovalsFrom,ns as provisionAgent,fr as provisionInfo,Tn as publisherBindingBytes,Ft as publisherBindingMessage,ss as releaseAgent,Qt as releaseConsent,jt as releaseNotesUrl,Ht as stalledBy,Le as transportKeyBinding,Ae as trustSignedRelease,qe as trustedMeasurementsFromReleases,vn as upgradeConsent,ur as validateAgentId,qt as verifyReleaseUrl,os as verifySignedAgentPolicy,Ot as verifySignedNodeRelease,kn as withdrawConsent};
9
9
  //# sourceMappingURL=index.browser.mjs.map