@calimero-network/mero-js 28.1.0 → 29.0.0

package/dist/cloud-v2/client.d.ts

@@ -445,7 +445,11 @@ export declare class CalimeroClient {
     get<T = Record<string, unknown>>(path: string): Promise<T>;
     put<T = Record<string, unknown>>(path: string, body?: unknown): Promise<T>;
     delete<T = Record<string, unknown>>(path: string, body?: unknown): Promise<T>;
-    /** Create an account with a new passkey, and sign in. */
+    /**
+     * Create an account with a new passkey, and sign in. The node then asks the
+     * new passkey to sign the account it creates (`412 CONFIRM_REQUIRED`, core
+     * #proofs-at-apply-rest), so a sign-up prompts twice: create, then sign.
+     */
     signUp(passkey: PasskeyProvider, name: string): Promise<CalimeroSession>;
     /** Sign in with an existing passkey. */
     signIn(passkey: PasskeyProvider): Promise<CalimeroSession>;
@@ -481,7 +485,8 @@ export declare class CalimeroClient {
     attestation(): Promise<AttestationDoc>;
     /** The account's API keys (never the keys themselves). */
     listApiKeys(): Promise<Array<Record<string, unknown>>>;
-    revokeApiKey(keyId: string): Promise<void>;
+    /** Revoke one of the account's API keys, approved with its `passkey` (`412 CONFIRM_REQUIRED`). */
+    revokeApiKey(keyId: string, passkey: PasskeyProvider): Promise<void>;
     /**
      * Create an API key for an agent or server, approved with the account's
      * `passkey` (`412 CONFIRM_REQUIRED`); needs a passkey session (an API key

package/dist/cloud-v2/client.js

@@ -440,14 +440,15 @@ export class CalimeroClient {
         return this.json('DELETE', path, body);
     }
     // ---------------------------------------------------------------- identity
-    /** Create an account with a new passkey, and sign in. */
+    /**
+     * Create an account with a new passkey, and sign in. The node then asks the
+     * new passkey to sign the account it creates (`412 CONFIRM_REQUIRED`, core
+     * #proofs-at-apply-rest), so a sign-up prompts twice: create, then sign.
+     */
     async signUp(passkey, name) {
         const begin = await this.post('auth/passkey/register/begin', { name });
         const registration = await passkey.create(begin.options);
-        const session = await this.post('auth/passkey/register/finish', {
-            challengeId: begin.challengeId,
-            registration,
-        });
+        const session = await this.postConfirmed('auth/passkey/register/finish', { challengeId: begin.challengeId, registration }, passkey);
         this.useSession(session);
         return session;
     }
@@ -556,8 +557,9 @@ export class CalimeroClient {
         const { keys } = await this.get('auth/apikeys');
         return keys;
     }
-    async revokeApiKey(keyId) {
-        await this.delete(`auth/apikeys/${seg(keyId)}`);
+    /** Revoke one of the account's API keys, approved with its `passkey` (`412 CONFIRM_REQUIRED`). */
+    async revokeApiKey(keyId, passkey) {
+        await this.deleteConfirmed(`auth/apikeys/${seg(keyId)}`, passkey);
     }
     /**
      * Create an API key for an agent or server, approved with the account's

package/dist/index.browser.mjs

@@ -5,5 +5,5 @@ ${t}
 ${n}`}function Tn(r,e,t,n){return new TextEncoder().encode(Ft(r,e,t,n))}var Cn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";async function it(r){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(r))),t=(e[0]<<24|e[1]<<16|e[2]<<8|e[3])>>>0,n="";for(let s=0;s<6;s++)s===3&&(n+="-"),n+=Cn[t>>>27-5*s&31];return n}function Sn(r){let e=typeof r=="string"?new URL(r):r,t=e.searchParams.get("request_id"),n=e.searchParams.get("result");return!t||n!=="approved"&&n!=="declined"?null:{requestId:t,result:n}}var Gt="https://mero-tee.vercel.app";function jt(r){return`https://github.com/calimero-network/mero-tee/releases/tag/mero-tee-v${encodeURIComponent(r)}`}function qt(r){return`${Gt}/mero-tee?release_tag=${encodeURIComponent(`mero-tee-v${r}`)}`}function ot(r,e,t=Date.now()/1e3){let n=c=>e.deadlines.find(d=>d.version===c)??null,s=r.governance.releases==="owner",i=r.governance.appUpgrades==="owner",o=r.clusterReleases.filter(c=>!c.approved).sort((c,d)=>ae(d.release,c.release)).map(c=>({version:c.release,nodes:c.nodes,actionable:s,releaseNotesUrl:jt(c.release),verifyUrl:qt(c.release),deadline:n(c.release)})),a=[];for(let c of r.apps){let d=c.availableVersions??[];c.package===null||d.length===0||a.push({app:c.app,name:c.name??null,package:c.package.package,from:c.package.version,to:d[d.length-1],available:d,actionable:i})}return{scope:r.scope,governance:r.governance,approvedReleases:r.approvedReleases,releases:o,upgrades:a,stalledBy:Ht(r.approvedReleases,e.deadlines,t),actionable:o.some(c=>c.actionable)||a.some(c=>c.actionable)}}function Qt(r,e,t,n={}){return{kind:"release",scope:r.kind==="org"?{org:r.org}:"account",subject:n.withdraw?{version:e,withdraw:!0}:{version:e},returnTo:t}}function kn(r,e,t){return Qt(r,e,t,{withdraw:!0})}function vn(r,e,t){return{kind:"upgrade",subject:{app:r,toVersion:e},returnTo:t}}function Zt(r){return"account"in r?`account:${r.account}`:`org:${r.org}`}async function In(r,e=fetch){let t=r??globalThis.location?.origin;if(!t)throw new Error("no page origin to read the frontend manifest from; pass `origin`");let n=await e(new URL("/.well-known/calimero.json",t).toString());if(!n.ok)throw await at(n);let s=await n.json();return{...s,deployments:s.deployments??[]}}function Dn(r){let e=r??globalThis.location?.href;if(!e)return null;try{return new URL(e).searchParams.get("deployment")||null}catch{return null}}function l(r){return encodeURIComponent(r)}function On(r){return r instanceof S&&r.status===413?Se(413,{error:"TOO_LARGE",message:r.message.replace(/^Sealed request refused: /,"")}):r}async function at(r){let e=await r.text().catch(()=>""),t={};try{t=e?JSON.parse(e):{}}catch{t={message:e}}return Se(r.status,t,r.headers.get("retry-after"))}async function*Nn(r){let e=r.getReader(),t=new TextDecoder,n="";for(;;){let{value:s,done:i}=await e.read();if(i)return;n+=t.decode(s,{stream:!0});let o;for(;(o=n.indexOf(`
 
 `))>=0;){let a=n.slice(0,o);n=n.slice(o+2);let c="",d="",u="";for(let p of a.split(`
-`))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?d=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!d&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:d,data:g}}}}function Jt(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function zt(){return`node:c-${C(crypto.getRandomValues(new Uint8Array(16)))}`}var Mn={retries:6,baseDelayMs:200,maxDelayMs:2e3};function $n(r,e){return Math.min(e.baseDelayMs*2**r,e.maxDelayMs)}function Yt(r){return r==="auth/refresh"||r.startsWith("auth/passkey/")}var ct=class r{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;let t=i=>i.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(t))],this.policy=e.policy,this.retry={...Mn,...e.retry};let n=e.fetch??((i,o)=>fetch(i,o)),s=async(i,o)=>{try{return await n(i,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=s}static async connect(e){let t=e.directory??tt,n=e.random??Math.random,s=e.fetch??((d,u)=>fetch(d,u)),i=await rt(t,e.cluster,s),[o,...a]=nt(i.nodes,e.zone,n),c=new r({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:t,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+i.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let t=this.channels.get(e);return t||(t=He({baseUrl:e,transportPublicKey:()=>et(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,t)),t}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,t){if(this.nodeUrl!==e&&!t.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let s=1;s<n;s++){let i=(this.at+s)%n;if(!t.has(this.nodeUrls[i]))return this.at=i,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=rt(e.directory,e.cluster,this.raw).then(t=>{let n=this.nodeUrl,s=nt(t.nodes,e.zone,e.random);this.nodeUrls=[n,...s.filter(i=>i!==n)],this.at=0,e.due=Date.now()+t.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,t,n,s,i="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;s?(a["content-type"]=i,c=s):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let d=this.nodeUrl;try{return await this.channel(d)(`${d}/${t}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw On(u)}}async send(e,t,n,s,i,o){let a=!1,c=!1;for(;;){let[d,u]=[this.auth,this.nodeUrl],g=await this.request(e,t,n,s,i,o);if(g.ok)return g;let p=await at(g);if(p instanceof B&&!c){if(c=!0,this.moveOn(u)&&!Yt(t))continue}else if(p instanceof z&&!a&&this.mayRefresh(d,t)){a=!0,await this.renew(d);continue}throw p}}mayRefresh(e,t){return e!==void 0&&this.current!==void 0&&!Yt(t)}async renew(e){this.auth===e&&await this.refresh()}async json(e,t,n,s,i){let a=await(await this.send(e,t,n,s,i)).text();return a?JSON.parse(a):{}}async retried(e,t,n,s=!1){let i=s?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let d=0;;d++){c=this.nodeUrl,o.add(c);try{return await this.json(e,t,n)}catch(g){if(g instanceof K)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new K("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(d>=i)break;let u=$n(d,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(s||!this.failOver(c,o))throw a}}post(e,t={}){return this.json("POST",e,t)}get(e){return this.json("GET",e)}put(e,t={}){return this.json("PUT",e,t)}delete(e,t){return this.json("DELETE",e,t)}async signUp(e,t){let n=await this.post("auth/passkey/register/begin",{name:t}),s=await e.create(n.options),i=await this.post("auth/passkey/register/finish",{challengeId:n.challengeId,registration:s});return this.useSession(i),i}async signIn(e){let t=await this.post("auth/passkey/login/begin"),n=await e.get(I(t.options.challenge),t.options.rpId),s=await this.post("auth/passkey/login/finish",{challengeId:t.challengeId,assertion:n});return this.useSession(s),s}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let t=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(t,t)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let t;for(let n=1;t===void 0;n++)try{t=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(s){if(!(s instanceof B)||n>=this.nodeUrls.length)throw s}return this.current===e&&this.useSession(t),t}async signOut(){await this.post("auth/logout"),this.auth=void 0,this.current=void 0}async signOutEverywhere(){await this.post("auth/logout-all"),this.auth=void 0,this.current=void 0}me(){return this.get("auth/me")}async addPasskey(e,t){let n=await this.post("auth/passkeys/add/begin"),s=await e.create(n.options),{credentialId:i}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:s},t);return i}async removePasskey(e,t){await this.deleteConfirmed(`auth/passkeys/${l(e)}`,t)}async labelPasskey(e,t){await this.post(`auth/passkeys/${l(e)}`,{label:t})}usage(){return this.get("auth/usage")}async attestation(){let e=Jt(crypto.getRandomValues(new Uint8Array(32))),t=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!t.ok)throw await at(t);return await t.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e){await this.delete(`auth/apikeys/${l(e)}`)}createApiKey(e,t){return this.postConfirmed("auth/apikeys",{...e},t)}async uploadBundle(e){let{hash:t}=await this.json("POST","bundles",void 0,e);return t}uploadBlob(e,t,n={}){let s=(typeof n=="string"?n:n.contentType)??"application/octet-stream";return this.json("POST",`apps/${l(e)}/blobs`,void 0,t,s)}async downloadBlob(e,t){return(await this.blobContent(e,t)).data}async downloadBlobGranted(e,t,n){return(await this.blobContent(e,t,{grant:n})).data}async blobContent(e,t,n={}){let s=n.grant===void 0?"":`?grant=${encodeURIComponent(n.grant)}`,i=await this.send("GET",`apps/${l(e)}/blobs/${l(t)}${s}`);return{data:new Uint8Array(await i.arrayBuffer()),contentType:i.headers.get("content-type")??"application/octet-stream"}}async listBlobs(e){let{blobs:t}=await this.get(`apps/${l(e)}/blobs`);return t}blobInfo(e,t){return this.get(`apps/${l(e)}/blobs/${l(t)}/info`)}async deleteBlob(e,t){await this.delete(`apps/${l(e)}/blobs/${l(t)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,t){return this.post("packages/install",{package:e,version:t})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${l(e)}`)}uninstallPackage(e,t){return this.delete(t===void 0?`packages/${l(e)}`:`packages/${l(e)}/${l(t)}`)}async listApps(e={}){let t=new URLSearchParams;e.package&&t.set("package",e.package),e.bundle&&t.set("bundle",e.bundle);let n=t.toString(),{apps:s}=await this.get(n?`apps?${n}`:"apps");return s}getApp(e){return this.get(`apps/${l(e)}`)}async deleteApp(e){await this.delete(`apps/${l(e)}`)}async setAccess(e,t){await this.post(`apps/${l(e)}/access`,{access:t})}async setAppMetadata(e,t){await this.post(`apps/${l(e)}/metadata`,{metadata:t})}appXcalls(e){return this.get(`apps/${l(e)}/xcalls`)}appStorage(e){return this.get(`apps/${l(e)}/storage`)}appAbi(e){return this.get(`apps/${l(e)}/abi`)}async transferApp(e,t,n){await this.postConfirmed(`apps/${l(e)}/transfer`,{to:t},n)}upgradeApp(e,t,n){let s=`apps/${l(e)}/upgrade`;return n?this.postConfirmed(s,t,n):this.post(s,t)}postConfirmed(e,t,n){return this.confirmed("POST",e,t,n)}deleteConfirmed(e,t,n={}){return this.confirmed("DELETE",e,n,t)}async confirmed(e,t,n,s,i=o=>this.json(e,t,o)){try{return await i(n)}catch(o){if(!(o instanceof Y)||!s)throw o;let a=o.details,c;try{c=await s.get(I(a.challenge),a.rpId,a.allowCredentials)}catch(d){let u=d?.name;throw u==="NotAllowedError"||u==="AbortError"?new ie(d):d}return i({...n,confirm:{challengeId:a.challengeId,assertion:c}})}}async createApp(e,t,n={}){let s=typeof t=="string"?{bundle:t}:t,{appId:i}=await this.post("apps",{name:e,...s,...n});return i}call(e,t,n={},s){let i=s??zt();return this.retried("POST",`apps/${l(e)}/intents`,{method:t,args:n,idempotencyKey:i})}async callConfirmed(e,t,n,s,i){let o=`apps/${l(e)}/intents`,a=i??zt();return this.confirmed("POST",o,{method:t,args:n,idempotencyKey:a},s,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,t,n={},s={}){return this.retried("POST",`apps/${l(e)}/views`,{method:t,args:n,consistency:s.stale?"stale":"strong",minIndex:s.minIndex??0})}events(e,t=0,n){return this.stream(`apps/${l(e)}/events?from=${t}`,n)}async*stream(e,t){let n=await this.send("GET",e,void 0,void 0,void 0,t);if(!n.body)throw new w(n.status,"EVENTS","the event stream has no body");yield*Nn(n.body)}async publishPresence(e,t,n){await this.post(`apps/${l(e)}/presence`,{seq:t,state:n===null?null:Jt(n)})}async presence(e){let{present:t}=await this.get(`apps/${l(e)}/presence`);return t}presenceStream(e,t){return this.stream(`apps/${l(e)}/presence/stream`,t)}async setAlias(e,t){await this.put(`auth/aliases/${l(e)}`,{app:t})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:t}=await this.get(`auth/aliases/${l(e)}`);return t}async deleteAlias(e){await this.delete(`auth/aliases/${l(e)}`)}async createOrg(e){let{orgId:t}=await this.post("orgs",{name:e});return t}getOrg(e){return this.get(`orgs/${l(e)}`)}async deleteOrg(e,t){await this.deleteConfirmed(`orgs/${l(e)}`,t)}async setOrgMetadata(e,t){await this.post(`orgs/${l(e)}/metadata`,{metadata:t})}async setMemberMetadata(e,t,n){await this.post(`orgs/${l(e)}/members/${l(t)}/metadata`,{metadata:n})}upgradeOrg(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrade`,{...t},n)}upgradeRun(e,t){return this.get(`orgs/${l(e)}/upgrades/${l(t)}`)}retryUpgradeRun(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrades/${l(t)}/retry`,{},n)}async approveRelease(e,t,n,s=!0){let i=e===null?"auth/releases":`orgs/${l(e)}/releases`;return this.postConfirmed(i,{version:t,approved:s},n)}async approveOutbound(e,t,n,s={}){let i=e===null?"auth/outbound":`orgs/${l(e)}/outbound`;return this.postConfirmed(i,{package:t,prefixes:s.prefixes??"manifest",replace:s.replace??!1},n)}appsReport(e,t={}){let n=e===null?"auth/apps":`orgs/${l(e)}/apps`;return this.get(`${n}${ce(t)}`)}async appsReportAll(e){let t=await this.appsReport(e),n=[...t.apps],s=t.next;for(;s!==null;){let i=await this.appsReport(e,{after:s});n.push(...i.apps),s=i.next}return{...t,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[t,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return ot(t,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,t={}){let n=typeof t=="function"?{navigate:t}:t,s=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),i=await this.requestConsent(e);if(i.code!==void 0){let o=await it(i.requestId);if(i.code!==o)throw new w(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:i.requestId,code:i.code,expected:o})}return n.confirm&&!await n.confirm(i)||s(i.url),i}consentResult(e){return this.get(`consent/${l(e)}/result`)}async waitForConsent(e,t={}){let n=t.intervalMs??2e3;for(;;){let s=await this.consentResult(e);if(s.status!=="pending"||t.signal?.aborted||t.expiresAt!==void 0&&Date.now()/1e3>=t.expiresAt)return s;await new Promise(i=>setTimeout(i,n))}}publisherBinding(e){return this.get(`publishers/${l(e)}`)}bindPublisher(e,t,n){return this.postConfirmed(`orgs/${l(e)}/publishers`,{...t},n)}upgradePublished(e,t,n,s){return this.postConfirmed(`orgs/${l(e)}/packages/${l(t)}/upgrade`,{...n},s)}opsApps(e={}){return this.get(`ops/apps${ce(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ce(e)}`)}async setReleaseDeadline(e,t){let n=typeof t=="string"?t:t.toISOString();await this.post(`ops/releases/${l(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${l(e)}/deadline`)}async setMember(e,t,n,s){await this.postConfirmed(`orgs/${l(e)}/members`,{account:t,role:n},s)}removeMember(e,t,n){return this.deleteConfirmed(`orgs/${l(e)}/members/${l(t)}`,n)}async setCapabilities(e,t,n,s={}){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{capabilities:t,...s},n)}async createTeam(e,t,n,s){let{teamId:i}=await this.post(`orgs/${l(e)}/teams`,{name:t,join:n,parent:s});return i}getTeam(e,t){return this.get(`orgs/${l(e)}/teams/${l(t)}`)}async updateTeam(e,t,n){await this.post(`orgs/${l(e)}/teams/${l(t)}`,n)}async deleteTeam(e,t){await this.delete(`orgs/${l(e)}/teams/${l(t)}`)}async setTeamMember(e,t,n,s,i={}){await this.postConfirmed(`orgs/${l(e)}/teams/${l(t)}/members`,{account:n,...i},s)}async removeTeamMember(e,t,n,s){await this.deleteConfirmed(`orgs/${l(e)}/teams/${l(t)}/members/${l(n)}`,s)}async invite(e,t,n,s=[],i={}){let{token:o}=await this.postConfirmed(`orgs/${l(e)}/invites`,{role:t,teams:s,...i},n);return o}redeemInvite(e){return this.post(`invites/${l(e)}/redeem`)}grantDeployer(e,t,n={}){let s=n.until instanceof Date?n.until.toISOString():n.until;return this.postConfirmed("deployers",{deployer:e,...s===void 0?{}:{until:s}},t)}deployers(){return this.get("deployers")}async revokeDeployer(e,t){let n=typeof e=="string"?e:Zt(e);await this.deleteConfirmed(`deployers/${l(n)}`,t)}async createDeployment(e,t,n){let{id:s}=await this.postConfirmed("deployments",{name:e,owner:t},n);return s}async deployments(){let{deployments:e}=await this.get("deployments");return e}deployment(e){return this.get(`deployments/${l(e)}`)}async deleteDeployment(e,t){await this.deleteConfirmed(`deployments/${l(e)}`,t)}offerApp(e,t,n){return this.postConfirmed(`deployments/${l(e)}/apps`,{...t},n)}async withdrawApp(e,t,n){await this.deleteConfirmed(`deployments/${l(e)}/apps/${l(t)}`,n)}deploymentOrgs(e){return this.get(`deployments/${l(e)}/orgs`)}};var lt={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},_n=lt.JOIN_OPEN_TEAMS;function Bn(...r){return r.reduce((e,t)=>e|lt[t],0)}function ke(r,e){return(r<<e|r>>>32-e)>>>0}function D(r,e,t,n,s){r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],16),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],12),r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],8),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],7)}function Xt(r,e){return(r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24)>>>0}function tr(r,e,t){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=Xt(r,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=Xt(t,o*4);let s=n.slice();for(let o=0;o<10;o+=1)D(s,0,4,8,12),D(s,1,5,9,13),D(s,2,6,10,14),D(s,3,7,11,15),D(s,0,5,10,15),D(s,1,6,11,12),D(s,2,7,8,13),D(s,3,4,9,14);let i=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=s[o]+n[o]>>>0;i[o*4]=a&255,i[o*4+1]=a>>>8&255,i[o*4+2]=a>>>16&255,i[o*4+3]=a>>>24&255}return i}function Kn(r,e,t,n){let s=new Uint8Array(n.length);for(let i=0,o=e;i<n.length;i+=64,o+=1){let a=tr(r,o,t),c=Math.min(i+64,n.length);for(let d=i;d<c;d+=1)s[d]=n[d]^a[d-i]}return s}function dt(r){let e=0n;for(let t=r.length-1;t>=0;t-=1)e=e<<8n|BigInt(r[t]);return e}var Vn=(1n<<130n)-5n;function Ln(r,e){let t=dt(r.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=dt(r.subarray(16,32)),s=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),d=dt(c)+(1n<<BigInt(8*c.length));s=(s+d)*t%Vn}let i=s+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(i&0xffn),i>>=8n;return o}function Wt(r){return new Uint8Array((16-r%16)%16)}function er(r){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(r),!0),e}function Hn(r,e){let t=[r,Wt(r.length),e,Wt(e.length),er(r.length),er(e.length)],n=new Uint8Array(t.reduce((i,o)=>i+o.length,0)),s=0;for(let i of t)n.set(i,s),s+=i.length;return n}function Fn(r,e){if(r.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function rr(r,e,t,n=new Uint8Array(0)){Fn(r,e);let s=tr(r,0,e).subarray(0,32),i=Kn(r,1,e,t),o=Ln(s,Hn(n,i)),a=new Uint8Array(i.length+16);return a.set(i),a.set(o,i.length),a}var sr=32,Gn=1,jn=3,qn=2,Qn=32,Jn=32,zn=12,Z=r=>new TextEncoder().encode(r),de=r=>new Uint8Array([r>>8&255,r&255]),nr=y(Z("KEM"),de(sr)),le=y(Z("HPKE"),de(sr),de(Gn),de(jn));async function ir(r,e){let t=r.length===0?new Uint8Array(32):r,n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function Yn(r,e,t){let n=new Uint8Array(t),s=new Uint8Array(0);for(let i=1,o=0;o<t;i+=1)s=await ir(r,y(s,e,new Uint8Array([i]))),n.set(s.subarray(0,Math.min(s.length,t-o)),o),o+=s.length;return n}function ve(r,e,t,n){return ir(e,y(Z("HPKE-v1"),r,Z(t),n))}function ut(r,e,t,n,s){return Yn(e,y(de(s),Z("HPKE-v1"),r,Z(t),n),s)}async function Zn(r,e){let t=await ve(nr,new Uint8Array(0),"eae_prk",r);return ut(nr,t,"shared_secret",e,Qn)}async function Xn(r,e){let t=new Uint8Array(0),n=await ve(le,t,"psk_id_hash",t),s=await ve(le,t,"info_hash",e),i=y(new Uint8Array([qn]),n,s),o=await ve(le,r,"secret",t);return{key:await ut(le,o,"key",i,Jn),nonce:await ut(le,o,"base_nonce",i,zn)}}async function or(r,e,t,n,s=new Uint8Array(0),i){if(r.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await G(i),a=await G(e),c=y(await W(o.privateKey,r),await W(a.privateKey,r)),d=await Zn(c,y(o.publicKey,r,a.publicKey)),{key:u,nonce:g}=await Xn(d,t);return{enc:o.publicKey,ciphertext:rr(u,g,n,s)}}var lr="mero-agent-gate/attest/v3",dr="mero-agent-gate/provision/v2",Wn=/^[a-z0-9][a-z0-9-]{0,62}$/,es=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,ar=64,cr=64*1024,O=class extends Error{constructor(t,n,s){super(t);this.status=n;this.code=s;this.name="AgentGateError"}};function ur(r){if(!Wn.test(r))throw new Error(`Agent id ${JSON.stringify(r)} must match [a-z0-9][a-z0-9-]{0,62}`)}function ue(r){return new TextEncoder().encode(r)}function gr(r){let e=ue(r);return y(new Uint8Array([e.length]),e)}function V(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}function Ie(r,e,t){let n;try{n=Uint8Array.from(atob(r.trim()),s=>s.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(t!==void 0&&n.length!==t)throw new Error(`${e} is not ${t} bytes`);return n}async function pr(r,e,t,n){let s=new Uint8Array(32),i=y(ue(lr),r,gr(e),t??s,n??s);return new Uint8Array(await crypto.subtle.digest("SHA-256",i))}function fr(r,e){return y(ue(dr),r,gr(e))}async function ts(){let r=crypto.getRandomValues(new Uint8Array(32));return{secret:r,publicKey:await De(r)}}async function De(r){if(r.length!==32)throw new Error("An owner key is 32 bytes");return V((await G(r)).publicKey)}function yr(r,e){return`${r.replace(/\/+$/,"")}${e}`}async function hr(r,e,t){let n=await r(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),s=await n.text(),i;try{i=s?JSON.parse(s):void 0}catch{}if(!n.ok){let o=i;throw new O(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??s.slice(0,200)}`,n.status,o?.error)}return i}async function gt(r){let e=r.agentId??"";e&&ur(e);let t=crypto.getRandomValues(new Uint8Array(32)),n=await hr(r.fetch??fetch,yr(r.gateUrl,"/attest"),{nonceB64:V(t),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let s=Ie(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),i=n.signingPublicKeyB64?Ie(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ie(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!i!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await pr(s,e,i,o);return await r.verifier({quoteB64:n.quoteB64,nonce:R(t),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:V(s),...i?{signingPublicKey:V(i)}:{},...o?{ownerPublicKey:V(o)}:{}}}async function mr(r,e){let t=await De(e);if(r.ownerPublicKey&&r.ownerPublicKey!==t)throw new O(`This agent is claimed by another key (${r.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return t}function rs(r){let e=Object.keys(r);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>ar)throw new Error(`At most ${ar} secrets at once`);for(let t of e){if(!es.test(t))throw new Error(`Secret name ${JSON.stringify(t)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof r[t]!="string")throw new Error(`Secret ${t} is not a string`);if(ue(r[t]).length>cr)throw new Error(`Secret ${t} is over ${cr} bytes`)}}async function wr(r,e,t,n,s,i){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await mr(n,s),a=Ie(n.provisioningPublicKey,"provisioningPublicKey",32),c=await or(a,s,fr(a,n.agentId),ue(JSON.stringify(i)));return hr(r,yr(e,t),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:V(c.enc),ciphertextB64:V(c.ciphertext)})}async function ns(r){rs(r.secrets);let e=r.fetch??fetch,t=await wr(e,r.gateUrl,"/provision",r.agent,r.ownerSecret,{secrets:r.secrets}),n=await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e}),s=await De(r.ownerSecret);if(n.ownerPublicKey!==s||!n.signingPublicKey)throw new O("The gate accepted the secrets, but its quote does not name your key as owner");if(r.agent.signingPublicKey&&r.agent.signingPublicKey!==n.signingPublicKey)throw new O("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:s,written:t?.written??[],claimed:t?.claimed===!0}}async function ss(r){if(!r.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=r.fetch??fetch;if(await wr(e,r.gateUrl,"/release",r.agent,r.ownerSecret,{release:!0}),(await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e})).ownerPublicKey)throw new O("The gate says it released the agent, but its quote still names an owner")}var pt=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),is=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function os(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??pt.identity,issuer:t.issuer??pt.issuer});let s;try{s=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let i=t.role??"agent";if(s?.role!==i)throw new Error(`The signed file is a ${JSON.stringify(s?.role)} policy, not an ${i} one`);let o=t.profile??$;if(s.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(s.profile)} profile, not ${o}`);if(t.expectedVersion!==void 0&&s.version!==t.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(s.version)}, not ${t.expectedVersion}`);return Ar(s),s}function Ar(r){for(let e of is)if(!Array.isArray(r?.[e])||r[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var as=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function cs(r){let e=as.find(t=>t.toLowerCase()===r.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(r)}`);return e}var ge=r=>r.trim().replace(/^0x/i,"");function ls(r,e){return Ar(r),_({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:r.allowed_tcb_statuses.map(cs),allowedMrtd:r.allowed_mrtd.map(ge),allowedRtmr0:r.allowed_rtmr0.map(ge),allowedRtmr1:r.allowed_rtmr1.map(ge),allowedRtmr2:r.allowed_rtmr2.map(ge),allowedRtmr3:r.allowed_rtmr3.map(ge)})}export{lr as AGENT_ATTEST_DOMAIN,dr as AGENT_PROVISION_INFO_DOMAIN,O as AgentGateError,xe as AppError,Ee as ArgsTooLarge,ct as CalimeroClient,w as CalimeroError,ie as ConfirmCancelled,Y as ConfirmRequired,Ue as ConsentStale,Je as DEFAULT_COLLATERAL_MIRROR,tt as DEFAULT_DIRECTORY,_n as DEFAULT_ORG_CAPABILITIES,we as DEFAULT_RELEASE_MIRROR,T as DirectoryError,Nt as GITHUB_RELEASES,bt as HANDSHAKE_PATH,Re as IdempotencyMismatch,pt as KMS_RELEASE_SIGNER,z as LoginRequired,st as MAX_REPORT_PAGE,_t as MOCK_QUOTE_HEADER,Qe as NODE_RELEASE_SIGNER,be as NotFound,lt as ORG_CAPABILITIES,$ as PRODUCTION_PROFILE,Gt as RELEASE_VERIFIER,Pe as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,Et as SEALED_PATH,S as SealedTransportError,re as StaleTransportKeyError,Te as TrapError,K as UnavailableError,B as WrongNode,pr as agentKeyBinding,ls as agentQuoteVerifier,gt as attestAgent,C as b64url,xn as browserPasskey,mr as checkOwner,Bt as claimedRelease,Ze as cloudNodeReleaseUrl,ae as compareVersions,it as confirmationCode,Sn as consentReturn,_ as createQuoteVerifier,He as createSealedFetch,hn as createSignedReleaseVerifier,Zt as deployerKey,Se as errorFrom,et as fetchAttestedKey,Ye as fetchGithubNodeRelease,ze as fetchNodeRelease,Kt as freshCollateral,I as fromB64url,In as frontendManifest,ts as generateOwnerKey,Bn as orgCapabilities,De as ownerPublicKey,Dn as pageDeployment,ce as pageQuery,ot as pendingApprovalsFrom,ns as provisionAgent,fr as provisionInfo,Tn as publisherBindingBytes,Ft as publisherBindingMessage,ss as releaseAgent,Qt as releaseConsent,jt as releaseNotesUrl,Ht as stalledBy,Le as transportKeyBinding,Ae as trustSignedRelease,qe as trustedMeasurementsFromReleases,vn as upgradeConsent,ur as validateAgentId,qt as verifyReleaseUrl,os as verifySignedAgentPolicy,Ot as verifySignedNodeRelease,kn as withdrawConsent};
+`))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?d=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!d&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:d,data:g}}}}function Jt(r){return Array.from(r,e=>e.toString(16).padStart(2,"0")).join("")}function zt(){return`node:c-${C(crypto.getRandomValues(new Uint8Array(16)))}`}var Mn={retries:6,baseDelayMs:200,maxDelayMs:2e3};function $n(r,e){return Math.min(e.baseDelayMs*2**r,e.maxDelayMs)}function Yt(r){return r==="auth/refresh"||r.startsWith("auth/passkey/")}var ct=class r{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;let t=i=>i.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(t))],this.policy=e.policy,this.retry={...Mn,...e.retry};let n=e.fetch??((i,o)=>fetch(i,o)),s=async(i,o)=>{try{return await n(i,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=s}static async connect(e){let t=e.directory??tt,n=e.random??Math.random,s=e.fetch??((d,u)=>fetch(d,u)),i=await rt(t,e.cluster,s),[o,...a]=nt(i.nodes,e.zone,n),c=new r({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:t,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+i.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let t=this.channels.get(e);return t||(t=He({baseUrl:e,transportPublicKey:()=>et(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,t)),t}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,t){if(this.nodeUrl!==e&&!t.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let s=1;s<n;s++){let i=(this.at+s)%n;if(!t.has(this.nodeUrls[i]))return this.at=i,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=rt(e.directory,e.cluster,this.raw).then(t=>{let n=this.nodeUrl,s=nt(t.nodes,e.zone,e.random);this.nodeUrls=[n,...s.filter(i=>i!==n)],this.at=0,e.due=Date.now()+t.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,t,n,s,i="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;s?(a["content-type"]=i,c=s):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let d=this.nodeUrl;try{return await this.channel(d)(`${d}/${t}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw On(u)}}async send(e,t,n,s,i,o){let a=!1,c=!1;for(;;){let[d,u]=[this.auth,this.nodeUrl],g=await this.request(e,t,n,s,i,o);if(g.ok)return g;let p=await at(g);if(p instanceof B&&!c){if(c=!0,this.moveOn(u)&&!Yt(t))continue}else if(p instanceof z&&!a&&this.mayRefresh(d,t)){a=!0,await this.renew(d);continue}throw p}}mayRefresh(e,t){return e!==void 0&&this.current!==void 0&&!Yt(t)}async renew(e){this.auth===e&&await this.refresh()}async json(e,t,n,s,i){let a=await(await this.send(e,t,n,s,i)).text();return a?JSON.parse(a):{}}async retried(e,t,n,s=!1){let i=s?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let d=0;;d++){c=this.nodeUrl,o.add(c);try{return await this.json(e,t,n)}catch(g){if(g instanceof K)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new K("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(d>=i)break;let u=$n(d,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(s||!this.failOver(c,o))throw a}}post(e,t={}){return this.json("POST",e,t)}get(e){return this.json("GET",e)}put(e,t={}){return this.json("PUT",e,t)}delete(e,t){return this.json("DELETE",e,t)}async signUp(e,t){let n=await this.post("auth/passkey/register/begin",{name:t}),s=await e.create(n.options),i=await this.postConfirmed("auth/passkey/register/finish",{challengeId:n.challengeId,registration:s},e);return this.useSession(i),i}async signIn(e){let t=await this.post("auth/passkey/login/begin"),n=await e.get(I(t.options.challenge),t.options.rpId),s=await this.post("auth/passkey/login/finish",{challengeId:t.challengeId,assertion:n});return this.useSession(s),s}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let t=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(t,t)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let t;for(let n=1;t===void 0;n++)try{t=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(s){if(!(s instanceof B)||n>=this.nodeUrls.length)throw s}return this.current===e&&this.useSession(t),t}async signOut(){await this.post("auth/logout"),this.auth=void 0,this.current=void 0}async signOutEverywhere(){await this.post("auth/logout-all"),this.auth=void 0,this.current=void 0}me(){return this.get("auth/me")}async addPasskey(e,t){let n=await this.post("auth/passkeys/add/begin"),s=await e.create(n.options),{credentialId:i}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:s},t);return i}async removePasskey(e,t){await this.deleteConfirmed(`auth/passkeys/${l(e)}`,t)}async labelPasskey(e,t){await this.post(`auth/passkeys/${l(e)}`,{label:t})}usage(){return this.get("auth/usage")}async attestation(){let e=Jt(crypto.getRandomValues(new Uint8Array(32))),t=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!t.ok)throw await at(t);return await t.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e,t){await this.deleteConfirmed(`auth/apikeys/${l(e)}`,t)}createApiKey(e,t){return this.postConfirmed("auth/apikeys",{...e},t)}async uploadBundle(e){let{hash:t}=await this.json("POST","bundles",void 0,e);return t}uploadBlob(e,t,n={}){let s=(typeof n=="string"?n:n.contentType)??"application/octet-stream";return this.json("POST",`apps/${l(e)}/blobs`,void 0,t,s)}async downloadBlob(e,t){return(await this.blobContent(e,t)).data}async downloadBlobGranted(e,t,n){return(await this.blobContent(e,t,{grant:n})).data}async blobContent(e,t,n={}){let s=n.grant===void 0?"":`?grant=${encodeURIComponent(n.grant)}`,i=await this.send("GET",`apps/${l(e)}/blobs/${l(t)}${s}`);return{data:new Uint8Array(await i.arrayBuffer()),contentType:i.headers.get("content-type")??"application/octet-stream"}}async listBlobs(e){let{blobs:t}=await this.get(`apps/${l(e)}/blobs`);return t}blobInfo(e,t){return this.get(`apps/${l(e)}/blobs/${l(t)}/info`)}async deleteBlob(e,t){await this.delete(`apps/${l(e)}/blobs/${l(t)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,t){return this.post("packages/install",{package:e,version:t})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${l(e)}`)}uninstallPackage(e,t){return this.delete(t===void 0?`packages/${l(e)}`:`packages/${l(e)}/${l(t)}`)}async listApps(e={}){let t=new URLSearchParams;e.package&&t.set("package",e.package),e.bundle&&t.set("bundle",e.bundle);let n=t.toString(),{apps:s}=await this.get(n?`apps?${n}`:"apps");return s}getApp(e){return this.get(`apps/${l(e)}`)}async deleteApp(e){await this.delete(`apps/${l(e)}`)}async setAccess(e,t){await this.post(`apps/${l(e)}/access`,{access:t})}async setAppMetadata(e,t){await this.post(`apps/${l(e)}/metadata`,{metadata:t})}appXcalls(e){return this.get(`apps/${l(e)}/xcalls`)}appStorage(e){return this.get(`apps/${l(e)}/storage`)}appAbi(e){return this.get(`apps/${l(e)}/abi`)}async transferApp(e,t,n){await this.postConfirmed(`apps/${l(e)}/transfer`,{to:t},n)}upgradeApp(e,t,n){let s=`apps/${l(e)}/upgrade`;return n?this.postConfirmed(s,t,n):this.post(s,t)}postConfirmed(e,t,n){return this.confirmed("POST",e,t,n)}deleteConfirmed(e,t,n={}){return this.confirmed("DELETE",e,n,t)}async confirmed(e,t,n,s,i=o=>this.json(e,t,o)){try{return await i(n)}catch(o){if(!(o instanceof Y)||!s)throw o;let a=o.details,c;try{c=await s.get(I(a.challenge),a.rpId,a.allowCredentials)}catch(d){let u=d?.name;throw u==="NotAllowedError"||u==="AbortError"?new ie(d):d}return i({...n,confirm:{challengeId:a.challengeId,assertion:c}})}}async createApp(e,t,n={}){let s=typeof t=="string"?{bundle:t}:t,{appId:i}=await this.post("apps",{name:e,...s,...n});return i}call(e,t,n={},s){let i=s??zt();return this.retried("POST",`apps/${l(e)}/intents`,{method:t,args:n,idempotencyKey:i})}async callConfirmed(e,t,n,s,i){let o=`apps/${l(e)}/intents`,a=i??zt();return this.confirmed("POST",o,{method:t,args:n,idempotencyKey:a},s,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,t,n={},s={}){return this.retried("POST",`apps/${l(e)}/views`,{method:t,args:n,consistency:s.stale?"stale":"strong",minIndex:s.minIndex??0})}events(e,t=0,n){return this.stream(`apps/${l(e)}/events?from=${t}`,n)}async*stream(e,t){let n=await this.send("GET",e,void 0,void 0,void 0,t);if(!n.body)throw new w(n.status,"EVENTS","the event stream has no body");yield*Nn(n.body)}async publishPresence(e,t,n){await this.post(`apps/${l(e)}/presence`,{seq:t,state:n===null?null:Jt(n)})}async presence(e){let{present:t}=await this.get(`apps/${l(e)}/presence`);return t}presenceStream(e,t){return this.stream(`apps/${l(e)}/presence/stream`,t)}async setAlias(e,t){await this.put(`auth/aliases/${l(e)}`,{app:t})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:t}=await this.get(`auth/aliases/${l(e)}`);return t}async deleteAlias(e){await this.delete(`auth/aliases/${l(e)}`)}async createOrg(e){let{orgId:t}=await this.post("orgs",{name:e});return t}getOrg(e){return this.get(`orgs/${l(e)}`)}async deleteOrg(e,t){await this.deleteConfirmed(`orgs/${l(e)}`,t)}async setOrgMetadata(e,t){await this.post(`orgs/${l(e)}/metadata`,{metadata:t})}async setMemberMetadata(e,t,n){await this.post(`orgs/${l(e)}/members/${l(t)}/metadata`,{metadata:n})}upgradeOrg(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrade`,{...t},n)}upgradeRun(e,t){return this.get(`orgs/${l(e)}/upgrades/${l(t)}`)}retryUpgradeRun(e,t,n){return this.postConfirmed(`orgs/${l(e)}/upgrades/${l(t)}/retry`,{},n)}async approveRelease(e,t,n,s=!0){let i=e===null?"auth/releases":`orgs/${l(e)}/releases`;return this.postConfirmed(i,{version:t,approved:s},n)}async approveOutbound(e,t,n,s={}){let i=e===null?"auth/outbound":`orgs/${l(e)}/outbound`;return this.postConfirmed(i,{package:t,prefixes:s.prefixes??"manifest",replace:s.replace??!1},n)}appsReport(e,t={}){let n=e===null?"auth/apps":`orgs/${l(e)}/apps`;return this.get(`${n}${ce(t)}`)}async appsReportAll(e){let t=await this.appsReport(e),n=[...t.apps],s=t.next;for(;s!==null;){let i=await this.appsReport(e,{after:s});n.push(...i.apps),s=i.next}return{...t,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[t,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return ot(t,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,t={}){let n=typeof t=="function"?{navigate:t}:t,s=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),i=await this.requestConsent(e);if(i.code!==void 0){let o=await it(i.requestId);if(i.code!==o)throw new w(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:i.requestId,code:i.code,expected:o})}return n.confirm&&!await n.confirm(i)||s(i.url),i}consentResult(e){return this.get(`consent/${l(e)}/result`)}async waitForConsent(e,t={}){let n=t.intervalMs??2e3;for(;;){let s=await this.consentResult(e);if(s.status!=="pending"||t.signal?.aborted||t.expiresAt!==void 0&&Date.now()/1e3>=t.expiresAt)return s;await new Promise(i=>setTimeout(i,n))}}publisherBinding(e){return this.get(`publishers/${l(e)}`)}bindPublisher(e,t,n){return this.postConfirmed(`orgs/${l(e)}/publishers`,{...t},n)}upgradePublished(e,t,n,s){return this.postConfirmed(`orgs/${l(e)}/packages/${l(t)}/upgrade`,{...n},s)}opsApps(e={}){return this.get(`ops/apps${ce(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ce(e)}`)}async setReleaseDeadline(e,t){let n=typeof t=="string"?t:t.toISOString();await this.post(`ops/releases/${l(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${l(e)}/deadline`)}async setMember(e,t,n,s){await this.postConfirmed(`orgs/${l(e)}/members`,{account:t,role:n},s)}removeMember(e,t,n){return this.deleteConfirmed(`orgs/${l(e)}/members/${l(t)}`,n)}async setCapabilities(e,t,n,s={}){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{capabilities:t,...s},n)}async createTeam(e,t,n,s){let{teamId:i}=await this.post(`orgs/${l(e)}/teams`,{name:t,join:n,parent:s});return i}getTeam(e,t){return this.get(`orgs/${l(e)}/teams/${l(t)}`)}async updateTeam(e,t,n){await this.post(`orgs/${l(e)}/teams/${l(t)}`,n)}async deleteTeam(e,t){await this.delete(`orgs/${l(e)}/teams/${l(t)}`)}async setTeamMember(e,t,n,s,i={}){await this.postConfirmed(`orgs/${l(e)}/teams/${l(t)}/members`,{account:n,...i},s)}async removeTeamMember(e,t,n,s){await this.deleteConfirmed(`orgs/${l(e)}/teams/${l(t)}/members/${l(n)}`,s)}async invite(e,t,n,s=[],i={}){let{token:o}=await this.postConfirmed(`orgs/${l(e)}/invites`,{role:t,teams:s,...i},n);return o}redeemInvite(e){return this.post(`invites/${l(e)}/redeem`)}grantDeployer(e,t,n={}){let s=n.until instanceof Date?n.until.toISOString():n.until;return this.postConfirmed("deployers",{deployer:e,...s===void 0?{}:{until:s}},t)}deployers(){return this.get("deployers")}async revokeDeployer(e,t){let n=typeof e=="string"?e:Zt(e);await this.deleteConfirmed(`deployers/${l(n)}`,t)}async createDeployment(e,t,n){let{id:s}=await this.postConfirmed("deployments",{name:e,owner:t},n);return s}async deployments(){let{deployments:e}=await this.get("deployments");return e}deployment(e){return this.get(`deployments/${l(e)}`)}async deleteDeployment(e,t){await this.deleteConfirmed(`deployments/${l(e)}`,t)}offerApp(e,t,n){return this.postConfirmed(`deployments/${l(e)}/apps`,{...t},n)}async withdrawApp(e,t,n){await this.deleteConfirmed(`deployments/${l(e)}/apps/${l(t)}`,n)}deploymentOrgs(e){return this.get(`deployments/${l(e)}/orgs`)}};var lt={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},_n=lt.JOIN_OPEN_TEAMS;function Bn(...r){return r.reduce((e,t)=>e|lt[t],0)}function ke(r,e){return(r<<e|r>>>32-e)>>>0}function D(r,e,t,n,s){r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],16),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],12),r[e]=r[e]+r[t]>>>0,r[s]=ke(r[s]^r[e],8),r[n]=r[n]+r[s]>>>0,r[t]=ke(r[t]^r[n],7)}function Xt(r,e){return(r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24)>>>0}function tr(r,e,t){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=Xt(r,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=Xt(t,o*4);let s=n.slice();for(let o=0;o<10;o+=1)D(s,0,4,8,12),D(s,1,5,9,13),D(s,2,6,10,14),D(s,3,7,11,15),D(s,0,5,10,15),D(s,1,6,11,12),D(s,2,7,8,13),D(s,3,4,9,14);let i=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=s[o]+n[o]>>>0;i[o*4]=a&255,i[o*4+1]=a>>>8&255,i[o*4+2]=a>>>16&255,i[o*4+3]=a>>>24&255}return i}function Kn(r,e,t,n){let s=new Uint8Array(n.length);for(let i=0,o=e;i<n.length;i+=64,o+=1){let a=tr(r,o,t),c=Math.min(i+64,n.length);for(let d=i;d<c;d+=1)s[d]=n[d]^a[d-i]}return s}function dt(r){let e=0n;for(let t=r.length-1;t>=0;t-=1)e=e<<8n|BigInt(r[t]);return e}var Vn=(1n<<130n)-5n;function Ln(r,e){let t=dt(r.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=dt(r.subarray(16,32)),s=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),d=dt(c)+(1n<<BigInt(8*c.length));s=(s+d)*t%Vn}let i=s+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(i&0xffn),i>>=8n;return o}function Wt(r){return new Uint8Array((16-r%16)%16)}function er(r){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(r),!0),e}function Hn(r,e){let t=[r,Wt(r.length),e,Wt(e.length),er(r.length),er(e.length)],n=new Uint8Array(t.reduce((i,o)=>i+o.length,0)),s=0;for(let i of t)n.set(i,s),s+=i.length;return n}function Fn(r,e){if(r.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function rr(r,e,t,n=new Uint8Array(0)){Fn(r,e);let s=tr(r,0,e).subarray(0,32),i=Kn(r,1,e,t),o=Ln(s,Hn(n,i)),a=new Uint8Array(i.length+16);return a.set(i),a.set(o,i.length),a}var sr=32,Gn=1,jn=3,qn=2,Qn=32,Jn=32,zn=12,Z=r=>new TextEncoder().encode(r),de=r=>new Uint8Array([r>>8&255,r&255]),nr=y(Z("KEM"),de(sr)),le=y(Z("HPKE"),de(sr),de(Gn),de(jn));async function ir(r,e){let t=r.length===0?new Uint8Array(32):r,n=await crypto.subtle.importKey("raw",t,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function Yn(r,e,t){let n=new Uint8Array(t),s=new Uint8Array(0);for(let i=1,o=0;o<t;i+=1)s=await ir(r,y(s,e,new Uint8Array([i]))),n.set(s.subarray(0,Math.min(s.length,t-o)),o),o+=s.length;return n}function ve(r,e,t,n){return ir(e,y(Z("HPKE-v1"),r,Z(t),n))}function ut(r,e,t,n,s){return Yn(e,y(de(s),Z("HPKE-v1"),r,Z(t),n),s)}async function Zn(r,e){let t=await ve(nr,new Uint8Array(0),"eae_prk",r);return ut(nr,t,"shared_secret",e,Qn)}async function Xn(r,e){let t=new Uint8Array(0),n=await ve(le,t,"psk_id_hash",t),s=await ve(le,t,"info_hash",e),i=y(new Uint8Array([qn]),n,s),o=await ve(le,r,"secret",t);return{key:await ut(le,o,"key",i,Jn),nonce:await ut(le,o,"base_nonce",i,zn)}}async function or(r,e,t,n,s=new Uint8Array(0),i){if(r.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await G(i),a=await G(e),c=y(await W(o.privateKey,r),await W(a.privateKey,r)),d=await Zn(c,y(o.publicKey,r,a.publicKey)),{key:u,nonce:g}=await Xn(d,t);return{enc:o.publicKey,ciphertext:rr(u,g,n,s)}}var lr="mero-agent-gate/attest/v3",dr="mero-agent-gate/provision/v2",Wn=/^[a-z0-9][a-z0-9-]{0,62}$/,es=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,ar=64,cr=64*1024,O=class extends Error{constructor(t,n,s){super(t);this.status=n;this.code=s;this.name="AgentGateError"}};function ur(r){if(!Wn.test(r))throw new Error(`Agent id ${JSON.stringify(r)} must match [a-z0-9][a-z0-9-]{0,62}`)}function ue(r){return new TextEncoder().encode(r)}function gr(r){let e=ue(r);return y(new Uint8Array([e.length]),e)}function V(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e)}function Ie(r,e,t){let n;try{n=Uint8Array.from(atob(r.trim()),s=>s.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(t!==void 0&&n.length!==t)throw new Error(`${e} is not ${t} bytes`);return n}async function pr(r,e,t,n){let s=new Uint8Array(32),i=y(ue(lr),r,gr(e),t??s,n??s);return new Uint8Array(await crypto.subtle.digest("SHA-256",i))}function fr(r,e){return y(ue(dr),r,gr(e))}async function ts(){let r=crypto.getRandomValues(new Uint8Array(32));return{secret:r,publicKey:await De(r)}}async function De(r){if(r.length!==32)throw new Error("An owner key is 32 bytes");return V((await G(r)).publicKey)}function yr(r,e){return`${r.replace(/\/+$/,"")}${e}`}async function hr(r,e,t){let n=await r(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(t)}),s=await n.text(),i;try{i=s?JSON.parse(s):void 0}catch{}if(!n.ok){let o=i;throw new O(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??s.slice(0,200)}`,n.status,o?.error)}return i}async function gt(r){let e=r.agentId??"";e&&ur(e);let t=crypto.getRandomValues(new Uint8Array(32)),n=await hr(r.fetch??fetch,yr(r.gateUrl,"/attest"),{nonceB64:V(t),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let s=Ie(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),i=n.signingPublicKeyB64?Ie(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ie(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!i!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await pr(s,e,i,o);return await r.verifier({quoteB64:n.quoteB64,nonce:R(t),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:V(s),...i?{signingPublicKey:V(i)}:{},...o?{ownerPublicKey:V(o)}:{}}}async function mr(r,e){let t=await De(e);if(r.ownerPublicKey&&r.ownerPublicKey!==t)throw new O(`This agent is claimed by another key (${r.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return t}function rs(r){let e=Object.keys(r);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>ar)throw new Error(`At most ${ar} secrets at once`);for(let t of e){if(!es.test(t))throw new Error(`Secret name ${JSON.stringify(t)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof r[t]!="string")throw new Error(`Secret ${t} is not a string`);if(ue(r[t]).length>cr)throw new Error(`Secret ${t} is over ${cr} bytes`)}}async function wr(r,e,t,n,s,i){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await mr(n,s),a=Ie(n.provisioningPublicKey,"provisioningPublicKey",32),c=await or(a,s,fr(a,n.agentId),ue(JSON.stringify(i)));return hr(r,yr(e,t),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:V(c.enc),ciphertextB64:V(c.ciphertext)})}async function ns(r){rs(r.secrets);let e=r.fetch??fetch,t=await wr(e,r.gateUrl,"/provision",r.agent,r.ownerSecret,{secrets:r.secrets}),n=await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e}),s=await De(r.ownerSecret);if(n.ownerPublicKey!==s||!n.signingPublicKey)throw new O("The gate accepted the secrets, but its quote does not name your key as owner");if(r.agent.signingPublicKey&&r.agent.signingPublicKey!==n.signingPublicKey)throw new O("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:s,written:t?.written??[],claimed:t?.claimed===!0}}async function ss(r){if(!r.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=r.fetch??fetch;if(await wr(e,r.gateUrl,"/release",r.agent,r.ownerSecret,{release:!0}),(await gt({gateUrl:r.gateUrl,agentId:r.agent.agentId,verifier:r.verifier,fetch:e})).ownerPublicKey)throw new O("The gate says it released the agent, but its quote still names an owner")}var pt=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),is=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function os(r,e,t={}){let n=typeof r=="string"?new TextEncoder().encode(r):r;await me(n,e,{identity:t.identity??pt.identity,issuer:t.issuer??pt.issuer});let s;try{s=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let i=t.role??"agent";if(s?.role!==i)throw new Error(`The signed file is a ${JSON.stringify(s?.role)} policy, not an ${i} one`);let o=t.profile??$;if(s.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(s.profile)} profile, not ${o}`);if(t.expectedVersion!==void 0&&s.version!==t.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(s.version)}, not ${t.expectedVersion}`);return Ar(s),s}function Ar(r){for(let e of is)if(!Array.isArray(r?.[e])||r[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var as=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function cs(r){let e=as.find(t=>t.toLowerCase()===r.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(r)}`);return e}var ge=r=>r.trim().replace(/^0x/i,"");function ls(r,e){return Ar(r),_({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:r.allowed_tcb_statuses.map(cs),allowedMrtd:r.allowed_mrtd.map(ge),allowedRtmr0:r.allowed_rtmr0.map(ge),allowedRtmr1:r.allowed_rtmr1.map(ge),allowedRtmr2:r.allowed_rtmr2.map(ge),allowedRtmr3:r.allowed_rtmr3.map(ge)})}export{lr as AGENT_ATTEST_DOMAIN,dr as AGENT_PROVISION_INFO_DOMAIN,O as AgentGateError,xe as AppError,Ee as ArgsTooLarge,ct as CalimeroClient,w as CalimeroError,ie as ConfirmCancelled,Y as ConfirmRequired,Ue as ConsentStale,Je as DEFAULT_COLLATERAL_MIRROR,tt as DEFAULT_DIRECTORY,_n as DEFAULT_ORG_CAPABILITIES,we as DEFAULT_RELEASE_MIRROR,T as DirectoryError,Nt as GITHUB_RELEASES,bt as HANDSHAKE_PATH,Re as IdempotencyMismatch,pt as KMS_RELEASE_SIGNER,z as LoginRequired,st as MAX_REPORT_PAGE,_t as MOCK_QUOTE_HEADER,Qe as NODE_RELEASE_SIGNER,be as NotFound,lt as ORG_CAPABILITIES,$ as PRODUCTION_PROFILE,Gt as RELEASE_VERIFIER,Pe as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,Et as SEALED_PATH,S as SealedTransportError,re as StaleTransportKeyError,Te as TrapError,K as UnavailableError,B as WrongNode,pr as agentKeyBinding,ls as agentQuoteVerifier,gt as attestAgent,C as b64url,xn as browserPasskey,mr as checkOwner,Bt as claimedRelease,Ze as cloudNodeReleaseUrl,ae as compareVersions,it as confirmationCode,Sn as consentReturn,_ as createQuoteVerifier,He as createSealedFetch,hn as createSignedReleaseVerifier,Zt as deployerKey,Se as errorFrom,et as fetchAttestedKey,Ye as fetchGithubNodeRelease,ze as fetchNodeRelease,Kt as freshCollateral,I as fromB64url,In as frontendManifest,ts as generateOwnerKey,Bn as orgCapabilities,De as ownerPublicKey,Dn as pageDeployment,ce as pageQuery,ot as pendingApprovalsFrom,ns as provisionAgent,fr as provisionInfo,Tn as publisherBindingBytes,Ft as publisherBindingMessage,ss as releaseAgent,Qt as releaseConsent,jt as releaseNotesUrl,Ht as stalledBy,Le as transportKeyBinding,Ae as trustSignedRelease,qe as trustedMeasurementsFromReleases,vn as upgradeConsent,ur as validateAgentId,qt as verifyReleaseUrl,os as verifySignedAgentPolicy,Ot as verifySignedNodeRelease,kn as withdrawConsent};
 //# sourceMappingURL=index.browser.mjs.map