@calimero-network/mero-js 29.13.0 → 29.14.0

package/README.md

@@ -104,7 +104,7 @@ Pinned measurements go through `policy.verifyQuote` (`createQuoteVerifier`).
 - **Apps**: `createApp`, `listApps`, `getApp`, `deleteApp`, `setAccess`, `setAppMetadata`, `appStorage`, `appAbi`, `upgradeApp`, `transferApp`, `moveApp`.
 - **Calls**: `call`, `callConfirmed`, `view`, `events`. A call always carries an idempotency key, and is sent again with it while the node answers `503`, then to the next node.
 - **Blobs and presence**: `uploadBlob`, `downloadBlob`, `listBlobs`, `blobInfo`, `deleteBlob`; `publishPresence`, `presence`, `presenceStream`.
-- **Organizations**: `createOrg`, `getOrg`, `orgMembersSecurity` (owners and admins: each member's passkey count to `3+`, recovery code set, last active day, live sessions), `deleteOrg`, `setOrgMetadata`, `setMember`, `removeMember`, `setMemberMetadata`, `setCapabilities` (`ORG_CAPABILITIES`), `setTeamDefaultCapabilities`, teams, app teams (`listAppTeams`, `scopeApps`), `invite`, `redeemInvite`, `listInvites`, `revokeInvite`, recovery (`setRecoveryKey`, `startRecovery`, `cancelRecovery`, `finishRecovery`; `newRecoverySeed`, `recoveryPublicKey`). Setting or removing a member or team member, capabilities, invites (minting and revoking) and scoping apps are approved with the caller's passkey; redeeming an invite is not.
+- **Organizations**: `createOrg`, `getOrg`, `orgMembersSecurity` (owners and admins: each member's passkey count to `3+`, recovery code set, last active day, live sessions), `deleteOrg`, `setOrgMetadata`, `setMember`, `removeMember`, `setMemberMetadata`, `setCapabilities` (`ORG_CAPABILITIES`), `setTeamDefaultCapabilities`, teams, app teams (`listAppTeams`, `scopeApps`), `invite` (`{ allApps: true }`: whoever redeems it gets every app added later), `setAllApps` (owner or admin: every app added later, for a member), `redeemInvite`, `listInvites`, `revokeInvite`, recovery (`setRecoveryKey`, `startRecovery`, `cancelRecovery`, `finishRecovery`; `newRecoverySeed`, `recoveryPublicKey`). Setting or removing a member or team member, capabilities, invites (minting and revoking) and scoping apps are approved with the caller's passkey; redeeming an invite is not.
 - **Owner decisions** (passkey approval, never from an app's frontend): `upgradeOrg`, `upgradeRun`, `retryUpgradeRun`, `approveRelease`, `approveOutbound`, `bindPublisher`, `upgradePublished`.
 - **Approvals from an app**: `appsReport`, `releaseRules`, `pendingApprovals`, then `requestConsent` / `openConsentPage` to send the user to the node's consent page, and `consentResult`. Show the answer's `code` to the user before sending them to `url` (`openConsentPage`'s `confirm` hook); they should see the same code on the page (`confirmationCode(requestId)` checks it). See [Ask your users to approve node images and app upgrades](https://calimero-network.github.io/mero-js/guides/user-approvals/).
 - **Operator** (ops token): `opsApps`, `opsOrgs`, `opsServedOrigins` (every custom domain the log holds, by package label), `setReleaseDeadline`, `liftReleaseDeadline`.

package/dist/cloud-v2/client.d.ts

@@ -151,6 +151,12 @@ export interface OrgInfo extends Record<string, unknown> {
     recovery?: OrgRecovery;
     /** How it holds its apps ({@link OrgMode}); absent from nodes before app teams. */
     mode?: OrgMode;
+    /**
+     * The members (those the caller sees) who get every app added from now on
+     * ({@link CalimeroClient.setAllApps}); absent while there are none, and
+     * from nodes before core's `feat/org-all-apps`.
+     */
+    allApps?: string[];
 }
 /**
  * How an organization holds its apps, derived from its app teams (core
@@ -249,6 +255,8 @@ export interface OrgInvite {
     createdBy: string | null;
     /** Unix seconds; `null` for invites made before core recorded it. */
     createdAt: number | null;
+    /** Whoever redeems it also gets every app added later; absent from nodes before core's `feat/org-all-apps`. */
+    allApps?: boolean;
 }
 /** One direct row of a team ({@link TeamInfo}). */
 export interface TeamMemberInfo {
@@ -1429,6 +1437,18 @@ export declare class CalimeroClient {
         account?: string;
         team?: string;
     }): Promise<void>;
+    /**
+     * Give a member every app added to the organization from now on, or stop
+     * it (`allApps: false`), core `POST /orgs/{org}/all-apps`: the owner's or
+     * an admin's, approved with `passkey` (`__set_all_apps { account, allApps
+     * }`). Each app team made after gives them a row, so in an organization
+     * that keeps its apps apart a new app reaches them though nobody named
+     * them; apps already there are untouched. {@link invite} with
+     * `{ allApps: true }` gives it to whoever redeems the invite. A member
+     * below admin is refused (`403`), someone outside gets {@link NotFound};
+     * a node from before the route answers a bare `404`.
+     */
+    setAllApps(org: string, account: string, allApps: boolean, passkey: PasskeyProvider): Promise<void>;
     /**
      * Set the capability bits everyone in `team` holds there on top of their
      * own, unless their row sets its own (`POST /orgs/{org}/capabilities` with
@@ -1483,6 +1503,7 @@ export declare class CalimeroClient {
     invite(org: string, role: 'guest' | 'member' | 'admin', passkey: PasskeyProvider, teams?: string[], options?: {
         ttlSecs?: number;
         uses?: number;
+        allApps?: boolean;
     }): Promise<string>;
     redeemInvite(token: string): Promise<Record<string, unknown>>;
     /**

package/dist/cloud-v2/client.js

@@ -1414,6 +1414,20 @@ export class CalimeroClient {
     async setCapabilities(org, capabilities, passkey, at = {}) {
         await this.postConfirmed(`orgs/${seg(org)}/capabilities`, { capabilities, ...at }, passkey);
     }
+    /**
+     * Give a member every app added to the organization from now on, or stop
+     * it (`allApps: false`), core `POST /orgs/{org}/all-apps`: the owner's or
+     * an admin's, approved with `passkey` (`__set_all_apps { account, allApps
+     * }`). Each app team made after gives them a row, so in an organization
+     * that keeps its apps apart a new app reaches them though nobody named
+     * them; apps already there are untouched. {@link invite} with
+     * `{ allApps: true }` gives it to whoever redeems the invite. A member
+     * below admin is refused (`403`), someone outside gets {@link NotFound};
+     * a node from before the route answers a bare `404`.
+     */
+    async setAllApps(org, account, allApps, passkey) {
+        await this.postConfirmed(`orgs/${seg(org)}/all-apps`, { account, allApps }, passkey);
+    }
     /**
      * Set the capability bits everyone in `team` holds there on top of their
      * own, unless their row sets its own (`POST /orgs/{org}/capabilities` with

package/dist/index.browser.mjs

@@ -5,5 +5,5 @@ ${r}
 ${n}`}function Xn(t,e,r,n){return new TextEncoder().encode(lt(t,e,r,n))}var Wn="0123456789ABCDEFGHJKMNPQRSTVWXYZ";async function br(t){let e=new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t))),r=(e[0]<<24|e[1]<<16|e[2]<<8|e[3])>>>0,n="";for(let i=0;i<6;i++)i===3&&(n+="-"),n+=Wn[r>>>27-5*i&31];return n}function ei(t){let e=typeof t=="string"?new URL(t):t,r=e.searchParams.get("request_id"),n=e.searchParams.get("result");return!r||n!=="approved"&&n!=="declined"?null:{requestId:r,result:n}}var dt="https://mero-tee.vercel.app";function ut(t){return`https://github.com/calimero-network/mero-tee/releases/tag/mero-tee-v${encodeURIComponent(t)}`}function gt(t){return`${dt}/mero-tee?release_tag=${encodeURIComponent(`mero-tee-v${t}`)}`}function Er(t,e,r=Date.now()/1e3){let n=c=>e.deadlines.find(d=>d.version===c)??null,i=t.governance.releases==="owner",s=t.governance.appUpgrades==="owner",o=t.clusterReleases.filter(c=>!c.approved).sort((c,d)=>de(d.release,c.release)).map(c=>({version:c.release,nodes:c.nodes,actionable:i,releaseNotesUrl:ut(c.release),verifyUrl:gt(c.release),deadline:n(c.release)})),a=[];for(let c of t.apps){let d=c.availableVersions??[];c.package===null||d.length===0||a.push({app:c.app,name:c.name??null,package:c.package.package,from:c.package.version,to:d[d.length-1],available:d,actionable:s})}return{scope:t.scope,governance:t.governance,approvedReleases:t.approvedReleases,releases:o,upgrades:a,stalledBy:ct(t.approvedReleases,e.deadlines,r),actionable:o.some(c=>c.actionable)||a.some(c=>c.actionable)}}function pt(t,e,r,n={}){return{kind:"release",scope:t.kind==="org"?{org:t.org}:"account",subject:n.withdraw?{version:e,withdraw:!0}:{version:e},returnTo:r}}function ri(t,e,r){return pt(t,e,r,{withdraw:!0})}function ti(t,e,r){return{kind:"upgrade",subject:{app:t,toVersion:e},returnTo:r}}function mt(t){return"account"in t?`account:${t.account}`:`org:${t.org}`}async function ni(t,e=fetch){let r=t??globalThis.location?.origin;if(!r)throw new Error("no page origin to read the frontend manifest from; pass `origin`");let n=await e(new URL("/.well-known/calimero.json",r).toString());if(!n.ok)throw await Rr(n);let i=await n.json();return{...i,deployments:i.deployments??[]}}function ii(t){let e=t??globalThis.location?.href;if(!e)return null;try{return new URL(e).searchParams.get("deployment")||null}catch{return null}}function si(t,e){return t==="required"||t==="preferred"||t==="discouraged"?t:e}function oi(t){let e=t,r=e?.name,n=typeof e?.message=="string"?e.message:"";return r==="InvalidStateError"||/not focused|already pending/i.test(n)?new ae(t):r==="NotAllowedError"||r==="AbortError"?new oe(t):t}function l(t){return encodeURIComponent(t)}function ai(t){return t instanceof S&&t.status===413?Ke(413,{error:"TOO_LARGE",message:t.message.replace(/^Sealed request refused: /,"")}):t}async function Rr(t){let e=await t.text().catch(()=>""),r={};try{r=e?JSON.parse(e):{}}catch{r={message:e}}return Ke(t.status,r,t.headers.get("retry-after"))}async function*ci(t){let e=t.getReader(),r=new TextDecoder,n="";for(;;){let{value:i,done:s}=await e.read();if(s)return;n+=r.decode(i,{stream:!0});let o;for(;(o=n.indexOf(`
 
 `))>=0;){let a=n.slice(0,o);n=n.slice(o+2);let c="",d="",u="";for(let p of a.split(`
-`))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?d=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!d&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:d,data:g}}}}function ft(t){return Array.from(t,e=>e.toString(16).padStart(2,"0")).join("")}function yt(){return`node:c-${P(crypto.getRandomValues(new Uint8Array(16)))}`}var li={retries:6,baseDelayMs:200,maxDelayMs:2e3};function di(t,e){return Math.min(e.baseDelayMs*2**t,e.maxDelayMs)}function ht(t){return t==="auth/refresh"||t.startsWith("auth/passkey/")||ui.has(t)}var ui=new Set(["auth/recovery/begin","auth/recovery/start","auth/recovery/finish"]),Pr=class t{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;this.packageOrigins={list:async e=>{let{origins:r}=await this.get(`package-origins/${l(e)}`);return r??[]},add:(e,r,n,i={})=>this.confirmed("POST",`package-origins/${l(e)}`,{origin:r,...i.rpId===void 0?{}:{rpId:i.rpId},...i.served?{served:!0}:{}},n),remove:(e,r,n)=>this.confirmed("DELETE",`package-origins/${l(e)}`,{origin:r},n)};let r=s=>s.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(r))],this.policy=e.policy,this.retry={...li,...e.retry};let n=e.fetch??((s,o)=>fetch(s,o)),i=async(s,o)=>{try{return await n(s,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=i}static async connect(e){let r=e.directory??gr,n=e.random??Math.random,i=e.fetch??((d,u)=>fetch(d,u)),s=await pr(r,e.cluster,i),[o,...a]=fr(s.nodes,e.zone,n),c=new t({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:r,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+s.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let r=this.channels.get(e);return r||(r=We({baseUrl:e,transportPublicKey:()=>ur(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,r)),r}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,r){if(this.nodeUrl!==e&&!r.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let i=1;i<n;i++){let s=(this.at+i)%n;if(!r.has(this.nodeUrls[s]))return this.at=s,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=pr(e.directory,e.cluster,this.raw).then(r=>{let n=this.nodeUrl,i=fr(r.nodes,e.zone,e.random);this.nodeUrls=[n,...i.filter(s=>s!==n)],this.at=0,e.due=Date.now()+r.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,r,n,i,s="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;i?(a["content-type"]=s,c=i):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let d=this.nodeUrl;try{return await this.channel(d)(`${d}/${r}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw ai(u)}}async send(e,r,n,i,s,o){let a=!1,c=!1;for(;;){let[d,u]=[this.auth,this.nodeUrl],g=await this.request(e,r,n,i,s,o);if(g.ok)return g;let p=await Rr(g);if(p instanceof K&&!c){if(c=!0,this.moveOn(u)&&!ht(r))continue}else if(p instanceof B&&!a&&this.mayRefresh(d,r)){a=!0,await this.renew(d);continue}throw p}}mayRefresh(e,r){return e!==void 0&&this.current!==void 0&&!ht(r)}async renew(e){this.auth===e&&await this.refresh()}async json(e,r,n,i,s){let a=await(await this.send(e,r,n,i,s)).text();return a?JSON.parse(a):{}}async retried(e,r,n,i=!1){let s=i?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let d=0;;d++){c=this.nodeUrl,o.add(c);try{return await this.json(e,r,n)}catch(g){if(g instanceof L)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new L("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(d>=s)break;let u=di(d,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(i||!this.failOver(c,o))throw a}}post(e,r={}){return this.json("POST",e,r)}get(e){return this.json("GET",e)}put(e,r={}){return this.json("PUT",e,r)}delete(e,r){return this.json("DELETE",e,r)}async signUp(e,r,n={}){let i=this.pageOrigin(n),s=n.invite?{invite:n.invite}:{},o=await this.begin("auth/passkey/register/begin",i===void 0?{name:r,...s}:{name:r,origin:i,...s},i),a=n.signal,c=await(a?e.create(o.options,{signal:a}):e.create(o.options)),d=await this.confirmed("POST","auth/passkey/register/finish",{challengeId:o.challengeId,registration:c,...s},e,void 0,"preferred",a);return this.useSession(d),d}signUpPolicy(){return this.get("sign-up")}async signIn(e,r={}){let n=this.pageOrigin(r),i=await this.begin("auth/passkey/login/begin",n===void 0?void 0:{origin:n},n),s=i.options.rpId??i.options.rp?.id??"",o=O(i.options.challenge),a=await(r.signal?e.get(o,s,void 0,{signal:r.signal}):e.get(o,s)),c=await this.post("auth/passkey/login/finish",{challengeId:i.challengeId,assertion:a});return this.useSession(c),c}pageOrigin(e){if(e.origin!==void 0)return e.origin??void 0;let r=globalThis.location?.origin;return!r||r==="null"||new Set(this.nodeUrls.map(i=>{try{return new URL(i).origin}catch{return i}})).has(r)?void 0:r}async begin(e,r,n){try{return await this.post(e,r)}catch(i){throw i instanceof V&&!i.origin&&n!==void 0?new V(i.nodeMessage,{...i.details,origin:n}):i}}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let r=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(r,r)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let r;for(let n=1;r===void 0;n++)try{r=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(i){if(!(i instanceof K)||n>=this.nodeUrls.length)throw i}return this.current===e&&this.useSession(r),r}async signOut(){await this.signingOut("auth/logout")}async signOutEverywhere(){await this.signingOut("auth/logout-all")}async listSessions(){let{sessions:e}=await this.get("auth/sessions");return e}async revokeSession(e){await this.delete(`auth/sessions/${l(e)}`)}async listActivity(e){let r=e===void 0?"":`?after=${encodeURIComponent(String(e))}`,{activity:n}=await this.get(`auth/activity${r}`);return n}async signingOut(e){try{await this.post(e)}finally{this.auth=void 0,this.current=void 0}}me(){return this.get("auth/me")}async addPasskey(e,r){let n=await this.post("auth/passkeys/add/begin"),i=await e.create(n.options),{credentialId:s}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:i},r);return s}async removePasskey(e,r){await this.deleteConfirmed(`auth/passkeys/${l(e)}`,r)}async labelPasskey(e,r){await this.post(`auth/passkeys/${l(e)}`,{label:r})}async createRecoveryCode(e){let{code:r}=await this.postConfirmed("auth/recovery",{},e);return r}async removeRecoveryCode(e){await this.deleteConfirmed("auth/recovery",e)}async startAccountRecovery(e,r){try{let n=await this.post("auth/recovery/begin",{code:e}),i=await r.create(n.options);return await this.post("auth/recovery/start",{challengeId:n.challengeId,code:e,registration:i})}catch(n){throw n instanceof B?new ce(n.message.replace(/^401 UNAUTHENTICATED: /,""),n.details):n}}async cancelAccountRecovery(e){await this.postConfirmed("auth/recovery/cancel",{},e)}async finishAccountRecovery(e,r){let n=await this.postConfirmed("auth/recovery/finish",r?{accountId:r}:{},e);return this.useSession(n),n}usage(){return this.get("auth/usage")}async attestation(){let e=ft(crypto.getRandomValues(new Uint8Array(32))),r=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!r.ok)throw await Rr(r);return await r.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e,r){await this.deleteConfirmed(`auth/apikeys/${l(e)}`,r)}createApiKey(e,r){return this.postConfirmed("auth/apikeys",{...e},r)}async uploadBundle(e){let{hash:r}=await this.json("POST","bundles",void 0,e);return r}uploadBlob(e,r,n={}){let i=(typeof n=="string"?n:n.contentType)??"application/octet-stream";return this.json("POST",`apps/${l(e)}/blobs`,void 0,r,i)}async downloadBlob(e,r){return(await this.blobContent(e,r)).data}async downloadBlobGranted(e,r,n){return(await this.blobContent(e,r,{grant:n})).data}async blobContent(e,r,n={}){let i=n.grant===void 0?"":`?grant=${encodeURIComponent(n.grant)}`,s=await this.send("GET",`apps/${l(e)}/blobs/${l(r)}${i}`);return{data:new Uint8Array(await s.arrayBuffer()),contentType:s.headers.get("content-type")??"application/octet-stream"}}async listBlobs(e){let{blobs:r}=await this.get(`apps/${l(e)}/blobs`);return r}blobInfo(e,r){return this.get(`apps/${l(e)}/blobs/${l(r)}/info`)}async deleteBlob(e,r){await this.delete(`apps/${l(e)}/blobs/${l(r)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,r){return this.post("packages/install",{package:e,version:r})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${l(e)}`)}uninstallPackage(e,r){return this.delete(r===void 0?`packages/${l(e)}`:`packages/${l(e)}/${l(r)}`)}async listApps(e={}){let r=new URLSearchParams;e.package&&r.set("package",e.package),e.bundle&&r.set("bundle",e.bundle);let n=r.toString(),{apps:i}=await this.get(n?`apps?${n}`:"apps");return i}getApp(e){return this.get(`apps/${l(e)}`)}async deleteApp(e){await this.delete(`apps/${l(e)}`)}async setAccess(e,r){await this.post(`apps/${l(e)}/access`,{access:r})}async setAppMetadata(e,r){await this.post(`apps/${l(e)}/metadata`,{metadata:r})}appXcalls(e){return this.get(`apps/${l(e)}/xcalls`)}appStorage(e){return this.get(`apps/${l(e)}/storage`)}appAbi(e){return this.get(`apps/${l(e)}/abi`)}async transferApp(e,r,n){await this.postConfirmed(`apps/${l(e)}/transfer`,{to:r},n)}moveApp(e,r,n={},i){let s=`apps/${l(e)}/move`,o={toOrg:r,bringMembers:n.bringMembers??!1};return i?this.postConfirmed(s,o,i):this.post(s,o)}upgradeApp(e,r,n){let i=`apps/${l(e)}/upgrade`;return n?this.postConfirmed(i,r,n):this.post(i,r)}postConfirmed(e,r,n){return this.confirmed("POST",e,r,n)}deleteConfirmed(e,r,n={}){return this.confirmed("DELETE",e,n,r)}async confirmed(e,r,n,i,s=c=>this.json(e,r,c),o="required",a){try{return await s(n)}catch(c){if(!(c instanceof Z)||!i)throw c;let d=c.details,u;try{u=await i.get(O(d.challenge),d.rpId,d.allowCredentials,{userVerification:si(d.userVerification,o),...a?{signal:a}:{}})}catch(g){throw oi(g)}return s({...n,confirm:{challengeId:d.challengeId,assertion:u}})}}async createApp(e,r,n={}){let i=typeof r=="string"?{bundle:r}:r,{appId:s}=await this.post("apps",{name:e,...i,...n});return s}call(e,r,n={},i){let s=i??yt();return this.retried("POST",`apps/${l(e)}/intents`,{method:r,args:n,idempotencyKey:s})}async callConfirmed(e,r,n,i,s){let o=`apps/${l(e)}/intents`,a=s??yt();return this.confirmed("POST",o,{method:r,args:n,idempotencyKey:a},i,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,r,n={},i={}){return this.retried("POST",`apps/${l(e)}/views`,{method:r,args:n,consistency:i.stale?"stale":"strong",minIndex:i.minIndex??0})}events(e,r=0,n){return this.stream(`apps/${l(e)}/events?from=${r}`,n)}async*stream(e,r){let n=await this.send("GET",e,void 0,void 0,void 0,r);if(!n.body)throw new y(n.status,"EVENTS","the event stream has no body");yield*ci(n.body)}async publishPresence(e,r,n){await this.post(`apps/${l(e)}/presence`,{seq:r,state:n===null?null:ft(n)})}async presence(e){let{present:r}=await this.get(`apps/${l(e)}/presence`);return r}presenceStream(e,r){return this.stream(`apps/${l(e)}/presence/stream`,r)}async setAlias(e,r){await this.put(`auth/aliases/${l(e)}`,{app:r})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:r}=await this.get(`auth/aliases/${l(e)}`);return r}async deleteAlias(e){await this.delete(`auth/aliases/${l(e)}`)}async createOrg(e,r={}){let n={name:e};r.recoveryKey!==void 0&&(n.recoveryKey=r.recoveryKey);let{orgId:i}=await this.post("orgs",n);return i}async setRecoveryKey(e,r,n){await this.postConfirmed(`orgs/${l(e)}/recovery`,{publicKey:r},n)}async startRecovery(e,r){let n=(await this.me()).accountId,i=P(crypto.getRandomValues(new Uint8Array(16))),s=await wr(r,e,n,i);return this.post(`orgs/${l(e)}/recovery/start`,{nonce:i,signature:s})}async cancelRecovery(e,r){await this.postConfirmed(`orgs/${l(e)}/recovery/cancel`,{},r)}finishRecovery(e,r){return this.postConfirmed(`orgs/${l(e)}/recovery/finish`,{},r)}getOrg(e){return this.get(`orgs/${l(e)}`)}async orgMembersSecurity(e){let{members:r}=await this.get(`orgs/${l(e)}/members?detail=security`);return r}async deleteOrg(e,r){await this.deleteConfirmed(`orgs/${l(e)}`,r)}async setOrgMetadata(e,r){await this.post(`orgs/${l(e)}/metadata`,{metadata:r})}async setMemberMetadata(e,r,n){await this.post(`orgs/${l(e)}/members/${l(r)}/metadata`,{metadata:n})}upgradeOrg(e,r,n){return this.postConfirmed(`orgs/${l(e)}/upgrade`,{...r},n)}upgradeRun(e,r){return this.get(`orgs/${l(e)}/upgrades/${l(r)}`)}retryUpgradeRun(e,r,n){return this.postConfirmed(`orgs/${l(e)}/upgrades/${l(r)}/retry`,{},n)}async approveRelease(e,r,n,i=!0){let s=e===null?"auth/releases":`orgs/${l(e)}/releases`;return this.postConfirmed(s,{version:r,approved:i},n)}async approveOutbound(e,r,n,i={}){let s=e===null?"auth/outbound":`orgs/${l(e)}/outbound`;return this.postConfirmed(s,{package:r,prefixes:i.prefixes??"manifest",replace:i.replace??!1},n)}appsReport(e,r={}){let n=e===null?"auth/apps":`orgs/${l(e)}/apps`;return this.get(`${n}${ue(r)}`)}async appsReportAll(e){let r=await this.appsReport(e),n=[...r.apps],i=r.next;for(;i!==null;){let s=await this.appsReport(e,{after:i});n.push(...s.apps),i=s.next}return{...r,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[r,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return Er(r,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,r={}){let n=typeof r=="function"?{navigate:r}:r,i=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),s=await this.requestConsent(e);if(s.code!==void 0){let o=await br(s.requestId);if(s.code!==o)throw new y(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:s.requestId,code:s.code,expected:o})}return n.confirm&&!await n.confirm(s)||i(s.url),s}consentResult(e){return this.get(`consent/${l(e)}/result`)}async waitForConsent(e,r={}){let n=r.intervalMs??2e3;for(;;){let i=await this.consentResult(e);if(i.status!=="pending"||r.signal?.aborted||r.expiresAt!==void 0&&Date.now()/1e3>=r.expiresAt)return i;await new Promise(s=>setTimeout(s,n))}}publisherBinding(e){return this.get(`publishers/${l(e)}`)}bindPublisher(e,r,n){return this.postConfirmed(`orgs/${l(e)}/publishers`,{...r},n)}upgradePublished(e,r,n,i){return this.postConfirmed(`orgs/${l(e)}/packages/${l(r)}/upgrade`,{...n},i)}opsApps(e={}){return this.get(`ops/apps${ue(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ue(e)}`)}opsServedOrigins(){return this.get("ops/served-origins")}async setReleaseDeadline(e,r){let n=typeof r=="string"?r:r.toISOString();await this.post(`ops/releases/${l(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${l(e)}/deadline`)}async setMember(e,r,n,i){await this.postConfirmed(`orgs/${l(e)}/members`,{account:r,role:n},i)}removeMember(e,r,n){return this.deleteConfirmed(`orgs/${l(e)}/members/${l(r)}`,n)}async setCapabilities(e,r,n,i={}){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{capabilities:r,...i},n)}async setTeamDefaultCapabilities(e,r,n,i){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{team:r,capabilities:n},i)}async createTeam(e,r,n,i){let{teamId:s}=await this.post(`orgs/${l(e)}/teams`,{name:r,join:n,parent:i});return s}getTeam(e,r){return this.get(`orgs/${l(e)}/teams/${l(r)}`)}async updateTeam(e,r,n){await this.post(`orgs/${l(e)}/teams/${l(r)}`,n)}async deleteTeam(e,r,n){let i=`orgs/${l(e)}/teams/${l(r)}`;await(n?this.deleteConfirmed(i,n):this.delete(i))}async setTeamMember(e,r,n,i,s={}){await this.postConfirmed(`orgs/${l(e)}/teams/${l(r)}/members`,{account:n,...s},i)}async removeTeamMember(e,r,n,i){await this.deleteConfirmed(`orgs/${l(e)}/teams/${l(r)}/members/${l(n)}`,i)}async invite(e,r,n,i=[],s={}){let{token:o}=await this.postConfirmed(`orgs/${l(e)}/invites`,{role:r,teams:i,...s},n);return o}redeemInvite(e){return this.post(`invites/${l(e)}/redeem`)}async listInvites(e){let{invites:r}=await this.get(`orgs/${l(e)}/invites`);return r}async revokeInvite(e,r,n){await this.deleteConfirmed(`orgs/${l(e)}/invites/${l(r)}`,n)}listAppTeams(e){return this.get(`orgs/${l(e)}/app-teams`)}scopeApps(e,r,n={}){let i={};return n.apps!==void 0&&(i.apps=n.apps),n.shared!==void 0&&(i.shared=n.shared),this.postConfirmed(`orgs/${l(e)}/app-teams`,i,r)}grantDeployer(e,r,n={}){let i=n.until instanceof Date?n.until.toISOString():n.until;return this.postConfirmed("deployers",{deployer:e,...i===void 0?{}:{until:i}},r)}deployers(){return this.get("deployers")}async revokeDeployer(e,r){let n=typeof e=="string"?e:mt(e);await this.deleteConfirmed(`deployers/${l(n)}`,r)}async createDeployment(e,r,n){let{id:i}=await this.postConfirmed("deployments",{name:e,owner:r},n);return i}async deployments(){let{deployments:e}=await this.get("deployments");return e}deployment(e){return this.get(`deployments/${l(e)}`)}async deleteDeployment(e,r){await this.deleteConfirmed(`deployments/${l(e)}`,r)}offerApp(e,r,n){return this.postConfirmed(`deployments/${l(e)}/apps`,{...r},n)}async withdrawApp(e,r,n){await this.deleteConfirmed(`deployments/${l(e)}/apps/${l(r)}`,n)}deploymentOrgs(e){return this.get(`deployments/${l(e)}/orgs`)}};var vr={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},gi=vr.JOIN_OPEN_TEAMS;function pi(...t){return t.reduce((e,r)=>e|vr[r],0)}function Ve(t,e){return(t<<e|t>>>32-e)>>>0}function I(t,e,r,n,i){t[e]=t[e]+t[r]>>>0,t[i]=Ve(t[i]^t[e],16),t[n]=t[n]+t[i]>>>0,t[r]=Ve(t[r]^t[n],12),t[e]=t[e]+t[r]>>>0,t[i]=Ve(t[i]^t[e],8),t[n]=t[n]+t[i]>>>0,t[r]=Ve(t[r]^t[n],7)}function wt(t,e){return(t[e]|t[e+1]<<8|t[e+2]<<16|t[e+3]<<24)>>>0}function Et(t,e,r){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=wt(t,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=wt(r,o*4);let i=n.slice();for(let o=0;o<10;o+=1)I(i,0,4,8,12),I(i,1,5,9,13),I(i,2,6,10,14),I(i,3,7,11,15),I(i,0,5,10,15),I(i,1,6,11,12),I(i,2,7,8,13),I(i,3,4,9,14);let s=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=i[o]+n[o]>>>0;s[o*4]=a&255,s[o*4+1]=a>>>8&255,s[o*4+2]=a>>>16&255,s[o*4+3]=a>>>24&255}return s}function fi(t,e,r,n){let i=new Uint8Array(n.length);for(let s=0,o=e;s<n.length;s+=64,o+=1){let a=Et(t,o,r),c=Math.min(s+64,n.length);for(let d=s;d<c;d+=1)i[d]=n[d]^a[d-s]}return i}function xr(t){let e=0n;for(let r=t.length-1;r>=0;r-=1)e=e<<8n|BigInt(t[r]);return e}var yi=(1n<<130n)-5n;function hi(t,e){let r=xr(t.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=xr(t.subarray(16,32)),i=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),d=xr(c)+(1n<<BigInt(8*c.length));i=(i+d)*r%yi}let s=i+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(s&0xffn),s>>=8n;return o}function At(t){return new Uint8Array((16-t%16)%16)}function bt(t){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(t),!0),e}function mi(t,e){let r=[t,At(t.length),e,At(e.length),bt(t.length),bt(e.length)],n=new Uint8Array(r.reduce((s,o)=>s+o.length,0)),i=0;for(let s of r)n.set(s,i),i+=s.length;return n}function wi(t,e){if(t.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function Rt(t,e,r,n=new Uint8Array(0)){wi(t,e);let i=Et(t,0,e).subarray(0,32),s=fi(t,1,e,r),o=hi(i,mi(n,s)),a=new Uint8Array(s.length+16);return a.set(s),a.set(o,s.length),a}var vt=32,Ai=1,bi=3,Ei=2,Ri=32,Pi=32,vi=12,X=t=>new TextEncoder().encode(t),pe=t=>new Uint8Array([t>>8&255,t&255]),Pt=h(X("KEM"),pe(vt)),ge=h(X("HPKE"),pe(vt),pe(Ai),pe(bi));async function xt(t,e){let r=t.length===0?new Uint8Array(32):t,n=await crypto.subtle.importKey("raw",r,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function xi(t,e,r){let n=new Uint8Array(r),i=new Uint8Array(0);for(let s=1,o=0;o<r;s+=1)i=await xt(t,h(i,e,new Uint8Array([s]))),n.set(i.subarray(0,Math.min(i.length,r-o)),o),o+=i.length;return n}function Le(t,e,r,n){return xt(e,h(X("HPKE-v1"),t,X(r),n))}function kr(t,e,r,n,i){return xi(e,h(pe(i),X("HPKE-v1"),t,X(r),n),i)}async function ki(t,e){let r=await Le(Pt,new Uint8Array(0),"eae_prk",t);return kr(Pt,r,"shared_secret",e,Ri)}async function Ui(t,e){let r=new Uint8Array(0),n=await Le(ge,r,"psk_id_hash",r),i=await Le(ge,r,"info_hash",e),s=h(new Uint8Array([Ei]),n,i),o=await Le(ge,t,"secret",r);return{key:await kr(ge,o,"key",s,Pi),nonce:await kr(ge,o,"base_nonce",s,vi)}}async function kt(t,e,r,n,i=new Uint8Array(0),s){if(t.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await q(s),a=await q(e),c=h(await ee(o.privateKey,t),await ee(a.privateKey,t)),d=await ki(c,h(o.publicKey,t,a.publicKey)),{key:u,nonce:g}=await Ui(d,r);return{enc:o.publicKey,ciphertext:Rt(u,g,n,i)}}var Tt="mero-agent-gate/attest/v3",Ct="mero-agent-gate/provision/v2",Si=/^[a-z0-9][a-z0-9-]{0,62}$/,Ti=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,Ut=64,St=64*1024,D=class extends Error{constructor(r,n,i){super(r);this.status=n;this.code=i;this.name="AgentGateError"}};function Ot(t){if(!Si.test(t))throw new Error(`Agent id ${JSON.stringify(t)} must match [a-z0-9][a-z0-9-]{0,62}`)}function fe(t){return new TextEncoder().encode(t)}function It(t){let e=fe(t);return h(new Uint8Array([e.length]),e)}function G(t){let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e)}function Ge(t,e,r){let n;try{n=Uint8Array.from(atob(t.trim()),i=>i.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(r!==void 0&&n.length!==r)throw new Error(`${e} is not ${r} bytes`);return n}async function Dt(t,e,r,n){let i=new Uint8Array(32),s=h(fe(Tt),t,It(e),r??i,n??i);return new Uint8Array(await crypto.subtle.digest("SHA-256",s))}function Nt(t,e){return h(fe(Ct),t,It(e))}async function Ci(){let t=crypto.getRandomValues(new Uint8Array(32));return{secret:t,publicKey:await He(t)}}async function He(t){if(t.length!==32)throw new Error("An owner key is 32 bytes");return G((await q(t)).publicKey)}function Mt(t,e){return`${t.replace(/\/+$/,"")}${e}`}async function _t(t,e,r){let n=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)}),i=await n.text(),s;try{s=i?JSON.parse(i):void 0}catch{}if(!n.ok){let o=s;throw new D(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??i.slice(0,200)}`,n.status,o?.error)}return s}async function Ur(t){let e=t.agentId??"";e&&Ot(e);let r=crypto.getRandomValues(new Uint8Array(32)),n=await _t(t.fetch??fetch,Mt(t.gateUrl,"/attest"),{nonceB64:G(r),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let i=Ge(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),s=n.signingPublicKeyB64?Ge(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ge(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!s!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await Dt(i,e,s,o);return await t.verifier({quoteB64:n.quoteB64,nonce:R(r),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:G(i),...s?{signingPublicKey:G(s)}:{},...o?{ownerPublicKey:G(o)}:{}}}async function $t(t,e){let r=await He(e);if(t.ownerPublicKey&&t.ownerPublicKey!==r)throw new D(`This agent is claimed by another key (${t.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return r}function Oi(t){let e=Object.keys(t);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>Ut)throw new Error(`At most ${Ut} secrets at once`);for(let r of e){if(!Ti.test(r))throw new Error(`Secret name ${JSON.stringify(r)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof t[r]!="string")throw new Error(`Secret ${r} is not a string`);if(fe(t[r]).length>St)throw new Error(`Secret ${r} is over ${St} bytes`)}}async function Bt(t,e,r,n,i,s){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await $t(n,i),a=Ge(n.provisioningPublicKey,"provisioningPublicKey",32),c=await kt(a,i,Nt(a,n.agentId),fe(JSON.stringify(s)));return _t(t,Mt(e,r),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:G(c.enc),ciphertextB64:G(c.ciphertext)})}async function Ii(t){Oi(t.secrets);let e=t.fetch??fetch,r=await Bt(e,t.gateUrl,"/provision",t.agent,t.ownerSecret,{secrets:t.secrets}),n=await Ur({gateUrl:t.gateUrl,agentId:t.agent.agentId,verifier:t.verifier,fetch:e}),i=await He(t.ownerSecret);if(n.ownerPublicKey!==i||!n.signingPublicKey)throw new D("The gate accepted the secrets, but its quote does not name your key as owner");if(t.agent.signingPublicKey&&t.agent.signingPublicKey!==n.signingPublicKey)throw new D("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:i,written:r?.written??[],claimed:r?.claimed===!0}}async function Di(t){if(!t.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=t.fetch??fetch;if(await Bt(e,t.gateUrl,"/release",t.agent,t.ownerSecret,{release:!0}),(await Ur({gateUrl:t.gateUrl,agentId:t.agent.agentId,verifier:t.verifier,fetch:e})).ownerPublicKey)throw new D("The gate says it released the agent, but its quote still names an owner")}var Sr=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),Ni=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function Mi(t,e,r={}){let n=typeof t=="string"?new TextEncoder().encode(t):t;await be(n,e,{identity:r.identity??Sr.identity,issuer:r.issuer??Sr.issuer});let i;try{i=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let s=r.role??"agent";if(i?.role!==s)throw new Error(`The signed file is a ${JSON.stringify(i?.role)} policy, not an ${s} one`);let o=r.profile??_;if(i.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(i.profile)} profile, not ${o}`);if(r.expectedVersion!==void 0&&i.version!==r.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(i.version)}, not ${r.expectedVersion}`);return Kt(i),i}function Kt(t){for(let e of Ni)if(!Array.isArray(t?.[e])||t[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var _i=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function $i(t){let e=_i.find(r=>r.toLowerCase()===t.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(t)}`);return e}var ye=t=>t.trim().replace(/^0x/i,"");function Bi(t,e){return Kt(t),$({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:t.allowed_tcb_statuses.map($i),allowedMrtd:t.allowed_mrtd.map(ye),allowedRtmr0:t.allowed_rtmr0.map(ye),allowedRtmr1:t.allowed_rtmr1.map(ye),allowedRtmr2:t.allowed_rtmr2.map(ye),allowedRtmr3:t.allowed_rtmr3.map(ye)})}export{Tt as AGENT_ATTEST_DOMAIN,Ct as AGENT_PROVISION_INFO_DOMAIN,D as AgentGateError,_e as AppError,xe as ArgsTooLarge,Te as BadOrigin,Pr as CalimeroClient,y as CalimeroError,Ie as ClusterNotUpgraded,oe as ConfirmCancelled,ae as ConfirmPromptBlocked,Z as ConfirmRequired,Se as ConsentStale,sr as DEFAULT_COLLATERAL_MIRROR,gr as DEFAULT_DIRECTORY,gi as DEFAULT_ORG_CAPABILITIES,Ee as DEFAULT_RELEASE_MIRROR,U as DirectoryError,Jr as GITHUB_RELEASES,Mr as HANDSHAKE_PATH,ke as IdempotencyMismatch,Sr as KMS_RELEASE_SIGNER,B as LoginRequired,mr as MAX_RECOVERY_NONCE_BYTES,Ar as MAX_REPORT_PAGE,Xr as MOCK_QUOTE_HEADER,ir as NODE_RELEASE_SIGNER,ve as NotFound,Oe as NotServing,vr as ORG_CAPABILITIES,V as OriginNotRegistered,Ce as OriginTaken,_ as PRODUCTION_PROFILE,Pe as PasskeyUnknownHere,Me as QuotaExceeded,nt as RECOVERY_DOMAIN,dt as RELEASE_VERIFIER,De as RecoveryNotReady,Ue as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,_r as SEALED_PATH,S as SealedTransportError,Ne as SignUpRefused,ne as StaleTransportKeyError,$e as TrapError,L as UnavailableError,K as WrongNode,ce as WrongRecoveryCode,Dt as agentKeyBinding,Bi as agentQuoteVerifier,Ur as attestAgent,P as b64url,Qn as browserPasskey,$t as checkOwner,Wr as claimedRelease,cr as cloudNodeReleaseUrl,de as compareVersions,br as confirmationCode,ei as consentReturn,$ as createQuoteVerifier,We as createSealedFetch,_n as createSignedReleaseVerifier,mt as deployerKey,Ke as errorFrom,ur as fetchAttestedKey,ar as fetchGithubNodeRelease,or as fetchNodeRelease,et as freshCollateral,O as fromB64url,ni as frontendManifest,Ci as generateOwnerKey,Yn as newRecoverySeed,pi as orgCapabilities,He as ownerPublicKey,ii as pageDeployment,ue as pageQuery,zn as parseRecoverySeed,Er as pendingApprovalsFrom,Ii as provisionAgent,Nt as provisionInfo,Xn as publisherBindingBytes,lt as publisherBindingMessage,it as recoveryMessage,Zn as recoveryPublicKey,Jn as recoverySeedText,Di as releaseAgent,pt as releaseConsent,ut as releaseNotesUrl,wr as signRecovery,ct as stalledBy,Xe as transportKeyBinding,Re as trustSignedRelease,nr as trustedMeasurementsFromReleases,ti as upgradeConsent,Ot as validateAgentId,gt as verifyReleaseUrl,Mi as verifySignedAgentPolicy,Yr as verifySignedNodeRelease,ri as withdrawConsent};
+`))p.startsWith("id:")?c=p.slice(3).trim():p.startsWith("event:")?d=p.slice(6).trim():p.startsWith("data:")&&(u+=p.slice(5).trim());if(!d&&!u)continue;let g=u;try{g=JSON.parse(u)}catch{}yield{id:c,kind:d,data:g}}}}function ft(t){return Array.from(t,e=>e.toString(16).padStart(2,"0")).join("")}function yt(){return`node:c-${P(crypto.getRandomValues(new Uint8Array(16)))}`}var li={retries:6,baseDelayMs:200,maxDelayMs:2e3};function di(t,e){return Math.min(e.baseDelayMs*2**t,e.maxDelayMs)}function ht(t){return t==="auth/refresh"||t.startsWith("auth/passkey/")||ui.has(t)}var ui=new Set(["auth/recovery/begin","auth/recovery/start","auth/recovery/finish"]),Pr=class t{constructor(e){this.at=0;this.channels=new Map;this.networkFailures=new WeakSet;this.packageOrigins={list:async e=>{let{origins:r}=await this.get(`package-origins/${l(e)}`);return r??[]},add:(e,r,n,i={})=>this.confirmed("POST",`package-origins/${l(e)}`,{origin:r,...i.rpId===void 0?{}:{rpId:i.rpId},...i.served?{served:!0}:{}},n),remove:(e,r,n)=>this.confirmed("DELETE",`package-origins/${l(e)}`,{origin:r},n)};let r=s=>s.replace(/\/+$/,"");this.nodeUrls=[...new Set([e.baseUrl,...e.nodes??[]].map(r))],this.policy=e.policy,this.retry={...li,...e.retry};let n=e.fetch??((s,o)=>fetch(s,o)),i=async(s,o)=>{try{return await n(s,o)}catch(a){throw a instanceof TypeError&&this.networkFailures.add(a),a}};this.raw=i}static async connect(e){let r=e.directory??gr,n=e.random??Math.random,i=e.fetch??((d,u)=>fetch(d,u)),s=await pr(r,e.cluster,i),[o,...a]=fr(s.nodes,e.zone,n),c=new t({baseUrl:o,nodes:a,policy:e.policy,fetch:e.fetch,retry:e.retry});return c.source={directory:r,cluster:e.cluster,zone:e.zone,random:n,due:Date.now()+s.refreshAfterSeconds*1e3},c}get nodeUrl(){return this.nodeUrls[this.at]}get nodes(){return[...this.nodeUrls]}channel(e){let r=this.channels.get(e);return r||(r=We({baseUrl:e,transportPublicKey:()=>ur(e,this.policy,this.raw),fetch:this.raw}),this.channels.set(e,r)),r}moveOn(e){return this.nodeUrls.length<2?!1:(this.nodeUrl===e&&(this.at=(this.at+1)%this.nodeUrls.length),!0)}failOver(e,r){if(this.nodeUrl!==e&&!r.has(this.nodeUrl))return!0;let n=this.nodeUrls.length;for(let i=1;i<n;i++){let s=(this.at+i)%n;if(!r.has(this.nodeUrls[s]))return this.at=s,this.reread(),!0}return!1}reread(){let e=this.source;!e||e.reading||(e.reading=pr(e.directory,e.cluster,this.raw).then(r=>{let n=this.nodeUrl,i=fr(r.nodes,e.zone,e.random);this.nodeUrls=[n,...i.filter(s=>s!==n)],this.at=0,e.due=Date.now()+r.refreshAfterSeconds*1e3}).catch(()=>{}).finally(()=>{e.reading=void 0}))}useApiKey(e){this.auth=e,this.current=void 0}useSession(e){this.auth=e.sessionToken,this.current=e}get session(){return this.current}async request(e,r,n,i,s="application/wasm",o){let a={};this.auth&&(a.authorization=`Bearer ${this.auth}`);let c;i?(a["content-type"]=s,c=i):n!==void 0&&(a["content-type"]="application/json",c=JSON.stringify(n)),this.source&&Date.now()>=this.source.due&&this.reread();let d=this.nodeUrl;try{return await this.channel(d)(`${d}/${r}`,{method:e,headers:a,body:c,signal:o})}catch(u){throw ai(u)}}async send(e,r,n,i,s,o){let a=!1,c=!1;for(;;){let[d,u]=[this.auth,this.nodeUrl],g=await this.request(e,r,n,i,s,o);if(g.ok)return g;let p=await Rr(g);if(p instanceof K&&!c){if(c=!0,this.moveOn(u)&&!ht(r))continue}else if(p instanceof B&&!a&&this.mayRefresh(d,r)){a=!0,await this.renew(d);continue}throw p}}mayRefresh(e,r){return e!==void 0&&this.current!==void 0&&!ht(r)}async renew(e){this.auth===e&&await this.refresh()}async json(e,r,n,i,s){let a=await(await this.send(e,r,n,i,s)).text();return a?JSON.parse(a):{}}async retried(e,r,n,i=!1){let s=i?0:this.retry.retries,o=new Set;for(;;){let a,c=this.nodeUrl;for(let d=0;;d++){c=this.nodeUrl,o.add(c);try{return await this.json(e,r,n)}catch(g){if(g instanceof L)a=g;else if(g instanceof TypeError&&this.networkFailures.has(g))a=new L("NETWORK",`the node could not be reached: ${g.message}`,{},void 0,g);else throw g}if(d>=s)break;let u=di(d,this.retry);await new Promise(g=>setTimeout(g,Math.max(u,(a.retryAfter??0)*1e3)))}if(i||!this.failOver(c,o))throw a}}post(e,r={}){return this.json("POST",e,r)}get(e){return this.json("GET",e)}put(e,r={}){return this.json("PUT",e,r)}delete(e,r){return this.json("DELETE",e,r)}async signUp(e,r,n={}){let i=this.pageOrigin(n),s=n.invite?{invite:n.invite}:{},o=await this.begin("auth/passkey/register/begin",i===void 0?{name:r,...s}:{name:r,origin:i,...s},i),a=n.signal,c=await(a?e.create(o.options,{signal:a}):e.create(o.options)),d=await this.confirmed("POST","auth/passkey/register/finish",{challengeId:o.challengeId,registration:c,...s},e,void 0,"preferred",a);return this.useSession(d),d}signUpPolicy(){return this.get("sign-up")}async signIn(e,r={}){let n=this.pageOrigin(r),i=await this.begin("auth/passkey/login/begin",n===void 0?void 0:{origin:n},n),s=i.options.rpId??i.options.rp?.id??"",o=O(i.options.challenge),a=await(r.signal?e.get(o,s,void 0,{signal:r.signal}):e.get(o,s)),c=await this.post("auth/passkey/login/finish",{challengeId:i.challengeId,assertion:a});return this.useSession(c),c}pageOrigin(e){if(e.origin!==void 0)return e.origin??void 0;let r=globalThis.location?.origin;return!r||r==="null"||new Set(this.nodeUrls.map(i=>{try{return new URL(i).origin}catch{return i}})).has(r)?void 0:r}async begin(e,r,n){try{return await this.post(e,r)}catch(i){throw i instanceof V&&!i.origin&&n!==void 0?new V(i.nodeMessage,{...i.details,origin:n}):i}}refresh(){if(!this.refreshing){let e=this.exchangeRefresh();this.refreshing=e;let r=()=>{this.refreshing===e&&(this.refreshing=void 0)};e.then(r,r)}return this.refreshing}async exchangeRefresh(){let e=this.current;if(!e)throw new Error("no session to refresh");let r;for(let n=1;r===void 0;n++)try{r=await this.post("auth/refresh",{refreshToken:e.refreshToken})}catch(i){if(!(i instanceof K)||n>=this.nodeUrls.length)throw i}return this.current===e&&this.useSession(r),r}async signOut(){await this.signingOut("auth/logout")}async signOutEverywhere(){await this.signingOut("auth/logout-all")}async listSessions(){let{sessions:e}=await this.get("auth/sessions");return e}async revokeSession(e){await this.delete(`auth/sessions/${l(e)}`)}async listActivity(e){let r=e===void 0?"":`?after=${encodeURIComponent(String(e))}`,{activity:n}=await this.get(`auth/activity${r}`);return n}async signingOut(e){try{await this.post(e)}finally{this.auth=void 0,this.current=void 0}}me(){return this.get("auth/me")}async addPasskey(e,r){let n=await this.post("auth/passkeys/add/begin"),i=await e.create(n.options),{credentialId:s}=await this.postConfirmed("auth/passkeys/add/finish",{challengeId:n.challengeId,registration:i},r);return s}async removePasskey(e,r){await this.deleteConfirmed(`auth/passkeys/${l(e)}`,r)}async labelPasskey(e,r){await this.post(`auth/passkeys/${l(e)}`,{label:r})}async createRecoveryCode(e){let{code:r}=await this.postConfirmed("auth/recovery",{},e);return r}async removeRecoveryCode(e){await this.deleteConfirmed("auth/recovery",e)}async startAccountRecovery(e,r){try{let n=await this.post("auth/recovery/begin",{code:e}),i=await r.create(n.options);return await this.post("auth/recovery/start",{challengeId:n.challengeId,code:e,registration:i})}catch(n){throw n instanceof B?new ce(n.message.replace(/^401 UNAUTHENTICATED: /,""),n.details):n}}async cancelAccountRecovery(e){await this.postConfirmed("auth/recovery/cancel",{},e)}async finishAccountRecovery(e,r){let n=await this.postConfirmed("auth/recovery/finish",r?{accountId:r}:{},e);return this.useSession(n),n}usage(){return this.get("auth/usage")}async attestation(){let e=ft(crypto.getRandomValues(new Uint8Array(32))),r=await this.raw(`${this.nodeUrl}/attestation?nonce=${e}`);if(!r.ok)throw await Rr(r);return await r.json()}async listApiKeys(){let{keys:e}=await this.get("auth/apikeys");return e}async revokeApiKey(e,r){await this.deleteConfirmed(`auth/apikeys/${l(e)}`,r)}createApiKey(e,r){return this.postConfirmed("auth/apikeys",{...e},r)}async uploadBundle(e){let{hash:r}=await this.json("POST","bundles",void 0,e);return r}uploadBlob(e,r,n={}){let i=(typeof n=="string"?n:n.contentType)??"application/octet-stream";return this.json("POST",`apps/${l(e)}/blobs`,void 0,r,i)}async downloadBlob(e,r){return(await this.blobContent(e,r)).data}async downloadBlobGranted(e,r,n){return(await this.blobContent(e,r,{grant:n})).data}async blobContent(e,r,n={}){let i=n.grant===void 0?"":`?grant=${encodeURIComponent(n.grant)}`,s=await this.send("GET",`apps/${l(e)}/blobs/${l(r)}${i}`);return{data:new Uint8Array(await s.arrayBuffer()),contentType:s.headers.get("content-type")??"application/octet-stream"}}async listBlobs(e){let{blobs:r}=await this.get(`apps/${l(e)}/blobs`);return r}blobInfo(e,r){return this.get(`apps/${l(e)}/blobs/${l(r)}/info`)}async deleteBlob(e,r){await this.delete(`apps/${l(e)}/blobs/${l(r)}`)}uploadPackage(e){return this.json("POST","packages",void 0,e,"application/octet-stream")}installPackage(e,r){return this.post("packages/install",{package:e,version:r})}async packages(){let{packages:e}=await this.get("packages");return e}package(e){return this.get(`packages/${l(e)}`)}uninstallPackage(e,r){return this.delete(r===void 0?`packages/${l(e)}`:`packages/${l(e)}/${l(r)}`)}async listApps(e={}){let r=new URLSearchParams;e.package&&r.set("package",e.package),e.bundle&&r.set("bundle",e.bundle);let n=r.toString(),{apps:i}=await this.get(n?`apps?${n}`:"apps");return i}getApp(e){return this.get(`apps/${l(e)}`)}async deleteApp(e){await this.delete(`apps/${l(e)}`)}async setAccess(e,r){await this.post(`apps/${l(e)}/access`,{access:r})}async setAppMetadata(e,r){await this.post(`apps/${l(e)}/metadata`,{metadata:r})}appXcalls(e){return this.get(`apps/${l(e)}/xcalls`)}appStorage(e){return this.get(`apps/${l(e)}/storage`)}appAbi(e){return this.get(`apps/${l(e)}/abi`)}async transferApp(e,r,n){await this.postConfirmed(`apps/${l(e)}/transfer`,{to:r},n)}moveApp(e,r,n={},i){let s=`apps/${l(e)}/move`,o={toOrg:r,bringMembers:n.bringMembers??!1};return i?this.postConfirmed(s,o,i):this.post(s,o)}upgradeApp(e,r,n){let i=`apps/${l(e)}/upgrade`;return n?this.postConfirmed(i,r,n):this.post(i,r)}postConfirmed(e,r,n){return this.confirmed("POST",e,r,n)}deleteConfirmed(e,r,n={}){return this.confirmed("DELETE",e,n,r)}async confirmed(e,r,n,i,s=c=>this.json(e,r,c),o="required",a){try{return await s(n)}catch(c){if(!(c instanceof Z)||!i)throw c;let d=c.details,u;try{u=await i.get(O(d.challenge),d.rpId,d.allowCredentials,{userVerification:si(d.userVerification,o),...a?{signal:a}:{}})}catch(g){throw oi(g)}return s({...n,confirm:{challengeId:d.challengeId,assertion:u}})}}async createApp(e,r,n={}){let i=typeof r=="string"?{bundle:r}:r,{appId:s}=await this.post("apps",{name:e,...i,...n});return s}call(e,r,n={},i){let s=i??yt();return this.retried("POST",`apps/${l(e)}/intents`,{method:r,args:n,idempotencyKey:s})}async callConfirmed(e,r,n,i,s){let o=`apps/${l(e)}/intents`,a=s??yt();return this.confirmed("POST",o,{method:r,args:n,idempotencyKey:a},i,c=>this.retried("POST",o,c,c.confirm!==void 0))}view(e,r,n={},i={}){return this.retried("POST",`apps/${l(e)}/views`,{method:r,args:n,consistency:i.stale?"stale":"strong",minIndex:i.minIndex??0})}events(e,r=0,n){return this.stream(`apps/${l(e)}/events?from=${r}`,n)}async*stream(e,r){let n=await this.send("GET",e,void 0,void 0,void 0,r);if(!n.body)throw new y(n.status,"EVENTS","the event stream has no body");yield*ci(n.body)}async publishPresence(e,r,n){await this.post(`apps/${l(e)}/presence`,{seq:r,state:n===null?null:ft(n)})}async presence(e){let{present:r}=await this.get(`apps/${l(e)}/presence`);return r}presenceStream(e,r){return this.stream(`apps/${l(e)}/presence/stream`,r)}async setAlias(e,r){await this.put(`auth/aliases/${l(e)}`,{app:r})}async aliases(){let{aliases:e}=await this.get("auth/aliases");return e}async alias(e){let{appId:r}=await this.get(`auth/aliases/${l(e)}`);return r}async deleteAlias(e){await this.delete(`auth/aliases/${l(e)}`)}async createOrg(e,r={}){let n={name:e};r.recoveryKey!==void 0&&(n.recoveryKey=r.recoveryKey);let{orgId:i}=await this.post("orgs",n);return i}async setRecoveryKey(e,r,n){await this.postConfirmed(`orgs/${l(e)}/recovery`,{publicKey:r},n)}async startRecovery(e,r){let n=(await this.me()).accountId,i=P(crypto.getRandomValues(new Uint8Array(16))),s=await wr(r,e,n,i);return this.post(`orgs/${l(e)}/recovery/start`,{nonce:i,signature:s})}async cancelRecovery(e,r){await this.postConfirmed(`orgs/${l(e)}/recovery/cancel`,{},r)}finishRecovery(e,r){return this.postConfirmed(`orgs/${l(e)}/recovery/finish`,{},r)}getOrg(e){return this.get(`orgs/${l(e)}`)}async orgMembersSecurity(e){let{members:r}=await this.get(`orgs/${l(e)}/members?detail=security`);return r}async deleteOrg(e,r){await this.deleteConfirmed(`orgs/${l(e)}`,r)}async setOrgMetadata(e,r){await this.post(`orgs/${l(e)}/metadata`,{metadata:r})}async setMemberMetadata(e,r,n){await this.post(`orgs/${l(e)}/members/${l(r)}/metadata`,{metadata:n})}upgradeOrg(e,r,n){return this.postConfirmed(`orgs/${l(e)}/upgrade`,{...r},n)}upgradeRun(e,r){return this.get(`orgs/${l(e)}/upgrades/${l(r)}`)}retryUpgradeRun(e,r,n){return this.postConfirmed(`orgs/${l(e)}/upgrades/${l(r)}/retry`,{},n)}async approveRelease(e,r,n,i=!0){let s=e===null?"auth/releases":`orgs/${l(e)}/releases`;return this.postConfirmed(s,{version:r,approved:i},n)}async approveOutbound(e,r,n,i={}){let s=e===null?"auth/outbound":`orgs/${l(e)}/outbound`;return this.postConfirmed(s,{package:r,prefixes:i.prefixes??"manifest",replace:i.replace??!1},n)}appsReport(e,r={}){let n=e===null?"auth/apps":`orgs/${l(e)}/apps`;return this.get(`${n}${ue(r)}`)}async appsReportAll(e){let r=await this.appsReport(e),n=[...r.apps],i=r.next;for(;i!==null;){let s=await this.appsReport(e,{after:i});n.push(...s.apps),i=s.next}return{...r,apps:n,next:null}}releaseRules(){return this.get("releases")}async pendingApprovals(e=null){let[r,n]=await Promise.all([this.appsReportAll(e),this.releaseRules()]);return Er(r,n)}requestConsent(e){return this.post("consent/requests",e)}async openConsentPage(e,r={}){let n=typeof r=="function"?{navigate:r}:r,i=n.navigate??(o=>{let a=globalThis.window;if(!a)throw new Error("no window to open the consent page in; pass `navigate`");a.location.assign(o)}),s=await this.requestConsent(e);if(s.code!==void 0){let o=await br(s.requestId);if(s.code!==o)throw new y(200,"CONSENT_CODE_MISMATCH","the consent page code does not match the request",{requestId:s.requestId,code:s.code,expected:o})}return n.confirm&&!await n.confirm(s)||i(s.url),s}consentResult(e){return this.get(`consent/${l(e)}/result`)}async waitForConsent(e,r={}){let n=r.intervalMs??2e3;for(;;){let i=await this.consentResult(e);if(i.status!=="pending"||r.signal?.aborted||r.expiresAt!==void 0&&Date.now()/1e3>=r.expiresAt)return i;await new Promise(s=>setTimeout(s,n))}}publisherBinding(e){return this.get(`publishers/${l(e)}`)}bindPublisher(e,r,n){return this.postConfirmed(`orgs/${l(e)}/publishers`,{...r},n)}upgradePublished(e,r,n,i){return this.postConfirmed(`orgs/${l(e)}/packages/${l(r)}/upgrade`,{...n},i)}opsApps(e={}){return this.get(`ops/apps${ue(e)}`)}opsOrgs(e={}){return this.get(`ops/orgs${ue(e)}`)}opsServedOrigins(){return this.get("ops/served-origins")}async setReleaseDeadline(e,r){let n=typeof r=="string"?r:r.toISOString();await this.post(`ops/releases/${l(e)}/deadline`,{after:n})}async liftReleaseDeadline(e){await this.delete(`ops/releases/${l(e)}/deadline`)}async setMember(e,r,n,i){await this.postConfirmed(`orgs/${l(e)}/members`,{account:r,role:n},i)}removeMember(e,r,n){return this.deleteConfirmed(`orgs/${l(e)}/members/${l(r)}`,n)}async setCapabilities(e,r,n,i={}){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{capabilities:r,...i},n)}async setAllApps(e,r,n,i){await this.postConfirmed(`orgs/${l(e)}/all-apps`,{account:r,allApps:n},i)}async setTeamDefaultCapabilities(e,r,n,i){await this.postConfirmed(`orgs/${l(e)}/capabilities`,{team:r,capabilities:n},i)}async createTeam(e,r,n,i){let{teamId:s}=await this.post(`orgs/${l(e)}/teams`,{name:r,join:n,parent:i});return s}getTeam(e,r){return this.get(`orgs/${l(e)}/teams/${l(r)}`)}async updateTeam(e,r,n){await this.post(`orgs/${l(e)}/teams/${l(r)}`,n)}async deleteTeam(e,r,n){let i=`orgs/${l(e)}/teams/${l(r)}`;await(n?this.deleteConfirmed(i,n):this.delete(i))}async setTeamMember(e,r,n,i,s={}){await this.postConfirmed(`orgs/${l(e)}/teams/${l(r)}/members`,{account:n,...s},i)}async removeTeamMember(e,r,n,i){await this.deleteConfirmed(`orgs/${l(e)}/teams/${l(r)}/members/${l(n)}`,i)}async invite(e,r,n,i=[],s={}){let{token:o}=await this.postConfirmed(`orgs/${l(e)}/invites`,{role:r,teams:i,...s},n);return o}redeemInvite(e){return this.post(`invites/${l(e)}/redeem`)}async listInvites(e){let{invites:r}=await this.get(`orgs/${l(e)}/invites`);return r}async revokeInvite(e,r,n){await this.deleteConfirmed(`orgs/${l(e)}/invites/${l(r)}`,n)}listAppTeams(e){return this.get(`orgs/${l(e)}/app-teams`)}scopeApps(e,r,n={}){let i={};return n.apps!==void 0&&(i.apps=n.apps),n.shared!==void 0&&(i.shared=n.shared),this.postConfirmed(`orgs/${l(e)}/app-teams`,i,r)}grantDeployer(e,r,n={}){let i=n.until instanceof Date?n.until.toISOString():n.until;return this.postConfirmed("deployers",{deployer:e,...i===void 0?{}:{until:i}},r)}deployers(){return this.get("deployers")}async revokeDeployer(e,r){let n=typeof e=="string"?e:mt(e);await this.deleteConfirmed(`deployers/${l(n)}`,r)}async createDeployment(e,r,n){let{id:i}=await this.postConfirmed("deployments",{name:e,owner:r},n);return i}async deployments(){let{deployments:e}=await this.get("deployments");return e}deployment(e){return this.get(`deployments/${l(e)}`)}async deleteDeployment(e,r){await this.deleteConfirmed(`deployments/${l(e)}`,r)}offerApp(e,r,n){return this.postConfirmed(`deployments/${l(e)}/apps`,{...r},n)}async withdrawApp(e,r,n){await this.deleteConfirmed(`deployments/${l(e)}/apps/${l(r)}`,n)}deploymentOrgs(e){return this.get(`deployments/${l(e)}/orgs`)}};var vr={CREATE_APP:1,INVITE_MEMBERS:2,JOIN_OPEN_TEAMS:4,MANAGE_MEMBERS:8,MANAGE_APPLICATION:16,CREATE_TEAM:32,DELETE_TEAM:64,MANAGE_VISIBILITY:128,MANAGE_METADATA:256,APPROVE_RELEASES:1024},gi=vr.JOIN_OPEN_TEAMS;function pi(...t){return t.reduce((e,r)=>e|vr[r],0)}function Ve(t,e){return(t<<e|t>>>32-e)>>>0}function I(t,e,r,n,i){t[e]=t[e]+t[r]>>>0,t[i]=Ve(t[i]^t[e],16),t[n]=t[n]+t[i]>>>0,t[r]=Ve(t[r]^t[n],12),t[e]=t[e]+t[r]>>>0,t[i]=Ve(t[i]^t[e],8),t[n]=t[n]+t[i]>>>0,t[r]=Ve(t[r]^t[n],7)}function wt(t,e){return(t[e]|t[e+1]<<8|t[e+2]<<16|t[e+3]<<24)>>>0}function Et(t,e,r){let n=new Uint32Array(16);n[0]=1634760805,n[1]=857760878,n[2]=2036477234,n[3]=1797285236;for(let o=0;o<8;o+=1)n[4+o]=wt(t,o*4);n[12]=e>>>0;for(let o=0;o<3;o+=1)n[13+o]=wt(r,o*4);let i=n.slice();for(let o=0;o<10;o+=1)I(i,0,4,8,12),I(i,1,5,9,13),I(i,2,6,10,14),I(i,3,7,11,15),I(i,0,5,10,15),I(i,1,6,11,12),I(i,2,7,8,13),I(i,3,4,9,14);let s=new Uint8Array(64);for(let o=0;o<16;o+=1){let a=i[o]+n[o]>>>0;s[o*4]=a&255,s[o*4+1]=a>>>8&255,s[o*4+2]=a>>>16&255,s[o*4+3]=a>>>24&255}return s}function fi(t,e,r,n){let i=new Uint8Array(n.length);for(let s=0,o=e;s<n.length;s+=64,o+=1){let a=Et(t,o,r),c=Math.min(s+64,n.length);for(let d=s;d<c;d+=1)i[d]=n[d]^a[d-s]}return i}function xr(t){let e=0n;for(let r=t.length-1;r>=0;r-=1)e=e<<8n|BigInt(t[r]);return e}var yi=(1n<<130n)-5n;function hi(t,e){let r=xr(t.subarray(0,16))&0x0ffffffc0ffffffc0ffffffc0fffffffn,n=xr(t.subarray(16,32)),i=0n;for(let a=0;a<e.length;a+=16){let c=e.subarray(a,Math.min(a+16,e.length)),d=xr(c)+(1n<<BigInt(8*c.length));i=(i+d)*r%yi}let s=i+n&(1n<<128n)-1n,o=new Uint8Array(16);for(let a=0;a<16;a+=1)o[a]=Number(s&0xffn),s>>=8n;return o}function At(t){return new Uint8Array((16-t%16)%16)}function bt(t){let e=new Uint8Array(8);return new DataView(e.buffer).setBigUint64(0,BigInt(t),!0),e}function mi(t,e){let r=[t,At(t.length),e,At(e.length),bt(t.length),bt(e.length)],n=new Uint8Array(r.reduce((s,o)=>s+o.length,0)),i=0;for(let s of r)n.set(s,i),i+=s.length;return n}function wi(t,e){if(t.length!==32)throw new Error("ChaCha20-Poly1305 needs a 32-byte key");if(e.length!==12)throw new Error("ChaCha20-Poly1305 needs a 12-byte nonce")}function Rt(t,e,r,n=new Uint8Array(0)){wi(t,e);let i=Et(t,0,e).subarray(0,32),s=fi(t,1,e,r),o=hi(i,mi(n,s)),a=new Uint8Array(s.length+16);return a.set(s),a.set(o,s.length),a}var vt=32,Ai=1,bi=3,Ei=2,Ri=32,Pi=32,vi=12,X=t=>new TextEncoder().encode(t),pe=t=>new Uint8Array([t>>8&255,t&255]),Pt=h(X("KEM"),pe(vt)),ge=h(X("HPKE"),pe(vt),pe(Ai),pe(bi));async function xt(t,e){let r=t.length===0?new Uint8Array(32):t,n=await crypto.subtle.importKey("raw",r,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return new Uint8Array(await crypto.subtle.sign("HMAC",n,e))}async function xi(t,e,r){let n=new Uint8Array(r),i=new Uint8Array(0);for(let s=1,o=0;o<r;s+=1)i=await xt(t,h(i,e,new Uint8Array([s]))),n.set(i.subarray(0,Math.min(i.length,r-o)),o),o+=i.length;return n}function Le(t,e,r,n){return xt(e,h(X("HPKE-v1"),t,X(r),n))}function kr(t,e,r,n,i){return xi(e,h(pe(i),X("HPKE-v1"),t,X(r),n),i)}async function ki(t,e){let r=await Le(Pt,new Uint8Array(0),"eae_prk",t);return kr(Pt,r,"shared_secret",e,Ri)}async function Ui(t,e){let r=new Uint8Array(0),n=await Le(ge,r,"psk_id_hash",r),i=await Le(ge,r,"info_hash",e),s=h(new Uint8Array([Ei]),n,i),o=await Le(ge,t,"secret",r);return{key:await kr(ge,o,"key",s,Pi),nonce:await kr(ge,o,"base_nonce",s,vi)}}async function kt(t,e,r,n,i=new Uint8Array(0),s){if(t.length!==32)throw new Error("The recipient key is not 32 bytes of X25519");let o=await q(s),a=await q(e),c=h(await ee(o.privateKey,t),await ee(a.privateKey,t)),d=await ki(c,h(o.publicKey,t,a.publicKey)),{key:u,nonce:g}=await Ui(d,r);return{enc:o.publicKey,ciphertext:Rt(u,g,n,i)}}var Tt="mero-agent-gate/attest/v3",Ct="mero-agent-gate/provision/v2",Si=/^[a-z0-9][a-z0-9-]{0,62}$/,Ti=/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/,Ut=64,St=64*1024,D=class extends Error{constructor(r,n,i){super(r);this.status=n;this.code=i;this.name="AgentGateError"}};function Ot(t){if(!Si.test(t))throw new Error(`Agent id ${JSON.stringify(t)} must match [a-z0-9][a-z0-9-]{0,62}`)}function fe(t){return new TextEncoder().encode(t)}function It(t){let e=fe(t);return h(new Uint8Array([e.length]),e)}function G(t){let e="";for(let r of t)e+=String.fromCharCode(r);return btoa(e)}function Ge(t,e,r){let n;try{n=Uint8Array.from(atob(t.trim()),i=>i.charCodeAt(0))}catch{throw new Error(`${e} is not base64`)}if(r!==void 0&&n.length!==r)throw new Error(`${e} is not ${r} bytes`);return n}async function Dt(t,e,r,n){let i=new Uint8Array(32),s=h(fe(Tt),t,It(e),r??i,n??i);return new Uint8Array(await crypto.subtle.digest("SHA-256",s))}function Nt(t,e){return h(fe(Ct),t,It(e))}async function Ci(){let t=crypto.getRandomValues(new Uint8Array(32));return{secret:t,publicKey:await He(t)}}async function He(t){if(t.length!==32)throw new Error("An owner key is 32 bytes");return G((await q(t)).publicKey)}function Mt(t,e){return`${t.replace(/\/+$/,"")}${e}`}async function _t(t,e,r){let n=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(r)}),i=await n.text(),s;try{s=i?JSON.parse(i):void 0}catch{}if(!n.ok){let o=s;throw new D(`The gate answered ${n.status}${o?.error?` ${o.error}`:""}: ${o?.details??i.slice(0,200)}`,n.status,o?.error)}return s}async function Ur(t){let e=t.agentId??"";e&&Ot(e);let r=crypto.getRandomValues(new Uint8Array(32)),n=await _t(t.fetch??fetch,Mt(t.gateUrl,"/attest"),{nonceB64:G(r),...e?{agentId:e}:{}});if((n?.agentId??"")!==e)throw new Error(`Asked about agent ${JSON.stringify(e)}, the gate answered for ${JSON.stringify(n?.agentId)}`);let i=Ge(n.provisioningPublicKeyB64??"","provisioningPublicKeyB64",32),s=n.signingPublicKeyB64?Ge(n.signingPublicKeyB64,"signingPublicKeyB64",32):void 0,o=n.ownerPublicKeyB64?Ge(n.ownerPublicKeyB64,"ownerPublicKeyB64",32):void 0;if(!s!=!o)throw new Error("A claimed agent has both a signing key and an owner; the gate named one");let a=await Dt(i,e,s,o);return await t.verifier({quoteB64:n.quoteB64,nonce:R(r),reportDataSuffix:R(a)}),{agentId:e,provisioningPublicKey:G(i),...s?{signingPublicKey:G(s)}:{},...o?{ownerPublicKey:G(o)}:{}}}async function $t(t,e){let r=await He(e);if(t.ownerPublicKey&&t.ownerPublicKey!==r)throw new D(`This agent is claimed by another key (${t.ownerPublicKey}); it is not yours. Send it nothing and do not authorize its signing key`,void 0,"not_yours");return r}function Oi(t){let e=Object.keys(t);if(e.length===0)throw new Error("There are no secrets to provision");if(e.length>Ut)throw new Error(`At most ${Ut} secrets at once`);for(let r of e){if(!Ti.test(r))throw new Error(`Secret name ${JSON.stringify(r)} must match [A-Za-z0-9][A-Za-z0-9_.-]{0,63}`);if(typeof t[r]!="string")throw new Error(`Secret ${r} is not a string`);if(fe(t[r]).length>St)throw new Error(`Secret ${r} is over ${St} bytes`)}}async function Bt(t,e,r,n,i,s){if(!n.agentId)throw new Error("This quote names no agent; attest with the agent id");let o=await $t(n,i),a=Ge(n.provisioningPublicKey,"provisioningPublicKey",32),c=await kt(a,i,Nt(a,n.agentId),fe(JSON.stringify(s)));return _t(t,Mt(e,r),{agentId:n.agentId,provisioningPublicKeyB64:n.provisioningPublicKey,senderPublicKeyB64:o,encappedKeyB64:G(c.enc),ciphertextB64:G(c.ciphertext)})}async function Ii(t){Oi(t.secrets);let e=t.fetch??fetch,r=await Bt(e,t.gateUrl,"/provision",t.agent,t.ownerSecret,{secrets:t.secrets}),n=await Ur({gateUrl:t.gateUrl,agentId:t.agent.agentId,verifier:t.verifier,fetch:e}),i=await He(t.ownerSecret);if(n.ownerPublicKey!==i||!n.signingPublicKey)throw new D("The gate accepted the secrets, but its quote does not name your key as owner");if(t.agent.signingPublicKey&&t.agent.signingPublicKey!==n.signingPublicKey)throw new D("The agent's signing key changed while provisioning");return{agentId:n.agentId,provisioningPublicKey:n.provisioningPublicKey,signingPublicKey:n.signingPublicKey,ownerPublicKey:i,written:r?.written??[],claimed:r?.claimed===!0}}async function Di(t){if(!t.agent.ownerPublicKey)throw new Error("This agent is not claimed; there is nothing to release");let e=t.fetch??fetch;if(await Bt(e,t.gateUrl,"/release",t.agent,t.ownerSecret,{release:!0}),(await Ur({gateUrl:t.gateUrl,agentId:t.agent.agentId,verifier:t.verifier,fetch:e})).ownerPublicKey)throw new D("The gate says it released the agent, but its quote still names an owner")}var Sr=Object.freeze({identity:"https://github.com/calimero-network/mero-tee/.github/workflows/release-kms.yaml@refs/heads/master",issuer:"https://token.actions.githubusercontent.com"}),Ni=["allowed_tcb_statuses","allowed_mrtd","allowed_rtmr0","allowed_rtmr1","allowed_rtmr2","allowed_rtmr3"];async function Mi(t,e,r={}){let n=typeof t=="string"?new TextEncoder().encode(t):t;await be(n,e,{identity:r.identity??Sr.identity,issuer:r.issuer??Sr.issuer});let i;try{i=JSON.parse(new TextDecoder().decode(n))}catch{throw new Error("The signed agent policy is not JSON")}let s=r.role??"agent";if(i?.role!==s)throw new Error(`The signed file is a ${JSON.stringify(i?.role)} policy, not an ${s} one`);let o=r.profile??_;if(i.profile!==o)throw new Error(`The signed agent policy is for the ${JSON.stringify(i.profile)} profile, not ${o}`);if(r.expectedVersion!==void 0&&i.version!==r.expectedVersion)throw new Error(`The signed agent policy is release ${JSON.stringify(i.version)}, not ${r.expectedVersion}`);return Kt(i),i}function Kt(t){for(let e of Ni)if(!Array.isArray(t?.[e])||t[e].length===0)throw new Error(`The agent policy's ${e} is empty, so no agent would be accepted`)}var _i=["UpToDate","SWHardeningNeeded","ConfigurationNeeded","ConfigurationAndSWHardeningNeeded","OutOfDate","OutOfDateConfigurationNeeded"];function $i(t){let e=_i.find(r=>r.toLowerCase()===t.trim().toLowerCase());if(!e)throw new Error(`The agent policy allows an unknown TCB status ${JSON.stringify(t)}`);return e}var ye=t=>t.trim().replace(/^0x/i,"");function Bi(t,e){return Kt(t),$({dcapVerify:e.dcapVerify,fetchCollateral:e.fetchCollateral,now:e.now,allowedTcbStatuses:t.allowed_tcb_statuses.map($i),allowedMrtd:t.allowed_mrtd.map(ye),allowedRtmr0:t.allowed_rtmr0.map(ye),allowedRtmr1:t.allowed_rtmr1.map(ye),allowedRtmr2:t.allowed_rtmr2.map(ye),allowedRtmr3:t.allowed_rtmr3.map(ye)})}export{Tt as AGENT_ATTEST_DOMAIN,Ct as AGENT_PROVISION_INFO_DOMAIN,D as AgentGateError,_e as AppError,xe as ArgsTooLarge,Te as BadOrigin,Pr as CalimeroClient,y as CalimeroError,Ie as ClusterNotUpgraded,oe as ConfirmCancelled,ae as ConfirmPromptBlocked,Z as ConfirmRequired,Se as ConsentStale,sr as DEFAULT_COLLATERAL_MIRROR,gr as DEFAULT_DIRECTORY,gi as DEFAULT_ORG_CAPABILITIES,Ee as DEFAULT_RELEASE_MIRROR,U as DirectoryError,Jr as GITHUB_RELEASES,Mr as HANDSHAKE_PATH,ke as IdempotencyMismatch,Sr as KMS_RELEASE_SIGNER,B as LoginRequired,mr as MAX_RECOVERY_NONCE_BYTES,Ar as MAX_REPORT_PAGE,Xr as MOCK_QUOTE_HEADER,ir as NODE_RELEASE_SIGNER,ve as NotFound,Oe as NotServing,vr as ORG_CAPABILITIES,V as OriginNotRegistered,Ce as OriginTaken,_ as PRODUCTION_PROFILE,Pe as PasskeyUnknownHere,Me as QuotaExceeded,nt as RECOVERY_DOMAIN,dt as RELEASE_VERIFIER,De as RecoveryNotReady,Ue as ReleaseDeadlineError,te as SEALED_CONTENT_TYPE,_r as SEALED_PATH,S as SealedTransportError,Ne as SignUpRefused,ne as StaleTransportKeyError,$e as TrapError,L as UnavailableError,K as WrongNode,ce as WrongRecoveryCode,Dt as agentKeyBinding,Bi as agentQuoteVerifier,Ur as attestAgent,P as b64url,Qn as browserPasskey,$t as checkOwner,Wr as claimedRelease,cr as cloudNodeReleaseUrl,de as compareVersions,br as confirmationCode,ei as consentReturn,$ as createQuoteVerifier,We as createSealedFetch,_n as createSignedReleaseVerifier,mt as deployerKey,Ke as errorFrom,ur as fetchAttestedKey,ar as fetchGithubNodeRelease,or as fetchNodeRelease,et as freshCollateral,O as fromB64url,ni as frontendManifest,Ci as generateOwnerKey,Yn as newRecoverySeed,pi as orgCapabilities,He as ownerPublicKey,ii as pageDeployment,ue as pageQuery,zn as parseRecoverySeed,Er as pendingApprovalsFrom,Ii as provisionAgent,Nt as provisionInfo,Xn as publisherBindingBytes,lt as publisherBindingMessage,it as recoveryMessage,Zn as recoveryPublicKey,Jn as recoverySeedText,Di as releaseAgent,pt as releaseConsent,ut as releaseNotesUrl,wr as signRecovery,ct as stalledBy,Xe as transportKeyBinding,Re as trustSignedRelease,nr as trustedMeasurementsFromReleases,ti as upgradeConsent,Ot as validateAgentId,gt as verifyReleaseUrl,Mi as verifySignedAgentPolicy,Yr as verifySignedNodeRelease,ri as withdrawConsent};
 //# sourceMappingURL=index.browser.mjs.map