@invisible-labs/sdk 0.8.0-devnet → 0.10.0-devnet

package/README.md

@@ -19,8 +19,10 @@ coordinator. The normal-user surface uses one functional sequence over a caller-
 npm install @invisible-labs/sdk@devnet
 ```
 
-The public package requires Node.js 22 or newer for server runtimes. Browser consumers need Web
-Crypto and WebSocket. The default transport uses the platform `WebSocket`.
+Server runtimes require Node.js 22.23.4+, 24.22.1+, or 26.12.1+ within those
+major versions. Earlier releases lack the October 2026 security fixes.
+Browser consumers need Web Crypto and WebSocket. The default transport uses
+the platform `WebSocket`.
 
 ## Session boundary
 
@@ -125,7 +127,7 @@ be persisted. Resume fails closed if the coordinator acknowledges a different sp
 ## Private-transfer amount limits
 
 Use the public user-entry constants for inclusive preflight validation. Values are expressed in
-lamports, matching the `amountLamports` request field. The current V0 bounds are `1.5 SOL`
+lamports, matching the `amountLamports` request field. The current Beta bounds are `1.5 SOL`
 (`1_500_000_000` lamports) minimum and `100 SOL` (`100_000_000_000` lamports) maximum.
 The SDK rejects non-safe integers and values outside these bounds before sending a coordinator
 request.
@@ -191,6 +193,13 @@ clearing. Use a caller-controlled encrypted adapter when that tradeoff is unacce
 fails after coordinator acceptance, the SDK throws a typed `StorageError` with the affected swap
 and `remoteAccepted: true`; do not blindly retry the coordinator command.
 
+Busy and capacity rejections are returned by default. For caller-controlled
+initialization recovery, `contractRequest` and `resumePreDelegation` accept
+`onInitializationRetry({ swapId, stage, error })`. Wait in that callback to
+repeat the same DKG/delegation payload after a correlated temporary busy
+response. The SDK defines no retry delays. `signal` stops future attempts;
+unknown outcomes never authorize allocating another transfer.
+
 When client persistence is disabled, consumers that need restart or tab-close recovery must store
 the relevant values themselves:
 
@@ -206,6 +215,11 @@ their own encrypted storage layer for caller-managed material. Browser and exten
 caller-supplied bytes; they do not encrypt them. Encrypt before storing or use an access-controlled
 vault for production recovery material.
 
+After an interrupted LP creation response, the SDK queries the existing position
+using its generated Position Code authority and a fresh attested session when
+needed. A matching persisted position completes creation without another wallet
+signature or creation command. An unresolved result fails closed.
+
 LP DKG requests are bounded. If a browser worker stops responding, the SDK terminates the local
 workers and attempts the signed position-scoped DKG abort command within a bounded cleanup window
 before returning the original failure. LP recovery sends the same cleanup command for an

package/dist/.invisible-sdk-build-target.json

@@ -1,7 +1,7 @@
 {
   "package": "@invisible-labs/sdk",
   "target": "public",
-  "productionBinaryHash": "2eb6efac5b38562b0759043155556034ea105db40094f0e424762f05ae441da8",
+  "productionBinaryHash": "3144c8837fbbaad837013512f4920e76699a4d61b167f7041eb33b1ac5aba8df",
   "productionMrtd": "6f3e84c54ac6377614d4c139473db575a83b5db41bd845eecb4eedaf2788ea881309a410c4ceae9641406411f3f639b8",
-  "productionRuntimeProfile": "prod-hardened"
+  "productionRuntimeProfile": "prod-devnet-premium-locked"
 }

package/dist/{chunk-MZKJU3UA.js → chunk-6AGC3IOB.js}

@@ -1,5 +1,5 @@
-import { getSessionState } from './chunk-HJFMDMPY.js';
-import { TransportError, CommandError } from './chunk-QRN46R3F.js';
+import { getSessionState } from './chunk-6AKBRYKO.js';
+import { TransportError, CommandError, COORDINATOR_CAPACITY_FULL_ERROR_CODE, COORDINATOR_CAPACITY_FULL_USER_MESSAGE } from './chunk-RWKG7N7I.js';
 
 // src/coordinator/protocolClient.ts
 var MAX_COORDINATOR_REQUEST_ID = 4294967295;
@@ -32,7 +32,7 @@ var CoordinatorMessageType = {
 };
 var protocolPromise = null;
 function loadProtocol() {
-  protocolPromise ??= import('./coordinator-E2TS6NR2.js');
+  protocolPromise ??= import('./coordinator-T2B7253V.js');
   return protocolPromise;
 }
 var runtimes = /* @__PURE__ */ new WeakMap();
@@ -270,8 +270,10 @@ function rejectMatchingOutOfBandErrors(runtime, swapId, error) {
 }
 function commandErrorFromCoordinatorError(payload) {
   const coordinatorCode = toCoordinatorWireErrorCode(payload.code);
-  return new CommandError(commandCodeFromCoordinatorCode(coordinatorCode), payload.message, {
+  const message = coordinatorCode === COORDINATOR_CAPACITY_FULL_ERROR_CODE ? COORDINATOR_CAPACITY_FULL_USER_MESSAGE : payload.message;
+  return new CommandError(commandCodeFromCoordinatorCode(coordinatorCode), message, {
     coordinatorCode,
+    coordinatorMessage: payload.message,
     ...payload.failed_req_id !== void 0 ? { failedReqId: payload.failed_req_id } : {}
   });
 }
@@ -281,6 +283,11 @@ function commandCodeFromCoordinatorCode(code) {
     case "ERR_UNKNOWN_SWAP":
     case "ERR_SWAP_NOT_REFUNDABLE":
       return "REJECTED_STATE";
+    case "ERR_INITIALIZATION_BUSY":
+    case "ERR_PRESEAL_ADMISSION_BUSY":
+      return "RETRYABLE_BUSY";
+    case COORDINATOR_CAPACITY_FULL_ERROR_CODE:
+      return "REJECTED_RESOURCE_CAP";
     case "ERR_INTERNAL":
     case "ERR_SETTLEMENT_FAILED":
       return "REJECTED_STALE_JOB";
@@ -302,6 +309,9 @@ function toCoordinatorWireErrorCode(code) {
     case "ERR_SWAP_NOT_REFUNDABLE":
     case "ERR_DKG_FAILURE":
     case "ERR_INTERNAL":
+    case "ERR_INITIALIZATION_BUSY":
+    case "ERR_PRESEAL_ADMISSION_BUSY":
+    case COORDINATOR_CAPACITY_FULL_ERROR_CODE:
     case "ERR_INVALID_DEPOSIT":
     case "ERR_SETTLEMENT_FAILED":
       return code;
@@ -325,5 +335,5 @@ function rejectAll(runtime, error) {
 }
 
 export { CoordinatorMessageType, EnvelopeKind, closeProtocolRuntime, onEnvelope, requestEnvelope };
-//# sourceMappingURL=chunk-MZKJU3UA.js.map
-//# sourceMappingURL=chunk-MZKJU3UA.js.map
+//# sourceMappingURL=chunk-6AGC3IOB.js.map
+//# sourceMappingURL=chunk-6AGC3IOB.js.map

package/dist/chunk-6AGC3IOB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/coordinator/protocolClient.ts"],"names":["pending"],"mappings":";;;;AAaA,IAAM,0BAAA,GAA6B,UAAA;AACnC,IAAM,sBAAA,GAAyB,CAAA;AAExB,IAAM,YAAA,GAAe;AAAA,EAC1B,OAAA,EAAS,SAAA;AAAA,EACT,QAAA,EAAU,UAAA;AAAA,EACV,IAAA,EAAM,MAAA;AAAA,EACN,KAAA,EAAO;AACT;AAIO,IAAM,sBAAA,GAAyB;AAAA,EACpC,eAAA,EAAiB,iBAAA;AAAA,EACjB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,OAAA,EAAS,SAAA;AAAA,EACT,SAAA,EAAW,WAAA;AAAA,EACX,SAAA,EAAW,WAAA;AAAA,EACX,WAAA,EAAa,aAAA;AAAA,EACb,aAAA,EAAe,eAAA;AAAA,EACf,WAAA,EAAa,aAAA;AAAA,EACb,gBAAA,EAAkB,kBAAA;AAAA,EAClB,IAAA,EAAM,MAAA;AAAA,EACN,YAAA,EAAc,cAAA;AAAA,EACd,MAAA,EAAQ,QAAA;AAAA,EACR,cAAA,EAAgB,gBAAA;AAAA,EAChB,eAAA,EAAiB,iBAAA;AAAA,EACjB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,SAAA,EAAW,WAAA;AAAA,EACX,KAAA,EAAO;AACT;AA4BA,IAAI,eAAA,GAAkD,IAAA;AAEtD,SAAS,YAAA,GAAwC;AAC/C,EAAA,eAAA,KAAoB,OAAO,2BAAsB,CAAA;AACjD,EAAA,OAAO,eAAA;AACT;AAmDA,IAAM,QAAA,uBAAe,OAAA,EAAuC;AAE5D,eAAsB,gBACpB,OAAA,EACA,IAAA,EACA,OAAA,EACA,OAAA,GAAkC,EAAC,EAChB;AACnB,EAAA,qBAAA,CAAsB,QAAQ,MAAM,CAAA;AACpC,EAAA,MAAM,QAAA,GAAW,MAAM,YAAA,EAAa;AACpC,EAAA,qBAAA,CAAsB,QAAQ,MAAM,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,gBAAgB,OAAO,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,sBAAsB,KAAK,CAAA;AAC3C,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA;AACtB,EAAA,IAAI,CAAC,KAAA,CAAM,QAAA,IAAY,OAAA,KAAY,IAAA,EAAM;AACvC,IAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,kDAAkD,CAAA;AAAA,EAChG;AAEA,EAAA,IAAI,OAAA,CAAQ,cAAc,0BAAA,EAA4B;AACpD,IAAA,MAAM,IAAI,YAAA,CAAa,gBAAA,EAAkB,wCAAwC,CAAA;AAAA,EACnF;AACA,EAAA,MAAM,KAAA,GAAQ,QAAQ,UAAA,GAAa,CAAA;AACnC,EAAA,OAAA,CAAQ,UAAA,GAAa,KAAA;AACrB,EAAA,MAAM,QAAA,GAAqB;AAAA,IACzB,SAAS,QAAA,CAAS,gBAAA;AAAA,IAClB,IAAA,EAAM,SAAS,YAAA,CAAa,OAAA;AAAA,IAC5B,IAAA;AAAA,IACA,OAAA,EAAS,QAAQ,MAAA,IAAU,IAAA;AAAA,IAC3B,MAAA,EAAQ,KAAA;AAAA,IACR,YAAA,EAAc,KAAK,GAAA,EAAI;AAAA,IACvB;AAAA,GACF;AACA,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,eAAA,CAAgB,QAAQ,CAAA;AAE/C,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GACJ,OAAA,CAAQ,MAAA,KAAW,MAAA,GACf,MAAA,GACA,MAAM,aAAA,CAAc,OAAA,EAAS,KAAA,EAAO,uBAAA,EAAyB,CAAA;AACnE,IAAA,MAAM,QACJ,OAAA,CAAQ,SAAA,KAAc,MAAA,GAClB,IAAA,GACA,WAAW,MAAM;AACf,MAAA,aAAA;AAAA,QACE,OAAA;AAAA,QACA,KAAA;AAAA,QACA,IAAI,YAAA;AAAA,UACF,oBAAA;AAAA,UACA,CAAA,kCAAA,EAAqC,IAAI,CAAA,OAAA,EAAU,OAAA,CAAQ,SAAS,CAAA,EAAA;AAAA;AACtE,OACF;AAAA,IACF,CAAA,EAAG,QAAQ,SAAS,CAAA;AAE1B,IAAA,OAAA,CAAQ,OAAA,CAAQ,IAAI,KAAA,EAAO;AAAA,MACzB,cAAA,EAAgB,QAAQ,MAAA,IAAU,IAAA;AAAA,MAClC,OAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA;AAAA,MACA,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,YAAA;AAAA,MACA,QAAQ,QAAA,CAAS,OAAA;AAAA,MACjB,6BAAA,EAA+B,QAAQ,6BAAA,KAAkC,IAAA;AAAA,MACzE,4BAAA,EAA8B,QAAQ,4BAAA,KAAiC;AAAA,KACxE,CAAA;AACD,IAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,MAAA,OAAA,CAAQ,QAAQ,gBAAA,CAAiB,OAAA,EAAS,cAAc,EAAE,IAAA,EAAM,MAAM,CAAA;AACtE,MAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM;AACpC,QAAA,YAAA,EAAa;AACb,QAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,QAAA,EAAW,KAAK,IAAI,KAAK,CAAA;AACnD,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,KAAK,KAAK,CAAA;AAAA,IACpB,SAAS,KAAA,EAAO;AACd,MAAA,aAAA,CAAc,OAAA,EAAS,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,IACzF;AAAA,EACF,CAAC,CAAA;AACH;AA0BO,SAAS,UAAA,CAAW,SAAkB,OAAA,EAA+C;AAC1F,EAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,eAAA,CAAgB,OAAO,CAAC,CAAA;AAC9D,EAAA,OAAA,CAAQ,gBAAA,CAAiB,IAAI,OAAO,CAAA;AACpC,EAAA,OAAO,MAAM,OAAA,CAAQ,gBAAA,CAAiB,MAAA,CAAO,OAAO,CAAA;AACtD;AAEO,SAAS,qBAAqB,OAAA,EAAwB;AAC3D,EAAA,MAAM,KAAA,GAAQ,gBAAgB,OAAO,CAAA;AACrC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA;AAClC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,KAAA,GAAQ,IAAI,cAAA,CAAe,iBAAA,EAAmB,qCAAqC,CAAA;AACzF,EAAA,SAAA,CAAU,SAAS,KAAK,CAAA;AACxB,EAAA,OAAA,CAAQ,kBAAA,IAAqB;AAC7B,EAAA,OAAA,CAAQ,oBAAA,IAAuB;AAC/B,EAAA,QAAA,CAAS,OAAO,KAAK,CAAA;AACvB;AAEA,SAAS,sBAAsB,KAAA,EAAsC;AACnE,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,KAAK,CAAA;AACnC,EAAA,IAAI,UAAU,OAAO,QAAA;AAErB,EAAA,MAAM,OAAA,GAA2B;AAAA,IAC/B,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,sBAAa,GAAA,EAAI;AAAA,IACjB,WAAA,sBAAiB,GAAA,EAAI;AAAA,IACrB,gBAAA,sBAAsB,GAAA,EAAI;AAAA,IAC1B,kBAAA,EAAoB,IAAA;AAAA,IACpB,oBAAA,EAAsB;AAAA,GACxB;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,IAAA,EAAM;AAC1B,IAAA,MAAM,IAAI,cAAA,CAAe,iBAAA,EAAmB,8CAA8C,CAAA;AAAA,EAC5F;AACA,EAAA,OAAA,CAAQ,kBAAA,GAAqB,MAAM,OAAA,CAAQ,SAAA,CAAU,CAAC,KAAA,KAAU,WAAA,CAAY,OAAA,EAAS,KAAK,CAAC,CAAA;AAC3F,EAAA,OAAA,CAAQ,oBAAA,GAAuB,KAAA,CAAM,SAAA,CAAU,aAAA,CAAc,CAAC,cAAA,KAAmB;AAC/E,IAAA,IAAI,cAAA,KAAmB,SAAA,IAAa,cAAA,KAAmB,QAAA,EAAU;AAC/D,MAAA,SAAA,CAAU,OAAA,EAAS,IAAI,cAAA,CAAe,iBAAA,EAAmB,8BAA8B,CAAC,CAAA;AAAA,IAC1F;AAAA,EACF,CAAC,CAAA;AAED,EAAA,QAAA,CAAS,GAAA,CAAI,OAAO,OAAO,CAAA;AAC3B,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,WAAA,CAAY,SAA0B,KAAA,EAAyB;AACtE,EAAA,KAAK,gBAAA,CAAiB,SAAS,KAAK,CAAA;AACtC;AAEA,eAAe,gBAAA,CAAiB,SAA0B,KAAA,EAAkC;AAC1F,EAAA,MAAM,QAAA,GAAW,MAAM,YAAA,EAAa;AACpC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA;AACrC,EAAA,IAAI,CAAC,QAAQ,EAAA,EAAI;AACf,IAAA,SAAA,CAAU,OAAA,EAAS,QAAQ,KAAK,CAAA;AAChC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,WAAW,OAAA,CAAQ,KAAA;AACzB,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,YAAA,CAAa,QAAA,EAAU;AACpD,IAAA,MAAMA,QAAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,MAAM,CAAA;AACnD,IAAA,IAAIA,YAAW,CAAC,2BAAA,CAA4BA,QAAAA,EAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AACtE,MAAA,aAAA;AAAA,QACE,OAAA;AAAA,QACA,QAAA,CAAS,MAAA;AAAA,QACT,2BAA2B,QAAA,CAAS,MAAA,EAAQA,QAAAA,CAAQ,cAAA,EAAgB,SAAS,OAAO;AAAA,OACtF;AACA,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GACJ,SAAS,IAAA,KAAS,QAAA,CAAS,aAAa,KAAA,GAAQ,QAAA,CAAS,cAAA,CAAe,QAAQ,CAAA,GAAI,IAAA;AACtF,EAAA,IAAI,YAAA,EAAc,kBAAkB,MAAA,EAAW;AAC7C,IAAA,MAAMA,QAAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,aAAa,aAAa,CAAA;AAC9D,IAAA,IAAIA,YAAW,CAAC,2BAAA,CAA4BA,UAAS,QAAA,CAAS,OAAA,EAAS,KAAK,CAAA,EAAG;AAC7E,MAAA,aAAA;AAAA,QACE,OAAA;AAAA,QACA,YAAA,CAAa,aAAA;AAAA,QACb,0BAAA;AAAA,UACE,YAAA,CAAa,aAAA;AAAA,UACbA,QAAAA,CAAQ,cAAA;AAAA,UACR,QAAA,CAAS;AAAA;AACX,OACF;AACA,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,OAAA,CAAQ,gBAAA,EAAkB,OAAA,CAAQ,QAAQ,CAAA;AAEhE,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,YAAA,CAAa,KAAA,EAAO;AACjD,IAAA,MAAM,OAAA,GAAU,YAAA;AAChB,IAAA,MAAM,KAAA,GAAQ,iCAAiC,OAAO,CAAA;AACtD,IAAA,IAAI,OAAA,CAAQ,aAAA,KAAkB,MAAA,IAAa,OAAA,CAAQ,kBAAkB,sBAAA,EAAwB;AAC3F,MAAA,IAAI,QAAA,CAAS,YAAY,IAAA,EAAM;AAC7B,QAAA,6BAAA,CAA8B,OAAA,EAAS,QAAA,CAAS,OAAA,EAAS,KAAK,CAAA;AAAA,MAChE;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAMA,QAAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,aAAa,CAAA;AACzD,IAAA,IAAI,CAACA,QAAAA,EAAS;AACd,IAAA,IAAI,CAAC,2BAAA,CAA4BA,QAAAA,EAAS,QAAA,CAAS,OAAA,EAAS,KAAK,CAAA,EAAG;AAClE,MAAA,aAAA;AAAA,QACE,OAAA;AAAA,QACA,OAAA,CAAQ,aAAA;AAAA,QACR,2BAA2B,OAAA,CAAQ,aAAA,EAAeA,QAAAA,CAAQ,cAAA,EAAgB,SAAS,OAAO;AAAA,OAC5F;AACA,MAAA;AAAA,IACF;AACA,IAAA,aAAA,CAAc,OAAA,EAAS,OAAA,CAAQ,aAAA,EAAe,KAAK,CAAA;AACnD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,YAAA,CAAa,IAAA,EAAM;AAChD,IAAA,iBAAA,CAAkB,SAAS,QAAQ,CAAA;AACnC,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,QAAA,CAAS,YAAA,CAAa,QAAA,EAAU;AACtD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,SAAS,MAAM,CAAA;AACnD,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,IAAI,CAAC,2BAAA,CAA4B,OAAA,EAAS,QAAA,CAAS,OAAO,CAAA,EAAG;AAC3D,IAAA,aAAA;AAAA,MACE,OAAA;AAAA,MACA,QAAA,CAAS,MAAA;AAAA,MACT,2BAA2B,QAAA,CAAS,MAAA,EAAQ,OAAA,CAAQ,cAAA,EAAgB,SAAS,OAAO;AAAA,KACtF;AACA,IAAA;AAAA,EACF;AACA,EAAA,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA;AACtC,EAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,EAAA,OAAA,CAAQ,QAAQ,QAAQ,CAAA;AAC1B;AAEA,SAAS,2BAAA,CACP,OAAA,EACA,cAAA,EACA,4BAAA,GAA+B,IAAA,EACtB;AACT,EAAA,IACE,4BAAA,IACA,OAAA,CAAQ,4BAAA,IACR,cAAA,KAAmB,IAAA,EACnB;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,OAAA,CAAQ,cAAA,KAAmB,IAAA,IAAQ,OAAA,CAAQ,cAAA,KAAmB,cAAA;AACvE;AAEA,SAAS,0BAAA,CACP,KAAA,EACA,cAAA,EACA,cAAA,EACc;AACd,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,gBAAA;AAAA,IACA,oDAAoD,KAAK,CAAA,WAAA,EAAc,kBAAkB,MAAM,CAAA,WAAA,EAAc,kBAAkB,MAAM,CAAA,CAAA;AAAA,IACrI,EAAE,aAAa,KAAA;AAAM,GACvB;AACF;AAEA,SAAS,iBAAA,CAAkB,SAA0B,QAAA,EAA0B;AAC7E,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,WAAA,CAAY,GAAA,CAAI,SAAS,IAAI,CAAA;AACrD,EAAA,MAAM,cAAc,OAAA,EAAS,SAAA;AAAA,IAC3B,CAAC,SAAA,KAAc,SAAA,CAAU,WAAW,MAAA,IAAa,SAAA,CAAU,WAAW,QAAA,CAAS;AAAA,GACjF;AACA,EAAA,MAAM,MAAA,GACJ,OAAA,IAAW,WAAA,KAAgB,MAAA,IAAa,WAAA,IAAe,CAAA,GACnD,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,CAAE,CAAC,CAAA,GAChC,MAAA;AACN,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,OAAA,EAAS;AACzB,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,OAAA,CAAQ,WAAA,CAAY,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA;AAAA,EAC1C;AACA,EAAA,IAAI,MAAA,CAAO,KAAA,EAAO,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC3C,EAAA,MAAA,CAAO,QAAQ,QAAQ,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,OAAA,EAA0B,KAAA,EAAe,KAAA,EAAoB;AAClF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACzC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,OAAA,CAAQ,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC5B,EAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,EAAA,OAAA,CAAQ,OAAO,KAAK,CAAA;AACtB;AAEA,SAAS,sBAAsB,OAAA,EAA+B;AAC5D,EAAA,IAAI,OAAA,CAAQ,KAAA,EAAO,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AAC7C,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,MAAA,IAAa,OAAA,CAAQ,iBAAiB,MAAA,EAAW;AACtE,IAAA,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,OAAA,CAAQ,YAAY,CAAA;AAAA,EAClE;AACF;AAEA,SAAS,sBAAsB,MAAA,EAAuC;AACpE,EAAA,IAAI,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM,MAAM,uBAAA,EAAwB;AAC9D;AAEA,SAAS,uBAAA,GAAwC;AAC/C,EAAA,OAAO,IAAI,YAAA,CAAa,6BAAA,EAA+B,YAAY,CAAA;AACrE;AAEA,SAAS,6BAAA,CACP,OAAA,EACA,MAAA,EACA,KAAA,EACM;AACN,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,OAAO,CAAA,IAAK,QAAQ,OAAA,EAAS;AAC9C,IAAA,IAAI,CAAC,OAAA,CAAQ,6BAAA,IAAiC,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACzE,IAAA,aAAA,CAAc,OAAA,EAAS,OAAO,KAAK,CAAA;AAAA,EACrC;AACF;AAEA,SAAS,iCAAiC,OAAA,EAIzB;AACf,EAAA,MAAM,eAAA,GAAkB,0BAAA,CAA2B,OAAA,CAAQ,IAAI,CAAA;AAC/D,EAAA,MAAM,OAAA,GACJ,eAAA,KAAoB,oCAAA,GAChB,sCAAA,GACA,OAAA,CAAQ,OAAA;AACd,EAAA,OAAO,IAAI,YAAA,CAAa,8BAAA,CAA+B,eAAe,GAAG,OAAA,EAAS;AAAA,IAChF,eAAA;AAAA,IACA,oBAAoB,OAAA,CAAQ,OAAA;AAAA,IAC5B,GAAI,QAAQ,aAAA,KAAkB,MAAA,GAAY,EAAE,WAAA,EAAa,OAAA,CAAQ,aAAA,EAAc,GAAI;AAAC,GACrF,CAAA;AACH;AAEA,SAAS,+BAA+B,IAAA,EAAkD;AACxF,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,qBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,yBAAA;AACH,MAAA,OAAO,gBAAA;AAAA,IACT,KAAK,yBAAA;AAAA,IACL,KAAK,4BAAA;AACH,MAAA,OAAO,gBAAA;AAAA,IACT,KAAK,oCAAA;AACH,MAAA,OAAO,uBAAA;AAAA,IACT,KAAK,cAAA;AAAA,IACL,KAAK,uBAAA;AACH,MAAA,OAAO,oBAAA;AAAA,IACT,KAAK,qBAAA;AAAA,IACL,KAAK,sBAAA;AAAA,IACL,KAAK,2BAAA;AAAA,IACL,KAAK,iBAAA;AAAA,IACL,KAAK,qBAAA;AACH,MAAA,OAAO,gBAAA;AAAA;AAEb;AAEA,SAAS,2BAA2B,IAAA,EAAwC;AAC1E,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,qBAAA;AAAA,IACL,KAAK,qBAAA;AAAA,IACL,KAAK,kBAAA;AAAA,IACL,KAAK,sBAAA;AAAA,IACL,KAAK,2BAAA;AAAA,IACL,KAAK,yBAAA;AAAA,IACL,KAAK,iBAAA;AAAA,IACL,KAAK,cAAA;AAAA,IACL,KAAK,yBAAA;AAAA,IACL,KAAK,4BAAA;AAAA,IACL,KAAK,oCAAA;AAAA,IACL,KAAK,qBAAA;AAAA,IACL,KAAK,uBAAA;AACH,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,cAAA;AAAA;AAEb;AAcA,SAAS,SAAA,CAAU,SAA0B,KAAA,EAAoB;AAC/D,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,OAAO,KAAK,OAAA,CAAQ,OAAA,CAAQ,SAAQ,EAAG;AACxD,IAAA,OAAA,CAAQ,OAAA,CAAQ,OAAO,KAAK,CAAA;AAC5B,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAC7B,IAAA,OAAA,CAAQ,OAAO,KAAK,CAAA;AAAA,EACtB;AACA,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,OAAO,KAAK,OAAA,CAAQ,WAAA,CAAY,SAAQ,EAAG;AAC3D,IAAA,OAAA,CAAQ,WAAA,CAAY,OAAO,IAAI,CAAA;AAC/B,IAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,MAAA,IAAI,MAAA,CAAO,KAAA,EAAO,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC3C,MAAA,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,IACrB;AAAA,EACF;AACF","file":"chunk-6AGC3IOB.js","sourcesContent":["import {\n  COORDINATOR_CAPACITY_FULL_ERROR_CODE,\n  COORDINATOR_CAPACITY_FULL_USER_MESSAGE,\n  CommandError,\n  TransportError,\n  type CommandErrorCode,\n  type CoordinatorWireErrorCode,\n} from \"../core/errors.js\";\nimport type { Session } from \"../core/session.js\";\nimport { getSessionState, type SessionState } from \"../session/state.js\";\nimport type { Unsubscribe } from \"../transport/types.js\";\n\nconst COORDINATOR_ENVELOPE_VERSION = 2;\nconst MAX_COORDINATOR_REQUEST_ID = 0xffff_ffff;\nconst OUT_OF_BAND_REQUEST_ID = 0;\n\nexport const EnvelopeKind = {\n  REQUEST: \"request\",\n  RESPONSE: \"response\",\n  PUSH: \"push\",\n  ERROR: \"error\",\n} as const;\n\nexport type EnvelopeKind = (typeof EnvelopeKind)[keyof typeof EnvelopeKind];\n\nexport const CoordinatorMessageType = {\n  ContractRequest: \"ContractRequest\",\n  LpCreateAuthorization: \"LpCreateAuthorization\",\n  DkgInit: \"DkgInit\",\n  DkgRound1: \"DkgRound1\",\n  DkgRound2: \"DkgRound2\",\n  DkgComplete: \"DkgComplete\",\n  DelegateShare: \"DelegateShare\",\n  DelegateAck: \"DelegateAck\",\n  DepositConfirmed: \"DepositConfirmed\",\n  Sync: \"Sync\",\n  SyncRequired: \"SyncRequired\",\n  Refill: \"Refill\",\n  PayoutExecuted: \"PayoutExecuted\",\n  WithdrawRequest: \"WithdrawRequest\",\n  WithdrawAccepted: \"WithdrawAccepted\",\n  WithdrawExecuted: \"WithdrawExecuted\",\n  LpCommand: \"LpCommand\",\n  Error: \"Error\",\n} as const;\n\nexport type CoordinatorMessageType =\n  (typeof CoordinatorMessageType)[keyof typeof CoordinatorMessageType];\n\nexport type Envelope = {\n  readonly version: typeof COORDINATOR_ENVELOPE_VERSION;\n  readonly kind: EnvelopeKind;\n  readonly type: CoordinatorMessageType;\n  readonly swap_id: string | null;\n  readonly req_id: number;\n  readonly timestamp_ms: number;\n  readonly payload: unknown;\n};\n\ntype ProtocolModule = {\n  readonly ENVELOPE_VERSION: typeof COORDINATOR_ENVELOPE_VERSION;\n  readonly EnvelopeKind: typeof EnvelopeKind;\n  readonly CoordinatorMessageType: typeof CoordinatorMessageType;\n  readonly encodeValidated: (envelope: Envelope) => Uint8Array;\n  readonly decode: (raw: Uint8Array) => { ok: true; value: Envelope } | { ok: false; error: Error };\n  readonly asErrorPayload: (envelope: Envelope) => {\n    readonly code: string;\n    readonly failed_req_id?: number;\n    readonly message: string;\n  };\n};\n\nlet protocolPromise: Promise<ProtocolModule> | null = null;\n\nfunction loadProtocol(): Promise<ProtocolModule> {\n  protocolPromise ??= import(\"protocol/coordinator\") as Promise<ProtocolModule>;\n  return protocolPromise;\n}\n\nexport type ProtocolLogDirection = \"in\" | \"out\" | \"info\";\nexport type ProtocolLogHandler = (message: string, direction: ProtocolLogDirection) => void;\nexport type ProtocolEnvelopeHandler = (envelope: Envelope) => void;\n\nexport interface RequestEnvelopeOptions {\n  readonly swapId?: string | null;\n  readonly timeoutMs?: number;\n  readonly signal?: AbortSignal;\n  readonly onLog?: ProtocolLogHandler;\n  /** Reject this request when the coordinator reports a swap-scoped error without a request id. */\n  readonly rejectMatchingOutOfBandErrors?: boolean;\n  /** Contract allocation responses must carry the server-assigned swap_id. */\n  readonly requireNonNullResponseSwapId?: boolean;\n}\n\nexport interface AwaitPushOptions {\n  /** Exact business routing key. Omit only for legacy wildcard waiters. */\n  readonly swapId?: string | null;\n  readonly timeoutMs?: number | null;\n}\n\ntype PendingRequest = {\n  readonly expectedSwapId: string | null;\n  readonly resolve: (envelope: Envelope) => void;\n  readonly reject: (error: Error) => void;\n  readonly timer: ReturnType<typeof setTimeout> | null;\n  readonly signal?: AbortSignal;\n  readonly abortHandler?: () => void;\n  readonly swapId: string | null;\n  readonly rejectMatchingOutOfBandErrors: boolean;\n  readonly requireNonNullResponseSwapId: boolean;\n};\n\ntype PushWaiter = {\n  readonly swapId?: string | null;\n  readonly resolve: (envelope: Envelope) => void;\n  readonly reject: (error: Error) => void;\n  readonly timer: ReturnType<typeof setTimeout> | null;\n};\n\ntype ProtocolRuntime = {\n  reqCounter: number;\n  readonly pending: Map<number, PendingRequest>;\n  readonly pushWaiters: Map<CoordinatorMessageType, PushWaiter[]>;\n  readonly envelopeHandlers: Set<ProtocolEnvelopeHandler>;\n  unsubscribeChannel: Unsubscribe | null;\n  unsubscribeTransport: Unsubscribe | null;\n};\n\nconst runtimes = new WeakMap<SessionState, ProtocolRuntime>();\n\nexport async function requestEnvelope(\n  session: Session,\n  type: CoordinatorMessageType,\n  payload: unknown,\n  options: RequestEnvelopeOptions = {},\n): Promise<Envelope> {\n  throwIfRequestAborted(options.signal);\n  const protocol = await loadProtocol();\n  throwIfRequestAborted(options.signal);\n  const state = getSessionState(session);\n  const runtime = ensureProtocolRuntime(state);\n  const channel = state.channel;\n  if (!state.attested || channel === null) {\n    throw new TransportError(\"CONNECTION_LOST\", \"coordinator request requires an attested channel\");\n  }\n\n  if (runtime.reqCounter >= MAX_COORDINATOR_REQUEST_ID) {\n    throw new CommandError(\"REJECTED_STATE\", \"coordinator request id space exhausted\");\n  }\n  const reqId = runtime.reqCounter + 1;\n  runtime.reqCounter = reqId;\n  const envelope: Envelope = {\n    version: protocol.ENVELOPE_VERSION,\n    kind: protocol.EnvelopeKind.REQUEST,\n    type,\n    swap_id: options.swapId ?? null,\n    req_id: reqId,\n    timestamp_ms: Date.now(),\n    payload,\n  };\n  const frame = protocol.encodeValidated(envelope);\n\n  return new Promise((resolve, reject) => {\n    const abortHandler =\n      options.signal === undefined\n        ? undefined\n        : () => rejectPending(runtime, reqId, createRequestAbortError());\n    const timer =\n      options.timeoutMs === undefined\n        ? null\n        : setTimeout(() => {\n            rejectPending(\n              runtime,\n              reqId,\n              new CommandError(\n                \"REJECTED_STALE_JOB\",\n                `coordinator request timed out for ${type} after ${options.timeoutMs}ms`,\n              ),\n            );\n          }, options.timeoutMs);\n\n    runtime.pending.set(reqId, {\n      expectedSwapId: options.swapId ?? null,\n      resolve,\n      reject,\n      timer,\n      signal: options.signal,\n      abortHandler,\n      swapId: envelope.swap_id,\n      rejectMatchingOutOfBandErrors: options.rejectMatchingOutOfBandErrors === true,\n      requireNonNullResponseSwapId: options.requireNonNullResponseSwapId === true,\n    });\n    if (abortHandler !== undefined) {\n      options.signal?.addEventListener(\"abort\", abortHandler, { once: true });\n      if (options.signal?.aborted === true) {\n        abortHandler();\n        return;\n      }\n    }\n    options.onLog?.(`-> ${type} req_id=${reqId}`, \"out\");\n    try {\n      channel.send(frame);\n    } catch (error) {\n      rejectPending(runtime, reqId, error instanceof Error ? error : new Error(String(error)));\n    }\n  });\n}\n\nexport function awaitPush(\n  session: Session,\n  type: CoordinatorMessageType,\n  options: AwaitPushOptions = {},\n): Promise<Envelope> {\n  const state = getSessionState(session);\n  const runtime = ensureProtocolRuntime(state);\n  const timeoutMs = options.timeoutMs === undefined ? 30_000 : options.timeoutMs;\n\n  return new Promise((resolve, reject) => {\n    const timer =\n      timeoutMs === null\n        ? null\n        : setTimeout(() => {\n            removePushWaiter(runtime, type, waiter);\n            reject(new CommandError(\"REJECTED_STALE_JOB\", `timed out waiting for ${type} push`));\n          }, timeoutMs);\n    const waiter: PushWaiter = { swapId: options.swapId, resolve, reject, timer };\n    const waiters = runtime.pushWaiters.get(type) ?? [];\n    waiters.push(waiter);\n    runtime.pushWaiters.set(type, waiters);\n  });\n}\n\nexport function onEnvelope(session: Session, handler: ProtocolEnvelopeHandler): Unsubscribe {\n  const runtime = ensureProtocolRuntime(getSessionState(session));\n  runtime.envelopeHandlers.add(handler);\n  return () => runtime.envelopeHandlers.delete(handler);\n}\n\nexport function closeProtocolRuntime(session: Session): void {\n  const state = getSessionState(session);\n  const runtime = runtimes.get(state);\n  if (!runtime) return;\n  const error = new TransportError(\"CONNECTION_LOST\", \"coordinator protocol runtime closed\");\n  rejectAll(runtime, error);\n  runtime.unsubscribeChannel?.();\n  runtime.unsubscribeTransport?.();\n  runtimes.delete(state);\n}\n\nfunction ensureProtocolRuntime(state: SessionState): ProtocolRuntime {\n  const existing = runtimes.get(state);\n  if (existing) return existing;\n\n  const runtime: ProtocolRuntime = {\n    reqCounter: 0,\n    pending: new Map(),\n    pushWaiters: new Map(),\n    envelopeHandlers: new Set(),\n    unsubscribeChannel: null,\n    unsubscribeTransport: null,\n  };\n\n  if (state.channel === null) {\n    throw new TransportError(\"CONNECTION_LOST\", \"coordinator protocol requires a live channel\");\n  }\n  runtime.unsubscribeChannel = state.channel.onMessage((frame) => handleFrame(runtime, frame));\n  runtime.unsubscribeTransport = state.transport.onStateChange((transportState) => {\n    if (transportState === \"closing\" || transportState === \"closed\") {\n      rejectAll(runtime, new TransportError(\"CONNECTION_LOST\", \"coordinator transport closed\"));\n    }\n  });\n\n  runtimes.set(state, runtime);\n  return runtime;\n}\n\nfunction handleFrame(runtime: ProtocolRuntime, frame: Uint8Array): void {\n  void handleFrameAsync(runtime, frame);\n}\n\nasync function handleFrameAsync(runtime: ProtocolRuntime, frame: Uint8Array): Promise<void> {\n  const protocol = await loadProtocol();\n  const decoded = protocol.decode(frame);\n  if (!decoded.ok) {\n    rejectAll(runtime, decoded.error);\n    return;\n  }\n\n  const envelope = decoded.value;\n  if (envelope.kind === protocol.EnvelopeKind.RESPONSE) {\n    const pending = runtime.pending.get(envelope.req_id);\n    if (pending && !pendingRequestMatchesSwapId(pending, envelope.swap_id)) {\n      rejectPending(\n        runtime,\n        envelope.req_id,\n        requestSwapIdMismatchError(envelope.req_id, pending.expectedSwapId, envelope.swap_id),\n      );\n      return;\n    }\n  }\n\n  const errorPayload =\n    envelope.kind === protocol.EnvelopeKind.ERROR ? protocol.asErrorPayload(envelope) : null;\n  if (errorPayload?.failed_req_id !== undefined) {\n    const pending = runtime.pending.get(errorPayload.failed_req_id);\n    if (pending && !pendingRequestMatchesSwapId(pending, envelope.swap_id, false)) {\n      rejectPending(\n        runtime,\n        errorPayload.failed_req_id,\n        requestSwapIdMismatchError(\n          errorPayload.failed_req_id,\n          pending.expectedSwapId,\n          envelope.swap_id,\n        ),\n      );\n      return;\n    }\n  }\n\n  for (const handler of runtime.envelopeHandlers) handler(envelope);\n\n  if (envelope.kind === protocol.EnvelopeKind.ERROR) {\n    const payload = errorPayload!;\n    const error = commandErrorFromCoordinatorError(payload);\n    if (payload.failed_req_id === undefined || payload.failed_req_id === OUT_OF_BAND_REQUEST_ID) {\n      if (envelope.swap_id !== null) {\n        rejectMatchingOutOfBandErrors(runtime, envelope.swap_id, error);\n      }\n      return;\n    }\n    const pending = runtime.pending.get(payload.failed_req_id);\n    if (!pending) return;\n    if (!pendingRequestMatchesSwapId(pending, envelope.swap_id, false)) {\n      rejectPending(\n        runtime,\n        payload.failed_req_id,\n        requestSwapIdMismatchError(payload.failed_req_id, pending.expectedSwapId, envelope.swap_id),\n      );\n      return;\n    }\n    rejectPending(runtime, payload.failed_req_id, error);\n    return;\n  }\n\n  if (envelope.kind === protocol.EnvelopeKind.PUSH) {\n    resolvePushWaiter(runtime, envelope);\n    return;\n  }\n\n  if (envelope.kind !== protocol.EnvelopeKind.RESPONSE) return;\n  const pending = runtime.pending.get(envelope.req_id);\n  if (!pending) return;\n  if (!pendingRequestMatchesSwapId(pending, envelope.swap_id)) {\n    rejectPending(\n      runtime,\n      envelope.req_id,\n      requestSwapIdMismatchError(envelope.req_id, pending.expectedSwapId, envelope.swap_id),\n    );\n    return;\n  }\n  runtime.pending.delete(envelope.req_id);\n  cleanupPendingRequest(pending);\n  pending.resolve(envelope);\n}\n\nfunction pendingRequestMatchesSwapId(\n  pending: PendingRequest,\n  responseSwapId: string | null,\n  enforceNonNullResponseSwapId = true,\n): boolean {\n  if (\n    enforceNonNullResponseSwapId &&\n    pending.requireNonNullResponseSwapId &&\n    responseSwapId === null\n  ) {\n    return false;\n  }\n  return pending.expectedSwapId === null || pending.expectedSwapId === responseSwapId;\n}\n\nfunction requestSwapIdMismatchError(\n  reqId: number,\n  expectedSwapId: string | null,\n  receivedSwapId: string | null,\n): CommandError {\n  return new CommandError(\n    \"REJECTED_STATE\",\n    `coordinator response swap_id mismatch for req_id=${reqId}: expected ${expectedSwapId ?? \"null\"}, received ${receivedSwapId ?? \"null\"}`,\n    { failedReqId: reqId },\n  );\n}\n\nfunction resolvePushWaiter(runtime: ProtocolRuntime, envelope: Envelope): void {\n  const waiters = runtime.pushWaiters.get(envelope.type);\n  const waiterIndex = waiters?.findIndex(\n    (candidate) => candidate.swapId === undefined || candidate.swapId === envelope.swap_id,\n  );\n  const waiter =\n    waiters && waiterIndex !== undefined && waiterIndex >= 0\n      ? waiters.splice(waiterIndex, 1)[0]\n      : undefined;\n  if (!waiter || !waiters) return;\n  if (waiters.length === 0) {\n    runtime.pushWaiters.delete(envelope.type);\n  }\n  if (waiter.timer) clearTimeout(waiter.timer);\n  waiter.resolve(envelope);\n}\n\nfunction rejectPending(runtime: ProtocolRuntime, reqId: number, error: Error): void {\n  const pending = runtime.pending.get(reqId);\n  if (!pending) return;\n  runtime.pending.delete(reqId);\n  cleanupPendingRequest(pending);\n  pending.reject(error);\n}\n\nfunction cleanupPendingRequest(pending: PendingRequest): void {\n  if (pending.timer) clearTimeout(pending.timer);\n  if (pending.signal !== undefined && pending.abortHandler !== undefined) {\n    pending.signal.removeEventListener(\"abort\", pending.abortHandler);\n  }\n}\n\nfunction throwIfRequestAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted === true) throw createRequestAbortError();\n}\n\nfunction createRequestAbortError(): DOMException {\n  return new DOMException(\"coordinator request aborted\", \"AbortError\");\n}\n\nfunction rejectMatchingOutOfBandErrors(\n  runtime: ProtocolRuntime,\n  swapId: string,\n  error: Error,\n): void {\n  for (const [reqId, pending] of runtime.pending) {\n    if (!pending.rejectMatchingOutOfBandErrors || pending.swapId !== swapId) continue;\n    rejectPending(runtime, reqId, error);\n  }\n}\n\nfunction commandErrorFromCoordinatorError(payload: {\n  readonly code: string;\n  readonly failed_req_id?: number;\n  readonly message: string;\n}): CommandError {\n  const coordinatorCode = toCoordinatorWireErrorCode(payload.code);\n  const message =\n    coordinatorCode === COORDINATOR_CAPACITY_FULL_ERROR_CODE\n      ? COORDINATOR_CAPACITY_FULL_USER_MESSAGE\n      : payload.message;\n  return new CommandError(commandCodeFromCoordinatorCode(coordinatorCode), message, {\n    coordinatorCode,\n    coordinatorMessage: payload.message,\n    ...(payload.failed_req_id !== undefined ? { failedReqId: payload.failed_req_id } : {}),\n  });\n}\n\nfunction commandCodeFromCoordinatorCode(code: CoordinatorWireErrorCode): CommandErrorCode {\n  switch (code) {\n    case \"ERR_UNEXPECTED_TYPE\":\n    case \"ERR_UNKNOWN_SWAP\":\n    case \"ERR_SWAP_NOT_REFUNDABLE\":\n      return \"REJECTED_STATE\";\n    case \"ERR_INITIALIZATION_BUSY\":\n    case \"ERR_PRESEAL_ADMISSION_BUSY\":\n      return \"RETRYABLE_BUSY\";\n    case COORDINATOR_CAPACITY_FULL_ERROR_CODE:\n      return \"REJECTED_RESOURCE_CAP\";\n    case \"ERR_INTERNAL\":\n    case \"ERR_SETTLEMENT_FAILED\":\n      return \"REJECTED_STALE_JOB\";\n    case \"ERR_INVALID_PAYLOAD\":\n    case \"ERR_POLICY_VIOLATION\":\n    case \"ERR_INVALID_RECOVERY_CODE\":\n    case \"ERR_DKG_FAILURE\":\n    case \"ERR_INVALID_DEPOSIT\":\n      return \"REJECTED_GUARD\";\n  }\n}\n\nfunction toCoordinatorWireErrorCode(code: string): CoordinatorWireErrorCode {\n  switch (code) {\n    case \"ERR_INVALID_PAYLOAD\":\n    case \"ERR_UNEXPECTED_TYPE\":\n    case \"ERR_UNKNOWN_SWAP\":\n    case \"ERR_POLICY_VIOLATION\":\n    case \"ERR_INVALID_RECOVERY_CODE\":\n    case \"ERR_SWAP_NOT_REFUNDABLE\":\n    case \"ERR_DKG_FAILURE\":\n    case \"ERR_INTERNAL\":\n    case \"ERR_INITIALIZATION_BUSY\":\n    case \"ERR_PRESEAL_ADMISSION_BUSY\":\n    case COORDINATOR_CAPACITY_FULL_ERROR_CODE:\n    case \"ERR_INVALID_DEPOSIT\":\n    case \"ERR_SETTLEMENT_FAILED\":\n      return code;\n    default:\n      return \"ERR_INTERNAL\";\n  }\n}\n\nfunction removePushWaiter(\n  runtime: ProtocolRuntime,\n  type: CoordinatorMessageType,\n  waiter: PushWaiter,\n): void {\n  const waiters = runtime.pushWaiters.get(type);\n  if (!waiters) return;\n  const index = waiters.indexOf(waiter);\n  if (index >= 0) waiters.splice(index, 1);\n  if (waiters.length === 0) runtime.pushWaiters.delete(type);\n}\n\nfunction rejectAll(runtime: ProtocolRuntime, error: Error): void {\n  for (const [reqId, pending] of runtime.pending.entries()) {\n    runtime.pending.delete(reqId);\n    cleanupPendingRequest(pending);\n    pending.reject(error);\n  }\n  for (const [type, waiters] of runtime.pushWaiters.entries()) {\n    runtime.pushWaiters.delete(type);\n    for (const waiter of waiters) {\n      if (waiter.timer) clearTimeout(waiter.timer);\n      waiter.reject(error);\n    }\n  }\n}\n"]}

package/dist/{chunk-HJFMDMPY.js → chunk-6AKBRYKO.js}

@@ -1,4 +1,4 @@
-import { TransportError } from './chunk-QRN46R3F.js';
+import { TransportError } from './chunk-RWKG7N7I.js';
 
 // src/session/state.ts
 var registry = /* @__PURE__ */ new WeakMap();
@@ -46,5 +46,5 @@ function failSessionClosed(state, cause, options = {}) {
 }
 
 export { closeSessionState, createSessionHandle, failSessionClosed, getSessionState };
-//# sourceMappingURL=chunk-HJFMDMPY.js.map
-//# sourceMappingURL=chunk-HJFMDMPY.js.map
+//# sourceMappingURL=chunk-6AKBRYKO.js.map
+//# sourceMappingURL=chunk-6AKBRYKO.js.map

package/dist/{chunk-HJFMDMPY.js.map → chunk-6AKBRYKO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/session/state.ts"],"names":[],"mappings":";;;AAoDA,IAAM,QAAA,uBAAe,OAAA,EAA+B;AAG7C,SAAS,oBAAoB,KAAA,EAA8B;AAChE,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAI,QAAA,GAAW;AACb,MAAA,OAAO,KAAA,CAAM,QAAA;AAAA,IACf;AAAA,GACF;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC1B,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,gBAAgB,OAAA,EAAgC;AAC9D,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,kBAAkB,KAAA,EAA2B;AAC3D,EAAA,iBAAA,CAAkB,KAAA,EAAO,IAAI,cAAA,CAAe,iBAAA,EAAmB,gBAAgB,CAAA,EAAG;AAAA,IAChF,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACH;AAEO,SAAS,iBAAA,CACd,KAAA,EACA,KAAA,EACA,OAAA,GAAwD,EAAC,EACnD;AACN,EAAA,MAAM,qBAAA,GAAwB,QAAQ,qBAAA,IAAyB,IAAA;AAC/D,EAAA,MAAM,YAAA,GACJ,0BACC,KAAA,CAAM,QAAA,IAAY,MAAM,WAAA,KAAgB,IAAA,IAAQ,MAAM,OAAA,KAAY,IAAA,CAAA;AAErE,EAAA,IAAI,KAAA,CAAM,kBAAkB,IAAA,EAAM;AAChC,IAAA,YAAA,CAAa,MAAM,aAAa,CAAA;AAChC,IAAA,KAAA,CAAM,aAAA,GAAgB,IAAA;AAAA,EACxB;AACA,EAAA,KAAA,CAAM,eAAA,GAAkB,IAAA;AACxB,EAAA,KAAA,CAAM,cAAA,GAAiB,KAAA;AAEvB,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA;AACtB,EAAA,KAAA,CAAM,QAAA,GAAW,KAAA;AACjB,EAAA,KAAA,CAAM,WAAA,GAAc,IAAA;AACpB,EAAA,KAAA,CAAM,OAAA,GAAU,IAAA;AAChB,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,EAAA,KAAA,CAAM,qBAAA,GAAwB,IAAA;AAE9B,EAAA,OAAA,EAAS,KAAA,EAAM;AACf,EAAA,KAAA,CAAM,UAAU,KAAA,EAAM;AAEtB,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAA,CAAM,uBAAA,EAAyB,OAAA,CAAQ,KAAK,CAAA;AAAA,EACpE;AACF","file":"chunk-HJFMDMPY.js","sourcesContent":["/**\n * Internal session state and the opaque-handle registry.\n *\n * The public {@link Session} is opaque: consumers only read `session.attested`.\n * The real state (transport, endpoint pool, attestation result) is held here\n * and reached through {@link getSessionState}, keyed off the handle in a\n * `WeakMap` so it is never reachable from the public surface.\n */\n\nimport type { Session } from \"../core/session.js\";\nimport type { Transport } from \"../transport/types.js\";\nimport type { AttestationResult } from \"../transport/handshake.js\";\nimport type { SecureChannel } from \"./secureChannel.js\";\nimport type { CoordinatorPoolConfig } from \"../schemas/types.generated.js\";\nimport { TransportError } from \"../core/errors.js\";\nimport type { ClientPersistenceState } from \"../storage/clientPersistence.js\";\n\nexport interface SessionState {\n  /** Flipped to `true` once attestation passes. */\n  attested: boolean;\n  /** The byte channel this session runs over. */\n  readonly transport: Transport;\n  /** The endpoint pool the session was created with. */\n  readonly pool: CoordinatorPoolConfig;\n  /** The last verified attestation result, or `null` before first attestation. */\n  attestation: AttestationResult | null;\n  /**\n   * The live attested Noise channel, or `null` before/after attestation. All\n   * application I/O Noise-encrypts through this.\n   */\n  channel: SecureChannel | null;\n  /**\n   * The per-connection 32-byte CSPRNG nonce bound into the attestation request.\n   * Retained for re-attestation over the same channel.\n   */\n  nonce: Uint8Array | null;\n  /** The coordinator's pinned Noise static public key, or `null` if unattested. */\n  remoteStaticPublicKey: Uint8Array | null;\n  /** Pending re-attestation timer, cleared on close. */\n  reattestTimer: ReturnType<typeof setTimeout> | null;\n  /** In-flight re-attestation shared by explicit and periodic checks. */\n  reattestPromise: Promise<AttestationResult> | null;\n  /** Fatal secure-channel cause preserved across transport close notifications. */\n  lastFatalError: Error | null;\n  /** Handlers invoked when an out-of-band re-attestation fails. */\n  readonly policyViolationHandlers: Set<(error: Error) => void>;\n  /** Resolved opt-in client-persistence policy, kept behind the opaque handle. */\n  readonly clientPersistence: ClientPersistenceState;\n  /** Tear down the session: clear the re-attest timer and close the channel. */\n  close(): void;\n}\n\nconst registry = new WeakMap<Session, SessionState>();\n\n/** Build an opaque {@link Session} handle backed by `state`. */\nexport function createSessionHandle(state: SessionState): Session {\n  const handle = {\n    get attested() {\n      return state.attested;\n    },\n  } as unknown as Session;\n  registry.set(handle, state);\n  return handle;\n}\n\n/**\n * Resolve the internal state for a session.\n *\n * @throws Error if the handle was not produced by `createSession`.\n */\nexport function getSessionState(session: Session): SessionState {\n  const state = registry.get(session);\n  if (!state) {\n    throw new Error(\"invalid Session: this handle was not created by createSession\");\n  }\n  return state;\n}\n\nexport function closeSessionState(state: SessionState): void {\n  failSessionClosed(state, new TransportError(\"CONNECTION_LOST\", \"session closed\"), {\n    notifyPolicyViolation: false,\n  });\n}\n\nexport function failSessionClosed(\n  state: SessionState,\n  cause: Error,\n  options: { readonly notifyPolicyViolation?: boolean } = {},\n): void {\n  const notifyPolicyViolation = options.notifyPolicyViolation ?? true;\n  const shouldNotify =\n    notifyPolicyViolation &&\n    (state.attested || state.attestation !== null || state.channel !== null);\n\n  if (state.reattestTimer !== null) {\n    clearTimeout(state.reattestTimer);\n    state.reattestTimer = null;\n  }\n  state.reattestPromise = null;\n  state.lastFatalError = cause;\n\n  const channel = state.channel;\n  state.attested = false;\n  state.attestation = null;\n  state.channel = null;\n  state.nonce = null;\n  state.remoteStaticPublicKey = null;\n\n  channel?.close();\n  state.transport.close();\n\n  if (shouldNotify) {\n    for (const handler of state.policyViolationHandlers) handler(cause);\n  }\n}\n"]}
+{"version":3,"sources":["../src/session/state.ts"],"names":[],"mappings":";;;AAoDA,IAAM,QAAA,uBAAe,OAAA,EAA+B;AAG7C,SAAS,oBAAoB,KAAA,EAA8B;AAChE,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,IAAI,QAAA,GAAW;AACb,MAAA,OAAO,KAAA,CAAM,QAAA;AAAA,IACf;AAAA,GACF;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,KAAK,CAAA;AAC1B,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,gBAAgB,OAAA,EAAgC;AAC9D,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA;AAClC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,kBAAkB,KAAA,EAA2B;AAC3D,EAAA,iBAAA,CAAkB,KAAA,EAAO,IAAI,cAAA,CAAe,iBAAA,EAAmB,gBAAgB,CAAA,EAAG;AAAA,IAChF,qBAAA,EAAuB;AAAA,GACxB,CAAA;AACH;AAEO,SAAS,iBAAA,CACd,KAAA,EACA,KAAA,EACA,OAAA,GAAwD,EAAC,EACnD;AACN,EAAA,MAAM,qBAAA,GAAwB,QAAQ,qBAAA,IAAyB,IAAA;AAC/D,EAAA,MAAM,YAAA,GACJ,0BACC,KAAA,CAAM,QAAA,IAAY,MAAM,WAAA,KAAgB,IAAA,IAAQ,MAAM,OAAA,KAAY,IAAA,CAAA;AAErE,EAAA,IAAI,KAAA,CAAM,kBAAkB,IAAA,EAAM;AAChC,IAAA,YAAA,CAAa,MAAM,aAAa,CAAA;AAChC,IAAA,KAAA,CAAM,aAAA,GAAgB,IAAA;AAAA,EACxB;AACA,EAAA,KAAA,CAAM,eAAA,GAAkB,IAAA;AACxB,EAAA,KAAA,CAAM,cAAA,GAAiB,KAAA;AAEvB,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA;AACtB,EAAA,KAAA,CAAM,QAAA,GAAW,KAAA;AACjB,EAAA,KAAA,CAAM,WAAA,GAAc,IAAA;AACpB,EAAA,KAAA,CAAM,OAAA,GAAU,IAAA;AAChB,EAAA,KAAA,CAAM,KAAA,GAAQ,IAAA;AACd,EAAA,KAAA,CAAM,qBAAA,GAAwB,IAAA;AAE9B,EAAA,OAAA,EAAS,KAAA,EAAM;AACf,EAAA,KAAA,CAAM,UAAU,KAAA,EAAM;AAEtB,EAAA,IAAI,YAAA,EAAc;AAChB,IAAA,KAAA,MAAW,OAAA,IAAW,KAAA,CAAM,uBAAA,EAAyB,OAAA,CAAQ,KAAK,CAAA;AAAA,EACpE;AACF","file":"chunk-6AKBRYKO.js","sourcesContent":["/**\n * Internal session state and the opaque-handle registry.\n *\n * The public {@link Session} is opaque: consumers only read `session.attested`.\n * The real state (transport, endpoint pool, attestation result) is held here\n * and reached through {@link getSessionState}, keyed off the handle in a\n * `WeakMap` so it is never reachable from the public surface.\n */\n\nimport type { Session } from \"../core/session.js\";\nimport type { Transport } from \"../transport/types.js\";\nimport type { AttestationResult } from \"../transport/handshake.js\";\nimport type { SecureChannel } from \"./secureChannel.js\";\nimport type { CoordinatorPoolConfig } from \"../schemas/types.generated.js\";\nimport { TransportError } from \"../core/errors.js\";\nimport type { ClientPersistenceState } from \"../storage/clientPersistence.js\";\n\nexport interface SessionState {\n  /** Flipped to `true` once attestation passes. */\n  attested: boolean;\n  /** The byte channel this session runs over. */\n  readonly transport: Transport;\n  /** The endpoint pool the session was created with. */\n  readonly pool: CoordinatorPoolConfig;\n  /** The last verified attestation result, or `null` before first attestation. */\n  attestation: AttestationResult | null;\n  /**\n   * The live attested Noise channel, or `null` before/after attestation. All\n   * application I/O Noise-encrypts through this.\n   */\n  channel: SecureChannel | null;\n  /**\n   * The per-connection 32-byte CSPRNG nonce bound into the attestation request.\n   * Retained for re-attestation over the same channel.\n   */\n  nonce: Uint8Array | null;\n  /** The coordinator's pinned Noise static public key, or `null` if unattested. */\n  remoteStaticPublicKey: Uint8Array | null;\n  /** Pending re-attestation timer, cleared on close. */\n  reattestTimer: ReturnType<typeof setTimeout> | null;\n  /** In-flight re-attestation shared by explicit and periodic checks. */\n  reattestPromise: Promise<AttestationResult> | null;\n  /** Fatal secure-channel cause preserved across transport close notifications. */\n  lastFatalError: Error | null;\n  /** Handlers invoked when an out-of-band re-attestation fails. */\n  readonly policyViolationHandlers: Set<(error: Error) => void>;\n  /** Resolved opt-in client-persistence policy, kept behind the opaque handle. */\n  readonly clientPersistence: ClientPersistenceState;\n  /** Tear down the session: clear the re-attest timer and close the channel. */\n  close(): void;\n}\n\nconst registry = new WeakMap<Session, SessionState>();\n\n/** Build an opaque {@link Session} handle backed by `state`. */\nexport function createSessionHandle(state: SessionState): Session {\n  const handle = {\n    get attested() {\n      return state.attested;\n    },\n  } as unknown as Session;\n  registry.set(handle, state);\n  return handle;\n}\n\n/**\n * Resolve the internal state for a session.\n *\n * @throws Error if the handle was not produced by `createSession`.\n */\nexport function getSessionState(session: Session): SessionState {\n  const state = registry.get(session);\n  if (!state) {\n    throw new Error(\"invalid Session: this handle was not created by createSession\");\n  }\n  return state;\n}\n\nexport function closeSessionState(state: SessionState): void {\n  failSessionClosed(state, new TransportError(\"CONNECTION_LOST\", \"session closed\"), {\n    notifyPolicyViolation: false,\n  });\n}\n\nexport function failSessionClosed(\n  state: SessionState,\n  cause: Error,\n  options: { readonly notifyPolicyViolation?: boolean } = {},\n): void {\n  const notifyPolicyViolation = options.notifyPolicyViolation ?? true;\n  const shouldNotify =\n    notifyPolicyViolation &&\n    (state.attested || state.attestation !== null || state.channel !== null);\n\n  if (state.reattestTimer !== null) {\n    clearTimeout(state.reattestTimer);\n    state.reattestTimer = null;\n  }\n  state.reattestPromise = null;\n  state.lastFatalError = cause;\n\n  const channel = state.channel;\n  state.attested = false;\n  state.attestation = null;\n  state.channel = null;\n  state.nonce = null;\n  state.remoteStaticPublicKey = null;\n\n  channel?.close();\n  state.transport.close();\n\n  if (shouldNotify) {\n    for (const handler of state.policyViolationHandlers) handler(cause);\n  }\n}\n"]}

package/dist/{chunk-DCTYBUY3.js → chunk-AIKC2XQS.js}

@@ -1,4 +1,4 @@
-import { StorageError } from './chunk-QRN46R3F.js';
+import { StorageError } from './chunk-RWKG7N7I.js';
 
 // src/storage/coordination.ts
 var storageBackings = /* @__PURE__ */ new WeakMap();
@@ -254,5 +254,5 @@ function isPromise(value) {
 }
 
 export { browserStorage, extensionStorage, getStorageBacking, inMemoryStorage };
-//# sourceMappingURL=chunk-DCTYBUY3.js.map
-//# sourceMappingURL=chunk-DCTYBUY3.js.map
+//# sourceMappingURL=chunk-AIKC2XQS.js.map
+//# sourceMappingURL=chunk-AIKC2XQS.js.map

package/dist/{chunk-DCTYBUY3.js.map → chunk-AIKC2XQS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/storage/coordination.ts","../src/storage/index.ts"],"names":[],"mappings":";;;AAAA,IAAM,eAAA,uBAAsB,OAAA,EAAwB;AAE7C,SAAS,sBAAA,CAAuB,SAAiB,OAAA,EAAuB;AAC7E,EAAA,eAAA,CAAgB,GAAA,CAAI,SAAS,OAAO,CAAA;AACtC;AAEO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,OAAO,eAAA,CAAgB,GAAA,CAAI,OAAO,CAAA,IAAK,OAAA;AACzC;;;ACKA,IAAM,kBAAA,GAAqB,2BAAA;AAC3B,IAAM,qBAAA,GAAwB,GAAA;AAC9B,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,sBAAA,GAAyB,KAAA;AAC/B,IAAM,uCAAA,GAA0C,kBAAA;AA6DzC,SAAS,eAAA,GAAkC;AAIhD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAqC;AAC5D,EAAA,MAAM,MAAA,GAAS,CAAC,SAAA,KAAsB;AACpC,IAAA,IAAI,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,KAAA,uBAAY,GAAA,EAAwB;AACpC,MAAA,UAAA,CAAW,GAAA,CAAI,WAAW,KAAK,CAAA;AAAA,IACjC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,OAAO,WAAW,GAAA,CAAI,SAAS,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,IAAK,IAAA;AAAA,IAChD,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,OAAO,CAAC,GAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,EAAK,IAAK,EAAG,CAAA;AAAA,IACtD,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,EAAG,MAAA,CAAO,GAAG,CAAA;AAAA,IACvC;AAAA,GACF;AACF;AASO,SAAS,cAAA,CAAe,OAAA,GAAiC,EAAC,EAAmB;AAClF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,qBAAA,EAAsB;AACzD,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,YAAA,CAAa,yBAAyB,6BAA6B,CAAA;AAC3F,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,QAAQ,UAAA,CAAW,SAAA,EAAW,GAAG,CAAA,EAAG,gBAAA,CAAiB,KAAK,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,QAAQ,OAAA,CAAQ,OAAA,CAAQ,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,QAAA,OAAO,KAAA,KAAU,IAAA,GAAO,IAAA,GAAO,gBAAA,CAAiB,KAAK,CAAA;AAAA,MACvD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,QAAA,MAAM,OAAiB,EAAC;AACxB,QAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtD,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACnC,UAAA,IAAI,SAAA,EAAW,UAAA,CAAW,MAAM,CAAA,EAAG;AACjC,YAAA,IAAA,CAAK,KAAK,oBAAA,CAAqB,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,UAChE;AAAA,QACF;AACA,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,UAAA,CAAW,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AAAA,MAC/C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF;AAAA,GACF;AACA,EAAA,sBAAA,CAAuB,SAAS,OAAO,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;AASO,SAAS,gBAAA,CAAiB,OAAA,GAAmC,EAAC,EAAmB;AACtF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,uBAAA,EAAwB;AAC3D,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,uBAAA,EAAyB,wCAAwC,CAAA;AAAA,EAC1F;AACA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,uBAAA,EAAwB;AAC3D,EAAA,MAAM,aAAA,GACJ,QAAQ,+BAAA,KAAoC,KAAA,GACxC,QAAQ,OAAA,EAAQ,GAChB,uBAAA,CAAwB,OAAA,EAAS,OAAO,CAAA;AAC9C,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,IAAA,EAAM,WAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,YAAA,CAAa,SAAS,OAAA,EAAS;AAAA,QACnC,CAAC,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,GAAG,iBAAiB,KAAK;AAAA,OACrD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,SAAA,GAAY,UAAA,CAAW,SAAA,EAAW,GAAG,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,SAAS,SAAS,CAAA;AAC7D,MAAA,MAAM,KAAA,GAAQ,OAAO,SAAS,CAAA;AAC9B,MAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,gBAAA,CAAiB,KAAK,CAAA,GAAI,IAAA;AAAA,IAC/D,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,SAAS,IAAI,CAAA;AACxD,MAAA,OAAO,MAAA,CAAO,KAAK,MAAM,CAAA,CACtB,OAAO,CAAC,GAAA,KAAQ,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACtC,GAAA,CAAI,CAAC,GAAA,KAAQ,oBAAA,CAAqB,IAAI,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAChE,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,gBAAgB,OAAA,EAAS,OAAA,EAAS,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AAAA,IACpE;AAAA,GACF;AACA,EAAA,sBAAA,CAAuB,SAAS,OAAO,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,UAAA,CAAW,WAAmB,GAAA,EAAqB;AAC1D,EAAA,OAAO,GAAG,gBAAA,CAAiB,SAAS,CAAC,CAAA,EAAG,oBAAA,CAAqB,GAAG,CAAC,CAAA,CAAA;AACnE;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,OAAO,GAAG,kBAAkB,CAAA,EAAG,qBAAqB,SAAS,CAAC,GAAG,qBAAqB,CAAA,CAAA;AACxF;AAEA,SAAS,qBAAqB,KAAA,EAAuB;AACnD,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAEA,SAAS,qBAAqB,KAAA,EAAuB;AACnD,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,MAAA,EAAQ,SAAS,sBAAA,EAAwB;AACzE,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,GAAG,KAAA,CAAM,MAAM,KAAA,EAAO,KAAA,GAAQ,sBAAsB,CAAC,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,KAAK,MAAM,CAAA,CACf,MAAM,cAAc,CAAA,CACpB,KAAK,eAAe,CAAA,CACpB,MAAM,eAAe,CAAA,CACrB,KAAK,oBAAoB,CAAA,CACzB,MAAM,aAAa,CAAA,CACnB,KAAK,EAAE,CAAA;AACZ;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MACZ,KAAA,CAAM,eAAe,EACrB,IAAA,CAAK,cAAc,CAAA,CACnB,KAAA,CAAM,oBAAoB,CAAA,CAC1B,KAAK,eAAe,CAAA,CACpB,OAAO,IAAA,CAAK,IAAA,CAAK,MAAM,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,EAAG,aAAa,CAAA;AACxD,IAAA,OAAO,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,IAAA,KAAS,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,EACnE,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa,wBAAA,EAA0B,qCAAA,EAAuC;AAAA,MACtF;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAEA,SAAS,qBAAA,GAAiD;AACxD,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,YAAA;AAAA,EACpB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa,uBAAA,EAAyB,6BAAA,EAA+B,EAAE,OAAO,CAAA;AAAA,EAC1F;AACF;AAEA,SAAS,sBAAsB,KAAA,EAA8B;AAC3D,EAAA,IAAI,KAAA,YAAiB,cAAc,OAAO,KAAA;AAC1C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,uBAAA;AAAA,IACA,mBAAA,CAAoB,KAAK,CAAA,IAAK,+BAAA;AAAA,IAC9B,EAAE,KAAA;AAAM,GACV;AACF;AAEA,SAAS,uBAAA,GAA4D;AACnE,EAAA,MAAM,MAAA,GAAS,UAAA;AAIf,EAAA,OAAO,OAAO,MAAA,EAAQ,OAAA,EAAS,KAAA,IAAS,MAAA,CAAO,SAAS,OAAA,EAAS,KAAA;AACnE;AAEA,SAAS,uBAAA,GAA4D;AACnE,EAAA,MAAM,MAAA,GAAS,UAAA;AAIf,EAAA,OAAO,MAAA,CAAO,MAAA,EAAQ,OAAA,IAAW,MAAA,CAAO,OAAA,EAAS,OAAA;AACnD;AAEA,SAAS,YAAA,CACP,OAAA,EACA,OAAA,EACA,IAAA,EACkC;AAClC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,CAAC,KAAA,KAAU;AAChD,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,mBACnC,KAAK,CAAA;AAAA,IACpB,CAAC,CAAA;AACD,IAAA,IAAI,SAAA,CAAmC,YAAY,CAAA,EAAG;AACpD,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,IAC9E;AAAA,EACF,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,OAAA,EACA,OAAA,EACA,KAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,MAAM;AAC5C,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,WAC3C,OAAA,EAAQ;AAAA,IACf,CAAC,CAAA;AACD,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,eAAA,CACP,OAAA,EACA,OAAA,EACA,GAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,MAAM;AAC7C,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,WAC3C,OAAA,EAAQ;AAAA,IACf,CAAC,CAAA;AACD,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,uBAAA,CACP,SACA,OAAA,EACe;AACf,EAAA,MAAM,iBAAiB,OAAA,CAAQ,cAAA;AAC/B,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,OAAA,CAAQ,OAAA,EAAQ;AAC5C,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,eAAe,cAAA,CAAe,IAAA;AAAA,MAClC,OAAA;AAAA,MACA,EAAE,aAAa,uCAAA,EAAwC;AAAA,MACvD,MAAM;AACJ,QAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,QAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,aAC3C,OAAA,EAAQ;AAAA,MACf;AAAA,KACF;AACA,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,mBACP,OAAA,EACsC;AACtC,EAAA,OAAO,SAAS,SAAA,IAAa,IAAA;AAC/B;AAEA,SAAS,wBAAwB,KAAA,EAA8B;AAC7D,EAAA,IAAI,KAAA,YAAiB,cAAc,OAAO,KAAA;AAC1C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,uBAAA;AAAA,IACA,mBAAA,CAAoB,KAAK,CAAA,IAAK,oCAAA;AAAA,IAC9B,EAAE,OAAO,KAAA;AAAM,GACjB;AACF;AAEA,SAAS,oBAAoB,KAAA,EAAoC;AAC/D,EAAA,IAAI,KAAA,YAAiB,KAAA,EAAO,OAAO,KAAA,CAAM,OAAA;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,IAAQ,aAAa,KAAA,EAAO;AACrE,IAAA,MAAM,UAAW,KAAA,CAAgC,OAAA;AACjD,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,OAAO,OAAA;AAAA,EAC1C;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,UAAa,KAAA,EAAqC;AACzD,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACV,MAAA,IAAU,KAAA,IACV,OAAQ,KAAA,CAA4B,IAAA,KAAS,UAAA;AAEjD","file":"chunk-DCTYBUY3.js","sourcesContent":["const storageBackings = new WeakMap<object, object>();\n\nexport function registerStorageBacking(adapter: object, backing: object): void {\n  storageBackings.set(adapter, backing);\n}\n\nexport function getStorageBacking(adapter: object): object {\n  return storageBackings.get(adapter) ?? adapter;\n}\n","/**\n * `@invisible-labs/sdk/storage` - storage adapters (spec section 7).\n *\n * The SDK persists recoverable secrets (Recovery Code, LP Position Code, LP\n * Refill Key, withdrawal secret) only through a {@link StorageAdapter}. The\n * `memory`, `browser`, and `extension` adapters are real. Browser and\n * extension adapters persist the bytes provided by the caller; callers that need\n * encrypted-at-rest storage can wrap/encrypt bytes before calling `put`.\n */\n\nimport { StorageError } from \"../core/errors.js\";\nimport { registerStorageBacking } from \"./coordination.js\";\n\nconst STORAGE_KEY_PREFIX = \"invisible:sdk:storage:v1:\";\nconst STORAGE_KEY_SEPARATOR = \":\";\nconst BASE64URL_PAD = \"=\";\nconst BASE64URL_PLUS = \"+\";\nconst BASE64URL_SLASH = \"/\";\nconst BASE64URL_MINUS = \"-\";\nconst BASE64URL_UNDERSCORE = \"_\";\nconst BYTE_STRING_CHUNK_SIZE = 0x8000;\nconst EXTENSION_TRUSTED_CONTEXTS_ACCESS_LEVEL = \"TRUSTED_CONTEXTS\";\n\n/**\n * A namespaced key/value store for the SDK's recoverable secrets. Values are\n * raw bytes. Callers may store plaintext bytes, pre-wrapped bytes, or encrypted\n * bytes depending on their host product's storage model.\n */\nexport interface StorageAdapter {\n  /** Which backing the adapter uses. */\n  readonly kind: \"browser\" | \"extension\" | \"server-hkdf\" | \"server-custom\" | \"memory\";\n  put(namespace: string, key: string, value: Uint8Array): Promise<void>;\n  get(namespace: string, key: string): Promise<Uint8Array | null>;\n  list(namespace: string): Promise<string[]>;\n  remove(namespace: string, key: string): Promise<void>;\n  /** `server-hkdf` only: derive a secret from a stable domain context. */\n  derive?(namespace: string, context: string): Promise<Uint8Array>;\n}\n\nexport interface BrowserStorageOptions {\n  /** Override for tests or custom host environments. Defaults to `globalThis.localStorage`. */\n  readonly storage?: StorageLike;\n}\n\nexport interface ExtensionStorageOptions {\n  /** Override for tests or custom extension hosts. Defaults to chrome/browser storage local. */\n  readonly storage?: ExtensionStorageArea;\n  /** Override for tests or custom extension hosts. Defaults to chrome/browser runtime. */\n  readonly runtime?: ExtensionRuntimeLike;\n  /**\n   * Chrome exposes storage.local to content scripts by default. Keep the default\n   * trusted-context restriction when the host API supports it.\n   */\n  readonly restrictAccessToTrustedContexts?: boolean;\n}\n\ninterface StorageLike {\n  readonly length: number;\n  key(index: number): string | null;\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\ninterface ExtensionStorageArea {\n  get(\n    keys?: string | string[] | Record<string, unknown> | null,\n    callback?: (items: Record<string, unknown>) => void,\n  ): Promise<Record<string, unknown>> | void;\n  set(items: Record<string, string>, callback?: () => void): Promise<void> | void;\n  remove(keys: string | string[], callback?: () => void): Promise<void> | void;\n  setAccessLevel?(details: { accessLevel: string }, callback?: () => void): Promise<void> | void;\n}\n\ninterface ExtensionRuntimeLike {\n  readonly lastError?: { readonly message?: string } | null;\n}\n\n/**\n * In-memory adapter. Fully functional, unencrypted, non-persistent - intended\n * for tests and ephemeral flows, never for real secrets at rest.\n */\nexport function inMemoryStorage(): StorageAdapter {\n  // Each namespace is a separate inner map rather than a flattened composite\n  // key, so a namespace or key containing any character (including a separator)\n  // can never collide across namespaces.\n  const namespaces = new Map<string, Map<string, Uint8Array>>();\n  const bucket = (namespace: string) => {\n    let inner = namespaces.get(namespace);\n    if (!inner) {\n      inner = new Map<string, Uint8Array>();\n      namespaces.set(namespace, inner);\n    }\n    return inner;\n  };\n  return {\n    kind: \"memory\",\n    async put(namespace, key, value) {\n      bucket(namespace).set(key, value);\n    },\n    async get(namespace, key) {\n      return namespaces.get(namespace)?.get(key) ?? null;\n    },\n    async list(namespace) {\n      return [...(namespaces.get(namespace)?.keys() ?? [])];\n    },\n    async remove(namespace, key) {\n      namespaces.get(namespace)?.delete(key);\n    },\n  };\n}\n\n/**\n * Browser `localStorage` adapter. Values are stored as base64url-encoded bytes.\n * Encrypt or wrap the bytes before `put` if your product requires encrypted\n * local persistence.\n *\n * @throws StorageError `STORAGE_NOT_AVAILABLE` if `localStorage` is unavailable.\n */\nexport function browserStorage(options: BrowserStorageOptions = {}): StorageAdapter {\n  const storage = options.storage ?? defaultBrowserStorage();\n  if (!storage) throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"localStorage is unavailable\");\n  const adapter: StorageAdapter = {\n    kind: \"browser\",\n    async put(namespace, key, value) {\n      try {\n        storage.setItem(storageKey(namespace, key), bytesToBase64Url(value));\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async get(namespace, key) {\n      try {\n        const value = storage.getItem(storageKey(namespace, key));\n        return value === null ? null : base64UrlToBytes(value);\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async list(namespace) {\n      try {\n        const prefix = storageKeyPrefix(namespace);\n        const keys: string[] = [];\n        for (let index = 0; index < storage.length; index += 1) {\n          const storedKey = storage.key(index);\n          if (storedKey?.startsWith(prefix)) {\n            keys.push(decodeStorageSegment(storedKey.slice(prefix.length)));\n          }\n        }\n        return keys;\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async remove(namespace, key) {\n      try {\n        storage.removeItem(storageKey(namespace, key));\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n  };\n  registerStorageBacking(adapter, storage);\n  return adapter;\n}\n\n/**\n * Browser-extension (`chrome.storage.local` / `browser.storage.local`) adapter.\n * Values are stored as base64url-encoded bytes. Encrypt or wrap the bytes before\n * `put` if your product requires encrypted local persistence.\n *\n * @throws StorageError `STORAGE_NOT_AVAILABLE` if extension storage is unavailable.\n */\nexport function extensionStorage(options: ExtensionStorageOptions = {}): StorageAdapter {\n  const storage = options.storage ?? defaultExtensionStorage();\n  if (!storage) {\n    throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"extension local storage is unavailable\");\n  }\n  const runtime = options.runtime ?? defaultExtensionRuntime();\n  const trustedAccess =\n    options.restrictAccessToTrustedContexts === false\n      ? Promise.resolve()\n      : extensionSetAccessLevel(storage, runtime);\n  const adapter: StorageAdapter = {\n    kind: \"extension\",\n    async put(namespace, key, value) {\n      await trustedAccess;\n      await extensionSet(storage, runtime, {\n        [storageKey(namespace, key)]: bytesToBase64Url(value),\n      });\n    },\n    async get(namespace, key) {\n      await trustedAccess;\n      const storedKey = storageKey(namespace, key);\n      const values = await extensionGet(storage, runtime, storedKey);\n      const value = values[storedKey];\n      return typeof value === \"string\" ? base64UrlToBytes(value) : null;\n    },\n    async list(namespace) {\n      await trustedAccess;\n      const prefix = storageKeyPrefix(namespace);\n      const values = await extensionGet(storage, runtime, null);\n      return Object.keys(values)\n        .filter((key) => key.startsWith(prefix))\n        .map((key) => decodeStorageSegment(key.slice(prefix.length)));\n    },\n    async remove(namespace, key) {\n      await trustedAccess;\n      await extensionRemove(storage, runtime, storageKey(namespace, key));\n    },\n  };\n  registerStorageBacking(adapter, storage);\n  return adapter;\n}\n\nfunction storageKey(namespace: string, key: string): string {\n  return `${storageKeyPrefix(namespace)}${encodeStorageSegment(key)}`;\n}\n\nfunction storageKeyPrefix(namespace: string): string {\n  return `${STORAGE_KEY_PREFIX}${encodeStorageSegment(namespace)}${STORAGE_KEY_SEPARATOR}`;\n}\n\nfunction encodeStorageSegment(value: string): string {\n  return encodeURIComponent(value);\n}\n\nfunction decodeStorageSegment(value: string): string {\n  return decodeURIComponent(value);\n}\n\nfunction bytesToBase64Url(value: Uint8Array): string {\n  let binary = \"\";\n  for (let index = 0; index < value.length; index += BYTE_STRING_CHUNK_SIZE) {\n    binary += String.fromCharCode(...value.slice(index, index + BYTE_STRING_CHUNK_SIZE));\n  }\n  return btoa(binary)\n    .split(BASE64URL_PLUS)\n    .join(BASE64URL_MINUS)\n    .split(BASE64URL_SLASH)\n    .join(BASE64URL_UNDERSCORE)\n    .split(BASE64URL_PAD)\n    .join(\"\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  try {\n    const base64 = value\n      .split(BASE64URL_MINUS)\n      .join(BASE64URL_PLUS)\n      .split(BASE64URL_UNDERSCORE)\n      .join(BASE64URL_SLASH)\n      .padEnd(Math.ceil(value.length / 4) * 4, BASE64URL_PAD);\n    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));\n  } catch (cause) {\n    throw new StorageError(\"STORAGE_DECRYPT_FAILED\", \"stored value is not valid base64url\", {\n      cause,\n    });\n  }\n}\n\nfunction defaultBrowserStorage(): StorageLike | undefined {\n  try {\n    return globalThis.localStorage;\n  } catch (cause) {\n    throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"localStorage is unavailable\", { cause });\n  }\n}\n\nfunction browserOperationError(cause: unknown): StorageError {\n  if (cause instanceof StorageError) return cause;\n  return new StorageError(\n    \"STORAGE_NOT_AVAILABLE\",\n    storageErrorMessage(cause) ?? \"localStorage operation failed\",\n    { cause },\n  );\n}\n\nfunction defaultExtensionStorage(): ExtensionStorageArea | undefined {\n  const global = globalThis as {\n    chrome?: { storage?: { local?: ExtensionStorageArea } };\n    browser?: { storage?: { local?: ExtensionStorageArea } };\n  };\n  return global.chrome?.storage?.local ?? global.browser?.storage?.local;\n}\n\nfunction defaultExtensionRuntime(): ExtensionRuntimeLike | undefined {\n  const global = globalThis as {\n    chrome?: { runtime?: ExtensionRuntimeLike };\n    browser?: { runtime?: ExtensionRuntimeLike };\n  };\n  return global.chrome?.runtime ?? global.browser?.runtime;\n}\n\nfunction extensionGet(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  keys: string | string[] | Record<string, unknown> | null,\n): Promise<Record<string, unknown>> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.get(keys, (items) => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve(items);\n    });\n    if (isPromise<Record<string, unknown>>(maybePromise)) {\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n    }\n  });\n}\n\nfunction extensionSet(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  items: Record<string, string>,\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.set(items, () => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve();\n    });\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionRemove(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  key: string,\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.remove(key, () => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve();\n    });\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionSetAccessLevel(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n): Promise<void> {\n  const setAccessLevel = storage.setAccessLevel;\n  if (!setAccessLevel) return Promise.resolve();\n  return new Promise((resolve, reject) => {\n    const maybePromise = setAccessLevel.call(\n      storage,\n      { accessLevel: EXTENSION_TRUSTED_CONTEXTS_ACCESS_LEVEL },\n      () => {\n        const error = extensionLastError(runtime);\n        if (error) reject(extensionOperationError(error));\n        else resolve();\n      },\n    );\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionLastError(\n  runtime: ExtensionRuntimeLike | undefined,\n): { readonly message?: string } | null {\n  return runtime?.lastError ?? null;\n}\n\nfunction extensionOperationError(error: unknown): StorageError {\n  if (error instanceof StorageError) return error;\n  return new StorageError(\n    \"STORAGE_NOT_AVAILABLE\",\n    storageErrorMessage(error) ?? \"extension storage operation failed\",\n    { cause: error },\n  );\n}\n\nfunction storageErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"object\" && error !== null && \"message\" in error) {\n    const message = (error as { message?: unknown }).message;\n    if (typeof message === \"string\") return message;\n  }\n  return undefined;\n}\n\nfunction isPromise<T>(value: unknown): value is Promise<T> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"then\" in value &&\n    typeof (value as { then: unknown }).then === \"function\"\n  );\n}\n"]}
+{"version":3,"sources":["../src/storage/coordination.ts","../src/storage/index.ts"],"names":[],"mappings":";;;AAAA,IAAM,eAAA,uBAAsB,OAAA,EAAwB;AAE7C,SAAS,sBAAA,CAAuB,SAAiB,OAAA,EAAuB;AAC7E,EAAA,eAAA,CAAgB,GAAA,CAAI,SAAS,OAAO,CAAA;AACtC;AAEO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,OAAO,eAAA,CAAgB,GAAA,CAAI,OAAO,CAAA,IAAK,OAAA;AACzC;;;ACKA,IAAM,kBAAA,GAAqB,2BAAA;AAC3B,IAAM,qBAAA,GAAwB,GAAA;AAC9B,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,cAAA,GAAiB,GAAA;AACvB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,oBAAA,GAAuB,GAAA;AAC7B,IAAM,sBAAA,GAAyB,KAAA;AAC/B,IAAM,uCAAA,GAA0C,kBAAA;AA6DzC,SAAS,eAAA,GAAkC;AAIhD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAqC;AAC5D,EAAA,MAAM,MAAA,GAAS,CAAC,SAAA,KAAsB;AACpC,IAAA,IAAI,KAAA,GAAQ,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA;AACpC,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,KAAA,uBAAY,GAAA,EAAwB;AACpC,MAAA,UAAA,CAAW,GAAA,CAAI,WAAW,KAAK,CAAA;AAAA,IACjC;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACA,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,QAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,OAAO,WAAW,GAAA,CAAI,SAAS,CAAA,EAAG,GAAA,CAAI,GAAG,CAAA,IAAK,IAAA;AAAA,IAChD,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,OAAO,CAAC,GAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,EAAK,IAAK,EAAG,CAAA;AAAA,IACtD,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,EAAG,MAAA,CAAO,GAAG,CAAA;AAAA,IACvC;AAAA,GACF;AACF;AASO,SAAS,cAAA,CAAe,OAAA,GAAiC,EAAC,EAAmB;AAClF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,qBAAA,EAAsB;AACzD,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,YAAA,CAAa,yBAAyB,6BAA6B,CAAA;AAC3F,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,IAAA,EAAM,SAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,QAAQ,UAAA,CAAW,SAAA,EAAW,GAAG,CAAA,EAAG,gBAAA,CAAiB,KAAK,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,QAAQ,OAAA,CAAQ,OAAA,CAAQ,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AACxD,QAAA,OAAO,KAAA,KAAU,IAAA,GAAO,IAAA,GAAO,gBAAA,CAAiB,KAAK,CAAA;AAAA,MACvD,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,QAAA,MAAM,OAAiB,EAAC;AACxB,QAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtD,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AACnC,UAAA,IAAI,SAAA,EAAW,UAAA,CAAW,MAAM,CAAA,EAAG;AACjC,YAAA,IAAA,CAAK,KAAK,oBAAA,CAAqB,SAAA,CAAU,MAAM,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,UAChE;AAAA,QACF;AACA,QAAA,OAAO,IAAA;AAAA,MACT,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,UAAA,CAAW,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AAAA,MAC/C,SAAS,KAAA,EAAO;AACd,QAAA,MAAM,sBAAsB,KAAK,CAAA;AAAA,MACnC;AAAA,IACF;AAAA,GACF;AACA,EAAA,sBAAA,CAAuB,SAAS,OAAO,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;AASO,SAAS,gBAAA,CAAiB,OAAA,GAAmC,EAAC,EAAmB;AACtF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,uBAAA,EAAwB;AAC3D,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,YAAA,CAAa,uBAAA,EAAyB,wCAAwC,CAAA;AAAA,EAC1F;AACA,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,uBAAA,EAAwB;AAC3D,EAAA,MAAM,aAAA,GACJ,QAAQ,+BAAA,KAAoC,KAAA,GACxC,QAAQ,OAAA,EAAQ,GAChB,uBAAA,CAAwB,OAAA,EAAS,OAAO,CAAA;AAC9C,EAAA,MAAM,OAAA,GAA0B;AAAA,IAC9B,IAAA,EAAM,WAAA;AAAA,IACN,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK,KAAA,EAAO;AAC/B,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,YAAA,CAAa,SAAS,OAAA,EAAS;AAAA,QACnC,CAAC,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,GAAG,iBAAiB,KAAK;AAAA,OACrD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,GAAA,CAAI,SAAA,EAAW,GAAA,EAAK;AACxB,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,SAAA,GAAY,UAAA,CAAW,SAAA,EAAW,GAAG,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,SAAS,SAAS,CAAA;AAC7D,MAAA,MAAM,KAAA,GAAQ,OAAO,SAAS,CAAA;AAC9B,MAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,gBAAA,CAAiB,KAAK,CAAA,GAAI,IAAA;AAAA,IAC/D,CAAA;AAAA,IACA,MAAM,KAAK,SAAA,EAAW;AACpB,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,MAAA,GAAS,iBAAiB,SAAS,CAAA;AACzC,MAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAA,EAAS,SAAS,IAAI,CAAA;AACxD,MAAA,OAAO,MAAA,CAAO,KAAK,MAAM,CAAA,CACtB,OAAO,CAAC,GAAA,KAAQ,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA,CACtC,GAAA,CAAI,CAAC,GAAA,KAAQ,oBAAA,CAAqB,IAAI,KAAA,CAAM,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAChE,CAAA;AAAA,IACA,MAAM,MAAA,CAAO,SAAA,EAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,aAAA;AACN,MAAA,MAAM,gBAAgB,OAAA,EAAS,OAAA,EAAS,UAAA,CAAW,SAAA,EAAW,GAAG,CAAC,CAAA;AAAA,IACpE;AAAA,GACF;AACA,EAAA,sBAAA,CAAuB,SAAS,OAAO,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,UAAA,CAAW,WAAmB,GAAA,EAAqB;AAC1D,EAAA,OAAO,GAAG,gBAAA,CAAiB,SAAS,CAAC,CAAA,EAAG,oBAAA,CAAqB,GAAG,CAAC,CAAA,CAAA;AACnE;AAEA,SAAS,iBAAiB,SAAA,EAA2B;AACnD,EAAA,OAAO,GAAG,kBAAkB,CAAA,EAAG,qBAAqB,SAAS,CAAC,GAAG,qBAAqB,CAAA,CAAA;AACxF;AAEA,SAAS,qBAAqB,KAAA,EAAuB;AACnD,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAEA,SAAS,qBAAqB,KAAA,EAAuB;AACnD,EAAA,OAAO,mBAAmB,KAAK,CAAA;AACjC;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,KAAA,CAAM,MAAA,EAAQ,SAAS,sBAAA,EAAwB;AACzE,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,GAAG,KAAA,CAAM,MAAM,KAAA,EAAO,KAAA,GAAQ,sBAAsB,CAAC,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,KAAK,MAAM,CAAA,CACf,MAAM,cAAc,CAAA,CACpB,KAAK,eAAe,CAAA,CACpB,MAAM,eAAe,CAAA,CACrB,KAAK,oBAAoB,CAAA,CACzB,MAAM,aAAa,CAAA,CACnB,KAAK,EAAE,CAAA;AACZ;AAEA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,MACZ,KAAA,CAAM,eAAe,EACrB,IAAA,CAAK,cAAc,CAAA,CACnB,KAAA,CAAM,oBAAoB,CAAA,CAC1B,KAAK,eAAe,CAAA,CACpB,OAAO,IAAA,CAAK,IAAA,CAAK,MAAM,MAAA,GAAS,CAAC,CAAA,GAAI,CAAA,EAAG,aAAa,CAAA;AACxD,IAAA,OAAO,UAAA,CAAW,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,EAAG,CAAC,IAAA,KAAS,IAAA,CAAK,UAAA,CAAW,CAAC,CAAC,CAAA;AAAA,EACnE,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa,wBAAA,EAA0B,qCAAA,EAAuC;AAAA,MACtF;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAEA,SAAS,qBAAA,GAAiD;AACxD,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,YAAA;AAAA,EACpB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,YAAA,CAAa,uBAAA,EAAyB,6BAAA,EAA+B,EAAE,OAAO,CAAA;AAAA,EAC1F;AACF;AAEA,SAAS,sBAAsB,KAAA,EAA8B;AAC3D,EAAA,IAAI,KAAA,YAAiB,cAAc,OAAO,KAAA;AAC1C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,uBAAA;AAAA,IACA,mBAAA,CAAoB,KAAK,CAAA,IAAK,+BAAA;AAAA,IAC9B,EAAE,KAAA;AAAM,GACV;AACF;AAEA,SAAS,uBAAA,GAA4D;AACnE,EAAA,MAAM,MAAA,GAAS,UAAA;AAIf,EAAA,OAAO,OAAO,MAAA,EAAQ,OAAA,EAAS,KAAA,IAAS,MAAA,CAAO,SAAS,OAAA,EAAS,KAAA;AACnE;AAEA,SAAS,uBAAA,GAA4D;AACnE,EAAA,MAAM,MAAA,GAAS,UAAA;AAIf,EAAA,OAAO,MAAA,CAAO,MAAA,EAAQ,OAAA,IAAW,MAAA,CAAO,OAAA,EAAS,OAAA;AACnD;AAEA,SAAS,YAAA,CACP,OAAA,EACA,OAAA,EACA,IAAA,EACkC;AAClC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,CAAC,KAAA,KAAU;AAChD,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,mBACnC,KAAK,CAAA;AAAA,IACpB,CAAC,CAAA;AACD,IAAA,IAAI,SAAA,CAAmC,YAAY,CAAA,EAAG;AACpD,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,IAC9E;AAAA,EACF,CAAC,CAAA;AACH;AAEA,SAAS,YAAA,CACP,OAAA,EACA,OAAA,EACA,KAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,MAAM;AAC5C,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,WAC3C,OAAA,EAAQ;AAAA,IACf,CAAC,CAAA;AACD,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,eAAA,CACP,OAAA,EACA,OAAA,EACA,GAAA,EACe;AACf,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,MAAM;AAC7C,MAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,WAC3C,OAAA,EAAQ;AAAA,IACf,CAAC,CAAA;AACD,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,uBAAA,CACP,SACA,OAAA,EACe;AACf,EAAA,MAAM,iBAAiB,OAAA,CAAQ,cAAA;AAC/B,EAAA,IAAI,CAAC,cAAA,EAAgB,OAAO,OAAA,CAAQ,OAAA,EAAQ;AAC5C,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,eAAe,cAAA,CAAe,IAAA;AAAA,MAClC,OAAA;AAAA,MACA,EAAE,aAAa,uCAAA,EAAwC;AAAA,MACvD,MAAM;AACJ,QAAA,MAAM,KAAA,GAAQ,mBAAmB,OAAO,CAAA;AACxC,QAAA,IAAI,KAAA,EAAO,MAAA,CAAO,uBAAA,CAAwB,KAAK,CAAC,CAAA;AAAA,aAC3C,OAAA,EAAQ;AAAA,MACf;AAAA,KACF;AACA,IAAA,IAAI,UAAgB,YAAY,CAAA;AAC9B,MAAA,YAAA,CAAa,IAAA,CAAK,SAAS,CAAC,KAAA,KAAU,OAAO,uBAAA,CAAwB,KAAK,CAAC,CAAC,CAAA;AAAA,EAChF,CAAC,CAAA;AACH;AAEA,SAAS,mBACP,OAAA,EACsC;AACtC,EAAA,OAAO,SAAS,SAAA,IAAa,IAAA;AAC/B;AAEA,SAAS,wBAAwB,KAAA,EAA8B;AAC7D,EAAA,IAAI,KAAA,YAAiB,cAAc,OAAO,KAAA;AAC1C,EAAA,OAAO,IAAI,YAAA;AAAA,IACT,uBAAA;AAAA,IACA,mBAAA,CAAoB,KAAK,CAAA,IAAK,oCAAA;AAAA,IAC9B,EAAE,OAAO,KAAA;AAAM,GACjB;AACF;AAEA,SAAS,oBAAoB,KAAA,EAAoC;AAC/D,EAAA,IAAI,KAAA,YAAiB,KAAA,EAAO,OAAO,KAAA,CAAM,OAAA;AACzC,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,IAAQ,aAAa,KAAA,EAAO;AACrE,IAAA,MAAM,UAAW,KAAA,CAAgC,OAAA;AACjD,IAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,OAAO,OAAA;AAAA,EAC1C;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,UAAa,KAAA,EAAqC;AACzD,EAAA,OACE,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACV,MAAA,IAAU,KAAA,IACV,OAAQ,KAAA,CAA4B,IAAA,KAAS,UAAA;AAEjD","file":"chunk-AIKC2XQS.js","sourcesContent":["const storageBackings = new WeakMap<object, object>();\n\nexport function registerStorageBacking(adapter: object, backing: object): void {\n  storageBackings.set(adapter, backing);\n}\n\nexport function getStorageBacking(adapter: object): object {\n  return storageBackings.get(adapter) ?? adapter;\n}\n","/**\n * `@invisible-labs/sdk/storage` - storage adapters (spec section 7).\n *\n * The SDK persists recoverable secrets (Recovery Code, LP Position Code, LP\n * Refill Key, withdrawal secret) only through a {@link StorageAdapter}. The\n * `memory`, `browser`, and `extension` adapters are real. Browser and\n * extension adapters persist the bytes provided by the caller; callers that need\n * encrypted-at-rest storage can wrap/encrypt bytes before calling `put`.\n */\n\nimport { StorageError } from \"../core/errors.js\";\nimport { registerStorageBacking } from \"./coordination.js\";\n\nconst STORAGE_KEY_PREFIX = \"invisible:sdk:storage:v1:\";\nconst STORAGE_KEY_SEPARATOR = \":\";\nconst BASE64URL_PAD = \"=\";\nconst BASE64URL_PLUS = \"+\";\nconst BASE64URL_SLASH = \"/\";\nconst BASE64URL_MINUS = \"-\";\nconst BASE64URL_UNDERSCORE = \"_\";\nconst BYTE_STRING_CHUNK_SIZE = 0x8000;\nconst EXTENSION_TRUSTED_CONTEXTS_ACCESS_LEVEL = \"TRUSTED_CONTEXTS\";\n\n/**\n * A namespaced key/value store for the SDK's recoverable secrets. Values are\n * raw bytes. Callers may store plaintext bytes, pre-wrapped bytes, or encrypted\n * bytes depending on their host product's storage model.\n */\nexport interface StorageAdapter {\n  /** Which backing the adapter uses. */\n  readonly kind: \"browser\" | \"extension\" | \"server-hkdf\" | \"server-custom\" | \"memory\";\n  put(namespace: string, key: string, value: Uint8Array): Promise<void>;\n  get(namespace: string, key: string): Promise<Uint8Array | null>;\n  list(namespace: string): Promise<string[]>;\n  remove(namespace: string, key: string): Promise<void>;\n  /** `server-hkdf` only: derive a secret from a stable domain context. */\n  derive?(namespace: string, context: string): Promise<Uint8Array>;\n}\n\nexport interface BrowserStorageOptions {\n  /** Override for tests or custom host environments. Defaults to `globalThis.localStorage`. */\n  readonly storage?: StorageLike;\n}\n\nexport interface ExtensionStorageOptions {\n  /** Override for tests or custom extension hosts. Defaults to chrome/browser storage local. */\n  readonly storage?: ExtensionStorageArea;\n  /** Override for tests or custom extension hosts. Defaults to chrome/browser runtime. */\n  readonly runtime?: ExtensionRuntimeLike;\n  /**\n   * Chrome exposes storage.local to content scripts by default. Keep the default\n   * trusted-context restriction when the host API supports it.\n   */\n  readonly restrictAccessToTrustedContexts?: boolean;\n}\n\ninterface StorageLike {\n  readonly length: number;\n  key(index: number): string | null;\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\ninterface ExtensionStorageArea {\n  get(\n    keys?: string | string[] | Record<string, unknown> | null,\n    callback?: (items: Record<string, unknown>) => void,\n  ): Promise<Record<string, unknown>> | void;\n  set(items: Record<string, string>, callback?: () => void): Promise<void> | void;\n  remove(keys: string | string[], callback?: () => void): Promise<void> | void;\n  setAccessLevel?(details: { accessLevel: string }, callback?: () => void): Promise<void> | void;\n}\n\ninterface ExtensionRuntimeLike {\n  readonly lastError?: { readonly message?: string } | null;\n}\n\n/**\n * In-memory adapter. Fully functional, unencrypted, non-persistent - intended\n * for tests and ephemeral flows, never for real secrets at rest.\n */\nexport function inMemoryStorage(): StorageAdapter {\n  // Each namespace is a separate inner map rather than a flattened composite\n  // key, so a namespace or key containing any character (including a separator)\n  // can never collide across namespaces.\n  const namespaces = new Map<string, Map<string, Uint8Array>>();\n  const bucket = (namespace: string) => {\n    let inner = namespaces.get(namespace);\n    if (!inner) {\n      inner = new Map<string, Uint8Array>();\n      namespaces.set(namespace, inner);\n    }\n    return inner;\n  };\n  return {\n    kind: \"memory\",\n    async put(namespace, key, value) {\n      bucket(namespace).set(key, value);\n    },\n    async get(namespace, key) {\n      return namespaces.get(namespace)?.get(key) ?? null;\n    },\n    async list(namespace) {\n      return [...(namespaces.get(namespace)?.keys() ?? [])];\n    },\n    async remove(namespace, key) {\n      namespaces.get(namespace)?.delete(key);\n    },\n  };\n}\n\n/**\n * Browser `localStorage` adapter. Values are stored as base64url-encoded bytes.\n * Encrypt or wrap the bytes before `put` if your product requires encrypted\n * local persistence.\n *\n * @throws StorageError `STORAGE_NOT_AVAILABLE` if `localStorage` is unavailable.\n */\nexport function browserStorage(options: BrowserStorageOptions = {}): StorageAdapter {\n  const storage = options.storage ?? defaultBrowserStorage();\n  if (!storage) throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"localStorage is unavailable\");\n  const adapter: StorageAdapter = {\n    kind: \"browser\",\n    async put(namespace, key, value) {\n      try {\n        storage.setItem(storageKey(namespace, key), bytesToBase64Url(value));\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async get(namespace, key) {\n      try {\n        const value = storage.getItem(storageKey(namespace, key));\n        return value === null ? null : base64UrlToBytes(value);\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async list(namespace) {\n      try {\n        const prefix = storageKeyPrefix(namespace);\n        const keys: string[] = [];\n        for (let index = 0; index < storage.length; index += 1) {\n          const storedKey = storage.key(index);\n          if (storedKey?.startsWith(prefix)) {\n            keys.push(decodeStorageSegment(storedKey.slice(prefix.length)));\n          }\n        }\n        return keys;\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n    async remove(namespace, key) {\n      try {\n        storage.removeItem(storageKey(namespace, key));\n      } catch (cause) {\n        throw browserOperationError(cause);\n      }\n    },\n  };\n  registerStorageBacking(adapter, storage);\n  return adapter;\n}\n\n/**\n * Browser-extension (`chrome.storage.local` / `browser.storage.local`) adapter.\n * Values are stored as base64url-encoded bytes. Encrypt or wrap the bytes before\n * `put` if your product requires encrypted local persistence.\n *\n * @throws StorageError `STORAGE_NOT_AVAILABLE` if extension storage is unavailable.\n */\nexport function extensionStorage(options: ExtensionStorageOptions = {}): StorageAdapter {\n  const storage = options.storage ?? defaultExtensionStorage();\n  if (!storage) {\n    throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"extension local storage is unavailable\");\n  }\n  const runtime = options.runtime ?? defaultExtensionRuntime();\n  const trustedAccess =\n    options.restrictAccessToTrustedContexts === false\n      ? Promise.resolve()\n      : extensionSetAccessLevel(storage, runtime);\n  const adapter: StorageAdapter = {\n    kind: \"extension\",\n    async put(namespace, key, value) {\n      await trustedAccess;\n      await extensionSet(storage, runtime, {\n        [storageKey(namespace, key)]: bytesToBase64Url(value),\n      });\n    },\n    async get(namespace, key) {\n      await trustedAccess;\n      const storedKey = storageKey(namespace, key);\n      const values = await extensionGet(storage, runtime, storedKey);\n      const value = values[storedKey];\n      return typeof value === \"string\" ? base64UrlToBytes(value) : null;\n    },\n    async list(namespace) {\n      await trustedAccess;\n      const prefix = storageKeyPrefix(namespace);\n      const values = await extensionGet(storage, runtime, null);\n      return Object.keys(values)\n        .filter((key) => key.startsWith(prefix))\n        .map((key) => decodeStorageSegment(key.slice(prefix.length)));\n    },\n    async remove(namespace, key) {\n      await trustedAccess;\n      await extensionRemove(storage, runtime, storageKey(namespace, key));\n    },\n  };\n  registerStorageBacking(adapter, storage);\n  return adapter;\n}\n\nfunction storageKey(namespace: string, key: string): string {\n  return `${storageKeyPrefix(namespace)}${encodeStorageSegment(key)}`;\n}\n\nfunction storageKeyPrefix(namespace: string): string {\n  return `${STORAGE_KEY_PREFIX}${encodeStorageSegment(namespace)}${STORAGE_KEY_SEPARATOR}`;\n}\n\nfunction encodeStorageSegment(value: string): string {\n  return encodeURIComponent(value);\n}\n\nfunction decodeStorageSegment(value: string): string {\n  return decodeURIComponent(value);\n}\n\nfunction bytesToBase64Url(value: Uint8Array): string {\n  let binary = \"\";\n  for (let index = 0; index < value.length; index += BYTE_STRING_CHUNK_SIZE) {\n    binary += String.fromCharCode(...value.slice(index, index + BYTE_STRING_CHUNK_SIZE));\n  }\n  return btoa(binary)\n    .split(BASE64URL_PLUS)\n    .join(BASE64URL_MINUS)\n    .split(BASE64URL_SLASH)\n    .join(BASE64URL_UNDERSCORE)\n    .split(BASE64URL_PAD)\n    .join(\"\");\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n  try {\n    const base64 = value\n      .split(BASE64URL_MINUS)\n      .join(BASE64URL_PLUS)\n      .split(BASE64URL_UNDERSCORE)\n      .join(BASE64URL_SLASH)\n      .padEnd(Math.ceil(value.length / 4) * 4, BASE64URL_PAD);\n    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));\n  } catch (cause) {\n    throw new StorageError(\"STORAGE_DECRYPT_FAILED\", \"stored value is not valid base64url\", {\n      cause,\n    });\n  }\n}\n\nfunction defaultBrowserStorage(): StorageLike | undefined {\n  try {\n    return globalThis.localStorage;\n  } catch (cause) {\n    throw new StorageError(\"STORAGE_NOT_AVAILABLE\", \"localStorage is unavailable\", { cause });\n  }\n}\n\nfunction browserOperationError(cause: unknown): StorageError {\n  if (cause instanceof StorageError) return cause;\n  return new StorageError(\n    \"STORAGE_NOT_AVAILABLE\",\n    storageErrorMessage(cause) ?? \"localStorage operation failed\",\n    { cause },\n  );\n}\n\nfunction defaultExtensionStorage(): ExtensionStorageArea | undefined {\n  const global = globalThis as {\n    chrome?: { storage?: { local?: ExtensionStorageArea } };\n    browser?: { storage?: { local?: ExtensionStorageArea } };\n  };\n  return global.chrome?.storage?.local ?? global.browser?.storage?.local;\n}\n\nfunction defaultExtensionRuntime(): ExtensionRuntimeLike | undefined {\n  const global = globalThis as {\n    chrome?: { runtime?: ExtensionRuntimeLike };\n    browser?: { runtime?: ExtensionRuntimeLike };\n  };\n  return global.chrome?.runtime ?? global.browser?.runtime;\n}\n\nfunction extensionGet(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  keys: string | string[] | Record<string, unknown> | null,\n): Promise<Record<string, unknown>> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.get(keys, (items) => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve(items);\n    });\n    if (isPromise<Record<string, unknown>>(maybePromise)) {\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n    }\n  });\n}\n\nfunction extensionSet(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  items: Record<string, string>,\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.set(items, () => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve();\n    });\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionRemove(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n  key: string,\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const maybePromise = storage.remove(key, () => {\n      const error = extensionLastError(runtime);\n      if (error) reject(extensionOperationError(error));\n      else resolve();\n    });\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionSetAccessLevel(\n  storage: ExtensionStorageArea,\n  runtime: ExtensionRuntimeLike | undefined,\n): Promise<void> {\n  const setAccessLevel = storage.setAccessLevel;\n  if (!setAccessLevel) return Promise.resolve();\n  return new Promise((resolve, reject) => {\n    const maybePromise = setAccessLevel.call(\n      storage,\n      { accessLevel: EXTENSION_TRUSTED_CONTEXTS_ACCESS_LEVEL },\n      () => {\n        const error = extensionLastError(runtime);\n        if (error) reject(extensionOperationError(error));\n        else resolve();\n      },\n    );\n    if (isPromise<void>(maybePromise))\n      maybePromise.then(resolve, (cause) => reject(extensionOperationError(cause)));\n  });\n}\n\nfunction extensionLastError(\n  runtime: ExtensionRuntimeLike | undefined,\n): { readonly message?: string } | null {\n  return runtime?.lastError ?? null;\n}\n\nfunction extensionOperationError(error: unknown): StorageError {\n  if (error instanceof StorageError) return error;\n  return new StorageError(\n    \"STORAGE_NOT_AVAILABLE\",\n    storageErrorMessage(error) ?? \"extension storage operation failed\",\n    { cause: error },\n  );\n}\n\nfunction storageErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"object\" && error !== null && \"message\" in error) {\n    const message = (error as { message?: unknown }).message;\n    if (typeof message === \"string\") return message;\n  }\n  return undefined;\n}\n\nfunction isPromise<T>(value: unknown): value is Promise<T> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"then\" in value &&\n    typeof (value as { then: unknown }).then === \"function\"\n  );\n}\n"]}