@keyneom/sync-kit 0.1.1 → 0.2.0-rc.1

package/README.md

@@ -7,12 +7,39 @@ The package extracts the behavior already implemented by EasyBC and Family
 Chores. It does not own application schemas, merge policy, persistence, UI, or
 lifecycle policy.
 
+## Backend-independent by design
+
+A primary package objective is to let a static frontend provide encrypted sync
+and multi-user sharing without an application-owned trusted backend. The
+complete interactive flow must be implementable with browser cryptography and
+passkeys, Google Identity Services, and Google Drive:
+
+- no server-held client secret or refresh token;
+- no application database, certificate signer, or authorization service;
+- no server required to encrypt, decrypt, invite, accept, reconcile access, or
+  publish a signed revision.
+
+Google remains the OAuth, identity, and storage provider. Participant keys,
+signed access-control history, and the pinned owner key remain the
+cryptographic authority. An optional backend adapter may add unattended jobs,
+notifications, or operational automation, but package correctness and
+interoperability must never depend on one.
+
+Backendless browser deployments operate while the app is open and may need
+user interaction when OAuth access expires or a passkey ceremony is required.
+That limitation must not be hidden by broad Drive scopes or by making a
+backend mandatory.
+
 ## Status
 
-Version `0.1.0` was published to npm on 2026-06-30. Current source version
-`0.1.1` removes application-specific runtime presets and keeps compatibility
+Version `0.1.1` was published to npm on 2026-06-30. It removes the
+application-specific runtime presets from `0.1.0` and keeps compatibility
 profiles consumer-owned.
 
+Version `0.2.0-rc.1` publishes shared encrypted backups, Tier A background
+detection helpers, and the Android sharing port. Live Google validation and
+one external consumer integration remain release gates for a stable `0.2.0`.
+
 The tests in this repository cover frozen compatibility vectors, mocked
 browser providers, package orchestration, and installation/imports from the
 packed tarball. They do not install this package into EasyBC, Family Chores, or
@@ -87,12 +114,30 @@ Available exports:
   optional gzip, and canonical JSON/AAD helpers
 - `/snapshot` — serialized snapshot synchronization
 - `/snapshot/lifecycle` — opt-in browser lifecycle binding
+- `/sharing` — browser-independent shared-backup protocol types, validation,
+  roles, invitations, signed multi-recipient envelopes, and join-link helpers
+- `/sharing/web-crypto` — P-256 identities, ECDH key grants, signed revisions,
+  invitation/key-response proofs, and decryption
+- `/sharing/controller` — headless multi-dataset orchestration, owner pinning,
+  serialized writes, exchange processing, roles, revocation, Drive permission
+  reconciliation, and optional IndexedDB registry persistence
+- `/sharing/web-passkey` — passkey-encrypted sharing identities with
+  non-extractable runtime keys and optional IndexedDB ciphertext storage
+- `/sharing/account-binding` — backendless Google ID-token and WebAuthn
+  challenge binding, signature verification, and account provenance
 - `/keys/web-passkey` — WebAuthn PRF keys with exact credential selection,
   unlock coalescing, raw-secret zeroing, and explicit cache clearing
 - `/auth/google-web` — Google Identity Services with memory-only token reuse,
   expiry skew, request coalescing, and explicit invalidation
-- `/stores/google-drive` — low-level `appDataFolder` objects plus a typed
-  snapshot wrapper
+- `/auth/google-web/identity` — uncached nonce-bound Google ID tokens for
+  account-binding exchanges
+- `/stores/google-drive` — low-level `appDataFolder` objects, a typed snapshot
+  wrapper, normal-Drive folder/per-file stores, folder-name helpers, and
+  accessible app-folder discovery
+- `/stores/google-drive/sharing` — managed app/exchange folders, conditional
+  dataset writes, provenance checks, and per-dataset permissions
+- `/stores/google-drive/picker` — explicit folder Picker and Drive Open-with
+  state parsing
 
 The root, `/core`, `/crypto`, and `/snapshot` expose no browser adapter.
 Browser globals and script loading are used only after an explicit browser
@@ -136,12 +181,15 @@ matches the remote value.
 The wire protocol is the native compatibility boundary; the browser adapter is
 not.
 
-- EasyBC Android's Kotlin implementation reads the same v1 AES-GCM/HKDF/gzip
-  fixtures as this package.
+- **Android:** `com.keyneom:sync-kit-android` (module `android/synckit`) provides
+  private v1 snapshot crypto, `SnapshotSyncController`, Drive `appDataFolder`
+  storage, and Credential Manager passkey PRF — the same contracts as the npm
+  `/crypto`, `/snapshot`, and appData store paths. Published to
+  [GitHub Packages](https://github.com/keyneom/sync-kit/packages). See
+  [android-library.md](docs/android-library.md).
+- Shared backups (`/sharing`) are TypeScript-only for now.
 - React Native and other JavaScript-native runtimes can inject a
   `CryptoBackend<K>` backed by platform crypto.
-- Kotlin and Swift applications implement the small key, authorization, store,
-  and crypto contracts natively while consuming the shared fixtures.
 - Tauri applications can use `/core`, `/crypto`, and the low-level Google Drive
   object store, but should perform OAuth in the system browser through
   Authorization Code + PKCE.
@@ -149,6 +197,53 @@ not.
 See [native consumer guidance](docs/native-consumers.md) and the exact
 [v1 compatibility contract](docs/compatibility-v1.md).
 
+## Shared encrypted backups
+
+The experimental sharing surface encrypts each revision with a fresh content
+key, wraps that key to every participant's ECDH public key, and accepts writes
+only when an owner/admin/writer signs the complete revision. Viewers receive a
+decryption grant but are not authorized revision signers.
+
+Sharing follows the package-wide backend-independent objective above. A static
+frontend can execute the protocol directly against Google Drive; an
+application-owned server is neither a trust root nor a deployment requirement.
+
+Shared files use normal Google Drive storage with the per-file `drive.file`
+scope. A recipient can select the shared app folder once through Google Picker,
+after which the app reuses its ID for app-created children; broad access to
+Drive is not required. `appDataFolder` files cannot be shared.
+
+New integrations can use `GoogleDriveFileSnapshotStore`, which defaults to an
+app-owned top-level folder:
+
+```text
+Sync Kit - <appId>/
+  <consumer filename>
+```
+
+The folder name can be overridden. A selected parent folder is optional rather
+than part of the default flow. Existing v1 consumers continue using
+`GoogleDriveSnapshotStore` and `appDataFolder` until they explicitly migrate.
+
+For shared data, the default policy makes the app folder readable to all app
+participants, makes its `exchanges/` child writable, and upgrades selected
+participants to writer on individual dataset files. This exposes filenames,
+metadata, and ciphertext to app participants while cryptographic grants control
+decryption. Applications needing metadata isolation can instead use direct file
+sharing or limited-access subfolders.
+
+See the [protocol and threat model](docs/shared-backups.md),
+[authoritative implementation handoff](docs/sharing-implementation-handoff.md),
+[consumer responsibilities](docs/consumer-responsibilities.md), and
+[background notifications](docs/background-notifications.md). The phased gates
+remain in the [sharing execution plan](docs/sharing-execution-plan.md). The crypto and
+per-file transport, Picker, protected identity, account binding, signed
+ancestry/fork policy, key rotation, and controller primitives are implemented.
+The same sharing fixture is consumed by Java, and the packed package completes
+an exchange/decryption smoke test. Live Google OAuth/Picker, Drive
+conditional-write/permission validation, and adoption in an external consumer
+remain release gates.
+
 ## Compatibility and isolation
 
 Each application owns the profile that preserves its filename, AAD, HKDF

package/dist/auth/google-web/cache.d.ts

@@ -0,0 +1,46 @@
+import type { Authorization, AuthorizationProvider } from "../../core/types.js";
+export type CachedAuthorizationRecord = {
+    profileId: string;
+    accessToken: string;
+    expiresAt: number;
+    accountHint?: string;
+};
+/**
+ * Opt-in persistence for short-lived Google access tokens used by Tier A
+ * background polling. Not enabled by default; memory-only auth remains the
+ * default policy.
+ */
+export declare class IndexedDbAuthorizationCache {
+    private readonly options;
+    constructor(options?: {
+        databaseName?: string;
+        storeName?: string;
+        indexedDB?: IDBFactory;
+    });
+    load(profileId: string): Promise<CachedAuthorizationRecord | null>;
+    save(record: CachedAuthorizationRecord): Promise<void>;
+    delete(profileId: string): Promise<void>;
+    private transaction;
+    private open;
+    private storeName;
+}
+export type CachingAuthorizationProviderOptions = {
+    profileId: string;
+    inner: AuthorizationProvider<Authorization>;
+    cache: IndexedDbAuthorizationCache;
+    accountHint?: string;
+    expirySkewMs?: number;
+    now?: () => number;
+};
+/**
+ * Wraps an authorization provider and mirrors valid access tokens into the
+ * opt-in IndexedDB cache for service-worker polling.
+ */
+export declare class CachingAuthorizationProvider implements AuthorizationProvider<Authorization> {
+    private readonly options;
+    constructor(options: CachingAuthorizationProviderOptions);
+    authorize(): Promise<Authorization>;
+    authorizeFromCache(): Promise<Authorization | null>;
+    clear(): void;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/auth/google-web/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE;QACxB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,UAAU,CAAC;KACnB;IAGF,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAelE,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIhC,WAAW;IAoBzB,OAAO,CAAC,IAAI;IAoCZ,OAAO,CAAC,SAAS;CAGlB;AAED,MAAM,MAAM,mCAAmC,GAAG;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC5C,KAAK,EAAE,2BAA2B,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,qBAAa,4BACX,YAAW,qBAAqB,CAAC,aAAa,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,mCAAmC;IAEnE,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAmBnC,kBAAkB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAezD,KAAK,IAAI,IAAI;CAId"}

package/dist/auth/google-web/cache.js

@@ -0,0 +1,111 @@
+import { SyncKitError } from "../../core/errors.js";
+/**
+ * Opt-in persistence for short-lived Google access tokens used by Tier A
+ * background polling. Not enabled by default; memory-only auth remains the
+ * default policy.
+ */
+export class IndexedDbAuthorizationCache {
+    options;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async load(profileId) {
+        const stored = await this.transaction("readonly", (store) => store.get(profileId));
+        if (!stored || typeof stored !== "object")
+            return null;
+        const record = stored;
+        if (typeof record.accessToken !== "string" ||
+            typeof record.expiresAt !== "number") {
+            return null;
+        }
+        return structuredClone(record);
+    }
+    async save(record) {
+        await this.transaction("readwrite", (store) => store.put(structuredClone(record)));
+    }
+    async delete(profileId) {
+        await this.transaction("readwrite", (store) => store.delete(profileId));
+    }
+    async transaction(mode, operation) {
+        const database = await this.open();
+        return new Promise((resolve, reject) => {
+            const transaction = database.transaction(this.storeName(), mode);
+            const request = operation(transaction.objectStore(this.storeName()));
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new SyncKitError("state", "IndexedDB authorization cache failed.", {
+                cause: request.error,
+            }));
+            transaction.oncomplete = () => database.close();
+            transaction.onabort = () => database.close();
+        });
+    }
+    open() {
+        const indexedDBImplementation = this.options.indexedDB ??
+            (typeof indexedDB === "undefined" ? undefined : indexedDB);
+        if (!indexedDBImplementation) {
+            return Promise.reject(new SyncKitError("configuration", "IndexedDB is required for authorization cache storage."));
+        }
+        return new Promise((resolve, reject) => {
+            const request = indexedDBImplementation.open(this.options.databaseName ?? "sync-kit-auth-cache", 1);
+            request.onupgradeneeded = () => {
+                if (!request.result.objectStoreNames.contains(this.storeName())) {
+                    request.result.createObjectStore(this.storeName(), {
+                        keyPath: "profileId",
+                    });
+                }
+            };
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(new SyncKitError("state", "IndexedDB authorization cache could not be opened.", { cause: request.error }));
+        });
+    }
+    storeName() {
+        return this.options.storeName ?? "google-authorization";
+    }
+}
+/**
+ * Wraps an authorization provider and mirrors valid access tokens into the
+ * opt-in IndexedDB cache for service-worker polling.
+ */
+export class CachingAuthorizationProvider {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async authorize() {
+        const authorization = await this.options.inner.authorize();
+        const now = this.options.now?.() ?? Date.now();
+        const skew = this.options.expirySkewMs ?? 60_000;
+        const expiresAt = authorization.expiresAt ?? now + 3_600_000;
+        if (expiresAt > now + skew) {
+            await this.options.cache.save({
+                profileId: this.options.profileId,
+                accessToken: authorization.accessToken,
+                expiresAt,
+                ...(this.options.accountHint
+                    ? { accountHint: this.options.accountHint }
+                    : {}),
+            });
+        }
+        return authorization;
+    }
+    async authorizeFromCache() {
+        const record = await this.options.cache.load(this.options.profileId);
+        if (!record)
+            return null;
+        const now = this.options.now?.() ?? Date.now();
+        const skew = this.options.expirySkewMs ?? 60_000;
+        if (record.expiresAt <= now + skew) {
+            await this.options.cache.delete(this.options.profileId);
+            return null;
+        }
+        return {
+            accessToken: record.accessToken,
+            expiresAt: record.expiresAt,
+        };
+    }
+    clear() {
+        this.options.inner.clear();
+        void this.options.cache.delete(this.options.profileId);
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/auth/google-web/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/auth/google-web/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AASpD;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAEnB;IADnB,YACmB,UAIb,EAAE;QAJW,YAAO,GAAP,OAAO,CAIlB;IACL,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CACnE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CACrB,CAAC;QACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,MAAmC,CAAC;QACnD,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAiC;QAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAwB,EACxB,SAAmD;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,YAAY,CAAC,OAAO,EAAE,uCAAuC,EAAE;gBACjE,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CACH,CAAC;YACJ,WAAW,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChD,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI;QACV,MAAM,uBAAuB,GAC3B,IAAI,CAAC,OAAO,CAAC,SAAS;YACtB,CAAC,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,YAAY,CACd,eAAe,EACf,wDAAwD,CACzD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAC1C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,EAClD,CAAC,CACF,CAAC;YACF,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;oBAChE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE;wBACjD,OAAO,EAAE,WAAW;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CACJ,IAAI,YAAY,CACd,OAAO,EACP,oDAAoD,EACpD,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CACF,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC1D,CAAC;CACF;AAWD;;;GAGG;AACH,MAAM,OAAO,4BAA4B;IAGV;IAA7B,YAA6B,OAA4C;QAA5C,YAAO,GAAP,OAAO,CAAqC;IAAG,CAAC;IAE7E,KAAK,CAAC,SAAS;QACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;QACjD,MAAM,SAAS,GACb,aAAa,CAAC,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC;QAC7C,IAAI,SAAS,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS;gBACT,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;oBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;oBAC3C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;QACjD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/auth/google-web/identity.d.ts

@@ -0,0 +1,49 @@
+type GoogleCredentialResponse = {
+    credential?: string;
+};
+type PromptMomentNotification = {
+    isNotDisplayed(): boolean;
+    isSkippedMoment(): boolean;
+    getNotDisplayedReason?(): string;
+    getSkippedReason?(): string;
+};
+type GoogleIdentityWindow = Window & {
+    google?: {
+        accounts?: {
+            id?: {
+                initialize(options: {
+                    client_id: string;
+                    nonce: string;
+                    callback(response: GoogleCredentialResponse): void;
+                    auto_select?: boolean;
+                    cancel_on_tap_outside?: boolean;
+                    use_fedcm_for_prompt?: boolean;
+                }): void;
+                prompt(callback?: (notification: PromptMomentNotification) => void): void;
+                cancel(): void;
+            };
+        };
+    };
+};
+export type GoogleWebIdentityOptions = {
+    clientId: string;
+    window?: GoogleIdentityWindow;
+    document?: Document;
+    useFedCm?: boolean;
+};
+/**
+ * Requests a Google-signed ID token whose nonce is the sharing-account
+ * binding challenge. The token is returned to the caller and is not cached.
+ */
+export declare class GoogleWebIdentityProvider {
+    private readonly options;
+    private scriptPromise;
+    constructor(options: GoogleWebIdentityOptions);
+    requestIdToken(nonce: string): Promise<string>;
+    cancel(): void;
+    private loadScript;
+    private browserWindow;
+    private browserDocument;
+}
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/auth/google-web/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/identity.ts"],"names":[],"mappings":"AAEA,KAAK,wBAAwB,GAAG;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,cAAc,IAAI,OAAO,CAAC;IAC1B,eAAe,IAAI,OAAO,CAAC;IAC3B,qBAAqB,CAAC,IAAI,MAAM,CAAC;IACjC,gBAAgB,CAAC,IAAI,MAAM,CAAC;CAC7B,CAAC;AAEF,KAAK,oBAAoB,GAAG,MAAM,GAAG;IACnC,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE;YACT,EAAE,CAAC,EAAE;gBACH,UAAU,CAAC,OAAO,EAAE;oBAClB,SAAS,EAAE,MAAM,CAAC;oBAClB,KAAK,EAAE,MAAM,CAAC;oBACd,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,IAAI,CAAC;oBACnD,WAAW,CAAC,EAAE,OAAO,CAAC;oBACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;oBAChC,oBAAoB,CAAC,EAAE,OAAO,CAAC;iBAChC,GAAG,IAAI,CAAC;gBACT,MAAM,CACJ,QAAQ,CAAC,EAAE,CAAC,YAAY,EAAE,wBAAwB,KAAK,IAAI,GAC1D,IAAI,CAAC;gBACR,MAAM,IAAI,IAAI,CAAC;aAChB,CAAC;SACH,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,qBAAa,yBAAyB;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAFpC,OAAO,CAAC,aAAa,CAA8B;gBAEtB,OAAO,EAAE,wBAAwB;IAMxD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiDpD,MAAM,IAAI,IAAI;IAId,OAAO,CAAC,UAAU;IAyBlB,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,eAAe;CAYxB"}

package/dist/auth/google-web/identity.js

@@ -0,0 +1,102 @@
+import { SyncKitError } from "../../core/errors.js";
+/**
+ * Requests a Google-signed ID token whose nonce is the sharing-account
+ * binding challenge. The token is returned to the caller and is not cached.
+ */
+export class GoogleWebIdentityProvider {
+    options;
+    scriptPromise = null;
+    constructor(options) {
+        this.options = options;
+        if (!options.clientId.trim()) {
+            throw new TypeError("clientId must not be empty.");
+        }
+    }
+    async requestIdToken(nonce) {
+        if (!nonce.trim())
+            throw new TypeError("nonce must not be empty.");
+        await this.loadScript();
+        const identity = this.browserWindow().google?.accounts?.id;
+        if (!identity) {
+            throw new SyncKitError("authorization", "Google identity services are unavailable.");
+        }
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const fail = (message) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(new SyncKitError("authorization", message));
+            };
+            identity.initialize({
+                client_id: this.options.clientId,
+                nonce,
+                auto_select: false,
+                cancel_on_tap_outside: true,
+                use_fedcm_for_prompt: this.options.useFedCm ?? true,
+                callback: (response) => {
+                    if (settled)
+                        return;
+                    if (!response.credential) {
+                        fail("Google did not return an identity token.");
+                        return;
+                    }
+                    settled = true;
+                    resolve(response.credential);
+                },
+            });
+            identity.prompt((notification) => {
+                if (notification.isNotDisplayed()) {
+                    fail(notification.getNotDisplayedReason?.() ??
+                        "Google sign-in could not be displayed.");
+                }
+                else if (notification.isSkippedMoment()) {
+                    fail(notification.getSkippedReason?.() ??
+                        "Google sign-in was skipped.");
+                }
+            });
+        });
+    }
+    cancel() {
+        this.browserWindow().google?.accounts?.id?.cancel();
+    }
+    loadScript() {
+        if (this.browserWindow().google?.accounts?.id) {
+            return Promise.resolve();
+        }
+        if (this.scriptPromise)
+            return this.scriptPromise;
+        this.scriptPromise = new Promise((resolve, reject) => {
+            const script = this.browserDocument().createElement("script");
+            script.src = "https://accounts.google.com/gsi/client";
+            script.async = true;
+            script.defer = true;
+            script.onload = () => resolve();
+            script.onerror = () => {
+                this.scriptPromise = null;
+                reject(new SyncKitError("authorization", "Google identity services could not be loaded."));
+            };
+            this.browserDocument().head.append(script);
+        });
+        return this.scriptPromise;
+    }
+    browserWindow() {
+        const value = this.options.window ??
+            (typeof window === "undefined"
+                ? undefined
+                : window);
+        if (!value) {
+            throw new SyncKitError("configuration", "Google identity requires a browser window.");
+        }
+        return value;
+    }
+    browserDocument() {
+        const value = this.options.document ??
+            (typeof document === "undefined" ? undefined : document);
+        if (!value) {
+            throw new SyncKitError("configuration", "Google identity requires a browser document.");
+        }
+        return value;
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/auth/google-web/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/auth/google-web/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAyCpD;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAGP;IAFrB,aAAa,GAAyB,IAAI,CAAC;IAEnD,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;gBACrC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC;gBAClB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,KAAK;gBACL,WAAW,EAAE,KAAK;gBAClB,qBAAqB,EAAE,IAAI;gBAC3B,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI;gBACnD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACrB,IAAI,OAAO;wBAAE,OAAO;oBACpB,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;wBACzB,IAAI,CAAC,0CAA0C,CAAC,CAAC;wBACjD,OAAO;oBACT,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAC/B,CAAC;aACF,CAAC,CAAC;YACH,QAAQ,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE;gBAC/B,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;oBAClC,IAAI,CACF,YAAY,CAAC,qBAAqB,EAAE,EAAE;wBACpC,wCAAwC,CAC3C,CAAC;gBACJ,CAAC;qBAAM,IAAI,YAAY,CAAC,eAAe,EAAE,EAAE,CAAC;oBAC1C,IAAI,CACF,YAAY,CAAC,gBAAgB,EAAE,EAAE;wBAC/B,6BAA6B,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAG,wCAAwC,CAAC;YACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;gBACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,+CAA+C,CAChD,CACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,aAAa;QACnB,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,MAAM;YACnB,CAAC,OAAO,MAAM,KAAK,WAAW;gBAC5B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe;QACrB,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrB,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/auth/google-web/index.d.ts

@@ -1,5 +1,6 @@
 import type { Authorization, AuthorizationProvider } from "../../core/types.js";
 export declare const GOOGLE_DRIVE_APPDATA_SCOPE = "https://www.googleapis.com/auth/drive.appdata";
+export declare const GOOGLE_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
 type TokenResponse = {
     access_token?: string;
     expires_in?: number;

package/dist/auth/google-web/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,0BAA0B,kDACU,CAAC;AAElD,KAAK,aAAa,GAAG;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,eAAe,CAAC,MAAM,EAAE;gBACtB,SAAS,EAAE,MAAM,CAAC;gBAClB,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;gBACxC,cAAc,CAAC,CAAC,KAAK,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,GAAG,IAAI,CAAC;aACjD,GAAG,WAAW,CAAC;SACjB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,qBAAa,8BACX,YAAW,qBAAqB,CAAC,aAAa,CAAC;IAOnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,MAAM,CAAuD;IACrE,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAK;gBAEM,OAAO,EAAE,6BAA6B;IAE7D,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAwBzC,KAAK,IAAI,IAAI;YAMC,YAAY;IAyD1B,OAAO,CAAC,UAAU;IAuBlB,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,QAAQ;CAYjB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,0BAA0B,kDACU,CAAC;AAClD,eAAO,MAAM,uBAAuB,+CACU,CAAC;AAE/C,KAAK,aAAa,GAAG;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,kBAAkB,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE;QACR,MAAM,EAAE;YACN,eAAe,CAAC,MAAM,EAAE;gBACtB,SAAS,EAAE,MAAM,CAAC;gBAClB,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;gBACxC,cAAc,CAAC,CAAC,KAAK,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAA;iBAAE,GAAG,IAAI,CAAC;aACjD,GAAG,WAAW,CAAC;SACjB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,qBAAa,8BACX,YAAW,qBAAqB,CAAC,aAAa,CAAC;IAOnC,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,MAAM,CAAuD;IACrE,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAK;gBAEM,OAAO,EAAE,6BAA6B;IAE7D,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAwBzC,KAAK,IAAI,IAAI;YAMC,YAAY;IAyD1B,OAAO,CAAC,UAAU;IAuBlB,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,QAAQ;CAYjB"}

package/dist/auth/google-web/index.js

@@ -1,5 +1,6 @@
 import { SyncKitError } from "../../core/errors.js";
 export const GOOGLE_DRIVE_APPDATA_SCOPE = "https://www.googleapis.com/auth/drive.appdata";
+export const GOOGLE_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
 export class GoogleWebAuthorizationProvider {
     options;
     scriptPromise = null;

package/dist/auth/google-web/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GACrC,+CAA+C,CAAC;AAmClD,MAAM,OAAO,8BAA8B;IAQZ;IALrB,aAAa,GAAyB,IAAI,CAAC;IAC3C,MAAM,GAAkD,IAAI,CAAC;IAC7D,OAAO,GAAkC,IAAI,CAAC;IAC9C,UAAU,GAAG,CAAC,CAAC;IAEvB,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;IAAG,CAAC;IAEvE,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,IACE,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,EAClC,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;gBACpD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,0BAA0B;gBACvD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACrB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;wBAC3B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,QAAQ,CAAC,iBAAiB;4BACxB,QAAQ,CAAC,KAAK;4BACd,8BAA8B,CACjC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;oBACpE,MAAM,SAAS,GACb,GAAG;wBACH,IAAI,CAAC,GAAG,CACN,CAAC,EACD,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CACpD,CAAC;oBACJ,MAAM,aAAa,GAAG;wBACpB,WAAW,EAAE,QAAQ,CAAC,YAAY;wBAClC,SAAS;qBACV,CAAC;oBACF,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;wBACtD,IAAI,CAAC,MAAM,GAAG;4BACZ,GAAG,aAAa;4BAChB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;yBAChC,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,aAAa,CAAC,CAAC;gBACzB,CAAC;gBACD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,KAAK,CAAC,IAAI,IAAI,qCAAqC,CACpD,CACF;aACJ,CAAC,CAAC;YACH,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,GAAG,wCAAwC,CAAC;YACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;gBACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,2CAA2C,CAC5C,CACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,MAAM;QACZ,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,MAAM;YACnB,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrB,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/google-web/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GACrC,+CAA+C,CAAC;AAClD,MAAM,CAAC,MAAM,uBAAuB,GAClC,4CAA4C,CAAC;AAmC/C,MAAM,OAAO,8BAA8B;IAQZ;IALrB,aAAa,GAAyB,IAAI,CAAC;IAC3C,MAAM,GAAkD,IAAI,CAAC;IAC7D,OAAO,GAAkC,IAAI,CAAC;IAC9C,UAAU,GAAG,CAAC,CAAC;IAEvB,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;IAAG,CAAC;IAEvE,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/C,IACE,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/C,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,EAClC,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;gBACpD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,0BAA0B;gBACvD,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;oBACrB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;wBAC3B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,QAAQ,CAAC,iBAAiB;4BACxB,QAAQ,CAAC,KAAK;4BACd,8BAA8B,CACjC,CACF,CAAC;wBACF,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;oBACpE,MAAM,SAAS,GACb,GAAG;wBACH,IAAI,CAAC,GAAG,CACN,CAAC,EACD,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CACpD,CAAC;oBACJ,MAAM,aAAa,GAAG;wBACpB,WAAW,EAAE,QAAQ,CAAC,YAAY;wBAClC,SAAS;qBACV,CAAC;oBACF,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;wBACtD,IAAI,CAAC,MAAM,GAAG;4BACZ,GAAG,aAAa;4BAChB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;yBAChC,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,aAAa,CAAC,CAAC;gBACzB,CAAC;gBACD,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CACxB,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,KAAK,CAAC,IAAI,IAAI,qCAAqC,CACpD,CACF;aACJ,CAAC,CAAC;YACH,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,GAAG,wCAAwC,CAAC;YACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE;gBACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM,CACJ,IAAI,YAAY,CACd,eAAe,EACf,2CAA2C,CAC5C,CACF,CAAC;YACJ,CAAC,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,MAAM;QACZ,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,MAAM;YACnB,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GACT,IAAI,CAAC,OAAO,CAAC,QAAQ;YACrB,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/core/errors.d.ts

@@ -1,4 +1,4 @@
-export type SyncErrorCode = "authorization" | "compatibility" | "configuration" | "crypto" | "decompression" | "key" | "not-found" | "provider" | "serialization" | "state";
+export type SyncErrorCode = "authorization" | "compatibility" | "configuration" | "conflict" | "crypto" | "decompression" | "key" | "not-found" | "provider" | "serialization" | "state";
 export declare class SyncKitError extends Error {
     readonly code: SyncErrorCode;
     readonly status: number | undefined;

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,eAAe,GACf,eAAe,GACf,QAAQ,GACR,eAAe,GACf,KAAK,GACL,WAAW,GACX,UAAU,GACV,eAAe,GACf,OAAO,CAAC;AAEZ,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGlC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;CAOnD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,GACd,YAAY,CAId"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,eAAe,GACf,eAAe,GACf,UAAU,GACV,QAAQ,GACR,eAAe,GACf,KAAK,GACL,WAAW,GACX,UAAU,GACV,eAAe,GACf,OAAO,CAAC;AAgBZ,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGlC,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,YAAY,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;CAOnD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAUpE;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,GACd,YAAY,CAId"}

package/dist/core/errors.js

@@ -1,3 +1,16 @@
+const SYNC_ERROR_CODES = new Set([
+    "authorization",
+    "compatibility",
+    "configuration",
+    "conflict",
+    "crypto",
+    "decompression",
+    "key",
+    "not-found",
+    "provider",
+    "serialization",
+    "state",
+]);
 export class SyncKitError extends Error {
     code;
     status;
@@ -9,7 +22,15 @@ export class SyncKitError extends Error {
     }
 }
 export function isSyncKitError(value) {
-    return value instanceof SyncKitError;
+    if (value instanceof SyncKitError)
+        return true;
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    return (candidate.name === "SyncKitError" &&
+        typeof candidate.message === "string" &&
+        typeof candidate.code === "string" &&
+        SYNC_ERROR_CODES.has(candidate.code));
 }
 export function asSyncKitError(value, code, message) {
     return isSyncKitError(value)

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAgB;IACpB,MAAM,CAAqB;IAEpC,YACE,IAAmB,EACnB,OAAe,EACf,UAA8C,EAAE;QAEhD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,IAAmB,EACnB,OAAe;IAEf,OAAO,cAAc,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAaA,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAgB;IAC9C,eAAe;IACf,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,eAAe;IACf,KAAK;IACL,WAAW;IACX,UAAU;IACV,eAAe;IACf,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAgB;IACpB,MAAM,CAAqB;IAEpC,YACE,IAAmB,EACnB,OAAe,EACf,UAA8C,EAAE;QAEhD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA8D,CAAC;IACjF,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,cAAc;QACjC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;QAClC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAqB,CAAC,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,IAAmB,EACnB,OAAe;IAEf,OAAO,cAAc,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/crypto/canonical.d.ts

@@ -1,3 +1,8 @@
 export declare function canonicalJson(value: unknown): string;
 export declare function canonicalAad(value: unknown): Uint8Array;
+/**
+ * Compares strings by UTF-16 code units so canonicalization is independent of
+ * the host locale and matches Java String.compareTo.
+ */
+export declare function compareUtf16CodeUnits(left: string, right: string): number;
 //# sourceMappingURL=canonical.d.ts.map

package/dist/crypto/canonical.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD"}
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAEvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/dist/crypto/canonical.js

@@ -5,6 +5,13 @@ export function canonicalJson(value) {
 export function canonicalAad(value) {
     return new TextEncoder().encode(canonicalJson(value));
 }
+/**
+ * Compares strings by UTF-16 code units so canonicalization is independent of
+ * the host locale and matches Java String.compareTo.
+ */
+export function compareUtf16CodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
 function canonicalValue(value) {
     if (value === null ||
         typeof value === "string" ||
@@ -22,7 +29,7 @@ function canonicalValue(value) {
     if (typeof value === "object") {
         return Object.fromEntries(Object.entries(value)
             .filter(([, child]) => child !== undefined)
-            .sort(([left], [right]) => left.localeCompare(right))
+            .sort(([left], [right]) => compareUtf16CodeUnits(left, right))
             .map(([key, child]) => [key, canonicalValue(child)]));
     }
     throw new SyncKitError("serialization", `Canonical JSON does not support ${typeof value}.`);

package/dist/crypto/canonical.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,mCAAmC,OAAO,KAAK,GAAG,CACnD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,qDAAqD,CACtD,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,mCAAmC,OAAO,KAAK,GAAG,CACnD,CAAC;AACJ,CAAC"}