@mdbase-dev/connect 0.1.0-beta.23 → 0.1.0-beta.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (23) hide show
  1. package/README.md +26 -8
  2. package/dist/application-identity.d.ts +5 -0
  3. package/dist/application-identity.js +56 -0
  4. package/dist/browser/integrity.json +1 -1
  5. package/dist/browser/mdbase-connect.min.js +3 -3
  6. package/dist/browser/mdbase-connect.min.js.sha384 +1 -1
  7. package/dist/connect-options.d.ts +22 -0
  8. package/dist/connect-options.js +1 -0
  9. package/dist/connect.d.ts +40 -29
  10. package/dist/connect.js +183 -79
  11. package/dist/connection.d.ts +14 -2
  12. package/dist/first-contact-presentation.d.ts +5 -0
  13. package/dist/first-contact-presentation.js +51 -0
  14. package/dist/first-contact.d.ts +14 -0
  15. package/dist/first-contact.js +145 -0
  16. package/dist/index.d.ts +5 -2
  17. package/dist/index.js +4 -1
  18. package/dist/internal-types.d.ts +5 -1
  19. package/dist/mdbase-connect.d.ts +21 -0
  20. package/dist/mdbase-connect.js +42 -0
  21. package/dist/outcomes.d.ts +3 -3
  22. package/dist/outcomes.js +2 -0
  23. package/package.json +2 -2
package/dist/browser/mdbase-connect.min.js CHANGED
@@ -1,3 +1,3 @@
1
- "use strict";var MdbaseConnect=(()=>{var We=Object.defineProperty;var xn=Object.getOwnPropertyDescriptor;var Mn=Object.getOwnPropertyNames;var Fn=Object.prototype.hasOwnProperty;var Un=(n,e)=>{for(var t in e)We(n,t,{get:e[t],enumerable:!0})},Dn=(n,e,t,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Mn(e))!Fn.call(n,i)&&i!==t&&We(n,i,{get:()=>e[i],enumerable:!(o=xn(e,i))||o.enumerable});return n};var zn=n=>Dn(We({},"__esModule",{value:!0}),n);var jo={};Un(jo,{ALL_CONNECT_PROBLEM_CODES:()=>lt,AUTHORIZATION_PROBLEM_CODES:()=>J,COLLECTION_CHANGES_PROBLEM_CODES:()=>ut,COLLECTION_DESCRIPTION_PROBLEM_CODES:()=>ge,COLLECTION_MUTATION_PROBLEM_CODES:()=>S,COLLECTION_QUERY_PROBLEM_CODES:()=>dt,COLLECTION_READ_PROBLEM_CODES:()=>U,COLLECTION_SETUP_PROBLEM_CODES:()=>Yt,COLLECTION_TYPE_PROBLEM_CODES:()=>ae,COMMON_OPERATION_PROBLEM_CODES:()=>Gt,ConnectOutcomeError:()=>ze,DIRECT_ACCESS_PROBLEM_CODES:()=>Le,FileTransferCryptoError:()=>L,GrantFileTransferCipher:()=>ie,IndexedDbGrantKeyStore:()=>te,MdbaseBrowserSelection:()=>Ct,MdbaseCollectionClient:()=>be,MdbaseConnect:()=>vt,MdbaseConnectError:()=>v,MdbaseConnection:()=>ke,MdbaseFileClient:()=>Se,MdbaseMemorySelection:()=>Pt,MdbaseSession:()=>Ae,MemoryGrantKeyStore:()=>ne,NOTIFICATION_PROBLEM_CODES:()=>re,REGISTRATION_PROBLEM_CODES:()=>Y,RelayCryptoError:()=>g,SESSION_PROBLEM_CODES:()=>uo,captureConnectOutcome:()=>P,connectError:()=>c,connectFailure:()=>R,connectProblem:()=>E,connectSuccess:()=>A,createPkce:()=>Ce,decryptRelayResponse:()=>oe,encryptRelayRequest:()=>V,isRetryableConnectError:()=>co,operationProblem:()=>ct,parseMdbaseNativeNotificationData:()=>Bo,parseMdbasePushPayload:()=>In,serverConnectError:()=>x,showMdbasePushNotification:()=>Ko,unknownConnectProblem:()=>st,unwrapConnectOutcome:()=>po});var H={access_denied:{category:"authorization",recovery:"reauthorize"},access_paused:{category:"availability",recovery:"resume_connector_access"},approval_window_blocked:{category:"authorization",recovery:"reauthorize"},authority_authorization_changed:{category:"authorization",recovery:"reauthorize"},authorization_cancelled:{category:"cancellation",recovery:"none"},authorization_expired:{category:"authorization",recovery:"reauthorize"},browser_required:{category:"compatibility",recovery:"none"},callback_url_required:{category:"validation",recovery:"fix_request"},change_cursor_reset:{category:"conflict",recovery:"refresh"},collection_access_denied:{category:"authorization",recovery:"reauthorize"},collection_configuration_invalid:{category:"validation",recovery:"repair_collection"},collection_contracts_missing:{category:"compatibility",recovery:"choose_collection"},collection_incompatible:{category:"compatibility",recovery:"choose_collection"},collection_invalid:{category:"validation",recovery:"repair_collection"},collection_kind_unsupported:{category:"compatibility",recovery:"choose_collection"},collection_mismatch:{category:"selection",recovery:"choose_collection"},collection_not_found:{category:"selection",recovery:"choose_collection"},collection_not_ready:{category:"selection",recovery:"choose_collection"},collection_not_selected:{category:"selection",recovery:"choose_collection"},collection_type_registry_invalid:{category:"validation",recovery:"repair_collection"},collection_version_unsupported:{category:"compatibility",recovery:"upgrade_collection"},concurrent_modification:{category:"conflict",recovery:"refresh"},connector_identity_changed:{category:"integrity",recovery:"reauthorize"},connector_offline:{category:"availability",recovery:"retry"},connector_upgrade_required:{category:"compatibility",recovery:"upgrade_connector"},device_authorization_failed:{category:"authorization",recovery:"reauthorize"},direct_operation_rejected:{category:"authorization",recovery:"reauthorize"},discovery_failed:{category:"availability",recovery:"retry"},encrypted_relay_rejected:{category:"authorization",recovery:"reauthorize"},encryption_required:{category:"authorization",recovery:"reauthorize"},expired_token:{category:"authorization",recovery:"reauthorize"},file_changed_during_move:{category:"conflict",recovery:"refresh"},file_changed_during_read:{category:"conflict",recovery:"refresh"},file_move_failed:{category:"internal",recovery:"contact_support"},file_mutation_conflict:{category:"conflict",recovery:"resolve_conflict"},file_not_found:{category:"conflict",recovery:"refresh"},file_source_mismatch:{category:"conflict",recovery:"refresh"},file_upload_incomplete:{category:"conflict",recovery:"retry"},hosted_provider_unavailable:{category:"availability",recovery:"retry"},insufficient_access:{category:"authorization",recovery:"reauthorize"},invalid_application_manifest:{category:"validation",recovery:"fix_request"},invalid_callback:{category:"validation",recovery:"fix_request"},invalid_device_authorization_response:{category:"integrity",recovery:"contact_support"},invalid_encrypted_response:{category:"integrity",recovery:"contact_support"},invalid_loopback_url:{category:"validation",recovery:"fix_request"},invalid_mutation_id:{category:"validation",recovery:"fix_request"},invalid_operation_response:{category:"integrity",recovery:"contact_support"},invalid_path:{category:"validation",recovery:"fix_request"},invalid_preflight:{category:"conflict",recovery:"refresh"},invalid_push_payload:{category:"validation",recovery:"fix_request"},invalid_push_subscription:{category:"validation",recovery:"fix_request"},invalid_request:{category:"validation",recovery:"fix_request"},invalid_token_response:{category:"integrity",recovery:"contact_support"},managed_fcm_not_declared:{category:"compatibility",recovery:"fix_request"},manifest_load_failed:{category:"availability",recovery:"retry"},manifest_required:{category:"validation",recovery:"fix_request"},missing_grant_key:{category:"authorization",recovery:"reauthorize"},no_pending_mutation:{category:"conflict",recovery:"refresh"},not_authorized:{category:"authorization",recovery:"reauthorize"},not_remote_authority:{category:"compatibility",recovery:"choose_collection"},notification_criterion_not_declared:{category:"validation",recovery:"fix_request"},notification_reauthorization_required:{category:"authorization",recovery:"reauthorize"},notification_registration_failed:{category:"availability",recovery:"retry"},notification_unregistration_failed:{category:"availability",recovery:"retry"},notifications_not_declared:{category:"compatibility",recovery:"fix_request"},notifications_unavailable:{category:"availability",recovery:"retry"},operation_cancelled:{category:"cancellation",recovery:"none"},operation_failed:{category:"internal",recovery:"contact_support"},operation_invalid:{category:"validation",recovery:"fix_request"},operation_outcome_unknown:{category:"conflict",recovery:"resolve_outcome"},path_occupied:{category:"conflict",recovery:"resolve_conflict"},pending_mutation_unresolved:{category:"conflict",recovery:"resolve_outcome"},query_snapshot_changed:{category:"conflict",recovery:"refresh"},rate_limited:{category:"availability",recovery:"retry"},redirect_uri_required:{category:"validation",recovery:"fix_request"},reference_updates_unsupported:{category:"compatibility",recovery:"fix_request"},relay_authorization_expired:{category:"authorization",recovery:"reauthorize"},relay_unavailable:{category:"availability",recovery:"retry"},sandbox_unsupported:{category:"compatibility",recovery:"fix_request"},scope_denied:{category:"authorization",recovery:"reauthorize"},stale_file_revision:{category:"conflict",recovery:"refresh"},storage_required:{category:"compatibility",recovery:"none"},sync_failed:{category:"availability",recovery:"retry"},temporarily_unavailable:{category:"availability",recovery:"retry"},timeout:{category:"availability",recovery:"retry"},token_exchange_failed:{category:"availability",recovery:"retry"},type_pack_provision_failed:{category:"validation",recovery:"repair_collection"},unknown_collection:{category:"selection",recovery:"choose_collection"},unsafe_file_path:{category:"validation",recovery:"fix_request"},unsupported_encryption:{category:"compatibility",recovery:"upgrade_application"},unsupported_operation:{category:"compatibility",recovery:"fix_request"}},Ln={access_denied:{type:"object",required:[],properties:{return_to:{type:"string"}}},approval_window_blocked:{type:"object",required:["user_code","verification_uri","verification_uri_complete","expires_at","interval_seconds"],properties:{user_code:{type:"string"},verification_uri:{type:"string"},verification_uri_complete:{type:"string"},expires_at:{type:"integer"},interval_seconds:{type:"integer"}}},collection_configuration_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_contracts_missing:{type:"object",required:["contracts"],properties:{contracts:{type:"array",items:{type:"object",required:["id","version"],properties:{id:{type:"string"},version:{type:"string"}}}}}},collection_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_type_registry_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_version_unsupported:{type:"object",required:["current_version","required_version"],properties:{current_version:{type:"string"},required_version:{type:"string"}}},connector_offline:{type:"object",required:[],properties:{connector_name:{type:"string"}}},insufficient_access:{type:"object",required:["required_operations","granted_operations","missing_operations"],properties:{required_operations:{type:"array",items:{type:"string"}},granted_operations:{type:"array",items:{type:"string"}},missing_operations:{type:"array",items:{type:"string"}}}},operation_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}},partial_result:{}}},rate_limited:{type:"object",required:[],properties:{retry_after_ms:{type:"integer"}}}};function Rt(n){return Object.hasOwn(H,n)}function he(n){if(!St(n))return!1;let e=n;if(e.problem_version!==1||typeof e.message!="string"||e.message.length===0||e.operation_outcome!==void 0&&e.operation_outcome!=="not_sent"&&e.operation_outcome!=="rejected"&&e.operation_outcome!=="unknown"||e.trace_id!==void 0&&(typeof e.trace_id!="string"||e.trace_id.length===0))return!1;if(e.code==="unknown")return typeof e.server_code=="string"&&e.server_code.length>0&&e.category==="unknown"&&e.recovery==="none";if(typeof e.code!="string"||!Rt(e.code)||e.server_code!==void 0)return!1;let t=H[e.code],o=Ln[e.code],i=o===void 0?e.details===void 0:e.details===void 0?(o.required?.length??0)===0:Ze(e.details,o);return e.category===t.category&&e.recovery===t.recovery&&i}function Ze(n,e){if(e.type===void 0)return!0;if(e.type==="string")return typeof n=="string";if(e.type==="integer")return typeof n=="number"&&Number.isInteger(n);if(e.type==="number")return typeof n=="number"&&Number.isFinite(n);if(e.type==="boolean")return typeof n=="boolean";if(e.type==="array")return Array.isArray(n)&&n.every(o=>Ze(o,e.items??{}));if(!St(n))return!1;if(!e.properties)return!0;let t=n;return!Object.keys(t).every(o=>Object.hasOwn(e.properties,o))||!(e.required??[]).every(o=>Object.hasOwn(t,o))?!1:Object.entries(t).every(([o,i])=>Ze(i,e.properties[o]))}function St(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}function et(n,e,t={}){if(Rt(n)){let o=H[n],i={problem_version:1,code:n,category:o.category,recovery:o.recovery,message:e,...t.details===void 0?{}:{details:t.details},...t.operation_outcome===void 0?{}:{operation_outcome:t.operation_outcome},...t.trace_id===void 0?{}:{trace_id:t.trace_id}};if(he(i))return i}return{problem_version:1,code:"unknown",server_code:n,category:"unknown",recovery:"none",message:e,...t.details===void 0?{}:{details:t.details},...t.operation_outcome===void 0?{}:{operation_outcome:t.operation_outcome},...t.trace_id===void 0?{}:{trace_id:t.trace_id}}}var kt=new Uint8Array([77,68,66,70]),Ot=1,At=0,Vo=new Uint8Array([77,68,66,82]);var Tt=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,y=class extends Error{code;constructor(e,t){super(t),this.code=e,this.name="FileFrameError"}};function Nn(n){return n==="upload_chunk"?1:2}function qn(n){if(n===1)return"upload_chunk";if(n===2)return"download_chunk";throw new y("invalid_kind",`Unknown file frame kind ${n}`)}function Bn(n){if(!n||typeof n!="object"||Array.isArray(n))throw new y("invalid_header","File frame header must be a JSON object");return n}function Ee(n,e){let t=n[e];if(typeof t!="string"||t.length===0)throw new y("invalid_header",`File frame header ${e} must be a non-empty string`);return t}function Ie(n,e){let t=Ee(n,e);if(!Tt.test(t))throw new y("invalid_header",`File frame header ${e} must be a UUID`);return t}function $(n,e,t=Number.MAX_SAFE_INTEGER){let o=n[e];if(!Number.isSafeInteger(o)||o<0||o>t)throw new y("invalid_header",`File frame header ${e} is outside its allowed range`);return o}function tt(n){if(n.protocol_version!==1)throw new y("unsupported_version",`Unsupported file transfer protocol ${n.protocol_version}`);if(n.protection!=="grant_aead_v1"&&n.protection!=="transport_tls")throw new y("invalid_header","Unknown file transfer protection");if(n.direction!=="upload"&&n.direction!=="download")throw new y("invalid_header","Unknown file transfer direction");for(let[e,t]of[["grant_id",n.grant_id],["authority_id",n.authority_id],["collection_id",n.collection_id],["transfer_id",n.transfer_id]])if(!Tt.test(t))throw new y("invalid_header",`File frame header ${e} must be a UUID`);for(let[e,t,o]of[["chunk_size",n.chunk_size,4194304],["chunk_index",n.chunk_index,Number.MAX_SAFE_INTEGER],["offset",n.offset,Number.MAX_SAFE_INTEGER],["plaintext_length",n.plaintext_length,4194304],["total_size",n.total_size,Number.MAX_SAFE_INTEGER]])if(!Number.isSafeInteger(t)||t<0||t>o)throw new y("invalid_header",`File frame header ${e} is outside its allowed range`);if(n.chunk_size<64*1024)throw new y("invalid_header","File frame chunk_size is below the protocol minimum");if(!Number.isSafeInteger(n.scope_epoch)||n.scope_epoch<1)throw new y("invalid_header","File frame header scope_epoch must be a positive integer");if(n.protection==="grant_aead_v1"&&!n.key_id)throw new y("invalid_header","AEAD-protected file frames require key_id");return{protocol_version:1,protection:n.protection,grant_id:n.grant_id,authority_id:n.authority_id,collection_id:n.collection_id,transfer_id:n.transfer_id,direction:n.direction,chunk_size:n.chunk_size,chunk_index:n.chunk_index,offset:n.offset,plaintext_length:n.plaintext_length,total_size:n.total_size,scope_epoch:n.scope_epoch,...n.key_id===void 0?{}:{key_id:n.key_id}}}function Kn(n){let e;try{e=new TextDecoder("utf-8",{fatal:!0}).decode(n)}catch{throw new y("invalid_header","File frame header is not valid UTF-8")}let t;try{t=Bn(JSON.parse(e))}catch(d){throw d instanceof y?d:new y("invalid_header","File frame header is not valid JSON")}let o=new Set(["protocol_version","protection","grant_id","authority_id","collection_id","transfer_id","direction","chunk_size","chunk_index","offset","plaintext_length","total_size","scope_epoch","key_id"]);if(Object.keys(t).some(d=>!o.has(d)))throw new y("invalid_header","File frame header contains an unknown field");let i=$(t,"protocol_version");if(i!==1)throw new y("unsupported_version",`Unsupported file transfer protocol ${i}`);let r=Ee(t,"protection"),a=Ee(t,"direction"),s=t.key_id===void 0?void 0:Ee(t,"key_id"),l=tt({protocol_version:1,protection:r,grant_id:Ie(t,"grant_id"),authority_id:Ie(t,"authority_id"),collection_id:Ie(t,"collection_id"),transfer_id:Ie(t,"transfer_id"),direction:a,chunk_size:$(t,"chunk_size",4194304),chunk_index:$(t,"chunk_index"),offset:$(t,"offset"),plaintext_length:$(t,"plaintext_length",4194304),total_size:$(t,"total_size"),scope_epoch:$(t,"scope_epoch"),...s===void 0?{}:{key_id:s}});if(JSON.stringify(l)!==e)throw new y("invalid_header","File frame header must use the canonical field order without duplicate fields or whitespace");return l}function nt(n,e,t){let o=n==="upload_chunk"?"upload":"download";if(e.direction!==o)throw new y("invalid_header",`Frame kind ${n} requires direction ${o}`);let i=e.chunk_index*e.chunk_size;if(!Number.isSafeInteger(i)||e.offset!==i)throw new y("invalid_header","Chunk offset does not match its index and protocol chunk size");if(e.offset+e.plaintext_length>e.total_size)throw new y("invalid_header","Chunk extends past the declared transfer size");let r=e.protection==="grant_aead_v1"?e.plaintext_length+16:e.plaintext_length;if(t!==r)throw new y("invalid_length","Payload length does not match the protected plaintext length")}function jn(n){return n.plaintext_length+(n.protection==="grant_aead_v1"?16:0)}function xe(n,e){let t=tt(e),o=jn(t);nt(n,t,o);let i=new TextEncoder().encode(JSON.stringify(t));if(i.byteLength>16384)throw new y("limit_exceeded","File frame header exceeds the protocol limit");let r=new Uint8Array(16+i.byteLength);r.set(kt,0);let a=new DataView(r.buffer,r.byteOffset,r.byteLength);return a.setUint8(4,Ot),a.setUint8(5,Nn(n)),a.setUint16(6,At,!1),a.setUint32(8,i.byteLength,!1),a.setUint32(12,o,!1),r.set(i,16),r}function It(n){let e=tt(n.header);if(nt(n.kind,e,n.payload.byteLength),n.payload.byteLength>4194320)throw new y("limit_exceeded","File frame payload exceeds the protocol limit");let t=xe(n.kind,e),o=new Uint8Array(t.byteLength+n.payload.byteLength);return o.set(t,0),o.set(n.payload,t.byteLength),o}function Me(n,e={}){if(n.byteLength<16)throw new y("invalid_length","File frame is shorter than its fixed prefix");if(!kt.every((f,h)=>n[h]===f))throw new y("invalid_magic","File frame magic is not MDBF");let t=new DataView(n.buffer,n.byteOffset,n.byteLength),o=t.getUint8(4);if(o!==Ot)throw new y("unsupported_version",`Unsupported file frame version ${o}`);let i=qn(t.getUint8(5));if(t.getUint16(6,!1)!==At)throw new y("unsupported_flags","File frame uses unsupported flags");let r=t.getUint32(8,!1),a=t.getUint32(12,!1),s=e.maxHeaderBytes??16384,l=e.maxPayloadBytes??4194320;if(r===0)throw new y("invalid_length","File frame header must not be empty");if(r>s||a>l)throw new y("limit_exceeded","File frame exceeds the configured decode limits");let d=16+r+a;if(!Number.isSafeInteger(d)||d!==n.byteLength)throw new y("invalid_length","File frame lengths do not match the supplied bytes");let u=16+r,p=Kn(n.subarray(16,u));return nt(i,p,a),{kind:i,header:p,payload:n.slice(u)}}var ee=1;var Et=28485,fe="P256-HKDF-SHA256-AES256GCM";var Hn="contract-setup-v1",$n="file-relay-v1",Vn=["authorization-activation","encrypted-relay","policy-ack"],Yo=[...Vn,Hn,$n],ot=1;var xt="mdbase-authority-request-proof-v1",ye={version:"x-mdbase-proof-version",timestamp:"x-mdbase-proof-timestamp",nonce:"x-mdbase-proof-nonce",signature:"x-mdbase-proof-signature"};var Gn="mdbase-connect-keys",j="grant-keys",rt=18446744073709551615n,Yn="mdbase-connect relay request key v1",Jn="mdbase-connect relay response key v1",Mt=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,te=class{database=null;async create(e){let t=await zt(e),o=await this.open();return await Ut(o,i=>i.add({...t,counter:"0"})),t}async get(e){let t=await this.open(),o=await eo(t.transaction(j).objectStore(j).get(e));return o?{handle:o.handle,agreementPrivateKey:o.agreementPrivateKey,agreementPublicKey:o.agreementPublicKey,signingPrivateKey:o.signingPrivateKey,signingPublicKey:o.signingPublicKey}:null}async nextCounter(e){let t=await this.open();return new Promise((o,i)=>{let r=t.transaction(j,"readwrite"),a=r.objectStore(j),s=a.get(e),l=null;s.onerror=()=>i(s.error),s.onsuccess=()=>{let d=s.result;if(!d){r.abort(),i(new g("missing_grant_key","The encrypted grant key is unavailable."));return}let u=BigInt(d.counter)+1n;if(u>rt){r.abort(),i(new g("counter_exhausted","The encrypted grant must be authorized again."));return}l=u.toString(),a.put({...d,counter:l})},r.onerror=()=>i(r.error),r.onabort=()=>i(r.error??new Error("Key counter transaction aborted.")),r.oncomplete=()=>{l&&o(l)}})}async delete(e){let t=await this.open();await Ut(t,o=>o.delete(e))}open(){if(typeof indexedDB>"u")throw new g("key_storage_unavailable","Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");return this.database||(this.database=new Promise((e,t)=>{let o=indexedDB.open(Gn,1);o.onupgradeneeded=()=>{o.result.objectStoreNames.contains(j)||o.result.createObjectStore(j,{keyPath:"handle"})},o.onerror=()=>t(o.error),o.onsuccess=()=>e(o.result)})),this.database}},ne=class{records=new Map;sequence=Promise.resolve();async create(e){if(this.records.has(e))throw new Error(`Grant key already exists: ${e}`);let t=await zt(e);return this.records.set(e,{...t,counter:"0"}),t}async get(e){let t=this.records.get(e);return t?{handle:t.handle,agreementPrivateKey:t.agreementPrivateKey,agreementPublicKey:t.agreementPublicKey,signingPrivateKey:t.signingPrivateKey,signingPublicKey:t.signingPublicKey}:null}nextCounter(e){let t,o,i=new Promise((r,a)=>{t=r,o=a});return this.sequence=this.sequence.then(()=>{let r=this.records.get(e);if(!r)throw new g("missing_grant_key","The encrypted grant key is unavailable.");let a=BigInt(r.counter)+1n;if(a>rt)throw new g("counter_exhausted","The encrypted grant must be authorized again.");r.counter=a.toString(),t(r.counter)}).catch(r=>{o(r)}),i}async delete(e){this.records.delete(e)}};async function Dt(n,e,t,o){let i=await Xn(n,e,t),r=o.timestamp??Math.floor(Date.now()/1e3),a=o.nonce??crypto.randomUUID(),s=await Qn({...o,timestamp:r,nonce:a}),l=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},i.signingPrivateKey,new TextEncoder().encode(s));return{[ye.version]:String(ot),[ye.timestamp]:String(r),[ye.nonce]:a,[ye.signature]:me(new Uint8Array(l))}}async function Qn(n){let e=n.method.toUpperCase(),t=await Ft(n.body??""),o=await Ft(n.credential);for(let i of[e,n.target,String(n.timestamp),n.nonce])if(!i||i.includes(`
2
- `)||i.includes("\r"))throw new g("invalid_proof_input","Authority request proof metadata is invalid.");return[xt,ot,e,n.target,t,o,n.timestamp,n.nonce].join(`
3
- `)}async function V(n,e,t,o,i,r=crypto.randomUUID()){G(t.encryption);let a=await Lt(n,e,t.encryption.application_agreement_public_key),s=await n.nextCounter(e),l={binding:t,requestId:r,operation:o,counter:s},d=await Nt(a.agreementPrivateKey,t,"request"),u=new TextEncoder().encode(JSON.stringify(i??{})),p=await crypto.subtle.encrypt({name:"AES-GCM",iv:Kt(s),additionalData:new TextEncoder().encode(Bt(l,"request")),tagLength:128},d,u);return{type:"encrypted_operation_request",...Wn(l),ciphertext:me(new Uint8Array(p))}}async function oe(n,e,t,o,i){if(!Zn(o,i))throw new g("invalid_encrypted_response","Encrypted response metadata does not match its request.");let r=await Lt(n,e,t.encryption.application_agreement_public_key),a={binding:t,requestId:o.request_id,operation:o.operation,counter:o.counter},s=await Nt(r.agreementPrivateKey,t,"response");try{let l=await crypto.subtle.decrypt({name:"AES-GCM",iv:Kt(o.counter),additionalData:new TextEncoder().encode(Bt(a,"response")),tagLength:128},s,Ht(jt(i.ciphertext))),d=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(l));if(d?.ok===!0&&"result"in d||d?.ok===!1&&he(d.problem))return d;throw new Error("invalid response body")}catch(l){throw l instanceof g?l:new g("encrypted_response_rejected","The encrypted connector response could not be authenticated.")}}var g=class extends Error{constructor(t,o){super(o);this.code=t}code};async function zt(n){let e=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveBits"]),t=me(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),o=await crypto.subtle.exportKey("pkcs8",e.privateKey),i=await crypto.subtle.importKey("pkcs8",o,{name:"ECDH",namedCurve:"P-256"},!1,["deriveBits"]),r=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),a=me(new Uint8Array(await crypto.subtle.exportKey("raw",r.publicKey))),s=await crypto.subtle.exportKey("pkcs8",r.privateKey),l=await crypto.subtle.importKey("pkcs8",s,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:n,agreementPrivateKey:i,agreementPublicKey:t,signingPrivateKey:l,signingPublicKey:a}}async function Lt(n,e,t){let o=await n.get(e);if(!o||o.agreementPublicKey!==t)throw new g("missing_grant_key","The encrypted grant key is unavailable or does not match the grant.");return o}async function Xn(n,e,t){let o=await n.get(e);if(!o||o.signingPublicKey!==t)throw new g("missing_grant_key","The remote authority signing key is unavailable or does not match the grant.");return o}async function Nt(n,e,t){let o=await at(n,e.encryption.connector_agreement_public_key),i=await crypto.subtle.importKey("raw",o,"HKDF",!1,["deriveKey"]),r=new TextEncoder().encode(qt(e)),a=await crypto.subtle.digest("SHA-256",r);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:a,info:new TextEncoder().encode(t==="request"?Yn:Jn)},i,{name:"AES-GCM",length:256},!1,t==="request"?["encrypt"]:["decrypt"])}async function at(n,e){try{let t=await crypto.subtle.importKey("raw",Ht(it(e)),{name:"ECDH",namedCurve:"P-256"},!1,[]);return await crypto.subtle.deriveBits({name:"ECDH",public:t},n,256)}catch{throw new g("invalid_public_key","The connector relay public key is invalid.")}}function qt(n){let e=n.encryption;return["mdbase-connect",ee,e.suite,n.grantId,n.applicationId,e.connector_id,e.collection_id,e.scope_epoch,e.key_id].join("|")}function Bt(n,e){return[qt(n.binding),n.requestId,e,n.operation,n.counter].join("|")}function Wn(n){let e=n.binding.encryption;return{protocol_version:ee,suite:fe,request_id:n.requestId,grant_id:n.binding.grantId,application_id:n.binding.applicationId,connector_id:e.connector_id,collection_id:e.collection_id,operation:n.operation,scope_epoch:e.scope_epoch,key_id:e.key_id,counter:n.counter}}function Zn(n,e){return e.type==="encrypted_operation_response"&&typeof e.ciphertext=="string"&&n.protocol_version===e.protocol_version&&n.suite===e.suite&&n.request_id===e.request_id&&n.grant_id===e.grant_id&&n.application_id===e.application_id&&n.connector_id===e.connector_id&&n.collection_id===e.collection_id&&n.operation===e.operation&&n.scope_epoch===e.scope_epoch&&n.key_id===e.key_id&&n.counter===e.counter}function G(n){if(n.protocol_version!==ee||n.suite!==fe||!Number.isSafeInteger(n.scope_epoch)||n.scope_epoch<=0||typeof n.key_id!="string"||n.key_id.length===0||n.key_id.length>200||n.key_id.includes("|"))throw new g("unsupported_encryption","The grant uses an unsupported relay encryption profile.");if(typeof n.connector_id!="string"||!Mt.test(n.connector_id)||typeof n.collection_id!="string"||!Mt.test(n.collection_id))throw new g("unsupported_encryption","The grant uses invalid encrypted relay identities.");it(n.application_agreement_public_key),it(n.connector_agreement_public_key)}function Kt(n){let e=BigInt(n);if(e<=0n||e>rt||e.toString()!==n)throw new g("invalid_counter","The encrypted relay counter is invalid.");let t=new Uint8Array(new ArrayBuffer(12));return new DataView(t.buffer).setBigUint64(4,e,!1),t}function me(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}async function Ft(n){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(n));return me(new Uint8Array(e))}function jt(n){if(!/^[A-Za-z0-9_-]+$/.test(n))throw new g("invalid_base64","Encrypted relay data is malformed.");let e="=".repeat((4-n.length%4)%4),t=atob(n.replaceAll("-","+").replaceAll("_","/")+e);return Uint8Array.from(t,o=>o.charCodeAt(0))}function it(n){let e=jt(n);if(e.length!==65||e[0]!==4)throw new g("invalid_public_key","Encrypted relay public keys must be uncompressed P-256 points.");return e}function Ht(n){return Uint8Array.from(n).buffer}function eo(n){return new Promise((e,t)=>{n.onerror=()=>t(n.error),n.onsuccess=()=>e(n.result)})}function Ut(n,e){return new Promise((t,o)=>{let i=n.transaction(j,"readwrite"),r=e(i.objectStore(j));r.onerror=()=>o(r.error),i.onerror=()=>o(i.error),i.onabort=()=>o(i.error??new Error("Grant key transaction aborted.")),i.oncomplete=()=>t()})}var to="mdbase-connect file chunk key v1",Fe=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,L=class extends Error{constructor(t,o){super(o);this.code=t;this.name="FileTransferCryptoError"}code},ie=class n{constructor(e,t){this.binding=e;this.key=t}binding;key;static async open(e,t,o){$t(o);let i=await e.get(t);if(!i||i.agreementPublicKey!==o.encryption.application_agreement_public_key)throw new g("missing_grant_key","The encrypted grant key is unavailable or does not match the file transfer grant.");let r=await at(i.agreementPrivateKey,o.encryption.connector_agreement_public_key);return n.fromSharedSecret(r,o)}static async fromSharedSecret(e,t){$t(t);let o=await no(e,t);return new n(t,o)}async encryptChunk(e,t,o){if(this.validateHeader(t),o.byteLength!==t.plaintext_length)throw new L("plaintext_length_mismatch","File chunk plaintext length does not match its authenticated header.");let i=xe(e,t),r=await crypto.subtle.encrypt({name:"AES-GCM",iv:Vt(t.chunk_index),additionalData:Ue(i),tagLength:128},this.key,Ue(o));return It({kind:e,header:t,payload:new Uint8Array(r)})}async decryptChunk(e){let t=Me(e);this.validateHeader(t.header);let o=xe(t.kind,t.header);try{let i=await crypto.subtle.decrypt({name:"AES-GCM",iv:Vt(t.header.chunk_index),additionalData:Ue(o),tagLength:128},this.key,Ue(t.payload));return new Uint8Array(i)}catch{throw new L("authentication_failed","The encrypted file chunk could not be authenticated.")}}validateHeader(e){let t=this.binding.encryption;if(e.protocol_version!==1||e.protection!=="grant_aead_v1"||e.grant_id!==this.binding.grantId||e.authority_id!==this.binding.authorityId||e.collection_id!==t.collection_id||e.transfer_id!==this.binding.transferId||e.direction!==this.binding.direction||e.scope_epoch!==t.scope_epoch||e.key_id!==t.key_id)throw new L("header_binding_mismatch","The file frame does not match its transfer encryption binding.")}};async function no(n,e){let t=new TextEncoder().encode(oo(e)),o=await crypto.subtle.digest("SHA-256",t),i=await crypto.subtle.importKey("raw",n,"HKDF",!1,["deriveKey"]);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:o,info:new TextEncoder().encode(to)},i,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}function $t(n){if(G(n.encryption),!Fe.test(n.grantId)||!Fe.test(n.applicationId)||!Fe.test(n.authorityId)||!Fe.test(n.transferId)||n.direction!=="upload"&&n.direction!=="download")throw new L("invalid_binding","The file transfer encryption binding is invalid.")}function oo(n){let e=n.encryption;return["mdbase-connect","file-transfer",1,e.suite,n.grantId,n.applicationId,e.connector_id,n.authorityId,e.collection_id,e.scope_epoch,e.key_id,n.transferId,n.direction].join("|")}function Vt(n){if(!Number.isSafeInteger(n)||n<0)throw new L("invalid_chunk_index","The file chunk index is invalid.");let e=new Uint8Array(new ArrayBuffer(12));return new DataView(e.buffer).setBigUint64(4,BigInt(n),!1),e}function Ue(n){return Uint8Array.from(n).buffer}function _e(n,e){return new Promise((t,o)=>{if(e?.aborted){o(e.reason??new DOMException("Aborted","AbortError"));return}let i=setTimeout(t,n);e?.addEventListener("abort",()=>{clearTimeout(i),o(e.reason??new DOMException("Aborted","AbortError"))},{once:!0})})}var v=class extends Error{constructor(t,o={}){super(t.message,o.cause===void 0?void 0:{cause:o.cause});this.problem=t;this.name="MdbaseConnectError",this.code=t.code,this.status=o.status}problem;code;status;get retryable(){return this.problem.recovery==="retry"&&this.problem.operation_outcome!=="unknown"}get requiresAuthorization(){return this.problem.category==="authorization"}get outcomeUnknown(){return this.problem.operation_outcome==="unknown"}get recovery(){return this.problem.recovery}get details(){return this.problem.details}};function E(n,e,...[t={}]){let o=H[n];return{problem_version:1,code:n,category:o.category,recovery:o.recovery,message:e,...t.details===void 0?{}:{details:t.details},...t.operationOutcome===void 0?{}:{operation_outcome:t.operationOutcome},...t.traceId===void 0?{}:{trace_id:t.traceId}}}function st(n,e,t={}){return et(n,e,{details:t.details,operation_outcome:t.operationOutcome,trace_id:t.traceId})}function c(n,e,...t){let o=t[0];return new v(E(n,e,...t),{status:o?.status,cause:o?.cause})}function x(n,e,t={}){let{status:o,cause:i,...r}=t;return new v(et(n,e,{details:r.details,operation_outcome:r.operationOutcome,trace_id:r.traceId}),{status:o,cause:i})}function ct(n){let e=ro(n.diagnostics),t=lo(n.diagnostics);if(e==="collection_version_unsupported"){let o=ao(n.diagnostics);return E(e,t,{operationOutcome:"rejected",details:o})}return e!=="operation_invalid"?E(e,t,{operationOutcome:"rejected",details:{diagnostics:n.diagnostics}}):E(e,t,{operationOutcome:"rejected",details:{diagnostics:n.diagnostics,partial_result:n.result}})}function ro(n){let e=new Set(n.filter(t=>t.severity==="error").map(t=>t.code));return["migration_required","migration_lossy","unsupported_version"].some(t=>e.has(t))?"collection_version_unsupported":["invalid_config","invalid_configuration","missing_config","missing_spec_version"].some(t=>e.has(t))?"collection_configuration_invalid":["duplicate_type","invalid_contract_definition","invalid_data_contract","invalid_type_definition","invalid_type_path"].some(t=>e.has(t))?"collection_type_registry_invalid":["collection_invalid","collection_open_failed"].some(t=>e.has(t))?"collection_invalid":"operation_invalid"}function ao(n){let e=n.map(t=>t.details).find(t=>so(t));return{current_version:typeof e?.current_version=="string"?e.current_version:"0.2.x",required_version:typeof e?.required_version=="string"?e.required_version:"0.3.0"}}function so(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}function co(n){return n instanceof v&&n.retryable}function lo(n){return n.filter(e=>e.severity==="error").map(e=>e.message).join(" ")||n.map(e=>e.message).join(" ")||"The collection rejected this operation."}var Gt=["access_denied","access_paused","authorization_expired","collection_access_denied","connector_identity_changed","connector_offline","connector_upgrade_required","direct_operation_rejected","operation_outcome_unknown","encryption_required","encrypted_relay_rejected","hosted_provider_unavailable","insufficient_access","invalid_encrypted_response","invalid_operation_response","invalid_request","missing_grant_key","not_authorized","operation_cancelled","operation_failed","rate_limited","relay_authorization_expired","relay_unavailable","temporarily_unavailable","timeout","unsupported_operation"],lt=Object.keys(H),Y=["discovery_failed","invalid_application_manifest","invalid_request","manifest_load_failed","rate_limited","temporarily_unavailable","timeout"],J=[...Y,"access_denied","approval_window_blocked","authorization_cancelled","browser_required","collection_access_denied","collection_configuration_invalid","collection_contracts_missing","collection_incompatible","collection_invalid","collection_kind_unsupported","collection_mismatch","collection_not_found","collection_type_registry_invalid","collection_version_unsupported","connector_identity_changed","connector_offline","connector_upgrade_required","device_authorization_failed","encryption_required","expired_token","invalid_callback","invalid_device_authorization_response","invalid_token_response","scope_denied","token_exchange_failed"],re=[...Y,"authorization_expired","invalid_push_subscription","managed_fcm_not_declared","not_authorized","notification_criterion_not_declared","notification_reauthorization_required","notification_registration_failed","notification_unregistration_failed","notifications_not_declared","notifications_unavailable"],Le=["connector_offline","connector_upgrade_required","invalid_operation_response","not_authorized","operation_failed","temporarily_unavailable","timeout"],uo=[...J,"collection_not_ready","collection_not_selected","unknown_collection"],Yt=["collection_configuration_invalid","collection_invalid","collection_type_registry_invalid","collection_version_unsupported"],ge=[...Gt,...Yt],U=[...ge,"invalid_path","operation_invalid"],dt=[...U,"query_snapshot_changed","sandbox_unsupported"],S=[...U,"concurrent_modification","invalid_preflight","pending_mutation_unresolved"],ut=[...ge,"change_cursor_reset"],ae=[...S,"type_pack_provision_failed"];function A(n,e=[]){return{ok:!0,value:n,diagnostics:e}}function R(n){return{ok:!1,problem:n}}async function P(n,e){try{return A(await n())}catch(t){if(!(t instanceof v))throw t;let o=t.problem;return o.code==="unknown"||e.includes(o.code)?R(o):R(st(o.code,o.message,{details:o.details,operationOutcome:o.operation_outcome,traceId:o.trace_id}))}}var ze=class extends Error{constructor(t){super(t.message);this.problem=t;this.name="ConnectOutcomeError"}problem};function po(n){if(!n.ok)throw new ze(n.problem);return n.value}var be=class{constructor(e){this.transport=e}transport;operation(e,t,o){return P(()=>this.transport.operation(e,t,o),lt)}describe(){return this.rawOperation("describe",{},ge)}changes(e={},t){return this.rawOperation("changes",e,ut,t)}read(e){return this.envelopeOperation("read",e,U)}query(e={},t){return this.envelopeOperation("query",e,dt,t)}async*queryPages(e={},t={}){let{offset:o,limit:i,snapshot:r,...a}=e,s=fo(o,0),l=Jt(t.firstPageSize??i,200),d=Jt(t.pageSize??i,1e3),u=r,p=0,f=0;for(;!t.signal?.aborted;){let h=await this.query({...a,offset:s,limit:f===0?l:d,...u?{snapshot:u}:{}},{signal:t.signal});if(!h.ok){yield h;return}let m=h.value,_=m.meta?.snapshot;if(u&&_&&u!==_){yield R(E("query_snapshot_changed","The collection query snapshot changed while paging. Refresh the query before continuing."));return}!u&&_&&(u=_),p+=m.results.length;let w=!m.meta?.has_more||m.results.length===0,b={results:m.results,...m.meta?{meta:m.meta}:{},page:f,offset:s,loaded:p,complete:w,...u?{snapshot:u}:{}};if(t.onProgress?.(b),yield A(b,h.diagnostics),w)return;s+=m.results.length,f+=1}}async queryAll(e={},t={}){let o=[],i,r=[];for await(let a of this.queryPages(e,t)){if(!a.ok)return a;let s=a.value;o.push(...s.results),i=s,r.push(...a.diagnostics)}return A({results:o,meta:{...i?.meta??{},total_count:i?.meta?.total_count??o.length,has_more:i?!i.complete:!1,...i?.snapshot?{snapshot:i.snapshot}:{}}},r)}listViews(){return this.envelopeOperation("list_views",{},U)}executeView(e){return this.envelopeOperation("execute_view",e,U)}readViewSource(e){return this.envelopeOperation("read_view_source",e,U)}createViewSource(e){return this.envelopeOperation("create_view_source",e,S)}updateViewSource(e){return this.envelopeOperation("update_view_source",e,S)}deleteViewSource(e){return this.envelopeOperation("delete_view_source",e,S)}create(e){return this.envelopeOperation("create",e,S)}update(e){return this.envelopeOperation("update",e,S)}delete(e,t){return this.envelopeOperation("delete",e,S,t)}preflightDelete(e,t){return this.envelopeOperation("delete",{...e,check_backlinks:!0,dry_run:!0},S,t)}rename(e,t){return this.envelopeOperation("rename",e,S,t)}preflightRename(e,t){return this.envelopeOperation("rename",{...e,dry_run:!0},S,t)}validate(e={}){return this.envelopeOperation("validate",e,U)}readType(e){return this.envelopeOperation("read_type",e,ae)}createType(e){return this.envelopeOperation("create_type",e,ae)}updateType(e){return this.envelopeOperation("update_type",e,ae)}installTypePack(e){return this.envelopeOperation("install_type_pack",e,ae)}listTimers(e){return this.rawOperation("list_timers",{namespace:e},U)}putTimer(e){return this.rawOperation("put_timer",e,S)}cancelTimer(e){return this.rawOperation("cancel_timer",e,S)}reconcileTimers(e){return this.rawOperation("reconcile_timers",e,S)}async*watch(e={}){let t=e.cursor,o=Math.max(100,e.pollIntervalMs??1e3),i=ho(e.retry),r=0,a=!1;for(e.onStatus?.({state:"connecting",...t===void 0?{}:{cursor:t}});!e.signal?.aborted;){let s=await this.changes(t===void 0?{}:{after:t,limit:200},{signal:e.signal});if(!s.ok){let u=s.problem;if(e.signal?.aborted)return;if(!i||u.recovery!=="retry"){yield s;return}if(a=!1,r+=1,i.maxAttempts!==void 0&&r>i.maxAttempts){yield s;return}let p=Math.min(i.maxDelayMs,Math.round(i.initialDelayMs*i.multiplier**(r-1)));e.onStatus?.({state:"reconnecting",...t===void 0?{}:{cursor:t},attempt:r,retryInMs:p,problem:u});try{await _e(p,e.signal)}catch{if(!e.signal?.aborted)throw c("operation_failed","Watch retry delay failed unexpectedly.")}continue}let l=s.value;if(t===void 0){t=l.cursor;continue}if(l.reset){let u=E("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again.");e.onStatus?.({state:"reset_required",cursor:t,problem:u}),yield R(u);return}let d=r>0;r=0,(!a||d)&&e.onStatus?.({state:"connected",cursor:t,recovered:d}),a=!0;for(let u of l.events)yield A(u);if(t=l.cursor,!l.has_more)try{await _e(o,e.signal)}catch{if(!e.signal?.aborted)throw c("operation_failed","Watch polling delay failed unexpectedly.")}}}rawOperation(e,t,o,i){return P(()=>this.transport.operation(e,t,i),o)}async envelopeOperation(e,t,o,i){let r=await P(()=>this.transport.operation(e,t,i),o);if(!r.ok)return r;let a=r.value;return a.valid?A(a.result,a.diagnostics):R(ct(a))}};function ho(n){if(n!==!1)return{initialDelayMs:Math.max(0,n?.initialDelayMs??500),maxDelayMs:Math.max(0,n?.maxDelayMs??15e3),multiplier:Math.max(1,n?.multiplier??2),...n?.maxAttempts===void 0?{}:{maxAttempts:Math.max(0,n.maxAttempts)}}}function fo(n,e){return typeof n=="number"&&Number.isFinite(n)?Math.max(0,Math.floor(n)):e}function Jt(n,e){return typeof n=="number"&&Number.isFinite(n)&&n>0?Math.floor(n):e}function N(n){let e=new Uint8Array(n);return crypto.getRandomValues(e),ve(e)}function ve(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function Qt(n){let e=n.replaceAll("-","+").replaceAll("_","/").padEnd(Math.ceil(n.length/4)*4,"="),t=atob(e),o=new Uint8Array(new ArrayBuffer(t.length));for(let i=0;i<t.length;i+=1)o[i]=t.charCodeAt(i);return o}function Q(n){return{...n,credentials:"omit",targetAddressSpace:"loopback"}}async function we(){if(typeof navigator>"u"||!navigator.permissions?.query)return null;try{return(await navigator.permissions.query({name:"local-network-access"})).state}catch{return null}}function se(n){return n===404||n===405||n===426||n>=500}function Ne(n,e){return e&&typeof e=="object"&&!Array.isArray(e)&&e.dry_run===!0?!1:n==="sync"&&e!==null&&typeof e=="object"&&!Array.isArray(e)&&e.action==="mutate"||n==="create"||n==="update"||n==="delete"||n==="rename"||n==="create_type"||n==="update_type"||n==="install_type_pack"||n==="put_timer"||n==="cancel_timer"||n==="reconcile_timers"}function D(n){return[...new Set(n)]}function Xt(n,e){return n.grantId||e.grantId?n.grantId===e.grantId&&n.keyHandle===e.keyHandle&&n.encryption?.key_id===e.encryption?.key_id:n.accessToken===e.accessToken}function X(n){if(n?.aborted)throw c("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:n.reason})}function ht(n,e,t,o){return n instanceof v?n:e?.aborted?t?M(n):c("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:n}):t?M(n):n instanceof TypeError?c(o,o==="hosted_provider_unavailable"?"The hosted collection provider is unavailable.":"The Connect relay is unavailable.",{cause:n}):n instanceof Error?n:new Error(String(n))}function ft(n,e){return e?.aborted===!0||n instanceof v&&n.code==="operation_cancelled"}function Wt(n,e){if(e.dry_run!==!0||e.would_rename!==!0||e.from!==n.from||e.to!==n.to)throw c("invalid_preflight","The rename preview does not match this mutation. Run the preview again.")}function Zt(n,e){if(e.dry_run!==!0||e.would_delete!==!0||e.path!==n.path)throw c("invalid_preflight","The delete preview does not match this mutation. Run the preview again.")}function en(n,e){if(n.update_refs===!1)return{affectedRecords:0,totalUnits:1,warnings:0};let t=e.references_affected??[];return{affectedRecords:new Set(t.map(o=>o.path)).size,totalUnits:1+t.length,warnings:e.warnings?.length??0}}function tn(n){return{affectedRecords:new Set((n.broken_links??[]).map(e=>e.path)).size,totalUnits:1,warnings:0}}async function nn(n,e){let t=new TextEncoder().encode(`${n}\0${yt(e??{})}`),o=await crypto.subtle.digest("SHA-256",t);return ve(new Uint8Array(o))}function yt(n){return JSON.stringify(pt(n))}function pt(n){return Array.isArray(n)?n.map(e=>pt(e)):n&&typeof n=="object"?Object.fromEntries(Object.entries(n).filter(([,e])=>e!==void 0).sort(([e],[t])=>e<t?-1:e>t?1:0).map(([e,t])=>[e,pt(t)])):n}function M(n){return c("operation_outcome_unknown","The write may have completed, but mdbase could not recover its authoritative result. Retry the exact same write to recover safely.",{operationOutcome:"unknown",cause:n})}async function q(n,e,t,o){try{return await fetch(n,e)}catch(i){throw c(t,o,{cause:i})}}function on(n){let e=new URL(n);if(e.protocol!=="http:"||!["127.0.0.1","[::1]"].includes(e.hostname)||e.username||e.password||e.pathname!=="/"||e.search||e.hash)throw c("invalid_loopback_url","loopbackUrl must be an HTTP origin on 127.0.0.1 or ::1.");return e.origin}async function Ce(){let n=N(32),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(n));return{verifier:n,challenge:ve(new Uint8Array(e))}}function C(n,e,t,o){return x(Pe(n)??n?.error?.code??e,n?.error_description??n?.error?.message??t,{status:o,details:n?.error?.details})}function Pe(n){return typeof n?.error=="string"?n.error:void 0}function qe(n,e){if(!n||typeof n!="object"||Array.isArray(n)||typeof e!="string")return!1;let t=n;if(typeof t.operations_url!="string"||typeof t.sync_url!="string"||typeof t.files_url!="string"||typeof t.replica_id!="string"||t.replica_id.length===0||typeof t.access_token!="string"||t.access_token.length===0||t.proof_public_key!==void 0&&(typeof t.proof_public_key!="string"||t.proof_public_key.length===0))return!1;try{let o=new URL(t.operations_url),i=new URL(t.sync_url),r=new URL(t.files_url);return[o,i,r].every(a=>(a.protocol==="https:"||a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))&&!a.username&&!a.password&&!a.search&&!a.hash)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/operations$/i.test(o.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/sync$/i.test(i.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/files$/i.test(r.pathname)&&o.origin===i.origin&&o.origin===r.origin&&o.pathname.split("/")[3]===e&&i.pathname.split("/")[3]===e&&r.pathname.split("/")[3]===e}catch{return!1}}function rn(n,e){return qe({operations_url:n?.operationsUrl,sync_url:n?.syncUrl,files_url:n?.filesUrl,replica_id:n?.replicaId,access_token:n?.accessToken,proof_public_key:n?.proofPublicKey},e)}function Be(n){if(!n||typeof n!="object"||Array.isArray(n))return!1;let e=n,t=e.actions;if(e.kind!=="files"||e.protocol_version!==1||!Array.isArray(t)||t.length===0||t.length>6||new Set(t).size!==t.length||t.some(i=>!["list","read","add","replace","move","delete"].includes(i)))return!1;let o=e.scope;return!o||typeof o!="object"||Array.isArray(o)?!1:o.kind==="collection"?Object.keys(o).length===1:o.kind==="selected_folders"&&Object.keys(o).length===2&&Array.isArray(o.folders)&&o.folders.length>0&&o.folders.length<=100&&new Set(o.folders).size===o.folders.length&&o.folders.every(i=>typeof i=="string"&&i.length>0&&i.length<=1024&&yo(i))}function yo(n){let e=new Set([".mdbase",".git","node_modules","_contracts","_schemas","_types","_views"]);return!n.startsWith("/")&&!n.endsWith("/")&&!n.includes("\\")&&n.split("/").every(t=>{let o=t.split(".")[0]?.toUpperCase()??"";return t!==""&&t!=="."&&t!==".."&&!t.startsWith(".")&&!t.endsWith(" ")&&!t.endsWith(".")&&!/[<>:"|?*]/.test(t)&&!e.has(t.toLowerCase())&&!["CON","PRN","AUX","NUL"].includes(o)&&!/^(COM|LPT)[1-9]$/.test(o)})}function an(n,e){if(!n||typeof n!="object"||Array.isArray(n)||n.collection_id!==e)return!1;try{return G(n),!0}catch{return!1}}function sn(n){if(typeof n?.device_code!="string"||typeof n?.user_code!="string"||typeof n?.verification_uri!="string"||typeof n?.verification_uri_complete!="string"||!Number.isFinite(n?.expires_in)||!Number.isFinite(n?.interval))throw c("invalid_device_authorization_response","Connect returned an invalid downloaded application authorization response.");return{userCode:n.user_code,verificationUri:n.verification_uri,verificationUriComplete:n.verification_uri_complete,expiresAt:Date.now()+Math.max(1,n.expires_in)*1e3,intervalSeconds:Math.max(1,n.interval)}}function I(n){if(!n)return null;try{return JSON.parse(n)}catch{return null}}function Ke(n){if(!n||typeof n!="object"||Array.isArray(n))return null;let e=n;return e.access!=="contract"&&e.access!=="full_collection"||!Array.isArray(e.contracts)||e.contracts.some(t=>!t||typeof t!="object"||t.contract_type!=="record"||typeof t.id!="string"||typeof t.version!="string"||!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(t.version)||!/^sha256:[0-9a-f]{64}$/.test(t.digest)||!t.schema||typeof t.schema!="object"||Array.isArray(t.schema)||!Array.isArray(t.implementations)||t.implementations.some(o=>!o||typeof o!="object"||typeof o.type_name!="string"||!Number.isInteger(o.type_version)||!/^sha256:[0-9a-f]{64}$/.test(o.digest)||!o.fields||typeof o.fields!="object"||Array.isArray(o.fields)||Object.values(o.fields).some(i=>typeof i!="string")))?null:e}function cn(n){return n.endsWith("/")?n.slice(0,-1):n}function ln(){if(typeof location>"u")throw c("manifest_required","manifest is required outside a browser environment.");if(location.origin==="null")throw c("manifest_required","Downloaded applications must provide their v1 portable manifest inline.");return new URL("/.well-known/mdbase-app.json",location.origin).href}function dn(){if(typeof location>"u")throw c("redirect_uri_required","redirectUri is required outside a browser environment.");return location.href.split(/[?#]/)[0]}function un(){if(typeof location>"u")throw c("callback_url_required","callbackUrl is required outside a browser environment.");return location.href}function pn(n){if(n)return new ce;if(typeof localStorage>"u")throw c("storage_required","storage is required outside a browser environment.");try{let e=`mdbase-connect:probe:${N(8)}`;return localStorage.setItem(e,"1"),localStorage.removeItem(e),localStorage}catch{return new ce}}var ce=class{values=new Map;get length(){return this.values.size}clear(){this.values.clear()}getItem(e){return this.values.get(e)??null}key(e){return[...this.values.keys()][e]??null}removeItem(e){this.values.delete(e)}setItem(e,t){this.values.set(String(e),String(t))}};function hn(n){return typeof n=="string"||n.distribution!=="portable"?!1:typeof location>"u"||location.origin==="null"||!["http:","https:"].includes(location.protocol)}function fn(n){let e=yt(n),t=2166136261,o=2654435769;for(let i=0;i<e.length;i+=1){let r=e.charCodeAt(i);t=Math.imul(t^r,16777619),o=Math.imul(o^r,2246822507)}return`${(t>>>0).toString(16).padStart(8,"0")}${(o>>>0).toString(16).padStart(8,"0")}`}var je=class{constructor(e){this.context=e}context;async registerNotifications(e){let t=await this.context.authorizedToken();if(!t)throw c("not_authorized","Connect this application before enabling notifications.");let i=(await this.context.register()).notifications?.criteria.map(w=>w.id)??[],r=[...new Set(e.criteria??i)],a=r.find(w=>!i.includes(w));if(a)throw c("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${a}.`);if(r.length===0)throw c("notifications_not_declared","This application manifest does not declare any notification criteria.");let s=await q(`${this.context.serverUrl}/v1/notifications/vapid-public-key`,void 0,"notifications_unavailable","Push notifications are unavailable."),l=await s.json();if(!s.ok)throw C(l,"notifications_unavailable","Push notifications are unavailable.",s.status);let d=await e.serviceWorker.pushManager.getSubscription();d||(d=await e.serviceWorker.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:Qt(l.public_key)}));let u=d.toJSON();if(!u.endpoint||!u.keys?.p256dh||!u.keys.auth)throw c("invalid_push_subscription","The browser returned an incomplete push subscription.");let p=I(this.context.storage.getItem(this.context.notificationKey())),f=e.installationId??p?.installationId??N(24),h=await q(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${t.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:f,criteria:r,subscription:{endpoint:u.endpoint,expirationTime:u.expirationTime??null,keys:u.keys}})},"notification_registration_failed","Could not register push notifications."),m=await h.json();if(!h.ok)throw C(m,"notification_registration_failed","Could not register push notifications.",h.status);p?.channelId&&p.channelId!==m.channel_id&&fetch(`${this.context.serverUrl}/v1/notifications/channels/${p.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${t.accessToken}`}}).catch(()=>{});let _={channelId:m.channel_id,installationId:f,criteria:r};return this.context.storage.setItem(this.context.notificationKey(),JSON.stringify(_)),_}async registerNativeNotifications(e){let t=await this.context.authorizedToken();if(!t)throw c("not_authorized","Connect this application before enabling notifications.");let o=await this.context.register();if(o.notifications?.native_delivery?.mode!=="managed_fcm")throw c("managed_fcm_not_declared","This application does not declare Connect-managed native notifications.");let i=o.notifications.criteria.map(h=>h.id),r=[...new Set(e.criteria??i)],a=r.find(h=>!i.includes(h));if(a)throw c("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${a}.`);if(r.length===0)throw c("notifications_not_declared","This application manifest does not declare any notification criteria.");let s=this.context.notificationKey("fcm"),l=I(this.context.storage.getItem(s)),d=e.installationId??l?.installationId??N(24),u=await q(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${t.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:d,criteria:r,transport:"fcm",token:e.token})},"notification_registration_failed","Could not register native notifications."),p=await u.json();if(!u.ok)throw C(p,"notification_registration_failed","Could not register native notifications.",u.status);l?.channelId&&l.channelId!==p.channel_id&&this.deleteNotificationChannel(l.channelId,t.accessToken).catch(()=>{});let f={channelId:p.channel_id,installationId:d,transport:"fcm",criteria:r};return this.context.storage.setItem(s,JSON.stringify(f)),f}async unregisterNativeNotifications(){let e=this.context.notificationKey("fcm"),t=I(this.context.storage.getItem(e)),o=await this.context.authorizedToken();if(t?.channelId&&!o)throw c("not_authorized","Reconnect this application before disabling native notifications.");t?.channelId&&o&&await this.deleteNotificationChannel(t.channelId,o.accessToken),this.context.storage.removeItem(e)}async unregisterNotifications(e){let t=I(this.context.storage.getItem(this.context.notificationKey())),o=await this.context.authorizedToken();if(t?.channelId&&!o)throw c("not_authorized","Reconnect this application before disabling push notifications.");if(t?.channelId&&o){let r=await q(`${this.context.serverUrl}/v1/notifications/channels/${t.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${o.accessToken}`}},"notification_unregistration_failed","Could not unregister push notifications.");if(!r.ok&&r.status!==404){let a=await r.json();throw C(a,"notification_unregistration_failed","Could not unregister push notifications.",r.status)}}this.context.storage.removeItem(this.context.notificationKey()),await(await e?.pushManager.getSubscription())?.unsubscribe()}async deleteNotificationChannel(e,t){let o=await q(`${this.context.serverUrl}/v1/notifications/channels/${e}`,{method:"DELETE",headers:{authorization:`Bearer ${t}`}},"notification_unregistration_failed","Could not unregister push notifications.");if(!o.ok&&o.status!==404){let i=await o.json();throw C(i,"notification_unregistration_failed","Could not unregister push notifications.",o.status)}}};async function He(n,e,t,o,i,r){if(!n.authority)throw c("not_remote_authority","This authorization has no remote authority endpoint.");let a=t===""||t.startsWith("?")?t:`/${t}`,s=`${n.authority.filesUrl}${a}`,l=o===void 0?void 0:JSON.stringify(o),d=await r(n,e,s,l,n.authority.accessToken);return fetch(s,{method:e,redirect:"error",headers:{authorization:`Bearer ${n.authority.accessToken}`,...l===void 0?{}:{"content-type":"application/json"},...d},...l===void 0?{}:{body:l},...i?{signal:i}:{}})}async function yn(n,e,t,o,i,r,a){let s=n,l=await He(s,e,t,o,i,a);if(l.status===401&&s.refreshToken){if(s=await r(),!s.authority||!s.fileCapability)throw c("authority_authorization_changed","Reconnect this collection before accessing its files.");l=await He(s,e,t,o,i,a)}let d=await l.json().catch(()=>({}));if(!l.ok)throw C(d,"operation_failed","Collection file request failed.",l.status);return d}async function mn(n,e,t,o,i,r){let a=n,s=await He(a,"GET",e,void 0,o,r);if(s.status===401&&a.refreshToken){if(a=await i(),!a.authority||!a.fileCapability)throw c("authority_authorization_changed","Reconnect this collection before accessing its files.");s=await He(a,"GET",e,void 0,o,r)}if(!s.ok){let d=await s.json().catch(()=>({}));throw C(d,"operation_failed","Collection file range request failed.",s.status)}let l=s.headers.get("content-length");if(l===null||!/^(0|[1-9][0-9]*)$/u.test(l)||Number(l)!==t)throw await s.body?.cancel().catch(()=>{}),c("invalid_operation_response","The hosted file response declared an unexpected byte length.");if(!s.body)throw c("invalid_operation_response","The hosted file response did not contain a byte stream.");return s.body}var $e=class{constructor(e){this.options=e}options;async control(e,t,o,i,r){le(e);let a=wo(t,o,i),s=await this.encryptControl(e,a),l;if(await this.options.shouldAttemptDirect(e)){try{l=await fetch(`${this.options.loopbackUrl}/v1/files/control`,Q({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r}))}catch(d){if(r?.aborted)throw d;this.options.onDirectUnavailable()}if(l&&!se(l.status))return l.ok&&this.options.onDirectAvailable(),this.decryptControlResponse(e,s,l);l&&this.options.onDirectUnavailable()}return l=await this.sendRelayControl(e,s,r),await _o(l,e)&&(e=await this.options.refreshAuthorization(),mt(e),s=await this.encryptControl(e,a),l=await this.sendRelayControl(e,s,r)),l.ok&&this.options.onRelayAvailable(),this.decryptControlResponse(e,s,l)}async decryptControlResponse(e,t,o){let i=await o.json().catch(()=>({}));if(!o.ok)throw C(i,"operation_failed","Collection file request failed.",o.status);let r=i?.envelope;if(!r)throw c("invalid_encrypted_response","The connector omitted its encrypted file response.");let a=await oe(this.options.keyStore,e.keyHandle,_t(e),t,r);return a.ok||vo(a.problem),a.result}async uploadChunk(e,t,o,i){let a=await this.localFileToken(e,"upload"),s=await _n(this.options.keyStore,a,e,t,o),l;if(await this.options.shouldAttemptDirect(a)){try{l=await fetch(`${this.options.loopbackUrl}/v1/files/upload`,Q(gn(s,i)))}catch(d){if(i?.aborted)throw d;this.options.onDirectUnavailable()}if(l&&!se(l.status))return l.ok&&this.options.onDirectAvailable(),mo(l,"Encrypted file chunk upload failed.");l&&this.options.onDirectUnavailable()}if(l=await this.sendRelayUpload(a,s,i),l.status===401&&a.refreshToken&&(a=await this.options.refreshAuthorization(),mt(a),s=await _n(this.options.keyStore,a,e,t,o),l=await this.sendRelayUpload(a,s,i)),!l.ok){let d=await l.json().catch(()=>({}));throw C(d,"operation_failed","Encrypted file chunk upload failed.",l.status)}this.options.onRelayAvailable()}async downloadChunk(e,t,o){let i=await this.localFileToken(e,"download"),r;if(await this.options.shouldAttemptDirect(i)){try{r=await fetch(`${this.options.loopbackUrl}/v1/files/download/${encodeURIComponent(i.grantId)}/${encodeURIComponent(e.transfer_id)}/${t}`,Q({method:"GET",signal:o}))}catch(a){if(o?.aborted)throw a;this.options.onDirectUnavailable()}if(r&&!se(r.status))return r.ok&&this.options.onDirectAvailable(),this.decryptDownloadResponse(i,e,t,r);r&&this.options.onDirectUnavailable()}return r=await this.sendRelayDownload(i,e,t,o),r.status===401&&i.refreshToken&&(i=await this.options.refreshAuthorization(),mt(i),r=await this.sendRelayDownload(i,e,t,o)),r.ok&&this.options.onRelayAvailable(),this.decryptDownloadResponse(i,e,t,r)}async decryptDownloadResponse(e,t,o,i){if(!i.ok){let s=await i.json().catch(()=>({}));throw C(s,"operation_failed","Encrypted file chunk download failed.",i.status)}if(i.headers.get("content-type")?.split(";",1)[0]!=="application/mdbase-connect-file")throw c("invalid_operation_response","The connector returned an invalid file response media type.");let r=new Uint8Array(await i.arrayBuffer()),a;try{bo(t,o,r),a=await(await vn(this.options.keyStore,e,t)).decryptChunk(r)}catch(s){throw s instanceof v?s:c("invalid_operation_response","The connector returned an invalid encrypted file frame.",{cause:s})}if(a.byteLength!==gt(t,o))throw c("invalid_operation_response","The connector returned a truncated file chunk.");return a}encryptControl(e,t){return le(e),V(this.options.keyStore,e.keyHandle,_t(e),"file_control",t)}sendRelayControl(e,t,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/control`,{method:"POST",headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/json"},body:JSON.stringify(t),signal:o})}sendRelayUpload(e,t,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/upload`,{...gn(t,o),headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/mdbase-connect-file"}})}sendRelayDownload(e,t,o,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/download/${encodeURIComponent(t.transfer_id)}/${o}`,{method:"GET",headers:{authorization:`Bearer ${e.accessToken}`},signal:i})}async localFileToken(e,t){let o=await this.options.authorizedToken();if(!o||o.authority||!o.fileCapability||!o.encryption||!o.grantId||!o.keyHandle||e.direction!==t||e.protection!=="grant_aead_v1")throw c("not_authorized","This connection cannot use encrypted local file delivery.");return Ve(e),o}};function mt(n){if(n.authority||!n.fileCapability)throw c("not_authorized","This connection cannot use encrypted local file delivery.");le(n)}async function _n(n,e,t,o,i){let r=go(e,t,o,i.byteLength);return(await vn(n,e,t)).encryptChunk("upload_chunk",r,i)}function gn(n,e){return{method:"POST",headers:{"content-type":"application/mdbase-connect-file"},body:Uint8Array.from(n).buffer,signal:e}}async function mo(n,e){if(n.ok)return;let t=await n.json().catch(()=>({}));throw C(t,"operation_failed",e,n.status)}async function _o(n,e){return e.refreshToken?n.status===401?!0:n.status!==409?!1:(await n.clone().json().catch(()=>null))?.error?.code==="encryption_binding_stale":!1}function le(n){if(!n.encryption||!n.grantId||!n.keyHandle)throw c("missing_grant_key","Reconnect this application to restore encrypted file access.")}function _t(n){return le(n),{grantId:n.grantId,applicationId:n.clientId,encryption:n.encryption}}function vn(n,e,t){return le(e),ie.open(n,e.keyHandle,{..._t(e),authorityId:e.encryption.connector_id,transferId:t.transfer_id,direction:t.direction})}function go(n,e,t,o){le(n);let i=Ve(e),r=gt(e,t);if(o!==r)throw c("invalid_request","The file chunk has the wrong byte length.");return{protocol_version:1,protection:"grant_aead_v1",grant_id:n.grantId,authority_id:n.encryption.connector_id,collection_id:n.collectionId,transfer_id:e.transfer_id,direction:e.direction,chunk_size:i,chunk_index:t,offset:t*i,plaintext_length:o,total_size:e.total_size,scope_epoch:n.encryption.scope_epoch,key_id:n.encryption.key_id}}function bo(n,e,t){let o=Me(t),i=gt(n,e),r=Ve(n);if(o.kind!=="download_chunk"||o.header.chunk_index!==e||o.header.chunk_size!==r||o.header.offset!==e*r||o.header.plaintext_length!==i||o.header.total_size!==n.total_size)throw c("invalid_operation_response","The connector returned a file frame for a different chunk.")}function vo(n){throw x(n.code==="unknown"?n.server_code:n.code,n.message,{details:n.details,operationOutcome:n.operation_outcome??"rejected",traceId:n.trace_id})}function wo(n,e,t){if(n==="GET"&&(e===""||e.startsWith("?"))){let i=new URLSearchParams(e.startsWith("?")?e.slice(1):e),r=i.get("limit");return{protocol_version:1,type:"list_files",...i.get("folder")?{folder:i.get("folder")}:{},...i.get("after")?{after:i.get("after")}:{},...r?{limit:Number(r)}:{}}}let o=e.split("/");if(n==="GET"&&o.length===2&&o[0]==="transfers")return bn("get_file_transfer_status",o[1]);if(n==="DELETE"&&o.length===2&&o[0]==="transfers")return bn("abort_file_transfer",o[1]);if(n==="POST"&&Co(t)){let i=e==="uploads"?"open_file_upload":e==="downloads"?"open_file_download":o.length===3&&o[0]==="uploads"&&o[2]==="commit"?"commit_file_upload":o.length===2&&o[1]==="move"&&t.file_id===decodeURIComponent(o[0])?"move_file":o.length===2&&o[1]==="delete"&&t.file_id===decodeURIComponent(o[0])?"delete_file":null;if(i&&t.type===i)return{...t}}throw c("invalid_request","The file control request path is invalid.")}function bn(n,e){return{protocol_version:1,type:n,transfer_id:decodeURIComponent(e)}}function Ve(n){if(n.strategy.kind!=="framed_chunks"||!Number.isSafeInteger(n.strategy.chunk_size)||n.strategy.chunk_size<=0)throw c("invalid_operation_response","The connector returned an invalid framed transfer strategy.");return n.strategy.chunk_size}function gt(n,e){let t=Ve(n);if(!Number.isSafeInteger(e)||e<0||!Number.isSafeInteger(n.total_size)||n.total_size<0)throw c("invalid_request","The file chunk index is invalid.");let o=e*t;if(!Number.isSafeInteger(o)||o>=n.total_size)throw c("invalid_request","The file chunk index is outside the transfer.");return Math.min(t,n.total_size-o)}function Co(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}var Ge=class{constructor(e){this.options=e;this.local=new $e(e)}options;local;async control(e,t="",o,i){let r=await this.requireFileToken();return r.authority?yn(r,e,t,o,i,this.options.refreshAuthorization,this.options.authorityProofHeaders):this.local.control(r,e,t,o,i)}uploadChunk(e,t,o,i){return this.local.uploadChunk(e,t,o,i)}downloadChunk(e,t,o){return this.local.downloadChunk(e,t,o)}async downloadHostedPart(e,t,o,i){let r=await this.requireFileToken();if(!r.authority)throw c("not_remote_authority","Hosted file delivery requires a remote authority endpoint.");return mn(r,`downloads/${encodeURIComponent(e.transfer_id)}/parts/${t}`,o,i,this.options.refreshAuthorization,this.options.authorityProofHeaders)}async requireFileToken(){let e=await this.options.authorizedToken();if(!e?.fileCapability)throw c("not_authorized","This connection has no file capability.");return e}};var Ye=class{serverUrl;storage;keyStore;directAccessMode;loopbackUrl;collectionId;internals;onChange;files;refreshPromise=null;directStatus;currentRoute="relay";directFailures=0;directRetryAt=0;constructor(e){this.serverUrl=e.serverUrl,this.storage=e.storage,this.keyStore=e.keyStore,this.directAccessMode=e.directAccessMode,this.loopbackUrl=e.loopbackUrl,this.collectionId=e.collectionId,this.internals=e.internals,this.onChange=e.onChange,this.files=new Ge({keyStore:this.keyStore,serverUrl:this.serverUrl,loopbackUrl:this.loopbackUrl,authorizedToken:()=>this.authorizedToken(),refreshAuthorization:()=>this.refreshAuthorization(),shouldAttemptDirect:t=>this.shouldAttemptDirect(t),onDirectAvailable:()=>{this.markDirectAvailable(),this.setRoute("direct")},onDirectUnavailable:()=>this.markDirectUnavailable(),onRelayAvailable:()=>this.setRoute("relay"),authorityProofHeaders:(t,o,i,r,a)=>this.authorityProofHeaders(t,o,i,r,a)}),this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable"}get directAccess(){return this.currentToken()?.authority?"disabled":this.directStatus}get route(){return this.currentToken()?.authority?"remote":this.currentRoute}notifyStorageChanged(){this.emitConnection()}async checkDirectAccess(){let e=this.currentToken();if(!this.directEligible(e))return this.setDirectStatus("disabled");let t=await we();return t==="denied"?this.setDirectStatus("denied"):(t==="prompt"||t===null)&&this.storage.getItem(this.directPreferenceKey())!=="enabled"?this.setDirectStatus("permission_required"):this.probeDirectAccess()}async requestDirectAccess(){let e=this.currentToken();return this.directCapable(e)?(this.storage.setItem(this.directPreferenceKey(),"enabled"),this.directRetryAt=0,this.probeDirectAccess()):this.setDirectStatus("disabled")}disableDirectAccess(){this.storage.setItem(this.directPreferenceKey(),"disabled"),this.setDirectStatus("disabled"),this.setRoute("relay")}pendingMutation(){let e=I(this.storage.getItem(this.pendingMutationKey())),t=this.currentToken();return!e||!t||e.collectionId!==t.collectionId||e.grantId!==t.grantId||e.keyId!==t.encryption?.key_id?null:{operation:e.operation,createdAt:e.createdAt,resumable:!0}}async resumePendingMutation(e,t){let o=this.pendingMutation();if(!o)throw c("no_pending_mutation","There is no interrupted mutation to resume.");return this.performOperation(o.operation,e,t)}async performOperation(e,t,o={}){X(o.signal);let i=this.currentToken();if(!i)throw c("not_authorized","Connect this application before accessing a collection.");if(!i.operations.includes(e))throw c("insufficient_access",`This connection does not allow ${e}.`,{details:{required_operations:[e],granted_operations:[...i.operations],missing_operations:[e]}});let r=await this.shouldAttemptDirect(i);if(!r&&(i=await this.authorizedToken(),!i))throw c("not_authorized","Reconnect this application to continue.");let a;try{a=await this.sendOperation(i,e,t,r,o)}catch(u){throw ht(u,o.signal,Ne(e,t)&&this.pendingMutation()!==null,i.authority?"hosted_provider_unavailable":"relay_unavailable")}let s=a.response,l=s.status===409&&(await s.clone().json().catch(()=>null))?.error?.code==="encryption_binding_stale";if((s.status===401||l)&&i.refreshToken){if(a.pendingMutation&&(a.directDeliveryUncertain||a.encryptedRequest&&a.resumingMutation))throw c("operation_outcome_unknown","The direct operation may have completed, but its encrypted grant changed before the response could be recovered. Refresh before making another change.",{operationOutcome:"unknown"});a.pendingMutation&&this.clearPendingMutation(),i=await this.refreshAuthorization(),r=await this.shouldAttemptDirect(i);try{a=await this.sendOperation(i,e,t,r,o)}catch(u){throw ht(u,o.signal,Ne(e,t)&&this.pendingMutation()!==null,i.authority?"hosted_provider_unavailable":"relay_unavailable")}s=a.response}let d;try{d=await s.json()}catch(u){throw a.pendingMutation?M(u):c("invalid_operation_response","The collection authority returned a response that is not valid JSON.",{cause:u})}if(!s.ok){let u=C(d,"operation_failed","Collection operation failed.",s.status);throw a.pendingMutation&&(a.directDeliveryUncertain||a.encryptedRequest&&a.resumingMutation)?M(u):(a.pendingMutation&&!a.directDeliveryUncertain&&this.clearPendingMutation(),u.code==="direct_operation_rejected"&&u.status===403&&this.invalidateRejectedAuthorization(i),u)}if(a.encryptedRequest){let u=d?.envelope;if(!u||!i.encryption||!i.grantId||!i.keyHandle)throw a.pendingMutation?M(new Error("Encrypted operation response was missing its envelope.")):c("invalid_encrypted_response","The relay did not return an encrypted connector response.");try{let p=await oe(this.keyStore,i.keyHandle,{grantId:i.grantId,applicationId:i.clientId,encryption:i.encryption},a.encryptedRequest,u);if(a.pendingMutation&&this.clearPendingMutation(),!p.ok)throw x(p.problem.code==="unknown"?p.problem.server_code:p.problem.code,p.problem.message,{details:p.problem.details,operationOutcome:p.problem.operation_outcome??"rejected",traceId:p.problem.trace_id});return p.result}catch(p){throw p instanceof v?p:p instanceof g?a.pendingMutation?M(p):x(p.code,p.message):p}}if(d?.protocol_version!==1||d?.request_id!==a.requestId)throw a.pendingMutation?M(new Error("Operation response protocol or request ID did not match.")):c("invalid_operation_response","The collection authority returned a response for a different protocol request.");if(d.ok===!1)throw he(d.problem)?(a.pendingMutation&&this.clearPendingMutation(),new v(d.problem)):a.pendingMutation?M(new Error("Operation rejection did not contain a canonical problem.")):c("invalid_operation_response","The collection authority returned an invalid operation problem.");if(d.ok!==!0||!("result"in d))throw a.pendingMutation?M(new Error("Successful operation response did not contain a result.")):c("invalid_operation_response","The collection authority returned an incomplete operation response.");return a.pendingMutation&&this.clearPendingMutation(),d.result}async performAuthoritySyncRequest(e,t,o,i,r){let a=await this.authorizedToken();if(!a?.authority||a.collectionId!==e||a.authority.replicaId!==t)throw c("authority_authorization_changed","Reconnect this collection authority before synchronizing.");let s=await this.sendAuthoritySyncRequest(a,o,i,r);if(s.status===401&&a.refreshToken){if(a=await this.refreshAuthorization(),!a.authority||a.collectionId!==e||a.authority.replicaId!==t)throw c("authority_authorization_changed","Reconnect this collection authority before synchronizing.");s=await this.sendAuthoritySyncRequest(a,o,i,r)}let l=await s.json();if(!s.ok)throw C(l,"sync_failed","Collection synchronization failed.",s.status);return l}async sendAuthoritySyncRequest(e,t,o,i){if(!e.authority)throw c("not_remote_authority","This authorization has no remote authority endpoint.");let r=`${e.authority.syncUrl}/${o}`,a=i===void 0?void 0:JSON.stringify(i),s=await this.authorityProofHeaders(e,t,r,a,e.authority.accessToken);return fetch(r,{method:t,headers:{authorization:`Bearer ${e.authority.accessToken}`,...i===void 0?{}:{"content-type":"application/json"},...s},...a===void 0?{}:{body:a}})}async sendOperation(e,t,o,i,r={}){let a=o??{},s,l=!1,d=!1,u=crypto.randomUUID(),p=null,f;if(Ne(t,o)){if(f=await nn(t,o),p=I(this.storage.getItem(this.pendingMutationKey())),p){if(p.collectionId!==e.collectionId||p.grantId!==e.grantId||p.keyId!==e.encryption?.key_id||p.operation!==t||p.inputFingerprint!==f)throw c("pending_mutation_unresolved","A previous write still has an unknown outcome. Retry that exact write before making another change.");u=p.requestId,d=!0}l=!0}if(e.encryption&&!e.authority){if(!e.grantId||!e.keyHandle)throw c("missing_grant_key","Reconnect this application to restore encrypted access.");try{if(l)if(p){if(!p.envelope)throw c("pending_mutation_unresolved","The pending write belongs to a different transport. Reconnect before retrying it.");s=p.envelope}else s=await V(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},t,o,u),this.storage.setItem(this.pendingMutationKey(),JSON.stringify({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},keyId:e.encryption.key_id,operation:t,inputFingerprint:f,requestId:u,envelope:s,createdAt:Date.now()}));else s=await V(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},t,o)}catch(b){throw b instanceof g?x(b.code,b.message):b}a=s}else a={protocol_version:1,request_id:u,input:a},l&&!p&&this.storage.setItem(this.pendingMutationKey(),JSON.stringify({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},operation:t,inputFingerprint:f,requestId:u,createdAt:Date.now()}));if(i&&s&&!e.authority){let b=!1;try{let k=await fetch(`${this.loopbackUrl}/v1/operations`,Q({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r.signal}));if(!se(k.status))return k.ok&&(this.markDirectAvailable(),this.setRoute("direct")),{response:k,requestId:u,encryptedRequest:s,pendingMutation:l,resumingMutation:d};b=k.status>=500,this.markDirectUnavailable()}catch(k){if(r.signal?.aborted)throw k;b=!0,await we()==="denied"?this.setDirectStatus("denied"):this.markDirectUnavailable()}let F;try{F=e.expiresAt>Date.now()+3e4?e:await this.refreshAuthorization()}catch(k){throw l&&(b||d)?M(k):k}let T;try{T=await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(F.collectionId)}/operations/${t}`,{method:"POST",headers:{authorization:`Bearer ${F.accessToken}`,"content-type":"application/json"},body:JSON.stringify(s),signal:r.signal})}catch(k){throw l&&(b||d)?M(k):k}return T.ok&&this.setRoute("relay"),{response:T,requestId:u,encryptedRequest:s,directDeliveryUncertain:b,pendingMutation:l,resumingMutation:d}}let h=e.authority?`${e.authority.operationsUrl}/${t}`:`${this.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/operations/${t}`,m=JSON.stringify(a),_=e.authority?await this.authorityProofHeaders(e,"POST",h,m,e.authority.accessToken):{},w=await fetch(h,{method:"POST",headers:{authorization:`Bearer ${e.authority?.accessToken??e.accessToken}`,"content-type":"application/json",..._},body:m,signal:r.signal});return w.ok&&this.setRoute(e.authority?"remote":"relay"),{response:w,requestId:u,encryptedRequest:s,pendingMutation:l,resumingMutation:d}}directCapable(e){return!(!e||e.authority||!e.encryption||!e.grantId||!e.keyHandle||this.directAccessMode==="disabled"||typeof location<"u"&&e.applicationOrigin&&e.applicationOrigin!==location.origin)}hasResumableMutationTransport(){return!!this.currentToken()}directEligible(e){return e!==null&&this.directCapable(e)&&this.storage.getItem(this.directPreferenceKey())!=="disabled"}async shouldAttemptDirect(e){if(!this.directEligible(e))return!1;if(this.directStatus==="available")return!0;if(this.directStatus==="unavailable"&&Date.now()<this.directRetryAt)return!1;let t=await we();return t==="denied"?(this.setDirectStatus("denied"),!1):(t==="prompt"||t===null)&&this.storage.getItem(this.directPreferenceKey())!=="enabled"?(this.setDirectStatus("permission_required"),!1):(this.setDirectStatus("checking"),!0)}async probeDirectAccess(){this.setDirectStatus("checking");try{let e=await fetch(`${this.loopbackUrl}/v1/ready`,Q({method:"GET",cache:"no-store"})),t=await e.json().catch(()=>null);if(e.ok&&t?.service==="mdbase-connect"&&t?.loopback_protocol_version===1&&t?.encrypted_protocol_version===1)return this.markDirectAvailable(),"available"}catch{}return await we()==="denied"?this.setDirectStatus("denied"):(this.markDirectUnavailable(),"unavailable")}markDirectAvailable(){this.directFailures=0,this.directRetryAt=0,this.setDirectStatus("available")}markDirectUnavailable(){this.directFailures+=1,this.directRetryAt=Date.now()+Math.min(6e4,1e3*2**(this.directFailures-1)),this.setDirectStatus("unavailable")}setDirectStatus(e){return this.directStatus!==e&&(this.directStatus=e,this.emitConnection()),e}setRoute(e){this.currentRoute!==e&&(this.currentRoute=e,this.emitConnection())}emitConnection(){this.onChange()}invalidateRejectedAuthorization(e){let t=I(this.storage.getItem(this.tokenKey()));!t||!Xt(t,e)||(this.internals.removeToken(this.collectionId,t.keyHandle),this.currentRoute="relay",this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection())}currentToken(){let e=this.storage.getItem(this.tokenKey()),t=I(e),o=i=>(this.internals.removeToken(this.collectionId,typeof i=="string"?i:void 0,"invalid_stored_grant"),null);if(!t)return e&&o(),null;if(t.version!==1||typeof t.accessToken!="string"||t.accessToken.length===0||typeof t.clientId!="string"||t.clientId.length===0||t.collectionId!==this.collectionId||typeof t.collectionName!="string"||t.collectionName.length===0||!Array.isArray(t.operations)||t.operations.some(i=>typeof i!="string")||typeof t.expiresAt!="number"||!Number.isFinite(t.expiresAt)||t.refreshToken!==void 0&&(typeof t.refreshToken!="string"||t.refreshToken.length===0)||t.refreshExpiresAt!==void 0&&(typeof t.refreshExpiresAt!="number"||!Number.isFinite(t.refreshExpiresAt))||!Ke(t.scope)||t.fileCapability&&!Be(t.fileCapability)||t.authority&&!rn(t.authority,t.collectionId))return o(t.keyHandle);if(this.internals.relayEncryption==="required"){if(t.authority){if(!t.keyHandle||!t.authority.proofPublicKey)return o(t.keyHandle)}else if(!t.grantId||!t.keyHandle||!an(t.encryption,t.collectionId))return o(t.keyHandle)}return t.expiresAt<=Date.now()&&(!t.refreshToken||(t.refreshExpiresAt??0)<=Date.now())?this.directCapable(t)?t:(this.internals.removeToken(this.collectionId,t.keyHandle),null):t}async authorizedToken(){let e=this.currentToken();if(!e)return null;if(e.expiresAt>Date.now()+3e4)return e;if(!e.refreshToken||(e.refreshExpiresAt??0)<=Date.now()){if(this.directCapable(e))throw c("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");return this.internals.removeToken(this.collectionId,e.keyHandle),null}return this.refreshAuthorization()}refreshAuthorization(){return this.refreshPromise?this.refreshPromise:(this.refreshPromise=this.performRefresh().finally(()=>{this.refreshPromise=null}),this.refreshPromise)}async performRefresh(){let e=this.currentToken();if(!e?.refreshToken)throw c("not_authorized","Reconnect this application to continue.");if((e.refreshExpiresAt??0)<=Date.now())throw c("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");let t=e.refreshToken,o=`${this.serverUrl}/oauth/token`,i=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken,client_id:e.clientId}).toString(),r=e.authority?await this.authorityProofHeaders(e,"POST",o,i,e.refreshToken):{},a=await fetch(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...r},body:i}),s=await a.json();if(!a.ok){let l=this.currentToken();if(l?.refreshToken&&l.refreshToken!==t)return l;throw this.directCapable(e)||this.internals.removeToken(this.collectionId,e.keyHandle),(Pe(s)??s?.error?.code)==="invalid_grant"?c("authorization_expired",s?.error_description??s?.error?.message??"Reconnect this application to continue.",{status:a.status}):C(s,"authorization_expired","Reconnect this application to continue.",a.status)}return this.storeTokenResponse(s,e.clientId,e.keyHandle)}async authorityProofHeaders(e,t,o,i,r){if(!e.authority?.proofPublicKey)return{};if(!e.keyHandle)throw c("missing_grant_key","Reconnect this application to restore remote authority request signing.");try{let a=new URL(o);return await Dt(this.keyStore,e.keyHandle,e.authority.proofPublicKey,{method:t,target:`${a.pathname}${a.search}`,body:i,credential:r})}catch(a){throw a instanceof g?x(a.code,a.message):a}}storeTokenResponse(e,t,o){if(e.collection_id!==this.collectionId)throw c("collection_mismatch","The refreshed authorization belongs to a different collection.");let i=this.internals.storeTokenResponse(e,t,o);return this.currentRoute=i.authority?"remote":"relay",this.directStatus=i.authority||this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection(),i}tokenKey(){return this.internals.tokenKey(this.collectionId)}notificationKey(e="web_push"){return this.internals.notificationKey(this.collectionId,e)}pendingMutationKey(){return this.internals.pendingMutationKey(this.collectionId)}clearPendingMutation(){this.storage.removeItem(this.pendingMutationKey())}directPreferenceKey(){return this.internals.directPreferenceKey()}};var Po=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Ro=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),de=class{state=Ro.slice();block=new Uint8Array(64);words=new Uint32Array(64);blockLength=0;byteLength=0;finished=!1;update(e){if(this.finished)throw new Error("SHA-256 digest is already finalized.");if(this.byteLength+=e.byteLength,!Number.isSafeInteger(this.byteLength))throw new Error("SHA-256 input exceeds the safe browser byte range.");let t=0;if(this.blockLength>0){let o=Math.min(64-this.blockLength,e.byteLength);this.block.set(e.subarray(0,o),this.blockLength),this.blockLength+=o,t+=o,this.blockLength===64&&(this.compress(this.block),this.blockLength=0)}for(;t+64<=e.byteLength;)this.compress(e.subarray(t,t+64)),t+=64;return t<e.byteLength&&(this.block.set(e.subarray(t),0),this.blockLength=e.byteLength-t),this}digestHex(){if(this.finished)throw new Error("SHA-256 digest is already finalized.");this.finished=!0,this.block[this.blockLength]=128,this.block.fill(0,this.blockLength+1),this.blockLength>=56&&(this.compress(this.block),this.block.fill(0));let e=this.byteLength*8,t=Math.floor(e/4294967296),o=e>>>0;return wn(this.block,56,t),wn(this.block,60,o),this.compress(this.block),[...this.state].map(i=>i.toString(16).padStart(8,"0")).join("")}compress(e){let t=this.words;for(let p=0;p<16;p+=1){let f=p*4;t[p]=(e[f]<<24|e[f+1]<<16|e[f+2]<<8|e[f+3])>>>0}for(let p=16;p<64;p+=1){let f=t[p-15],h=t[p-2],m=z(f,7)^z(f,18)^f>>>3,_=z(h,17)^z(h,19)^h>>>10;t[p]=t[p-16]+m+t[p-7]+_>>>0}let o=this.state[0],i=this.state[1],r=this.state[2],a=this.state[3],s=this.state[4],l=this.state[5],d=this.state[6],u=this.state[7];for(let p=0;p<64;p+=1){let f=z(s,6)^z(s,11)^z(s,25),h=s&l^~s&d,m=u+f+h+Po[p]+t[p]>>>0,_=z(o,2)^z(o,13)^z(o,22),w=o&i^o&r^i&r,b=_+w>>>0;u=d,d=l,l=s,s=a+m>>>0,a=r,r=i,i=o,o=m+b>>>0}this.state[0]=this.state[0]+o>>>0,this.state[1]=this.state[1]+i>>>0,this.state[2]=this.state[2]+r>>>0,this.state[3]=this.state[3]+a>>>0,this.state[4]=this.state[4]+s>>>0,this.state[5]=this.state[5]+l>>>0,this.state[6]=this.state[6]+d>>>0,this.state[7]=this.state[7]+u>>>0}};function z(n,e){return n>>>e|n<<32-e}function wn(n,e,t){n[e]=t>>>24,n[e+1]=t>>>16,n[e+2]=t>>>8,n[e+3]=t}var Je=class{constructor(e,t){this.signal=t;this.iterator=So(e)}signal;iterator;remainder=new Uint8Array;remainderOffset=0;maxSourceChunkBytes=null;iteratorClosing=!1;ended=!1;setMaxSourceChunkBytes(e){this.maxSourceChunkBytes=e}async read(e){let t=new Uint8Array(e),o=0;for(;o<e;){if(this.remainderOffset===this.remainder.byteLength){let r=await this.nextSourceChunk();if(r.done)throw this.ended=!0,c("invalid_request","Streamed file bytes ended before the declared size.");if(!(r.value instanceof Uint8Array))throw c("invalid_request","A streamed file chunk was not a Uint8Array.");if(this.maxSourceChunkBytes===null)throw new Error("Stream source was read before upload negotiation completed.");if(r.value.byteLength>this.maxSourceChunkBytes)throw c("invalid_request",`A streamed file chunk exceeded the negotiated ${this.maxSourceChunkBytes}-byte upload part size.`);if(this.remainder=r.value,this.remainderOffset=0,this.remainder.byteLength===0)continue}let i=Math.min(e-o,this.remainder.byteLength-this.remainderOffset);t.set(this.remainder.subarray(this.remainderOffset,this.remainderOffset+i),o),o+=i,this.remainderOffset+=i}return t}async expectEnd(){if(this.remainderOffset<this.remainder.byteLength)throw c("invalid_request","Streamed file bytes exceed the declared size.");for(;!this.ended;){let e=await this.nextSourceChunk();if(e.done){this.ended=!0;return}if(!(e.value instanceof Uint8Array))throw c("invalid_request","A streamed file chunk was not a Uint8Array.");if(e.value.byteLength>0)throw c("invalid_request","Streamed file bytes exceed the declared size.")}}async close(){this.ended=!0,this.closeIterator()}async nextSourceChunk(){Cn(this.signal);let e=this.iterator.next(),t=this.signal;if(!t)return e;let o=()=>{},i=new Promise((r,a)=>{let s=()=>{this.closeIterator(),a(Pn(t))};t.addEventListener("abort",s,{once:!0}),o=()=>t.removeEventListener("abort",s),t.aborted&&s()});try{let r=await Promise.race([e,i]);return Cn(t),r}finally{o()}}closeIterator(){if(!this.iteratorClosing){this.iteratorClosing=!0;try{this.iterator.return?.()?.catch(()=>{})}catch{}}}};function So(n){if(typeof n.getReader=="function"){let t=n.getReader(),o=!1,i=()=>{o||(o=!0,t.releaseLock())};return{async next(){if(o)return{done:!0,value:void 0};let r=await t.read();return r.done&&i(),r},async return(){if(!o)try{await t.cancel()}finally{i()}return{done:!0,value:void 0}}}}let e=n;if(typeof e[Symbol.asyncIterator]!="function")throw c("invalid_request","Streamed files require a readable byte stream.");return e[Symbol.asyncIterator]()}function Cn(n){if(n?.aborted)throw Pn(n)}function Pn(n){return c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n?.reason})}var Rn=1024*1024,ko=4,Sn=8,ue=3,kn=64*1024*1024,Oo=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu,Ao=/^sha256:[0-9a-f]{64}$/u,Se=class{constructor(e,t,o,i){this.capability=e;this.request=t;this.framed=o;this.hosted=i}capability;request;framed;hosted;async*list(e={}){this.requireAction("list");let t;do{W(e.signal);let o=new URLSearchParams({protocol_version:String(1),...e.folder?{folder:e.folder}:{},...t?{after:t}:{},...e.pageSize?{limit:String(Mo(e.pageSize))}:{}}),i=await this.request("GET",`?${o.toString()}`,void 0,e.signal);if(i.protocol_version!==1||i.type!=="files_page"||!Array.isArray(i.files))throw c("invalid_operation_response","The authority returned an invalid file page.");for(let r of i.files)W(e.signal),yield r;t=i.next}while(t)}async upload(e,t,o={}){this.requireAction(o.ifRevision?"replace":"add");let i=Io(t,o.mediaType),r=On(o.concurrency),a=await To(i,o.signal,s=>{o.onProgress?.({phase:"hashing",transferredBytes:s,totalBytes:i.size})});return this.uploadKnownSource(e,i.size,`sha256:${a}`,(o.mediaType??i.type)||void 0,o,r,async(s,l,d)=>i.slice(l,l+d))}async uploadStream(e,t,o={}){if(this.requireAction(o.ifRevision?"replace":"add"),!Number.isSafeInteger(t.size)||t.size<0)throw c("invalid_request","Streamed file size must be a non-negative safe integer.");if(!Ao.test(t.contentDigest))throw c("invalid_request","Streamed files require a lowercase SHA-256 content digest.");let i=new Je(t.stream,o.signal),r=new de;return this.uploadKnownSource(e,t.size,t.contentDigest,o.mediaType??t.mediaType,o,1,async(a,s,l)=>{let d=await i.read(l);return r.update(d),d},async()=>{if(await i.expectEnd(),`sha256:${r.digestHex()}`!==t.contentDigest)throw c("invalid_request","Streamed file bytes do not match the declared SHA-256 digest.")},()=>i.close(),a=>i.setMaxSourceChunkBytes(a))}async uploadKnownSource(e,t,o,i,r,a,s,l,d,u){let p=r.transferId??crypto.randomUUID();if(!Oo.test(p))throw c("invalid_request","File transfer ID must be a UUID.");let f=!1;try{let h=await this.request("POST","uploads",{protocol_version:1,type:"open_file_upload",transfer_id:p,path:e,size:t,content_digest:o,...i?{media_type:i}:{},...r.ifRevision?{if_revision:r.ifRevision}:{}},r.signal);if(An(h,p,"upload"),h.total_size!==t||h.strategy.kind==="object_ranges")throw c("invalid_operation_response","The authority returned an incompatible upload strategy.");let m=h.strategy.kind==="framed_chunks";if(m&&!this.framed)throw c("invalid_operation_response","Encrypted file chunk delivery is unavailable.");let _=h.strategy.kind==="object_put"?Math.max(1,t):h.strategy.kind==="framed_chunks"?h.strategy.chunk_size:h.strategy.part_size,w=h.strategy.kind==="object_put"?1:Math.ceil(t/_);if(u?.(_),!m&&h.received.length===w){let O=await this.tryReplayUploadCommit(p,h.strategy.kind==="object_multipart"?h.uploaded_parts:void 0,r.signal);if(O)return f=!0,O.file}let b=new Set(h.received),F=new Map((h.uploaded_parts??[]).map(O=>[O.part_number-1,O])),T=[...b].reduce((O,pe)=>O+Uo(t,_,pe),0),k=await Lo(w,a,async O=>{let pe=O*_,Te=Math.min(_,Math.max(0,t-pe)),Xe=await s(O,pe,Te);if(Eo(Xe)!==Te)throw c("invalid_request","Streamed file bytes ended before the declared size.");if(b.has(O))return F.get(O)??null;let En=m?await bt(async()=>this.framed.uploadChunk(h,O,await xo(Xe),r.signal),r.signal).then(()=>null):await this.uploadPart(p,O,pe,Xe,Te,h.strategy.kind==="object_multipart",r.signal);return T+=Te,r.onProgress?.({phase:"uploading",transferredBytes:T,totalBytes:t}),En});await l?.();let K=await this.commitUpload(p,h.strategy.kind==="object_multipart"?k.filter(O=>O!==null):void 0,r.signal);if(K.protocol_version!==1||K.type!=="file_upload_committed"||K.transfer_id!==p||K.file.path!==e||K.file.size!==t||K.file.content_digest!==o)throw c("invalid_operation_response","The authority returned an invalid file receipt.");return f=!0,K.file}catch(h){throw Re(h)}finally{await d?.().catch(()=>{}),!f&&r.transferId===void 0&&await this.abort(p)}}async download(e,t={}){if(e.size>kn)throw c("invalid_request",`download() buffers at most ${kn} bytes; use downloadStream() for larger files.`);let o=await this.downloadStream(e,t),i=[],r=o.getReader();for(;;){let a=await r.read();if(a.done)break;i.push(a.value)}return new Blob(i.map(a=>{let s=new Uint8Array(a.byteLength);return s.set(a),s.buffer}),{type:e.media_type??""})}async downloadStream(e,t={}){this.requireAction("read"),On(t.concurrency);let o=crypto.randomUUID(),i;try{if(i=await this.request("POST","downloads",{protocol_version:1,type:"open_file_download",transfer_id:o,file_id:e.file_id,revision:e.revision},t.signal),An(i,o,"download"),i.total_size!==e.size||i.strategy.kind!=="object_ranges"&&i.strategy.kind!=="framed_chunks")throw c("invalid_operation_response","The authority returned an incompatible download session.");if(i.strategy.kind==="framed_chunks"&&!this.framed)throw c("invalid_operation_response","Encrypted file chunk delivery is unavailable.");if(i.strategy.kind==="object_ranges"&&e.size>0&&!this.hosted)throw c("invalid_operation_response","Authenticated hosted file delivery is unavailable.")}catch(_){throw await this.abort(o),Re(_)}let r=i.strategy.kind==="framed_chunks"?i.strategy.chunk_size:i.strategy.part_size,a=Math.ceil(e.size/r),s=new de,l=0,d=0,u=null,p=0,f=!1,h=async()=>{f||(f=!0,await u?.cancel().catch(()=>{}),u=null,await this.abort(o))},m=()=>{if(p!==e.size||`sha256:${s.digestHex()}`!==e.content_digest)throw c("invalid_operation_response","Downloaded file bytes failed integrity verification.")};return new ReadableStream({pull:async _=>{try{if(W(t.signal),i.strategy.kind==="object_ranges")for(;;){if(!u){if(l>=a){m(),await h(),_.close();return}let k=l*r;d=Math.min(r,e.size-k),u=(await bt(()=>this.hosted.downloadPart(i,l,d,t.signal),t.signal)).getReader()}let T=await u.read();if(T.done){if(u.releaseLock(),u=null,d!==0)throw c("invalid_operation_response","A hosted file range ended before its declared byte length.");l+=1;continue}if(!(T.value instanceof Uint8Array))throw c("invalid_operation_response","A hosted file range returned a non-byte chunk.");if(T.value.byteLength!==0){if(T.value.byteLength>d)throw c("invalid_operation_response","A hosted file range exceeded its declared byte length.");d-=T.value.byteLength,s.update(T.value),p+=T.value.byteLength,t.onProgress?.({phase:"downloading",transferredBytes:p,totalBytes:e.size}),_.enqueue(T.value);return}}if(l>=a){m(),await h(),_.close();return}let w=l*r,b=Math.min(r,e.size-w),F=await bt(()=>this.framed.downloadChunk(i,l,t.signal),t.signal);if(F.byteLength!==b)throw c("invalid_operation_response","A file chunk had the wrong byte length.");s.update(F),p+=F.byteLength,l+=1,t.onProgress?.({phase:"downloading",transferredBytes:p,totalBytes:e.size}),l===a&&m(),_.enqueue(F),l===a&&(await h(),_.close())}catch(w){await h(),_.error(Re(w))}},cancel:h})}async downloadBytes(e,t={}){return new Uint8Array(await(await this.download(e,t)).arrayBuffer())}async move(e,t,o={}){this.requireAction("move");let i=o.mutationId??crypto.randomUUID(),r;try{r=await this.request("POST",`${encodeURIComponent(e.file_id)}/move`,{protocol_version:1,type:"move_file",mutation_id:i,file_id:e.file_id,if_revision:o.ifRevision??e.revision,from_path:e.path,path:t,update_references:!1},o.signal)}catch(a){throw Re(a)}if(r.protocol_version!==1||r.type!=="file_moved"||r.mutation_id!==i||r.file.file_id!==e.file_id||r.file.path!==t)throw c("invalid_operation_response","The authority returned an invalid file move receipt.");return r.file}async delete(e,t={}){this.requireAction("delete");let o=t.mutationId??crypto.randomUUID(),i;try{i=await this.request("POST",`${encodeURIComponent(e.file_id)}/delete`,{protocol_version:1,type:"delete_file",mutation_id:o,file_id:e.file_id,if_revision:t.ifRevision??e.revision,path:e.path},t.signal)}catch(r){throw Re(r)}if(i.protocol_version!==1||i.type!=="file_deleted"||i.mutation_id!==o||i.file_id!==e.file_id||i.previous_path!==e.path)throw c("invalid_operation_response","The authority returned an invalid file delete receipt.");return i}async uploadPart(e,t,o,i,r,a,s){for(let l=1;l<=ue;l+=1){W(s);try{let d=await this.request("POST",`uploads/${encodeURIComponent(e)}/parts`,{protocol_version:1,type:"prepare_file_upload_part",transfer_id:e,part_number:t+1,content_length:r},s);Do(d,e,t,o,r,"PUT");let u=await fetch(d.url,{method:d.method,headers:zo(d.headers),body:i,redirect:"error",signal:s});if(!u.ok)throw new Error(`Object upload failed with HTTP ${u.status}.`);let p=u.headers.get("etag");if(a&&!p)throw new Error("Multipart object upload did not return an ETag.");return{part_number:t+1,etag:p??""}}catch(d){if(s?.aborted||l===ue)throw d}}throw new Error("Unreachable upload retry state.")}async tryReplayUploadCommit(e,t,o){try{return await this.commitUpload(e,t,o)}catch(i){if(i instanceof v&&i.code==="file_upload_incomplete")return null;throw i}}async commitUpload(e,t,o){let i;for(let r=1;r<=ue;r+=1){W(o);try{return await this.request("POST",`uploads/${encodeURIComponent(e)}/commit`,{protocol_version:1,type:"commit_file_upload",transfer_id:e,...t===void 0?{}:{parts:t}},o)}catch(a){if(i=a,o?.aborted||a instanceof v||r===ue)throw a}}throw i}requireAction(e){if(!this.capability()?.actions.includes(e))throw c("not_authorized",`This connection is not authorized to ${e} files.`)}async abort(e){await this.request("DELETE",`transfers/${encodeURIComponent(e)}`).catch(()=>{})}};async function To(n,e,t){let o=new de;for(let i=0;i<n.size;i+=Rn){W(e);let r=new Uint8Array(await n.slice(i,i+Rn).arrayBuffer());o.update(r),t(Math.min(n.size,i+r.byteLength))}return n.size===0&&t(0),o.digestHex()}function Io(n,e){if(n instanceof Blob)return e&&e!==n.type?n.slice(0,n.size,e):n;if(n instanceof ArrayBuffer)return new Blob([n],{type:e});let t=new Uint8Array(n.byteLength);return t.set(new Uint8Array(n.buffer,n.byteOffset,n.byteLength)),new Blob([t.buffer],{type:e})}function Eo(n){return n instanceof Blob?n.size:n.byteLength}async function xo(n){return n instanceof Blob?new Uint8Array(await n.arrayBuffer()):n}function On(n=ko){if(!Number.isInteger(n)||n<1||n>Sn)throw c("invalid_request",`File concurrency must be between 1 and ${Sn}.`);return n}function Mo(n){if(!Number.isInteger(n)||n<1||n>1e3)throw c("invalid_request","File page size must be between 1 and 1000.");return n}function An(n,e,t){if(n.protocol_version!==1||n.type!=="file_transfer"||n.transfer_id!==e||n.direction!==t||!Number.isSafeInteger(n.total_size)||n.total_size<0||!Array.isArray(n.received)||!Fo(n))throw c("invalid_operation_response","The authority returned an invalid file transfer session.");let o=n.strategy.kind==="framed_chunks"?n.strategy.chunk_size:n.strategy.kind==="object_put"?Math.max(1,n.total_size):n.strategy.part_size,i=n.strategy.kind==="object_put"?1:Math.ceil(n.total_size/o);if(new Set(n.received).size!==n.received.length||n.received.some(a=>!Number.isSafeInteger(a)||a<0||a>=i))throw c("invalid_operation_response","The authority returned invalid transfer progress.");let r=n.uploaded_parts??[];if(!Array.isArray(r)||r.some((a,s)=>!Number.isSafeInteger(a?.part_number)||a.part_number<1||a.part_number>i||typeof a.etag!="string"||a.etag.length===0||a.etag.length>255||s>0&&r[s-1].part_number>=a.part_number)||(n.strategy.kind==="object_multipart"?r.length!==n.received.length||r.some((a,s)=>a.part_number-1!==n.received[s]):r.length!==0))throw c("invalid_operation_response","The authority returned invalid uploaded part receipts.")}function Fo(n){return n.strategy.kind==="framed_chunks"?n.protection==="grant_aead_v1"&&Number.isSafeInteger(n.strategy.chunk_size)&&n.strategy.chunk_size>0:n.protection!=="transport_tls"?!1:n.strategy.kind==="object_put"?!0:Number.isSafeInteger(n.strategy.part_size)&&n.strategy.part_size>0}function Uo(n,e,t){return Math.min(e,Math.max(0,n-t*e))}async function bt(n,e){for(let t=1;t<=ue;t+=1){W(e);try{return await n()}catch(o){if(e?.aborted||t===ue)throw o}}throw new Error("Unreachable file chunk retry state.")}function Do(n,e,t,o,i,r){let a;try{a=new URL(n.url)}catch{throw c("invalid_operation_response","The authority returned an invalid object URL.")}if(n.protocol_version!==1||n.type!=="file_part"||n.transfer_id!==e||n.part_index!==t||n.offset!==o||n.content_length!==i||n.method.toUpperCase()!==r||a.protocol!=="https:"&&!(a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))||a.username||a.password)throw c("invalid_operation_response","The authority returned an invalid prepared file part.")}function zo(n){let e=new Headers;for(let[t,o]of Object.entries(n))["host","content-length"].includes(t.toLowerCase())||e.set(t,o);return e}async function Lo(n,e,t){let o=new Array(n),i=0;return await Promise.all(Array.from({length:Math.min(n,e)},async()=>{for(;i<n;){let r=i;i+=1,o[r]=await t(r)}})),o}function W(n){if(n?.aborted)throw c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n.reason})}function Re(n){return n instanceof v?n:typeof DOMException<"u"&&n instanceof DOMException&&n.name==="AbortError"?c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n}):c("temporarily_unavailable","The file transfer could not be completed.",{cause:n})}var Z=["describe","changes","read","query"];var ke=class{constructor(e,t){this.internals=e;this.collectionId=t;this.transport=new Ye({serverUrl:e.serverUrl,storage:e.storage,keyStore:e.keyStore,directAccessMode:e.directAccessMode,loopbackUrl:e.loopbackUrl,collectionId:t,internals:e,onChange:()=>this.emitConnection()}),this.files=new Se(()=>this.fileCapability,(o,i,r,a)=>this.transport.files.control(o,i,r,a),{uploadChunk:(o,i,r,a)=>this.transport.files.uploadChunk(o,i,r,a),downloadChunk:(o,i,r)=>this.transport.files.downloadChunk(o,i,r)},{downloadPart:(o,i,r,a)=>this.transport.files.downloadHostedPart(o,i,r,a)}),this.collectionClient=new be({operation:(o,i,r)=>this.transport.performOperation(o,i,r)}),this.notifications=new je({serverUrl:e.serverUrl,storage:e.storage,authorizedToken:()=>this.transport.authorizedToken(),register:()=>this.internals.register(),notificationKey:o=>e.notificationKey(t,o)})}internals;collectionId;collectionClient;notifications;transport;files;connectionListeners=new Set;get displayName(){return this.transport.currentToken()?.collectionName??`Collection ${this.collectionId.slice(0,8)}`}get operations(){return[...this.transport.currentToken()?.operations??[]]}get scope(){return this.transport.currentToken()?.scope??null}get fileCapability(){return this.transport.currentToken()?.fileCapability??null}get directAccess(){return this.transport.directAccess}get route(){return this.transport.route}register(){return P(()=>this.internals.register(),Y)}info(){let e=this.transport.currentToken();return e?{collectionId:e.collectionId,displayName:e.collectionName,operations:[...e.operations],scope:e.scope,...e.fileCapability?{fileCapability:e.fileCapability}:{},route:this.transport.route,directAccess:this.transport.directAccess}:null}authorizationCapabilities(e=Z){let t=this.operations,o=D(e).filter(i=>!t.includes(i));return{authorized:this.info()!==null,sufficient:this.info()!==null&&o.length===0,collectionId:this.collectionId,grantedOperations:t,missingOperations:o}}hasOperations(e){return this.authorizationCapabilities(e).sufficient}authorize(e={}){return P(()=>this.internals.authorize({...e,target:{kind:"collection",collectionId:this.collectionId}}),J)}async requestOperations(e,t={}){let o=this.authorizationCapabilities(e);return o.sufficient?A({kind:"unchanged",connection:this}):this.authorize({...t,operations:D([...o.grantedOperations,...o.missingOperations])})}onConnectionChange(e){return this.connectionListeners.add(e),e(this.info()),()=>this.connectionListeners.delete(e)}notifyStorageChanged(){this.transport.notifyStorageChanged()}checkDirectAccess(){return P(()=>this.transport.checkDirectAccess(),Le)}requestDirectAccess(){return P(()=>this.transport.requestDirectAccess(),Le)}disableDirectAccess(){this.transport.disableDirectAccess()}sync(){let e=this.transport.currentToken();if(!e)return null;let t=e.collectionId;if(!e.authority){if(!e.grantId||!e.operations.includes("sync"))return null;let i=e.grantId;return{collectionId:t,replicaId:i,transport:{openSession:()=>this.transport.performOperation("sync",{action:"open_session"}),snapshot:(r,a)=>this.transport.performOperation("sync",{action:"snapshot",snapshot_id:r,...a?{page:a}:{}}),changes:(r,a=200)=>this.transport.performOperation("sync",{action:"changes",after:r,limit:a}),mutate:r=>this.transport.performOperation("sync",{action:"mutate",mutation:r})}}}let o=e.authority.replicaId;return{collectionId:t,replicaId:o,transport:{openSession:()=>this.transport.performAuthoritySyncRequest(t,o,"POST","sessions"),snapshot:(i,r)=>{let a=new URLSearchParams({snapshot_id:i});return r&&a.set("page",r),this.transport.performAuthoritySyncRequest(t,o,"GET",`snapshot?${a}`)},changes:(i,r=200)=>this.transport.performAuthoritySyncRequest(t,o,"GET",`changes?${new URLSearchParams({after:String(i),limit:String(r)})}`),mutate:i=>this.transport.performAuthoritySyncRequest(t,o,"POST","mutations",i)}}}registerNotifications(e){return P(()=>this.notifications.registerNotifications(e),re)}registerNativeNotifications(e){return P(()=>this.notifications.registerNativeNotifications(e),re)}unregisterNativeNotifications(){return P(()=>this.notifications.unregisterNativeNotifications(),re)}unregisterNotifications(e){return P(()=>this.notifications.unregisterNotifications(e),re)}forget(){let e=this.transport.currentToken();this.internals.removeToken(this.collectionId,e?.keyHandle,"not_authorized"),this.transport.notifyStorageChanged()}describe(){return this.collectionClient.describe()}changes(e={},t){return this.collectionClient.changes(e,t)}read(e){return this.collectionClient.read(e)}query(e={},t){return this.collectionClient.query(e,t)}queryPages(e={},t={}){return this.collectionClient.queryPages(e,t)}queryAll(e={},t={}){return this.collectionClient.queryAll(e,t)}listViews(){return this.collectionClient.listViews()}executeView(e){return this.collectionClient.executeView(e)}readViewSource(e){return this.collectionClient.readViewSource(e)}createViewSource(e){return this.collectionClient.createViewSource(e)}updateViewSource(e){return this.collectionClient.updateViewSource(e)}deleteViewSource(e){return this.collectionClient.deleteViewSource(e)}create(e){return this.collectionClient.create(e)}update(e){return this.collectionClient.update(e)}delete(e,t){return this.collectionClient.delete(e,t)}preflightDelete(e,t){return this.collectionClient.preflightDelete(e,t)}rename(e,t){return this.collectionClient.rename(e,t)}preflightRename(e,t){return this.collectionClient.preflightRename(e,t)}async renameWithProgress(e,t={}){let o=Date.now(),i=this.pendingMutation()?.operation==="rename",r,a=(s,l,d=0)=>{t.onProgress?.({operation:"rename",state:s,elapsedMs:Date.now()-o,cancellable:l,resumed:i,completedUnits:d,...r?{estimate:r}:{}})};try{X(t.signal),a("preflighting",!0);let s=t.preflight?A(t.preflight):await this.preflightRename(e,{signal:t.signal});if(!s.ok)return s;let l=s.value;try{Wt(e,l)}catch(p){if(p instanceof v)return R(p.problem);throw p}r=en(e,l),a("ready",!0),X(t.signal);let d=this.transport.hasResumableMutationTransport();a("applying",d);let u=await this.rename(e,d?{signal:t.signal}:void 0);return u.ok&&a("completed",!1,r.totalUnits),u}catch(s){if(ft(s,t.signal)&&a("cancelled",!1),s instanceof v)return R(s.problem);throw s}}async deleteWithProgress(e,t={}){let o=Date.now(),i=this.pendingMutation()?.operation==="delete",r,a=(s,l,d=0)=>{t.onProgress?.({operation:"delete",state:s,elapsedMs:Date.now()-o,cancellable:l,resumed:i,completedUnits:d,...r?{estimate:r}:{}})};try{X(t.signal),a("preflighting",!0);let s=t.preflight?A(t.preflight):await this.preflightDelete(e,{signal:t.signal});if(!s.ok)return s;let l=s.value;try{Zt(e,l)}catch(p){if(p instanceof v)return R(p.problem);throw p}r=tn(l),a("ready",!0),X(t.signal);let d=this.transport.hasResumableMutationTransport();a("applying",d);let u=await this.delete(e,d?{signal:t.signal}:void 0);return u.ok&&a("completed",!1,r.totalUnits),u}catch(s){if(ft(s,t.signal)&&a("cancelled",!1),s instanceof v)return R(s.problem);throw s}}pendingMutation(){return this.transport.pendingMutation()}resumePendingMutation(e,t){return P(()=>this.transport.resumePendingMutation(e,t),S)}validate(e={}){return this.collectionClient.validate(e)}readType(e){return this.collectionClient.readType(e)}createType(e){return this.collectionClient.createType(e)}updateType(e){return this.collectionClient.updateType(e)}installTypePack(e){return this.collectionClient.installTypePack(e)}listTimers(e){return this.collectionClient.listTimers(e)}putTimer(e){return this.collectionClient.putTimer(e)}cancelTimer(e){return this.collectionClient.cancelTimer(e)}reconcileTimers(e){return this.collectionClient.reconcileTimers(e)}watch(e={}){return this.collectionClient.watch(e)}operation(e,t,o){return this.collectionClient.operation(e,t,o)}emitConnection(){let e=this.info();for(let t of this.connectionListeners)t(e)}};function Oe(n){for(let e of["code","state","error","error_description"])n.searchParams.delete(e);return n}function Qe(n){let e;try{e=new URL(n)}catch{return!1}return e.searchParams.has("state")&&(e.searchParams.has("code")||e.searchParams.has("error"))}function Tn(n){if(!n.details||typeof n.details!="object"||Array.isArray(n.details))return;let e=n.details.return_to;return typeof e=="string"?e:void 0}var Ae=class{constructor(e,t){this.connect=e;this.operations=D(t.operations??Z),this.selection=t.selection,this.autoSelect=t.autoSelect??"only",this.snapshot={status:"unselected",connections:[]},this.refresh()}connect;operations;selection;autoSelect;listeners=new Set;snapshot;snapshotKey="";stopConnections;stopSelection;stopActiveConnection;activeCollectionId=null;unavailableReason="not_authorized";started=!1;refreshing=!1;refreshQueued=!1;transactionDepth=0;callbackPromise=null;async start(){this.started||(this.started=!0,this.stopConnections=this.connect.onConnectionsChange(()=>this.refresh()),this.stopSelection=this.selection.subscribe(()=>{this.unavailableReason="not_authorized",this.refresh()}));let e=this.selection.authorizationCallback();if(e){let t=await this.handleAuthorizationCallback(e);if(!t.ok)return t}else this.autoSelectOnlyConnection();return this.refresh(),A(this.snapshot)}destroy(){this.stopConnections?.(),this.stopSelection?.(),this.stopActiveConnection?.(),this.stopConnections=void 0,this.stopSelection=void 0,this.stopActiveConnection=void 0,this.activeCollectionId=null,this.started=!1}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}select(e,t={}){let o=this.connect.connection(e);return o?(this.unavailableReason="not_authorized",this.selection.select(e,t),this.refresh(),A(o)):R(E("unknown_collection","This collection is not authorized for this application."))}clearSelection(e={}){this.unavailableReason="not_authorized",this.selection.select(null,e),this.refresh()}forget(e){this.transactionDepth+=1;try{let t=this.selection.selectedCollectionId()===e;this.connect.connection(e)?.forget(),t&&this.selection.select(null,{history:"replace"})}finally{this.transactionDepth-=1,this.refresh()}}async authorize(e,t={}){let o=this.selection.selectedCollectionId();if(e==="selected"&&!o)return R(E("collection_not_selected","Choose a collection before updating its access."));let i=typeof e=="object"?e.collectionId:e==="selected"?o:null;this.transactionDepth+=1;try{let r=await this.connect.authorize({...t,operations:this.operations,target:i===null?{kind:"choose"}:{kind:"collection",collectionId:i},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}async ensureOperations(e){let t=this.snapshot;if(t.status!=="ready")return R(E("collection_not_ready","Choose an authorized collection first."));let o=D(e),i=t.connection.authorizationCapabilities(o);if(i.sufficient)return A({kind:"unchanged",connection:t.connection});this.transactionDepth+=1;try{let r=await this.connect.authorize({operations:D([...i.grantedOperations,...i.missingOperations]),target:{kind:"collection",collectionId:t.collectionId},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}handleAuthorizationCallback(e){if(!Qe(e))return Promise.resolve(R(E("invalid_callback","This URL is not an authorization callback.")));if(this.callbackPromise)return this.callbackPromise;this.transactionDepth+=1;let t=this.connect.completeAuthorization(e).then(o=>{if(!o.ok){let r=Tn(o.problem);return this.selection.clearAuthorizationCallback(r),this.refresh(),o}let i=o.value;return this.unavailableReason="not_authorized",this.selection.finishAuthorization(i.returnTo,i.connection.collectionId),this.refresh(),A(i.connection,o.diagnostics)}).catch(o=>{throw this.selection.clearAuthorizationCallback(),this.refresh(),o}).finally(()=>{this.transactionDepth-=1,this.refresh(),this.callbackPromise===t&&(this.callbackPromise=null)});return this.callbackPromise=t,t}autoSelectOnlyConnection(){if(this.autoSelect!=="only"||this.selection.selectedCollectionId())return;let e=this.connect.connections();e.length===1&&this.selection.select(e[0].collectionId,{history:"replace"})}refresh(){if(this.transactionDepth>0){this.refreshQueued=!0;return}if(this.refreshing){this.refreshQueued=!0;return}this.refreshing=!0;try{do this.refreshQueued=!1,this.refreshOnce();while(this.refreshQueued)}finally{this.refreshing=!1}}refreshOnce(){let e=this.selection.selectedCollectionId(),t=this.connect.connections(),o=e?this.connect.connection(e):null;o?.collectionId!==this.activeCollectionId&&(this.stopActiveConnection?.(),this.activeCollectionId=o?.collectionId??null,this.stopActiveConnection=o?.onConnectionChange(a=>{!a&&this.selection.selectedCollectionId()===o.collectionId&&(this.unavailableReason="authorization_lost"),this.refresh()}));let i;if(!e)i={status:"unselected",connections:t};else if(!o||!o.info())i={status:"unavailable",collectionId:e,reason:this.connect.unavailableReason(e)??this.unavailableReason,connections:t};else{let a=o.info();i={status:"ready",collectionId:e,connection:o,info:a,access:o.authorizationCapabilities(this.operations),connections:t}}let r=No(i);if(r!==this.snapshotKey){this.snapshot=i,this.snapshotKey=r;for(let a of this.listeners)a()}}};function No(n){return n.status==="unselected"?JSON.stringify({status:n.status,connections:n.connections}):n.status==="unavailable"?JSON.stringify({status:n.status,collectionId:n.collectionId,reason:n.reason,connections:n.connections}):JSON.stringify({status:n.status,collectionId:n.collectionId,info:n.info,access:n.access,connections:n.connections})}var vt=class{internals;constructor(e){this.internals=new wt(e)}register(){return P(()=>this.internals.register(),Y)}authorize(e={}){return P(()=>this.internals.authorize(e),J)}createSession(e){return new Ae(this,e)}environment(){return this.internals.environment()}completeAuthorization(e){return P(()=>this.internals.completeAuthorization(e??un()),J)}connections(){return this.internals.connections()}connection(e){return this.internals.connection(e)}unavailableReason(e){return this.internals.unavailableReason(e)}onConnectionsChange(e){return this.internals.onConnectionsChange(e)}forgetAll(){for(let e of this.connections())this.connection(e.collectionId)?.forget()}},wt=class{serverUrl;manifest;manifestSource;redirectUri;storage;relayEncryption;keyStore;directAccessMode;loopbackUrl;navigate;credentialStorage;application=null;completionPromises=new Map;connectionCache=new Map;listeners=new Set;invalidatedConnections=new Map;constructor(e){this.serverUrl=cn(e.serverUrl),this.manifest=e.manifest??ln(),this.manifestSource=typeof this.manifest=="string"?this.manifest:this.manifest.distribution==="portable"?`bundle:${this.manifest.id}:${fn(this.manifest)}`:`bundle:${this.manifest.id}`;let t=hn(this.manifest);this.redirectUri=e.redirectUri??(typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"":dn()),this.storage=e.storage??pn(t),this.relayEncryption=e.relayEncryption??"required",this.keyStore=e.keyStore??(t?new ne:new te),this.credentialStorage=e.storage||e.keyStore?"custom":this.storage instanceof ce?"memory":"persistent",this.directAccessMode=e.directAccess??"auto",this.loopbackUrl=on(e.loopbackUrl??`http://127.0.0.1:${Et}`),this.navigate=e.navigate,typeof window<"u"&&this.storage===window.localStorage&&window.addEventListener("storage",o=>{o.storageArea!==this.storage||!o.key?.startsWith(this.storagePrefix())||(this.connectionCache.get(qo(o.key))?.notifyStorageChanged(),this.emitConnections())})}environment(){let e=typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"portable":this.application?.distribution??"web";return{distribution:e,applicationOrigin:e==="portable"?"null":this.defaultApplicationOrigin(),credentialStorage:this.credentialStorage}}async register(){if(this.application)return this.application;let e=await q(`${this.serverUrl}/v1/apps/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({manifest:await this.loadManifest()})},"temporarily_unavailable","Application registration is temporarily unavailable."),t=await e.json();if(!e.ok)throw C(t,"discovery_failed","Application discovery failed.",e.status);return this.application=t.application,this.application}async loadManifest(){if(typeof this.manifest!="string")return this.manifest;let e=this.manifest,t;try{t=await fetch(e,{headers:{accept:"application/json"}})}catch(o){throw c("manifest_load_failed","The bundled application declaration could not be loaded.",{cause:o})}if(!t.ok)throw c("manifest_load_failed",`The bundled application declaration returned HTTP ${t.status}.`,{status:t.status});try{return await t.json()}catch(o){throw c("invalid_application_manifest","The bundled application declaration is not valid JSON.",{cause:o})}}async authorize(e={}){if(typeof location>"u"&&!this.navigate&&!e.openVerification)throw c("browser_required","Authorization navigation requires a browser environment.");let o=typeof this.manifest!="string"&&this.manifest.distribution==="portable"&&!e.openVerification&&typeof window<"u"?window.open(`${this.serverUrl}/device`,"mdbase-connect-authorization","popup,width=620,height=760"):null,i;try{i=await this.register()}catch(h){throw o?.close(),h}if(i.distribution==="portable")return this.authorizePortable(i,e,o);o?.close();let{verifier:r,challenge:a}=await Ce(),s=N(24),l=e.target?.kind==="collection"?e.target.collectionId:void 0,d=this.relayEncryption==="required"?`grant:${i.id}:${s}`:void 0,u=d?await this.keyStore.create(d):void 0,p={version:1,verifier:r,state:s,clientId:i.id,redirectUri:this.redirectUri,relayEncryption:this.relayEncryption,collectionId:l,returnTo:e.returnTo,keyHandle:d,applicationAgreementPublicKey:u?.agreementPublicKey,applicationSigningPublicKey:u?.signingPublicKey};this.storage.setItem(this.pendingKey(s),JSON.stringify(p));let f=new URL(`${this.serverUrl}/oauth/authorize`);return f.searchParams.set("client_id",i.id),f.searchParams.set("redirect_uri",this.redirectUri),f.searchParams.set("code_challenge",a),f.searchParams.set("code_challenge_method","S256"),f.searchParams.set("state",s),f.searchParams.set("operations",D(e.operations??Z).join(",")),l&&f.searchParams.set("collection_id",l),u&&(f.searchParams.set("relay_protocol","1"),f.searchParams.set("application_agreement_public_key",u.agreementPublicKey),f.searchParams.set("application_signing_public_key",u.signingPublicKey)),this.navigate?await this.navigate(f.href):location.assign(f.href),{kind:"redirecting"}}async authorizePortable(e,t,o){if(this.relayEncryption!=="required")throw o?.close(),c("encryption_required","Downloaded applications require encrypted relay authorization.");let{verifier:i,challenge:r}=await Ce(),a=`grant:${e.id}:${N(24)}`,s=await this.keyStore.create(a),l,d;try{l=await fetch(`${this.serverUrl}/oauth/device_authorization`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,operations:D(t.operations??Z).join(","),...t.target?.kind==="collection"?{collection_id:t.target.collectionId}:{},code_challenge:r,code_challenge_method:"S256",relay_protocol:"1",application_agreement_public_key:s.agreementPublicKey,application_signing_public_key:s.signingPublicKey})}),d=await l.json()}catch(f){throw o?.close(),await this.keyStore.delete(a),c("device_authorization_failed","Downloaded application authorization could not be started.",{cause:f})}if(!l.ok)throw o?.close(),await this.keyStore.delete(a),C(d,"device_authorization_failed","Downloaded application authorization could not be started.",l.status);let u;try{u=sn(d)}catch(f){throw o?.close(),await this.keyStore.delete(a),f}if(t.onDeviceCode?.(u),t.openVerification)await t.openVerification(u);else if(o)try{o.location.href=u.verificationUriComplete}catch{}else throw await this.keyStore.delete(a),c("approval_window_blocked","The approval window was blocked. Show the provided verification link and code, then try again.",{details:{user_code:u.userCode,verification_uri:u.verificationUri,verification_uri_complete:u.verificationUriComplete,expires_at:u.expiresAt,interval_seconds:u.intervalSeconds}});let p=u.intervalSeconds;try{for(;Date.now()<u.expiresAt;){if(await _e(p*1e3,t.signal),t.signal?.aborted)throw c("authorization_cancelled","Downloaded application authorization was cancelled.");let f;try{f=await fetch(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:d.device_code,client_id:e.id,code_verifier:i}),signal:t.signal})}catch(b){if(t.signal?.aborted)throw c("authorization_cancelled","Downloaded application authorization was cancelled.",{cause:b});continue}let h=await f.json();if(!f.ok){let b=Pe(h);if(b==="authorization_pending")continue;if(b==="slow_down"){p+=5;continue}throw C(h,"token_exchange_failed","Downloaded application authorization could not be completed.",f.status)}let m=qe(h.authority,h.collection_id),_=h.encryption&&h.encryption.protocol_version===ee&&h.encryption.suite===fe&&h.encryption.application_agreement_public_key===s.agreementPublicKey;if(h.application_origin!=="null")throw c("invalid_token_response","Authorization did not bind the portable grant to its opaque application origin.");if(h.authority&&(!m||h.encryption!=null||h.authority.proof_public_key!==s.signingPublicKey))throw c("invalid_token_response","Authorization returned a remote authority capability that is not bound to this portable grant key.");if(!h.authority&&!_)throw c("encryption_required","Authorization did not establish the expected key-bound local portable grant.");let w=this.storeTokenResponse(h,e.id,a);if(t.target?.kind==="collection"&&t.target.collectionId!==w.collectionId)throw this.removeToken(w.collectionId,w.keyHandle),c("collection_mismatch","The approved collection does not match the collection requested by this link.");return o?.close(),{kind:"connected",connection:this.connection(w.collectionId),...t.returnTo?{returnTo:t.returnTo}:{}}}throw c("expired_token","The downloaded application authorization code expired.")}catch(f){throw o?.close(),await this.keyStore.delete(a),f}}completeAuthorization(e){let t=new URL(e).searchParams.get("state");if(!t)return Promise.reject(c("invalid_callback","Authorization callback is missing its state."));let o=this.completionPromises.get(t);if(o)return o;let r=this.performAuthorizationCompletion(e,t).finally(()=>{this.completionPromises.get(t)===r&&this.completionPromises.delete(t)});return this.completionPromises.set(t,r),r}async performAuthorizationCompletion(e,t){let o=new URL(e),i=o.searchParams.get("code"),r=this.pendingKey(t),a=I(this.storage.getItem(r));if(!a||a.version!==1||t!==a.state)throw c("invalid_callback","Authorization callback is missing or does not match this browser session.");if(o.searchParams.has("error"))throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),x(o.searchParams.get("error")??"access_denied",o.searchParams.get("error_description")??"Collection access was not approved.",{details:a.returnTo?{return_to:a.returnTo}:void 0});if(!i)throw c("invalid_callback","Authorization callback is missing its code.");let s=await q(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:i,client_id:a.clientId,redirect_uri:a.redirectUri,code_verifier:a.verifier})},"temporarily_unavailable","Authorization completion is temporarily unavailable."),l=await s.json();if(!s.ok)throw C(l,"token_exchange_failed","Authorization could not be completed.",s.status);if(a.relayEncryption==="required"&&!l.authority&&(!l.encryption||!a.keyHandle||l.encryption.application_agreement_public_key!==a.applicationAgreementPublicKey))throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),c("encryption_required","Authorization did not establish the required encrypted relay grant.");if(l.authority?.proof_public_key){if(!a.keyHandle||!a.applicationSigningPublicKey||l.authority.proof_public_key!==a.applicationSigningPublicKey)throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),c("invalid_token_response","Authorization returned a remote authority capability bound to another application key.")}else l.authority&&a.keyHandle&&await this.keyStore.delete(a.keyHandle);let d=this.storeTokenResponse(l,a.clientId,l.authority?.proof_public_key?a.keyHandle:l.authority?void 0:a.keyHandle);if(a.collectionId&&a.collectionId!==d.collectionId)throw this.removeToken(d.collectionId,d.keyHandle),this.storage.removeItem(r),c("collection_mismatch","The approved collection does not match the collection requested by this link.");return this.storage.removeItem(r),{connection:this.connection(d.collectionId),...a.returnTo?{returnTo:a.returnTo}:{}}}connections(){let e=[];for(let t of this.connectionIds()){let o=this.connection(t)?.info();o&&e.push(o)}return e.sort((t,o)=>t.displayName.localeCompare(o.displayName)||t.collectionId.localeCompare(o.collectionId))}connection(e){if(!this.storage.getItem(this.tokenKey(e)))return null;let t=this.connectionCache.get(e);return t||(t=new ke(this,e),this.connectionCache.set(e,t)),t.info()?t:null}unavailableReason(e){return this.invalidatedConnections.get(e)??null}onConnectionsChange(e){return this.listeners.add(e),e(this.connections()),()=>this.listeners.delete(e)}storeTokenResponse(e,t,o){let i=e.collection_id;if(typeof i!="string")throw c("invalid_token_response","Authorization returned no collection ID.");let r=Ke(e.scope);if(!r)throw c("invalid_token_response","Authorization returned no valid collection scope.");if(e.authority&&!qe(e.authority,i))throw c("invalid_token_response","Authorization returned an invalid remote authority capability.");if(e.authority&&e.encryption)throw c("invalid_token_response","Authorization returned conflicting collection transports.");if(e.file_capability!==null&&e.file_capability!==void 0&&!Be(e.file_capability))throw c("invalid_token_response","Authorization returned an invalid file capability.");if(e.encryption){try{G(e.encryption)}catch{throw c("invalid_token_response","Authorization returned an invalid encrypted relay binding.")}if(e.encryption.collection_id!==i||typeof e.grant_id!="string"||e.grant_id.length===0)throw c("invalid_token_response","Authorization returned an encrypted relay binding for another grant.")}let a=I(this.storage.getItem(this.tokenKey(i)));if(a?.encryption&&e.encryption&&a.keyHandle&&a.keyHandle===o&&(a.grantId!==e.grant_id||a.encryption.connector_id!==e.encryption.connector_id||a.encryption.connector_agreement_public_key!==e.encryption.connector_agreement_public_key||a.encryption.application_agreement_public_key!==e.encryption.application_agreement_public_key))throw c("connector_identity_changed","The connector identity changed during authorization renewal. Reauthorize before sending collection data.");a?.keyHandle&&a.keyHandle!==o&&this.keyStore.delete(a.keyHandle).catch(()=>{});let s={version:1,accessToken:e.access_token,refreshToken:e.refresh_token,clientId:t,collectionId:i,collectionName:e.collection_name??`Collection ${i.slice(0,8)}`,operations:e.operations,scope:r,expiresAt:Date.now()+e.expires_in*1e3,refreshExpiresAt:e.refresh_expires_in?Date.now()+e.refresh_expires_in*1e3:void 0,grantId:e.grant_id,encryption:e.encryption??void 0,fileCapability:e.file_capability??void 0,applicationOrigin:e.application_origin??this.defaultApplicationOrigin(),keyHandle:o,savedAt:Date.now(),authority:e.authority?{operationsUrl:e.authority.operations_url,syncUrl:e.authority.sync_url,filesUrl:e.authority.files_url,replicaId:e.authority.replica_id,accessToken:e.authority.access_token,proofPublicKey:e.authority.proof_public_key}:void 0};return this.storage.setItem(this.tokenKey(i),JSON.stringify(s)),this.addConnectionId(i),this.invalidatedConnections.delete(i),this.connectionCache.delete(i),this.emitConnections(),s}removeToken(e,t,o="authorization_lost"){this.invalidatedConnections.set(e,o),t&&this.keyStore.delete(t).catch(()=>{}),this.storage.removeItem(this.tokenKey(e)),this.storage.removeItem(this.pendingMutationKey(e));for(let i of["web_push","fcm"])this.storage.removeItem(this.notificationKey(e,i));this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:this.connectionIds().filter(i=>i!==e)})),this.connectionCache.delete(e),this.emitConnections()}tokenKey(e){return`${this.storagePrefix()}:token:${e}`}pendingMutationKey(e){return`${this.storagePrefix()}:pending-mutation:${e}`}notificationKey(e,t="web_push"){return`${this.storagePrefix()}:notifications:${e}:${t}`}directPreferenceKey(){return`mdbase-connect:direct:${this.defaultApplicationOrigin()}`}defaultApplicationOrigin(){if(typeof this.manifest!="string"&&this.manifest.distribution==="portable"||this.application?.distribution==="portable")return"null";let e=new URL(this.redirectUri);if(["http:","https:"].includes(e.protocol))return e.origin;if(typeof location<"u")return location.origin;if(this.manifest&&typeof this.manifest!="string")return new URL(this.manifest.homepage).origin;try{return new URL(this.manifestSource).origin}catch{return""}}pendingKey(e){return`${this.storagePrefix()}:pending:${e}`}storagePrefix(){return`mdbase-connect:${this.serverUrl}:${this.manifestSource}`}connectionsKey(){return`${this.storagePrefix()}:connections`}connectionIds(){let e=I(this.storage.getItem(this.connectionsKey()));return e?.version===1&&Array.isArray(e.collectionIds)&&e.collectionIds.every(t=>typeof t=="string")?e.collectionIds:[]}addConnectionId(e){this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:[...new Set([...this.connectionIds(),e])]}))}emitConnections(){let e=this.connections();for(let t of this.listeners)t(e)}};function qo(n){let e=":token:",t=n.lastIndexOf(e);return t<0?"":n.slice(t+e.length)}function In(n){if(!n||typeof n!="object")throw c("invalid_push_payload","The push payload is not an object.");let e=n;if(e.type!=="mdbase.notification"||e.version!==1||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string"||!e.presentation||typeof e.presentation.title!="string")throw c("invalid_push_payload","The push payload is not an mdbase notification.");return e}function Bo(n){if(!n||typeof n!="object")throw c("invalid_push_payload","The native notification data is not an object.");let e=n;if(e.type!=="mdbase.notification"||e.version!==1&&e.version!=="1"||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string")throw c("invalid_push_payload","The native notification data is not an mdbase notification.");return{type:"mdbase.notification",version:1,signal_id:e.signal_id,criterion_id:e.criterion_id,cursor:e.cursor}}function Ko(n,e){let t=In(e);return n.showNotification(t.presentation.title,{...t.presentation.body?{body:t.presentation.body}:{},...t.presentation.tag?{tag:t.presentation.tag}:{},data:{type:t.type,signal_id:t.signal_id,criterion_id:t.criterion_id,cursor:t.cursor}})}var Ct=class{collectionParameter;fallbackPath;listeners=new Set;handlePopState=()=>this.emit();constructor(e={}){this.collectionParameter=e.collectionParameter??"collection",this.fallbackPath=e.fallbackPath??"/"}selectedCollectionId(){return this.currentUrl().searchParams.get(this.collectionParameter)}select(e,t={}){let o=Oe(this.currentUrl());e?o.searchParams.set(this.collectionParameter,e):o.searchParams.delete(this.collectionParameter);let i=this.browserHistory();i[t.history==="push"?"pushState":"replaceState"](i.state,"",o),this.emit()}authorizationReturnTo(){let e=Oe(this.currentUrl());return`${e.pathname}${e.search}${e.hash}`}authorizationCallback(){let e=this.currentUrl().href;return Qe(e)?e:null}finishAuthorization(e,t){let o=this.safeAppUrl(e??this.fallbackPath);Oe(o),o.searchParams.set(this.collectionParameter,t),this.browserHistory().replaceState(null,"",o),this.emit()}clearAuthorizationCallback(e){let t=e?this.safeAppUrl(e):this.currentUrl(),o=this.browserHistory();o.replaceState(o.state,"",Oe(t)),this.emit()}subscribe(e){let t=this.listeners.size===0;return this.listeners.add(e),t&&typeof window<"u"&&window.addEventListener("popstate",this.handlePopState),()=>{this.listeners.delete(e),this.listeners.size===0&&typeof window<"u"&&window.removeEventListener("popstate",this.handlePopState)}}emit(){for(let e of this.listeners)e()}safeAppUrl(e){let t=this.currentUrl(),o=new URL(e,t.origin);return o.origin===t.origin?o:new URL(this.fallbackPath,t.origin)}currentUrl(){if(typeof location>"u")throw c("browser_required","Browser selection requires a browser environment.");return new URL(location.href)}browserHistory(){if(typeof history>"u")throw c("browser_required","Browser selection requires a browser environment.");return history}},Pt=class{collectionId=null;listeners=new Set;selectedCollectionId(){return this.collectionId}select(e){if(e!==this.collectionId){this.collectionId=e;for(let t of this.listeners)t()}}authorizationReturnTo(){}authorizationCallback(){return null}finishAuthorization(e,t){this.select(t)}clearAuthorizationCallback(){}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}};return zn(jo);})();
1
+ "use strict";var MdbaseConnect=(()=>{var pt=Object.defineProperty;var ii=Object.getOwnPropertyDescriptor;var oi=Object.getOwnPropertyNames;var ri=Object.prototype.hasOwnProperty;var ai=(n,e)=>{for(var t in e)pt(n,t,{get:e[t],enumerable:!0})},si=(n,e,t,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of oi(e))!ri.call(n,o)&&o!==t&&pt(n,o,{get:()=>e[o],enumerable:!(i=ii(e,o))||i.enumerable});return n};var ci=n=>si(pt({},"__esModule",{value:!0}),n);var zo={};ai(zo,{ALL_CONNECT_PROBLEM_CODES:()=>Ot,AUTHORIZATION_PROBLEM_CODES:()=>ee,COLLECTION_CHANGES_PROBLEM_CODES:()=>It,COLLECTION_DESCRIPTION_PROBLEM_CODES:()=>Ie,COLLECTION_MUTATION_PROBLEM_CODES:()=>I,COLLECTION_QUERY_PROBLEM_CODES:()=>Tt,COLLECTION_READ_PROBLEM_CODES:()=>q,COLLECTION_SETUP_PROBLEM_CODES:()=>vn,COLLECTION_TYPE_PROBLEM_CODES:()=>ye,COMMON_OPERATION_PROBLEM_CODES:()=>bn,ConnectOutcomeError:()=>Qe,DIRECT_ACCESS_PROBLEM_CODES:()=>Xe,FileTransferCryptoError:()=>H,FirstContactCryptoError:()=>U,GrantFileTransferCipher:()=>ue,IndexedDbGrantKeyStore:()=>ce,MdbaseBrowserSelection:()=>Kt,MdbaseCollectionClient:()=>Ee,MdbaseConnect:()=>Bt,MdbaseConnectError:()=>S,MdbaseConnection:()=>De,MdbaseFileClient:()=>Fe,MdbaseMemorySelection:()=>jt,MdbaseSession:()=>Ne,MemoryGrantKeyStore:()=>le,NOTIFICATION_PROBLEM_CODES:()=>fe,REGISTRATION_PROBLEM_CODES:()=>Z,RelayCryptoError:()=>C,SESSION_PROBLEM_CODES:()=>no,applicationInstallationId:()=>Y,authorizationSigningMessage:()=>$e,captureConnectOutcome:()=>A,connectError:()=>c,connectFailure:()=>T,connectProblem:()=>z,connectSuccess:()=>E,createPkce:()=>Ue,decryptRelayResponse:()=>de,deriveFirstContactSas:()=>Je,encryptRelayRequest:()=>X,isRetryableConnectError:()=>eo,operationProblem:()=>At,parseMdbaseNativeNotificationData:()=>Mo,parseMdbasePushPayload:()=>ti,serverConnectError:()=>D,showMdbasePushNotification:()=>Uo,signApplicationAuthorization:()=>Te,unknownConnectProblem:()=>kt,unwrapConnectOutcome:()=>io});var J={access_denied:{category:"authorization",recovery:"reauthorize"},access_paused:{category:"availability",recovery:"resume_connector_access"},approval_window_blocked:{category:"authorization",recovery:"reauthorize"},authority_authorization_changed:{category:"authorization",recovery:"reauthorize"},authorization_cancelled:{category:"cancellation",recovery:"none"},authorization_expired:{category:"authorization",recovery:"reauthorize"},browser_required:{category:"compatibility",recovery:"none"},callback_url_required:{category:"validation",recovery:"fix_request"},change_cursor_reset:{category:"conflict",recovery:"refresh"},collection_access_denied:{category:"authorization",recovery:"reauthorize"},collection_configuration_invalid:{category:"validation",recovery:"repair_collection"},collection_contracts_missing:{category:"compatibility",recovery:"choose_collection"},collection_incompatible:{category:"compatibility",recovery:"choose_collection"},collection_invalid:{category:"validation",recovery:"repair_collection"},collection_kind_unsupported:{category:"compatibility",recovery:"choose_collection"},collection_mismatch:{category:"selection",recovery:"choose_collection"},collection_not_found:{category:"selection",recovery:"choose_collection"},collection_not_ready:{category:"selection",recovery:"choose_collection"},collection_not_selected:{category:"selection",recovery:"choose_collection"},collection_type_registry_invalid:{category:"validation",recovery:"repair_collection"},collection_version_unsupported:{category:"compatibility",recovery:"upgrade_collection"},concurrent_modification:{category:"conflict",recovery:"refresh"},connector_identity_changed:{category:"integrity",recovery:"reauthorize"},connector_offline:{category:"availability",recovery:"retry"},connector_upgrade_required:{category:"compatibility",recovery:"upgrade_connector"},device_authorization_failed:{category:"authorization",recovery:"reauthorize"},direct_operation_rejected:{category:"authorization",recovery:"reauthorize"},discovery_failed:{category:"availability",recovery:"retry"},encrypted_relay_rejected:{category:"authorization",recovery:"reauthorize"},encryption_required:{category:"authorization",recovery:"reauthorize"},expired_token:{category:"authorization",recovery:"reauthorize"},file_changed_during_move:{category:"conflict",recovery:"refresh"},file_changed_during_read:{category:"conflict",recovery:"refresh"},file_move_failed:{category:"internal",recovery:"contact_support"},file_mutation_conflict:{category:"conflict",recovery:"resolve_conflict"},file_not_found:{category:"conflict",recovery:"refresh"},file_source_mismatch:{category:"conflict",recovery:"refresh"},file_upload_incomplete:{category:"conflict",recovery:"retry"},first_contact_handler_required:{category:"compatibility",recovery:"upgrade_application"},hosted_provider_unavailable:{category:"availability",recovery:"retry"},insufficient_access:{category:"authorization",recovery:"reauthorize"},invalid_application_manifest:{category:"validation",recovery:"fix_request"},invalid_callback:{category:"validation",recovery:"fix_request"},invalid_device_authorization_response:{category:"integrity",recovery:"contact_support"},invalid_encrypted_response:{category:"integrity",recovery:"contact_support"},invalid_first_contact:{category:"integrity",recovery:"contact_support"},invalid_loopback_url:{category:"validation",recovery:"fix_request"},invalid_mutation_id:{category:"validation",recovery:"fix_request"},invalid_operation_response:{category:"integrity",recovery:"contact_support"},invalid_path:{category:"validation",recovery:"fix_request"},invalid_preflight:{category:"conflict",recovery:"refresh"},invalid_push_payload:{category:"validation",recovery:"fix_request"},invalid_push_subscription:{category:"validation",recovery:"fix_request"},invalid_request:{category:"validation",recovery:"fix_request"},invalid_token_response:{category:"integrity",recovery:"contact_support"},managed_fcm_not_declared:{category:"compatibility",recovery:"fix_request"},manifest_load_failed:{category:"availability",recovery:"retry"},manifest_required:{category:"validation",recovery:"fix_request"},missing_grant_key:{category:"authorization",recovery:"reauthorize"},no_pending_mutation:{category:"conflict",recovery:"refresh"},not_authorized:{category:"authorization",recovery:"reauthorize"},not_remote_authority:{category:"compatibility",recovery:"choose_collection"},notification_criterion_not_declared:{category:"validation",recovery:"fix_request"},notification_reauthorization_required:{category:"authorization",recovery:"reauthorize"},notification_registration_failed:{category:"availability",recovery:"retry"},notification_unregistration_failed:{category:"availability",recovery:"retry"},notifications_not_declared:{category:"compatibility",recovery:"fix_request"},notifications_unavailable:{category:"availability",recovery:"retry"},operation_cancelled:{category:"cancellation",recovery:"none"},operation_failed:{category:"internal",recovery:"contact_support"},operation_invalid:{category:"validation",recovery:"fix_request"},operation_outcome_unknown:{category:"conflict",recovery:"resolve_outcome"},path_occupied:{category:"conflict",recovery:"resolve_conflict"},pending_mutation_unresolved:{category:"conflict",recovery:"resolve_outcome"},query_snapshot_changed:{category:"conflict",recovery:"refresh"},rate_limited:{category:"availability",recovery:"retry"},redirect_uri_required:{category:"validation",recovery:"fix_request"},reference_updates_unsupported:{category:"compatibility",recovery:"fix_request"},relay_authorization_expired:{category:"authorization",recovery:"reauthorize"},relay_unavailable:{category:"availability",recovery:"retry"},sandbox_unsupported:{category:"compatibility",recovery:"fix_request"},scope_denied:{category:"authorization",recovery:"reauthorize"},stale_file_revision:{category:"conflict",recovery:"refresh"},storage_required:{category:"compatibility",recovery:"none"},sync_failed:{category:"availability",recovery:"retry"},temporarily_unavailable:{category:"availability",recovery:"retry"},timeout:{category:"availability",recovery:"retry"},token_exchange_failed:{category:"availability",recovery:"retry"},type_pack_provision_failed:{category:"validation",recovery:"repair_collection"},unknown_collection:{category:"selection",recovery:"choose_collection"},unsafe_file_path:{category:"validation",recovery:"fix_request"},unsupported_encryption:{category:"compatibility",recovery:"upgrade_application"},unsupported_operation:{category:"compatibility",recovery:"fix_request"}},li={access_denied:{type:"object",required:[],properties:{return_to:{type:"string"}}},approval_window_blocked:{type:"object",required:["user_code","verification_uri","verification_uri_complete","expires_at","interval_seconds"],properties:{user_code:{type:"string"},verification_uri:{type:"string"},verification_uri_complete:{type:"string"},expires_at:{type:"integer"},interval_seconds:{type:"integer"}}},collection_configuration_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_contracts_missing:{type:"object",required:["contracts"],properties:{contracts:{type:"array",items:{type:"object",required:["id","version"],properties:{id:{type:"string"},version:{type:"string"}}}}}},collection_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_type_registry_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_version_unsupported:{type:"object",required:["current_version","required_version"],properties:{current_version:{type:"string"},required_version:{type:"string"}}},connector_offline:{type:"object",required:[],properties:{connector_name:{type:"string"}}},insufficient_access:{type:"object",required:["required_operations","granted_operations","missing_operations"],properties:{required_operations:{type:"array",items:{type:"string"}},granted_operations:{type:"array",items:{type:"string"}},missing_operations:{type:"array",items:{type:"string"}}}},operation_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}},partial_result:{}}},rate_limited:{type:"object",required:[],properties:{retry_after_ms:{type:"integer"}}}};function Ht(n){return Object.hasOwn(J,n)}function Ce(n){if(!$t(n))return!1;let e=n;if(e.problem_version!==1||typeof e.message!="string"||e.message.length===0||e.operation_outcome!==void 0&&e.operation_outcome!=="not_sent"&&e.operation_outcome!=="rejected"&&e.operation_outcome!=="unknown"||e.trace_id!==void 0&&(typeof e.trace_id!="string"||e.trace_id.length===0))return!1;if(e.code==="unknown")return typeof e.server_code=="string"&&e.server_code.length>0&&e.category==="unknown"&&e.recovery==="none";if(typeof e.code!="string"||!Ht(e.code)||e.server_code!==void 0)return!1;let t=J[e.code],i=li[e.code],o=i===void 0?e.details===void 0:e.details===void 0?(i.required?.length??0)===0:ht(e.details,i);return e.category===t.category&&e.recovery===t.recovery&&o}function ht(n,e){if(e.type===void 0)return!0;if(e.type==="string")return typeof n=="string";if(e.type==="integer")return typeof n=="number"&&Number.isInteger(n);if(e.type==="number")return typeof n=="number"&&Number.isFinite(n);if(e.type==="boolean")return typeof n=="boolean";if(e.type==="array")return Array.isArray(n)&&n.every(i=>ht(i,e.items??{}));if(!$t(n))return!1;if(!e.properties)return!0;let t=n;return!Object.keys(t).every(i=>Object.hasOwn(e.properties,i))||!(e.required??[]).every(i=>Object.hasOwn(t,i))?!1:Object.entries(t).every(([i,o])=>ht(o,e.properties[i]))}function $t(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}function ft(n,e,t={}){if(Ht(n)){let i=J[n],o={problem_version:1,code:n,category:i.category,recovery:i.recovery,message:e,...t.details===void 0?{}:{details:t.details},...t.operation_outcome===void 0?{}:{operation_outcome:t.operation_outcome},...t.trace_id===void 0?{}:{trace_id:t.trace_id}};if(Ce(o))return o}return{problem_version:1,code:"unknown",server_code:n,category:"unknown",recovery:"none",message:e,...t.details===void 0?{}:{details:t.details},...t.operation_outcome===void 0?{}:{operation_outcome:t.operation_outcome},...t.trace_id===void 0?{}:{trace_id:t.trace_id}}}var Vt=new Uint8Array([77,68,66,70]),Gt=1,Yt=0,Lo=new Uint8Array([77,68,66,82]);var Jt=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,b=class extends Error{code;constructor(e,t){super(t),this.code=e,this.name="FileFrameError"}};function di(n){return n==="upload_chunk"?1:2}function ui(n){if(n===1)return"upload_chunk";if(n===2)return"download_chunk";throw new b("invalid_kind",`Unknown file frame kind ${n}`)}function pi(n){if(!n||typeof n!="object"||Array.isArray(n))throw new b("invalid_header","File frame header must be a JSON object");return n}function Be(n,e){let t=n[e];if(typeof t!="string"||t.length===0)throw new b("invalid_header",`File frame header ${e} must be a non-empty string`);return t}function qe(n,e){let t=Be(n,e);if(!Jt.test(t))throw new b("invalid_header",`File frame header ${e} must be a UUID`);return t}function Q(n,e,t=Number.MAX_SAFE_INTEGER){let i=n[e];if(!Number.isSafeInteger(i)||i<0||i>t)throw new b("invalid_header",`File frame header ${e} is outside its allowed range`);return i}function yt(n){if(n.protocol_version!==1)throw new b("unsupported_version",`Unsupported file transfer protocol ${n.protocol_version}`);if(n.protection!=="grant_aead_v1"&&n.protection!=="transport_tls")throw new b("invalid_header","Unknown file transfer protection");if(n.direction!=="upload"&&n.direction!=="download")throw new b("invalid_header","Unknown file transfer direction");for(let[e,t]of[["grant_id",n.grant_id],["authority_id",n.authority_id],["collection_id",n.collection_id],["transfer_id",n.transfer_id]])if(!Jt.test(t))throw new b("invalid_header",`File frame header ${e} must be a UUID`);for(let[e,t,i]of[["chunk_size",n.chunk_size,4194304],["chunk_index",n.chunk_index,Number.MAX_SAFE_INTEGER],["offset",n.offset,Number.MAX_SAFE_INTEGER],["plaintext_length",n.plaintext_length,4194304],["total_size",n.total_size,Number.MAX_SAFE_INTEGER]])if(!Number.isSafeInteger(t)||t<0||t>i)throw new b("invalid_header",`File frame header ${e} is outside its allowed range`);if(n.chunk_size<64*1024)throw new b("invalid_header","File frame chunk_size is below the protocol minimum");if(!Number.isSafeInteger(n.scope_epoch)||n.scope_epoch<1)throw new b("invalid_header","File frame header scope_epoch must be a positive integer");if(n.protection==="grant_aead_v1"&&!n.key_id)throw new b("invalid_header","AEAD-protected file frames require key_id");return{protocol_version:1,protection:n.protection,grant_id:n.grant_id,authority_id:n.authority_id,collection_id:n.collection_id,transfer_id:n.transfer_id,direction:n.direction,chunk_size:n.chunk_size,chunk_index:n.chunk_index,offset:n.offset,plaintext_length:n.plaintext_length,total_size:n.total_size,scope_epoch:n.scope_epoch,...n.key_id===void 0?{}:{key_id:n.key_id}}}function hi(n){let e;try{e=new TextDecoder("utf-8",{fatal:!0}).decode(n)}catch{throw new b("invalid_header","File frame header is not valid UTF-8")}let t;try{t=pi(JSON.parse(e))}catch(d){throw d instanceof b?d:new b("invalid_header","File frame header is not valid JSON")}let i=new Set(["protocol_version","protection","grant_id","authority_id","collection_id","transfer_id","direction","chunk_size","chunk_index","offset","plaintext_length","total_size","scope_epoch","key_id"]);if(Object.keys(t).some(d=>!i.has(d)))throw new b("invalid_header","File frame header contains an unknown field");let o=Q(t,"protocol_version");if(o!==1)throw new b("unsupported_version",`Unsupported file transfer protocol ${o}`);let r=Be(t,"protection"),a=Be(t,"direction"),s=t.key_id===void 0?void 0:Be(t,"key_id"),l=yt({protocol_version:1,protection:r,grant_id:qe(t,"grant_id"),authority_id:qe(t,"authority_id"),collection_id:qe(t,"collection_id"),transfer_id:qe(t,"transfer_id"),direction:a,chunk_size:Q(t,"chunk_size",4194304),chunk_index:Q(t,"chunk_index"),offset:Q(t,"offset"),plaintext_length:Q(t,"plaintext_length",4194304),total_size:Q(t,"total_size"),scope_epoch:Q(t,"scope_epoch"),...s===void 0?{}:{key_id:s}});if(JSON.stringify(l)!==e)throw new b("invalid_header","File frame header must use the canonical field order without duplicate fields or whitespace");return l}function mt(n,e,t){let i=n==="upload_chunk"?"upload":"download";if(e.direction!==i)throw new b("invalid_header",`Frame kind ${n} requires direction ${i}`);let o=e.chunk_index*e.chunk_size;if(!Number.isSafeInteger(o)||e.offset!==o)throw new b("invalid_header","Chunk offset does not match its index and protocol chunk size");if(e.offset+e.plaintext_length>e.total_size)throw new b("invalid_header","Chunk extends past the declared transfer size");let r=e.protection==="grant_aead_v1"?e.plaintext_length+16:e.plaintext_length;if(t!==r)throw new b("invalid_length","Payload length does not match the protected plaintext length")}function fi(n){return n.plaintext_length+(n.protection==="grant_aead_v1"?16:0)}function Ke(n,e){let t=yt(e),i=fi(t);mt(n,t,i);let o=new TextEncoder().encode(JSON.stringify(t));if(o.byteLength>16384)throw new b("limit_exceeded","File frame header exceeds the protocol limit");let r=new Uint8Array(16+o.byteLength);r.set(Vt,0);let a=new DataView(r.buffer,r.byteOffset,r.byteLength);return a.setUint8(4,Gt),a.setUint8(5,di(n)),a.setUint16(6,Yt,!1),a.setUint32(8,o.byteLength,!1),a.setUint32(12,i,!1),r.set(o,16),r}function Qt(n){let e=yt(n.header);if(mt(n.kind,e,n.payload.byteLength),n.payload.byteLength>4194320)throw new b("limit_exceeded","File frame payload exceeds the protocol limit");let t=Ke(n.kind,e),i=new Uint8Array(t.byteLength+n.payload.byteLength);return i.set(t,0),i.set(n.payload,t.byteLength),i}function je(n,e={}){if(n.byteLength<16)throw new b("invalid_length","File frame is shorter than its fixed prefix");if(!Vt.every((y,h)=>n[h]===y))throw new b("invalid_magic","File frame magic is not MDBF");let t=new DataView(n.buffer,n.byteOffset,n.byteLength),i=t.getUint8(4);if(i!==Gt)throw new b("unsupported_version",`Unsupported file frame version ${i}`);let o=ui(t.getUint8(5));if(t.getUint16(6,!1)!==Yt)throw new b("unsupported_flags","File frame uses unsupported flags");let r=t.getUint32(8,!1),a=t.getUint32(12,!1),s=e.maxHeaderBytes??16384,l=e.maxPayloadBytes??4194320;if(r===0)throw new b("invalid_length","File frame header must not be empty");if(r>s||a>l)throw new b("limit_exceeded","File frame exceeds the configured decode limits");let d=16+r+a;if(!Number.isSafeInteger(d)||d!==n.byteLength)throw new b("invalid_length","File frame lengths do not match the supplied bytes");let p=16+r,u=hi(n.subarray(16,p));return mt(o,u,a),{kind:o,header:u,payload:n.slice(p)}}var yi=new TextEncoder().encode("mdbase-connect application installation id v1\0"),mi=new TextEncoder().encode("mdbase-connect application authorization proof\0");async function Wt(n,e){let t=re(n),i=re(e);if(en(t,i))throw new Error("Application installation agreement and signing keys must be distinct.");let r=new Uint8Array(await crypto.subtle.digest("SHA-256",ae([yi,O(t),O(i)]))).slice(0,16);return r[6]=r[6]&15|128,r[8]=r[8]&63|128,[Pe(r.slice(0,4)),Pe(r.slice(4,6)),Pe(r.slice(6,8)),Pe(r.slice(8,10)),Pe(r.slice(10,16))].join("-")}function $e(n){let e=[re(n.installation_agreement_public_key),re(n.installation_signing_public_key),re(n.grant_agreement_public_key),re(n.grant_signing_public_key)];if(e.some((r,a)=>e.slice(a+1).some(s=>en(r,s))))throw new Error("Application authorization keys must be distinct.");let t=_t(n.authorization_nonce),i=_t(n.code_challenge);if(n.protocol_version!==1||t.byteLength!==32||!/^[0-9a-f]{64}$/u.test(n.application_manifest_digest)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(n.issued_at)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(n.expires_at)||i.byteLength!==32||n.requested_operations.length===0&&n.requested_files===void 0||new Set(n.requested_operations).size!==n.requested_operations.length||n.requested_operations.some(r=>!r||r.includes("\0"))||(n.flow==="authorization_code"?n.redirect_uri===void 0||n.state===void 0:n.flow!=="device_code"||n.redirect_uri!==void 0||n.state!==void 0))throw new Error("Application authorization binding is invalid.");_i(n.requested_files);let o=n.requested_operations.map(r=>O(new TextEncoder().encode(r)));return ae([mi,Se(n.protocol_version),O(He(n.application_id)),O(He(n.authorization_id)),O(Zt(n.application_manifest_digest)),O(He(n.application_installation_id)),...e.map(O),O(new TextEncoder().encode(n.flow)),O(t),O(new TextEncoder().encode(n.issued_at)),O(new TextEncoder().encode(n.expires_at)),Xt(n.redirect_uri),Xt(n.state),O(new TextEncoder().encode(n.code_challenge)),Se(o.length),...o,gi(n.requested_files),bi(n.collection_id)])}function _i(n){if(n!==void 0&&(n.actions.length===0||new Set(n.actions).size!==n.actions.length||n.scope.kind==="selected_folders"&&(n.scope.folders.length===0||new Set(n.scope.folders).size!==n.scope.folders.length||n.scope.folders.some(e=>!e||e.includes("\0")))))throw new Error("Application authorization file request is invalid.")}function gi(n){if(n===void 0)return new Uint8Array([0]);let e=n.actions.map(t=>O(new TextEncoder().encode(t)));return ae([new Uint8Array([1]),Se(e.length),...e,O(new TextEncoder().encode(n.scope.kind)),...n.scope.kind==="selected_folders"?[Se(n.scope.folders.length),...n.scope.folders.map(t=>O(new TextEncoder().encode(t)))]:[]])}function Xt(n){return n===void 0?new Uint8Array([0]):ae([new Uint8Array([1]),O(new TextEncoder().encode(n))])}function bi(n){return n===void 0?new Uint8Array([0]):ae([new Uint8Array([1]),O(He(n))])}function re(n){let e=_t(n);if(e.byteLength!==65||e[0]!==4)throw new Error("Application authorization public key is invalid.");return e}function _t(n){if(!/^[A-Za-z0-9_-]+$/u.test(n))throw new Error("Invalid base64url value.");let e=n.replaceAll("-","+").replaceAll("_","/"),t=e.padEnd(Math.ceil(e.length/4)*4,"="),i=Uint8Array.from(atob(t),o=>o.charCodeAt(0));if(vi(i)!==n)throw new Error("Non-canonical base64url value.");return i}function He(n){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(n))throw new Error("Invalid UUID value.");let e=n.replaceAll("-","");return Zt(e)}function Zt(n){if(!/^[0-9a-f]+$/u.test(n)||n.length%2!==0)throw new Error("Invalid hexadecimal value.");return Uint8Array.from({length:n.length/2},(e,t)=>Number.parseInt(n.slice(t*2,t*2+2),16))}function O(n){return ae([Se(n.byteLength),n])}function Se(n){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,n,!1),e}function ae(n){let e=new Uint8Array(n.reduce((i,o)=>i+o.byteLength,0)),t=0;for(let i of n)e.set(i,t),t+=i.byteLength;return e}function vi(n){return btoa(String.fromCharCode(...n)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function en(n,e){return n.byteLength===e.byteLength&&n.every((t,i)=>t===e[i])}function Pe(n){return[...n].map(e=>e.toString(16).padStart(2,"0")).join("")}var se=1,Re=1;var tn=28485,ke="P256-HKDF-SHA256-AES256GCM";var wi="contract-setup-v1",Ci="file-relay-v1",Pi=["application-trust-v1","authorization-activation","encrypted-relay","policy-ack"],Bo=[...Pi,wi,Ci],gt=1;var nn="mdbase-authority-request-proof-v1",Ae={version:"x-mdbase-proof-version",timestamp:"x-mdbase-proof-timestamp",nonce:"x-mdbase-proof-nonce",signature:"x-mdbase-proof-signature"};var Si="mdbase-connect-keys",G="grant-keys",vt=18446744073709551615n,Ri="mdbase-connect relay request key v1",ki="mdbase-connect relay response key v1",on=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,ce=class{database=null;async create(e){let t=await cn(e),i=await this.open();return await an(i,o=>o.add({...t,counter:"0"})),t}async get(e){let t=await this.open(),i=await Ei(t.transaction(G).objectStore(G).get(e));return i?{handle:i.handle,agreementPrivateKey:i.agreementPrivateKey,agreementPublicKey:i.agreementPublicKey,signingPrivateKey:i.signingPrivateKey,signingPublicKey:i.signingPublicKey}:null}async nextCounter(e){let t=await this.open();return new Promise((i,o)=>{let r=t.transaction(G,"readwrite"),a=r.objectStore(G),s=a.get(e),l=null;s.onerror=()=>o(s.error),s.onsuccess=()=>{let d=s.result;if(!d){r.abort(),o(new C("missing_grant_key","The encrypted grant key is unavailable."));return}let p=BigInt(d.counter)+1n;if(p>vt){r.abort(),o(new C("counter_exhausted","The encrypted grant must be authorized again."));return}l=p.toString(),a.put({...d,counter:l})},r.onerror=()=>o(r.error),r.onabort=()=>o(r.error??new Error("Key counter transaction aborted.")),r.oncomplete=()=>{l&&i(l)}})}async delete(e){let t=await this.open();await an(t,i=>i.delete(e))}open(){if(typeof indexedDB>"u")throw new C("key_storage_unavailable","Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");return this.database||(this.database=new Promise((e,t)=>{let i=indexedDB.open(Si,1);i.onupgradeneeded=()=>{i.result.objectStoreNames.contains(G)||i.result.createObjectStore(G,{keyPath:"handle"})},i.onerror=()=>t(i.error),i.onsuccess=()=>e(i.result)})),this.database}},le=class{records=new Map;sequence=Promise.resolve();async create(e){if(this.records.has(e))throw new Error(`Grant key already exists: ${e}`);let t=await cn(e);return this.records.set(e,{...t,counter:"0"}),t}async get(e){let t=this.records.get(e);return t?{handle:t.handle,agreementPrivateKey:t.agreementPrivateKey,agreementPublicKey:t.agreementPublicKey,signingPrivateKey:t.signingPrivateKey,signingPublicKey:t.signingPublicKey}:null}nextCounter(e){let t,i,o=new Promise((r,a)=>{t=r,i=a});return this.sequence=this.sequence.then(()=>{let r=this.records.get(e);if(!r)throw new C("missing_grant_key","The encrypted grant key is unavailable.");let a=BigInt(r.counter)+1n;if(a>vt)throw new C("counter_exhausted","The encrypted grant must be authorized again.");r.counter=a.toString(),t(r.counter)}).catch(r=>{i(r)}),o}async delete(e){this.records.delete(e)}};async function sn(n,e,t,i){let o=await Oi(n,e,t),r=i.timestamp??Math.floor(Date.now()/1e3),a=i.nonce??crypto.randomUUID(),s=await Ai({...i,timestamp:r,nonce:a}),l=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},o.signingPrivateKey,new TextEncoder().encode(s));return{[Ae.version]:String(gt),[Ae.timestamp]:String(r),[Ae.nonce]:a,[Ae.signature]:Oe(new Uint8Array(l))}}async function Ai(n){let e=n.method.toUpperCase(),t=await rn(n.body??""),i=await rn(n.credential);for(let o of[e,n.target,String(n.timestamp),n.nonce])if(!o||o.includes(`
2
+ `)||o.includes("\r"))throw new C("invalid_proof_input","Authority request proof metadata is invalid.");return[nn,gt,e,n.target,t,i,n.timestamp,n.nonce].join(`
3
+ `)}async function X(n,e,t,i,o,r=crypto.randomUUID()){W(t.encryption);let a=await ln(n,e,t.encryption.application_agreement_public_key),s=await n.nextCounter(e),l={binding:t,requestId:r,operation:i,counter:s},d=await dn(a.agreementPrivateKey,t,"request"),p=new TextEncoder().encode(JSON.stringify(o??{})),u=await crypto.subtle.encrypt({name:"AES-GCM",iv:hn(s),additionalData:new TextEncoder().encode(pn(l,"request")),tagLength:128},d,p);return{type:"encrypted_operation_request",...Ti(l),ciphertext:Oe(new Uint8Array(u))}}async function de(n,e,t,i,o){if(!Ii(i,o))throw new C("invalid_encrypted_response","Encrypted response metadata does not match its request.");let r=await ln(n,e,t.encryption.application_agreement_public_key),a={binding:t,requestId:i.request_id,operation:i.operation,counter:i.counter},s=await dn(r.agreementPrivateKey,t,"response");try{let l=await crypto.subtle.decrypt({name:"AES-GCM",iv:hn(i.counter),additionalData:new TextEncoder().encode(pn(a,"response")),tagLength:128},s,yn(fn(o.ciphertext))),d=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(l));if(d?.ok===!0&&"result"in d||d?.ok===!1&&Ce(d.problem))return d;throw new Error("invalid response body")}catch(l){throw l instanceof C?l:new C("encrypted_response_rejected","The encrypted connector response could not be authenticated.")}}var C=class extends Error{constructor(t,i){super(i);this.code=t}code};async function cn(n){let e=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveBits"]),t=Oe(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),i=await crypto.subtle.exportKey("pkcs8",e.privateKey),o=await crypto.subtle.importKey("pkcs8",i,{name:"ECDH",namedCurve:"P-256"},!1,["deriveBits"]),r=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),a=Oe(new Uint8Array(await crypto.subtle.exportKey("raw",r.publicKey))),s=await crypto.subtle.exportKey("pkcs8",r.privateKey),l=await crypto.subtle.importKey("pkcs8",s,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:n,agreementPrivateKey:o,agreementPublicKey:t,signingPrivateKey:l,signingPublicKey:a}}async function ln(n,e,t){let i=await n.get(e);if(!i||i.agreementPublicKey!==t)throw new C("missing_grant_key","The encrypted grant key is unavailable or does not match the grant.");return i}async function Oi(n,e,t){let i=await n.get(e);if(!i||i.signingPublicKey!==t)throw new C("missing_grant_key","The remote authority signing key is unavailable or does not match the grant.");return i}async function dn(n,e,t){let i=await wt(n,e.encryption.connector_agreement_public_key),o=await crypto.subtle.importKey("raw",i,"HKDF",!1,["deriveKey"]),r=new TextEncoder().encode(un(e)),a=await crypto.subtle.digest("SHA-256",r);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:a,info:new TextEncoder().encode(t==="request"?Ri:ki)},o,{name:"AES-GCM",length:256},!1,t==="request"?["encrypt"]:["decrypt"])}async function wt(n,e){try{let t=await crypto.subtle.importKey("raw",yn(bt(e)),{name:"ECDH",namedCurve:"P-256"},!1,[]);return await crypto.subtle.deriveBits({name:"ECDH",public:t},n,256)}catch{throw new C("invalid_public_key","The connector relay public key is invalid.")}}function un(n){let e=n.encryption;return["mdbase-connect",se,e.suite,n.grantId,n.applicationId,e.connector_id,e.collection_id,e.scope_epoch,e.key_id].join("|")}function pn(n,e){return[un(n.binding),n.requestId,e,n.operation,n.counter].join("|")}function Ti(n){let e=n.binding.encryption;return{protocol_version:se,suite:ke,request_id:n.requestId,grant_id:n.binding.grantId,application_id:n.binding.applicationId,connector_id:e.connector_id,collection_id:e.collection_id,operation:n.operation,scope_epoch:e.scope_epoch,key_id:e.key_id,counter:n.counter}}function Ii(n,e){return e.type==="encrypted_operation_response"&&typeof e.ciphertext=="string"&&n.protocol_version===e.protocol_version&&n.suite===e.suite&&n.request_id===e.request_id&&n.grant_id===e.grant_id&&n.application_id===e.application_id&&n.connector_id===e.connector_id&&n.collection_id===e.collection_id&&n.operation===e.operation&&n.scope_epoch===e.scope_epoch&&n.key_id===e.key_id&&n.counter===e.counter}function W(n){if(n.protocol_version!==se||n.suite!==ke||!Number.isSafeInteger(n.scope_epoch)||n.scope_epoch<=0||typeof n.key_id!="string"||n.key_id.length===0||n.key_id.length>200||n.key_id.includes("|"))throw new C("unsupported_encryption","The grant uses an unsupported relay encryption profile.");if(typeof n.connector_id!="string"||!on.test(n.connector_id)||typeof n.collection_id!="string"||!on.test(n.collection_id))throw new C("unsupported_encryption","The grant uses invalid encrypted relay identities.");bt(n.application_agreement_public_key),bt(n.connector_agreement_public_key)}function hn(n){let e=BigInt(n);if(e<=0n||e>vt||e.toString()!==n)throw new C("invalid_counter","The encrypted relay counter is invalid.");let t=new Uint8Array(new ArrayBuffer(12));return new DataView(t.buffer).setBigUint64(4,e,!1),t}function Oe(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}async function rn(n){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(n));return Oe(new Uint8Array(e))}function fn(n){if(!/^[A-Za-z0-9_-]+$/.test(n))throw new C("invalid_base64","Encrypted relay data is malformed.");let e="=".repeat((4-n.length%4)%4),t=atob(n.replaceAll("-","+").replaceAll("_","/")+e);return Uint8Array.from(t,i=>i.charCodeAt(0))}function bt(n){let e=fn(n);if(e.length!==65||e[0]!==4)throw new C("invalid_public_key","Encrypted relay public keys must be uncompressed P-256 points.");return e}function yn(n){return Uint8Array.from(n).buffer}function Ei(n){return new Promise((e,t)=>{n.onerror=()=>t(n.error),n.onsuccess=()=>e(n.result)})}function an(n,e){return new Promise((t,i)=>{let o=n.transaction(G,"readwrite"),r=e(o.objectStore(G));r.onerror=()=>i(r.error),o.onerror=()=>i(o.error),o.onabort=()=>i(o.error??new Error("Grant key transaction aborted.")),o.oncomplete=()=>t()})}var xi="mdbase-connect file chunk key v1",Ve=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,H=class extends Error{constructor(t,i){super(i);this.code=t;this.name="FileTransferCryptoError"}code},ue=class n{constructor(e,t){this.binding=e;this.key=t}binding;key;static async open(e,t,i){mn(i);let o=await e.get(t);if(!o||o.agreementPublicKey!==i.encryption.application_agreement_public_key)throw new C("missing_grant_key","The encrypted grant key is unavailable or does not match the file transfer grant.");let r=await wt(o.agreementPrivateKey,i.encryption.connector_agreement_public_key);return n.fromSharedSecret(r,i)}static async fromSharedSecret(e,t){mn(t);let i=await Mi(e,t);return new n(t,i)}async encryptChunk(e,t,i){if(this.validateHeader(t),i.byteLength!==t.plaintext_length)throw new H("plaintext_length_mismatch","File chunk plaintext length does not match its authenticated header.");let o=Ke(e,t),r=await crypto.subtle.encrypt({name:"AES-GCM",iv:_n(t.chunk_index),additionalData:Ge(o),tagLength:128},this.key,Ge(i));return Qt({kind:e,header:t,payload:new Uint8Array(r)})}async decryptChunk(e){let t=je(e);this.validateHeader(t.header);let i=Ke(t.kind,t.header);try{let o=await crypto.subtle.decrypt({name:"AES-GCM",iv:_n(t.header.chunk_index),additionalData:Ge(i),tagLength:128},this.key,Ge(t.payload));return new Uint8Array(o)}catch{throw new H("authentication_failed","The encrypted file chunk could not be authenticated.")}}validateHeader(e){let t=this.binding.encryption;if(e.protocol_version!==1||e.protection!=="grant_aead_v1"||e.grant_id!==this.binding.grantId||e.authority_id!==this.binding.authorityId||e.collection_id!==t.collection_id||e.transfer_id!==this.binding.transferId||e.direction!==this.binding.direction||e.scope_epoch!==t.scope_epoch||e.key_id!==t.key_id)throw new H("header_binding_mismatch","The file frame does not match its transfer encryption binding.")}};async function Mi(n,e){let t=new TextEncoder().encode(Ui(e)),i=await crypto.subtle.digest("SHA-256",t),o=await crypto.subtle.importKey("raw",n,"HKDF",!1,["deriveKey"]);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:i,info:new TextEncoder().encode(xi)},o,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}function mn(n){if(W(n.encryption),!Ve.test(n.grantId)||!Ve.test(n.applicationId)||!Ve.test(n.authorityId)||!Ve.test(n.transferId)||n.direction!=="upload"&&n.direction!=="download")throw new H("invalid_binding","The file transfer encryption binding is invalid.")}function Ui(n){let e=n.encryption;return["mdbase-connect","file-transfer",1,e.suite,n.grantId,n.applicationId,e.connector_id,n.authorityId,e.collection_id,e.scope_epoch,e.key_id,n.transferId,n.direction].join("|")}function _n(n){if(!Number.isSafeInteger(n)||n<0)throw new H("invalid_chunk_index","The file chunk index is invalid.");let e=new Uint8Array(new ArrayBuffer(12));return new DataView(e.buffer).setBigUint64(4,BigInt(n),!1),e}function Ge(n){return Uint8Array.from(n).buffer}var zi=new TextEncoder().encode("mdbase-connect first-contact transcript\0"),Fi=new TextEncoder().encode("mdbase-connect first-contact sas v1"),Di="0123456789ABCDEFGHJKMNPQRSTVWXYZ",Li=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,U=class extends Error{constructor(t,i){super(i);this.code=t}code};async function Je(n,e,t){let i=await Ni(n),o=e==="application"?n.application_agreement_public_key:n.connector_agreement_public_key,r=e==="application"?i.connector:i.applicationAgreement;if(t.agreementPublicKey!==o)throw new U("identity_mismatch","The first-contact identity does not match the transcript.");let a;try{a=await crypto.subtle.importKey("raw",r,{name:"ECDH",namedCurve:"P-256"},!1,[])}catch{throw new U("invalid_public_key","The first-contact public key is invalid.")}let s=await crypto.subtle.deriveBits({name:"ECDH",public:a},t.agreementPrivateKey,256),l=qi(n,i),d=await crypto.subtle.digest("SHA-256",l),p=await crypto.subtle.importKey("raw",s,"HKDF",!1,["deriveBits"]),u=new Uint8Array(await crypto.subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:d,info:Fi},p,40));return Ki(u)}async function Ni(n){if(n.protocol_version!==Re)throw new U("unsupported_version","The first-contact protocol version is not supported.");let e=Pt(n.application_agreement_public_key),t=Pt(n.application_signing_public_key),i=Pt(n.connector_agreement_public_key);if(St(e,t)||St(e,i)||St(t,i))throw new U("invalid_public_key","First contact requires distinct endpoint agreement and signing keys.");try{await Promise.all([e,t,i].map(o=>crypto.subtle.importKey("raw",o,{name:"ECDH",namedCurve:"P-256"},!1,[])))}catch{throw new U("invalid_public_key","The first-contact public key is invalid.")}return{applicationAgreement:e,applicationSigning:t,connector:i}}function qi(n,e){let t=[zi,gn(n.protocol_version),pe(Ct(n.application_id)),pe(Ct(n.application_installation_id)),pe(e.applicationAgreement),pe(e.applicationSigning),pe(Ct(n.connector_id)),pe(e.connector)],i=t.reduce((a,s)=>a+s.byteLength,0),o=new Uint8Array(i),r=0;for(let a of t)o.set(a,r),r+=a.byteLength;return o}function pe(n){let e=new Uint8Array(4+n.byteLength);return e.set(gn(n.byteLength)),e.set(n,4),e}function gn(n){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,n,!1),e}function Ct(n){if(!Li.test(n))throw new U("invalid_binding","The first-contact transcript contains an invalid identifier.");let e=n.replaceAll("-","");return Uint8Array.from({length:16},(t,i)=>Number.parseInt(e.slice(i*2,i*2+2),16))}function Pt(n){if(!/^[A-Za-z0-9_-]+$/.test(n))throw new U("invalid_public_key","The first-contact public key is invalid.");let e=n.replaceAll("-","+").replaceAll("_","/"),t=e.padEnd(Math.ceil(e.length/4)*4,"="),i;try{i=Uint8Array.from(atob(t),o=>o.charCodeAt(0))}catch{throw new U("invalid_public_key","The first-contact public key is invalid.")}if(i.byteLength!==65||i[0]!==4||Bi(i)!==n)throw new U("invalid_public_key","The first-contact public key is invalid.");return i}function Bi(n){return btoa(String.fromCharCode(...n)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function St(n,e){return n.byteLength===e.byteLength&&n.every((t,i)=>t===e[i])}function Ki(n){let e=0n;for(let i of n)e=e<<8n|BigInt(i);let t="";for(let i=7;i>=0;i-=1)t+=Di[Number(e>>BigInt(i*5)&31n)],i===4&&(t+="-");return t}var Rt=BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),ji=Rt/2n;async function Y(n){return Wt(n.agreementPublicKey,n.signingPublicKey)}async function Te(n,e){if(n.installation_agreement_public_key!==e.agreementPublicKey||n.installation_signing_public_key!==e.signingPublicKey||n.application_installation_id!==await Y(e))throw new Error("Application authorization identity does not match its binding.");let t=Vi(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.signingPrivateKey,$e(n))));return{binding:n,signature:$i(t)}}function Hi(n){let e=new Uint8Array(n.reduce((i,o)=>i+o.byteLength,0)),t=0;for(let i of n)e.set(i,t),t+=i.byteLength;return e}function $i(n){return btoa(String.fromCharCode(...n)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function Vi(n){if(n.byteLength!==64)throw new Error("Application authorization signature is invalid.");let e=Gi(n.slice(32));if(e===0n||e>=Rt)throw new Error("Application authorization signature is invalid.");return e<=ji?n:Hi([n.slice(0,32),Yi(Rt-e,32)])}function Gi(n){return BigInt(`0x${Ji(n)}`)}function Yi(n,e){let t=n.toString(16).padStart(e*2,"0");return Uint8Array.from({length:e},(i,o)=>Number.parseInt(t.slice(o*2,o*2+2),16))}function Ji(n){return[...n].map(e=>e.toString(16).padStart(2,"0")).join("")}function he(n,e){return new Promise((t,i)=>{if(e?.aborted){i(e.reason??new DOMException("Aborted","AbortError"));return}let o=setTimeout(t,n);e?.addEventListener("abort",()=>{clearTimeout(o),i(e.reason??new DOMException("Aborted","AbortError"))},{once:!0})})}var S=class extends Error{constructor(t,i={}){super(t.message,i.cause===void 0?void 0:{cause:i.cause});this.problem=t;this.name="MdbaseConnectError",this.code=t.code,this.status=i.status}problem;code;status;get retryable(){return this.problem.recovery==="retry"&&this.problem.operation_outcome!=="unknown"}get requiresAuthorization(){return this.problem.category==="authorization"}get outcomeUnknown(){return this.problem.operation_outcome==="unknown"}get recovery(){return this.problem.recovery}get details(){return this.problem.details}};function z(n,e,...[t={}]){let i=J[n];return{problem_version:1,code:n,category:i.category,recovery:i.recovery,message:e,...t.details===void 0?{}:{details:t.details},...t.operationOutcome===void 0?{}:{operation_outcome:t.operationOutcome},...t.traceId===void 0?{}:{trace_id:t.traceId}}}function kt(n,e,t={}){return ft(n,e,{details:t.details,operation_outcome:t.operationOutcome,trace_id:t.traceId})}function c(n,e,...t){let i=t[0];return new S(z(n,e,...t),{status:i?.status,cause:i?.cause})}function D(n,e,t={}){let{status:i,cause:o,...r}=t;return new S(ft(n,e,{details:r.details,operation_outcome:r.operationOutcome,trace_id:r.traceId}),{status:i,cause:o})}function At(n){let e=Xi(n.diagnostics),t=to(n.diagnostics);if(e==="collection_version_unsupported"){let i=Wi(n.diagnostics);return z(e,t,{operationOutcome:"rejected",details:i})}return e!=="operation_invalid"?z(e,t,{operationOutcome:"rejected",details:{diagnostics:n.diagnostics}}):z(e,t,{operationOutcome:"rejected",details:{diagnostics:n.diagnostics,partial_result:n.result}})}function Xi(n){let e=new Set(n.filter(t=>t.severity==="error").map(t=>t.code));return["migration_required","migration_lossy","unsupported_version"].some(t=>e.has(t))?"collection_version_unsupported":["invalid_config","invalid_configuration","missing_config","missing_spec_version"].some(t=>e.has(t))?"collection_configuration_invalid":["duplicate_type","invalid_contract_definition","invalid_data_contract","invalid_type_definition","invalid_type_path"].some(t=>e.has(t))?"collection_type_registry_invalid":["collection_invalid","collection_open_failed"].some(t=>e.has(t))?"collection_invalid":"operation_invalid"}function Wi(n){let e=n.map(t=>t.details).find(t=>Zi(t));return{current_version:typeof e?.current_version=="string"?e.current_version:"0.2.x",required_version:typeof e?.required_version=="string"?e.required_version:"0.3.0"}}function Zi(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}function eo(n){return n instanceof S&&n.retryable}function to(n){return n.filter(e=>e.severity==="error").map(e=>e.message).join(" ")||n.map(e=>e.message).join(" ")||"The collection rejected this operation."}var bn=["access_denied","access_paused","authorization_expired","collection_access_denied","connector_identity_changed","connector_offline","connector_upgrade_required","direct_operation_rejected","operation_outcome_unknown","encryption_required","encrypted_relay_rejected","hosted_provider_unavailable","insufficient_access","invalid_encrypted_response","invalid_operation_response","invalid_request","missing_grant_key","not_authorized","operation_cancelled","operation_failed","rate_limited","relay_authorization_expired","relay_unavailable","temporarily_unavailable","timeout","unsupported_operation"],Ot=Object.keys(J),Z=["discovery_failed","invalid_application_manifest","invalid_request","manifest_load_failed","rate_limited","temporarily_unavailable","timeout"],ee=[...Z,"access_denied","approval_window_blocked","authorization_cancelled","browser_required","collection_access_denied","collection_configuration_invalid","collection_contracts_missing","collection_incompatible","collection_invalid","collection_kind_unsupported","collection_mismatch","collection_not_found","collection_type_registry_invalid","collection_version_unsupported","connector_identity_changed","connector_offline","connector_upgrade_required","device_authorization_failed","encryption_required","expired_token","first_contact_handler_required","invalid_callback","invalid_device_authorization_response","invalid_first_contact","invalid_token_response","scope_denied","token_exchange_failed"],fe=[...Z,"authorization_expired","invalid_push_subscription","managed_fcm_not_declared","not_authorized","notification_criterion_not_declared","notification_reauthorization_required","notification_registration_failed","notification_unregistration_failed","notifications_not_declared","notifications_unavailable"],Xe=["connector_offline","connector_upgrade_required","invalid_operation_response","not_authorized","operation_failed","temporarily_unavailable","timeout"],no=[...ee,"collection_not_ready","collection_not_selected","unknown_collection"],vn=["collection_configuration_invalid","collection_invalid","collection_type_registry_invalid","collection_version_unsupported"],Ie=[...bn,...vn],q=[...Ie,"invalid_path","operation_invalid"],Tt=[...q,"query_snapshot_changed","sandbox_unsupported"],I=[...q,"concurrent_modification","invalid_preflight","pending_mutation_unresolved"],It=[...Ie,"change_cursor_reset"],ye=[...I,"type_pack_provision_failed"];function E(n,e=[]){return{ok:!0,value:n,diagnostics:e}}function T(n){return{ok:!1,problem:n}}async function A(n,e){try{return E(await n())}catch(t){if(!(t instanceof S))throw t;let i=t.problem;return i.code==="unknown"||e.includes(i.code)?T(i):T(kt(i.code,i.message,{details:i.details,operationOutcome:i.operation_outcome,traceId:i.trace_id}))}}var Qe=class extends Error{constructor(t){super(t.message);this.problem=t;this.name="ConnectOutcomeError"}problem};function io(n){if(!n.ok)throw new Qe(n.problem);return n.value}var Ee=class{constructor(e){this.transport=e}transport;operation(e,t,i){return A(()=>this.transport.operation(e,t,i),Ot)}describe(){return this.rawOperation("describe",{},Ie)}changes(e={},t){return this.rawOperation("changes",e,It,t)}read(e){return this.envelopeOperation("read",e,q)}query(e={},t){return this.envelopeOperation("query",e,Tt,t)}async*queryPages(e={},t={}){let{offset:i,limit:o,snapshot:r,...a}=e,s=ro(i,0),l=wn(t.firstPageSize??o,200),d=wn(t.pageSize??o,1e3),p=r,u=0,y=0;for(;!t.signal?.aborted;){let h=await this.query({...a,offset:s,limit:y===0?l:d,...p?{snapshot:p}:{}},{signal:t.signal});if(!h.ok){yield h;return}let _=h.value,f=_.meta?.snapshot;if(p&&f&&p!==f){yield T(z("query_snapshot_changed","The collection query snapshot changed while paging. Refresh the query before continuing."));return}!p&&f&&(p=f),u+=_.results.length;let v=!_.meta?.has_more||_.results.length===0,m={results:_.results,..._.meta?{meta:_.meta}:{},page:y,offset:s,loaded:u,complete:v,...p?{snapshot:p}:{}};if(t.onProgress?.(m),yield E(m,h.diagnostics),v)return;s+=_.results.length,y+=1}}async queryAll(e={},t={}){let i=[],o,r=[];for await(let a of this.queryPages(e,t)){if(!a.ok)return a;let s=a.value;i.push(...s.results),o=s,r.push(...a.diagnostics)}return E({results:i,meta:{...o?.meta??{},total_count:o?.meta?.total_count??i.length,has_more:o?!o.complete:!1,...o?.snapshot?{snapshot:o.snapshot}:{}}},r)}listViews(){return this.envelopeOperation("list_views",{},q)}executeView(e){return this.envelopeOperation("execute_view",e,q)}readViewSource(e){return this.envelopeOperation("read_view_source",e,q)}createViewSource(e){return this.envelopeOperation("create_view_source",e,I)}updateViewSource(e){return this.envelopeOperation("update_view_source",e,I)}deleteViewSource(e){return this.envelopeOperation("delete_view_source",e,I)}create(e){return this.envelopeOperation("create",e,I)}update(e){return this.envelopeOperation("update",e,I)}delete(e,t){return this.envelopeOperation("delete",e,I,t)}preflightDelete(e,t){return this.envelopeOperation("delete",{...e,check_backlinks:!0,dry_run:!0},I,t)}rename(e,t){return this.envelopeOperation("rename",e,I,t)}preflightRename(e,t){return this.envelopeOperation("rename",{...e,dry_run:!0},I,t)}validate(e={}){return this.envelopeOperation("validate",e,q)}readType(e){return this.envelopeOperation("read_type",e,ye)}createType(e){return this.envelopeOperation("create_type",e,ye)}updateType(e){return this.envelopeOperation("update_type",e,ye)}installTypePack(e){return this.envelopeOperation("install_type_pack",e,ye)}listTimers(e){return this.rawOperation("list_timers",{namespace:e},q)}putTimer(e){return this.rawOperation("put_timer",e,I)}cancelTimer(e){return this.rawOperation("cancel_timer",e,I)}reconcileTimers(e){return this.rawOperation("reconcile_timers",e,I)}async*watch(e={}){let t=e.cursor,i=Math.max(100,e.pollIntervalMs??1e3),o=oo(e.retry),r=0,a=!1;for(e.onStatus?.({state:"connecting",...t===void 0?{}:{cursor:t}});!e.signal?.aborted;){let s=await this.changes(t===void 0?{}:{after:t,limit:200},{signal:e.signal});if(!s.ok){let p=s.problem;if(e.signal?.aborted)return;if(!o||p.recovery!=="retry"){yield s;return}if(a=!1,r+=1,o.maxAttempts!==void 0&&r>o.maxAttempts){yield s;return}let u=Math.min(o.maxDelayMs,Math.round(o.initialDelayMs*o.multiplier**(r-1)));e.onStatus?.({state:"reconnecting",...t===void 0?{}:{cursor:t},attempt:r,retryInMs:u,problem:p});try{await he(u,e.signal)}catch{if(!e.signal?.aborted)throw c("operation_failed","Watch retry delay failed unexpectedly.")}continue}let l=s.value;if(t===void 0){t=l.cursor;continue}if(l.reset){let p=z("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again.");e.onStatus?.({state:"reset_required",cursor:t,problem:p}),yield T(p);return}let d=r>0;r=0,(!a||d)&&e.onStatus?.({state:"connected",cursor:t,recovered:d}),a=!0;for(let p of l.events)yield E(p);if(t=l.cursor,!l.has_more)try{await he(i,e.signal)}catch{if(!e.signal?.aborted)throw c("operation_failed","Watch polling delay failed unexpectedly.")}}}rawOperation(e,t,i,o){return A(()=>this.transport.operation(e,t,o),i)}async envelopeOperation(e,t,i,o){let r=await A(()=>this.transport.operation(e,t,o),i);if(!r.ok)return r;let a=r.value;return a.valid?E(a.result,a.diagnostics):T(At(a))}};function oo(n){if(n!==!1)return{initialDelayMs:Math.max(0,n?.initialDelayMs??500),maxDelayMs:Math.max(0,n?.maxDelayMs??15e3),multiplier:Math.max(1,n?.multiplier??2),...n?.maxAttempts===void 0?{}:{maxAttempts:Math.max(0,n.maxAttempts)}}}function ro(n,e){return typeof n=="number"&&Number.isFinite(n)?Math.max(0,Math.floor(n)):e}function wn(n,e){return typeof n=="number"&&Number.isFinite(n)&&n>0?Math.floor(n):e}function N(n){let e=new Uint8Array(n);return crypto.getRandomValues(e),xe(e)}function xe(n){let e="";for(let t of n)e+=String.fromCharCode(t);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function Cn(n){let e=n.replaceAll("-","+").replaceAll("_","/").padEnd(Math.ceil(n.length/4)*4,"="),t=atob(e),i=new Uint8Array(new ArrayBuffer(t.length));for(let o=0;o<t.length;o+=1)i[o]=t.charCodeAt(o);return i}function te(n){return{...n,credentials:"omit",targetAddressSpace:"loopback"}}async function Me(){if(typeof navigator>"u"||!navigator.permissions?.query)return null;try{return(await navigator.permissions.query({name:"local-network-access"})).state}catch{return null}}function me(n){return n===404||n===405||n===426||n>=500}function We(n,e){return e&&typeof e=="object"&&!Array.isArray(e)&&e.dry_run===!0?!1:n==="sync"&&e!==null&&typeof e=="object"&&!Array.isArray(e)&&e.action==="mutate"||n==="create"||n==="update"||n==="delete"||n==="rename"||n==="create_type"||n==="update_type"||n==="install_type_pack"||n==="put_timer"||n==="cancel_timer"||n==="reconcile_timers"}function B(n){return[...new Set(n)]}function Pn(n,e){return n.grantId||e.grantId?n.grantId===e.grantId&&n.keyHandle===e.keyHandle&&n.encryption?.key_id===e.encryption?.key_id:n.accessToken===e.accessToken}function ne(n){if(n?.aborted)throw c("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:n.reason})}function xt(n,e,t,i){return n instanceof S?n:e?.aborted?t?L(n):c("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:n}):t?L(n):n instanceof TypeError?c(i,i==="hosted_provider_unavailable"?"The hosted collection provider is unavailable.":"The Connect relay is unavailable.",{cause:n}):n instanceof Error?n:new Error(String(n))}function Mt(n,e){return e?.aborted===!0||n instanceof S&&n.code==="operation_cancelled"}function Sn(n,e){if(e.dry_run!==!0||e.would_rename!==!0||e.from!==n.from||e.to!==n.to)throw c("invalid_preflight","The rename preview does not match this mutation. Run the preview again.")}function Rn(n,e){if(e.dry_run!==!0||e.would_delete!==!0||e.path!==n.path)throw c("invalid_preflight","The delete preview does not match this mutation. Run the preview again.")}function kn(n,e){if(n.update_refs===!1)return{affectedRecords:0,totalUnits:1,warnings:0};let t=e.references_affected??[];return{affectedRecords:new Set(t.map(i=>i.path)).size,totalUnits:1+t.length,warnings:e.warnings?.length??0}}function An(n){return{affectedRecords:new Set((n.broken_links??[]).map(e=>e.path)).size,totalUnits:1,warnings:0}}async function On(n,e){let t=new TextEncoder().encode(`${n}\0${Ut(e??{})}`),i=await crypto.subtle.digest("SHA-256",t);return xe(new Uint8Array(i))}function Ut(n){return JSON.stringify(Et(n))}function Et(n){return Array.isArray(n)?n.map(e=>Et(e)):n&&typeof n=="object"?Object.fromEntries(Object.entries(n).filter(([,e])=>e!==void 0).sort(([e],[t])=>e<t?-1:e>t?1:0).map(([e,t])=>[e,Et(t)])):n}function L(n){return c("operation_outcome_unknown","The write may have completed, but mdbase could not recover its authoritative result. Retry the exact same write to recover safely.",{operationOutcome:"unknown",cause:n})}async function $(n,e,t,i){try{return await fetch(n,e)}catch(o){throw c(t,i,{cause:o})}}function Tn(n){let e=new URL(n);if(e.protocol!=="http:"||!["127.0.0.1","[::1]"].includes(e.hostname)||e.username||e.password||e.pathname!=="/"||e.search||e.hash)throw c("invalid_loopback_url","loopbackUrl must be an HTTP origin on 127.0.0.1 or ::1.");return e.origin}async function Ue(){let n=N(32),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(n));return{verifier:n,challenge:xe(new Uint8Array(e))}}function R(n,e,t,i){return D(ge(n)??n?.error?.code??e,n?.error_description??n?.error?.message??t,{status:i,details:n?.error?.details})}function ge(n){return typeof n?.error=="string"?n.error:void 0}function Ze(n,e){if(!n||typeof n!="object"||Array.isArray(n)||typeof e!="string")return!1;let t=n;if(typeof t.operations_url!="string"||typeof t.sync_url!="string"||typeof t.files_url!="string"||typeof t.replica_id!="string"||t.replica_id.length===0||typeof t.access_token!="string"||t.access_token.length===0||t.proof_public_key!==void 0&&(typeof t.proof_public_key!="string"||t.proof_public_key.length===0))return!1;try{let i=new URL(t.operations_url),o=new URL(t.sync_url),r=new URL(t.files_url);return[i,o,r].every(a=>(a.protocol==="https:"||a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))&&!a.username&&!a.password&&!a.search&&!a.hash)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/operations$/i.test(i.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/sync$/i.test(o.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/files$/i.test(r.pathname)&&i.origin===o.origin&&i.origin===r.origin&&i.pathname.split("/")[3]===e&&o.pathname.split("/")[3]===e&&r.pathname.split("/")[3]===e}catch{return!1}}function In(n,e){return Ze({operations_url:n?.operationsUrl,sync_url:n?.syncUrl,files_url:n?.filesUrl,replica_id:n?.replicaId,access_token:n?.accessToken,proof_public_key:n?.proofPublicKey},e)}function et(n){if(!n||typeof n!="object"||Array.isArray(n))return!1;let e=n,t=e.actions;if(e.kind!=="files"||e.protocol_version!==1||!Array.isArray(t)||t.length===0||t.length>6||new Set(t).size!==t.length||t.some(o=>!["list","read","add","replace","move","delete"].includes(o)))return!1;let i=e.scope;return!i||typeof i!="object"||Array.isArray(i)?!1:i.kind==="collection"?Object.keys(i).length===1:i.kind==="selected_folders"&&Object.keys(i).length===2&&Array.isArray(i.folders)&&i.folders.length>0&&i.folders.length<=100&&new Set(i.folders).size===i.folders.length&&i.folders.every(o=>typeof o=="string"&&o.length>0&&o.length<=1024&&ao(o))}function ao(n){let e=new Set([".mdbase",".git","node_modules","_contracts","_schemas","_types","_views"]);return!n.startsWith("/")&&!n.endsWith("/")&&!n.includes("\\")&&n.split("/").every(t=>{let i=t.split(".")[0]?.toUpperCase()??"";return t!==""&&t!=="."&&t!==".."&&!t.startsWith(".")&&!t.endsWith(" ")&&!t.endsWith(".")&&!/[<>:"|?*]/.test(t)&&!e.has(t.toLowerCase())&&!["CON","PRN","AUX","NUL"].includes(i)&&!/^(COM|LPT)[1-9]$/.test(i)})}function En(n,e){if(!n||typeof n!="object"||Array.isArray(n)||n.collection_id!==e)return!1;try{return W(n),!0}catch{return!1}}function xn(n){if(typeof n?.device_code!="string"||typeof n?.user_code!="string"||typeof n?.verification_uri!="string"||typeof n?.verification_uri_complete!="string"||!Number.isFinite(n?.expires_in)||!Number.isFinite(n?.interval))throw c("invalid_device_authorization_response","Connect returned an invalid downloaded application authorization response.");return{userCode:n.user_code,verificationUri:n.verification_uri,verificationUriComplete:n.verification_uri_complete,expiresAt:Date.now()+Math.max(1,n.expires_in)*1e3,intervalSeconds:Math.max(1,n.interval)}}function M(n){if(!n)return null;try{return JSON.parse(n)}catch{return null}}function tt(n){if(!n||typeof n!="object"||Array.isArray(n))return null;let e=n;return e.access!=="contract"&&e.access!=="full_collection"||!Array.isArray(e.contracts)||e.contracts.some(t=>!t||typeof t!="object"||t.contract_type!=="record"||typeof t.id!="string"||typeof t.version!="string"||!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(t.version)||!/^sha256:[0-9a-f]{64}$/.test(t.digest)||!t.schema||typeof t.schema!="object"||Array.isArray(t.schema)||!Array.isArray(t.implementations)||t.implementations.some(i=>!i||typeof i!="object"||typeof i.type_name!="string"||!Number.isInteger(i.type_version)||!/^sha256:[0-9a-f]{64}$/.test(i.digest)||!i.fields||typeof i.fields!="object"||Array.isArray(i.fields)||Object.values(i.fields).some(o=>typeof o!="string")))?null:e}function Mn(n){return n.endsWith("/")?n.slice(0,-1):n}function Un(){if(typeof location>"u")throw c("manifest_required","manifest is required outside a browser environment.");if(location.origin==="null")throw c("manifest_required","Downloaded applications must provide their v1 portable manifest inline.");return new URL("/.well-known/mdbase-app.json",location.origin).href}function zn(){if(typeof location>"u")throw c("redirect_uri_required","redirectUri is required outside a browser environment.");return location.href.split(/[?#]/)[0]}function Fn(){if(typeof location>"u")throw c("callback_url_required","callbackUrl is required outside a browser environment.");return location.href}function Dn(n){if(n)return new _e;if(typeof localStorage>"u")throw c("storage_required","storage is required outside a browser environment.");try{let e=`mdbase-connect:probe:${N(8)}`;return localStorage.setItem(e,"1"),localStorage.removeItem(e),localStorage}catch{return new _e}}var _e=class{values=new Map;get length(){return this.values.size}clear(){this.values.clear()}getItem(e){return this.values.get(e)??null}key(e){return[...this.values.keys()][e]??null}removeItem(e){this.values.delete(e)}setItem(e,t){this.values.set(String(e),String(t))}};function Ln(n){return typeof n=="string"||n.distribution!=="portable"?!1:typeof location>"u"||location.origin==="null"||!["http:","https:"].includes(location.protocol)}function Nn(n){let e=Ut(n),t=2166136261,i=2654435769;for(let o=0;o<e.length;o+=1){let r=e.charCodeAt(o);t=Math.imul(t^r,16777619),i=Math.imul(i^r,2246822507)}return`${(t>>>0).toString(16).padStart(8,"0")}${(i>>>0).toString(16).padStart(8,"0")}`}var nt=class{constructor(e){this.context=e}context;async registerNotifications(e){let t=await this.context.authorizedToken();if(!t)throw c("not_authorized","Connect this application before enabling notifications.");let o=(await this.context.register()).notifications?.criteria.map(v=>v.id)??[],r=[...new Set(e.criteria??o)],a=r.find(v=>!o.includes(v));if(a)throw c("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${a}.`);if(r.length===0)throw c("notifications_not_declared","This application manifest does not declare any notification criteria.");let s=await $(`${this.context.serverUrl}/v1/notifications/vapid-public-key`,void 0,"notifications_unavailable","Push notifications are unavailable."),l=await s.json();if(!s.ok)throw R(l,"notifications_unavailable","Push notifications are unavailable.",s.status);let d=await e.serviceWorker.pushManager.getSubscription();d||(d=await e.serviceWorker.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:Cn(l.public_key)}));let p=d.toJSON();if(!p.endpoint||!p.keys?.p256dh||!p.keys.auth)throw c("invalid_push_subscription","The browser returned an incomplete push subscription.");let u=M(this.context.storage.getItem(this.context.notificationKey())),y=e.installationId??u?.installationId??N(24),h=await $(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${t.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:y,criteria:r,subscription:{endpoint:p.endpoint,expirationTime:p.expirationTime??null,keys:p.keys}})},"notification_registration_failed","Could not register push notifications."),_=await h.json();if(!h.ok)throw R(_,"notification_registration_failed","Could not register push notifications.",h.status);u?.channelId&&u.channelId!==_.channel_id&&fetch(`${this.context.serverUrl}/v1/notifications/channels/${u.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${t.accessToken}`}}).catch(()=>{});let f={channelId:_.channel_id,installationId:y,criteria:r};return this.context.storage.setItem(this.context.notificationKey(),JSON.stringify(f)),f}async registerNativeNotifications(e){let t=await this.context.authorizedToken();if(!t)throw c("not_authorized","Connect this application before enabling notifications.");let i=await this.context.register();if(i.notifications?.native_delivery?.mode!=="managed_fcm")throw c("managed_fcm_not_declared","This application does not declare Connect-managed native notifications.");let o=i.notifications.criteria.map(h=>h.id),r=[...new Set(e.criteria??o)],a=r.find(h=>!o.includes(h));if(a)throw c("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${a}.`);if(r.length===0)throw c("notifications_not_declared","This application manifest does not declare any notification criteria.");let s=this.context.notificationKey("fcm"),l=M(this.context.storage.getItem(s)),d=e.installationId??l?.installationId??N(24),p=await $(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${t.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:d,criteria:r,transport:"fcm",token:e.token})},"notification_registration_failed","Could not register native notifications."),u=await p.json();if(!p.ok)throw R(u,"notification_registration_failed","Could not register native notifications.",p.status);l?.channelId&&l.channelId!==u.channel_id&&this.deleteNotificationChannel(l.channelId,t.accessToken).catch(()=>{});let y={channelId:u.channel_id,installationId:d,transport:"fcm",criteria:r};return this.context.storage.setItem(s,JSON.stringify(y)),y}async unregisterNativeNotifications(){let e=this.context.notificationKey("fcm"),t=M(this.context.storage.getItem(e)),i=await this.context.authorizedToken();if(t?.channelId&&!i)throw c("not_authorized","Reconnect this application before disabling native notifications.");t?.channelId&&i&&await this.deleteNotificationChannel(t.channelId,i.accessToken),this.context.storage.removeItem(e)}async unregisterNotifications(e){let t=M(this.context.storage.getItem(this.context.notificationKey())),i=await this.context.authorizedToken();if(t?.channelId&&!i)throw c("not_authorized","Reconnect this application before disabling push notifications.");if(t?.channelId&&i){let r=await $(`${this.context.serverUrl}/v1/notifications/channels/${t.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${i.accessToken}`}},"notification_unregistration_failed","Could not unregister push notifications.");if(!r.ok&&r.status!==404){let a=await r.json();throw R(a,"notification_unregistration_failed","Could not unregister push notifications.",r.status)}}this.context.storage.removeItem(this.context.notificationKey()),await(await e?.pushManager.getSubscription())?.unsubscribe()}async deleteNotificationChannel(e,t){let i=await $(`${this.context.serverUrl}/v1/notifications/channels/${e}`,{method:"DELETE",headers:{authorization:`Bearer ${t}`}},"notification_unregistration_failed","Could not unregister push notifications.");if(!i.ok&&i.status!==404){let o=await i.json();throw R(o,"notification_unregistration_failed","Could not unregister push notifications.",i.status)}}};async function it(n,e,t,i,o,r){if(!n.authority)throw c("not_remote_authority","This authorization has no remote authority endpoint.");let a=t===""||t.startsWith("?")?t:`/${t}`,s=`${n.authority.filesUrl}${a}`,l=i===void 0?void 0:JSON.stringify(i),d=await r(n,e,s,l,n.authority.accessToken);return fetch(s,{method:e,redirect:"error",headers:{authorization:`Bearer ${n.authority.accessToken}`,...l===void 0?{}:{"content-type":"application/json"},...d},...l===void 0?{}:{body:l},...o?{signal:o}:{}})}async function qn(n,e,t,i,o,r,a){let s=n,l=await it(s,e,t,i,o,a);if(l.status===401&&s.refreshToken){if(s=await r(),!s.authority||!s.fileCapability)throw c("authority_authorization_changed","Reconnect this collection before accessing its files.");l=await it(s,e,t,i,o,a)}let d=await l.json().catch(()=>({}));if(!l.ok)throw R(d,"operation_failed","Collection file request failed.",l.status);return d}async function Bn(n,e,t,i,o,r){let a=n,s=await it(a,"GET",e,void 0,i,r);if(s.status===401&&a.refreshToken){if(a=await o(),!a.authority||!a.fileCapability)throw c("authority_authorization_changed","Reconnect this collection before accessing its files.");s=await it(a,"GET",e,void 0,i,r)}if(!s.ok){let d=await s.json().catch(()=>({}));throw R(d,"operation_failed","Collection file range request failed.",s.status)}let l=s.headers.get("content-length");if(l===null||!/^(0|[1-9][0-9]*)$/u.test(l)||Number(l)!==t)throw await s.body?.cancel().catch(()=>{}),c("invalid_operation_response","The hosted file response declared an unexpected byte length.");if(!s.body)throw c("invalid_operation_response","The hosted file response did not contain a byte stream.");return s.body}var ot=class{constructor(e){this.options=e}options;async control(e,t,i,o,r){be(e);let a=ho(t,i,o),s=await this.encryptControl(e,a),l;if(await this.options.shouldAttemptDirect(e)){try{l=await fetch(`${this.options.loopbackUrl}/v1/files/control`,te({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r}))}catch(d){if(r?.aborted)throw d;this.options.onDirectUnavailable()}if(l&&!me(l.status))return l.ok&&this.options.onDirectAvailable(),this.decryptControlResponse(e,s,l);l&&this.options.onDirectUnavailable()}return l=await this.sendRelayControl(e,s,r),await co(l,e)&&(e=await this.options.refreshAuthorization(),zt(e),s=await this.encryptControl(e,a),l=await this.sendRelayControl(e,s,r)),l.ok&&this.options.onRelayAvailable(),this.decryptControlResponse(e,s,l)}async decryptControlResponse(e,t,i){let o=await i.json().catch(()=>({}));if(!i.ok)throw R(o,"operation_failed","Collection file request failed.",i.status);let r=o?.envelope;if(!r)throw c("invalid_encrypted_response","The connector omitted its encrypted file response.");let a=await de(this.options.keyStore,e.keyHandle,Ft(e),t,r);return a.ok||po(a.problem),a.result}async uploadChunk(e,t,i,o){let a=await this.localFileToken(e,"upload"),s=await Kn(this.options.keyStore,a,e,t,i),l;if(await this.options.shouldAttemptDirect(a)){try{l=await fetch(`${this.options.loopbackUrl}/v1/files/upload`,te(jn(s,o)))}catch(d){if(o?.aborted)throw d;this.options.onDirectUnavailable()}if(l&&!me(l.status))return l.ok&&this.options.onDirectAvailable(),so(l,"Encrypted file chunk upload failed.");l&&this.options.onDirectUnavailable()}if(l=await this.sendRelayUpload(a,s,o),l.status===401&&a.refreshToken&&(a=await this.options.refreshAuthorization(),zt(a),s=await Kn(this.options.keyStore,a,e,t,i),l=await this.sendRelayUpload(a,s,o)),!l.ok){let d=await l.json().catch(()=>({}));throw R(d,"operation_failed","Encrypted file chunk upload failed.",l.status)}this.options.onRelayAvailable()}async downloadChunk(e,t,i){let o=await this.localFileToken(e,"download"),r;if(await this.options.shouldAttemptDirect(o)){try{r=await fetch(`${this.options.loopbackUrl}/v1/files/download/${encodeURIComponent(o.grantId)}/${encodeURIComponent(e.transfer_id)}/${t}`,te({method:"GET",signal:i}))}catch(a){if(i?.aborted)throw a;this.options.onDirectUnavailable()}if(r&&!me(r.status))return r.ok&&this.options.onDirectAvailable(),this.decryptDownloadResponse(o,e,t,r);r&&this.options.onDirectUnavailable()}return r=await this.sendRelayDownload(o,e,t,i),r.status===401&&o.refreshToken&&(o=await this.options.refreshAuthorization(),zt(o),r=await this.sendRelayDownload(o,e,t,i)),r.ok&&this.options.onRelayAvailable(),this.decryptDownloadResponse(o,e,t,r)}async decryptDownloadResponse(e,t,i,o){if(!o.ok){let s=await o.json().catch(()=>({}));throw R(s,"operation_failed","Encrypted file chunk download failed.",o.status)}if(o.headers.get("content-type")?.split(";",1)[0]!=="application/mdbase-connect-file")throw c("invalid_operation_response","The connector returned an invalid file response media type.");let r=new Uint8Array(await o.arrayBuffer()),a;try{uo(t,i,r),a=await(await $n(this.options.keyStore,e,t)).decryptChunk(r)}catch(s){throw s instanceof S?s:c("invalid_operation_response","The connector returned an invalid encrypted file frame.",{cause:s})}if(a.byteLength!==Dt(t,i))throw c("invalid_operation_response","The connector returned a truncated file chunk.");return a}encryptControl(e,t){return be(e),X(this.options.keyStore,e.keyHandle,Ft(e),"file_control",t)}sendRelayControl(e,t,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/control`,{method:"POST",headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/json"},body:JSON.stringify(t),signal:i})}sendRelayUpload(e,t,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/upload`,{...jn(t,i),headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/mdbase-connect-file"}})}sendRelayDownload(e,t,i,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/download/${encodeURIComponent(t.transfer_id)}/${i}`,{method:"GET",headers:{authorization:`Bearer ${e.accessToken}`},signal:o})}async localFileToken(e,t){let i=await this.options.authorizedToken();if(!i||i.authority||!i.fileCapability||!i.encryption||!i.grantId||!i.keyHandle||e.direction!==t||e.protection!=="grant_aead_v1")throw c("not_authorized","This connection cannot use encrypted local file delivery.");return rt(e),i}};function zt(n){if(n.authority||!n.fileCapability)throw c("not_authorized","This connection cannot use encrypted local file delivery.");be(n)}async function Kn(n,e,t,i,o){let r=lo(e,t,i,o.byteLength);return(await $n(n,e,t)).encryptChunk("upload_chunk",r,o)}function jn(n,e){return{method:"POST",headers:{"content-type":"application/mdbase-connect-file"},body:Uint8Array.from(n).buffer,signal:e}}async function so(n,e){if(n.ok)return;let t=await n.json().catch(()=>({}));throw R(t,"operation_failed",e,n.status)}async function co(n,e){return e.refreshToken?n.status===401?!0:n.status!==409?!1:(await n.clone().json().catch(()=>null))?.error?.code==="encryption_binding_stale":!1}function be(n){if(!n.encryption||!n.grantId||!n.keyHandle)throw c("missing_grant_key","Reconnect this application to restore encrypted file access.")}function Ft(n){return be(n),{grantId:n.grantId,applicationId:n.clientId,encryption:n.encryption}}function $n(n,e,t){return be(e),ue.open(n,e.keyHandle,{...Ft(e),authorityId:e.encryption.connector_id,transferId:t.transfer_id,direction:t.direction})}function lo(n,e,t,i){be(n);let o=rt(e),r=Dt(e,t);if(i!==r)throw c("invalid_request","The file chunk has the wrong byte length.");return{protocol_version:1,protection:"grant_aead_v1",grant_id:n.grantId,authority_id:n.encryption.connector_id,collection_id:n.collectionId,transfer_id:e.transfer_id,direction:e.direction,chunk_size:o,chunk_index:t,offset:t*o,plaintext_length:i,total_size:e.total_size,scope_epoch:n.encryption.scope_epoch,key_id:n.encryption.key_id}}function uo(n,e,t){let i=je(t),o=Dt(n,e),r=rt(n);if(i.kind!=="download_chunk"||i.header.chunk_index!==e||i.header.chunk_size!==r||i.header.offset!==e*r||i.header.plaintext_length!==o||i.header.total_size!==n.total_size)throw c("invalid_operation_response","The connector returned a file frame for a different chunk.")}function po(n){throw D(n.code==="unknown"?n.server_code:n.code,n.message,{details:n.details,operationOutcome:n.operation_outcome??"rejected",traceId:n.trace_id})}function ho(n,e,t){if(n==="GET"&&(e===""||e.startsWith("?"))){let o=new URLSearchParams(e.startsWith("?")?e.slice(1):e),r=o.get("limit");return{protocol_version:1,type:"list_files",...o.get("folder")?{folder:o.get("folder")}:{},...o.get("after")?{after:o.get("after")}:{},...r?{limit:Number(r)}:{}}}let i=e.split("/");if(n==="GET"&&i.length===2&&i[0]==="transfers")return Hn("get_file_transfer_status",i[1]);if(n==="DELETE"&&i.length===2&&i[0]==="transfers")return Hn("abort_file_transfer",i[1]);if(n==="POST"&&fo(t)){let o=e==="uploads"?"open_file_upload":e==="downloads"?"open_file_download":i.length===3&&i[0]==="uploads"&&i[2]==="commit"?"commit_file_upload":i.length===2&&i[1]==="move"&&t.file_id===decodeURIComponent(i[0])?"move_file":i.length===2&&i[1]==="delete"&&t.file_id===decodeURIComponent(i[0])?"delete_file":null;if(o&&t.type===o)return{...t}}throw c("invalid_request","The file control request path is invalid.")}function Hn(n,e){return{protocol_version:1,type:n,transfer_id:decodeURIComponent(e)}}function rt(n){if(n.strategy.kind!=="framed_chunks"||!Number.isSafeInteger(n.strategy.chunk_size)||n.strategy.chunk_size<=0)throw c("invalid_operation_response","The connector returned an invalid framed transfer strategy.");return n.strategy.chunk_size}function Dt(n,e){let t=rt(n);if(!Number.isSafeInteger(e)||e<0||!Number.isSafeInteger(n.total_size)||n.total_size<0)throw c("invalid_request","The file chunk index is invalid.");let i=e*t;if(!Number.isSafeInteger(i)||i>=n.total_size)throw c("invalid_request","The file chunk index is outside the transfer.");return Math.min(t,n.total_size-i)}function fo(n){return n!==null&&typeof n=="object"&&!Array.isArray(n)}var at=class{constructor(e){this.options=e;this.local=new ot(e)}options;local;async control(e,t="",i,o){let r=await this.requireFileToken();return r.authority?qn(r,e,t,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders):this.local.control(r,e,t,i,o)}uploadChunk(e,t,i,o){return this.local.uploadChunk(e,t,i,o)}downloadChunk(e,t,i){return this.local.downloadChunk(e,t,i)}async downloadHostedPart(e,t,i,o){let r=await this.requireFileToken();if(!r.authority)throw c("not_remote_authority","Hosted file delivery requires a remote authority endpoint.");return Bn(r,`downloads/${encodeURIComponent(e.transfer_id)}/parts/${t}`,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders)}async requireFileToken(){let e=await this.options.authorizedToken();if(!e?.fileCapability)throw c("not_authorized","This connection has no file capability.");return e}};var st=class{serverUrl;storage;keyStore;directAccessMode;loopbackUrl;collectionId;internals;onChange;files;refreshPromise=null;directStatus;currentRoute="relay";directFailures=0;directRetryAt=0;constructor(e){this.serverUrl=e.serverUrl,this.storage=e.storage,this.keyStore=e.keyStore,this.directAccessMode=e.directAccessMode,this.loopbackUrl=e.loopbackUrl,this.collectionId=e.collectionId,this.internals=e.internals,this.onChange=e.onChange,this.files=new at({keyStore:this.keyStore,serverUrl:this.serverUrl,loopbackUrl:this.loopbackUrl,authorizedToken:()=>this.authorizedToken(),refreshAuthorization:()=>this.refreshAuthorization(),shouldAttemptDirect:t=>this.shouldAttemptDirect(t),onDirectAvailable:()=>{this.markDirectAvailable(),this.setRoute("direct")},onDirectUnavailable:()=>this.markDirectUnavailable(),onRelayAvailable:()=>this.setRoute("relay"),authorityProofHeaders:(t,i,o,r,a)=>this.authorityProofHeaders(t,i,o,r,a)}),this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable"}get directAccess(){return this.currentToken()?.authority?"disabled":this.directStatus}get route(){return this.currentToken()?.authority?"remote":this.currentRoute}notifyStorageChanged(){this.emitConnection()}async checkDirectAccess(){let e=this.currentToken();if(!this.directEligible(e))return this.setDirectStatus("disabled");let t=await Me();return t==="denied"?this.setDirectStatus("denied"):(t==="prompt"||t===null)&&this.storage.getItem(this.directPreferenceKey())!=="enabled"?this.setDirectStatus("permission_required"):this.probeDirectAccess()}async requestDirectAccess(){let e=this.currentToken();return this.directCapable(e)?(this.storage.setItem(this.directPreferenceKey(),"enabled"),this.directRetryAt=0,this.probeDirectAccess()):this.setDirectStatus("disabled")}disableDirectAccess(){this.storage.setItem(this.directPreferenceKey(),"disabled"),this.setDirectStatus("disabled"),this.setRoute("relay")}pendingMutation(){let e=M(this.storage.getItem(this.pendingMutationKey())),t=this.currentToken();return!e||!t||e.collectionId!==t.collectionId||e.grantId!==t.grantId||e.keyId!==t.encryption?.key_id?null:{operation:e.operation,createdAt:e.createdAt,resumable:!0}}async resumePendingMutation(e,t){let i=this.pendingMutation();if(!i)throw c("no_pending_mutation","There is no interrupted mutation to resume.");return this.performOperation(i.operation,e,t)}async performOperation(e,t,i={}){ne(i.signal);let o=this.currentToken();if(!o)throw c("not_authorized","Connect this application before accessing a collection.");if(!o.operations.includes(e))throw c("insufficient_access",`This connection does not allow ${e}.`,{details:{required_operations:[e],granted_operations:[...o.operations],missing_operations:[e]}});let r=await this.shouldAttemptDirect(o);if(!r&&(o=await this.authorizedToken(),!o))throw c("not_authorized","Reconnect this application to continue.");let a;try{a=await this.sendOperation(o,e,t,r,i)}catch(p){throw xt(p,i.signal,We(e,t)&&this.pendingMutation()!==null,o.authority?"hosted_provider_unavailable":"relay_unavailable")}let s=a.response,l=s.status===409&&(await s.clone().json().catch(()=>null))?.error?.code==="encryption_binding_stale";if((s.status===401||l)&&o.refreshToken){if(a.pendingMutation&&(a.directDeliveryUncertain||a.encryptedRequest&&a.resumingMutation))throw c("operation_outcome_unknown","The direct operation may have completed, but its encrypted grant changed before the response could be recovered. Refresh before making another change.",{operationOutcome:"unknown"});a.pendingMutation&&this.clearPendingMutation(),o=await this.refreshAuthorization(),r=await this.shouldAttemptDirect(o);try{a=await this.sendOperation(o,e,t,r,i)}catch(p){throw xt(p,i.signal,We(e,t)&&this.pendingMutation()!==null,o.authority?"hosted_provider_unavailable":"relay_unavailable")}s=a.response}let d;try{d=await s.json()}catch(p){throw a.pendingMutation?L(p):c("invalid_operation_response","The collection authority returned a response that is not valid JSON.",{cause:p})}if(!s.ok){let p=R(d,"operation_failed","Collection operation failed.",s.status);throw a.pendingMutation&&(a.directDeliveryUncertain||a.encryptedRequest&&a.resumingMutation)?L(p):(a.pendingMutation&&!a.directDeliveryUncertain&&this.clearPendingMutation(),p.code==="direct_operation_rejected"&&p.status===403&&this.invalidateRejectedAuthorization(o),p)}if(a.encryptedRequest){let p=d?.envelope;if(!p||!o.encryption||!o.grantId||!o.keyHandle)throw a.pendingMutation?L(new Error("Encrypted operation response was missing its envelope.")):c("invalid_encrypted_response","The relay did not return an encrypted connector response.");try{let u=await de(this.keyStore,o.keyHandle,{grantId:o.grantId,applicationId:o.clientId,encryption:o.encryption},a.encryptedRequest,p);if(a.pendingMutation&&this.clearPendingMutation(),!u.ok)throw D(u.problem.code==="unknown"?u.problem.server_code:u.problem.code,u.problem.message,{details:u.problem.details,operationOutcome:u.problem.operation_outcome??"rejected",traceId:u.problem.trace_id});return u.result}catch(u){throw u instanceof S?u:u instanceof C?a.pendingMutation?L(u):D(u.code,u.message):u}}if(d?.protocol_version!==1||d?.request_id!==a.requestId)throw a.pendingMutation?L(new Error("Operation response protocol or request ID did not match.")):c("invalid_operation_response","The collection authority returned a response for a different protocol request.");if(d.ok===!1)throw Ce(d.problem)?(a.pendingMutation&&this.clearPendingMutation(),new S(d.problem)):a.pendingMutation?L(new Error("Operation rejection did not contain a canonical problem.")):c("invalid_operation_response","The collection authority returned an invalid operation problem.");if(d.ok!==!0||!("result"in d))throw a.pendingMutation?L(new Error("Successful operation response did not contain a result.")):c("invalid_operation_response","The collection authority returned an incomplete operation response.");return a.pendingMutation&&this.clearPendingMutation(),d.result}async performAuthoritySyncRequest(e,t,i,o,r){let a=await this.authorizedToken();if(!a?.authority||a.collectionId!==e||a.authority.replicaId!==t)throw c("authority_authorization_changed","Reconnect this collection authority before synchronizing.");let s=await this.sendAuthoritySyncRequest(a,i,o,r);if(s.status===401&&a.refreshToken){if(a=await this.refreshAuthorization(),!a.authority||a.collectionId!==e||a.authority.replicaId!==t)throw c("authority_authorization_changed","Reconnect this collection authority before synchronizing.");s=await this.sendAuthoritySyncRequest(a,i,o,r)}let l=await s.json();if(!s.ok)throw R(l,"sync_failed","Collection synchronization failed.",s.status);return l}async sendAuthoritySyncRequest(e,t,i,o){if(!e.authority)throw c("not_remote_authority","This authorization has no remote authority endpoint.");let r=`${e.authority.syncUrl}/${i}`,a=o===void 0?void 0:JSON.stringify(o),s=await this.authorityProofHeaders(e,t,r,a,e.authority.accessToken);return fetch(r,{method:t,headers:{authorization:`Bearer ${e.authority.accessToken}`,...o===void 0?{}:{"content-type":"application/json"},...s},...a===void 0?{}:{body:a}})}async sendOperation(e,t,i,o,r={}){let a=i??{},s,l=!1,d=!1,p=crypto.randomUUID(),u=null,y;if(We(t,i)){if(y=await On(t,i),u=M(this.storage.getItem(this.pendingMutationKey())),u){if(u.collectionId!==e.collectionId||u.grantId!==e.grantId||u.keyId!==e.encryption?.key_id||u.operation!==t||u.inputFingerprint!==y)throw c("pending_mutation_unresolved","A previous write still has an unknown outcome. Retry that exact write before making another change.");p=u.requestId,d=!0}l=!0}if(e.encryption&&!e.authority){if(!e.grantId||!e.keyHandle)throw c("missing_grant_key","Reconnect this application to restore encrypted access.");try{if(l)if(u){if(!u.envelope)throw c("pending_mutation_unresolved","The pending write belongs to a different transport. Reconnect before retrying it.");s=u.envelope}else s=await X(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},t,i,p),this.storage.setItem(this.pendingMutationKey(),JSON.stringify({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},keyId:e.encryption.key_id,operation:t,inputFingerprint:y,requestId:p,envelope:s,createdAt:Date.now()}));else s=await X(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},t,i)}catch(m){throw m instanceof C?D(m.code,m.message):m}a=s}else a={protocol_version:1,request_id:p,input:a},l&&!u&&this.storage.setItem(this.pendingMutationKey(),JSON.stringify({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},operation:t,inputFingerprint:y,requestId:p,createdAt:Date.now()}));if(o&&s&&!e.authority){let m=!1;try{let k=await fetch(`${this.loopbackUrl}/v1/operations`,te({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r.signal}));if(!me(k.status))return k.ok&&(this.markDirectAvailable(),this.setRoute("direct")),{response:k,requestId:p,encryptedRequest:s,pendingMutation:l,resumingMutation:d};m=k.status>=500,this.markDirectUnavailable()}catch(k){if(r.signal?.aborted)throw k;m=!0,await Me()==="denied"?this.setDirectStatus("denied"):this.markDirectUnavailable()}let P;try{P=e.expiresAt>Date.now()+3e4?e:await this.refreshAuthorization()}catch(k){throw l&&(m||d)?L(k):k}let g;try{g=await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(P.collectionId)}/operations/${t}`,{method:"POST",headers:{authorization:`Bearer ${P.accessToken}`,"content-type":"application/json"},body:JSON.stringify(s),signal:r.signal})}catch(k){throw l&&(m||d)?L(k):k}return g.ok&&this.setRoute("relay"),{response:g,requestId:p,encryptedRequest:s,directDeliveryUncertain:m,pendingMutation:l,resumingMutation:d}}let h=e.authority?`${e.authority.operationsUrl}/${t}`:`${this.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/operations/${t}`,_=JSON.stringify(a),f=e.authority?await this.authorityProofHeaders(e,"POST",h,_,e.authority.accessToken):{},v=await fetch(h,{method:"POST",headers:{authorization:`Bearer ${e.authority?.accessToken??e.accessToken}`,"content-type":"application/json",...f},body:_,signal:r.signal});return v.ok&&this.setRoute(e.authority?"remote":"relay"),{response:v,requestId:p,encryptedRequest:s,pendingMutation:l,resumingMutation:d}}directCapable(e){return!(!e||e.authority||!e.encryption||!e.grantId||!e.keyHandle||this.directAccessMode==="disabled"||typeof location<"u"&&e.applicationOrigin&&e.applicationOrigin!==location.origin)}hasResumableMutationTransport(){return!!this.currentToken()}directEligible(e){return e!==null&&this.directCapable(e)&&this.storage.getItem(this.directPreferenceKey())!=="disabled"}async shouldAttemptDirect(e){if(!this.directEligible(e))return!1;if(this.directStatus==="available")return!0;if(this.directStatus==="unavailable"&&Date.now()<this.directRetryAt)return!1;let t=await Me();return t==="denied"?(this.setDirectStatus("denied"),!1):(t==="prompt"||t===null)&&this.storage.getItem(this.directPreferenceKey())!=="enabled"?(this.setDirectStatus("permission_required"),!1):(this.setDirectStatus("checking"),!0)}async probeDirectAccess(){this.setDirectStatus("checking");try{let e=await fetch(`${this.loopbackUrl}/v1/ready`,te({method:"GET",cache:"no-store"})),t=await e.json().catch(()=>null);if(e.ok&&t?.service==="mdbase-connect"&&t?.loopback_protocol_version===1&&t?.encrypted_protocol_version===1)return this.markDirectAvailable(),"available"}catch{}return await Me()==="denied"?this.setDirectStatus("denied"):(this.markDirectUnavailable(),"unavailable")}markDirectAvailable(){this.directFailures=0,this.directRetryAt=0,this.setDirectStatus("available")}markDirectUnavailable(){this.directFailures+=1,this.directRetryAt=Date.now()+Math.min(6e4,1e3*2**(this.directFailures-1)),this.setDirectStatus("unavailable")}setDirectStatus(e){return this.directStatus!==e&&(this.directStatus=e,this.emitConnection()),e}setRoute(e){this.currentRoute!==e&&(this.currentRoute=e,this.emitConnection())}emitConnection(){this.onChange()}invalidateRejectedAuthorization(e){let t=M(this.storage.getItem(this.tokenKey()));!t||!Pn(t,e)||(this.internals.removeToken(this.collectionId,t.keyHandle),this.currentRoute="relay",this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection())}currentToken(){let e=this.storage.getItem(this.tokenKey()),t=M(e),i=o=>(this.internals.removeToken(this.collectionId,typeof o=="string"?o:void 0,"invalid_stored_grant"),null);if(!t)return e&&i(),null;if(t.version!==1||typeof t.accessToken!="string"||t.accessToken.length===0||typeof t.clientId!="string"||t.clientId.length===0||t.collectionId!==this.collectionId||typeof t.collectionName!="string"||t.collectionName.length===0||!Array.isArray(t.operations)||t.operations.some(o=>typeof o!="string")||typeof t.expiresAt!="number"||!Number.isFinite(t.expiresAt)||t.refreshToken!==void 0&&(typeof t.refreshToken!="string"||t.refreshToken.length===0)||t.refreshExpiresAt!==void 0&&(typeof t.refreshExpiresAt!="number"||!Number.isFinite(t.refreshExpiresAt))||!tt(t.scope)||t.fileCapability&&!et(t.fileCapability)||t.authority&&!In(t.authority,t.collectionId))return i(t.keyHandle);if(this.internals.relayEncryption==="required"){if(t.authority){if(!t.keyHandle||!t.authority.proofPublicKey)return i(t.keyHandle)}else if(!t.grantId||!t.keyHandle||!En(t.encryption,t.collectionId))return i(t.keyHandle)}return t.expiresAt<=Date.now()&&(!t.refreshToken||(t.refreshExpiresAt??0)<=Date.now())?this.directCapable(t)?t:(this.internals.removeToken(this.collectionId,t.keyHandle),null):t}async authorizedToken(){let e=this.currentToken();if(!e)return null;if(e.expiresAt>Date.now()+3e4)return e;if(!e.refreshToken||(e.refreshExpiresAt??0)<=Date.now()){if(this.directCapable(e))throw c("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");return this.internals.removeToken(this.collectionId,e.keyHandle),null}return this.refreshAuthorization()}refreshAuthorization(){return this.refreshPromise?this.refreshPromise:(this.refreshPromise=this.performRefresh().finally(()=>{this.refreshPromise=null}),this.refreshPromise)}async performRefresh(){let e=this.currentToken();if(!e?.refreshToken)throw c("not_authorized","Reconnect this application to continue.");if((e.refreshExpiresAt??0)<=Date.now())throw c("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");let t=e.refreshToken,i=`${this.serverUrl}/oauth/token`,o=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken,client_id:e.clientId}).toString(),r=e.authority?await this.authorityProofHeaders(e,"POST",i,o,e.refreshToken):{},a=await fetch(i,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...r},body:o}),s=await a.json();if(!a.ok){let l=this.currentToken();if(l?.refreshToken&&l.refreshToken!==t)return l;throw this.directCapable(e)||this.internals.removeToken(this.collectionId,e.keyHandle),(ge(s)??s?.error?.code)==="invalid_grant"?c("authorization_expired",s?.error_description??s?.error?.message??"Reconnect this application to continue.",{status:a.status}):R(s,"authorization_expired","Reconnect this application to continue.",a.status)}return this.storeTokenResponse(s,e.clientId,e.keyHandle)}async authorityProofHeaders(e,t,i,o,r){if(!e.authority?.proofPublicKey)return{};if(!e.keyHandle)throw c("missing_grant_key","Reconnect this application to restore remote authority request signing.");try{let a=new URL(i);return await sn(this.keyStore,e.keyHandle,e.authority.proofPublicKey,{method:t,target:`${a.pathname}${a.search}`,body:o,credential:r})}catch(a){throw a instanceof C?D(a.code,a.message):a}}storeTokenResponse(e,t,i){if(e.collection_id!==this.collectionId)throw c("collection_mismatch","The refreshed authorization belongs to a different collection.");let o=this.internals.storeTokenResponse(e,t,i);return this.currentRoute=o.authority?"remote":"relay",this.directStatus=o.authority||this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection(),o}tokenKey(){return this.internals.tokenKey(this.collectionId)}notificationKey(e="web_push"){return this.internals.notificationKey(this.collectionId,e)}pendingMutationKey(){return this.internals.pendingMutationKey(this.collectionId)}clearPendingMutation(){this.storage.removeItem(this.pendingMutationKey())}directPreferenceKey(){return this.internals.directPreferenceKey()}};var yo=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),mo=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),ve=class{state=mo.slice();block=new Uint8Array(64);words=new Uint32Array(64);blockLength=0;byteLength=0;finished=!1;update(e){if(this.finished)throw new Error("SHA-256 digest is already finalized.");if(this.byteLength+=e.byteLength,!Number.isSafeInteger(this.byteLength))throw new Error("SHA-256 input exceeds the safe browser byte range.");let t=0;if(this.blockLength>0){let i=Math.min(64-this.blockLength,e.byteLength);this.block.set(e.subarray(0,i),this.blockLength),this.blockLength+=i,t+=i,this.blockLength===64&&(this.compress(this.block),this.blockLength=0)}for(;t+64<=e.byteLength;)this.compress(e.subarray(t,t+64)),t+=64;return t<e.byteLength&&(this.block.set(e.subarray(t),0),this.blockLength=e.byteLength-t),this}digestHex(){if(this.finished)throw new Error("SHA-256 digest is already finalized.");this.finished=!0,this.block[this.blockLength]=128,this.block.fill(0,this.blockLength+1),this.blockLength>=56&&(this.compress(this.block),this.block.fill(0));let e=this.byteLength*8,t=Math.floor(e/4294967296),i=e>>>0;return Vn(this.block,56,t),Vn(this.block,60,i),this.compress(this.block),[...this.state].map(o=>o.toString(16).padStart(8,"0")).join("")}compress(e){let t=this.words;for(let u=0;u<16;u+=1){let y=u*4;t[u]=(e[y]<<24|e[y+1]<<16|e[y+2]<<8|e[y+3])>>>0}for(let u=16;u<64;u+=1){let y=t[u-15],h=t[u-2],_=K(y,7)^K(y,18)^y>>>3,f=K(h,17)^K(h,19)^h>>>10;t[u]=t[u-16]+_+t[u-7]+f>>>0}let i=this.state[0],o=this.state[1],r=this.state[2],a=this.state[3],s=this.state[4],l=this.state[5],d=this.state[6],p=this.state[7];for(let u=0;u<64;u+=1){let y=K(s,6)^K(s,11)^K(s,25),h=s&l^~s&d,_=p+y+h+yo[u]+t[u]>>>0,f=K(i,2)^K(i,13)^K(i,22),v=i&o^i&r^o&r,m=f+v>>>0;p=d,d=l,l=s,s=a+_>>>0,a=r,r=o,o=i,i=_+m>>>0}this.state[0]=this.state[0]+i>>>0,this.state[1]=this.state[1]+o>>>0,this.state[2]=this.state[2]+r>>>0,this.state[3]=this.state[3]+a>>>0,this.state[4]=this.state[4]+s>>>0,this.state[5]=this.state[5]+l>>>0,this.state[6]=this.state[6]+d>>>0,this.state[7]=this.state[7]+p>>>0}};function K(n,e){return n>>>e|n<<32-e}function Vn(n,e,t){n[e]=t>>>24,n[e+1]=t>>>16,n[e+2]=t>>>8,n[e+3]=t}var ct=class{constructor(e,t){this.signal=t;this.iterator=_o(e)}signal;iterator;remainder=new Uint8Array;remainderOffset=0;maxSourceChunkBytes=null;iteratorClosing=!1;ended=!1;setMaxSourceChunkBytes(e){this.maxSourceChunkBytes=e}async read(e){let t=new Uint8Array(e),i=0;for(;i<e;){if(this.remainderOffset===this.remainder.byteLength){let r=await this.nextSourceChunk();if(r.done)throw this.ended=!0,c("invalid_request","Streamed file bytes ended before the declared size.");if(!(r.value instanceof Uint8Array))throw c("invalid_request","A streamed file chunk was not a Uint8Array.");if(this.maxSourceChunkBytes===null)throw new Error("Stream source was read before upload negotiation completed.");if(r.value.byteLength>this.maxSourceChunkBytes)throw c("invalid_request",`A streamed file chunk exceeded the negotiated ${this.maxSourceChunkBytes}-byte upload part size.`);if(this.remainder=r.value,this.remainderOffset=0,this.remainder.byteLength===0)continue}let o=Math.min(e-i,this.remainder.byteLength-this.remainderOffset);t.set(this.remainder.subarray(this.remainderOffset,this.remainderOffset+o),i),i+=o,this.remainderOffset+=o}return t}async expectEnd(){if(this.remainderOffset<this.remainder.byteLength)throw c("invalid_request","Streamed file bytes exceed the declared size.");for(;!this.ended;){let e=await this.nextSourceChunk();if(e.done){this.ended=!0;return}if(!(e.value instanceof Uint8Array))throw c("invalid_request","A streamed file chunk was not a Uint8Array.");if(e.value.byteLength>0)throw c("invalid_request","Streamed file bytes exceed the declared size.")}}async close(){this.ended=!0,this.closeIterator()}async nextSourceChunk(){Gn(this.signal);let e=this.iterator.next(),t=this.signal;if(!t)return e;let i=()=>{},o=new Promise((r,a)=>{let s=()=>{this.closeIterator(),a(Yn(t))};t.addEventListener("abort",s,{once:!0}),i=()=>t.removeEventListener("abort",s),t.aborted&&s()});try{let r=await Promise.race([e,o]);return Gn(t),r}finally{i()}}closeIterator(){if(!this.iteratorClosing){this.iteratorClosing=!0;try{this.iterator.return?.()?.catch(()=>{})}catch{}}}};function _o(n){if(typeof n.getReader=="function"){let t=n.getReader(),i=!1,o=()=>{i||(i=!0,t.releaseLock())};return{async next(){if(i)return{done:!0,value:void 0};let r=await t.read();return r.done&&o(),r},async return(){if(!i)try{await t.cancel()}finally{o()}return{done:!0,value:void 0}}}}let e=n;if(typeof e[Symbol.asyncIterator]!="function")throw c("invalid_request","Streamed files require a readable byte stream.");return e[Symbol.asyncIterator]()}function Gn(n){if(n?.aborted)throw Yn(n)}function Yn(n){return c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n?.reason})}var Jn=1024*1024,go=4,Qn=8,we=3,Xn=64*1024*1024,bo=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu,vo=/^sha256:[0-9a-f]{64}$/u,Fe=class{constructor(e,t,i,o){this.capability=e;this.request=t;this.framed=i;this.hosted=o}capability;request;framed;hosted;async*list(e={}){this.requireAction("list");let t;do{ie(e.signal);let i=new URLSearchParams({protocol_version:String(1),...e.folder?{folder:e.folder}:{},...t?{after:t}:{},...e.pageSize?{limit:String(Ro(e.pageSize))}:{}}),o=await this.request("GET",`?${i.toString()}`,void 0,e.signal);if(o.protocol_version!==1||o.type!=="files_page"||!Array.isArray(o.files))throw c("invalid_operation_response","The authority returned an invalid file page.");for(let r of o.files)ie(e.signal),yield r;t=o.next}while(t)}async upload(e,t,i={}){this.requireAction(i.ifRevision?"replace":"add");let o=Co(t,i.mediaType),r=Wn(i.concurrency),a=await wo(o,i.signal,s=>{i.onProgress?.({phase:"hashing",transferredBytes:s,totalBytes:o.size})});return this.uploadKnownSource(e,o.size,`sha256:${a}`,(i.mediaType??o.type)||void 0,i,r,async(s,l,d)=>o.slice(l,l+d))}async uploadStream(e,t,i={}){if(this.requireAction(i.ifRevision?"replace":"add"),!Number.isSafeInteger(t.size)||t.size<0)throw c("invalid_request","Streamed file size must be a non-negative safe integer.");if(!vo.test(t.contentDigest))throw c("invalid_request","Streamed files require a lowercase SHA-256 content digest.");let o=new ct(t.stream,i.signal),r=new ve;return this.uploadKnownSource(e,t.size,t.contentDigest,i.mediaType??t.mediaType,i,1,async(a,s,l)=>{let d=await o.read(l);return r.update(d),d},async()=>{if(await o.expectEnd(),`sha256:${r.digestHex()}`!==t.contentDigest)throw c("invalid_request","Streamed file bytes do not match the declared SHA-256 digest.")},()=>o.close(),a=>o.setMaxSourceChunkBytes(a))}async uploadKnownSource(e,t,i,o,r,a,s,l,d,p){let u=r.transferId??crypto.randomUUID();if(!bo.test(u))throw c("invalid_request","File transfer ID must be a UUID.");let y=!1;try{let h=await this.request("POST","uploads",{protocol_version:1,type:"open_file_upload",transfer_id:u,path:e,size:t,content_digest:i,...o?{media_type:o}:{},...r.ifRevision?{if_revision:r.ifRevision}:{}},r.signal);if(Zn(h,u,"upload"),h.total_size!==t||h.strategy.kind==="object_ranges")throw c("invalid_operation_response","The authority returned an incompatible upload strategy.");let _=h.strategy.kind==="framed_chunks";if(_&&!this.framed)throw c("invalid_operation_response","Encrypted file chunk delivery is unavailable.");let f=h.strategy.kind==="object_put"?Math.max(1,t):h.strategy.kind==="framed_chunks"?h.strategy.chunk_size:h.strategy.part_size,v=h.strategy.kind==="object_put"?1:Math.ceil(t/f);if(p?.(f),!_&&h.received.length===v){let w=await this.tryReplayUploadCommit(u,h.strategy.kind==="object_multipart"?h.uploaded_parts:void 0,r.signal);if(w)return y=!0,w.file}let m=new Set(h.received),P=new Map((h.uploaded_parts??[]).map(w=>[w.part_number-1,w])),g=[...m].reduce((w,F)=>w+Ao(t,f,F),0),k=await Io(v,a,async w=>{let F=w*f,j=Math.min(f,Math.max(0,t-F)),ut=await s(w,F,j);if(Po(ut)!==j)throw c("invalid_request","Streamed file bytes ended before the declared size.");if(m.has(w))return P.get(w)??null;let ni=_?await Lt(async()=>this.framed.uploadChunk(h,w,await So(ut),r.signal),r.signal).then(()=>null):await this.uploadPart(u,w,F,ut,j,h.strategy.kind==="object_multipart",r.signal);return g+=j,r.onProgress?.({phase:"uploading",transferredBytes:g,totalBytes:t}),ni});await l?.();let x=await this.commitUpload(u,h.strategy.kind==="object_multipart"?k.filter(w=>w!==null):void 0,r.signal);if(x.protocol_version!==1||x.type!=="file_upload_committed"||x.transfer_id!==u||x.file.path!==e||x.file.size!==t||x.file.content_digest!==i)throw c("invalid_operation_response","The authority returned an invalid file receipt.");return y=!0,x.file}catch(h){throw ze(h)}finally{await d?.().catch(()=>{}),!y&&r.transferId===void 0&&await this.abort(u)}}async download(e,t={}){if(e.size>Xn)throw c("invalid_request",`download() buffers at most ${Xn} bytes; use downloadStream() for larger files.`);let i=await this.downloadStream(e,t),o=[],r=i.getReader();for(;;){let a=await r.read();if(a.done)break;o.push(a.value)}return new Blob(o.map(a=>{let s=new Uint8Array(a.byteLength);return s.set(a),s.buffer}),{type:e.media_type??""})}async downloadStream(e,t={}){this.requireAction("read"),Wn(t.concurrency);let i=crypto.randomUUID(),o;try{if(o=await this.request("POST","downloads",{protocol_version:1,type:"open_file_download",transfer_id:i,file_id:e.file_id,revision:e.revision},t.signal),Zn(o,i,"download"),o.total_size!==e.size||o.strategy.kind!=="object_ranges"&&o.strategy.kind!=="framed_chunks")throw c("invalid_operation_response","The authority returned an incompatible download session.");if(o.strategy.kind==="framed_chunks"&&!this.framed)throw c("invalid_operation_response","Encrypted file chunk delivery is unavailable.");if(o.strategy.kind==="object_ranges"&&e.size>0&&!this.hosted)throw c("invalid_operation_response","Authenticated hosted file delivery is unavailable.")}catch(f){throw await this.abort(i),ze(f)}let r=o.strategy.kind==="framed_chunks"?o.strategy.chunk_size:o.strategy.part_size,a=Math.ceil(e.size/r),s=new ve,l=0,d=0,p=null,u=0,y=!1,h=async()=>{y||(y=!0,await p?.cancel().catch(()=>{}),p=null,await this.abort(i))},_=()=>{if(u!==e.size||`sha256:${s.digestHex()}`!==e.content_digest)throw c("invalid_operation_response","Downloaded file bytes failed integrity verification.")};return new ReadableStream({pull:async f=>{try{if(ie(t.signal),o.strategy.kind==="object_ranges")for(;;){if(!p){if(l>=a){_(),await h(),f.close();return}let k=l*r;d=Math.min(r,e.size-k),p=(await Lt(()=>this.hosted.downloadPart(o,l,d,t.signal),t.signal)).getReader()}let g=await p.read();if(g.done){if(p.releaseLock(),p=null,d!==0)throw c("invalid_operation_response","A hosted file range ended before its declared byte length.");l+=1;continue}if(!(g.value instanceof Uint8Array))throw c("invalid_operation_response","A hosted file range returned a non-byte chunk.");if(g.value.byteLength!==0){if(g.value.byteLength>d)throw c("invalid_operation_response","A hosted file range exceeded its declared byte length.");d-=g.value.byteLength,s.update(g.value),u+=g.value.byteLength,t.onProgress?.({phase:"downloading",transferredBytes:u,totalBytes:e.size}),f.enqueue(g.value);return}}if(l>=a){_(),await h(),f.close();return}let v=l*r,m=Math.min(r,e.size-v),P=await Lt(()=>this.framed.downloadChunk(o,l,t.signal),t.signal);if(P.byteLength!==m)throw c("invalid_operation_response","A file chunk had the wrong byte length.");s.update(P),u+=P.byteLength,l+=1,t.onProgress?.({phase:"downloading",transferredBytes:u,totalBytes:e.size}),l===a&&_(),f.enqueue(P),l===a&&(await h(),f.close())}catch(v){await h(),f.error(ze(v))}},cancel:h})}async downloadBytes(e,t={}){return new Uint8Array(await(await this.download(e,t)).arrayBuffer())}async move(e,t,i={}){this.requireAction("move");let o=i.mutationId??crypto.randomUUID(),r;try{r=await this.request("POST",`${encodeURIComponent(e.file_id)}/move`,{protocol_version:1,type:"move_file",mutation_id:o,file_id:e.file_id,if_revision:i.ifRevision??e.revision,from_path:e.path,path:t,update_references:!1},i.signal)}catch(a){throw ze(a)}if(r.protocol_version!==1||r.type!=="file_moved"||r.mutation_id!==o||r.file.file_id!==e.file_id||r.file.path!==t)throw c("invalid_operation_response","The authority returned an invalid file move receipt.");return r.file}async delete(e,t={}){this.requireAction("delete");let i=t.mutationId??crypto.randomUUID(),o;try{o=await this.request("POST",`${encodeURIComponent(e.file_id)}/delete`,{protocol_version:1,type:"delete_file",mutation_id:i,file_id:e.file_id,if_revision:t.ifRevision??e.revision,path:e.path},t.signal)}catch(r){throw ze(r)}if(o.protocol_version!==1||o.type!=="file_deleted"||o.mutation_id!==i||o.file_id!==e.file_id||o.previous_path!==e.path)throw c("invalid_operation_response","The authority returned an invalid file delete receipt.");return o}async uploadPart(e,t,i,o,r,a,s){for(let l=1;l<=we;l+=1){ie(s);try{let d=await this.request("POST",`uploads/${encodeURIComponent(e)}/parts`,{protocol_version:1,type:"prepare_file_upload_part",transfer_id:e,part_number:t+1,content_length:r},s);Oo(d,e,t,i,r,"PUT");let p=await fetch(d.url,{method:d.method,headers:To(d.headers),body:o,redirect:"error",signal:s});if(!p.ok)throw new Error(`Object upload failed with HTTP ${p.status}.`);let u=p.headers.get("etag");if(a&&!u)throw new Error("Multipart object upload did not return an ETag.");return{part_number:t+1,etag:u??""}}catch(d){if(s?.aborted||l===we)throw d}}throw new Error("Unreachable upload retry state.")}async tryReplayUploadCommit(e,t,i){try{return await this.commitUpload(e,t,i)}catch(o){if(o instanceof S&&o.code==="file_upload_incomplete")return null;throw o}}async commitUpload(e,t,i){let o;for(let r=1;r<=we;r+=1){ie(i);try{return await this.request("POST",`uploads/${encodeURIComponent(e)}/commit`,{protocol_version:1,type:"commit_file_upload",transfer_id:e,...t===void 0?{}:{parts:t}},i)}catch(a){if(o=a,i?.aborted||a instanceof S||r===we)throw a}}throw o}requireAction(e){if(!this.capability()?.actions.includes(e))throw c("not_authorized",`This connection is not authorized to ${e} files.`)}async abort(e){await this.request("DELETE",`transfers/${encodeURIComponent(e)}`).catch(()=>{})}};async function wo(n,e,t){let i=new ve;for(let o=0;o<n.size;o+=Jn){ie(e);let r=new Uint8Array(await n.slice(o,o+Jn).arrayBuffer());i.update(r),t(Math.min(n.size,o+r.byteLength))}return n.size===0&&t(0),i.digestHex()}function Co(n,e){if(n instanceof Blob)return e&&e!==n.type?n.slice(0,n.size,e):n;if(n instanceof ArrayBuffer)return new Blob([n],{type:e});let t=new Uint8Array(n.byteLength);return t.set(new Uint8Array(n.buffer,n.byteOffset,n.byteLength)),new Blob([t.buffer],{type:e})}function Po(n){return n instanceof Blob?n.size:n.byteLength}async function So(n){return n instanceof Blob?new Uint8Array(await n.arrayBuffer()):n}function Wn(n=go){if(!Number.isInteger(n)||n<1||n>Qn)throw c("invalid_request",`File concurrency must be between 1 and ${Qn}.`);return n}function Ro(n){if(!Number.isInteger(n)||n<1||n>1e3)throw c("invalid_request","File page size must be between 1 and 1000.");return n}function Zn(n,e,t){if(n.protocol_version!==1||n.type!=="file_transfer"||n.transfer_id!==e||n.direction!==t||!Number.isSafeInteger(n.total_size)||n.total_size<0||!Array.isArray(n.received)||!ko(n))throw c("invalid_operation_response","The authority returned an invalid file transfer session.");let i=n.strategy.kind==="framed_chunks"?n.strategy.chunk_size:n.strategy.kind==="object_put"?Math.max(1,n.total_size):n.strategy.part_size,o=n.strategy.kind==="object_put"?1:Math.ceil(n.total_size/i);if(new Set(n.received).size!==n.received.length||n.received.some(a=>!Number.isSafeInteger(a)||a<0||a>=o))throw c("invalid_operation_response","The authority returned invalid transfer progress.");let r=n.uploaded_parts??[];if(!Array.isArray(r)||r.some((a,s)=>!Number.isSafeInteger(a?.part_number)||a.part_number<1||a.part_number>o||typeof a.etag!="string"||a.etag.length===0||a.etag.length>255||s>0&&r[s-1].part_number>=a.part_number)||(n.strategy.kind==="object_multipart"?r.length!==n.received.length||r.some((a,s)=>a.part_number-1!==n.received[s]):r.length!==0))throw c("invalid_operation_response","The authority returned invalid uploaded part receipts.")}function ko(n){return n.strategy.kind==="framed_chunks"?n.protection==="grant_aead_v1"&&Number.isSafeInteger(n.strategy.chunk_size)&&n.strategy.chunk_size>0:n.protection!=="transport_tls"?!1:n.strategy.kind==="object_put"?!0:Number.isSafeInteger(n.strategy.part_size)&&n.strategy.part_size>0}function Ao(n,e,t){return Math.min(e,Math.max(0,n-t*e))}async function Lt(n,e){for(let t=1;t<=we;t+=1){ie(e);try{return await n()}catch(i){if(e?.aborted||t===we)throw i}}throw new Error("Unreachable file chunk retry state.")}function Oo(n,e,t,i,o,r){let a;try{a=new URL(n.url)}catch{throw c("invalid_operation_response","The authority returned an invalid object URL.")}if(n.protocol_version!==1||n.type!=="file_part"||n.transfer_id!==e||n.part_index!==t||n.offset!==i||n.content_length!==o||n.method.toUpperCase()!==r||a.protocol!=="https:"&&!(a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))||a.username||a.password)throw c("invalid_operation_response","The authority returned an invalid prepared file part.")}function To(n){let e=new Headers;for(let[t,i]of Object.entries(n))["host","content-length"].includes(t.toLowerCase())||e.set(t,i);return e}async function Io(n,e,t){let i=new Array(n),o=0;return await Promise.all(Array.from({length:Math.min(n,e)},async()=>{for(;o<n;){let r=o;o+=1,i[r]=await t(r)}})),i}function ie(n){if(n?.aborted)throw c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n.reason})}function ze(n){return n instanceof S?n:typeof DOMException<"u"&&n instanceof DOMException&&n.name==="AbortError"?c("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n}):c("temporarily_unavailable","The file transfer could not be completed.",{cause:n})}var oe=["describe","changes","read","query"];var De=class{constructor(e,t){this.internals=e;this.collectionId=t;this.transport=new st({serverUrl:e.serverUrl,storage:e.storage,keyStore:e.keyStore,directAccessMode:e.directAccessMode,loopbackUrl:e.loopbackUrl,collectionId:t,internals:e,onChange:()=>this.emitConnection()}),this.files=new Fe(()=>this.fileCapability,(i,o,r,a)=>this.transport.files.control(i,o,r,a),{uploadChunk:(i,o,r,a)=>this.transport.files.uploadChunk(i,o,r,a),downloadChunk:(i,o,r)=>this.transport.files.downloadChunk(i,o,r)},{downloadPart:(i,o,r,a)=>this.transport.files.downloadHostedPart(i,o,r,a)}),this.collectionClient=new Ee({operation:(i,o,r)=>this.transport.performOperation(i,o,r)}),this.notifications=new nt({serverUrl:e.serverUrl,storage:e.storage,authorizedToken:()=>this.transport.authorizedToken(),register:()=>this.internals.register(),notificationKey:i=>e.notificationKey(t,i)})}internals;collectionId;collectionClient;notifications;transport;files;connectionListeners=new Set;get displayName(){return this.transport.currentToken()?.collectionName??`Collection ${this.collectionId.slice(0,8)}`}get operations(){return[...this.transport.currentToken()?.operations??[]]}get scope(){return this.transport.currentToken()?.scope??null}get fileCapability(){return this.transport.currentToken()?.fileCapability??null}get directAccess(){return this.transport.directAccess}get route(){return this.transport.route}register(){return A(()=>this.internals.register(),Z)}info(){let e=this.transport.currentToken();return e?{collectionId:e.collectionId,displayName:e.collectionName,operations:[...e.operations],scope:e.scope,...e.fileCapability?{fileCapability:e.fileCapability}:{},route:this.transport.route,directAccess:this.transport.directAccess}:null}authorizationCapabilities(e=oe){let t=this.operations,i=B(e).filter(o=>!t.includes(o));return{authorized:this.info()!==null,sufficient:this.info()!==null&&i.length===0,collectionId:this.collectionId,grantedOperations:t,missingOperations:i}}hasOperations(e){return this.authorizationCapabilities(e).sufficient}authorize(e={}){return A(()=>this.internals.authorize({...e,target:{kind:"collection",collectionId:this.collectionId}}),ee)}async requestOperations(e,t={}){let i=this.authorizationCapabilities(e);return i.sufficient?E({kind:"unchanged",connection:this}):this.authorize({...t,operations:B([...i.grantedOperations,...i.missingOperations])})}onConnectionChange(e){return this.connectionListeners.add(e),e(this.info()),()=>this.connectionListeners.delete(e)}notifyStorageChanged(){this.transport.notifyStorageChanged()}checkDirectAccess(){return A(()=>this.transport.checkDirectAccess(),Xe)}requestDirectAccess(){return A(()=>this.transport.requestDirectAccess(),Xe)}disableDirectAccess(){this.transport.disableDirectAccess()}sync(){let e=this.transport.currentToken();if(!e)return null;let t=e.collectionId;if(!e.authority){if(!e.grantId||!e.operations.includes("sync"))return null;let o=e.grantId;return{collectionId:t,replicaId:o,transport:{openSession:()=>this.transport.performOperation("sync",{action:"open_session"}),snapshot:(r,a)=>this.transport.performOperation("sync",{action:"snapshot",snapshot_id:r,...a?{page:a}:{}}),changes:(r,a=200)=>this.transport.performOperation("sync",{action:"changes",after:r,limit:a}),mutate:r=>this.transport.performOperation("sync",{action:"mutate",mutation:r})}}}let i=e.authority.replicaId;return{collectionId:t,replicaId:i,transport:{openSession:()=>this.transport.performAuthoritySyncRequest(t,i,"POST","sessions"),snapshot:(o,r)=>{let a=new URLSearchParams({snapshot_id:o});return r&&a.set("page",r),this.transport.performAuthoritySyncRequest(t,i,"GET",`snapshot?${a}`)},changes:(o,r=200)=>this.transport.performAuthoritySyncRequest(t,i,"GET",`changes?${new URLSearchParams({after:String(o),limit:String(r)})}`),mutate:o=>this.transport.performAuthoritySyncRequest(t,i,"POST","mutations",o)}}}registerNotifications(e){return A(()=>this.notifications.registerNotifications(e),fe)}registerNativeNotifications(e){return A(()=>this.notifications.registerNativeNotifications(e),fe)}unregisterNativeNotifications(){return A(()=>this.notifications.unregisterNativeNotifications(),fe)}unregisterNotifications(e){return A(()=>this.notifications.unregisterNotifications(e),fe)}forget(){let e=this.transport.currentToken();this.internals.removeToken(this.collectionId,e?.keyHandle,"not_authorized"),this.transport.notifyStorageChanged()}describe(){return this.collectionClient.describe()}changes(e={},t){return this.collectionClient.changes(e,t)}read(e){return this.collectionClient.read(e)}query(e={},t){return this.collectionClient.query(e,t)}queryPages(e={},t={}){return this.collectionClient.queryPages(e,t)}queryAll(e={},t={}){return this.collectionClient.queryAll(e,t)}listViews(){return this.collectionClient.listViews()}executeView(e){return this.collectionClient.executeView(e)}readViewSource(e){return this.collectionClient.readViewSource(e)}createViewSource(e){return this.collectionClient.createViewSource(e)}updateViewSource(e){return this.collectionClient.updateViewSource(e)}deleteViewSource(e){return this.collectionClient.deleteViewSource(e)}create(e){return this.collectionClient.create(e)}update(e){return this.collectionClient.update(e)}delete(e,t){return this.collectionClient.delete(e,t)}preflightDelete(e,t){return this.collectionClient.preflightDelete(e,t)}rename(e,t){return this.collectionClient.rename(e,t)}preflightRename(e,t){return this.collectionClient.preflightRename(e,t)}async renameWithProgress(e,t={}){let i=Date.now(),o=this.pendingMutation()?.operation==="rename",r,a=(s,l,d=0)=>{t.onProgress?.({operation:"rename",state:s,elapsedMs:Date.now()-i,cancellable:l,resumed:o,completedUnits:d,...r?{estimate:r}:{}})};try{ne(t.signal),a("preflighting",!0);let s=t.preflight?E(t.preflight):await this.preflightRename(e,{signal:t.signal});if(!s.ok)return s;let l=s.value;try{Sn(e,l)}catch(u){if(u instanceof S)return T(u.problem);throw u}r=kn(e,l),a("ready",!0),ne(t.signal);let d=this.transport.hasResumableMutationTransport();a("applying",d);let p=await this.rename(e,d?{signal:t.signal}:void 0);return p.ok&&a("completed",!1,r.totalUnits),p}catch(s){if(Mt(s,t.signal)&&a("cancelled",!1),s instanceof S)return T(s.problem);throw s}}async deleteWithProgress(e,t={}){let i=Date.now(),o=this.pendingMutation()?.operation==="delete",r,a=(s,l,d=0)=>{t.onProgress?.({operation:"delete",state:s,elapsedMs:Date.now()-i,cancellable:l,resumed:o,completedUnits:d,...r?{estimate:r}:{}})};try{ne(t.signal),a("preflighting",!0);let s=t.preflight?E(t.preflight):await this.preflightDelete(e,{signal:t.signal});if(!s.ok)return s;let l=s.value;try{Rn(e,l)}catch(u){if(u instanceof S)return T(u.problem);throw u}r=An(l),a("ready",!0),ne(t.signal);let d=this.transport.hasResumableMutationTransport();a("applying",d);let p=await this.delete(e,d?{signal:t.signal}:void 0);return p.ok&&a("completed",!1,r.totalUnits),p}catch(s){if(Mt(s,t.signal)&&a("cancelled",!1),s instanceof S)return T(s.problem);throw s}}pendingMutation(){return this.transport.pendingMutation()}resumePendingMutation(e,t){return A(()=>this.transport.resumePendingMutation(e,t),I)}validate(e={}){return this.collectionClient.validate(e)}readType(e){return this.collectionClient.readType(e)}createType(e){return this.collectionClient.createType(e)}updateType(e){return this.collectionClient.updateType(e)}installTypePack(e){return this.collectionClient.installTypePack(e)}listTimers(e){return this.collectionClient.listTimers(e)}putTimer(e){return this.collectionClient.putTimer(e)}cancelTimer(e){return this.collectionClient.cancelTimer(e)}reconcileTimers(e){return this.collectionClient.reconcileTimers(e)}watch(e={}){return this.collectionClient.watch(e)}operation(e,t,i){return this.collectionClient.operation(e,t,i)}emitConnection(){let e=this.info();for(let t of this.connectionListeners)t(e)}};async function Nt(n,e,t,i,o){if(!n||typeof n!="object"||Array.isArray(n))throw c("invalid_first_contact","The authorization service returned an invalid first-contact challenge.");let r=n,a=await Y(t);if(r.application_id!==e.id||r.application_installation_id!==a||r.application_agreement_public_key!==t.agreementPublicKey||r.application_signing_public_key!==t.signingPublicKey)throw c("invalid_first_contact","The first-contact challenge does not match this application installation.");let s=JSON.stringify(r);if(s===o)return o;if(!i.onFirstContact)throw c("first_contact_handler_required","Local access requires the application to display a first-contact comparison code.");let l;try{l=await Je(r,"application",t)}catch(d){throw c("invalid_first_contact","The authorization service returned an invalid first-contact challenge.",{cause:d})}return await i.onFirstContact({binding:r,authenticationString:l,applicationId:r.application_id,connectorId:r.connector_id}),s}async function qt(n,e,t){let i=`application-installation:${e}:${t.id}`,o=await n.get(i);if(o)return o;try{return await n.create(i)}catch(r){let a=await n.get(i);if(a)return a;throw r}}var lt=class{serverUrl;manifest;manifestSource;redirectUri;storage;relayEncryption;keyStore;directAccessMode;loopbackUrl;navigate;credentialStorage;application=null;completionPromises=new Map;connectionCache=new Map;listeners=new Set;invalidatedConnections=new Map;constructor(e){this.serverUrl=Mn(e.serverUrl),this.manifest=e.manifest??Un(),this.manifestSource=typeof this.manifest=="string"?this.manifest:this.manifest.distribution==="portable"?`bundle:${this.manifest.id}:${Nn(this.manifest)}`:`bundle:${this.manifest.id}`;let t=Ln(this.manifest);this.redirectUri=e.redirectUri??(typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"":zn()),this.storage=e.storage??Dn(t),this.relayEncryption=e.relayEncryption??"required",this.keyStore=e.keyStore??(t?new le:new ce),this.credentialStorage=e.storage||e.keyStore?"custom":this.storage instanceof _e?"memory":"persistent",this.directAccessMode=e.directAccess??"auto",this.loopbackUrl=Tn(e.loopbackUrl??`http://127.0.0.1:${tn}`),this.navigate=e.navigate,typeof window<"u"&&this.storage===window.localStorage&&window.addEventListener("storage",i=>{i.storageArea!==this.storage||!i.key?.startsWith(this.storagePrefix())||(this.connectionCache.get(Eo(i.key))?.notifyStorageChanged(),this.emitConnections())})}environment(){let e=typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"portable":this.application?.distribution??"web";return{distribution:e,applicationOrigin:e==="portable"?"null":this.defaultApplicationOrigin(),credentialStorage:this.credentialStorage}}async register(){if(this.application)return this.application;let e=await $(`${this.serverUrl}/v1/apps/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({manifest:await this.loadManifest()})},"temporarily_unavailable","Application registration is temporarily unavailable."),t=await e.json();if(!e.ok)throw R(t,"discovery_failed","Application discovery failed.",e.status);return this.application=t.application,this.application}async loadManifest(){if(typeof this.manifest!="string")return this.manifest;let e=this.manifest,t;try{t=await fetch(e,{headers:{accept:"application/json"}})}catch(i){throw c("manifest_load_failed","The bundled application declaration could not be loaded.",{cause:i})}if(!t.ok)throw c("manifest_load_failed",`The bundled application declaration returned HTTP ${t.status}.`,{status:t.status});try{return await t.json()}catch(i){throw c("invalid_application_manifest","The bundled application declaration is not valid JSON.",{cause:i})}}async authorize(e={}){if(typeof location>"u"&&!this.navigate&&!e.openVerification)throw c("browser_required","Authorization navigation requires a browser environment.");let i=!(typeof this.manifest!="string"&&this.manifest.distribution==="portable"&&e.openVerification)&&!this.navigate&&typeof window<"u"?window.open("","mdbase-connect-authorization","popup,width=620,height=760"):null,o;try{o=await this.register()}catch(r){throw i?.close(),r}return o.distribution==="portable"?(e.openVerification&&i?.close(),this.authorizePortable(o,e,e.openVerification?null:i)):this.authorizeWeb(o,e,i)}async authorizeWeb(e,t,i){let{verifier:o,challenge:r}=await Ue(),a=N(24),s=crypto.randomUUID(),l=t.target?.kind==="collection"?t.target.collectionId:void 0,d=`grant:${e.id}:${a}`,p=await this.keyStore.create(d),u=await qt(this.keyStore,this.serverUrl,e),y=B(t.operations??oe),h=new Date,_=await Te({protocol_version:Re,authorization_id:s,application_id:e.id,application_manifest_digest:e.manifest_digest,application_installation_id:await Y(u),installation_agreement_public_key:u.agreementPublicKey,installation_signing_public_key:u.signingPublicKey,grant_agreement_public_key:p.agreementPublicKey,grant_signing_public_key:p.signingPublicKey,flow:"authorization_code",authorization_nonce:N(32),issued_at:h.toISOString(),expires_at:new Date(h.getTime()+600*1e3).toISOString(),redirect_uri:this.redirectUri,state:a,code_challenge:r,requested_operations:y,...e.requirements?.files?{requested_files:e.requirements.files}:{},...l?{collection_id:l}:{}},u),f={version:1,verifier:o,state:a,clientId:e.id,redirectUri:this.redirectUri,relayEncryption:this.relayEncryption,collectionId:l,returnTo:t.returnTo,keyHandle:d,installationKeyHandle:u.handle,authorizationId:s,applicationAgreementPublicKey:p.agreementPublicKey,applicationSigningPublicKey:p.signingPublicKey};this.storage.setItem(this.pendingKey(a),JSON.stringify(f));try{let v=await fetch(`${this.serverUrl}/oauth/authorization_request`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,redirect_uri:this.redirectUri,code_challenge:r,code_challenge_method:"S256",state:a,operations:y.join(","),...l?{collection_id:l}:{},application_authorization:JSON.stringify(_)}),signal:t.signal}),m=await v.json();if(!v.ok)throw R(m,"device_authorization_failed","Application authorization could not be started.",v.status);if(typeof m.authorization_uri!="string"||m.authorization_id!==s||!Number.isInteger(m.expires_in)||!Number.isInteger(m.interval)||m.expires_in<=0||m.interval<=0)throw c("invalid_device_authorization_response","The authorization service returned an invalid polling response.");if(this.navigate)await this.navigate(m.authorization_uri);else if(i)i.location.href=m.authorization_uri;else throw c("browser_required","The approval window was blocked. Allow popups for this application and try again.");let P=Date.now()+m.expires_in*1e3,g=m.interval,k="";for(;Date.now()<P;){if(await he(g*1e3,t.signal),t.signal?.aborted)throw c("authorization_cancelled","Application authorization was cancelled.");let x;try{x=await fetch(`${this.serverUrl}/oauth/authorization_status`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,authorization_id:s,code_verifier:o}),signal:t.signal})}catch(j){if(t.signal?.aborted)throw c("authorization_cancelled","Application authorization was cancelled.",{cause:j});continue}let w=await x.json();if(!x.ok){let j=ge(w);if(j==="authorization_pending"){w.first_contact&&(k=await Nt(w.first_contact,e,u,t,k));continue}if(j==="slow_down"){g+=2;continue}throw R(w,"token_exchange_failed","Application authorization could not be completed.",x.status)}if(typeof w.authorization_redirect!="string")throw c("invalid_token_response","The authorization service returned an invalid completion response.");let F=await this.performAuthorizationCompletion(w.authorization_redirect,a);return i?.close(),{kind:"connected",...F}}throw c("expired_token","The application authorization expired.")}catch(v){throw i?.close(),this.storage.removeItem(this.pendingKey(a)),await this.keyStore.delete(d),t.signal?.aborted?c("authorization_cancelled","Application authorization was cancelled.",{cause:v}):v}}async authorizePortable(e,t,i){if(this.relayEncryption!=="required")throw i?.close(),c("encryption_required","Downloaded applications require encrypted relay authorization.");let{verifier:o,challenge:r}=await Ue(),a=`grant:${e.id}:${N(24)}`,s=await this.keyStore.create(a),l=await qt(this.keyStore,this.serverUrl,e),d=B(t.operations??oe),p=crypto.randomUUID(),u=new Date,y=await Te({protocol_version:Re,authorization_id:p,application_id:e.id,application_manifest_digest:e.manifest_digest,application_installation_id:await Y(l),installation_agreement_public_key:l.agreementPublicKey,installation_signing_public_key:l.signingPublicKey,grant_agreement_public_key:s.agreementPublicKey,grant_signing_public_key:s.signingPublicKey,flow:"device_code",authorization_nonce:N(32),issued_at:u.toISOString(),expires_at:new Date(u.getTime()+600*1e3).toISOString(),code_challenge:r,requested_operations:d,...e.requirements?.files?{requested_files:e.requirements.files}:{},...t.target?.kind==="collection"?{collection_id:t.target.collectionId}:{}},l),h,_;try{h=await fetch(`${this.serverUrl}/oauth/device_authorization`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,operations:d.join(","),...t.target?.kind==="collection"?{collection_id:t.target.collectionId}:{},code_challenge:r,code_challenge_method:"S256",application_authorization:JSON.stringify(y)})}),_=await h.json()}catch(P){throw i?.close(),await this.keyStore.delete(a),c("device_authorization_failed","Downloaded application authorization could not be started.",{cause:P})}if(!h.ok)throw i?.close(),await this.keyStore.delete(a),R(_,"device_authorization_failed","Downloaded application authorization could not be started.",h.status);let f;try{f=xn(_)}catch(P){throw i?.close(),await this.keyStore.delete(a),t.signal?.aborted?c("authorization_cancelled","Downloaded application authorization was cancelled.",{cause:P}):P}if(t.onDeviceCode?.(f),t.openVerification)await t.openVerification(f);else if(i)try{i.location.href=f.verificationUriComplete}catch{}else throw await this.keyStore.delete(a),c("approval_window_blocked","The approval window was blocked. Show the provided verification link and code, then try again.",{details:{user_code:f.userCode,verification_uri:f.verificationUri,verification_uri_complete:f.verificationUriComplete,expires_at:f.expiresAt,interval_seconds:f.intervalSeconds}});let v=f.intervalSeconds,m="";try{for(;Date.now()<f.expiresAt;){if(await he(v*1e3,t.signal),t.signal?.aborted)throw c("authorization_cancelled","Downloaded application authorization was cancelled.");let P;try{P=await fetch(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:_.device_code,client_id:e.id,code_verifier:o}),signal:t.signal})}catch(F){if(t.signal?.aborted)throw c("authorization_cancelled","Downloaded application authorization was cancelled.",{cause:F});continue}let g=await P.json();if(!P.ok){let F=ge(g);if(F==="authorization_pending"){g.first_contact&&(m=await Nt(g.first_contact,e,l,t,m));continue}if(F==="slow_down"){v+=5;continue}throw R(g,"token_exchange_failed","Downloaded application authorization could not be completed.",P.status)}let k=Ze(g.authority,g.collection_id),x=g.encryption&&g.encryption.protocol_version===se&&g.encryption.suite===ke&&g.encryption.application_agreement_public_key===s.agreementPublicKey;if(g.application_origin!=="null")throw c("invalid_token_response","Authorization did not bind the portable grant to its opaque application origin.");if(g.authority&&(!k||g.encryption!=null||g.authority.proof_public_key!==s.signingPublicKey))throw c("invalid_token_response","Authorization returned a remote authority capability that is not bound to this portable grant key.");if(!g.authority&&!x)throw c("encryption_required","Authorization did not establish the expected key-bound local portable grant.");let w=this.storeTokenResponse(g,e.id,a);if(t.target?.kind==="collection"&&t.target.collectionId!==w.collectionId)throw this.removeToken(w.collectionId,w.keyHandle),c("collection_mismatch","The approved collection does not match the collection requested by this link.");return i?.close(),{kind:"connected",connection:this.connection(w.collectionId),...t.returnTo?{returnTo:t.returnTo}:{}}}throw c("expired_token","The downloaded application authorization code expired.")}catch(P){throw i?.close(),await this.keyStore.delete(a),t.signal?.aborted?c("authorization_cancelled","Downloaded application authorization was cancelled.",{cause:P}):P}}completeAuthorization(e){let t=new URL(e).searchParams.get("state");if(!t)return Promise.reject(c("invalid_callback","Authorization callback is missing its state."));let i=this.completionPromises.get(t);if(i)return i;let r=this.performAuthorizationCompletion(e,t).finally(()=>{this.completionPromises.get(t)===r&&this.completionPromises.delete(t)});return this.completionPromises.set(t,r),r}async performAuthorizationCompletion(e,t){let i=new URL(e),o=i.searchParams.get("code"),r=this.pendingKey(t),a=M(this.storage.getItem(r));if(!a||a.version!==1||t!==a.state)throw c("invalid_callback","Authorization callback is missing or does not match this browser session.");if(i.searchParams.has("error"))throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),D(i.searchParams.get("error")??"access_denied",i.searchParams.get("error_description")??"Collection access was not approved.",{details:a.returnTo?{return_to:a.returnTo}:void 0});if(!o)throw c("invalid_callback","Authorization callback is missing its code.");let s=await $(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:o,client_id:a.clientId,redirect_uri:a.redirectUri,code_verifier:a.verifier})},"temporarily_unavailable","Authorization completion is temporarily unavailable."),l=await s.json();if(!s.ok)throw R(l,"token_exchange_failed","Authorization could not be completed.",s.status);if(a.relayEncryption==="required"&&!l.authority&&(!l.encryption||!a.keyHandle||l.encryption.application_agreement_public_key!==a.applicationAgreementPublicKey))throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),c("encryption_required","Authorization did not establish the required encrypted relay grant.");if(l.authority?.proof_public_key){if(!a.keyHandle||!a.applicationSigningPublicKey||l.authority.proof_public_key!==a.applicationSigningPublicKey)throw a.keyHandle&&await this.keyStore.delete(a.keyHandle),this.storage.removeItem(r),c("invalid_token_response","Authorization returned a remote authority capability bound to another application key.")}else l.authority&&a.keyHandle&&await this.keyStore.delete(a.keyHandle);let d=this.storeTokenResponse(l,a.clientId,l.authority?.proof_public_key?a.keyHandle:l.authority?void 0:a.keyHandle);if(a.collectionId&&a.collectionId!==d.collectionId)throw this.removeToken(d.collectionId,d.keyHandle),this.storage.removeItem(r),c("collection_mismatch","The approved collection does not match the collection requested by this link.");return this.storage.removeItem(r),{connection:this.connection(d.collectionId),...a.returnTo?{returnTo:a.returnTo}:{}}}connections(){let e=[];for(let t of this.connectionIds()){let i=this.connection(t)?.info();i&&e.push(i)}return e.sort((t,i)=>t.displayName.localeCompare(i.displayName)||t.collectionId.localeCompare(i.collectionId))}connection(e){if(!this.storage.getItem(this.tokenKey(e)))return null;let t=this.connectionCache.get(e);return t||(t=new De(this,e),this.connectionCache.set(e,t)),t.info()?t:null}unavailableReason(e){return this.invalidatedConnections.get(e)??null}onConnectionsChange(e){return this.listeners.add(e),e(this.connections()),()=>this.listeners.delete(e)}storeTokenResponse(e,t,i){let o=e.collection_id;if(typeof o!="string")throw c("invalid_token_response","Authorization returned no collection ID.");let r=tt(e.scope);if(!r)throw c("invalid_token_response","Authorization returned no valid collection scope.");if(e.authority&&!Ze(e.authority,o))throw c("invalid_token_response","Authorization returned an invalid remote authority capability.");if(e.authority&&e.encryption)throw c("invalid_token_response","Authorization returned conflicting collection transports.");if(e.file_capability!==null&&e.file_capability!==void 0&&!et(e.file_capability))throw c("invalid_token_response","Authorization returned an invalid file capability.");if(e.encryption){try{W(e.encryption)}catch{throw c("invalid_token_response","Authorization returned an invalid encrypted relay binding.")}if(e.encryption.collection_id!==o||typeof e.grant_id!="string"||e.grant_id.length===0)throw c("invalid_token_response","Authorization returned an encrypted relay binding for another grant.")}let a=M(this.storage.getItem(this.tokenKey(o)));if(a?.encryption&&e.encryption&&a.keyHandle&&a.keyHandle===i&&(a.grantId!==e.grant_id||a.encryption.connector_id!==e.encryption.connector_id||a.encryption.connector_agreement_public_key!==e.encryption.connector_agreement_public_key||a.encryption.application_agreement_public_key!==e.encryption.application_agreement_public_key))throw c("connector_identity_changed","The connector identity changed during authorization renewal. Reauthorize before sending collection data.");a?.keyHandle&&a.keyHandle!==i&&this.keyStore.delete(a.keyHandle).catch(()=>{});let s={version:1,accessToken:e.access_token,refreshToken:e.refresh_token,clientId:t,collectionId:o,collectionName:e.collection_name??`Collection ${o.slice(0,8)}`,operations:e.operations,scope:r,expiresAt:Date.now()+e.expires_in*1e3,refreshExpiresAt:e.refresh_expires_in?Date.now()+e.refresh_expires_in*1e3:void 0,grantId:e.grant_id,encryption:e.encryption??void 0,fileCapability:e.file_capability??void 0,applicationOrigin:e.application_origin??this.defaultApplicationOrigin(),keyHandle:i,savedAt:Date.now(),authority:e.authority?{operationsUrl:e.authority.operations_url,syncUrl:e.authority.sync_url,filesUrl:e.authority.files_url,replicaId:e.authority.replica_id,accessToken:e.authority.access_token,proofPublicKey:e.authority.proof_public_key}:void 0};return this.storage.setItem(this.tokenKey(o),JSON.stringify(s)),this.addConnectionId(o),this.invalidatedConnections.delete(o),this.connectionCache.delete(o),this.emitConnections(),s}removeToken(e,t,i="authorization_lost"){this.invalidatedConnections.set(e,i),t&&this.keyStore.delete(t).catch(()=>{}),this.storage.removeItem(this.tokenKey(e)),this.storage.removeItem(this.pendingMutationKey(e));for(let o of["web_push","fcm"])this.storage.removeItem(this.notificationKey(e,o));this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:this.connectionIds().filter(o=>o!==e)})),this.connectionCache.delete(e),this.emitConnections()}tokenKey(e){return`${this.storagePrefix()}:token:${e}`}pendingMutationKey(e){return`${this.storagePrefix()}:pending-mutation:${e}`}notificationKey(e,t="web_push"){return`${this.storagePrefix()}:notifications:${e}:${t}`}directPreferenceKey(){return`mdbase-connect:direct:${this.defaultApplicationOrigin()}`}defaultApplicationOrigin(){if(typeof this.manifest!="string"&&this.manifest.distribution==="portable"||this.application?.distribution==="portable")return"null";let e=new URL(this.redirectUri);if(["http:","https:"].includes(e.protocol))return e.origin;if(typeof location<"u")return location.origin;if(this.manifest&&typeof this.manifest!="string")return new URL(this.manifest.homepage).origin;try{return new URL(this.manifestSource).origin}catch{return""}}pendingKey(e){return`${this.storagePrefix()}:pending:${e}`}storagePrefix(){return`mdbase-connect:${this.serverUrl}:${this.manifestSource}`}connectionsKey(){return`${this.storagePrefix()}:connections`}connectionIds(){let e=M(this.storage.getItem(this.connectionsKey()));return e?.version===1&&Array.isArray(e.collectionIds)&&e.collectionIds.every(t=>typeof t=="string")?e.collectionIds:[]}addConnectionId(e){this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:[...new Set([...this.connectionIds(),e])]}))}emitConnections(){let e=this.connections();for(let t of this.listeners)t(e)}};function Eo(n){let e=":token:",t=n.lastIndexOf(e);return t<0?"":n.slice(t+e.length)}function Le(n){for(let e of["code","state","error","error_description"])n.searchParams.delete(e);return n}function dt(n){let e;try{e=new URL(n)}catch{return!1}return e.searchParams.has("state")&&(e.searchParams.has("code")||e.searchParams.has("error"))}function ei(n){if(!n.details||typeof n.details!="object"||Array.isArray(n.details))return;let e=n.details.return_to;return typeof e=="string"?e:void 0}var Ne=class{constructor(e,t){this.connect=e;this.operations=B(t.operations??oe),this.selection=t.selection,this.autoSelect=t.autoSelect??"only",this.snapshot={status:"unselected",connections:[]},this.refresh()}connect;operations;selection;autoSelect;listeners=new Set;snapshot;snapshotKey="";stopConnections;stopSelection;stopActiveConnection;activeCollectionId=null;unavailableReason="not_authorized";started=!1;refreshing=!1;refreshQueued=!1;transactionDepth=0;callbackPromise=null;async start(){this.started||(this.started=!0,this.stopConnections=this.connect.onConnectionsChange(()=>this.refresh()),this.stopSelection=this.selection.subscribe(()=>{this.unavailableReason="not_authorized",this.refresh()}));let e=this.selection.authorizationCallback();if(e){let t=await this.handleAuthorizationCallback(e);if(!t.ok)return t}else this.autoSelectOnlyConnection();return this.refresh(),E(this.snapshot)}destroy(){this.stopConnections?.(),this.stopSelection?.(),this.stopActiveConnection?.(),this.stopConnections=void 0,this.stopSelection=void 0,this.stopActiveConnection=void 0,this.activeCollectionId=null,this.started=!1}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}select(e,t={}){let i=this.connect.connection(e);return i?(this.unavailableReason="not_authorized",this.selection.select(e,t),this.refresh(),E(i)):T(z("unknown_collection","This collection is not authorized for this application."))}clearSelection(e={}){this.unavailableReason="not_authorized",this.selection.select(null,e),this.refresh()}forget(e){this.transactionDepth+=1;try{let t=this.selection.selectedCollectionId()===e;this.connect.connection(e)?.forget(),t&&this.selection.select(null,{history:"replace"})}finally{this.transactionDepth-=1,this.refresh()}}async authorize(e,t={}){let i=this.selection.selectedCollectionId();if(e==="selected"&&!i)return T(z("collection_not_selected","Choose a collection before updating its access."));let o=typeof e=="object"?e.collectionId:e==="selected"?i:null;this.transactionDepth+=1;try{let r=await this.connect.authorize({...t,operations:this.operations,target:o===null?{kind:"choose"}:{kind:"collection",collectionId:o},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}async ensureOperations(e){let t=this.snapshot;if(t.status!=="ready")return T(z("collection_not_ready","Choose an authorized collection first."));let i=B(e),o=t.connection.authorizationCapabilities(i);if(o.sufficient)return E({kind:"unchanged",connection:t.connection});this.transactionDepth+=1;try{let r=await this.connect.authorize({operations:B([...o.grantedOperations,...o.missingOperations]),target:{kind:"collection",collectionId:t.collectionId},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}handleAuthorizationCallback(e){if(!dt(e))return Promise.resolve(T(z("invalid_callback","This URL is not an authorization callback.")));if(this.callbackPromise)return this.callbackPromise;this.transactionDepth+=1;let t=this.connect.completeAuthorization(e).then(i=>{if(!i.ok){let r=ei(i.problem);return this.selection.clearAuthorizationCallback(r),this.refresh(),i}let o=i.value;return this.unavailableReason="not_authorized",this.selection.finishAuthorization(o.returnTo,o.connection.collectionId),this.refresh(),E(o.connection,i.diagnostics)}).catch(i=>{throw this.selection.clearAuthorizationCallback(),this.refresh(),i}).finally(()=>{this.transactionDepth-=1,this.refresh(),this.callbackPromise===t&&(this.callbackPromise=null)});return this.callbackPromise=t,t}autoSelectOnlyConnection(){if(this.autoSelect!=="only"||this.selection.selectedCollectionId())return;let e=this.connect.connections();e.length===1&&this.selection.select(e[0].collectionId,{history:"replace"})}refresh(){if(this.transactionDepth>0){this.refreshQueued=!0;return}if(this.refreshing){this.refreshQueued=!0;return}this.refreshing=!0;try{do this.refreshQueued=!1,this.refreshOnce();while(this.refreshQueued)}finally{this.refreshing=!1}}refreshOnce(){let e=this.selection.selectedCollectionId(),t=this.connect.connections(),i=e?this.connect.connection(e):null;i?.collectionId!==this.activeCollectionId&&(this.stopActiveConnection?.(),this.activeCollectionId=i?.collectionId??null,this.stopActiveConnection=i?.onConnectionChange(a=>{!a&&this.selection.selectedCollectionId()===i.collectionId&&(this.unavailableReason="authorization_lost"),this.refresh()}));let o;if(!e)o={status:"unselected",connections:t};else if(!i||!i.info())o={status:"unavailable",collectionId:e,reason:this.connect.unavailableReason(e)??this.unavailableReason,connections:t};else{let a=i.info();o={status:"ready",collectionId:e,connection:i,info:a,access:i.authorizationCapabilities(this.operations),connections:t}}let r=xo(o);if(r!==this.snapshotKey){this.snapshot=o,this.snapshotKey=r;for(let a of this.listeners)a()}}};function xo(n){return n.status==="unselected"?JSON.stringify({status:n.status,connections:n.connections}):n.status==="unavailable"?JSON.stringify({status:n.status,collectionId:n.collectionId,reason:n.reason,connections:n.connections}):JSON.stringify({status:n.status,collectionId:n.collectionId,info:n.info,access:n.access,connections:n.connections})}var Bt=class{internals;constructor(e){this.internals=new lt(e)}register(){return A(()=>this.internals.register(),Z)}authorize(e={}){return A(()=>this.internals.authorize(e),ee)}createSession(e){return new Ne(this,e)}environment(){return this.internals.environment()}completeAuthorization(e){return A(()=>this.internals.completeAuthorization(e??Fn()),ee)}connections(){return this.internals.connections()}connection(e){return this.internals.connection(e)}unavailableReason(e){return this.internals.unavailableReason(e)}onConnectionsChange(e){return this.internals.onConnectionsChange(e)}forgetAll(){for(let e of this.connections())this.connection(e.collectionId)?.forget()}};function ti(n){if(!n||typeof n!="object")throw c("invalid_push_payload","The push payload is not an object.");let e=n;if(e.type!=="mdbase.notification"||e.version!==1||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string"||!e.presentation||typeof e.presentation.title!="string")throw c("invalid_push_payload","The push payload is not an mdbase notification.");return e}function Mo(n){if(!n||typeof n!="object")throw c("invalid_push_payload","The native notification data is not an object.");let e=n;if(e.type!=="mdbase.notification"||e.version!==1&&e.version!=="1"||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string")throw c("invalid_push_payload","The native notification data is not an mdbase notification.");return{type:"mdbase.notification",version:1,signal_id:e.signal_id,criterion_id:e.criterion_id,cursor:e.cursor}}function Uo(n,e){let t=ti(e);return n.showNotification(t.presentation.title,{...t.presentation.body?{body:t.presentation.body}:{},...t.presentation.tag?{tag:t.presentation.tag}:{},data:{type:t.type,signal_id:t.signal_id,criterion_id:t.criterion_id,cursor:t.cursor}})}var Kt=class{collectionParameter;fallbackPath;listeners=new Set;handlePopState=()=>this.emit();constructor(e={}){this.collectionParameter=e.collectionParameter??"collection",this.fallbackPath=e.fallbackPath??"/"}selectedCollectionId(){return this.currentUrl().searchParams.get(this.collectionParameter)}select(e,t={}){let i=Le(this.currentUrl());e?i.searchParams.set(this.collectionParameter,e):i.searchParams.delete(this.collectionParameter);let o=this.browserHistory();o[t.history==="push"?"pushState":"replaceState"](o.state,"",i),this.emit()}authorizationReturnTo(){let e=Le(this.currentUrl());return`${e.pathname}${e.search}${e.hash}`}authorizationCallback(){let e=this.currentUrl().href;return dt(e)?e:null}finishAuthorization(e,t){let i=this.safeAppUrl(e??this.fallbackPath);Le(i),i.searchParams.set(this.collectionParameter,t),this.browserHistory().replaceState(null,"",i),this.emit()}clearAuthorizationCallback(e){let t=e?this.safeAppUrl(e):this.currentUrl(),i=this.browserHistory();i.replaceState(i.state,"",Le(t)),this.emit()}subscribe(e){let t=this.listeners.size===0;return this.listeners.add(e),t&&typeof window<"u"&&window.addEventListener("popstate",this.handlePopState),()=>{this.listeners.delete(e),this.listeners.size===0&&typeof window<"u"&&window.removeEventListener("popstate",this.handlePopState)}}emit(){for(let e of this.listeners)e()}safeAppUrl(e){let t=this.currentUrl(),i=new URL(e,t.origin);return i.origin===t.origin?i:new URL(this.fallbackPath,t.origin)}currentUrl(){if(typeof location>"u")throw c("browser_required","Browser selection requires a browser environment.");return new URL(location.href)}browserHistory(){if(typeof history>"u")throw c("browser_required","Browser selection requires a browser environment.");return history}},jt=class{collectionId=null;listeners=new Set;selectedCollectionId(){return this.collectionId}select(e){if(e!==this.collectionId){this.collectionId=e;for(let t of this.listeners)t()}}authorizationReturnTo(){}authorizationCallback(){return null}finishAuthorization(e,t){this.select(t)}clearAuthorizationCallback(){}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}};return ci(zo);})();