@mdbase-dev/connect 0.1.0-beta.49 → 0.1.0-beta.50
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,3 +1,3 @@
|
|
|
1
1
|
"use strict";var MdbaseConnect=(()=>{var Ht=Object.defineProperty;var Po=Object.getOwnPropertyDescriptor;var Ao=Object.getOwnPropertyNames;var Oo=Object.prototype.hasOwnProperty;var To=(t,e)=>{for(var n in e)Ht(t,n,{get:e[n],enumerable:!0})},ko=(t,e,n,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of Ao(e))!Oo.call(t,o)&&o!==n&&Ht(t,o,{get:()=>e[o],enumerable:!(i=Po(e,o))||i.enumerable});return t};var Io=t=>ko(Ht({},"__esModule",{value:!0}),t);var wa={};To(wa,{ApplicationIdentityStoreError:()=>pe,FileTransferCryptoError:()=>Y,GrantFileTransferCipher:()=>Ie,IndexedDbApplicationIdentityStore:()=>Ae,IndexedDbGrantKeyStore:()=>_e,MDBASE_RECORD_CREATED_CONTRACT:()=>jn,MDBASE_TIMER_FIRED_CONTRACT:()=>Kn,MdbaseApplicationSession:()=>Re,MdbaseBrowserSelection:()=>Bt,MdbaseCollectionClient:()=>ke,MdbaseConnect:()=>Lt,MdbaseConnectError:()=>b,MdbaseConnection:()=>De,MdbaseFileClient:()=>Ee,MdbaseMemorySelection:()=>jt,MdbaseMemoryVerificationStore:()=>Ye,MdbaseSession:()=>Se,MemoryApplicationIdentityStore:()=>Oe,MemoryGrantKeyStore:()=>be,RelayCryptoError:()=>w,applicationIdentity:()=>wt,applicationInstallationId:()=>Te,authorityProofMessage:()=>on,connectError:()=>l,connectFailure:()=>P,connectProblem:()=>T,connectSuccess:()=>k,createPkce:()=>Ve,decryptRelayResponse:()=>ve,deriveFileTransferKey:()=>fn,deriveP256SharedSecret:()=>He,effectiveCapabilities:()=>ut,encryptRelayRequest:()=>ce,externalStore:()=>So,isRetryableConnectError:()=>Gn,operationProblem:()=>ye,operationsForApplicationCapabilities:()=>at,parseMdbaseNativeNotificationData:()=>Co,parseMdbasePushPayload:()=>Sn,showMdbasePushNotification:()=>wo,signApplicationAuthorization:()=>Xe,signAuthorityRequest:()=>mt,validateGrantEncryption:()=>W});var oe={access_denied:{category:"authorization",recovery:"reauthorize"},access_paused:{category:"availability",recovery:"resume_connector_access"},application_identity_unavailable:{category:"compatibility",recovery:"upgrade_application"},approval_window_blocked:{category:"authorization",recovery:"reauthorize"},authority_authorization_changed:{category:"authorization",recovery:"reauthorize"},authorization_binding_incompatible:{category:"compatibility",recovery:"upgrade_application"},authorization_cancelled:{category:"cancellation",recovery:"none"},authorization_expired:{category:"authorization",recovery:"reauthorize"},authorization_replayed:{category:"integrity",recovery:"reauthorize"},browser_required:{category:"compatibility",recovery:"none"},callback_url_required:{category:"validation",recovery:"fix_request"},capability_contract_incompatible:{category:"compatibility",recovery:"upgrade_application"},change_cursor_reset:{category:"conflict",recovery:"refresh"},collection_access_denied:{category:"authorization",recovery:"reauthorize"},collection_configuration_invalid:{category:"validation",recovery:"repair_collection"},collection_contracts_missing:{category:"compatibility",recovery:"choose_collection"},collection_incompatible:{category:"compatibility",recovery:"choose_collection"},collection_invalid:{category:"validation",recovery:"repair_collection"},collection_kind_unsupported:{category:"compatibility",recovery:"choose_collection"},collection_mismatch:{category:"selection",recovery:"choose_collection"},collection_not_found:{category:"selection",recovery:"choose_collection"},collection_not_ready:{category:"selection",recovery:"choose_collection"},collection_not_selected:{category:"selection",recovery:"choose_collection"},collection_type_registry_invalid:{category:"validation",recovery:"repair_collection"},collection_version_unsupported:{category:"compatibility",recovery:"upgrade_collection"},concurrent_modification:{category:"conflict",recovery:"refresh"},connector_identity_changed:{category:"integrity",recovery:"reauthorize"},connector_offline:{category:"availability",recovery:"retry"},connector_upgrade_required:{category:"compatibility",recovery:"upgrade_connector"},device_authorization_failed:{category:"authorization",recovery:"reauthorize"},direct_operation_rejected:{category:"authorization",recovery:"reauthorize"},discovery_failed:{category:"availability",recovery:"retry"},durable_mutation_unsupported:{category:"compatibility",recovery:"upgrade_connector"},encrypted_relay_rejected:{category:"authorization",recovery:"reauthorize"},encryption_required:{category:"authorization",recovery:"reauthorize"},expired_token:{category:"authorization",recovery:"reauthorize"},file_changed_during_move:{category:"conflict",recovery:"refresh"},file_changed_during_read:{category:"conflict",recovery:"refresh"},file_move_failed:{category:"internal",recovery:"contact_support"},file_mutation_conflict:{category:"conflict",recovery:"resolve_conflict"},file_not_found:{category:"conflict",recovery:"refresh"},file_source_mismatch:{category:"conflict",recovery:"refresh"},file_upload_incomplete:{category:"conflict",recovery:"retry"},hosted_provider_unavailable:{category:"availability",recovery:"retry"},insufficient_access:{category:"authorization",recovery:"reauthorize"},invalid_application_authorization:{category:"validation",recovery:"fix_request"},invalid_application_manifest:{category:"validation",recovery:"fix_request"},invalid_callback:{category:"validation",recovery:"fix_request"},invalid_device_authorization_response:{category:"integrity",recovery:"contact_support"},invalid_encrypted_response:{category:"integrity",recovery:"contact_support"},invalid_loopback_url:{category:"validation",recovery:"fix_request"},invalid_mutation_id:{category:"validation",recovery:"fix_request"},invalid_operation_response:{category:"integrity",recovery:"contact_support"},invalid_path:{category:"validation",recovery:"fix_request"},invalid_preflight:{category:"conflict",recovery:"refresh"},invalid_push_payload:{category:"validation",recovery:"fix_request"},invalid_push_subscription:{category:"validation",recovery:"fix_request"},invalid_request:{category:"validation",recovery:"fix_request"},invalid_token_response:{category:"integrity",recovery:"contact_support"},managed_fcm_not_declared:{category:"compatibility",recovery:"fix_request"},manifest_load_failed:{category:"availability",recovery:"retry"},manifest_required:{category:"validation",recovery:"fix_request"},missing_grant_key:{category:"authorization",recovery:"reauthorize"},mutation_recovery_expired:{category:"compatibility",recovery:"none"},mutation_request_conflict:{category:"conflict",recovery:"resolve_conflict"},no_pending_mutation:{category:"conflict",recovery:"refresh"},not_authorized:{category:"authorization",recovery:"reauthorize"},not_remote_authority:{category:"compatibility",recovery:"choose_collection"},notification_criterion_not_declared:{category:"validation",recovery:"fix_request"},notification_reauthorization_required:{category:"authorization",recovery:"reauthorize"},notification_registration_failed:{category:"availability",recovery:"retry"},notification_unregistration_failed:{category:"availability",recovery:"retry"},notifications_not_declared:{category:"compatibility",recovery:"fix_request"},notifications_unavailable:{category:"availability",recovery:"retry"},operation_cancelled:{category:"cancellation",recovery:"none"},operation_failed:{category:"internal",recovery:"contact_support"},operation_invalid:{category:"validation",recovery:"fix_request"},operation_outcome_unknown:{category:"conflict",recovery:"resolve_outcome"},path_occupied:{category:"conflict",recovery:"resolve_conflict"},pending_mutation_unresolved:{category:"conflict",recovery:"resolve_outcome"},query_snapshot_changed:{category:"conflict",recovery:"refresh"},rate_limited:{category:"availability",recovery:"retry"},reconnect_required:{category:"authorization",recovery:"reauthorize"},redirect_uri_required:{category:"validation",recovery:"fix_request"},reference_updates_unsupported:{category:"compatibility",recovery:"fix_request"},registry_backup_invalid:{category:"integrity",recovery:"contact_support"},registry_busy:{category:"availability",recovery:"retry"},registry_corrupt:{category:"integrity",recovery:"repair_collection"},registry_migration_failed:{category:"internal",recovery:"contact_support"},registry_schema_incompatible:{category:"compatibility",recovery:"upgrade_connector"},relay_authorization_expired:{category:"authorization",recovery:"reauthorize"},relay_unavailable:{category:"availability",recovery:"retry"},sandbox_unsupported:{category:"compatibility",recovery:"fix_request"},scope_denied:{category:"authorization",recovery:"reauthorize"},stale_file_revision:{category:"conflict",recovery:"refresh"},storage_required:{category:"compatibility",recovery:"none"},sync_failed:{category:"availability",recovery:"retry"},temporarily_unavailable:{category:"availability",recovery:"retry"},timeout:{category:"availability",recovery:"retry"},token_exchange_failed:{category:"availability",recovery:"retry"},transport_protocol_incompatible:{category:"compatibility",recovery:"upgrade_connector"},type_pack_provision_failed:{category:"validation",recovery:"repair_collection"},unknown_collection:{category:"selection",recovery:"choose_collection"},unsafe_file_path:{category:"validation",recovery:"fix_request"},unsupported_encryption:{category:"compatibility",recovery:"upgrade_application"},unsupported_operation:{category:"compatibility",recovery:"fix_request"}},Mo={access_denied:{type:"object",required:[],properties:{return_to:{type:"string"}}},approval_window_blocked:{type:"object",required:["user_code","verification_uri","verification_uri_complete","expires_at","interval_seconds"],properties:{user_code:{type:"string"},verification_uri:{type:"string"},verification_uri_complete:{type:"string"},expires_at:{type:"integer"},interval_seconds:{type:"integer"}}},authorization_binding_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},capability_contract_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},collection_configuration_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_contracts_missing:{type:"object",required:["contracts"],properties:{contracts:{type:"array",items:{type:"object",required:["id","version"],properties:{id:{type:"string"},version:{type:"string"}}}}}},collection_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_type_registry_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_version_unsupported:{type:"object",required:["current_version","required_version"],properties:{current_version:{type:"string"},required_version:{type:"string"}}},connector_offline:{type:"object",required:[],properties:{connector_name:{type:"string"}}},durable_mutation_unsupported:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},insufficient_access:{type:"object",required:["required_operations","granted_operations","missing_operations"],properties:{required_operations:{type:"array",items:{type:"string"}},granted_operations:{type:"array",items:{type:"string"}},missing_operations:{type:"array",items:{type:"string"}}}},invalid_application_manifest:{type:"object",required:["issues"],properties:{issues:{type:"array",items:{type:"object",required:["path","keyword","message","params"],properties:{path:{type:"string"},keyword:{type:"string"},message:{type:"string"},params:{type:"object"}}}}}},mutation_request_conflict:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},operation_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}},partial_result:{}}},operation_outcome_unknown:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},rate_limited:{type:"object",required:[],properties:{retry_after_ms:{type:"integer"}}},transport_protocol_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}}};function Rn(t){return Object.hasOwn(oe,t)}function ze(t){if(!Pn(t))return!1;let e=t;if(e.problem_version!==1||typeof e.message!="string"||e.message.length===0||e.operation_outcome!==void 0&&e.operation_outcome!=="not_sent"&&e.operation_outcome!=="rejected"&&e.operation_outcome!=="unknown"||e.trace_id!==void 0&&(typeof e.trace_id!="string"||e.trace_id.length===0))return!1;if(e.code==="unknown")return typeof e.server_code=="string"&&e.server_code.length>0&&e.category==="unknown"&&e.recovery==="none";if(typeof e.code!="string"||!Rn(e.code)||e.server_code!==void 0)return!1;let n=oe[e.code],i=Mo[e.code],o=i===void 0?e.details===void 0:e.details===void 0?(i.required?.length??0)===0:$t(e.details,i);return e.category===n.category&&e.recovery===n.recovery&&o}function $t(t,e){if(e.type===void 0)return!0;if(e.type==="string")return typeof t=="string";if(e.type==="integer")return typeof t=="number"&&Number.isInteger(t);if(e.type==="number")return typeof t=="number"&&Number.isFinite(t);if(e.type==="boolean")return typeof t=="boolean";if(e.type==="array")return Array.isArray(t)&&t.every(i=>$t(i,e.items??{}));if(!Pn(t))return!1;if(!e.properties)return!0;let n=t;return!Object.keys(n).every(i=>Object.hasOwn(e.properties,i))||!(e.required??[]).every(i=>Object.hasOwn(n,i))?!1:Object.entries(n).every(([i,o])=>$t(o,e.properties[i]))}function Pn(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function Vt(t,e,n={}){if(Rn(t)){let i=oe[t],o={problem_version:1,code:t,category:i.category,recovery:i.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}};if(ze(o))return o}return{problem_version:1,code:"unknown",server_code:t,category:"unknown",recovery:"none",message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}}}var An=new Uint8Array([77,68,66,70]),On=1,Tn=0,Pa=new Uint8Array([77,68,66,82]);var kn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,C=class extends Error{code;constructor(e,n){super(n),this.code=e,this.name="FileFrameError"}};function xo(t){return t==="upload_chunk"?1:2}function Eo(t){if(t===1)return"upload_chunk";if(t===2)return"download_chunk";throw new C("invalid_kind",`Unknown file frame kind ${t}`)}function Do(t){if(!t||typeof t!="object"||Array.isArray(t))throw new C("invalid_header","File frame header must be a JSON object");return t}function nt(t,e){let n=t[e];if(typeof n!="string"||n.length===0)throw new C("invalid_header",`File frame header ${e} must be a non-empty string`);return n}function tt(t,e){let n=nt(t,e);if(!kn.test(n))throw new C("invalid_header",`File frame header ${e} must be a UUID`);return n}function re(t,e,n=Number.MAX_SAFE_INTEGER){let i=t[e];if(!Number.isSafeInteger(i)||i<0||i>n)throw new C("invalid_header",`File frame header ${e} is outside its allowed range`);return i}function Gt(t){if(t.protocol_version!==1)throw new C("unsupported_version",`Unsupported file transfer protocol ${t.protocol_version}`);if(t.protection!=="grant_aead_v1"&&t.protection!=="transport_tls")throw new C("invalid_header","Unknown file transfer protection");if(t.direction!=="upload"&&t.direction!=="download")throw new C("invalid_header","Unknown file transfer direction");for(let[e,n]of[["grant_id",t.grant_id],["authority_id",t.authority_id],["collection_id",t.collection_id],["transfer_id",t.transfer_id]])if(!kn.test(n))throw new C("invalid_header",`File frame header ${e} must be a UUID`);for(let[e,n,i]of[["chunk_size",t.chunk_size,4194304],["chunk_index",t.chunk_index,Number.MAX_SAFE_INTEGER],["offset",t.offset,Number.MAX_SAFE_INTEGER],["plaintext_length",t.plaintext_length,4194304],["total_size",t.total_size,Number.MAX_SAFE_INTEGER]])if(!Number.isSafeInteger(n)||n<0||n>i)throw new C("invalid_header",`File frame header ${e} is outside its allowed range`);if(t.chunk_size<64*1024)throw new C("invalid_header","File frame chunk_size is below the protocol minimum");if(!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<1)throw new C("invalid_header","File frame header scope_epoch must be a positive integer");if(t.protection==="grant_aead_v1"&&!t.key_id)throw new C("invalid_header","AEAD-protected file frames require key_id");return{protocol_version:1,protection:t.protection,grant_id:t.grant_id,authority_id:t.authority_id,collection_id:t.collection_id,transfer_id:t.transfer_id,direction:t.direction,chunk_size:t.chunk_size,chunk_index:t.chunk_index,offset:t.offset,plaintext_length:t.plaintext_length,total_size:t.total_size,scope_epoch:t.scope_epoch,...t.key_id===void 0?{}:{key_id:t.key_id}}}function qo(t){let e;try{e=new TextDecoder("utf-8",{fatal:!0}).decode(t)}catch{throw new C("invalid_header","File frame header is not valid UTF-8")}let n;try{n=Do(JSON.parse(e))}catch(d){throw d instanceof C?d:new C("invalid_header","File frame header is not valid JSON")}let i=new Set(["protocol_version","protection","grant_id","authority_id","collection_id","transfer_id","direction","chunk_size","chunk_index","offset","plaintext_length","total_size","scope_epoch","key_id"]);if(Object.keys(n).some(d=>!i.has(d)))throw new C("invalid_header","File frame header contains an unknown field");let o=re(n,"protocol_version");if(o!==1)throw new C("unsupported_version",`Unsupported file transfer protocol ${o}`);let r=nt(n,"protection"),a=nt(n,"direction"),s=n.key_id===void 0?void 0:nt(n,"key_id"),c=Gt({protocol_version:1,protection:r,grant_id:tt(n,"grant_id"),authority_id:tt(n,"authority_id"),collection_id:tt(n,"collection_id"),transfer_id:tt(n,"transfer_id"),direction:a,chunk_size:re(n,"chunk_size",4194304),chunk_index:re(n,"chunk_index"),offset:re(n,"offset"),plaintext_length:re(n,"plaintext_length",4194304),total_size:re(n,"total_size"),scope_epoch:re(n,"scope_epoch"),...s===void 0?{}:{key_id:s}});if(JSON.stringify(c)!==e)throw new C("invalid_header","File frame header must use the canonical field order without duplicate fields or whitespace");return c}function Wt(t,e,n){let i=t==="upload_chunk"?"upload":"download";if(e.direction!==i)throw new C("invalid_header",`Frame kind ${t} requires direction ${i}`);let o=e.chunk_index*e.chunk_size;if(!Number.isSafeInteger(o)||e.offset!==o)throw new C("invalid_header","Chunk offset does not match its index and protocol chunk size");if(e.offset+e.plaintext_length>e.total_size)throw new C("invalid_header","Chunk extends past the declared transfer size");let r=e.protection==="grant_aead_v1"?e.plaintext_length+16:e.plaintext_length;if(n!==r)throw new C("invalid_length","Payload length does not match the protected plaintext length")}function Fo(t){return t.plaintext_length+(t.protection==="grant_aead_v1"?16:0)}function it(t,e){let n=Gt(e),i=Fo(n);Wt(t,n,i);let o=new TextEncoder().encode(JSON.stringify(n));if(o.byteLength>16384)throw new C("limit_exceeded","File frame header exceeds the protocol limit");let r=new Uint8Array(16+o.byteLength);r.set(An,0);let a=new DataView(r.buffer,r.byteOffset,r.byteLength);return a.setUint8(4,On),a.setUint8(5,xo(t)),a.setUint16(6,Tn,!1),a.setUint32(8,o.byteLength,!1),a.setUint32(12,i,!1),r.set(o,16),r}function In(t){let e=Gt(t.header);if(Wt(t.kind,e,t.payload.byteLength),t.payload.byteLength>4194320)throw new C("limit_exceeded","File frame payload exceeds the protocol limit");let n=it(t.kind,e),i=new Uint8Array(n.byteLength+t.payload.byteLength);return i.set(n,0),i.set(t.payload,n.byteLength),i}function ot(t,e={}){if(t.byteLength<16)throw new C("invalid_length","File frame is shorter than its fixed prefix");if(!An.every((f,h)=>t[h]===f))throw new C("invalid_magic","File frame magic is not MDBF");let n=new DataView(t.buffer,t.byteOffset,t.byteLength),i=n.getUint8(4);if(i!==On)throw new C("unsupported_version",`Unsupported file frame version ${i}`);let o=Eo(n.getUint8(5));if(n.getUint16(6,!1)!==Tn)throw new C("unsupported_flags","File frame uses unsupported flags");let r=n.getUint32(8,!1),a=n.getUint32(12,!1),s=e.maxHeaderBytes??16384,c=e.maxPayloadBytes??4194320;if(r===0)throw new C("invalid_length","File frame header must not be empty");if(r>s||a>c)throw new C("limit_exceeded","File frame exceeds the configured decode limits");let d=16+r+a;if(!Number.isSafeInteger(d)||d!==t.byteLength)throw new C("invalid_length","File frame lengths do not match the supplied bytes");let p=16+r,u=qo(t.subarray(16,p));return Wt(o,u,a),{kind:o,header:u,payload:t.slice(p)}}var zo=["describe","changes","read","query","list_views","execute_view","read_view_source","create_view_source","update_view_source","delete_view_source","validate","create","update","delete","rename","read_type","create_type","update_type","assess_type_pack","apply_type_pack","assess_collection_setup","apply_collection_setup","list_timers","put_timer","cancel_timer","reconcile_timers","sync"],Uo=["list_files","open_file_upload","open_file_download","move_file","delete_file","get_file_transfer_status","commit_file_upload","abort_file_transfer"],No={describe:"never",changes:"never",read:"never",query:"never",list_views:"never",execute_view:"never",read_view_source:"never",create_view_source:"always",update_view_source:"always",delete_view_source:"always",validate:"never",create:"always",update:"always",delete:"always",rename:"always",read_type:"never",create_type:"always",update_type:"always",assess_type_pack:"never",apply_type_pack:"always",assess_collection_setup:"never",apply_collection_setup:"always",list_timers:"never",put_timer:"always",cancel_timer:"always",reconcile_timers:"always",sync:"sync_action"},Lo={describe:1,changes:1,read:1,query:1,list_views:1,execute_view:1,read_view_source:1,create_view_source:1,update_view_source:1,delete_view_source:1,validate:1,create:1,update:1,delete:1,rename:1,read_type:1,create_type:1,update_type:1,assess_type_pack:1,apply_type_pack:1,assess_collection_setup:1,apply_collection_setup:1,list_timers:1,put_timer:1,cancel_timer:1,reconcile_timers:1,sync:1},Bo={list_files:1,open_file_upload:1,open_file_download:1,move_file:1,delete_file:1,get_file_transfer_status:1,commit_file_upload:1,abort_file_transfer:1},jo=new Set(["open_file_upload","move_file","delete_file","commit_file_upload","abort_file_transfer"]);var Ko=new Set(zo),Ho=new Set(Uo);function Mn(t){return Ko.has(t)}function $o(t){return Ho.has(t)}function xn(t,e){if(t==="file_control"){let n=En(e)&&typeof e.type=="string"?e.type:"";if(!$o(n))throw new Error(`Unknown file-control message: ${n}`);return Bo[n]}return Lo[t]}function X(t,e){let n=En(e)?e:{};if(n.dry_run===!0)return null;if(t==="file_control"){let o=typeof n.type=="string"?n.type:"";return jo.has(o)?`file_control:${o}`:null}let i=No[t];return i==="always"?t:i==="sync_action"&&n.action==="mutate"?"sync:mutate":null}function rt(t,e){return X(t,e)!==null}function En(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var Vo=1,Go="mdbase-connect mutation fingerprint v1\0",Jt=new TextEncoder;function Wo(t){return Yt(t,new Set)}function Jo(t,e){let n=X(t,e);if(n===null)throw new TypeError("The operation is not a canonical mutation.");let i=Jt.encode(n),o=Jt.encode(Wo(e)),r=Jt.encode(Go),a=new Uint8Array(r.length+4+8+i.length+4+8+o.length),s=new DataView(a.buffer),c=0;return a.set(r,c),c+=r.length,s.setUint32(c,Vo,!1),c+=4,c=qn(a,s,c,i),s.setUint32(c,xn(t,e),!1),c+=4,qn(a,s,c,o),a}async function Fn(t,e){let n=new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",Jo(t,e).buffer));return Yo(n)}function Yt(t,e){if(t===null)return"null";if(t===!0)return"true";if(t===!1)return"false";if(typeof t=="string")return Dn(t),JSON.stringify(t);if(typeof t=="number"){if(!Number.isFinite(t))throw new TypeError("Mutation input numbers must be finite.");return JSON.stringify(t)}if(typeof t!="object")throw new TypeError(`Mutation input contains unsupported ${typeof t}.`);if(e.has(t))throw new TypeError("Mutation input must not contain cycles.");e.add(t);try{if(Array.isArray(t)){if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let o=[];for(let r=0;r<t.length;r+=1){if(!Object.hasOwn(t,r))throw new TypeError("Mutation input arrays must not be sparse.");o.push(Yt(t[r],e))}return`[${o.join(",")}]`}let n=Object.getPrototypeOf(t);if(n!==Object.prototype&&n!==null)throw new TypeError("Mutation input objects must be plain JSON objects.");if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let i=Object.entries(t);for(let[o]of i)Dn(o);return i.sort(([o],[r])=>o<r?-1:o>r?1:0),`{${i.map(([o,r])=>{let a=Object.getOwnPropertyDescriptor(t,o);if(!a||a.get||a.set)throw new TypeError("Mutation input must not contain accessor properties.");return`${JSON.stringify(o)}:${Yt(r,e)}`}).join(",")}}`}finally{e.delete(t)}}function Dn(t){for(let e=0;e<t.length;e+=1){let n=t.charCodeAt(e);if(n>=55296&&n<=56319){let i=t.charCodeAt(e+1);if(!(i>=56320&&i<=57343))throw new TypeError("Mutation input strings must not contain lone surrogates.");e+=1}else if(n>=56320&&n<=57343)throw new TypeError("Mutation input strings must not contain lone surrogates.")}}function qn(t,e,n,i){return e.setBigUint64(n,BigInt(i.length),!1),n+=8,t.set(i,n),n+i.length}function Yo(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}var Z=2,Ue=4;function Qt(t,e){let n={operation_transport:Z,authorization_binding:Ue,semantic_capabilities:1};return(t.some(i=>rt(i,{action:"mutate"}))||e?.actions.some(i=>i!=="list"&&i!=="read")===!0)&&(n.durable_mutation=1),n}var zn={"collection.inspect":["describe"],"records.watch":["changes"],"records.read":["read"],"records.query":["query"],"records.validate":["validate"],"records.create":["create"],"records.update":["update"],"records.delete":["delete"],"records.rename":["rename"],"views.list":["list_views"],"views.execute":["execute_view"],"views.source.read":["read_view_source"],"views.source.create":["create_view_source"],"views.source.update":["update_view_source"],"views.source.delete":["delete_view_source"],"definitions.contracts.current":[],"definitions.read":["read_type"],"definitions.create":["create_type"],"definitions.update":["update_type"],"definitions.type-pack.inspect":["assess_type_pack"],"definitions.type-pack.apply":["assess_type_pack","apply_type_pack"],"collection.setup.apply":["assess_collection_setup","apply_collection_setup"],"timers.list":["list_timers"],"timers.put":["put_timer"],"timers.cancel":["cancel_timer"],"timers.reconcile":["reconcile_timers"],"sync.offline-replica":["sync"],"notifications.background-delivery":[],"files.list":[],"files.read":[],"files.add":[],"files.replace":[],"files.move":[],"files.delete":[]};function at(t,e={}){let n=e.includeOptional===!1?t.required:[...t.required,...t.optional??[]];return[...new Set(n.flatMap(i=>zn[i]))]}function st(t){return[...zn[t]]}var Qo=new TextEncoder().encode("mdbase-connect application installation id v2\0"),Xo=new TextEncoder().encode("mdbase-connect application authorization proof v4\0");async function Nn(t){let e=ct(t),i=new Uint8Array(await crypto.subtle.digest("SHA-256",ae([Qo,E(e)]))).slice(0,16);return i[6]=i[6]&15|128,i[8]=i[8]&63|128,[Ne(i.slice(0,4)),Ne(i.slice(4,6)),Ne(i.slice(6,8)),Ne(i.slice(8,10)),Ne(i.slice(10,16))].join("-")}function Ln(t){let e=[ct(t.installation_signing_public_key),ct(t.grant_agreement_public_key),ct(t.grant_signing_public_key)];if(e.some((a,s)=>e.slice(s+1).some(c=>or(a,c))))throw new Error("Application authorization keys must be distinct.");let n=Xt(t.authorization_nonce),i=Xt(t.code_challenge),o=t.contracts;if(t.protocol_version!==4||n.byteLength!==32||!/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)+$/u.test(t.application_declaration_id)||!/^[0-9a-f]{64}$/u.test(t.application_manifest_digest)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.issued_at)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.expires_at)||i.byteLength!==32||![o.operation_transport,o.authorization_binding,o.semantic_capabilities,o.durable_mutation??1].every(a=>Number.isInteger(a)&&a>0)||t.requested_operations.length===0&&t.requested_files===void 0||new Set(t.requested_operations).size!==t.requested_operations.length||t.requested_operations.some(a=>!a||a.includes("\0"))||(t.flow==="authorization_code"?t.redirect_uri===void 0||t.state===void 0:t.flow!=="device_code"||t.redirect_uri!==void 0||t.state!==void 0))throw new Error("Application authorization binding is invalid.");er(t.requested_files);let r=t.requested_operations.map(a=>E(new TextEncoder().encode(a)));return ae([Xo,$(t.protocol_version),E(lt(t.application_id)),E(lt(t.authorization_id)),E(new TextEncoder().encode(t.application_declaration_id)),E(Bn(t.application_manifest_digest)),E(lt(t.application_installation_id)),...e.map(E),E(new TextEncoder().encode(t.flow)),E(n),E(new TextEncoder().encode(t.issued_at)),E(new TextEncoder().encode(t.expires_at)),Un(t.redirect_uri),Un(t.state),E(new TextEncoder().encode(t.code_challenge)),$(o.operation_transport),$(o.authorization_binding),$(o.semantic_capabilities),Zo(o.durable_mutation),$(r.length),...r,tr(t.requested_files),nr(t.collection_id)])}function Zo(t){return t===void 0?new Uint8Array(1):ae([new Uint8Array([1]),$(t)])}function er(t){if(t!==void 0&&(t.actions.length===0||new Set(t.actions).size!==t.actions.length||t.scope.kind==="selected_folders"&&(t.scope.folders.length===0||new Set(t.scope.folders).size!==t.scope.folders.length||t.scope.folders.some(e=>!e||e.includes("\0")))))throw new Error("Application authorization file request is invalid.")}function tr(t){if(t===void 0)return new Uint8Array(1);let e=t.actions.map(n=>E(new TextEncoder().encode(n)));return ae([new Uint8Array([1]),$(e.length),...e,E(new TextEncoder().encode(t.scope.kind)),...t.scope.kind==="selected_folders"?[$(t.scope.folders.length),...t.scope.folders.map(n=>E(new TextEncoder().encode(n)))]:[]])}function Un(t){return t===void 0?new Uint8Array(1):ae([new Uint8Array([1]),E(new TextEncoder().encode(t))])}function nr(t){return t===void 0?new Uint8Array(1):ae([new Uint8Array([1]),E(lt(t))])}function ct(t){let e=Xt(t);if(e.byteLength!==65||e[0]!==4)throw new Error("Application authorization public key is invalid.");return e}function Xt(t){if(!/^[A-Za-z0-9_-]+$/u.test(t))throw new Error("Invalid base64url value.");let e=t.replaceAll("-","+").replaceAll("_","/"),n=e.padEnd(Math.ceil(e.length/4)*4,"="),i=Uint8Array.from(atob(n),o=>o.charCodeAt(0));if(ir(i)!==t)throw new Error("Non-canonical base64url value.");return i}function lt(t){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(t))throw new Error("Invalid UUID value.");let e=t.replaceAll("-","");return Bn(e)}function Bn(t){if(!/^[0-9a-f]+$/u.test(t)||t.length%2!==0)throw new Error("Invalid hexadecimal value.");return Uint8Array.from({length:t.length/2},(e,n)=>Number.parseInt(t.slice(n*2,n*2+2),16))}function E(t){return ae([$(t.byteLength),t])}function $(t){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,t,!1),e}function ae(t){let e=new Uint8Array(t.reduce((i,o)=>i+o.byteLength,0)),n=0;for(let i of t)e.set(i,n),n+=i.byteLength;return e}function ir(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function or(t,e){return t.byteLength===e.byteLength&&t.every((n,i)=>n===e[i])}function Ne(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}var jn={id:"mdbase.record.created",version:"1.0.0",digest:"sha256:7f3bed6baa356ee9389e977ae7b77a102e2bee871a7c1d9f2026fc21cacdbfc9"};var Kn={id:"mdbase.runtime.timer.fired",version:"1.0.0",digest:"sha256:41105be7a7abf33b31ced47e1e1965242236e40ccaea286b959b0a8c591f5642"};var Hn=28485,Le="P256-HKDF-SHA256-AES256GCM",dt=1;var rr="contract-setup-v1",ar="file-relay-v1",sr=["application-authorization-v4","authorization-activation","encrypted-relay","policy-ack"];var cr=["durable-mutation-journal-v1","durable-file-lifecycle-v1"],qa=[...cr,"mutation-replay-after-credential-retirement-v1"],Fa=[...sr,rr,ar],Zt=1;var $n="mdbase-authority-request-proof-v1",Be={version:"x-mdbase-proof-version",timestamp:"x-mdbase-proof-timestamp",nonce:"x-mdbase-proof-nonce",signature:"x-mdbase-proof-signature"};function ut(t,e,n){let i=new Set(t.required),o=[...new Set([...t.required,...t.optional??[]])],r={};for(let a of o)r[a]=lr(a,i.has(a),e,n);return{contractVersion:1,values:r,requiredAvailable:t.required.every(a=>r[a]?.state==="available")}}function lr(t,e,n,i){let o=st(t),r=o.filter(s=>!i.operations.includes(s)),a={id:t,requirement:e?"required":"optional",operations:o,missingOperations:r,evidence:[{source:"application",fact:`${e?"Required":"Optional"} in capability contract v1.`}]};if(r.length>0)return{...a,state:"requires_authorization",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${r.join(", ")}.`}],reason:"The current grant does not include every operation for this capability."};if(t==="definitions.contracts.current"&&i.scope.access!=="full_collection"){let s=new Set(i.scope.contracts.map(({id:d,version:p,digest:u})=>`${d}@${p}:${u}`)),c=(n.requirements?.contracts??[]).filter(({id:d,version:p,digest:u})=>!s.has(`${d}@${p}:${u}`));if(c.length>0)return{...a,state:"requires_authorization",reason:"The current grant does not approve the exact required contract definitions.",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${c.map(({id:d,version:p})=>`${d}@${p}`).join(", ")}.`}],details:{missingContracts:c}}}if(t.startsWith("files.")){let s=t.slice(6);if(!i.fileCapability?.actions.includes(s))return{...a,state:i.fileCapability?"requires_authorization":"unsupported",reason:i.fileCapability?`The current file grant does not include ${s}.`:"This connection has no file capability.",evidence:[...a.evidence,{source:"authorization",fact:i.fileCapability?`Granted file actions: ${i.fileCapability.actions.join(", ")}.`:"No file capability was granted."}]}}return t==="notifications.background-delivery"&&(n.notifications?.criteria.length??0)===0?{...a,state:"requires_setup",reason:"The application manifest declares no notification criteria.",evidence:[...a.evidence,{source:"application",fact:"No authority notification criteria are declared."}]}:{...a,state:"available",evidence:[...a.evidence,{source:"authorization",fact:o.length>0?`Granted operations: ${o.join(", ")}.`:"No record operation is required."},{source:"authority",fact:i.authority.kind==="hosted"?"Backed by a durable hosted mdbase authority.":"Backed by a user-operated mdbase connector."}],...t==="sync.offline-replica"?{details:{durability:"device",writes:"queued",authority:i.authority.kind}}:{},...t==="notifications.background-delivery"?{details:{delivery:"authority",payload:"opaque"}}:{}}}var b=class extends Error{constructor(n,i={}){super(n.message,i.cause===void 0?void 0:{cause:i.cause});this.problem=n;this.name="MdbaseConnectError",this.code=n.code,this.status=i.status}problem;code;status;get retryable(){return this.problem.recovery==="retry"&&this.problem.operation_outcome!=="unknown"}get requiresAuthorization(){return this.problem.category==="authorization"}get outcomeUnknown(){return this.problem.operation_outcome==="unknown"}get recovery(){return this.problem.recovery}get details(){return this.problem.details}};function T(t,e,...[n={}]){let i=oe[t];return{problem_version:1,code:t,category:i.category,recovery:i.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operationOutcome===void 0?{}:{operation_outcome:n.operationOutcome},...n.traceId===void 0?{}:{trace_id:n.traceId}}}function Vn(t,e,n={}){return Vt(t,e,{details:n.details,operation_outcome:n.operationOutcome,trace_id:n.traceId})}function l(t,e,...n){let i=n[0];return new b(T(t,e,...n),{status:i?.status,cause:i?.cause})}function U(t,e,n={}){let{status:i,cause:o,...r}=n;return new b(Vt(t,e,{details:r.details,operation_outcome:r.operationOutcome,trace_id:r.traceId}),{status:i,cause:o})}function ye(t){let e=ur(t.diagnostics),n=hr(t.diagnostics);if(e==="collection_version_unsupported"){let i=pr(t.diagnostics);return T(e,n,{operationOutcome:"rejected",details:i})}return e!=="operation_invalid"?T(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics}}):T(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics,partial_result:t.result}})}function ur(t){let e=new Set(t.filter(n=>n.severity==="error").map(n=>n.code));return["migration_required","migration_lossy","unsupported_version"].some(n=>e.has(n))?"collection_version_unsupported":["invalid_config","invalid_configuration","missing_config","missing_spec_version"].some(n=>e.has(n))?"collection_configuration_invalid":["duplicate_type","invalid_contract_definition","invalid_data_contract","invalid_type_definition","invalid_type_path"].some(n=>e.has(n))?"collection_type_registry_invalid":["collection_invalid","collection_open_failed"].some(n=>e.has(n))?"collection_invalid":"operation_invalid"}function pr(t){let e=t.map(n=>n.details).find(n=>fr(n));return{current_version:typeof e?.current_version=="string"?e.current_version:"0.2.x",required_version:typeof e?.required_version=="string"?e.required_version:"0.3.0"}}function fr(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function Gn(t){return t instanceof b&&t.retryable}function hr(t){return t.filter(e=>e.severity==="error").map(e=>e.message).join(" ")||t.map(e=>e.message).join(" ")||"The collection rejected this operation."}var yr=["access_denied","access_paused","authorization_binding_incompatible","authorization_expired","capability_contract_incompatible","collection_access_denied","connector_identity_changed","connector_offline","connector_upgrade_required","direct_operation_rejected","durable_mutation_unsupported","operation_outcome_unknown","encryption_required","encrypted_relay_rejected","hosted_provider_unavailable","insufficient_access","invalid_encrypted_response","invalid_operation_response","invalid_request","missing_grant_key","mutation_recovery_expired","mutation_request_conflict","not_authorized","operation_cancelled","operation_failed","rate_limited","relay_authorization_expired","relay_unavailable","temporarily_unavailable","timeout","transport_protocol_incompatible","unsupported_operation"],Wn=Object.keys(oe),se=["discovery_failed","invalid_operation_response","invalid_application_manifest","invalid_request","manifest_load_failed","rate_limited","temporarily_unavailable","timeout"],me=[...se,"access_denied","application_identity_unavailable","approval_window_blocked","authorization_binding_incompatible","authorization_cancelled","authorization_replayed","browser_required","capability_contract_incompatible","collection_access_denied","collection_configuration_invalid","collection_contracts_missing","collection_incompatible","collection_invalid","collection_kind_unsupported","collection_mismatch","collection_not_found","collection_type_registry_invalid","collection_version_unsupported","connector_identity_changed","connector_offline","connector_upgrade_required","device_authorization_failed","durable_mutation_unsupported","encryption_required","expired_token","invalid_application_authorization","invalid_callback","invalid_device_authorization_response","invalid_token_response","scope_denied","reconnect_required","token_exchange_failed","transport_protocol_incompatible"],je=[...se,"authorization_expired","invalid_operation_response","invalid_push_subscription","managed_fcm_not_declared","not_authorized","notification_criterion_not_declared","notification_reauthorization_required","notification_registration_failed","notification_unregistration_failed","notifications_not_declared","notifications_unavailable"],en=["connector_offline","connector_upgrade_required","invalid_operation_response","not_authorized","operation_failed","temporarily_unavailable","timeout"],es=[...me,"collection_not_ready","collection_not_selected","unknown_collection"],mr=["collection_configuration_invalid","collection_invalid","collection_type_registry_invalid","collection_version_unsupported"],pt=[...yr,...mr],V=[...pt,"invalid_path","operation_invalid"],Jn=[...V,"query_snapshot_changed","sandbox_unsupported"],q=[...V,"concurrent_modification","invalid_preflight","pending_mutation_unresolved"],ft=[...pt,"change_cursor_reset"],ee=[...q,"type_pack_provision_failed"];function k(t,e=[]){return{ok:!0,value:t,diagnostics:e}}function P(t){return{ok:!1,problem:t}}async function I(t,e){try{return k(await t())}catch(n){if(!(n instanceof b))throw n;let i=n.problem;return i.code==="unknown"||e.includes(i.code)?P(i):P(Vn(i.code,i.message,{details:i.details,operationOutcome:i.operation_outcome,traceId:i.trace_id}))}}var yt=3e4,gr=1e4,_r=12e4,br=6e4;function ge(t={}){return{requestMs:ht(t.requestMs,yt,"requestMs"),watchStartMs:ht(t.watchStartMs,gr,"watchStartMs"),uploadMs:ht(t.uploadMs,_r,"uploadMs"),syncMs:ht(t.syncMs,br,"syncMs")}}function te(t={},e=yt,n=Date.now){let i=t.timeoutMs===void 0?e:t.timeoutMs,o=i===null?null:vr(i),r=new AbortController,a=o===null?null:n()+o,s=()=>r.abort(t.signal?.reason);t.signal?.aborted?s():t.signal?.addEventListener("abort",s,{once:!0});let c=o===null?void 0:setTimeout(()=>r.abort(l("timeout","The operation exceeded its request deadline.",{operationOutcome:"not_sent"})),o),d=!1;return{signal:r.signal,deadline:a,remainingMs:()=>a===null?null:Math.max(0,a-n()),dispose:()=>{d||(d=!0,c!==void 0&&clearTimeout(c),t.signal?.removeEventListener("abort",s))}}}async function F(t,e,n){let i=te(t,e),o,r=new Promise((s,c)=>{o=c}),a=()=>o?.(G(i.signal));i.signal.addEventListener("abort",a,{once:!0});try{if(i.signal.aborted)throw G(i.signal);return await Promise.race([n(i),r])}finally{i.signal.removeEventListener("abort",a),i.dispose()}}async function N(t,e,n){let i=te(t,e);try{if(i.signal.aborted)throw G(i.signal);return await n(i)}finally{i.dispose()}}function G(t){return t.reason instanceof b?t.reason:l("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function vr(t){if(!Number.isSafeInteger(t)||t<=0)throw new TypeError("timeoutMs must be a positive safe integer or null.");return t}function ht(t,e,n){if(t===void 0)return e;if(t===null)return null;if(!Number.isSafeInteger(t)||t<=0)throw new TypeError(`${n} must be a positive safe integer or null.`);return t}var Cr="mdbase-connect-keys",ne="grant-keys",nn=18446744073709551615n,wr="mdbase-connect relay request key v1",Sr="mdbase-connect relay response key v1",Yn=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,_e=class{database=null;async create(e){let n=await Zn(e),i=await this.open();return await Xn(i,o=>o.add({...n,counter:"0"})),n}async get(e){let n=await this.open(),i=await Or(n.transaction(ne).objectStore(ne).get(e));return i?{handle:i.handle,agreementPrivateKey:i.agreementPrivateKey,agreementPublicKey:i.agreementPublicKey,signingPrivateKey:i.signingPrivateKey,signingPublicKey:i.signingPublicKey}:null}async nextCounter(e){let n=await this.open();return new Promise((i,o)=>{let r=n.transaction(ne,"readwrite"),a=r.objectStore(ne),s=a.get(e),c=null;s.onerror=()=>o(s.error),s.onsuccess=()=>{let d=s.result;if(!d){r.abort(),o(new w("missing_grant_key","The encrypted grant key is unavailable."));return}let p=BigInt(d.counter)+1n;if(p>nn){r.abort(),o(new w("counter_exhausted","The encrypted grant must be authorized again."));return}c=p.toString(),a.put({...d,counter:c})},r.onerror=()=>o(r.error),r.onabort=()=>o(r.error??new Error("Key counter transaction aborted.")),r.oncomplete=()=>{c&&i(c)}})}async delete(e){let n=await this.open();await Xn(n,i=>i.delete(e))}open(){if(typeof indexedDB>"u")throw new w("key_storage_unavailable","Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");return this.database||(this.database=new Promise((e,n)=>{let i=indexedDB.open(Cr,1);i.onupgradeneeded=()=>{i.result.objectStoreNames.contains(ne)||i.result.createObjectStore(ne,{keyPath:"handle"})},i.onerror=()=>n(i.error),i.onsuccess=()=>e(i.result)})),this.database}},be=class{records=new Map;sequence=Promise.resolve();async create(e){if(this.records.has(e))throw new Error(`Grant key already exists: ${e}`);let n=await Zn(e);return this.records.set(e,{...n,counter:"0"}),n}async get(e){let n=this.records.get(e);return n?{handle:n.handle,agreementPrivateKey:n.agreementPrivateKey,agreementPublicKey:n.agreementPublicKey,signingPrivateKey:n.signingPrivateKey,signingPublicKey:n.signingPublicKey}:null}nextCounter(e){let n,i,o=new Promise((r,a)=>{n=r,i=a});return this.sequence=this.sequence.then(()=>{let r=this.records.get(e);if(!r)throw new w("missing_grant_key","The encrypted grant key is unavailable.");let a=BigInt(r.counter)+1n;if(a>nn)throw new w("counter_exhausted","The encrypted grant must be authorized again.");r.counter=a.toString(),n(r.counter)}).catch(r=>{i(r)}),o}async delete(e){this.records.delete(e)}};async function mt(t,e,n,i){let o=await Rr(t,e,n),r=i.timestamp??Math.floor(Date.now()/1e3),a=i.nonce??crypto.randomUUID(),s=await on({...i,timestamp:r,nonce:a}),c=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},o.signingPrivateKey,new TextEncoder().encode(s));return{[Be.version]:String(Zt),[Be.timestamp]:String(r),[Be.nonce]:a,[Be.signature]:Ke(new Uint8Array(c))}}async function on(t){let e=t.method.toUpperCase(),n=await Qn(t.body??""),i=await Qn(t.credential);for(let o of[e,t.target,String(t.timestamp),t.nonce])if(!o||o.includes(`
|
|
2
2
|
`)||o.includes("\r"))throw new w("invalid_proof_input","Authority request proof metadata is invalid.");return[$n,Zt,e,t.target,n,i,t.timestamp,t.nonce].join(`
|
|
3
|
-
`)}async function ce(t,e,n,i,o,r=crypto.randomUUID()){W(n.encryption);let a=await ei(t,e,n.encryption.application_agreement_public_key),s=await t.nextCounter(e),c={binding:n,requestId:r,operation:i,counter:s},d=await ti(a.agreementPrivateKey,n,"request"),p=new TextEncoder().encode(JSON.stringify(o??{})),u=await crypto.subtle.encrypt({name:"AES-GCM",iv:oi(s),additionalData:new TextEncoder().encode(ii(c,"request")),tagLength:128},d,p);return{type:"encrypted_operation_request",...Pr(c),ciphertext:Ke(new Uint8Array(u))}}async function ve(t,e,n,i,o){if(!Ar(i,o))throw new w("invalid_encrypted_response","Encrypted response metadata does not match its request.");let r=await ei(t,e,n.encryption.application_agreement_public_key),a={binding:n,requestId:i.request_id,operation:i.operation,counter:i.counter},s=await ti(r.agreementPrivateKey,n,"response");try{let c=await crypto.subtle.decrypt({name:"AES-GCM",iv:oi(i.counter),additionalData:new TextEncoder().encode(ii(a,"response")),tagLength:128},s,ai(ri(o.ciphertext))),d=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c));if(d?.ok===!0&&"result"in d||d?.ok===!1&&ze(d.problem))return d;throw new Error("invalid response body")}catch(c){throw c instanceof w?c:new w("encrypted_response_rejected","The encrypted connector response could not be authenticated.")}}var w=class extends Error{constructor(n,i){super(i);this.code=n}code};async function Zn(t){let e=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveBits"]),n=Ke(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),i=await crypto.subtle.exportKey("pkcs8",e.privateKey),o=await crypto.subtle.importKey("pkcs8",i,{name:"ECDH",namedCurve:"P-256"},!1,["deriveBits"]),r=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),a=Ke(new Uint8Array(await crypto.subtle.exportKey("raw",r.publicKey))),s=await crypto.subtle.exportKey("pkcs8",r.privateKey),c=await crypto.subtle.importKey("pkcs8",s,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,agreementPrivateKey:o,agreementPublicKey:n,signingPrivateKey:c,signingPublicKey:a}}async function ei(t,e,n){let i=await t.get(e);if(!i||i.agreementPublicKey!==n)throw new w("missing_grant_key","The encrypted grant key is unavailable or does not match the grant.");return i}async function Rr(t,e,n){let i=await t.get(e);if(!i||i.signingPublicKey!==n)throw new w("missing_grant_key","The remote authority signing key is unavailable or does not match the grant.");return i}async function ti(t,e,n){let i=await He(t,e.encryption.connector_agreement_public_key),o=await crypto.subtle.importKey("raw",i,"HKDF",!1,["deriveKey"]),r=new TextEncoder().encode(ni(e)),a=await crypto.subtle.digest("SHA-256",r);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:a,info:new TextEncoder().encode(n==="request"?wr:Sr)},o,{name:"AES-GCM",length:256},!1,n==="request"?["encrypt"]:["decrypt"])}async function He(t,e){try{let n=await crypto.subtle.importKey("raw",ai(tn(e)),{name:"ECDH",namedCurve:"P-256"},!1,[]);return await crypto.subtle.deriveBits({name:"ECDH",public:n},t,256)}catch{throw new w("invalid_public_key","The connector relay public key is invalid.")}}function ni(t){let e=t.encryption;return["mdbase-connect",Z,e.suite,t.grantId,t.applicationId,e.connector_id,e.collection_id,e.scope_epoch,e.key_id].join("|")}function ii(t,e){return[ni(t.binding),t.requestId,e,t.operation,t.counter].join("|")}function Pr(t){let e=t.binding.encryption;return{protocol_version:Z,suite:Le,request_id:t.requestId,grant_id:t.binding.grantId,application_id:t.binding.applicationId,connector_id:e.connector_id,collection_id:e.collection_id,operation:t.operation,scope_epoch:e.scope_epoch,key_id:e.key_id,counter:t.counter}}function Ar(t,e){return e.type==="encrypted_operation_response"&&typeof e.ciphertext=="string"&&t.protocol_version===e.protocol_version&&t.suite===e.suite&&t.request_id===e.request_id&&t.grant_id===e.grant_id&&t.application_id===e.application_id&&t.connector_id===e.connector_id&&t.collection_id===e.collection_id&&t.operation===e.operation&&t.scope_epoch===e.scope_epoch&&t.key_id===e.key_id&&t.counter===e.counter}function W(t){if(t.protocol_version!==dt||t.suite!==Le||!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<=0||typeof t.key_id!="string"||t.key_id.length===0||t.key_id.length>200||t.key_id.includes("|"))throw new w("unsupported_encryption","The grant uses an unsupported relay encryption profile.");if(typeof t.connector_id!="string"||!Yn.test(t.connector_id)||typeof t.collection_id!="string"||!Yn.test(t.collection_id))throw new w("unsupported_encryption","The grant uses invalid encrypted relay identities.");tn(t.application_agreement_public_key),tn(t.connector_agreement_public_key)}function oi(t){let e=BigInt(t);if(e<=0n||e>nn||e.toString()!==t)throw new w("invalid_counter","The encrypted relay counter is invalid.");let n=new Uint8Array(new ArrayBuffer(12));return new DataView(n.buffer).setBigUint64(4,e,!1),n}function Ke(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}async function Qn(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return Ke(new Uint8Array(e))}function ri(t){if(!/^[A-Za-z0-9_-]+$/.test(t))throw new w("invalid_base64","Encrypted relay data is malformed.");let e="=".repeat((4-t.length%4)%4),n=atob(t.replaceAll("-","+").replaceAll("_","/")+e);return Uint8Array.from(n,i=>i.charCodeAt(0))}function tn(t){let e=ri(t);if(e.length!==65||e[0]!==4)throw new w("invalid_public_key","Encrypted relay public keys must be uncompressed P-256 points.");return e}function ai(t){return Uint8Array.from(t).buffer}function Or(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function Xn(t,e){return new Promise((n,i)=>{let o=t.transaction(ne,"readwrite"),r=e(o.objectStore(ne));r.onerror=()=>i(r.error),o.onerror=()=>i(o.error),o.onabort=()=>i(o.error??new Error("Grant key transaction aborted.")),o.oncomplete=()=>n()})}function le(t){return{...t,credentials:"omit",targetAddressSpace:"loopback"}}async function $e(){if(typeof navigator>"u"||!navigator.permissions?.query)return null;try{return(await navigator.permissions.query({name:"local-network-access"})).state}catch{return null}}function Ce(t){return t===404||t===405||t===426||t>=500}function si(t,e){return rt(t,e)}function K(t){return[...new Set(t)]}function ci(t,e){return t.grantId||e.grantId?t.grantId===e.grantId&&t.keyHandle===e.keyHandle&&t.encryption?.key_id===e.encryption?.key_id:t.accessToken===e.accessToken}function de(t){if(t?.aborted)throw l("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function gt(t,e,n,i){return t instanceof b?t:e?.aborted?n?B(n,t):e.reason instanceof b?e.reason:l("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t}):n?B(n,t):t instanceof TypeError?l(i,i==="hosted_provider_unavailable"?"The hosted collection provider is unavailable.":"The Connect relay is unavailable.",{cause:t}):t instanceof Error?t:new Error(String(t))}function an(t,e){return e?.aborted===!0||t instanceof b&&t.code==="operation_cancelled"}function li(t,e){if(e.dryRun!==!0||e.wouldRename!==!0||e.from!==t.from||e.to!==t.to)throw l("invalid_preflight","The rename preview does not match this mutation. Run the preview again.")}function di(t,e){if(e.dryRun!==!0||e.wouldDelete!==!0||e.path!==t.path)throw l("invalid_preflight","The delete preview does not match this mutation. Run the preview again.")}function ui(t,e){if(t.updateRefs===!1)return{affectedRecords:0,totalUnits:1,warnings:0};let n=e.referencesAffected??[];return{affectedRecords:new Set(n.map(i=>i.path)).size,totalUnits:1+n.length,warnings:e.warnings?.length??0}}function pi(t){return{affectedRecords:new Set((t.brokenLinks??[]).map(e=>e.path)).size,totalUnits:1,warnings:0}}async function fi(t,e){return Fn(t,e??{})}function hi(t){return JSON.stringify(rn(t))}function rn(t){return Array.isArray(t)?t.map(e=>rn(e)):t&&typeof t=="object"?Object.fromEntries(Object.entries(t).filter(([,e])=>e!==void 0).sort(([e],[n])=>e<n?-1:e>n?1:0).map(([e,n])=>[e,rn(n)])):t}function B(t,e){return l("operation_outcome_unknown","The write may have completed, but mdbase could not recover its authoritative result. Retry the exact same write to recover safely.",{operationOutcome:"unknown",details:{request_id:t},cause:e})}function j(t){let e=new Uint8Array(t);return crypto.getRandomValues(e),sn(e)}function sn(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function yi(t){let e=t.replaceAll("-","+").replaceAll("_","/").padEnd(Math.ceil(t.length/4)*4,"="),n=atob(e),i=new Uint8Array(new ArrayBuffer(n.length));for(let o=0;o<n.length;o+=1)i[o]=n.charCodeAt(o);return i}async function J(t,e,n,i){try{return await fetch(t,e)}catch(o){throw l(n,i,{cause:o})}}async function S(t,e,n){let i;try{i=await t.text()}catch(o){throw U(e,n,{status:t.status,cause:o})}if(i.trim()==="")throw U(e,n,{status:t.status});try{return JSON.parse(i)}catch(o){throw U(e,n,{status:t.status,cause:o})}}function mi(t){let e=new URL(t);if(e.protocol!=="http:"||!["127.0.0.1","[::1]"].includes(e.hostname)||e.username||e.password||e.pathname!=="/"||e.search||e.hash)throw l("invalid_loopback_url","loopbackUrl must be an HTTP origin on 127.0.0.1 or ::1.");return e.origin}async function Ve(){let t=j(32),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return{verifier:t,challenge:sn(new Uint8Array(e))}}function A(t,e,n,i){return U(Ge(t)??t?.error?.code??e,t?.error_description??t?.error?.message??n,{status:i,details:t?.error?.details})}function Ge(t){return typeof t?.error=="string"?t.error:void 0}function We(t,e){if(!t||typeof t!="object"||Array.isArray(t)||typeof e!="string")return!1;let n=t;if(typeof n.operations_url!="string"||typeof n.sync_url!="string"||typeof n.files_url!="string"||typeof n.replica_id!="string"||n.replica_id.length===0||typeof n.access_token!="string"||n.access_token.length===0||n.proof_public_key!==void 0&&(typeof n.proof_public_key!="string"||n.proof_public_key.length===0))return!1;try{let i=new URL(n.operations_url),o=new URL(n.sync_url),r=new URL(n.files_url);return[i,o,r].every(a=>(a.protocol==="https:"||a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))&&!a.username&&!a.password&&!a.search&&!a.hash)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/operations$/i.test(i.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/sync$/i.test(o.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/files$/i.test(r.pathname)&&i.origin===o.origin&&i.origin===r.origin&&i.pathname.split("/")[3]===e&&o.pathname.split("/")[3]===e&&r.pathname.split("/")[3]===e}catch{return!1}}function gi(t,e){return We({operations_url:t?.operationsUrl,sync_url:t?.syncUrl,files_url:t?.filesUrl,replica_id:t?.replicaId,access_token:t?.accessToken,proof_public_key:t?.proofPublicKey},e)}function _t(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;let e=t,n=e.actions;if(e.kind!=="files"||e.protocol_version!==1||!Array.isArray(n)||n.length===0||n.length>6||new Set(n).size!==n.length||n.some(o=>!["list","read","add","replace","move","delete"].includes(o)))return!1;let i=e.scope;return!i||typeof i!="object"||Array.isArray(i)?!1:i.kind==="collection"?Object.keys(i).length===1:i.kind==="selected_folders"&&Object.keys(i).length===2&&Array.isArray(i.folders)&&i.folders.length>0&&i.folders.length<=100&&new Set(i.folders).size===i.folders.length&&i.folders.every(o=>typeof o=="string"&&o.length>0&&o.length<=1024&&Tr(o))}function Tr(t){let e=new Set([".mdbase",".git","node_modules","_contracts","_schemas","_types","_views"]);return!t.startsWith("/")&&!t.endsWith("/")&&!t.includes("\\")&&t.split("/").every(n=>{let i=n.split(".")[0]?.toUpperCase()??"";return n!==""&&n!=="."&&n!==".."&&!n.startsWith(".")&&!n.endsWith(" ")&&!n.endsWith(".")&&!/[<>:"|?*]/.test(n)&&!e.has(n.toLowerCase())&&!["CON","PRN","AUX","NUL"].includes(i)&&!/^(COM|LPT)[1-9]$/.test(i)})}function _i(t,e){if(!t||typeof t!="object"||Array.isArray(t)||t.collection_id!==e)return!1;try{return W(t),!0}catch{return!1}}function bi(t){if(typeof t?.device_code!="string"||typeof t?.user_code!="string"||typeof t?.verification_uri!="string"||typeof t?.verification_uri_complete!="string"||!Number.isFinite(t?.expires_in)||!Number.isFinite(t?.interval))throw l("invalid_device_authorization_response","Connect returned an invalid downloaded application authorization response.");return{userCode:t.user_code,verificationUri:t.verification_uri,verificationUriComplete:t.verification_uri_complete,expiresAt:Date.now()+Math.max(1,t.expires_in)*1e3,intervalSeconds:Math.max(1,t.interval)}}function M(t){if(!t)return null;try{return JSON.parse(t)}catch{return null}}function bt(t){if(!t||typeof t!="object"||Array.isArray(t))return null;let e=t;return e.access!=="contract"&&e.access!=="full_collection"||!Array.isArray(e.contracts)||e.contracts.some(n=>!n||typeof n!="object"||n.contract_type!=="record"||typeof n.id!="string"||typeof n.version!="string"||!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(n.version)||!/^sha256:[0-9a-f]{64}$/.test(n.digest)||!n.schema||typeof n.schema!="object"||Array.isArray(n.schema)||!Array.isArray(n.implementations)||n.implementations.some(i=>!i||typeof i!="object"||typeof i.type_name!="string"||!Number.isInteger(i.type_version)||!/^sha256:[0-9a-f]{64}$/.test(i.digest)||!i.fields||typeof i.fields!="object"||Array.isArray(i.fields)||Object.values(i.fields).some(o=>typeof o!="string")))?null:e}function vi(t){return t.endsWith("/")?t.slice(0,-1):t}function Ci(){if(typeof location>"u")throw l("manifest_required","manifest is required outside a browser environment.");if(location.origin==="null")throw l("manifest_required","Downloaded applications must provide their v1 portable manifest inline.");return new URL("/.well-known/mdbase-app.json",location.origin).href}function wi(){if(typeof location>"u")throw l("redirect_uri_required","redirectUri is required outside a browser environment.");return location.href.split(/[?#]/)[0]}function Si(t,e,n,i){if(typeof t!="string"&&t.distribution==="portable"||i)return"null";let o=new URL(n);if(["http:","https:"].includes(o.protocol))return o.origin;if(typeof location<"u")return location.origin;if(typeof t!="string")return new URL(t.homepage).origin;try{return new URL(e).origin}catch{return""}}function Ri(t){let e=":token:",n=t.lastIndexOf(e);return n<0?"":t.slice(n+e.length)}function vt(){if(typeof location>"u")throw l("callback_url_required","callbackUrl is required outside a browser environment.");return location.href}function Pi(t){if(t)return new we;if(typeof localStorage>"u")throw l("storage_required","storage is required outside a browser environment.");try{let e=`mdbase-connect:probe:${j(8)}`;return localStorage.setItem(e,"1"),localStorage.removeItem(e),localStorage}catch{return new we}}var we=class{values=new Map;get length(){return this.values.size}clear(){this.values.clear()}getItem(e){return this.values.get(e)??null}key(e){return[...this.values.keys()][e]??null}removeItem(e){this.values.delete(e)}setItem(e,n){this.values.set(String(e),String(n))}};function Ai(t){return typeof t=="string"||t.distribution!=="portable"?!1:typeof location>"u"||location.origin==="null"||!["http:","https:"].includes(location.protocol)}function Oi(t){let e=hi(t),n=2166136261,i=2654435769;for(let o=0;o<e.length;o+=1){let r=e.charCodeAt(o);n=Math.imul(n^r,16777619),i=Math.imul(i^r,2246822507)}return`${(n>>>0).toString(16).padStart(8,"0")}${(i>>>0).toString(16).padStart(8,"0")}`}function Je(t){for(let e of["code","state","error","error_description"])t.searchParams.delete(e);return t}function Ct(t){let e;try{e=new URL(t)}catch{return!1}return e.searchParams.has("state")&&(e.searchParams.has("code")||e.searchParams.has("error"))}function Ti(t){if(!t.details||typeof t.details!="object"||Array.isArray(t.details))return;let e=t.details.return_to;return typeof e=="string"?e:void 0}var ue=["describe","changes","read","query"];var Se=class{constructor(e,n){this.connect=e;this.operations=K(n.operations??ue),this.selection=n.selection,this.autoSelect=n.autoSelect??"only",this.snapshot={status:"unselected",connections:[]},this.refresh()}connect;operations;selection;autoSelect;listeners=new Set;snapshot;snapshotKey="";stopConnections;stopSelection;stopActiveConnection;activeCollectionId=null;unavailableReason="not_authorized";started=!1;refreshing=!1;refreshQueued=!1;transactionDepth=0;callbackPromise=null;async start(e){this.started||(this.started=!0,this.stopConnections=this.connect.onConnectionsChange(()=>this.refresh()),this.stopSelection=this.selection.subscribe(()=>{this.unavailableReason="not_authorized",this.refresh()}));let n=this.selection.authorizationCallback();if(n){let i=await this.handleAuthorizationCallback(n,e);if(!i.ok)return i}else this.autoSelectOnlyConnection();return this.refresh(),k(this.snapshot)}destroy(){this.stopConnections?.(),this.stopSelection?.(),this.stopActiveConnection?.(),this.stopConnections=void 0,this.stopSelection=void 0,this.stopActiveConnection=void 0,this.activeCollectionId=null,this.started=!1}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}select(e,n={}){let i=this.connect.connection(e);return i?(this.unavailableReason="not_authorized",this.selection.select(e,n),this.refresh(),k(i)):P(T("unknown_collection","This collection is not authorized for this application."))}clearSelection(e={}){this.unavailableReason="not_authorized",this.selection.select(null,e),this.refresh()}forget(e){this.transactionDepth+=1;try{let n=this.selection.selectedCollectionId()===e;this.connect.connection(e)?.forget(),n&&this.selection.select(null,{history:"replace"})}finally{this.transactionDepth-=1,this.refresh()}}async authorize(e,n={}){let i=this.selection.selectedCollectionId();if(e==="selected"&&!i)return P(T("collection_not_selected","Choose a collection before updating its access."));let o=typeof e=="object"?e.collectionId:e==="selected"?i:null;this.transactionDepth+=1;try{let r=await this.connect.authorize({...n,operations:this.operations,target:o===null?{kind:"choose"}:{kind:"collection",collectionId:o},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}async ensureOperations(e,n){let i=this.snapshot;if(i.status!=="ready")return P(T("collection_not_ready","Choose an authorized collection first."));let o=K(e),r=i.connection.authorizationCapabilities(o);if(r.sufficient)return k({kind:"unchanged",connection:i.connection});this.transactionDepth+=1;try{let a=await this.connect.authorize({...n,operations:K([...r.grantedOperations,...r.missingOperations]),target:{kind:"collection",collectionId:i.collectionId},returnTo:this.selection.authorizationReturnTo()});return a.ok&&a.value.kind==="connected"&&this.selection.finishAuthorization(a.value.returnTo,a.value.connection.collectionId),a}finally{this.transactionDepth-=1,this.refresh()}}handleAuthorizationCallback(e,n){if(!Ct(e))return Promise.resolve(P(T("invalid_callback","This URL is not an authorization callback.")));if(this.callbackPromise)return this.callbackPromise;this.transactionDepth+=1;let i=this.connect.completeAuthorization(e,n).then(o=>{if(!o.ok){let a=Ti(o.problem);return this.selection.clearAuthorizationCallback(a),this.refresh(),o}let r=o.value;return this.unavailableReason="not_authorized",this.selection.finishAuthorization(r.returnTo,r.connection.collectionId),this.refresh(),k(r.connection,o.diagnostics)}).catch(o=>{throw this.selection.clearAuthorizationCallback(),this.refresh(),o}).finally(()=>{this.transactionDepth-=1,this.refresh(),this.callbackPromise===i&&(this.callbackPromise=null)});return this.callbackPromise=i,i}autoSelectOnlyConnection(){if(this.autoSelect!=="only"||this.selection.selectedCollectionId())return;let e=this.connect.connections();e.length===1&&this.selection.select(e[0].collectionId,{history:"replace"})}refresh(){if(this.transactionDepth>0){this.refreshQueued=!0;return}if(this.refreshing){this.refreshQueued=!0;return}this.refreshing=!0;try{do this.refreshQueued=!1,this.refreshOnce();while(this.refreshQueued)}finally{this.refreshing=!1}}refreshOnce(){let e=this.selection.selectedCollectionId(),n=this.connect.connections(),i=e?this.connect.connection(e):null;i?.collectionId!==this.activeCollectionId&&(this.stopActiveConnection?.(),this.activeCollectionId=i?.collectionId??null,this.stopActiveConnection=i?.onConnectionChange(a=>{!a&&this.selection.selectedCollectionId()===i.collectionId&&(this.unavailableReason="authorization_lost"),this.refresh()}));let o;if(!e)o={status:"unselected",connections:n};else if(!i||!i.info())o={status:"unavailable",collectionId:e,reason:this.connect.unavailableReason(e)??this.unavailableReason,connections:n};else{let a=i.info();o={status:"ready",collectionId:e,connection:i,info:a,access:i.authorizationCapabilities(this.operations),connections:n}}let r=kr(o);if(r!==this.snapshotKey){this.snapshot=o,this.snapshotKey=r;for(let a of this.listeners)a()}}};function kr(t){return t.status==="unselected"?JSON.stringify({status:t.status,connections:t.connections}):t.status==="unavailable"?JSON.stringify({status:t.status,collectionId:t.collectionId,reason:t.reason,connections:t.connections}):JSON.stringify({status:t.status,collectionId:t.collectionId,info:t.info,access:t.access,connections:t.connections})}var Ye=class{values=new Map;read(e){return this.values.get(e)??null}write(e,n){this.values.set(e,n)}remove(e){this.values.delete(e)}},Re=class{constructor(e,n,i=ge()){this.connect=e;this.options=n;this.timeouts=i;this.verificationStore=n.verificationStore??Fr()}connect;options;timeouts;listeners=new Set;verificationStore;snapshot={status:"opening",connections:[]};manifest=null;application=null;base=null;stopBase;setupAssessment=null;setupTypePackAdoptions=null;verificationGeneration=0;lifecycleGeneration=0;startOperation=null;start(e){if(this.base&&!this.startOperation)return Promise.resolve(k(this.snapshot));let n=this.startOperation??this.beginStart();return n.waiters+=1,F(e,this.timeouts.watchStartMs,()=>n.promise).finally(()=>{n.waiters-=1,n.waiters===0&&this.startOperation===n&&(n.controller.abort(),this.startOperation=null,this.lifecycleGeneration+=1)})}beginStart(){this.snapshot={status:"opening",connections:[]};let e=new AbortController,n=++this.lifecycleGeneration,i={promise:this.startWithinBudget({signal:e.signal,timeoutMs:null},n),controller:e,waiters:0,generation:n};this.startOperation=i;let o=()=>{this.startOperation===i&&(this.startOperation=null)};return i.promise.then(o,o),i}async startWithinBudget(e,n){let i=await this.connect.register(e);if(!i.ok)return i;let o=await this.connect.manifest(e);if(!o.ok)return o;let r=o.value.requirements?.capabilities;if(!r)return P(T("invalid_application_manifest","Application sessions require a versioned semantic capability contract.",{details:{issues:[{path:"/requirements/capabilities",keyword:"required",message:"is required for application sessions",params:{}}]}}));if(n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);this.application=i.value,this.manifest=o.value;let a=new Se(this.connect,{selection:this.options.selection,autoSelect:this.options.autoSelect,operations:Ir(r)});this.base=a;try{let s=await a.start(e);if(!s.ok)return this.cleanupBase(a),s;if(n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);if(this.stopBase=a.subscribe(()=>{this.base===a&&this.refresh()}),await this.refresh(!0,e),n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);return k(this.snapshot)}catch(s){throw this.cleanupBase(a),s}}destroy(){this.lifecycleGeneration+=1,this.verificationGeneration+=1,this.startOperation?.controller.abort(),this.startOperation=null,this.base&&this.cleanupBase(this.base),this.application=null,this.manifest=null,this.setupAssessment=null,this.setupTypePackAdoptions=null,this.snapshot={status:"opening",connections:[]},this.listeners.clear()}cleanupBase(e){this.base===e&&(this.stopBase?.(),this.stopBase=void 0,e.destroy(),this.base=null)}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}connection(){let e=this.base?.getSnapshot();return e?.status==="ready"?e.connection:null}select(e,n={}){return this.requireBase().select(e,n)}clearSelection(e={}){this.requireBase().clearSelection(e)}forget(e){this.requireBase().forget(e)}authorize(e,n={}){return this.requireBase().authorize(e,n)}handleAuthorizationCallback(e,n){return this.requireBase().handleAuthorizationCallback(String(e),n)}completeAuthorization(e,n){return this.requireBase().handleAuthorizationCallback(e===void 0?vt():String(e),n)}ensureCapabilities(e,n){let i=this.requireManifest().requirements?.capabilities,o=new Set([...i?.required??[],...i?.optional??[]]);return e.some(r=>!o.has(r))?Promise.resolve(P(T("invalid_application_manifest","Applications may only request capabilities declared in their manifest.",{details:{issues:[{path:"/requirements/capabilities",keyword:"undeclaredCapability",message:"must declare every capability requested by the application",params:{requested:e,declared:[...o]}}]}}))):this.requireBase().ensureOperations(Mr(e),n)}async applyCollectionSetup(e){if(this.snapshot.status!=="setup_review_required"||!this.setupAssessment)return P(T("collection_not_ready","There is no reviewed collection setup to apply."));if(!this.setupAssessment.applicable)return P(T("collection_not_ready","Resolve the collection setup conflicts before applying this update."));let n=this.connection();if(!n)return P(T("collection_not_ready","The collection is not ready."));let i=this.setupAssessment,o={...this.collectionSetupInput(this.setupTypePackAdoptions??void 0),expectedAssessmentDigest:i.assessmentDigest,expectedCollectionRevision:i.collectionRevision,expectedProvisionDigest:i.provisionDigest,allowTypePackDowngrades:i.typePacks.filter(s=>s.status==="downgrade").map(s=>s.desired.id)},r=te(e,this.timeouts.requestMs),a={signal:r.signal,timeoutMs:null};try{let s=await n.applyCollectionSetup(o,a);return s.ok?(this.setupAssessment=null,this.setupTypePackAdoptions=null,await this.verifySetup(this.context(n),++this.verificationGeneration,a),k(this.snapshot)):s}finally{r.dispose()}}async refresh(e=!1,n){if(!this.base||!this.manifest)return;let i=this.base.getSnapshot();this.verificationGeneration+=1;let o=this.verificationGeneration;if(this.setupAssessment=null,this.setupTypePackAdoptions=null,i.status==="unselected"){this.publish({status:"unselected",connections:i.connections});return}if(i.status==="unavailable"){this.publish(i);return}let r=this.context(i.connection);if(!r.capabilities.requiredAvailable){this.publish({status:"authorization_required",...r});return}if(!(this.manifest.requirements?.capabilities?.required.includes("collection.setup.apply")??!1)){this.publish({status:"ready",verification:"verified",...r});return}let s=cn(this.manifest,i.collectionId);this.verificationStore.read(s)===ki(this.manifest)?this.publish({status:"ready",verification:"cached",...r}):this.publish({status:"checking_setup",...r});let c=this.verifySetup(r,o,n);e&&await c}async verifySetup(e,n,i){let o=this.connection(),r=this.requireManifest();if(!o||o.collectionId!==e.collectionId)return;let a=this.collectionSetupInput(),s=i?await o.assessCollectionSetup(a,i):await o.assessCollectionSetup(a);if(n===this.verificationGeneration){if(!s.ok){this.publish({status:"blocked",problem:s.problem,...e});return}if(!s.value.applicable){let c=Dr(s.value);if(Object.keys(c).length>0){if(s=i?await o.assessCollectionSetup(this.collectionSetupInput(c),i):await o.assessCollectionSetup(this.collectionSetupInput(c)),n!==this.verificationGeneration)return;if(!s.ok){this.publish({status:"blocked",problem:s.problem,...e});return}this.setupTypePackAdoptions=c}}if(n===this.verificationGeneration){if(s.value.status!=="current"){this.setupAssessment=s.value,this.verificationStore.remove(cn(r,e.collectionId)),this.publish({status:"setup_review_required",update:Er(s.value,r.provisions?.type_packs??[]),...e});return}this.verificationStore.write(cn(r,e.collectionId),ki(r)),this.publish({status:"ready",verification:"verified",...e})}}}collectionSetupInput(e){let n=this.requireManifest(),i=this.requireApplication();return{applicationId:qr(i.family_identity),declarationDigest:`sha256:${i.manifest_digest}`,requirements:{configuration:n.requirements?.configuration??[]},provisions:{configuration:n.provisions?.configuration??[],typePacks:n.provisions?.type_packs??[]},...e?{typePackAdoptions:e}:{}}}context(e){let n=e.info();return{collectionId:e.collectionId,info:n,capabilities:ut(this.requireManifest().requirements.capabilities,this.requireManifest(),n),connections:this.connect.connections()}}publish(e){if(JSON.stringify(this.snapshot)!==JSON.stringify(e)){this.snapshot=e;for(let n of this.listeners)n()}}requireBase(){if(!this.base)throw new Error("Start the application session before using it.");return this.base}requireManifest(){if(!this.manifest)throw new Error("Start the application session before using it.");return this.manifest}requireApplication(){if(!this.application)throw new Error("Start the application session before using it.");return this.application}};function Ir(t){return at(t)}function Mr(t){let e=t.flatMap(n=>st(n));return[...new Set(e)]}function xr(t,e){let n=e.status==="conflict"?"Existing user-owned resources conflict with this application definition pack.":e.status==="install"?"This collection needs the application definitions installed.":`This collection has a ${e.status} definition change to review.`;return{id:e.desired.id,name:t.manifest.name??e.desired.id,status:e.status,applicable:e.applicable,assessmentDigest:e.assessmentDigest,...e.current?{currentVersion:e.current.version}:{},desiredVersion:e.desired.version,resources:e.resources,contractSetups:e.contractSetups,canApply:e.applicable,reason:n}}function Er(t,e){let n=t.typePacks.map(r=>{let a=e.find(s=>s.manifest.id===r.desired.id);if(!a)throw new Error(`Collection setup returned undeclared type pack '${r.desired.id}'.`);return xr(a,r)}),i=t.configuration.filter(r=>r.action!=="current").length,o=t.status==="conflict"?"Existing collection policy conflicts with this application's required setup.":`This application requires ${i} configuration change${i===1?"":"s"} and ${n.length} definition update${n.length===1?"":"s"}.`;return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessmentDigest,collectionRevision:t.collectionRevision,provisionDigest:t.provisionDigest,configuration:t.configuration,typePacks:n,canApply:t.applicable,reason:o}}function Dr(t){let e={};for(let n of t.typePacks){let i=Object.fromEntries(n.resources.filter(o=>o.action==="conflict"&&o.mode==="managed"&&o.currentDigest!==void 0&&o.installedDigest===void 0).map(o=>[o.target,o.currentDigest]));Object.keys(i).length>0&&(e[n.desired.id]=i)}return e}function cn(t,e){return`mdbase-application-session:v1:${t.id}:${e}`}function ki(t){return JSON.stringify({capabilities:t.requirements?.capabilities,requirements:t.requirements?.configuration??[],provisions:t.provisions??{}})}function qr(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function Fr(){return typeof localStorage<"u"?{read:t=>localStorage.getItem(t),write:(t,e)=>localStorage.setItem(t,e),remove:t=>localStorage.removeItem(t)}:new Ye}function Qe(t,e){return new Promise((n,i)=>{if(e?.aborted){i(e?.reason??new DOMException("Aborted","AbortError"));return}let o=()=>e?.removeEventListener("abort",a),r=setTimeout(()=>{o(),n()},t),a=()=>{clearTimeout(r),o(),i(e?.reason??new DOMException("Aborted","AbortError"))};e?.addEventListener("abort",a,{once:!0})})}var zr="mdbase-connect-identities",Pe="application-identities",ln=BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),Ur=ln/2n,Ae=class{database=null;async create(e){let n=await Mi(e),i=await this.open();return await Ii(i,o=>o.add(n)),n}async get(e){let n=await this.open();return await Nr(n.transaction(Pe).objectStore(Pe).get(e))??null}async delete(e){let n=await this.open();await Ii(n,i=>i.delete(e))}open(){if(typeof indexedDB>"u")throw new pe("Persistent application identity requires browser IndexedDB or an injected identity store.");return this.database||(this.database=new Promise((e,n)=>{let i=indexedDB.open(zr,1);i.onupgradeneeded=()=>{i.result.objectStoreNames.contains(Pe)||i.result.createObjectStore(Pe,{keyPath:"handle"})},i.onerror=()=>n(i.error),i.onsuccess=()=>e(i.result)})),this.database}},Oe=class{records=new Map;async create(e){if(this.records.has(e))throw new Error(`Application identity already exists: ${e}`);let n=await Mi(e);return this.records.set(e,n),n}async get(e){return this.records.get(e)??null}async delete(e){this.records.delete(e)}},pe=class extends Error{constructor(e){super(e),this.name="ApplicationIdentityStoreError"}};async function Te(t){return Nn(t.signingPublicKey)}async function Xe(t,e){if(t.installation_signing_public_key!==e.signingPublicKey||t.application_installation_id!==await Te(e))throw new Error("Application authorization identity does not match its binding.");let n=Br(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.signingPrivateKey,Ln(t))));return{binding:t,signature:xi(n)}}async function wt(t,e,n){let i=`application-installation:v2:${e}:${n.id}`,o=await t.get(i);if(o)return o;try{return await t.create(i)}catch(r){let a=await t.get(i);if(a)return a;throw r}}async function Mi(t){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),n=xi(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),i=await crypto.subtle.exportKey("pkcs8",e.privateKey),o=await crypto.subtle.importKey("pkcs8",i,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,signingPrivateKey:o,signingPublicKey:n}}function Nr(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function Ii(t,e){return new Promise((n,i)=>{let o=t.transaction(Pe,"readwrite");e(o.objectStore(Pe)).onerror=()=>i(o.error),o.onerror=()=>i(o.error),o.onabort=()=>i(o.error??new Error("Identity transaction aborted.")),o.oncomplete=()=>n()})}function Lr(t){let e=new Uint8Array(t.reduce((i,o)=>i+o.byteLength,0)),n=0;for(let i of t)e.set(i,n),n+=i.byteLength;return e}function xi(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function Br(t){if(t.byteLength!==64)throw new Error("Application authorization signature is invalid.");let e=jr(t.slice(32));if(e===0n||e>=ln)throw new Error("Application authorization signature is invalid.");return e<=Ur?t:Lr([t.slice(0,32),Kr(ln-e,32)])}function jr(t){return BigInt(`0x${Hr(t)}`)}function Kr(t,e){let n=t.toString(16).padStart(e*2,"0");return Uint8Array.from({length:e},(i,o)=>Number.parseInt(n.slice(o*2,o*2+2),16))}function Hr(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}function Ei(t){if(t!==!1)return{initialDelayMs:Math.max(0,t?.initialDelayMs??500),maxDelayMs:Math.max(0,t?.maxDelayMs??15e3),multiplier:Math.max(1,t?.multiplier??2),...t?.maxAttempts===void 0?{}:{maxAttempts:Math.max(0,t.maxAttempts)}}}var ke=class{constructor(e,n=yt){this.transport=e;this.requestTimeoutMs=n}transport;requestTimeoutMs;operation(e,n,i){return I(()=>this.transport.operation(e,n,i),Wn)}async describe(e){let n=await this.rawOperation("describe",{},pt,e);return x(n,aa)}async changes(e={},n){let i=await this.rawOperation("changes",e,ft,n);return x(i,ra)}async read(e,n){let i=await this.envelopeOperation("read",$r(e),V,n);return x(i,St)}async query(e={},n){let i=await this.envelopeOperation("query",Vr(e),Jn,n);return x(i,({results:o,meta:r})=>({results:o.map($i),...r?{meta:{totalCount:r.total_count,hasMore:r.has_more,...r.snapshot?{snapshot:r.snapshot}:{}}}:{}}))}async*queryPages(e={},n={}){let{offset:i,limit:o,snapshot:r,...a}=e,s=sa(i,0),c=Ni(n.firstPageSize??o,200),d=Ni(n.pageSize??o,1e3),p=r,u=0,f=0;for(;!n.signal?.aborted;){let h=await this.query({...a,offset:s,limit:f===0?c:d,...p?{snapshot:p}:{}},{signal:n.signal,timeoutMs:n.pageTimeoutMs});if(!h.ok){yield h;return}let m=h.value,y=m.meta?.snapshot;if(p&&y&&p!==y){yield P(T("query_snapshot_changed","The collection query snapshot changed while paging. Refresh the query before continuing."));return}!p&&y&&(p=y),u+=m.results.length;let v=!m.meta?.hasMore||m.results.length===0,g={results:m.results,...m.meta?{meta:m.meta}:{},page:f,offset:s,loaded:u,complete:v,...p?{snapshot:p}:{}};if(n.onProgress?.(g),yield k(g,h.diagnostics),v)return;s+=m.results.length,f+=1}}async queryAll(e={},n={}){let i=te(n,this.requestTimeoutMs),o=[],r,a=[];try{for await(let s of this.queryPages(e,{firstPageSize:n.firstPageSize,pageSize:n.pageSize,signal:i.signal,pageTimeoutMs:null,onProgress:n.onProgress})){if(!s.ok)return s;let c=s.value;o.push(...c.results),r=c,a.push(...s.diagnostics)}if(i.signal.aborted)throw G(i.signal);return k({results:o,meta:{...r?.meta??{},totalCount:r?.meta?.totalCount??o.length,hasMore:r?!r.complete:!1,...r?.snapshot?{snapshot:r.snapshot}:{}}},a)}catch(s){if(s instanceof b)return P(s.problem);throw s}finally{i.dispose()}}async listViews(e){let n=await this.envelopeOperation("list_views",{},V,e);return x(n,i=>({views:i.views,meta:{totalCount:i.meta.total_count}}))}async executeView(e,n){let i=await this.envelopeOperation("execute_view",e,V,n);return x(i,ea)}readViewSource(e,n){return this.envelopeOperation("read_view_source",e,V,n)}createViewSource(e,n){return this.envelopeOperation("create_view_source",e,q,n)}updateViewSource(e,n){return this.envelopeOperation("update_view_source",dn(e),q,n)}deleteViewSource(e,n){return this.envelopeOperation("delete_view_source",dn(e),q,n)}async create(e,n){let i=await this.envelopeOperation("create",Gr(e),q,n);return x(i,St)}async update(e,n){let i=await this.envelopeOperation("update",Wr(e),q,n);return x(i,St)}async delete(e,n){let i=await this.envelopeOperation("delete",Di(e),q,n);return x(i,ji)}async preflightDelete(e,n){let i=await this.envelopeOperation("delete",{...Di(e),check_backlinks:!0,dry_run:!0},q,n);return x(i,Qr)}async rename(e,n){let i=await this.envelopeOperation("rename",qi(e),q,n);return x(i,Xr)}async preflightRename(e,n){let i=await this.envelopeOperation("rename",{...qi(e),dry_run:!0},q,n);return x(i,Zr)}validate(e={},n){return this.envelopeOperation("validate",e,V,n)}readType(e,n){return this.envelopeOperation("read_type",e,ee,n)}createType(e,n){return this.envelopeOperation("create_type",e,ee,n)}updateType(e,n){return this.envelopeOperation("update_type",dn(e),ee,n)}async assessTypePack(e,n){let i=await this.envelopeOperation("assess_type_pack",Li(e),ee,n);return x(i,pn)}async applyTypePack(e,n){let i=await this.envelopeOperation("apply_type_pack",Jr(e),ee,n);return x(i,na)}async assessCollectionSetup(e,n){let i=await this.envelopeOperation("assess_collection_setup",Bi(e),ee,n);return x(i,Ui)}async applyCollectionSetup(e,n){let i=await this.envelopeOperation("apply_collection_setup",Yr(e),ee,n);return x(i,o=>({assessment:Ui(o.assessment),receipt:ia(o.receipt)}))}async listTimers(e,n){let i=await this.rawOperation("list_timers",{namespace:e},V,n);return x(i,o=>({namespace:o.namespace,timers:o.timers.map(un)}))}async putTimer(e,n){let i=await this.rawOperation("put_timer",{namespace:e.namespace,criterion_id:e.criterionId,timer:Fi(e.timer)},q,n);return x(i,un)}cancelTimer(e,n){return this.rawOperation("cancel_timer",e,q,n)}async reconcileTimers(e,n){let i=await this.rawOperation("reconcile_timers",{namespace:e.namespace,criterion_id:e.criterionId,timers:e.timers.map(Fi)},q,n);return x(i,o=>({namespace:o.namespace,timers:o.timers.map(un),cancelledIds:o.cancelled_ids}))}async*watch(e={}){let n=e.cursor,i=Math.max(100,e.pollIntervalMs??1e3),o=Ei(e.retry),r=0,a=!1;for(e.onStatus?.({state:"connecting",...n===void 0?{}:{cursor:n}});!e.signal?.aborted;){let s=await this.changes(n===void 0?{}:{after:n,limit:200},{signal:e.signal,timeoutMs:e.timeoutMs});if(!s.ok){let p=s.problem;if(e.signal?.aborted)return;if(!o||p.recovery!=="retry"){yield s;return}if(a=!1,r+=1,o.maxAttempts!==void 0&&r>o.maxAttempts){yield s;return}let u=Math.min(o.maxDelayMs,Math.round(o.initialDelayMs*o.multiplier**(r-1)));e.onStatus?.({state:"reconnecting",...n===void 0?{}:{cursor:n},attempt:r,retryInMs:u,problem:p});try{await Qe(u,e.signal)}catch{if(!e.signal?.aborted)throw l("operation_failed","Watch retry delay failed unexpectedly.")}continue}let c=s.value;if(n===void 0){n=c.cursor;continue}if(c.reset){let p=T("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again.");e.onStatus?.({state:"reset_required",cursor:n,problem:p}),yield P(p);return}let d=r>0;r=0,(!a||d)&&e.onStatus?.({state:"connected",cursor:n,recovered:d}),a=!0;for(let p of c.events)yield k(p);if(n=c.cursor,!c.hasMore)try{await Qe(i,e.signal)}catch{if(!e.signal?.aborted)throw l("operation_failed","Watch polling delay failed unexpectedly.")}}}rawOperation(e,n,i,o){return I(()=>this.transport.operation(e,n,o),i)}async envelopeOperation(e,n,i,o){let r=await I(()=>this.transport.operation(e,n,o),i);if(!r.ok)return r;let a=r.value;return a.valid?k(a.result,a.diagnostics):P(ye(a))}};function x(t,e){return t.ok?k(e(t.value),t.diagnostics):t}function $r(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function Vr(t){return{...t.types?{types:t.types}:{},...t.timezone?{timezone:t.timezone}:{},...t.context?{context:t.context}:{},...t.projections?{projections:Object.fromEntries(Object.entries(t.projections).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.where?{where:t.where}:{},...t.select?{select:t.select.map(e=>typeof e=="string"?e:{name:e.name,expr:e.expression,...e.label?{label:e.label}:{},...e.description?{description:e.description}:{}})}:{},...t.orderBy?{order_by:t.orderBy}:{},...t.groupBy?{group_by:t.groupBy}:{},...t.summaryFunctions?{summary_functions:Object.fromEntries(Object.entries(t.summaryFunctions).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.summaries?{summaries:t.summaries}:{},...t.limit===void 0?{}:{limit:t.limit},...t.offset===void 0?{}:{offset:t.offset},...t.snapshot?{snapshot:t.snapshot}:{},...t.includeBody===void 0?{}:{include_body:t.includeBody},...t.frontmatterMode?{frontmatter_mode:t.frontmatterMode}:{},...t.contract?{contract:t.contract}:{}}}function Gr(t){return{...t.path?{path:t.path}:{},...t.type?{type:t.type}:{},...t.contract?{contract:t.contract}:{},...t.frontmatter?{frontmatter:t.frontmatter}:{},...t.body===void 0?{}:{body:t.body},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function Wr(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument},...t.document===void 0?{patch:t.patch,...t.body===void 0?{}:{body:t.body}}:{document:t.document}}}function Di(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.checkBacklinks===void 0?{}:{check_backlinks:t.checkBacklinks},...t.ifRevision?{if_revision:t.ifRevision}:{}}}function qi(t){return{from:t.from,to:t.to,...t.contract?{contract:t.contract}:{},...t.updateRefs===void 0?{}:{update_refs:t.updateRefs},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function dn(t){let{ifRevision:e,...n}=t;return{...n,...e?{if_revision:e}:{}}}function Li(t){return{provision:t.provision,installed_by:t.installedBy,...t.adoptResources?{adopt_resources:t.adoptResources}:{},...t.preserveSeedTargets?{preserve_seed_targets:t.preserveSeedTargets}:{},...t.targetOverrides?{target_overrides:t.targetOverrides}:{},...t.contractSetups?{contract_setups:t.contractSetups.map(Ki)}:{}}}function Jr(t){return{...Li(t),expected_assessment_digest:t.expectedAssessmentDigest,...t.allowDowngrade===void 0?{}:{allow_downgrade:t.allowDowngrade}}}function Bi(t){return{application_id:t.applicationId,declaration_digest:t.declarationDigest,requirements:t.requirements,provisions:{configuration:t.provisions.configuration,type_packs:t.provisions.typePacks},...t.contractSetups?{contract_setups:t.contractSetups.map(Ki)}:{},...t.typePackAdoptions?{type_pack_adoptions:t.typePackAdoptions}:{}}}function Yr(t){return{...Bi(t),expected_assessment_digest:t.expectedAssessmentDigest,expected_collection_revision:t.expectedCollectionRevision,expected_provision_digest:t.expectedProvisionDigest,...t.allowTypePackDowngrades?{allow_type_pack_downgrades:t.allowTypePackDowngrades}:{}}}function ji(t){return{path:t.path,deleted:t.deleted,...t.broken_links?{brokenLinks:t.broken_links}:{}}}function Qr(t){return{...ji(t),deleted:!1,dryRun:!0,wouldDelete:!0}}function Xr(t){let{references_updated:e,...n}=t;return{...St(n),from:t.from,to:t.to,...e?{referencesUpdated:e}:{}}}function Zr(t){return{from:t.from,to:t.to,dryRun:!0,wouldRename:!0,...t.references_affected?{referencesAffected:t.references_affected}:{},...t.warnings?{warnings:t.warnings}:{}}}function Fi(t){return{id:t.id,fire_at:t.fireAt,...t.data===void 0?{}:{data:t.data}}}function un(t){return{id:t.id,fireAt:t.fire_at,...t.data===void 0?{}:{data:t.data},criterionId:t.criterion_id,generation:t.generation,status:t.status,createdAt:t.created_at,updatedAt:t.updated_at,firedAt:t.fired_at}}function Ki(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",type_name:t.typeName,type_revision:t.typeRevision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function Hi(t){return{id:t.id,version:t.version,digest:t.digest,type:t.type,implementationDigest:t.implementation_digest}}function $i(t){let{effective_frontmatter:e,contract:n,...i}=t;return{...i,...e===void 0?{}:{effectiveFrontmatter:e},...n?{contract:Hi(n)}:{}}}function St(t){let{effective_frontmatter:e,contract:n,...i}=t;return{...i,effectiveFrontmatter:e,...n?{contract:Hi(n)}:{}}}function ea(t){return{results:t.results.map(e=>{let n=$i(e);if(!n.effectiveFrontmatter)throw new Error("Saved view result omitted canonical effective frontmatter.");return{...n,effectiveFrontmatter:n.effectiveFrontmatter}}),meta:{totalCount:t.meta.total_count,hasMore:t.meta.has_more,view:t.meta.view,...t.meta.context?{context:t.meta.context}:{},...t.meta.groups?{groups:t.meta.groups}:{}}}}function zi(t){return{source:t.source,target:t.target,kind:t.kind,mode:t.mode,action:t.action,digest:t.digest,...t.current_digest?{currentDigest:t.current_digest}:{},...t.installed_digest?{installedDigest:t.installed_digest}:{},...t.adopted_from_digest?{adoptedFromDigest:t.adopted_from_digest}:{},...t.reason?{reason:t.reason}:{}}}function Rt(t){return{id:t.id,version:t.version,digest:t.digest,installedBy:t.installed_by,resources:t.resources.map(e=>({source:e.source,target:e.target,kind:e.kind,mode:e.mode,digest:e.digest,...e.adopted_from_digest?{adoptedFromDigest:e.adopted_from_digest}:{}}))}}function ta(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",typeName:t.type_name,typeRevision:t.type_revision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function pn(t){return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessment_digest,...t.current?{current:Rt(t.current)}:{},desired:Rt(t.desired),resources:t.resources.map(zi),lock:t.lock,contractSetups:{choices:t.contract_setups.choices.map(ta),resources:t.contract_setups.resources.map(zi)}}}function na(t){return{...pn(t),receipt:Rt(t.receipt),cleanupDeferred:t.cleanup_deferred}}function Ui(t){return{status:t.status,applicable:t.applicable,applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,collectionRevision:t.collection_revision,finalCollectionRevision:t.final_collection_revision,configuration:t.configuration,typePacks:t.type_packs.map(pn),finalResourceRevisions:t.final_resource_revisions,assessmentDigest:t.assessment_digest}}function ia(t){return{applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,assessmentDigest:t.assessment_digest,collectionRevision:t.collection_revision,configuration:t.configuration,typePacks:t.type_packs.map(Rt),cleanupDeferred:t.cleanup_deferred}}function oa(t){return{cursor:t.cursor,type:t.type,occurredAt:t.occurred_at,payload:t.payload}}function ra(t){return{events:t.events.map(oa),cursor:t.cursor,hasMore:t.has_more,reset:t.reset}}function aa(t){return{protocolVersion:t.protocol_version,collectionId:t.collection_id,displayName:t.display_name,specVersion:t.spec_version,operations:t.operations,changeCursor:t.change_cursor,types:t.types,contracts:t.contracts.map(e=>({contractType:e.contract_type,id:e.id,version:e.version,digest:e.digest,schema:e.schema,...e.binding_schema?{bindingSchema:e.binding_schema}:{},implementations:e.implementations.map(n=>({typeName:n.type_name,typeVersion:n.type_version,...n.type_path?{typePath:n.type_path}:{},digest:n.digest,fields:n.fields,...n.binding?{binding:n.binding}:{}}))})),...t.configuration?{configuration:t.configuration}:{}}}function sa(t,e){return typeof t=="number"&&Number.isFinite(t)?Math.max(0,Math.floor(t)):e}function Ni(t,e){return typeof t=="number"&&Number.isFinite(t)&&t>0?Math.floor(t):e}var Pt=class{constructor(e){this.context=e}context;async registerNotifications(e){return F(e,this.context.requestTimeoutMs,n=>this.registerNotificationsWithinBudget(e,n.signal))}async registerNotificationsWithinBudget(e,n){let i=await this.context.authorizedToken(n);if(!i)throw l("not_authorized","Connect this application before enabling notifications.");let r=(await this.context.register(n)).notifications?.criteria.map(g=>g.id)??[],a=[...new Set(e.criteria??r)],s=a.find(g=>!r.includes(g));if(s)throw l("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw l("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=await J(`${this.context.serverUrl}/v1/notifications/vapid-public-key`,{signal:n},"notifications_unavailable","Push notifications are unavailable."),d=await S(c,"invalid_operation_response","Connect returned an invalid notification key response.");if(!c.ok)throw A(d,"notifications_unavailable","Push notifications are unavailable.",c.status);let p=await e.serviceWorker.pushManager.getSubscription();p||(p=await e.serviceWorker.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:yi(d.public_key)}));let u=p.toJSON();if(!u.endpoint||!u.keys?.p256dh||!u.keys.auth)throw l("invalid_push_subscription","The browser returned an incomplete push subscription.");let f=M(this.context.storage.getItem(this.context.notificationKey())),h=e.installationId??f?.installationId??j(24),m=await J(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${i.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:h,criteria:a,subscription:{endpoint:u.endpoint,expirationTime:u.expirationTime??null,keys:u.keys}}),signal:n},"notification_registration_failed","Could not register push notifications."),y=await S(m,"invalid_operation_response","Connect returned an invalid notification registration response.");if(!m.ok)throw A(y,"notification_registration_failed","Could not register push notifications.",m.status);f?.channelId&&f.channelId!==y.channel_id&&fetch(`${this.context.serverUrl}/v1/notifications/channels/${f.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${i.accessToken}`},signal:n}).catch(()=>{});let v={channelId:y.channel_id,installationId:h,criteria:a};return this.context.storage.setItem(this.context.notificationKey(),JSON.stringify(v)),v}async registerNativeNotifications(e){return F(e,this.context.requestTimeoutMs,n=>this.registerNativeNotificationsWithinBudget(e,n.signal))}async registerNativeNotificationsWithinBudget(e,n){let i=await this.context.authorizedToken(n);if(!i)throw l("not_authorized","Connect this application before enabling notifications.");let o=await this.context.register(n);if(o.notifications?.native_delivery?.mode!=="managed_fcm")throw l("managed_fcm_not_declared","This application does not declare Connect-managed native notifications.");let r=o.notifications.criteria.map(m=>m.id),a=[...new Set(e.criteria??r)],s=a.find(m=>!r.includes(m));if(s)throw l("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw l("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=this.context.notificationKey("fcm"),d=M(this.context.storage.getItem(c)),p=e.installationId??d?.installationId??j(24),u=await J(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${i.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:p,criteria:a,transport:"fcm",token:e.token}),signal:n},"notification_registration_failed","Could not register native notifications."),f=await S(u,"invalid_operation_response","Connect returned an invalid native notification response.");if(!u.ok)throw A(f,"notification_registration_failed","Could not register native notifications.",u.status);d?.channelId&&d.channelId!==f.channel_id&&this.deleteNotificationChannel(d.channelId,i.accessToken,n).catch(()=>{});let h={channelId:f.channel_id,installationId:p,transport:"fcm",criteria:a};return this.context.storage.setItem(c,JSON.stringify(h)),h}async unregisterNativeNotifications(e={}){return F(e,this.context.requestTimeoutMs,n=>this.unregisterNativeNotificationsWithinBudget(n.signal))}async unregisterNativeNotificationsWithinBudget(e){let n=this.context.notificationKey("fcm"),i=M(this.context.storage.getItem(n)),o=await this.context.authorizedToken(e);if(i?.channelId&&!o)throw l("not_authorized","Reconnect this application before disabling native notifications.");i?.channelId&&o&&await this.deleteNotificationChannel(i.channelId,o.accessToken,e),this.context.storage.removeItem(n)}async unregisterNotifications(e,n={}){return F(n,this.context.requestTimeoutMs,i=>this.unregisterNotificationsWithinBudget(e,i.signal))}async unregisterNotificationsWithinBudget(e,n){let i=M(this.context.storage.getItem(this.context.notificationKey())),o=await this.context.authorizedToken(n);if(i?.channelId&&!o)throw l("not_authorized","Reconnect this application before disabling push notifications.");if(i?.channelId&&o){let a=await J(`${this.context.serverUrl}/v1/notifications/channels/${i.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${o.accessToken}`},signal:n},"notification_unregistration_failed","Could not unregister push notifications.");if(!a.ok&&a.status!==404){let s=await S(a,"invalid_operation_response","Connect returned an invalid notification response.");throw A(s,"notification_unregistration_failed","Could not unregister push notifications.",a.status)}}this.context.storage.removeItem(this.context.notificationKey()),await(await e?.pushManager.getSubscription())?.unsubscribe()}async deleteNotificationChannel(e,n,i){let o=await J(`${this.context.serverUrl}/v1/notifications/channels/${e}`,{method:"DELETE",headers:{authorization:`Bearer ${n}`},signal:i},"notification_unregistration_failed","Could not unregister push notifications.");if(!o.ok&&o.status!==404){let r=await S(o,"invalid_operation_response","Connect returned an invalid notification response.");throw A(r,"notification_unregistration_failed","Could not unregister push notifications.",o.status)}}};async function At(t,e,n,i,o,r){if(!t.authority)throw l("not_remote_authority","This authorization has no remote authority endpoint.");let a=n===""||n.startsWith("?")?n:`/${n}`,s=`${t.authority.filesUrl}${a}`,c=i===void 0?void 0:JSON.stringify(i),d=await r(t,e,s,c,t.authority.accessToken);return fetch(s,{method:e,redirect:"error",headers:{authorization:`Bearer ${t.authority.accessToken}`,...c===void 0?{}:{"content-type":"application/json"},...d},...c===void 0?{}:{body:c},...o?{signal:o}:{}})}async function Vi(t,e,n,i,o,r,a){let s=t,c=await At(s,e,n,i,o,a);if(c.status===401&&s.refreshToken){if(s=await r(),!s.authority||!s.fileCapability)throw l("authority_authorization_changed","Reconnect this collection before accessing its files.");c=await At(s,e,n,i,o,a)}let d=await S(c,"invalid_operation_response","The hosted authority returned an invalid file response.");if(!c.ok)throw A(d,"operation_failed","Collection file request failed.",c.status);return d}async function Gi(t,e,n,i,o,r){let a=t,s=await At(a,"GET",e,void 0,i,r);if(s.status===401&&a.refreshToken){if(a=await o(),!a.authority||!a.fileCapability)throw l("authority_authorization_changed","Reconnect this collection before accessing its files.");s=await At(a,"GET",e,void 0,i,r)}if(!s.ok){let d=await S(s,"invalid_operation_response","The hosted authority returned an invalid file range error response.");throw A(d,"operation_failed","Collection file range request failed.",s.status)}let c=s.headers.get("content-length");if(c===null||!/^(0|[1-9][0-9]*)$/u.test(c)||Number(c)!==n)throw await s.body?.cancel().catch(()=>{}),l("invalid_operation_response","The hosted file response declared an unexpected byte length.");if(!s.body)throw l("invalid_operation_response","The hosted file response did not contain a byte stream.");return s.body}var ca="mdbase-connect file chunk key v1",Ot=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Y=class extends Error{constructor(n,i){super(i);this.code=n;this.name="FileTransferCryptoError"}code},Ie=class t{constructor(e,n){this.binding=e;this.key=n}binding;key;static async open(e,n,i){Wi(i);let o=await e.get(n);if(!o||o.agreementPublicKey!==i.encryption.application_agreement_public_key)throw new w("missing_grant_key","The encrypted grant key is unavailable or does not match the file transfer grant.");let r=await He(o.agreementPrivateKey,i.encryption.connector_agreement_public_key);return t.fromSharedSecret(r,i)}static async fromSharedSecret(e,n){Wi(n);let i=await fn(e,n);return new t(n,i)}async encryptChunk(e,n,i){if(this.validateHeader(n),i.byteLength!==n.plaintext_length)throw new Y("plaintext_length_mismatch","File chunk plaintext length does not match its authenticated header.");let o=it(e,n),r=await crypto.subtle.encrypt({name:"AES-GCM",iv:Ji(n.chunk_index),additionalData:Tt(o),tagLength:128},this.key,Tt(i));return In({kind:e,header:n,payload:new Uint8Array(r)})}async decryptChunk(e){let n=ot(e);this.validateHeader(n.header);let i=it(n.kind,n.header);try{let o=await crypto.subtle.decrypt({name:"AES-GCM",iv:Ji(n.header.chunk_index),additionalData:Tt(i),tagLength:128},this.key,Tt(n.payload));return new Uint8Array(o)}catch{throw new Y("authentication_failed","The encrypted file chunk could not be authenticated.")}}validateHeader(e){let n=this.binding.encryption;if(e.protocol_version!==1||e.protection!=="grant_aead_v1"||e.grant_id!==this.binding.grantId||e.authority_id!==this.binding.authorityId||e.collection_id!==n.collection_id||e.transfer_id!==this.binding.transferId||e.direction!==this.binding.direction||e.scope_epoch!==n.scope_epoch||e.key_id!==n.key_id)throw new Y("header_binding_mismatch","The file frame does not match its transfer encryption binding.")}};async function fn(t,e){let n=new TextEncoder().encode(la(e)),i=await crypto.subtle.digest("SHA-256",n),o=await crypto.subtle.importKey("raw",t,"HKDF",!1,["deriveKey"]);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:i,info:new TextEncoder().encode(ca)},o,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}function Wi(t){if(W(t.encryption),!Ot.test(t.grantId)||!Ot.test(t.applicationId)||!Ot.test(t.authorityId)||!Ot.test(t.transferId)||t.direction!=="upload"&&t.direction!=="download")throw new Y("invalid_binding","The file transfer encryption binding is invalid.")}function la(t){let e=t.encryption;return["mdbase-connect","file-transfer",1,e.suite,t.grantId,t.applicationId,e.connector_id,t.authorityId,e.collection_id,e.scope_epoch,e.key_id,t.transferId,t.direction].join("|")}function Ji(t){if(!Number.isSafeInteger(t)||t<0)throw new Y("invalid_chunk_index","The file chunk index is invalid.");let e=new Uint8Array(new ArrayBuffer(12));return new DataView(e.buffer).setBigUint64(4,BigInt(t),!1),e}function Tt(t){return Uint8Array.from(t).buffer}var It=class{constructor(e){this.options=e}options;async control(e,n,i,o,r){Me(e);let a=ya(n,i,o),s=await this.encryptControl(e,a),c;if(await this.options.shouldAttemptDirect(e)){try{c=await fetch(`${this.options.loopbackUrl}/v1/files/control`,le({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r}))}catch(d){if(r?.aborted)throw d;this.options.onDirectUnavailable()}if(c&&!Ce(c.status))return c.ok&&this.options.onDirectAvailable(),this.decryptControlResponse(e,s,c);c&&this.options.onDirectUnavailable()}return c=await this.sendRelayControl(e,s,r),await ua(c,e)&&(e=await this.options.refreshAuthorization(r),hn(e),s=await this.encryptControl(e,a),c=await this.sendRelayControl(e,s,r)),c.ok&&this.options.onRelayAvailable(),this.decryptControlResponse(e,s,c)}async decryptControlResponse(e,n,i){let o=await S(i,"invalid_operation_response","The collection authority returned an invalid file control response.");if(!i.ok)throw A(o,"operation_failed","Collection file request failed.",i.status);let r=o?.envelope;if(!r)throw l("invalid_encrypted_response","The connector omitted its encrypted file response.");let a=await ve(this.options.keyStore,e.keyHandle,yn(e),n,r);return a.ok||ha(a.problem),a.result}async uploadChunk(e,n,i,o){let a=await this.localFileToken(e,"upload",o),s=await Yi(this.options.keyStore,a,e,n,i),c;if(await this.options.shouldAttemptDirect(a)){try{c=await fetch(`${this.options.loopbackUrl}/v1/files/upload`,le(Qi(s,o)))}catch(d){if(o?.aborted)throw d;this.options.onDirectUnavailable()}if(c&&!Ce(c.status))return c.ok&&this.options.onDirectAvailable(),da(c,"Encrypted file chunk upload failed.");c&&this.options.onDirectUnavailable()}if(c=await this.sendRelayUpload(a,s,o),c.status===401&&a.refreshToken&&(a=await this.options.refreshAuthorization(o),hn(a),s=await Yi(this.options.keyStore,a,e,n,i),c=await this.sendRelayUpload(a,s,o)),!c.ok){let d=await S(c,"invalid_operation_response","The collection authority returned an invalid file upload response.");throw A(d,"operation_failed","Encrypted file chunk upload failed.",c.status)}this.options.onRelayAvailable()}async downloadChunk(e,n,i){let o=await this.localFileToken(e,"download",i),r;if(await this.options.shouldAttemptDirect(o)){try{r=await fetch(`${this.options.loopbackUrl}/v1/files/download/${encodeURIComponent(o.grantId)}/${encodeURIComponent(e.transfer_id)}/${n}`,le({method:"GET",signal:i}))}catch(a){if(i?.aborted)throw a;this.options.onDirectUnavailable()}if(r&&!Ce(r.status))return r.ok&&this.options.onDirectAvailable(),this.decryptDownloadResponse(o,e,n,r);r&&this.options.onDirectUnavailable()}return r=await this.sendRelayDownload(o,e,n,i),r.status===401&&o.refreshToken&&(o=await this.options.refreshAuthorization(i),hn(o),r=await this.sendRelayDownload(o,e,n,i)),r.ok&&this.options.onRelayAvailable(),this.decryptDownloadResponse(o,e,n,r)}async decryptDownloadResponse(e,n,i,o){if(!o.ok){let s=await S(o,"invalid_operation_response","The collection authority returned an invalid file download response.");throw A(s,"operation_failed","Encrypted file chunk download failed.",o.status)}if(o.headers.get("content-type")?.split(";",1)[0]!=="application/mdbase-connect-file")throw l("invalid_operation_response","The connector returned an invalid file response media type.");let r=new Uint8Array(await o.arrayBuffer()),a;try{fa(n,i,r),a=await(await Zi(this.options.keyStore,e,n)).decryptChunk(r)}catch(s){throw s instanceof b?s:l("invalid_operation_response","The connector returned an invalid encrypted file frame.",{cause:s})}if(a.byteLength!==mn(n,i))throw l("invalid_operation_response","The connector returned a truncated file chunk.");return a}encryptControl(e,n){return Me(e),ce(this.options.keyStore,e.keyHandle,yn(e),"file_control",n)}sendRelayControl(e,n,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/control`,{method:"POST",headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/json"},body:JSON.stringify(n),signal:i})}sendRelayUpload(e,n,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/upload`,{...Qi(n,i),headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/mdbase-connect-file"}})}sendRelayDownload(e,n,i,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/download/${encodeURIComponent(n.transfer_id)}/${i}`,{method:"GET",headers:{authorization:`Bearer ${e.accessToken}`},signal:o})}async localFileToken(e,n,i){let o=await this.options.authorizedToken(i);if(!o||o.authority||!o.fileCapability||!o.encryption||!o.grantId||!o.keyHandle||e.direction!==n||e.protection!=="grant_aead_v1")throw l("not_authorized","This connection cannot use encrypted local file delivery.");return Mt(e),o}};function hn(t){if(t.authority||!t.fileCapability)throw l("not_authorized","This connection cannot use encrypted local file delivery.");Me(t)}async function Yi(t,e,n,i,o){let r=pa(e,n,i,o.byteLength);return(await Zi(t,e,n)).encryptChunk("upload_chunk",r,o)}function Qi(t,e){return{method:"POST",headers:{"content-type":"application/mdbase-connect-file"},body:Uint8Array.from(t).buffer,signal:e}}async function da(t,e){if(t.ok)return;let n=await S(t,"invalid_operation_response","The collection authority returned an invalid file transfer response.");throw A(n,"operation_failed",e,t.status)}async function ua(t,e){return e.refreshToken?t.status===401?!0:t.status!==409?!1:(await S(t.clone(),"invalid_operation_response","The collection authority returned an invalid file response.").catch(()=>null))?.error?.code==="encryption_binding_stale":!1}function Me(t){if(!t.encryption||!t.grantId||!t.keyHandle)throw l("missing_grant_key","Reconnect this application to restore encrypted file access.")}function yn(t){return Me(t),{grantId:t.grantId,applicationId:t.clientId,encryption:t.encryption}}function Zi(t,e,n){return Me(e),Ie.open(t,e.keyHandle,{...yn(e),authorityId:e.encryption.connector_id,transferId:n.transfer_id,direction:n.direction})}function pa(t,e,n,i){Me(t);let o=Mt(e),r=mn(e,n);if(i!==r)throw l("invalid_request","The file chunk has the wrong byte length.");return{protocol_version:1,protection:"grant_aead_v1",grant_id:t.grantId,authority_id:t.encryption.connector_id,collection_id:t.collectionId,transfer_id:e.transfer_id,direction:e.direction,chunk_size:o,chunk_index:n,offset:n*o,plaintext_length:i,total_size:e.total_size,scope_epoch:t.encryption.scope_epoch,key_id:t.encryption.key_id}}function fa(t,e,n){let i=ot(n),o=mn(t,e),r=Mt(t);if(i.kind!=="download_chunk"||i.header.chunk_index!==e||i.header.chunk_size!==r||i.header.offset!==e*r||i.header.plaintext_length!==o||i.header.total_size!==t.total_size)throw l("invalid_operation_response","The connector returned a file frame for a different chunk.")}function ha(t){throw U(t.code==="unknown"?t.server_code:t.code,t.message,{details:t.details,operationOutcome:t.operation_outcome??"rejected",traceId:t.trace_id})}function ya(t,e,n){if(t==="GET"&&(e===""||e.startsWith("?"))){let o=new URLSearchParams(e.startsWith("?")?e.slice(1):e),r=o.get("limit");return{protocol_version:1,type:"list_files",...o.get("folder")?{folder:o.get("folder")}:{},...o.get("after")?{after:o.get("after")}:{},...r?{limit:Number(r)}:{}}}let i=e.split("/");if(t==="GET"&&i.length===2&&i[0]==="transfers")return Xi("get_file_transfer_status",i[1]);if(t==="DELETE"&&i.length===2&&i[0]==="transfers")return Xi("abort_file_transfer",i[1]);if(t==="POST"&&ma(n)){let o=e==="uploads"?"open_file_upload":e==="downloads"?"open_file_download":i.length===3&&i[0]==="uploads"&&i[2]==="commit"?"commit_file_upload":i.length===2&&i[1]==="move"&&n.file_id===decodeURIComponent(i[0])?"move_file":i.length===2&&i[1]==="delete"&&n.file_id===decodeURIComponent(i[0])?"delete_file":null;if(o&&n.type===o)return{...n}}throw l("invalid_request","The file control request path is invalid.")}function Xi(t,e){return{protocol_version:1,type:t,transfer_id:decodeURIComponent(e)}}function Mt(t){if(t.strategy.kind!=="framed_chunks"||!Number.isSafeInteger(t.strategy.chunk_size)||t.strategy.chunk_size<=0)throw l("invalid_operation_response","The connector returned an invalid framed transfer strategy.");return t.strategy.chunk_size}function mn(t,e){let n=Mt(t);if(!Number.isSafeInteger(e)||e<0||!Number.isSafeInteger(t.total_size)||t.total_size<0)throw l("invalid_request","The file chunk index is invalid.");let i=e*n;if(!Number.isSafeInteger(i)||i>=t.total_size)throw l("invalid_request","The file chunk index is outside the transfer.");return Math.min(n,t.total_size-i)}function ma(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var xt=class{constructor(e){this.options=e;this.local=new It(e)}options;local;async control(e,n="",i,o){let r=await this.requireFileToken(o);return r.authority?Vi(r,e,n,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders):this.local.control(r,e,n,i,o)}uploadChunk(e,n,i,o){return this.local.uploadChunk(e,n,i,o)}downloadChunk(e,n,i){return this.local.downloadChunk(e,n,i)}async downloadHostedPart(e,n,i,o){let r=await this.requireFileToken(o);if(!r.authority)throw l("not_remote_authority","Hosted file delivery requires a remote authority endpoint.");return Gi(r,`downloads/${encodeURIComponent(e.transfer_id)}/parts/${n}`,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders)}async requireFileToken(e){let n=await this.options.authorizedToken(e);if(!n?.fileCapability)throw l("not_authorized","This connection has no file capability.");return n}};async function Ze(t,e,n,i,o,r){if(!e.authority?.proofPublicKey)return{};if(!e.keyHandle)throw l("missing_grant_key","Reconnect this application to restore remote authority request signing.");try{let a=new URL(i);return await mt(t,e.keyHandle,e.authority.proofPublicKey,{method:n,target:`${a.pathname}${a.search}`,body:o,credential:r})}catch(a){throw a instanceof w?U(a.code,a.message):a}}var Et=class{constructor(e,n){this.storage=e;this.baseKey=n}storage;baseKey;list(e){if(!e)return[];let n=M(this.storage.getItem(this.baseKey));if(eo(n)&&n.collectionId===e){let o=this.key(n.requestId);this.storage.getItem(o)||this.storage.setItem(o,JSON.stringify(n)),this.storage.removeItem(this.baseKey)}let i=[];for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);r?.startsWith(`${this.baseKey}:`)&&i.push(r)}return i.map(o=>M(this.storage.getItem(o))).filter(o=>eo(o)&&o.collectionId===e).sort((o,r)=>o.createdAt-r.createdAt||o.requestId.localeCompare(r.requestId))}find(e,n){return this.list(e).find(i=>i.requestId===n)??null}identifier(e){return e.mutation??X(e.operation,e.request?.input??(e.operation==="sync"?{action:"mutate"}:{}))??(e.operation==="sync"?"sync:mutate":e.operation)}store(e){this.storage.setItem(this.key(e.requestId),JSON.stringify(e))}take(e){let n=this.key(e),i=M(this.storage.getItem(n));return this.storage.removeItem(n),i}key(e){return`${this.baseKey}:${encodeURIComponent(e)}`}};function eo(t){return!!(t&&typeof t.collectionId=="string"&&typeof t.requestId=="string"&&t.requestId.length>0&&Mn(t.operation)&&typeof t.inputFingerprint=="string"&&Number.isFinite(t.createdAt)&&t.createdAt>0&&(t.envelope||t.request)&&(t.operation==="sync"||X(t.operation,t.request?.input??{})!==null))}function to({stored:t,collectionId:e,relayEncryption:n,invalidate:i,directCapable:o}){let r=M(t),a=s=>(i(typeof s=="string"?s:void 0),null);if(!r)return t&&a(),null;if(r.version!==1||typeof r.accessToken!="string"||r.accessToken.length===0||typeof r.clientId!="string"||r.clientId.length===0||r.collectionId!==e||typeof r.collectionName!="string"||r.collectionName.length===0||!Array.isArray(r.operations)||r.operations.some(s=>typeof s!="string")||typeof r.expiresAt!="number"||!Number.isFinite(r.expiresAt)||r.refreshToken!==void 0&&(typeof r.refreshToken!="string"||r.refreshToken.length===0)||r.refreshExpiresAt!==void 0&&(typeof r.refreshExpiresAt!="number"||!Number.isFinite(r.refreshExpiresAt))||!bt(r.scope)||r.fileCapability&&!_t(r.fileCapability)||r.authority&&!gi(r.authority,r.collectionId))return a(r.keyHandle);if(n==="required"){if(r.authority){if(!r.keyHandle||!r.authority.proofPublicKey)return a(r.keyHandle)}else if(!r.grantId||!r.keyHandle||!_i(r.encryption,r.collectionId))return a(r.keyHandle)}return r.expiresAt<=Date.now()&&(!r.refreshToken||(r.refreshExpiresAt??0)<=Date.now())?o(r)?r:(i(r.keyHandle),null):r}var Dt=class{serverUrl;storage;keyStore;directAccessMode;loopbackUrl;collectionId;internals;onChange;timeouts;pendingMutationStore;files;refreshPromise=null;directStatus;currentRoute="relay";directFailures=0;directRetryAt=0;constructor(e){this.serverUrl=e.serverUrl,this.storage=e.storage,this.keyStore=e.keyStore,this.directAccessMode=e.directAccessMode,this.loopbackUrl=e.loopbackUrl,this.collectionId=e.collectionId,this.internals=e.internals,this.onChange=e.onChange,this.timeouts=e.timeouts,this.pendingMutationStore=new Et(this.storage,this.internals.pendingMutationKey(this.collectionId)),this.files=new xt({keyStore:this.keyStore,serverUrl:this.serverUrl,loopbackUrl:this.loopbackUrl,authorizedToken:n=>this.authorizedToken({signal:n,timeoutMs:null}),refreshAuthorization:n=>this.refreshAuthorization(n),shouldAttemptDirect:n=>this.shouldAttemptDirect(n),onDirectAvailable:()=>{this.markDirectAvailable(),this.setRoute("direct")},onDirectUnavailable:()=>this.markDirectUnavailable(),onRelayAvailable:()=>this.setRoute("relay"),authorityProofHeaders:(n,i,o,r,a)=>Ze(this.keyStore,n,i,o,r,a)}),this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable"}get directAccess(){return this.currentToken()?.authority?"disabled":this.directStatus}get route(){return this.currentToken()?.authority?"remote":this.currentRoute}notifyStorageChanged(){this.emitConnection()}async checkDirectAccess(e={}){return F(e,this.timeouts.watchStartMs,n=>this.checkDirectAccessWithinBudget(n.signal))}async checkDirectAccessWithinBudget(e){let n=this.currentToken();if(!this.directEligible(n))return this.setDirectStatus("disabled");let i=await $e();return i==="denied"?this.setDirectStatus("denied"):(i==="prompt"||i===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?this.setDirectStatus("permission_required"):this.probeDirectAccess(e)}async requestDirectAccess(e={}){return F(e,this.timeouts.watchStartMs,n=>this.requestDirectAccessWithinBudget(n.signal))}async requestDirectAccessWithinBudget(e){let n=this.currentToken();return this.directCapable(n)?(this.storage.setItem(this.internals.directPreferenceKey(),"enabled"),this.directRetryAt=0,this.probeDirectAccess(e)):this.setDirectStatus("disabled")}disableDirectAccess(){this.storage.setItem(this.internals.directPreferenceKey(),"disabled"),this.setDirectStatus("disabled"),this.setRoute("relay")}pendingMutations(){return this.storedPendingMutations().map(e=>({requestId:e.requestId,operation:this.pendingMutationStore.identifier(e),fingerprint:e.inputFingerprint,status:"outcome_unknown",createdAt:new Date(e.createdAt).toISOString()}))}pendingMutation(e){let n=this.storedPendingMutation(e);return n?{requestId:n.requestId,operation:this.pendingMutationStore.identifier(n),fingerprint:n.inputFingerprint,status:"outcome_unknown",createdAt:new Date(n.createdAt).toISOString()}:null}async recoverPendingMutation(e,n){let i=this.storedPendingMutation(e);if(!i)throw l("no_pending_mutation","There is no interrupted mutation to resume.");return N(n,this.timeouts.requestMs,o=>this.performOperationWithinBudget(i.operation,i.request?.input??{},{...n,signal:o.signal},i))}async performOperation(e,n,i={}){return N(i,this.timeouts.requestMs,o=>this.performOperationWithinBudget(e,n,{...i,signal:o.signal}))}async performOperationWithinBudget(e,n,i,o){de(i.signal);let r=this.currentToken();if(!r)throw l("not_authorized","Connect this application before accessing a collection.");if(!r.operations.includes(e))throw l("insufficient_access",`This connection does not allow ${e}.`,{details:{required_operations:[e],granted_operations:[...r.operations],missing_operations:[e]}});let a=await this.shouldAttemptDirect(r);if(!a&&(r=await this.authorizedToken({signal:i.signal,timeoutMs:null}),!r))throw l("not_authorized","Reconnect this application to continue.");let s=o?.requestId??(si(e,n)?crypto.randomUUID():void 0),c;try{c=await this.sendOperation(r,e,n,a,i,s)}catch(f){throw gt(f,i.signal,s!==void 0&&this.storedPendingMutation(s)!==null?s:void 0,r.authority?"hosted_provider_unavailable":"relay_unavailable")}let d=c.response,p=d.status===409&&(await S(d.clone(),"invalid_operation_response","The collection authority returned an invalid operation response.").catch(()=>null))?.error?.code==="encryption_binding_stale";if((d.status===401||p)&&r.refreshToken){if(c.pendingMutation&&(c.directDeliveryUncertain||c.encryptedRequest&&c.resumingMutation))throw l("operation_outcome_unknown","The direct operation may have completed, but its encrypted grant changed before the response could be recovered. Refresh before making another change.",{operationOutcome:"unknown",details:{request_id:c.requestId}});c.pendingMutation&&this.clearPendingMutation(c.requestId),r=await this.refreshAuthorization(i.signal),a=await this.shouldAttemptDirect(r);try{c=await this.sendOperation(r,e,n,a,i,s)}catch(f){throw gt(f,i.signal,s!==void 0&&this.storedPendingMutation(s)!==null?s:void 0,r.authority?"hosted_provider_unavailable":"relay_unavailable")}d=c.response}let u;try{u=await S(d,"invalid_operation_response","The collection authority returned a response that is not valid JSON.")}catch(f){throw c.pendingMutation?B(c.requestId,f):l("invalid_operation_response","The collection authority returned a response that is not valid JSON.",{cause:f})}if(!d.ok){let f=A(u,"operation_failed","Collection operation failed.",d.status);throw c.pendingMutation&&(c.directDeliveryUncertain||c.encryptedRequest&&c.resumingMutation)?B(c.requestId,f):(c.pendingMutation&&!c.directDeliveryUncertain&&this.clearPendingMutation(c.requestId),f.code==="direct_operation_rejected"&&f.status===403&&this.invalidateRejectedAuthorization(r),f)}if(c.encryptedRequest){let f=u?.envelope,h=c.pendingMutationRecord,m=h?.encryption??r.encryption,y=h?.grantId??r.grantId,v=h?.applicationId??r.clientId,g=h?.keyHandle??r.keyHandle;if(!f||!m||!y||!g)throw c.pendingMutation?B(c.requestId,new Error("Encrypted operation response was missing its envelope.")):l("invalid_encrypted_response","The relay did not return an encrypted connector response.");try{let _=await ve(this.keyStore,g,{grantId:y,applicationId:v,encryption:m},c.encryptedRequest,f);if(c.pendingMutation&&this.clearPendingMutation(c.requestId),!_.ok)throw U(_.problem.code==="unknown"?_.problem.server_code:_.problem.code,_.problem.message,{details:_.problem.details,operationOutcome:_.problem.operation_outcome??"rejected",traceId:_.problem.trace_id});return _.result}catch(_){throw _ instanceof b?_:_ instanceof w?c.pendingMutation?B(c.requestId,_):U(_.code,_.message):_}}if(u?.protocol_version!==Z||u?.request_id!==c.requestId)throw c.pendingMutation?B(c.requestId,new Error("Operation response protocol or request ID did not match.")):l("invalid_operation_response","The collection authority returned a response for a different protocol request.");if(u.ok===!1)throw ze(u.problem)?(c.pendingMutation&&this.clearPendingMutation(c.requestId),new b(u.problem)):c.pendingMutation?B(c.requestId,new Error("Operation rejection did not contain a canonical problem.")):l("invalid_operation_response","The collection authority returned an invalid operation problem.");if(u.ok!==!0||!("result"in u))throw c.pendingMutation?B(c.requestId,new Error("Successful operation response did not contain a result.")):l("invalid_operation_response","The collection authority returned an incomplete operation response.");return c.pendingMutation&&this.clearPendingMutation(c.requestId),u.result}async performAuthoritySyncRequest(e,n,i,o,r,a={}){return N(a,this.timeouts.syncMs,async s=>{let c=await this.authorizedToken({signal:s.signal,timeoutMs:null});if(!c?.authority||c.collectionId!==e||c.authority.replicaId!==n)throw l("authority_authorization_changed","Reconnect this collection authority before synchronizing.");try{let d=await this.sendAuthoritySyncRequest(c,i,o,r,s.signal);if(d.status===401&&c.refreshToken){if(c=await this.refreshAuthorization(s.signal),!c.authority||c.collectionId!==e||c.authority.replicaId!==n)throw l("authority_authorization_changed","Reconnect this collection authority before synchronizing.");d=await this.sendAuthoritySyncRequest(c,i,o,r,s.signal)}let p=await S(d,"invalid_operation_response","The collection authority returned an invalid synchronization response.");if(!d.ok)throw A(p,"sync_failed","Collection synchronization failed.",d.status);return p}catch(d){let p=i==="POST"&&o==="mutations"&&r&&typeof r=="object"&&typeof r.mutation_id=="string"?r.mutation_id:void 0;throw gt(d,s.signal,p,"hosted_provider_unavailable")}})}async sendAuthoritySyncRequest(e,n,i,o,r){if(!e.authority)throw l("not_remote_authority","This authorization has no remote authority endpoint.");let a=`${e.authority.syncUrl}/${i}`,s=o===void 0?void 0:JSON.stringify(o),c=await Ze(this.keyStore,e,n,a,s,e.authority.accessToken);return fetch(a,{method:n,headers:{authorization:`Bearer ${e.authority.accessToken}`,...o===void 0?{}:{"content-type":"application/json"},...c},...s===void 0?{}:{body:s},signal:r})}async sendOperation(e,n,i,o,r={},a){let s=i??{},c,d=!1,p=!1,u=a??crypto.randomUUID(),f=null,h;if(a!==void 0){if(f=this.storedPendingMutation(a),h=f?.inputFingerprint??await fi(n,i),f){if(f.collectionId!==e.collectionId||f.operation!==n||f.inputFingerprint!==h)throw l("pending_mutation_unresolved","A previous write still has an unknown outcome. Retry that exact write before making another change.");u=f.requestId,p=!0}d=!0}let m=f?.mutation??X(n,i);if(f?.envelope&&(e.authority||!e.encryption))throw l("pending_mutation_unresolved","The pending write requires its encrypted relay authority. Reconnect that authority before recovery.");if(f?.request&&e.encryption&&!e.authority)throw l("pending_mutation_unresolved","The pending write belongs to a different authority transport. Reconnect that authority before recovery.");if(e.encryption&&!e.authority){if(!e.grantId||!e.keyHandle)throw l("missing_grant_key","Reconnect this application to restore encrypted access.");try{if(d)if(f){if(!f.envelope)throw l("pending_mutation_unresolved","The pending write belongs to a different transport. Reconnect before retrying it.");c=f.envelope}else c=await ce(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,i,u),this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},keyId:e.encryption.key_id,keyHandle:e.keyHandle,applicationId:e.clientId,encryption:e.encryption,operation:n,mutation:m,inputFingerprint:h,requestId:u,envelope:c,createdAt:Date.now()});else c=await ce(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,i)}catch(O){throw O instanceof w?U(O.code,O.message):O}s=c}else{let O=f?.request??{protocol_version:Z,request_id:u,input:s};s=O,d&&!f&&this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},operation:n,mutation:m,inputFingerprint:h,requestId:u,request:O,createdAt:Date.now()})}if(o&&c&&!e.authority){let O=!1;try{let R=await fetch(`${this.loopbackUrl}/v1/operations`,le({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(c),signal:r.signal}));if(!Ce(R.status))return R.ok&&(this.markDirectAvailable(),this.setRoute("direct")),{response:R,requestId:u,encryptedRequest:c,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p};O=R.status>=500,this.markDirectUnavailable()}catch(R){if(r.signal?.aborted)throw R;O=!0,await $e()==="denied"?this.setDirectStatus("denied"):this.markDirectUnavailable()}let D;try{D=e.expiresAt>Date.now()+3e4?e:await this.refreshAuthorization(r.signal)}catch(R){throw d&&(O||p)?B(u,R):R}let L;try{L=await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(D.collectionId)}/operations/${n}`,{method:"POST",headers:{authorization:`Bearer ${D.accessToken}`,"content-type":"application/json"},body:JSON.stringify(c),signal:r.signal})}catch(R){throw d&&(O||p)?B(u,R):R}return L.ok&&this.setRoute("relay"),{response:L,requestId:u,encryptedRequest:c,directDeliveryUncertain:O,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p}}let y=e.authority?`${e.authority.operationsUrl}/${n}`:`${this.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/operations/${n}`,v=JSON.stringify(s),g=e.authority?await Ze(this.keyStore,e,"POST",y,v,e.authority.accessToken):{},_=await fetch(y,{method:"POST",headers:{authorization:`Bearer ${e.authority?.accessToken??e.accessToken}`,"content-type":"application/json",...g},body:v,signal:r.signal});return _.ok&&this.setRoute(e.authority?"remote":"relay"),{response:_,requestId:u,encryptedRequest:c,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p}}directCapable(e){return!(!e||e.authority||!e.encryption||!e.grantId||!e.keyHandle||this.directAccessMode==="disabled"||typeof location<"u"&&e.applicationOrigin&&e.applicationOrigin!==location.origin)}hasResumableMutationTransport(){return!!this.currentToken()}directEligible(e){return e!==null&&this.directCapable(e)&&this.storage.getItem(this.internals.directPreferenceKey())!=="disabled"}async shouldAttemptDirect(e){if(!this.directEligible(e))return!1;if(this.directStatus==="available")return!0;if(this.directStatus==="unavailable"&&Date.now()<this.directRetryAt)return!1;let n=await $e();return n==="denied"?(this.setDirectStatus("denied"),!1):(n==="prompt"||n===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?(this.setDirectStatus("permission_required"),!1):(this.setDirectStatus("checking"),!0)}async probeDirectAccess(e){this.setDirectStatus("checking");try{let n=await fetch(`${this.loopbackUrl}/v1/ready`,le({method:"GET",cache:"no-store",signal:e})),i=await S(n,"invalid_operation_response","The connector returned an invalid readiness response.").catch(()=>null);if(n.ok&&i?.service==="mdbase-connect"&&i?.loopback_protocol_version===1&&i?.operation_transport_protocol_version===Z)return this.markDirectAvailable(),"available"}catch{}return await $e()==="denied"?this.setDirectStatus("denied"):(this.markDirectUnavailable(),"unavailable")}markDirectAvailable(){this.directFailures=0,this.directRetryAt=0,this.setDirectStatus("available")}markDirectUnavailable(){this.directFailures+=1,this.directRetryAt=Date.now()+Math.min(6e4,1e3*2**(this.directFailures-1)),this.setDirectStatus("unavailable")}setDirectStatus(e){return this.directStatus!==e&&(this.directStatus=e,this.emitConnection()),e}setRoute(e){this.currentRoute!==e&&(this.currentRoute=e,this.emitConnection())}emitConnection(){this.onChange()}invalidateRejectedAuthorization(e){let n=M(this.storage.getItem(this.internals.tokenKey(this.collectionId)));!n||!ci(n,e)||(this.internals.removeToken(this.collectionId,n.keyHandle),this.currentRoute="relay",this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection())}currentToken(){return to({stored:this.storage.getItem(this.internals.tokenKey(this.collectionId)),collectionId:this.collectionId,relayEncryption:this.internals.relayEncryption,invalidate:e=>this.internals.removeToken(this.collectionId,e,"invalid_stored_grant"),directCapable:e=>this.directCapable(e)})}async authorizedToken(e={}){let n=this.currentToken();if(!n)return null;if(n.expiresAt>Date.now()+3e4)return n;if(!n.refreshToken||(n.refreshExpiresAt??0)<=Date.now()){if(this.directCapable(n))throw l("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");return this.internals.removeToken(this.collectionId,n.keyHandle),null}return this.refreshAuthorization(e.signal)}refreshAuthorization(e){return this.refreshPromise?this.refreshPromise:(this.refreshPromise=this.performRefresh(e).finally(()=>{this.refreshPromise=null}),this.refreshPromise)}async performRefresh(e){let n=this.currentToken();if(!n?.refreshToken)throw l("not_authorized","Reconnect this application to continue.");if((n.refreshExpiresAt??0)<=Date.now())throw l("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");let i=n.refreshToken,o=`${this.serverUrl}/oauth/token`,r=new URLSearchParams({grant_type:"refresh_token",refresh_token:n.refreshToken,client_id:n.clientId}).toString(),a=n.authority?await Ze(this.keyStore,n,"POST",o,r,n.refreshToken):{},s=await fetch(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...a},body:r,signal:e}),c=await S(s,"invalid_token_response","The authorization service returned an invalid token response.");if(!s.ok){let d=this.currentToken();if(d?.refreshToken&&d.refreshToken!==i)return d;throw this.directCapable(n)||this.internals.removeToken(this.collectionId,n.keyHandle),(Ge(c)??c?.error?.code)==="invalid_grant"?l("authorization_expired",c?.error_description??c?.error?.message??"Reconnect this application to continue.",{status:s.status}):A(c,"authorization_expired","Reconnect this application to continue.",s.status)}return this.storeTokenResponse(c,n.clientId,n.keyHandle)}storeTokenResponse(e,n,i){if(e.collection_id!==this.collectionId)throw l("collection_mismatch","The refreshed authorization belongs to a different collection.");let o=this.internals.storeTokenResponse(e,n,i);return this.currentRoute=o.authority?"remote":"relay",this.directStatus=o.authority||this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection(),o}storedPendingMutations(){return this.pendingMutationStore.list(this.currentToken()?.collectionId??null)}storedPendingMutation(e){return this.pendingMutationStore.find(this.currentToken()?.collectionId??null,e)}clearPendingMutation(e){let n=this.pendingMutationStore.take(e),i=this.currentToken()?.keyHandle;n?.keyHandle&&n.keyHandle!==i&&this.keyStore.delete(n.keyHandle).catch(()=>{})}};var ga=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_a=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),fe=class{state=_a.slice();block=new Uint8Array(64);words=new Uint32Array(64);blockLength=0;byteLength=0;finished=!1;update(e){if(this.finished)throw new Error("SHA-256 digest is already finalized.");if(this.byteLength+=e.byteLength,!Number.isSafeInteger(this.byteLength))throw new Error("SHA-256 input exceeds the safe browser byte range.");let n=0;if(this.blockLength>0){let i=Math.min(64-this.blockLength,e.byteLength);this.block.set(e.subarray(0,i),this.blockLength),this.blockLength+=i,n+=i,this.blockLength===64&&(this.compress(this.block),this.blockLength=0)}for(;n+64<=e.byteLength;)this.compress(e.subarray(n,n+64)),n+=64;return n<e.byteLength&&(this.block.set(e.subarray(n),0),this.blockLength=e.byteLength-n),this}digestHex(){if(this.finished)throw new Error("SHA-256 digest is already finalized.");this.finished=!0,this.block[this.blockLength]=128,this.block.fill(0,this.blockLength+1),this.blockLength>=56&&(this.compress(this.block),this.block.fill(0));let e=this.byteLength*8,n=Math.floor(e/4294967296),i=e>>>0;return no(this.block,56,n),no(this.block,60,i),this.compress(this.block),[...this.state].map(o=>o.toString(16).padStart(8,"0")).join("")}compress(e){let n=this.words;for(let u=0;u<16;u+=1){let f=u*4;n[u]=(e[f]<<24|e[f+1]<<16|e[f+2]<<8|e[f+3])>>>0}for(let u=16;u<64;u+=1){let f=n[u-15],h=n[u-2],m=H(f,7)^H(f,18)^f>>>3,y=H(h,17)^H(h,19)^h>>>10;n[u]=n[u-16]+m+n[u-7]+y>>>0}let i=this.state[0],o=this.state[1],r=this.state[2],a=this.state[3],s=this.state[4],c=this.state[5],d=this.state[6],p=this.state[7];for(let u=0;u<64;u+=1){let f=H(s,6)^H(s,11)^H(s,25),h=s&c^~s&d,m=p+f+h+ga[u]+n[u]>>>0,y=H(i,2)^H(i,13)^H(i,22),v=i&o^i&r^o&r,g=y+v>>>0;p=d,d=c,c=s,s=a+m>>>0,a=r,r=o,o=i,i=m+g>>>0}this.state[0]=this.state[0]+i>>>0,this.state[1]=this.state[1]+o>>>0,this.state[2]=this.state[2]+r>>>0,this.state[3]=this.state[3]+a>>>0,this.state[4]=this.state[4]+s>>>0,this.state[5]=this.state[5]+c>>>0,this.state[6]=this.state[6]+d>>>0,this.state[7]=this.state[7]+p>>>0}};function H(t,e){return t>>>e|t<<32-e}function no(t,e,n){t[e]=n>>>24,t[e+1]=n>>>16,t[e+2]=n>>>8,t[e+3]=n}var qt=class{constructor(e,n){this.signal=n;this.iterator=ba(e)}signal;iterator;remainder=new Uint8Array;remainderOffset=0;maxSourceChunkBytes=null;iteratorClosing=!1;ended=!1;setMaxSourceChunkBytes(e){this.maxSourceChunkBytes=e}async read(e){let n=new Uint8Array(e),i=0;for(;i<e;){if(this.remainderOffset===this.remainder.byteLength){let r=await this.nextSourceChunk();if(r.done)throw this.ended=!0,l("invalid_request","Streamed file bytes ended before the declared size.");if(!(r.value instanceof Uint8Array))throw l("invalid_request","A streamed file chunk was not a Uint8Array.");if(this.maxSourceChunkBytes===null)throw new Error("Stream source was read before upload negotiation completed.");if(r.value.byteLength>this.maxSourceChunkBytes)throw l("invalid_request",`A streamed file chunk exceeded the negotiated ${this.maxSourceChunkBytes}-byte upload part size.`);if(this.remainder=r.value,this.remainderOffset=0,this.remainder.byteLength===0)continue}let o=Math.min(e-i,this.remainder.byteLength-this.remainderOffset);n.set(this.remainder.subarray(this.remainderOffset,this.remainderOffset+o),i),i+=o,this.remainderOffset+=o}return n}async expectEnd(){if(this.remainderOffset<this.remainder.byteLength)throw l("invalid_request","Streamed file bytes exceed the declared size.");for(;!this.ended;){let e=await this.nextSourceChunk();if(e.done){this.ended=!0;return}if(!(e.value instanceof Uint8Array))throw l("invalid_request","A streamed file chunk was not a Uint8Array.");if(e.value.byteLength>0)throw l("invalid_request","Streamed file bytes exceed the declared size.")}}async close(){this.ended=!0,this.closeIterator()}async nextSourceChunk(){io(this.signal);let e=this.iterator.next(),n=this.signal;if(!n)return e;let i=()=>{},o=new Promise((r,a)=>{let s=()=>{this.closeIterator(),a(oo(n))};n.addEventListener("abort",s,{once:!0}),i=()=>n.removeEventListener("abort",s),n.aborted&&s()});try{let r=await Promise.race([e,o]);return io(n),r}finally{i()}}closeIterator(){if(!this.iteratorClosing){this.iteratorClosing=!0;try{this.iterator.return?.()?.catch(()=>{})}catch{}}}};function ba(t){if(typeof t.getReader=="function"){let n=t.getReader(),i=!1,o=()=>{i||(i=!0,n.releaseLock())};return{async next(){if(i)return{done:!0,value:void 0};let r=await n.read();return r.done&&o(),r},async return(){if(!i)try{await n.cancel()}finally{o()}return{done:!0,value:void 0}}}}let e=t;if(typeof e[Symbol.asyncIterator]!="function")throw l("invalid_request","Streamed files require a readable byte stream.");return e[Symbol.asyncIterator]()}function io(t){if(t?.aborted)throw oo(t)}function oo(t){return l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t?.reason})}var ro=1024*1024,va=4,ao=8,he=3,gn=64*1024*1024,so=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu,co=/^sha256:[0-9a-f]{64}$/u;async function lo(t,e,n){let i=new fe;for(let o=0;o<t.size;o+=ro){ie(e);let r=new Uint8Array(await t.slice(o,o+ro).arrayBuffer());i.update(r),n(Math.min(t.size,o+r.byteLength))}return t.size===0&&n(0),i.digestHex()}function uo(t,e){if(t instanceof Blob)return e&&e!==t.type?t.slice(0,t.size,e):t;if(t instanceof ArrayBuffer)return new Blob([t],{type:e});let n=new Uint8Array(t.byteLength);return n.set(new Uint8Array(t.buffer,t.byteOffset,t.byteLength)),new Blob([n.buffer],{type:e})}function po(t){return t instanceof Blob?t.size:t.byteLength}async function fo(t){return t instanceof Blob?new Uint8Array(await t.arrayBuffer()):t}function _n(t=va){if(!Number.isInteger(t)||t<1||t>ao)throw l("invalid_request",`File concurrency must be between 1 and ${ao}.`);return t}function ho(t){if(!Number.isInteger(t)||t<1||t>1e3)throw l("invalid_request","File page size must be between 1 and 1000.");return t}function bn(t,e,n){if(t.protocol_version!==1||t.type!=="file_transfer"||t.transfer_id!==e||t.direction!==n||!Number.isSafeInteger(t.total_size)||t.total_size<0||!Array.isArray(t.received)||!Ca(t))throw l("invalid_operation_response","The authority returned an invalid file transfer session.");let i=t.strategy.kind==="framed_chunks"?t.strategy.chunk_size:t.strategy.kind==="object_put"?Math.max(1,t.total_size):t.strategy.part_size,o=t.strategy.kind==="object_put"?1:Math.ceil(t.total_size/i);if(new Set(t.received).size!==t.received.length||t.received.some(a=>!Number.isSafeInteger(a)||a<0||a>=o))throw l("invalid_operation_response","The authority returned invalid transfer progress.");let r=t.uploaded_parts??[];if(!Array.isArray(r)||r.some((a,s)=>!Number.isSafeInteger(a?.part_number)||a.part_number<1||a.part_number>o||typeof a.etag!="string"||a.etag.length===0||a.etag.length>255||s>0&&r[s-1].part_number>=a.part_number)||(t.strategy.kind==="object_multipart"?r.length!==t.received.length||r.some((a,s)=>a.part_number-1!==t.received[s]):r.length!==0))throw l("invalid_operation_response","The authority returned invalid uploaded part receipts.")}function yo(t,e){let n=e.strategy.kind==="framed_chunks"?e.strategy.chunk_size:e.strategy.kind==="object_put"?Math.max(1,e.total_size):e.strategy.part_size,i=e.strategy.kind==="object_put"?1:Math.ceil(e.total_size/n);if(t?.protocol_version!==1||t.type!=="file_transfer_status"||t.transfer_id!==e.transfer_id||!["open","committed","aborted","expired"].includes(t.state)||!Array.isArray(t.received)||new Set(t.received).size!==t.received.length||t.received.some(r=>!Number.isSafeInteger(r)||r<0||r>=i)||!Number.isSafeInteger(t.received_bytes)||t.received_bytes<0||t.received_bytes>e.total_size||t.received.reduce((r,a)=>r+vn(e.total_size,n,a),0)!==t.received_bytes)throw l("invalid_operation_response","The authority returned invalid transfer status.");let o=t.uploaded_parts;if(!Array.isArray(o)||o.some((r,a)=>!Number.isSafeInteger(r?.part_number)||r.part_number<1||r.part_number>i||typeof r.etag!="string"||r.etag.length===0||r.etag.length>255||a>0&&o[a-1].part_number>=r.part_number)||(e.strategy.kind==="object_multipart"?o.length!==t.received.length||o.some((r,a)=>r.part_number-1!==t.received[a]):o.length!==0))throw l("invalid_operation_response","The authority returned invalid uploaded part status.")}function Ca(t){return t.strategy.kind==="framed_chunks"?t.protection==="grant_aead_v1"&&Number.isSafeInteger(t.strategy.chunk_size)&&t.strategy.chunk_size>0:t.protection!=="transport_tls"?!1:t.strategy.kind==="object_put"?!0:Number.isSafeInteger(t.strategy.part_size)&&t.strategy.part_size>0}function vn(t,e,n){return Math.min(e,Math.max(0,t-n*e))}async function Ft(t,e){for(let n=1;n<=he;n+=1){ie(e);try{return await t()}catch(i){if(e?.aborted||n===he)throw i}}throw new Error("Unreachable file chunk retry state.")}function mo(t,e,n,i,o,r){let a;try{a=new URL(t.url)}catch{throw l("invalid_operation_response","The authority returned an invalid object URL.")}if(t.protocol_version!==1||t.type!=="file_part"||t.transfer_id!==e||t.part_index!==n||t.offset!==i||t.content_length!==o||t.method.toUpperCase()!==r||a.protocol!=="https:"&&!(a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))||a.username||a.password)throw l("invalid_operation_response","The authority returned an invalid prepared file part.")}function go(t){let e=new Headers;for(let[n,i]of Object.entries(t))["host","content-length"].includes(n.toLowerCase())||e.set(n,i);return e}async function _o(t,e,n){let i=new Array(t),o=0;return await Promise.all(Array.from({length:Math.min(t,e)},async()=>{for(;o<t;){let r=o;o+=1,i[r]=await n(r)}})),i}function ie(t){if(t?.aborted)throw l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t.reason})}function xe(t){return t instanceof b?t:typeof DOMException<"u"&&t instanceof DOMException&&t.name==="AbortError"?l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t}):l("temporarily_unavailable","The file transfer could not be completed.",{cause:t})}var Ee=class{constructor(e,n,i,o,r=ge()){this.capability=e;this.request=n;this.framed=i;this.hosted=o;this.timeouts=r}capability;request;framed;hosted;timeouts;async*list(e={}){let n=te(e,this.timeouts.requestMs),i=n.signal;try{this.requireAction("list");let o;do{ie(i);let r=new URLSearchParams({protocol_version:String(1),...e.folder?{folder:e.folder}:{},...o?{after:o}:{},...e.pageSize?{limit:String(ho(e.pageSize))}:{}}),a=await this.request("GET",`?${r.toString()}`,void 0,i);if(a.protocol_version!==1||a.type!=="files_page"||!Array.isArray(a.files))throw l("invalid_operation_response","The authority returned an invalid file page.");for(let s of a.files)ie(i),yield zt(s);o=a.next}while(o)}finally{n.dispose()}}async upload(e,n,i={}){return N(i,this.timeouts.uploadMs,o=>this.uploadWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async uploadWithinBudget(e,n,i){this.requireAction(i.ifRevision?"replace":"add");let o=uo(n,i.mediaType),r=_n(i.concurrency),a=await lo(o,i.signal,s=>{i.onProgress?.({phase:"hashing",transferredBytes:s,totalBytes:o.size})});return this.uploadKnownSource(e,o.size,`sha256:${a}`,(i.mediaType??o.type)||void 0,i,r,async(s,c,d)=>o.slice(c,c+d))}async uploadStream(e,n,i={}){return N(i,this.timeouts.uploadMs,o=>this.uploadStreamWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async uploadStreamWithinBudget(e,n,i){if(this.requireAction(i.ifRevision?"replace":"add"),!Number.isSafeInteger(n.size)||n.size<0)throw l("invalid_request","Streamed file size must be a non-negative safe integer.");if(!co.test(n.contentDigest))throw l("invalid_request","Streamed files require a lowercase SHA-256 content digest.");let o=new qt(n.stream,i.signal),r=new fe;return this.uploadKnownSource(e,n.size,n.contentDigest,i.mediaType??n.mediaType,i,1,async(a,s,c)=>{let d=await o.read(c);return r.update(d),d},async()=>{if(await o.expectEnd(),`sha256:${r.digestHex()}`!==n.contentDigest)throw l("invalid_request","Streamed file bytes do not match the declared SHA-256 digest.")},()=>o.close(),a=>o.setMaxSourceChunkBytes(a))}async uploadKnownSource(e,n,i,o,r,a,s,c,d,p){let u=r.transferId??crypto.randomUUID();if(!so.test(u))throw l("invalid_request","File transfer ID must be a UUID.");let f=!1;try{let h=await this.request("POST","uploads",{protocol_version:1,type:"open_file_upload",transfer_id:u,path:e,size:n,content_digest:i,...o?{media_type:o}:{},...r.ifRevision?{if_revision:r.ifRevision}:{}},r.signal);if(bn(h,u,"upload"),h.total_size!==n||h.strategy.kind==="object_ranges")throw l("invalid_operation_response","The authority returned an incompatible upload strategy.");let m=h.strategy.kind==="framed_chunks";if(m&&!this.framed)throw l("invalid_operation_response","Encrypted file chunk delivery is unavailable.");let y=h.strategy.kind==="object_put"?Math.max(1,n):h.strategy.kind==="framed_chunks"?h.strategy.chunk_size:h.strategy.part_size,v=h.strategy.kind==="object_put"?1:Math.ceil(n/y),g=await this.request("GET",`transfers/${encodeURIComponent(u)}`,void 0,r.signal);if(yo(g,h),g.state!=="open"&&g.state!=="committed")throw l("invalid_operation_response",`The authority cannot resume a ${g.state} file transfer.`);if(p?.(y),!m&&g.received.length===v){let z=await this.tryReplayUploadCommit(u,h.strategy.kind==="object_multipart"?g.uploaded_parts:void 0,r.signal);if(z)return f=!0,zt(z.file)}let _=new Set(g.received),O=new Map(g.uploaded_parts.map(z=>[z.part_number-1,z])),D=[..._].reduce((z,Fe)=>z+vn(n,y,Fe),0),L=await _o(v,a,async z=>{let Fe=z*y,et=Math.min(y,Math.max(0,n-Fe)),Kt=await s(z,Fe,et);if(po(Kt)!==et)throw l("invalid_request","Streamed file bytes ended before the declared size.");if(_.has(z))return O.get(z)??null;let Ro=m?await Ft(async()=>this.framed.uploadChunk(h,z,await fo(Kt),r.signal),r.signal).then(()=>null):await this.uploadPart(u,z,Fe,Kt,et,h.strategy.kind==="object_multipart",r.signal);return D+=et,r.onProgress?.({phase:"uploading",transferredBytes:D,totalBytes:n}),Ro});await c?.();let R=await this.commitUpload(u,h.strategy.kind==="object_multipart"?L.filter(z=>z!==null):void 0,r.signal);if(R.protocol_version!==1||R.type!=="file_upload_committed"||R.transfer_id!==u||R.file.path!==e||R.file.size!==n||R.file.content_digest!==i)throw l("invalid_operation_response","The authority returned an invalid file receipt.");return f=!0,zt(R.file)}catch(h){throw xe(h)}finally{await d?.().catch(()=>{}),!f&&r.transferId===void 0&&await this.abort(u)}}async download(e,n={}){if(e.size>gn)throw l("invalid_request",`download() buffers at most ${gn} bytes; use downloadStream() for larger files.`);let i=await this.downloadStream(e,n),o=[],r=i.getReader();for(;;){let a=await r.read();if(a.done)break;o.push(a.value)}return new Blob(o.map(a=>{let s=new Uint8Array(a.byteLength);return s.set(a),s.buffer}),{type:e.mediaType??""})}async downloadStream(e,n={}){return N(n,this.timeouts.requestMs,i=>this.openDownloadStream(e,n,i.signal))}async openDownloadStream(e,n,i){this.requireAction("read"),_n(n.concurrency);let o=crypto.randomUUID(),r;try{if(r=await this.request("POST","downloads",{protocol_version:1,type:"open_file_download",transfer_id:o,file_id:e.fileId,revision:e.revision},i),bn(r,o,"download"),r.total_size!==e.size||r.strategy.kind!=="object_ranges"&&r.strategy.kind!=="framed_chunks")throw l("invalid_operation_response","The authority returned an incompatible download session.");if(r.strategy.kind==="framed_chunks"&&!this.framed)throw l("invalid_operation_response","Encrypted file chunk delivery is unavailable.");if(r.strategy.kind==="object_ranges"&&e.size>0&&!this.hosted)throw l("invalid_operation_response","Authenticated hosted file delivery is unavailable.")}catch(v){throw await this.abort(o),xe(v)}let a=r.strategy.kind==="framed_chunks"?r.strategy.chunk_size:r.strategy.part_size,s=Math.ceil(e.size/a),c=new fe,d=0,p=0,u=null,f=0,h=!1,m=async()=>{h||(h=!0,await u?.cancel().catch(()=>{}),u=null,await this.abort(o))},y=()=>{if(f!==e.size||`sha256:${c.digestHex()}`!==e.contentDigest)throw l("invalid_operation_response","Downloaded file bytes failed integrity verification.")};return new ReadableStream({pull:async v=>{try{if(ie(n.signal),r.strategy.kind==="object_ranges")for(;;){if(!u){if(d>=s){y(),await m(),v.close();return}let L=d*a;p=Math.min(a,e.size-L),u=(await Ft(()=>this.hosted.downloadPart(r,d,p,n.signal),n.signal)).getReader()}let D=await u.read();if(D.done){if(u.releaseLock(),u=null,p!==0)throw l("invalid_operation_response","A hosted file range ended before its declared byte length.");d+=1;continue}if(!(D.value instanceof Uint8Array))throw l("invalid_operation_response","A hosted file range returned a non-byte chunk.");if(D.value.byteLength!==0){if(D.value.byteLength>p)throw l("invalid_operation_response","A hosted file range exceeded its declared byte length.");p-=D.value.byteLength,c.update(D.value),f+=D.value.byteLength,n.onProgress?.({phase:"downloading",transferredBytes:f,totalBytes:e.size}),v.enqueue(D.value);return}}if(d>=s){y(),await m(),v.close();return}let g=d*a,_=Math.min(a,e.size-g),O=await Ft(()=>this.framed.downloadChunk(r,d,n.signal),n.signal);if(O.byteLength!==_)throw l("invalid_operation_response","A file chunk had the wrong byte length.");c.update(O),f+=O.byteLength,d+=1,n.onProgress?.({phase:"downloading",transferredBytes:f,totalBytes:e.size}),d===s&&y(),v.enqueue(O),d===s&&(await m(),v.close())}catch(g){await m(),v.error(xe(g))}},cancel:m})}async downloadBytes(e,n={}){return new Uint8Array(await(await this.download(e,n)).arrayBuffer())}async move(e,n,i={}){return N(i,this.timeouts.requestMs,o=>this.moveWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async moveWithinBudget(e,n,i){this.requireAction("move");let o=i.mutationId??crypto.randomUUID(),r;try{r=await this.request("POST",`${encodeURIComponent(e.fileId)}/move`,{protocol_version:1,type:"move_file",mutation_id:o,file_id:e.fileId,if_revision:i.ifRevision??e.revision,from_path:e.path,path:n,update_references:!1},i.signal)}catch(a){throw xe(a)}if(r.protocol_version!==1||r.type!=="file_moved"||r.mutation_id!==o||r.file.file_id!==e.fileId||r.file.path!==n)throw l("invalid_operation_response","The authority returned an invalid file move receipt.");return zt(r.file)}async delete(e,n={}){return N(n,this.timeouts.requestMs,i=>this.deleteWithinBudget(e,{...n,signal:i.signal,timeoutMs:null}))}async deleteWithinBudget(e,n){this.requireAction("delete");let i=n.mutationId??crypto.randomUUID(),o;try{o=await this.request("POST",`${encodeURIComponent(e.fileId)}/delete`,{protocol_version:1,type:"delete_file",mutation_id:i,file_id:e.fileId,if_revision:n.ifRevision??e.revision,path:e.path},n.signal)}catch(r){throw xe(r)}if(o.protocol_version!==1||o.type!=="file_deleted"||o.mutation_id!==i||o.file_id!==e.fileId||o.previous_path!==e.path)throw l("invalid_operation_response","The authority returned an invalid file delete receipt.");return{protocolVersion:o.protocol_version,type:o.type,mutationId:o.mutation_id,fileId:o.file_id,previousPath:o.previous_path,revision:o.revision}}async uploadPart(e,n,i,o,r,a,s){for(let c=1;c<=he;c+=1){ie(s);try{let d=await this.request("POST",`uploads/${encodeURIComponent(e)}/parts`,{protocol_version:1,type:"prepare_file_upload_part",transfer_id:e,part_number:n+1,content_length:r},s);mo(d,e,n,i,r,"PUT");let p=await fetch(d.url,{method:d.method,headers:go(d.headers),body:o,redirect:"error",signal:s});if(!p.ok)throw new Error(`Object upload failed with HTTP ${p.status}.`);let u=p.headers.get("etag");if(a&&!u)throw new Error("Multipart object upload did not return an ETag.");return{part_number:n+1,etag:u??""}}catch(d){if(s?.aborted||c===he)throw d}}throw new Error("Unreachable upload retry state.")}async tryReplayUploadCommit(e,n,i){try{return await this.commitUpload(e,n,i)}catch(o){if(o instanceof b&&o.code==="file_upload_incomplete")return null;throw o}}async commitUpload(e,n,i){let o;for(let r=1;r<=he;r+=1){ie(i);try{return await this.request("POST",`uploads/${encodeURIComponent(e)}/commit`,{protocol_version:1,type:"commit_file_upload",transfer_id:e,...n===void 0?{}:{parts:n}},i)}catch(a){if(o=a,i?.aborted||a instanceof b||r===he)throw a}}throw o}requireAction(e){if(!this.capability()?.actions.includes(e))throw l("not_authorized",`This connection is not authorized to ${e} files.`)}async abort(e){await this.request("DELETE",`transfers/${encodeURIComponent(e)}`).catch(()=>{})}};function zt(t){return{fileId:t.file_id,path:t.path,revision:t.revision,contentDigest:t.content_digest,size:t.size,...t.media_type?{mediaType:t.media_type}:{},mediaClass:t.media_class,modifiedAt:t.modified_at}}var De=class{constructor(e,n){this.internals=e;this.collectionId=n;this.transport=new Dt({serverUrl:e.serverUrl,storage:e.storage,keyStore:e.keyStore,directAccessMode:e.directAccessMode,loopbackUrl:e.loopbackUrl,collectionId:n,internals:e,timeouts:e.timeouts,onChange:()=>this.emitConnection()}),this.files=new Ee(()=>this.fileCapability,(i,o,r,a)=>this.transport.files.control(i,o,r,a),{uploadChunk:(i,o,r,a)=>this.transport.files.uploadChunk(i,o,r,a),downloadChunk:(i,o,r)=>this.transport.files.downloadChunk(i,o,r)},{downloadPart:(i,o,r,a)=>this.transport.files.downloadHostedPart(i,o,r,a)},e.timeouts),this.collectionClient=new ke({operation:(i,o,r)=>this.transport.performOperation(i,o,r)},e.timeouts.requestMs),this.notifications=new Pt({serverUrl:e.serverUrl,storage:e.storage,authorizedToken:i=>this.transport.authorizedToken({signal:i,timeoutMs:null}),register:i=>this.internals.register({signal:i,timeoutMs:null}),notificationKey:i=>e.notificationKey(n,i),requestTimeoutMs:e.timeouts.requestMs})}internals;collectionId;collectionClient;notifications;transport;files;connectionListeners=new Set;get displayName(){return this.transport.currentToken()?.collectionName??`Collection ${this.collectionId.slice(0,8)}`}get operations(){return[...this.transport.currentToken()?.operations??[]]}get scope(){return this.transport.currentToken()?.scope??null}get fileCapability(){return this.transport.currentToken()?.fileCapability??null}get directAccess(){return this.transport.directAccess}get route(){return this.transport.route}register(e){return I(()=>this.internals.register(e),se)}info(){let e=this.transport.currentToken();return e?{collectionId:e.collectionId,displayName:e.collectionName,operations:[...e.operations],scope:e.scope,...e.fileCapability?{fileCapability:e.fileCapability}:{},authority:e.authority?{kind:"hosted",durability:"provider"}:{kind:"connector",durability:"computer"},route:this.transport.route,directAccess:this.transport.directAccess}:null}authorizationCapabilities(e=ue){let n=this.operations,i=K(e).filter(o=>!n.includes(o));return{authorized:this.info()!==null,sufficient:this.info()!==null&&i.length===0,collectionId:this.collectionId,grantedOperations:n,missingOperations:i}}hasOperations(e){return this.authorizationCapabilities(e).sufficient}authorize(e={}){return I(()=>this.internals.authorize({...e,target:{kind:"collection",collectionId:this.collectionId}}),me)}async requestOperations(e,n={}){let i=this.authorizationCapabilities(e);return i.sufficient?k({kind:"unchanged",connection:this}):this.authorize({...n,operations:K([...i.grantedOperations,...i.missingOperations])})}onConnectionChange(e){return this.connectionListeners.add(e),e(this.info()),()=>this.connectionListeners.delete(e)}notifyStorageChanged(){this.transport.notifyStorageChanged()}checkDirectAccess(e){return I(()=>this.transport.checkDirectAccess(e),en)}requestDirectAccess(e){return I(()=>this.transport.requestDirectAccess(e),en)}disableDirectAccess(){this.transport.disableDirectAccess()}sync(){let e=this.transport.currentToken();if(!e)return null;let n=e.collectionId;if(!e.authority){if(!e.grantId||!e.operations.includes("sync"))return null;let o=e.grantId;return{collectionId:n,replicaId:o,transport:{openSession:r=>this.transport.performOperation("sync",{action:"open_session"},Ut(r,this.internals.timeouts.syncMs)),snapshot:(r,a,s)=>this.transport.performOperation("sync",{action:"snapshot",snapshot_id:r,...a?{page:a}:{}},Ut(s,this.internals.timeouts.syncMs)),changes:(r,a=200,s)=>this.transport.performOperation("sync",{action:"changes",after:r,limit:a},Ut(s,this.internals.timeouts.syncMs)),mutate:(r,a)=>this.transport.performOperation("sync",{action:"mutate",mutation:r},Ut(a,this.internals.timeouts.syncMs))}}}let i=e.authority.replicaId;return{collectionId:n,replicaId:i,transport:{openSession:o=>this.transport.performAuthoritySyncRequest(n,i,"POST","sessions",void 0,o),snapshot:(o,r,a)=>{let s=new URLSearchParams({snapshot_id:o});return r&&s.set("page",r),this.transport.performAuthoritySyncRequest(n,i,"GET",`snapshot?${s}`,void 0,a)},changes:(o,r=200,a)=>this.transport.performAuthoritySyncRequest(n,i,"GET",`changes?${new URLSearchParams({after:String(o),limit:String(r)})}`,void 0,a),mutate:(o,r)=>this.transport.performAuthoritySyncRequest(n,i,"POST","mutations",o,r)}}}registerNotifications(e){return I(()=>this.notifications.registerNotifications(e),je)}registerNativeNotifications(e){return I(()=>this.notifications.registerNativeNotifications(e),je)}unregisterNativeNotifications(e){return I(()=>this.notifications.unregisterNativeNotifications(e),je)}unregisterNotifications(e,n){return I(()=>this.notifications.unregisterNotifications(e,n),je)}forget(){let e=this.transport.currentToken();this.internals.removeToken(this.collectionId,e?.keyHandle,"not_authorized",!0),this.transport.notifyStorageChanged()}describe(e){return this.collectionClient.describe(e)}changes(e={},n){return this.collectionClient.changes(e,n)}read(e,n){return this.collectionClient.read(e,n)}query(e={},n){return this.collectionClient.query(e,n)}queryPages(e={},n={}){return this.collectionClient.queryPages(e,n)}queryAll(e={},n={}){return this.collectionClient.queryAll(e,n)}listViews(e){return this.collectionClient.listViews(e)}executeView(e,n){return this.collectionClient.executeView(e,n)}readViewSource(e,n){return this.collectionClient.readViewSource(e,n)}createViewSource(e,n){return this.collectionClient.createViewSource(e,n)}updateViewSource(e,n){return this.collectionClient.updateViewSource(e,n)}deleteViewSource(e,n){return this.collectionClient.deleteViewSource(e,n)}create(e,n){return this.collectionClient.create(e,n)}update(e,n){return this.collectionClient.update(e,n)}delete(e,n){return this.collectionClient.delete(e,n)}preflightDelete(e,n){return this.collectionClient.preflightDelete(e,n)}rename(e,n){return this.collectionClient.rename(e,n)}preflightRename(e,n){return this.collectionClient.preflightRename(e,n)}async renameWithProgress(e,n={}){return N(n,this.internals.timeouts.requestMs,async i=>{let o=Date.now(),r=!1,a,s=(c,d,p=0)=>{n.onProgress?.({operation:"rename",state:c,elapsedMs:Date.now()-o,cancellable:d,resumed:r,completedUnits:p,...a?{estimate:a}:{}})};try{de(i.signal),s("preflighting",!0);let c=n.preflight?k(n.preflight):await this.preflightRename(e,{signal:i.signal,timeoutMs:null});if(!c.ok)return c;let d=c.value;try{li(e,d)}catch(f){if(f instanceof b)return P(f.problem);throw f}a=ui(e,d),s("ready",!0),de(i.signal);let p=this.transport.hasResumableMutationTransport();s("applying",p);let u=await this.rename(e,p?{signal:i.signal,timeoutMs:null}:{timeoutMs:bo(i.remainingMs())});return u.ok&&s("completed",!1,a.totalUnits),u}catch(c){if(an(c,i.signal)&&s("cancelled",!1),c instanceof b)return P(c.problem);throw c}})}async deleteWithProgress(e,n={}){return N(n,this.internals.timeouts.requestMs,async i=>{let o=Date.now(),r=!1,a,s=(c,d,p=0)=>{n.onProgress?.({operation:"delete",state:c,elapsedMs:Date.now()-o,cancellable:d,resumed:r,completedUnits:p,...a?{estimate:a}:{}})};try{de(i.signal),s("preflighting",!0);let c=n.preflight?k(n.preflight):await this.preflightDelete(e,{signal:i.signal,timeoutMs:null});if(!c.ok)return c;let d=c.value;try{di(e,d)}catch(f){if(f instanceof b)return P(f.problem);throw f}a=pi(d),s("ready",!0),de(i.signal);let p=this.transport.hasResumableMutationTransport();s("applying",p);let u=await this.delete(e,p?{signal:i.signal,timeoutMs:null}:{timeoutMs:bo(i.remainingMs())});return u.ok&&s("completed",!1,a.totalUnits),u}catch(c){if(an(c,i.signal)&&s("cancelled",!1),c instanceof b)return P(c.problem);throw c}})}pendingMutations(){return this.transport.pendingMutations().map(e=>({...e,recover:n=>I(()=>this.recoverPendingMutation(e.requestId,n),q)}))}pendingMutation(e){let n=this.transport.pendingMutation(e);return n?{...n,recover:i=>I(()=>this.recoverPendingMutation(e,i),q)}:null}async recoverPendingMutation(e,n){let i=await this.transport.recoverPendingMutation(e,n);if(i&&typeof i=="object"&&"valid"in i){let o=i;if(!o.valid)throw new b(ye(o));return o.result}return i}validate(e={},n){return this.collectionClient.validate(e,n)}readType(e,n){return this.collectionClient.readType(e,n)}createType(e,n){return this.collectionClient.createType(e,n)}updateType(e,n){return this.collectionClient.updateType(e,n)}assessTypePack(e,n){return this.collectionClient.assessTypePack(e,n)}applyTypePack(e,n){return this.collectionClient.applyTypePack(e,n)}assessCollectionSetup(e,n){return this.collectionClient.assessCollectionSetup(e,n)}applyCollectionSetup(e,n){return this.collectionClient.applyCollectionSetup(e,n)}listTimers(e,n){return this.collectionClient.listTimers(e,n)}putTimer(e,n){return this.collectionClient.putTimer(e,n)}cancelTimer(e,n){return this.collectionClient.cancelTimer(e,n)}reconcileTimers(e,n){return this.collectionClient.reconcileTimers(e,n)}watch(e={},n={}){return I(()=>F(n,this.internals.timeouts.watchStartMs,async i=>{let o=await this.collectionClient.changes(e.cursor===void 0?{}:{after:e.cursor,limit:200},{signal:i.signal,timeoutMs:null});if(!o.ok)throw new b(o.problem);if(o.value.reset)throw new b(T("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again."));return new Cn(this.collectionClient,o.value.cursor,e,e.cursor===void 0?[]:o.value.events,this.internals.timeouts.watchStartMs)}),ft)}emitConnection(){let e=this.info();for(let n of this.connectionListeners)n(e)}},Cn=class{constructor(e,n,i,o,r){this.client=e;this.input=i;this.watchStartTimeoutMs=r;this.pendingChanges=[...o],this.currentStatus={state:"connected",cursor:n,recovered:!1};let a=i.lifetimeSignal;if(a?.aborted)this.close();else if(a){let s=()=>this.close();a.addEventListener("abort",s,{once:!0}),this.removeLifetimeAbort=()=>a.removeEventListener("abort",s)}this.controller.signal.aborted||this.run(n)}client;input;watchStartTimeoutMs;changes=new Set;statuses=new Set;problems=new Set;controller=new AbortController;removeLifetimeAbort;currentStatus;currentProblem=null;pendingChanges;get status(){return this.currentStatus}get problem(){return this.currentProblem}subscribe(e,n,i){this.changes.add(e),n&&(this.statuses.add(n),n(this.currentStatus)),i&&(this.problems.add(i),this.currentProblem&&i(this.currentProblem));for(let o of this.pendingChanges)e(o);return this.pendingChanges=[],()=>{this.changes.delete(e),n&&this.statuses.delete(n),i&&this.problems.delete(i)}}close(){if(this.controller.signal.aborted)return;this.controller.abort(),this.removeLifetimeAbort?.(),this.removeLifetimeAbort=void 0;let e="cursor"in this.currentStatus?this.currentStatus.cursor:void 0;this.publishStatus({state:"closed",...e===void 0?{}:{cursor:e}})}async run(e){let n=!0,i=this.client.watch({cursor:e,pollIntervalMs:this.input.pollIntervalMs,retry:this.input.retry,signal:this.controller.signal,timeoutMs:this.watchStartTimeoutMs,onStatus:o=>{if(n&&o.state==="connecting"){n=!1;return}n=!1,this.publishStatus(o)}});try{for await(let o of i){if(this.controller.signal.aborted)return;if(!o.ok){this.currentProblem=o.problem;for(let r of this.problems)r(o.problem);return}for(let r of this.changes)r(o.value)}}finally{this.controller.signal.aborted||this.close()}}publishStatus(e){this.currentStatus=e;for(let n of this.statuses)n(e)}};function Ut(t,e){return{...t,timeoutMs:t?.timeoutMs===void 0?e:t.timeoutMs}}function bo(t){return t===null?null:Math.max(1,Math.ceil(t))}function wn(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function qe(t,e,n){return t.reason instanceof b?t.reason:l("authorization_cancelled",e,{cause:n})}function vo({body:t,clientId:e,keyHandle:n,previous:i,defaultApplicationOrigin:o,pinConnectorIdentity:r}){let a=t.collection_id;if(typeof a!="string")throw l("invalid_token_response","Authorization returned no collection ID.");let s=bt(t.scope);if(!s)throw l("invalid_token_response","Authorization returned no valid collection scope.");if(t.authority&&!We(t.authority,a))throw l("invalid_token_response","Authorization returned an invalid remote authority capability.");if(t.authority&&t.encryption)throw l("invalid_token_response","Authorization returned conflicting collection transports.");if(t.file_capability!==null&&t.file_capability!==void 0&&!_t(t.file_capability))throw l("invalid_token_response","Authorization returned an invalid file capability.");if(t.encryption){try{W(t.encryption)}catch{throw l("invalid_token_response","Authorization returned an invalid encrypted relay binding.")}if(r(t.encryption.connector_id,t.encryption.connector_agreement_public_key),t.encryption.collection_id!==a||typeof t.grant_id!="string"||t.grant_id.length===0)throw l("invalid_token_response","Authorization returned an encrypted relay binding for another grant.")}if(i?.encryption&&t.encryption&&i.keyHandle&&i.keyHandle===n&&(i.grantId!==t.grant_id||i.encryption.connector_id!==t.encryption.connector_id||i.encryption.connector_agreement_public_key!==t.encryption.connector_agreement_public_key||i.encryption.application_agreement_public_key!==t.encryption.application_agreement_public_key))throw l("connector_identity_changed","The connector identity changed during authorization renewal. Reauthorize before sending collection data.");return{version:1,accessToken:t.access_token,refreshToken:t.refresh_token,clientId:e,collectionId:a,collectionName:t.collection_name??`Collection ${a.slice(0,8)}`,operations:t.operations,scope:s,expiresAt:Date.now()+t.expires_in*1e3,refreshExpiresAt:t.refresh_expires_in?Date.now()+t.refresh_expires_in*1e3:void 0,grantId:t.grant_id,encryption:t.encryption??void 0,fileCapability:t.file_capability??void 0,applicationOrigin:t.application_origin??o,keyHandle:n,savedAt:Date.now(),authority:t.authority?{operationsUrl:t.authority.operations_url,syncUrl:t.authority.sync_url,filesUrl:t.authority.files_url,replicaId:t.authority.replica_id,accessToken:t.authority.access_token,proofPublicKey:t.authority.proof_public_key}:void 0}}var Nt=class{serverUrl;manifest;manifestSource;redirectUri;storage;relayEncryption;keyStore;identityStore;directAccessMode;loopbackUrl;navigate;timeouts;credentialStorage;application=null;manifestPromise=null;completionPromises=new Map;connectionCache=new Map;listeners=new Set;invalidatedConnections=new Map;constructor(e){this.serverUrl=vi(String(e.serverUrl)),this.manifest=e.manifest instanceof URL?e.manifest.href:e.manifest??Ci(),this.manifestSource=typeof this.manifest=="string"?this.manifest:this.manifest.distribution==="portable"?`bundle:${this.manifest.id}:${Oi(this.manifest)}`:`bundle:${this.manifest.id}`;let n=Ai(this.manifest);this.redirectUri=e.redirectUri===void 0?typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"":wi():String(e.redirectUri),this.storage=e.storage??Pi(n),this.relayEncryption=e.relayEncryption??"required",this.keyStore=e.keyStore??(n?new be:new _e),this.identityStore=e.identityStore??(n?new Oe:new Ae),this.credentialStorage=e.storage||e.keyStore||e.identityStore?"custom":this.storage instanceof we?"memory":"persistent",this.directAccessMode=e.directAccess??"auto",this.loopbackUrl=mi(String(e.loopbackUrl??`http://127.0.0.1:${Hn}`)),this.navigate=e.navigate,this.timeouts=ge(e.timeouts),typeof window<"u"&&this.storage===window.localStorage&&window.addEventListener("storage",i=>{i.storageArea!==this.storage||!i.key?.startsWith(this.storagePrefix())||(this.connectionCache.get(Ri(i.key))?.notifyStorageChanged(),this.emitConnections())})}environment(){let e=typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"portable":this.application?.distribution??"web";return{distribution:e,applicationOrigin:e==="portable"?"null":this.defaultApplicationOrigin(),credentialStorage:this.credentialStorage}}register(e={}){return F(e,this.timeouts.requestMs,n=>this.registerWithinBudget(n.signal))}async registerWithinBudget(e){if(this.application)return this.application;let n=await J(`${this.serverUrl}/v1/apps/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({manifest:await this.manifestDeclaration({signal:e,timeoutMs:null})}),signal:e},"temporarily_unavailable","Application registration is temporarily unavailable."),i=await S(n,"invalid_operation_response","Connect returned an invalid application registration response.");if(!n.ok)throw A(i,"discovery_failed","Application discovery failed.",n.status);return this.application=i.application,this.application}manifestDeclaration(e={}){if(this.manifestPromise)return this.manifestPromise;let i=F(e,this.timeouts.requestMs,o=>this.loadManifest(o.signal)).catch(o=>{throw this.manifestPromise===i&&(this.manifestPromise=null),o});return this.manifestPromise=i,this.manifestPromise}async loadManifest(e){if(typeof this.manifest!="string")return this.manifest;let n=this.manifest,i;try{i=await fetch(n,{headers:{accept:"application/json"},signal:e})}catch(o){throw l("manifest_load_failed","The bundled application declaration could not be loaded.",{cause:o})}if(!i.ok)throw l("manifest_load_failed",`The bundled application declaration returned HTTP ${i.status}.`,{status:i.status});try{return await S(i,"invalid_application_manifest","The bundled application declaration is not valid JSON.")}catch(o){throw l("invalid_application_manifest","The bundled application declaration is not valid JSON.",{cause:o,details:{issues:[{path:"/",keyword:"json",message:"must be valid JSON",params:{}}]}})}}async authorize(e={}){return F(e,this.timeouts.requestMs,n=>this.authorizeWithinBudget({...e,signal:n.signal,timeoutMs:null}))}async authorizeWithinBudget(e){if(typeof location>"u"&&!this.navigate&&!e.openVerification)throw l("browser_required","Authorization navigation requires a browser environment.");let i=typeof this.manifest!="string"&&this.manifest.distribution==="portable"&&!e.openVerification&&!this.navigate&&typeof window<"u"?window.open("","mdbase-connect-authorization","popup,width=620,height=760"):null,o;try{o=await this.registerWithinBudget(e.signal)}catch(r){throw i?.close(),r}return o.distribution==="portable"?(e.openVerification&&i?.close(),this.authorizePortable(o,e,e.openVerification?null:i)):(i?.close(),this.authorizeWeb(o,e))}async authorizeWeb(e,n){let{verifier:i,challenge:o}=await Ve(),r=j(24),a=crypto.randomUUID(),s=n.target?.kind==="collection"?n.target.collectionId:void 0,c=`grant:${e.id}:${r}`,d=await this.keyStore.create(c),p;try{p=await this.loadApplicationIdentity(e)}catch(y){throw await this.keyStore.delete(c),y}let u=K(n.operations??ue),f=new Date,h=await Xe({protocol_version:Ue,authorization_id:a,application_id:e.id,application_declaration_id:wn(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Te(p),installation_signing_public_key:p.signingPublicKey,grant_agreement_public_key:d.agreementPublicKey,grant_signing_public_key:d.signingPublicKey,flow:"authorization_code",authorization_nonce:j(32),issued_at:f.toISOString(),expires_at:new Date(f.getTime()+600*1e3).toISOString(),redirect_uri:this.redirectUri,state:r,code_challenge:o,contracts:Qt(u,e.requirements?.files),requested_operations:u,...e.requirements?.files?{requested_files:e.requirements.files}:{},...s?{collection_id:s}:{}},p),m={version:1,verifier:i,state:r,clientId:e.id,redirectUri:this.redirectUri,relayEncryption:this.relayEncryption,collectionId:s,returnTo:n.returnTo,keyHandle:c,authorizationId:a,applicationAgreementPublicKey:d.agreementPublicKey,applicationSigningPublicKey:d.signingPublicKey};this.storage.setItem(this.pendingKey(r),JSON.stringify(m));try{let y=await fetch(`${this.serverUrl}/oauth/authorization_request`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,redirect_uri:this.redirectUri,code_challenge:o,code_challenge_method:"S256",state:r,operations:u.join(","),...s?{collection_id:s}:{},application_authorization:JSON.stringify(h)}),signal:n.signal}),v=await S(y,"invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(!y.ok)throw A(v,"device_authorization_failed","Application authorization could not be started.",y.status);if(typeof v.authorization_uri!="string"||v.authorization_id!==a||!Number.isInteger(v.expires_in)||v.expires_in<=0)throw l("invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(this.navigate)await this.navigate(v.authorization_uri);else if(typeof location<"u")location.assign(v.authorization_uri);else throw l("browser_required","Authorization navigation requires a browser environment.");return{kind:"redirecting"}}catch(y){throw this.storage.removeItem(this.pendingKey(r)),await this.keyStore.delete(c),n.signal?.aborted?qe(n.signal,"Application authorization was cancelled.",y):y}}async authorizePortable(e,n,i){if(this.relayEncryption!=="required")throw i?.close(),l("encryption_required","Downloaded applications require encrypted relay authorization.");let{verifier:o,challenge:r}=await Ve(),a=`grant:${e.id}:${j(24)}`,s=await this.keyStore.create(a),c;try{c=await this.loadApplicationIdentity(e)}catch(g){throw i?.close(),await this.keyStore.delete(a),g}let d=K(n.operations??ue),p=crypto.randomUUID(),u=new Date,f=await Xe({protocol_version:Ue,authorization_id:p,application_id:e.id,application_declaration_id:wn(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Te(c),installation_signing_public_key:c.signingPublicKey,grant_agreement_public_key:s.agreementPublicKey,grant_signing_public_key:s.signingPublicKey,flow:"device_code",authorization_nonce:j(32),issued_at:u.toISOString(),expires_at:new Date(u.getTime()+600*1e3).toISOString(),code_challenge:r,contracts:Qt(d,e.requirements?.files),requested_operations:d,...e.requirements?.files?{requested_files:e.requirements.files}:{},...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{}},c),h,m;try{h=await fetch(`${this.serverUrl}/oauth/device_authorization`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,operations:d.join(","),...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{},code_challenge:r,code_challenge_method:"S256",application_authorization:JSON.stringify(f)}),signal:n.signal}),m=await S(h,"invalid_device_authorization_response","The authorization service returned an invalid device authorization response.")}catch(g){throw i?.close(),await this.keyStore.delete(a),l("device_authorization_failed","Downloaded application authorization could not be started.",{cause:g})}if(!h.ok)throw i?.close(),await this.keyStore.delete(a),A(m,"device_authorization_failed","Downloaded application authorization could not be started.",h.status);let y;try{y=bi(m)}catch(g){throw i?.close(),await this.keyStore.delete(a),n.signal?.aborted?qe(n.signal,"Downloaded application authorization was cancelled.",g):g}if(n.onDeviceCode?.(y),n.openVerification)await n.openVerification(y);else if(i)try{i.location.href=y.verificationUriComplete}catch{}else throw await this.keyStore.delete(a),l("approval_window_blocked","The approval window was blocked. Show the provided verification link and code, then try again.",{details:{user_code:y.userCode,verification_uri:y.verificationUri,verification_uri_complete:y.verificationUriComplete,expires_at:y.expiresAt,interval_seconds:y.intervalSeconds}});let v=y.intervalSeconds;try{for(;Date.now()<y.expiresAt;){if(await Qe(v*1e3,n.signal),n.signal?.aborted)throw qe(n.signal,"Downloaded application authorization was cancelled.");let g;try{g=await fetch(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:m.device_code,client_id:e.id,code_verifier:o}),signal:n.signal})}catch(R){if(n.signal?.aborted)throw qe(n.signal,"Downloaded application authorization was cancelled.",R);continue}let _=await S(g,"invalid_token_response","The authorization service returned an invalid token response.");if(!g.ok){let R=Ge(_);if(R==="authorization_pending")continue;if(R==="slow_down"){v+=5;continue}throw A(_,"token_exchange_failed","Downloaded application authorization could not be completed.",g.status)}let O=We(_.authority,_.collection_id),D=_.encryption&&_.encryption.protocol_version===dt&&_.encryption.suite===Le&&_.encryption.application_agreement_public_key===s.agreementPublicKey;if(_.application_origin!=="null")throw l("invalid_token_response","Authorization did not bind the portable grant to its opaque application origin.");if(_.authority&&(!O||_.encryption!=null||_.authority.proof_public_key!==s.signingPublicKey))throw l("invalid_token_response","Authorization returned a remote authority capability that is not bound to this portable grant key.");if(!_.authority&&!D)throw l("encryption_required","Authorization did not establish the expected key-bound local portable grant.");let L=this.storeTokenResponse(_,e.id,a);if(n.target?.kind==="collection"&&n.target.collectionId!==L.collectionId)throw this.removeToken(L.collectionId,L.keyHandle),l("collection_mismatch","The approved collection does not match the collection requested by this link.");return i?.close(),{kind:"connected",connection:this.connection(L.collectionId),...n.returnTo?{returnTo:n.returnTo}:{}}}throw l("expired_token","The downloaded application authorization code expired.")}catch(g){throw i?.close(),await this.keyStore.delete(a),n.signal?.aborted?qe(n.signal,"Downloaded application authorization was cancelled.",g):g}}completeAuthorization(e,n={}){return F(n,this.timeouts.requestMs,i=>this.completeAuthorizationWithinBudget(e,i.signal))}completeAuthorizationWithinBudget(e,n){let i=new URL(e).searchParams.get("state");if(!i)return Promise.reject(l("invalid_callback","Authorization callback is missing its state."));let o=this.completionPromises.get(i);if(o)return o;let a=this.performAuthorizationCompletion(e,i,n).finally(()=>{this.completionPromises.get(i)===a&&this.completionPromises.delete(i)});return this.completionPromises.set(i,a),a}async performAuthorizationCompletion(e,n,i){let o=new URL(e),r=o.searchParams.get("code"),a=this.pendingKey(n),s=M(this.storage.getItem(a));if(!s||s.version!==1||n!==s.state)throw l("invalid_callback","Authorization callback is missing or does not match this browser session.");if(o.searchParams.has("error"))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),U(o.searchParams.get("error")??"access_denied",o.searchParams.get("error_description")??"Collection access was not approved.",{details:s.returnTo?{return_to:s.returnTo}:void 0});if(!r)throw l("invalid_callback","Authorization callback is missing its code.");let c=await J(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:r,client_id:s.clientId,redirect_uri:s.redirectUri,code_verifier:s.verifier}),signal:i},"temporarily_unavailable","Authorization completion is temporarily unavailable."),d=await S(c,"invalid_token_response","The authorization service returned an invalid token response.");if(!c.ok)throw A(d,"token_exchange_failed","Authorization could not be completed.",c.status);if(s.relayEncryption==="required"&&!d.authority&&(!d.encryption||!s.keyHandle||d.encryption.application_agreement_public_key!==s.applicationAgreementPublicKey))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),l("encryption_required","Authorization did not establish the required encrypted relay grant.");if(d.authority?.proof_public_key){if(!s.keyHandle||!s.applicationSigningPublicKey||d.authority.proof_public_key!==s.applicationSigningPublicKey)throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),l("invalid_token_response","Authorization returned a remote authority capability bound to another application key.")}else d.authority&&s.keyHandle&&await this.keyStore.delete(s.keyHandle);let p=this.storeTokenResponse(d,s.clientId,d.authority?.proof_public_key?s.keyHandle:d.authority?void 0:s.keyHandle);if(s.collectionId&&s.collectionId!==p.collectionId)throw this.removeToken(p.collectionId,p.keyHandle),this.storage.removeItem(a),l("collection_mismatch","The approved collection does not match the collection requested by this link.");return this.storage.removeItem(a),{connection:this.connection(p.collectionId),...s.returnTo?{returnTo:s.returnTo}:{}}}connections(){let e=[];for(let n of this.connectionIds()){let i=this.connection(n)?.info();i&&e.push(i)}return e.sort((n,i)=>n.displayName.localeCompare(i.displayName)||n.collectionId.localeCompare(i.collectionId))}connection(e){if(!this.storage.getItem(this.tokenKey(e)))return null;let n=this.connectionCache.get(e);return n||(n=new De(this,e),this.connectionCache.set(e,n)),n.info()?n:null}unavailableReason(e){return this.invalidatedConnections.get(e)??null}onConnectionsChange(e){return this.listeners.add(e),e(this.connections()),()=>this.listeners.delete(e)}storeTokenResponse(e,n,i){let o=e.collection_id;if(typeof o!="string")throw l("invalid_token_response","Authorization returned no collection ID.");let r=M(this.storage.getItem(this.tokenKey(o))),a=vo({body:e,clientId:n,keyHandle:i,previous:r,defaultApplicationOrigin:this.defaultApplicationOrigin(),pinConnectorIdentity:(s,c)=>this.pinConnectorIdentity(s,c)});return r?.keyHandle&&r.keyHandle!==i&&this.keyStore.delete(r.keyHandle).catch(()=>{}),this.storage.setItem(this.tokenKey(o),JSON.stringify(a)),this.addConnectionId(o),this.invalidatedConnections.delete(o),this.connectionCache.delete(o),this.emitConnections(),a}forgetConnectorIdentity(e){this.storage.removeItem(this.connectorPinKey(e))}pinConnectorIdentity(e,n){let i=this.connectorPinKey(e),o=M(this.storage.getItem(i));if(o&&(o.version!==1||o.publicKey!==n))throw l("connector_identity_changed","The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");o||this.storage.setItem(i,JSON.stringify({version:1,publicKey:n}))}connectorPinKey(e){return`mdbase-connect:${this.serverUrl}:connector-pin:${e}`}async loadApplicationIdentity(e){try{return await wt(this.identityStore,this.serverUrl,e)}catch(n){throw l("application_identity_unavailable",n instanceof pe?n.message:"The application installation identity is unavailable.",{cause:n})}}removeToken(e,n,i="authorization_lost",o=!1){this.invalidatedConnections.set(e,i),n&&(o||!this.pendingMutationsUseKey(e,n))&&this.keyStore.delete(n).catch(()=>{}),this.storage.removeItem(this.tokenKey(e)),o&&this.removePendingMutations(e);for(let r of["web_push","fcm"])this.storage.removeItem(this.notificationKey(e,r));this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:this.connectionIds().filter(r=>r!==e)})),this.connectionCache.delete(e),this.emitConnections()}tokenKey(e){return`${this.storagePrefix()}:token:${e}`}pendingMutationKey(e){return`${this.storagePrefix()}:pending-mutation:${e}`}removePendingMutations(e){let n=this.pendingMutationKey(e),i=[n];for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);r?.startsWith(`${n}:`)&&i.push(r)}for(let o of i){let r=M(this.storage.getItem(o));r?.keyHandle&&this.keyStore.delete(r.keyHandle).catch(()=>{}),this.storage.removeItem(o)}}pendingMutationsUseKey(e,n){let i=this.pendingMutationKey(e);for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);if(r!==i&&!r?.startsWith(`${i}:`))continue;if(M(this.storage.getItem(r))?.keyHandle===n)return!0}return!1}notificationKey(e,n="web_push"){return`${this.storagePrefix()}:notifications:${e}:${n}`}directPreferenceKey(){return`mdbase-connect:direct:${this.defaultApplicationOrigin()}`}defaultApplicationOrigin(){return Si(this.manifest,this.manifestSource,this.redirectUri,this.application?.distribution==="portable")}pendingKey(e){return`${this.storagePrefix()}:pending:${e}`}storagePrefix(){return`mdbase-connect:${this.serverUrl}:${this.manifestSource}`}connectionsKey(){return`${this.storagePrefix()}:connections`}connectionIds(){let e=M(this.storage.getItem(this.connectionsKey()));return e?.version===1&&Array.isArray(e.collectionIds)&&e.collectionIds.every(n=>typeof n=="string")?e.collectionIds:[]}addConnectionId(e){this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:[...new Set([...this.connectionIds(),e])]}))}emitConnections(){let e=this.connections();for(let n of this.listeners)n(e)}};var Lt=class{internals;constructor(e){this.internals=new Nt(e)}register(e){return I(()=>this.internals.register(e),se)}authorize(e={}){return I(()=>this.internals.authorize(e),me)}application(e){return new Re(this,e,this.internals.timeouts)}manifest(e){return I(()=>this.internals.manifestDeclaration(e),se)}environment(){return this.internals.environment()}completeAuthorization(e,n){return I(()=>this.internals.completeAuthorization(e===void 0?vt():String(e),n),me)}connections(){return this.internals.connections()}connection(e){return this.internals.connection(e)}unavailableReason(e){return this.internals.unavailableReason(e)}onConnectionsChange(e){return this.internals.onConnectionsChange(e)}forgetAll(){for(let e of this.connections())this.connection(e.collectionId)?.forget()}forgetConnectorIdentity(e){this.internals.forgetConnectorIdentity(e)}};function Sn(t){if(!t||typeof t!="object")throw l("invalid_push_payload","The push payload is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string"||!e.presentation||typeof e.presentation.title!="string")throw l("invalid_push_payload","The push payload is not an mdbase notification.");return e}function Co(t){if(!t||typeof t!="object")throw l("invalid_push_payload","The native notification data is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1&&e.version!=="1"||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string")throw l("invalid_push_payload","The native notification data is not an mdbase notification.");return{type:"mdbase.notification",version:1,signal_id:e.signal_id,criterion_id:e.criterion_id,cursor:e.cursor}}function wo(t,e){let n=Sn(e);return t.showNotification(n.presentation.title,{...n.presentation.body?{body:n.presentation.body}:{},...n.presentation.tag?{tag:n.presentation.tag}:{},data:{type:n.type,signal_id:n.signal_id,criterion_id:n.criterion_id,cursor:n.cursor}})}function So(t){return{subscribe:e=>t.subscribe(e),getSnapshot:()=>t.getSnapshot()}}var Bt=class{collectionParameter;fallbackPath;listeners=new Set;handlePopState=()=>this.emit();constructor(e={}){this.collectionParameter=e.collectionParameter??"collection",this.fallbackPath=e.fallbackPath??"/"}selectedCollectionId(){return this.currentUrl().searchParams.get(this.collectionParameter)}select(e,n={}){let i=Je(this.currentUrl());e?i.searchParams.set(this.collectionParameter,e):i.searchParams.delete(this.collectionParameter);let o=this.browserHistory();o[n.history==="push"?"pushState":"replaceState"](o.state,"",i),this.emit()}authorizationReturnTo(){let e=Je(this.currentUrl());return`${e.pathname}${e.search}${e.hash}`}authorizationCallback(){let e=this.currentUrl().href;return Ct(e)?e:null}finishAuthorization(e,n){let i=this.safeAppUrl(e??this.fallbackPath);Je(i),i.searchParams.set(this.collectionParameter,n),this.browserHistory().replaceState(null,"",i),this.emit()}clearAuthorizationCallback(e){let n=e?this.safeAppUrl(e):this.currentUrl(),i=this.browserHistory();i.replaceState(i.state,"",Je(n)),this.emit()}subscribe(e){let n=this.listeners.size===0;return this.listeners.add(e),n&&typeof window<"u"&&window.addEventListener("popstate",this.handlePopState),()=>{this.listeners.delete(e),this.listeners.size===0&&typeof window<"u"&&window.removeEventListener("popstate",this.handlePopState)}}emit(){for(let e of this.listeners)e()}safeAppUrl(e){let n=this.currentUrl(),i=new URL(e,n.origin);return i.origin===n.origin?i:new URL(this.fallbackPath,n.origin)}currentUrl(){if(typeof location>"u")throw l("browser_required","Browser selection requires a browser environment.");return new URL(location.href)}browserHistory(){if(typeof history>"u")throw l("browser_required","Browser selection requires a browser environment.");return history}},jt=class{collectionId=null;listeners=new Set;selectedCollectionId(){return this.collectionId}select(e){if(e!==this.collectionId){this.collectionId=e;for(let n of this.listeners)n()}}authorizationReturnTo(){}authorizationCallback(){return null}finishAuthorization(e,n){this.select(n)}clearAuthorizationCallback(){}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}};return Io(wa);})();
|
|
3
|
+
`)}async function ce(t,e,n,i,o,r=crypto.randomUUID()){W(n.encryption);let a=await ei(t,e,n.encryption.application_agreement_public_key),s=await t.nextCounter(e),c={binding:n,requestId:r,operation:i,counter:s},d=await ti(a.agreementPrivateKey,n,"request"),p=new TextEncoder().encode(JSON.stringify(o??{})),u=await crypto.subtle.encrypt({name:"AES-GCM",iv:oi(s),additionalData:new TextEncoder().encode(ii(c,"request")),tagLength:128},d,p);return{type:"encrypted_operation_request",...Pr(c),ciphertext:Ke(new Uint8Array(u))}}async function ve(t,e,n,i,o){if(!Ar(i,o))throw new w("invalid_encrypted_response","Encrypted response metadata does not match its request.");let r=await ei(t,e,n.encryption.application_agreement_public_key),a={binding:n,requestId:i.request_id,operation:i.operation,counter:i.counter},s=await ti(r.agreementPrivateKey,n,"response");try{let c=await crypto.subtle.decrypt({name:"AES-GCM",iv:oi(i.counter),additionalData:new TextEncoder().encode(ii(a,"response")),tagLength:128},s,ai(ri(o.ciphertext))),d=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c));if(d?.ok===!0&&"result"in d||d?.ok===!1&&ze(d.problem))return d;throw new Error("invalid response body")}catch(c){throw c instanceof w?c:new w("encrypted_response_rejected","The encrypted connector response could not be authenticated.")}}var w=class extends Error{constructor(n,i){super(i);this.code=n}code};async function Zn(t){let e=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveBits"]),n=Ke(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),i=await crypto.subtle.exportKey("pkcs8",e.privateKey),o=await crypto.subtle.importKey("pkcs8",i,{name:"ECDH",namedCurve:"P-256"},!1,["deriveBits"]),r=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),a=Ke(new Uint8Array(await crypto.subtle.exportKey("raw",r.publicKey))),s=await crypto.subtle.exportKey("pkcs8",r.privateKey),c=await crypto.subtle.importKey("pkcs8",s,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,agreementPrivateKey:o,agreementPublicKey:n,signingPrivateKey:c,signingPublicKey:a}}async function ei(t,e,n){let i=await t.get(e);if(!i||i.agreementPublicKey!==n)throw new w("missing_grant_key","The encrypted grant key is unavailable or does not match the grant.");return i}async function Rr(t,e,n){let i=await t.get(e);if(!i||i.signingPublicKey!==n)throw new w("missing_grant_key","The remote authority signing key is unavailable or does not match the grant.");return i}async function ti(t,e,n){let i=await He(t,e.encryption.connector_agreement_public_key),o=await crypto.subtle.importKey("raw",i,"HKDF",!1,["deriveKey"]),r=new TextEncoder().encode(ni(e)),a=await crypto.subtle.digest("SHA-256",r);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:a,info:new TextEncoder().encode(n==="request"?wr:Sr)},o,{name:"AES-GCM",length:256},!1,n==="request"?["encrypt"]:["decrypt"])}async function He(t,e){try{let n=await crypto.subtle.importKey("raw",ai(tn(e)),{name:"ECDH",namedCurve:"P-256"},!1,[]);return await crypto.subtle.deriveBits({name:"ECDH",public:n},t,256)}catch{throw new w("invalid_public_key","The connector relay public key is invalid.")}}function ni(t){let e=t.encryption;return["mdbase-connect",Z,e.suite,t.grantId,t.applicationId,e.connector_id,e.collection_id,e.scope_epoch,e.key_id].join("|")}function ii(t,e){return[ni(t.binding),t.requestId,e,t.operation,t.counter].join("|")}function Pr(t){let e=t.binding.encryption;return{protocol_version:Z,suite:Le,request_id:t.requestId,grant_id:t.binding.grantId,application_id:t.binding.applicationId,connector_id:e.connector_id,collection_id:e.collection_id,operation:t.operation,scope_epoch:e.scope_epoch,key_id:e.key_id,counter:t.counter}}function Ar(t,e){return e.type==="encrypted_operation_response"&&typeof e.ciphertext=="string"&&t.protocol_version===e.protocol_version&&t.suite===e.suite&&t.request_id===e.request_id&&t.grant_id===e.grant_id&&t.application_id===e.application_id&&t.connector_id===e.connector_id&&t.collection_id===e.collection_id&&t.operation===e.operation&&t.scope_epoch===e.scope_epoch&&t.key_id===e.key_id&&t.counter===e.counter}function W(t){if(t.protocol_version!==dt||t.suite!==Le||!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<=0||typeof t.key_id!="string"||t.key_id.length===0||t.key_id.length>200||t.key_id.includes("|"))throw new w("unsupported_encryption","The grant uses an unsupported relay encryption profile.");if(typeof t.connector_id!="string"||!Yn.test(t.connector_id)||typeof t.collection_id!="string"||!Yn.test(t.collection_id))throw new w("unsupported_encryption","The grant uses invalid encrypted relay identities.");tn(t.application_agreement_public_key),tn(t.connector_agreement_public_key)}function oi(t){let e=BigInt(t);if(e<=0n||e>nn||e.toString()!==t)throw new w("invalid_counter","The encrypted relay counter is invalid.");let n=new Uint8Array(new ArrayBuffer(12));return new DataView(n.buffer).setBigUint64(4,e,!1),n}function Ke(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}async function Qn(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return Ke(new Uint8Array(e))}function ri(t){if(!/^[A-Za-z0-9_-]+$/.test(t))throw new w("invalid_base64","Encrypted relay data is malformed.");let e="=".repeat((4-t.length%4)%4),n=atob(t.replaceAll("-","+").replaceAll("_","/")+e);return Uint8Array.from(n,i=>i.charCodeAt(0))}function tn(t){let e=ri(t);if(e.length!==65||e[0]!==4)throw new w("invalid_public_key","Encrypted relay public keys must be uncompressed P-256 points.");return e}function ai(t){return Uint8Array.from(t).buffer}function Or(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function Xn(t,e){return new Promise((n,i)=>{let o=t.transaction(ne,"readwrite"),r=e(o.objectStore(ne));r.onerror=()=>i(r.error),o.onerror=()=>i(o.error),o.onabort=()=>i(o.error??new Error("Grant key transaction aborted.")),o.oncomplete=()=>n()})}function le(t){return{...t,credentials:"omit",targetAddressSpace:"loopback"}}async function $e(){if(typeof navigator>"u"||!navigator.permissions?.query)return null;try{return(await navigator.permissions.query({name:"local-network-access"})).state}catch{return null}}function Ce(t){return t===404||t===405||t===426||t>=500}function si(t,e){return rt(t,e)}function K(t){return[...new Set(t)]}function ci(t,e){return t.grantId||e.grantId?t.grantId===e.grantId&&t.keyHandle===e.keyHandle&&t.encryption?.key_id===e.encryption?.key_id:t.accessToken===e.accessToken}function de(t){if(t?.aborted)throw l("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function gt(t,e,n,i){return t instanceof b?t:e?.aborted?n?B(n,t):e.reason instanceof b?e.reason:l("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t}):n?B(n,t):t instanceof TypeError?l(i,i==="hosted_provider_unavailable"?"The hosted collection provider is unavailable.":"The Connect relay is unavailable.",{cause:t}):t instanceof Error?t:new Error(String(t))}function an(t,e){return e?.aborted===!0||t instanceof b&&t.code==="operation_cancelled"}function li(t,e){if(e.dryRun!==!0||e.wouldRename!==!0||e.from!==t.from||e.to!==t.to)throw l("invalid_preflight","The rename preview does not match this mutation. Run the preview again.")}function di(t,e){if(e.dryRun!==!0||e.wouldDelete!==!0||e.path!==t.path)throw l("invalid_preflight","The delete preview does not match this mutation. Run the preview again.")}function ui(t,e){if(t.updateRefs===!1)return{affectedRecords:0,totalUnits:1,warnings:0};let n=e.referencesAffected??[];return{affectedRecords:new Set(n.map(i=>i.path)).size,totalUnits:1+n.length,warnings:e.warnings?.length??0}}function pi(t){return{affectedRecords:new Set((t.brokenLinks??[]).map(e=>e.path)).size,totalUnits:1,warnings:0}}async function fi(t,e){return Fn(t,e??{})}function hi(t){return JSON.stringify(rn(t))}function rn(t){return Array.isArray(t)?t.map(e=>rn(e)):t&&typeof t=="object"?Object.fromEntries(Object.entries(t).filter(([,e])=>e!==void 0).sort(([e],[n])=>e<n?-1:e>n?1:0).map(([e,n])=>[e,rn(n)])):t}function B(t,e){return l("operation_outcome_unknown","The write may have completed, but mdbase could not recover its authoritative result. Retry the exact same write to recover safely.",{operationOutcome:"unknown",details:{request_id:t},cause:e})}function j(t){let e=new Uint8Array(t);return crypto.getRandomValues(e),sn(e)}function sn(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function yi(t){let e=t.replaceAll("-","+").replaceAll("_","/").padEnd(Math.ceil(t.length/4)*4,"="),n=atob(e),i=new Uint8Array(new ArrayBuffer(n.length));for(let o=0;o<n.length;o+=1)i[o]=n.charCodeAt(o);return i}async function J(t,e,n,i){try{return await fetch(t,e)}catch(o){throw l(n,i,{cause:o})}}async function S(t,e,n){let i;try{i=await t.text()}catch(o){throw U(e,n,{status:t.status,cause:o})}if(i.trim()==="")throw U(e,n,{status:t.status});try{return JSON.parse(i)}catch(o){throw U(e,n,{status:t.status,cause:o})}}function mi(t){let e=new URL(t);if(e.protocol!=="http:"||!["127.0.0.1","[::1]"].includes(e.hostname)||e.username||e.password||e.pathname!=="/"||e.search||e.hash)throw l("invalid_loopback_url","loopbackUrl must be an HTTP origin on 127.0.0.1 or ::1.");return e.origin}async function Ve(){let t=j(32),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return{verifier:t,challenge:sn(new Uint8Array(e))}}function A(t,e,n,i){return U(Ge(t)??t?.error?.code??e,t?.error_description??t?.error?.message??n,{status:i,details:t?.error?.details})}function Ge(t){return typeof t?.error=="string"?t.error:void 0}function We(t,e){if(!t||typeof t!="object"||Array.isArray(t)||typeof e!="string")return!1;let n=t;if(typeof n.operations_url!="string"||typeof n.sync_url!="string"||typeof n.files_url!="string"||typeof n.replica_id!="string"||n.replica_id.length===0||typeof n.access_token!="string"||n.access_token.length===0||n.proof_public_key!==void 0&&(typeof n.proof_public_key!="string"||n.proof_public_key.length===0))return!1;try{let i=new URL(n.operations_url),o=new URL(n.sync_url),r=new URL(n.files_url);return[i,o,r].every(a=>(a.protocol==="https:"||a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))&&!a.username&&!a.password&&!a.search&&!a.hash)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/operations$/i.test(i.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/sync$/i.test(o.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/files$/i.test(r.pathname)&&i.origin===o.origin&&i.origin===r.origin&&i.pathname.split("/")[3]===e&&o.pathname.split("/")[3]===e&&r.pathname.split("/")[3]===e}catch{return!1}}function gi(t,e){return We({operations_url:t?.operationsUrl,sync_url:t?.syncUrl,files_url:t?.filesUrl,replica_id:t?.replicaId,access_token:t?.accessToken,proof_public_key:t?.proofPublicKey},e)}function _t(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;let e=t,n=e.actions;if(e.kind!=="files"||e.protocol_version!==1||!Array.isArray(n)||n.length===0||n.length>6||new Set(n).size!==n.length||n.some(o=>!["list","read","add","replace","move","delete"].includes(o)))return!1;let i=e.scope;return!i||typeof i!="object"||Array.isArray(i)?!1:i.kind==="collection"?Object.keys(i).length===1:i.kind==="selected_folders"&&Object.keys(i).length===2&&Array.isArray(i.folders)&&i.folders.length>0&&i.folders.length<=100&&new Set(i.folders).size===i.folders.length&&i.folders.every(o=>typeof o=="string"&&o.length>0&&o.length<=1024&&Tr(o))}function Tr(t){let e=new Set([".mdbase",".git","node_modules","_contracts","_schemas","_types","_views"]);return!t.startsWith("/")&&!t.endsWith("/")&&!t.includes("\\")&&t.split("/").every(n=>{let i=n.split(".")[0]?.toUpperCase()??"";return n!==""&&n!=="."&&n!==".."&&!n.startsWith(".")&&!n.endsWith(" ")&&!n.endsWith(".")&&!/[<>:"|?*]/.test(n)&&!e.has(n.toLowerCase())&&!["CON","PRN","AUX","NUL"].includes(i)&&!/^(COM|LPT)[1-9]$/.test(i)})}function _i(t,e){if(!t||typeof t!="object"||Array.isArray(t)||t.collection_id!==e)return!1;try{return W(t),!0}catch{return!1}}function bi(t){if(typeof t?.device_code!="string"||typeof t?.user_code!="string"||typeof t?.verification_uri!="string"||typeof t?.verification_uri_complete!="string"||!Number.isFinite(t?.expires_in)||!Number.isFinite(t?.interval))throw l("invalid_device_authorization_response","Connect returned an invalid downloaded application authorization response.");return{userCode:t.user_code,verificationUri:t.verification_uri,verificationUriComplete:t.verification_uri_complete,expiresAt:Date.now()+Math.max(1,t.expires_in)*1e3,intervalSeconds:Math.max(1,t.interval)}}function M(t){if(!t)return null;try{return JSON.parse(t)}catch{return null}}function bt(t){if(!t||typeof t!="object"||Array.isArray(t))return null;let e=t;return e.access!=="contract"&&e.access!=="full_collection"||!Array.isArray(e.contracts)||e.contracts.some(n=>!n||typeof n!="object"||n.contract_type!=="record"||typeof n.id!="string"||typeof n.version!="string"||!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(n.version)||!/^sha256:[0-9a-f]{64}$/.test(n.digest)||!n.schema||typeof n.schema!="object"||Array.isArray(n.schema)||!Array.isArray(n.implementations)||n.implementations.some(i=>!i||typeof i!="object"||typeof i.type_name!="string"||!Number.isInteger(i.type_version)||!/^sha256:[0-9a-f]{64}$/.test(i.digest)||!i.fields||typeof i.fields!="object"||Array.isArray(i.fields)||Object.values(i.fields).some(o=>typeof o!="string")))?null:e}function vi(t){return t.endsWith("/")?t.slice(0,-1):t}function Ci(){if(typeof location>"u")throw l("manifest_required","manifest is required outside a browser environment.");if(location.origin==="null")throw l("manifest_required","Downloaded applications must provide their v1 portable manifest inline.");return new URL("/.well-known/mdbase-app.json",location.origin).href}function wi(){if(typeof location>"u")throw l("redirect_uri_required","redirectUri is required outside a browser environment.");return location.href.split(/[?#]/)[0]}function Si(t,e,n,i){if(typeof t!="string"&&t.distribution==="portable"||i)return"null";let o=new URL(n);if(["http:","https:"].includes(o.protocol))return o.origin;if(typeof location<"u")return location.origin;if(typeof t!="string")return new URL(t.homepage).origin;try{return new URL(e).origin}catch{return""}}function Ri(t){let e=":token:",n=t.lastIndexOf(e);return n<0?"":t.slice(n+e.length)}function vt(){if(typeof location>"u")throw l("callback_url_required","callbackUrl is required outside a browser environment.");return location.href}function Pi(t){if(t)return new we;if(typeof localStorage>"u")throw l("storage_required","storage is required outside a browser environment.");try{let e=`mdbase-connect:probe:${j(8)}`;return localStorage.setItem(e,"1"),localStorage.removeItem(e),localStorage}catch{return new we}}var we=class{values=new Map;get length(){return this.values.size}clear(){this.values.clear()}getItem(e){return this.values.get(e)??null}key(e){return[...this.values.keys()][e]??null}removeItem(e){this.values.delete(e)}setItem(e,n){this.values.set(String(e),String(n))}};function Ai(t){return typeof t=="string"||t.distribution!=="portable"?!1:typeof location>"u"||location.origin==="null"||!["http:","https:"].includes(location.protocol)}function Oi(t){let e=hi(t),n=2166136261,i=2654435769;for(let o=0;o<e.length;o+=1){let r=e.charCodeAt(o);n=Math.imul(n^r,16777619),i=Math.imul(i^r,2246822507)}return`${(n>>>0).toString(16).padStart(8,"0")}${(i>>>0).toString(16).padStart(8,"0")}`}function Je(t){for(let e of["code","state","error","error_description"])t.searchParams.delete(e);return t}function Ct(t){let e;try{e=new URL(t)}catch{return!1}return e.searchParams.has("state")&&(e.searchParams.has("code")||e.searchParams.has("error"))}function Ti(t){if(!t.details||typeof t.details!="object"||Array.isArray(t.details))return;let e=t.details.return_to;return typeof e=="string"?e:void 0}var ue=["describe","changes","read","query"];var Se=class{constructor(e,n){this.connect=e;this.operations=K(n.operations??ue),this.selection=n.selection,this.autoSelect=n.autoSelect??"only",this.snapshot={status:"unselected",connections:[]},this.refresh()}connect;operations;selection;autoSelect;listeners=new Set;snapshot;snapshotKey="";stopConnections;stopSelection;stopActiveConnection;activeCollectionId=null;unavailableReason="not_authorized";started=!1;refreshing=!1;refreshQueued=!1;transactionDepth=0;callbackPromise=null;async start(e){this.started||(this.started=!0,this.stopConnections=this.connect.onConnectionsChange(()=>this.refresh()),this.stopSelection=this.selection.subscribe(()=>{this.unavailableReason="not_authorized",this.refresh()}));let n=this.selection.authorizationCallback();if(n){let i=await this.handleAuthorizationCallback(n,e);if(!i.ok)return i}else this.autoSelectOnlyConnection();return this.refresh(),k(this.snapshot)}destroy(){this.stopConnections?.(),this.stopSelection?.(),this.stopActiveConnection?.(),this.stopConnections=void 0,this.stopSelection=void 0,this.stopActiveConnection=void 0,this.activeCollectionId=null,this.started=!1}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}select(e,n={}){let i=this.connect.connection(e);return i?(this.unavailableReason="not_authorized",this.selection.select(e,n),this.refresh(),k(i)):P(T("unknown_collection","This collection is not authorized for this application."))}clearSelection(e={}){this.unavailableReason="not_authorized",this.selection.select(null,e),this.refresh()}forget(e){this.transactionDepth+=1;try{let n=this.selection.selectedCollectionId()===e;this.connect.connection(e)?.forget(),n&&this.selection.select(null,{history:"replace"})}finally{this.transactionDepth-=1,this.refresh()}}async authorize(e,n={}){let i=this.selection.selectedCollectionId();if(e==="selected"&&!i)return P(T("collection_not_selected","Choose a collection before updating its access."));let o=typeof e=="object"?e.collectionId:e==="selected"?i:null;this.transactionDepth+=1;try{let r=await this.connect.authorize({...n,operations:this.operations,target:o===null?{kind:"choose"}:{kind:"collection",collectionId:o},returnTo:this.selection.authorizationReturnTo()});return r.ok&&r.value.kind==="connected"&&this.selection.finishAuthorization(r.value.returnTo,r.value.connection.collectionId),r}finally{this.transactionDepth-=1,this.refresh()}}async ensureOperations(e,n){let i=this.snapshot;if(i.status!=="ready")return P(T("collection_not_ready","Choose an authorized collection first."));let o=K(e),r=i.connection.authorizationCapabilities(o);if(r.sufficient)return k({kind:"unchanged",connection:i.connection});this.transactionDepth+=1;try{let a=await this.connect.authorize({...n,operations:K([...r.grantedOperations,...r.missingOperations]),target:{kind:"collection",collectionId:i.collectionId},returnTo:this.selection.authorizationReturnTo()});return a.ok&&a.value.kind==="connected"&&this.selection.finishAuthorization(a.value.returnTo,a.value.connection.collectionId),a}finally{this.transactionDepth-=1,this.refresh()}}handleAuthorizationCallback(e,n){if(!Ct(e))return Promise.resolve(P(T("invalid_callback","This URL is not an authorization callback.")));if(this.callbackPromise)return this.callbackPromise;this.transactionDepth+=1;let i=this.connect.completeAuthorization(e,n).then(o=>{if(!o.ok){let a=Ti(o.problem);return this.selection.clearAuthorizationCallback(a),this.refresh(),o}let r=o.value;return this.unavailableReason="not_authorized",this.selection.finishAuthorization(r.returnTo,r.connection.collectionId),this.refresh(),k(r.connection,o.diagnostics)}).catch(o=>{throw this.selection.clearAuthorizationCallback(),this.refresh(),o}).finally(()=>{this.transactionDepth-=1,this.refresh(),this.callbackPromise===i&&(this.callbackPromise=null)});return this.callbackPromise=i,i}autoSelectOnlyConnection(){if(this.autoSelect!=="only"||this.selection.selectedCollectionId())return;let e=this.connect.connections();e.length===1&&this.selection.select(e[0].collectionId,{history:"replace"})}refresh(){if(this.transactionDepth>0){this.refreshQueued=!0;return}if(this.refreshing){this.refreshQueued=!0;return}this.refreshing=!0;try{do this.refreshQueued=!1,this.refreshOnce();while(this.refreshQueued)}finally{this.refreshing=!1}}refreshOnce(){let e=this.selection.selectedCollectionId(),n=this.connect.connections(),i=e?this.connect.connection(e):null;i?.collectionId!==this.activeCollectionId&&(this.stopActiveConnection?.(),this.activeCollectionId=i?.collectionId??null,this.stopActiveConnection=i?.onConnectionChange(a=>{!a&&this.selection.selectedCollectionId()===i.collectionId&&(this.unavailableReason="authorization_lost"),this.refresh()}));let o;if(!e)o={status:"unselected",connections:n};else if(!i||!i.info())o={status:"unavailable",collectionId:e,reason:this.connect.unavailableReason(e)??this.unavailableReason,connections:n};else{let a=i.info();o={status:"ready",collectionId:e,connection:i,info:a,access:i.authorizationCapabilities(this.operations),connections:n}}let r=kr(o);if(r!==this.snapshotKey){this.snapshot=o,this.snapshotKey=r;for(let a of this.listeners)a()}}};function kr(t){return t.status==="unselected"?JSON.stringify({status:t.status,connections:t.connections}):t.status==="unavailable"?JSON.stringify({status:t.status,collectionId:t.collectionId,reason:t.reason,connections:t.connections}):JSON.stringify({status:t.status,collectionId:t.collectionId,info:t.info,access:t.access,connections:t.connections})}var Ye=class{values=new Map;read(e){return this.values.get(e)??null}write(e,n){this.values.set(e,n)}remove(e){this.values.delete(e)}},Re=class{constructor(e,n,i=ge()){this.connect=e;this.options=n;this.timeouts=i;this.verificationStore=n.verificationStore??Fr()}connect;options;timeouts;listeners=new Set;verificationStore;snapshot={status:"opening",connections:[]};manifest=null;application=null;base=null;stopBase;setupAssessment=null;setupTypePackAdoptions=null;verificationGeneration=0;lifecycleGeneration=0;startOperation=null;start(e){if(this.base&&!this.startOperation)return Promise.resolve(k(this.snapshot));let n=this.startOperation??this.beginStart();return n.waiters+=1,F(e,this.timeouts.watchStartMs,()=>n.promise).finally(()=>{n.waiters-=1,n.waiters===0&&this.startOperation===n&&(n.controller.abort(),this.startOperation=null,this.lifecycleGeneration+=1)})}beginStart(){this.snapshot={status:"opening",connections:[]};let e=new AbortController,n=++this.lifecycleGeneration,i={promise:this.startWithinBudget({signal:e.signal,timeoutMs:null},n),controller:e,waiters:0,generation:n};this.startOperation=i;let o=()=>{this.startOperation===i&&(this.startOperation=null)};return i.promise.then(o,o),i}async startWithinBudget(e,n){let i=await this.connect.register(e);if(!i.ok)return i;let o=await this.connect.manifest(e);if(!o.ok)return o;let r=o.value.requirements?.capabilities;if(!r)return P(T("invalid_application_manifest","Application sessions require a versioned semantic capability contract.",{details:{issues:[{path:"/requirements/capabilities",keyword:"required",message:"is required for application sessions",params:{}}]}}));if(n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);this.application=i.value,this.manifest=o.value;let a=new Se(this.connect,{selection:this.options.selection,autoSelect:this.options.autoSelect,operations:Ir(r)});this.base=a;try{let s=await a.start(e);if(!s.ok)return this.cleanupBase(a),s;if(n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);if(this.stopBase=a.subscribe(()=>{this.base===a&&this.refresh()}),await this.refresh(!0,e),n!==this.lifecycleGeneration||e.signal?.aborted)throw G(e.signal??new AbortController().signal);return k(this.snapshot)}catch(s){throw this.cleanupBase(a),s}}destroy(){this.lifecycleGeneration+=1,this.verificationGeneration+=1,this.startOperation?.controller.abort(),this.startOperation=null,this.base&&this.cleanupBase(this.base),this.application=null,this.manifest=null,this.setupAssessment=null,this.setupTypePackAdoptions=null,this.snapshot={status:"opening",connections:[]},this.listeners.clear()}cleanupBase(e){this.base===e&&(this.stopBase?.(),this.stopBase=void 0,e.destroy(),this.base=null)}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}connection(){let e=this.base?.getSnapshot();return e?.status==="ready"?e.connection:null}select(e,n={}){return this.requireBase().select(e,n)}clearSelection(e={}){this.requireBase().clearSelection(e)}forget(e){this.requireBase().forget(e)}authorize(e,n={}){return this.requireBase().authorize(e,n)}handleAuthorizationCallback(e,n){return this.requireBase().handleAuthorizationCallback(String(e),n)}completeAuthorization(e,n){return this.requireBase().handleAuthorizationCallback(e===void 0?vt():String(e),n)}ensureCapabilities(e,n){let i=this.requireManifest().requirements?.capabilities,o=new Set([...i?.required??[],...i?.optional??[]]);return e.some(r=>!o.has(r))?Promise.resolve(P(T("invalid_application_manifest","Applications may only request capabilities declared in their manifest.",{details:{issues:[{path:"/requirements/capabilities",keyword:"undeclaredCapability",message:"must declare every capability requested by the application",params:{requested:e,declared:[...o]}}]}}))):this.requireBase().ensureOperations(Mr(e),n)}async applyCollectionSetup(e){if(this.snapshot.status!=="setup_review_required"||!this.setupAssessment)return P(T("collection_not_ready","There is no reviewed collection setup to apply."));if(!this.setupAssessment.applicable)return P(T("collection_not_ready","Resolve the collection setup conflicts before applying this update."));let n=this.connection();if(!n)return P(T("collection_not_ready","The collection is not ready."));let i=this.setupAssessment,o={...this.collectionSetupInput(this.setupTypePackAdoptions??void 0),expectedAssessmentDigest:i.assessmentDigest,expectedCollectionRevision:i.collectionRevision,expectedProvisionDigest:i.provisionDigest,allowTypePackDowngrades:i.typePacks.filter(s=>s.status==="downgrade").map(s=>s.desired.id)},r=te(e,this.timeouts.requestMs),a={signal:r.signal,timeoutMs:null};try{let s=await n.applyCollectionSetup(o,a);return s.ok?(this.setupAssessment=null,this.setupTypePackAdoptions=null,await this.verifySetup(this.context(n),++this.verificationGeneration,a),k(this.snapshot)):s}finally{r.dispose()}}async refresh(e=!1,n){if(!this.base||!this.manifest)return;let i=this.base.getSnapshot();this.verificationGeneration+=1;let o=this.verificationGeneration;if(this.setupAssessment=null,this.setupTypePackAdoptions=null,i.status==="unselected"){this.publish({status:"unselected",connections:i.connections});return}if(i.status==="unavailable"){this.publish(i);return}let r=this.context(i.connection);if(!r.capabilities.requiredAvailable){this.publish({status:"authorization_required",...r});return}if(!(this.manifest.requirements?.capabilities?.required.includes("collection.setup.apply")??!1)){this.publish({status:"ready",verification:"verified",...r});return}let s=cn(this.manifest,i.collectionId);this.verificationStore.read(s)===ki(this.manifest)?this.publish({status:"ready",verification:"cached",...r}):this.publish({status:"checking_setup",...r});let c=this.verifySetup(r,o,n);e&&await c}async verifySetup(e,n,i){let o=this.connection(),r=this.requireManifest();if(!o||o.collectionId!==e.collectionId)return;let a=this.collectionSetupInput(),s=i?await o.assessCollectionSetup(a,i):await o.assessCollectionSetup(a);if(n===this.verificationGeneration){if(!s.ok){this.publish({status:"blocked",problem:s.problem,...e});return}if(!s.value.applicable){let c=Dr(s.value);if(Object.keys(c).length>0){if(s=i?await o.assessCollectionSetup(this.collectionSetupInput(c),i):await o.assessCollectionSetup(this.collectionSetupInput(c)),n!==this.verificationGeneration)return;if(!s.ok){this.publish({status:"blocked",problem:s.problem,...e});return}this.setupTypePackAdoptions=c}}if(n===this.verificationGeneration){if(s.value.status!=="current"){this.setupAssessment=s.value,this.verificationStore.remove(cn(r,e.collectionId)),this.publish({status:"setup_review_required",update:Er(s.value,r.provisions?.type_packs??[]),...e});return}this.verificationStore.write(cn(r,e.collectionId),ki(r)),this.publish({status:"ready",verification:"verified",...e})}}}collectionSetupInput(e){let n=this.requireManifest(),i=this.requireApplication();return{applicationId:qr(i.family_identity),declarationDigest:`sha256:${i.manifest_digest}`,requirements:{configuration:n.requirements?.configuration??[]},provisions:{configuration:n.provisions?.configuration??[],typePacks:n.provisions?.type_packs??[]},...e?{typePackAdoptions:e}:{}}}context(e){let n=e.info();return{collectionId:e.collectionId,info:n,capabilities:ut(this.requireManifest().requirements.capabilities,this.requireManifest(),n),connections:this.connect.connections()}}publish(e){if(JSON.stringify(this.snapshot)!==JSON.stringify(e)){this.snapshot=e;for(let n of this.listeners)n()}}requireBase(){if(!this.base)throw new Error("Start the application session before using it.");return this.base}requireManifest(){if(!this.manifest)throw new Error("Start the application session before using it.");return this.manifest}requireApplication(){if(!this.application)throw new Error("Start the application session before using it.");return this.application}};function Ir(t){return at(t)}function Mr(t){let e=t.flatMap(n=>st(n));return[...new Set(e)]}function xr(t,e){let n=e.status==="conflict"?"Existing user-owned resources conflict with this application definition pack.":e.status==="install"?"This collection needs the application definitions installed.":`This collection has a ${e.status} definition change to review.`;return{id:e.desired.id,name:t.manifest.name??e.desired.id,status:e.status,applicable:e.applicable,assessmentDigest:e.assessmentDigest,...e.current?{currentVersion:e.current.version}:{},desiredVersion:e.desired.version,resources:e.resources,contractSetups:e.contractSetups,canApply:e.applicable,reason:n}}function Er(t,e){let n=t.typePacks.map(r=>{let a=e.find(s=>s.manifest.id===r.desired.id);if(!a)throw new Error(`Collection setup returned undeclared type pack '${r.desired.id}'.`);return xr(a,r)}),i=t.configuration.filter(r=>r.action!=="current").length,o=t.status==="conflict"?"Existing collection policy conflicts with this application's required setup.":`This application requires ${i} configuration change${i===1?"":"s"} and ${n.length} definition update${n.length===1?"":"s"}.`;return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessmentDigest,collectionRevision:t.collectionRevision,provisionDigest:t.provisionDigest,configuration:t.configuration,typePacks:n,canApply:t.applicable,reason:o}}function Dr(t){let e={};for(let n of t.typePacks){let i=Object.fromEntries(n.resources.filter(o=>o.action==="conflict"&&o.mode==="managed"&&o.currentDigest!==void 0&&o.installedDigest===void 0).map(o=>[o.target,o.currentDigest]));Object.keys(i).length>0&&(e[n.desired.id]=i)}return e}function cn(t,e){return`mdbase-application-session:v1:${t.id}:${e}`}function ki(t){return JSON.stringify({capabilities:t.requirements?.capabilities,requirements:t.requirements?.configuration??[],provisions:t.provisions??{}})}function qr(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function Fr(){return typeof localStorage<"u"?{read:t=>localStorage.getItem(t),write:(t,e)=>localStorage.setItem(t,e),remove:t=>localStorage.removeItem(t)}:new Ye}function Qe(t,e){return new Promise((n,i)=>{if(e?.aborted){i(e?.reason??new DOMException("Aborted","AbortError"));return}let o=()=>e?.removeEventListener("abort",a),r=setTimeout(()=>{o(),n()},t),a=()=>{clearTimeout(r),o(),i(e?.reason??new DOMException("Aborted","AbortError"))};e?.addEventListener("abort",a,{once:!0})})}var zr="mdbase-connect-identities",Pe="application-identities",ln=BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),Ur=ln/2n,Ae=class{database=null;async create(e){let n=await Mi(e),i=await this.open();return await Ii(i,o=>o.add(n)),n}async get(e){let n=await this.open();return await Nr(n.transaction(Pe).objectStore(Pe).get(e))??null}async delete(e){let n=await this.open();await Ii(n,i=>i.delete(e))}open(){if(typeof indexedDB>"u")throw new pe("Persistent application identity requires browser IndexedDB or an injected identity store.");return this.database||(this.database=new Promise((e,n)=>{let i=indexedDB.open(zr,1);i.onupgradeneeded=()=>{i.result.objectStoreNames.contains(Pe)||i.result.createObjectStore(Pe,{keyPath:"handle"})},i.onerror=()=>n(i.error),i.onsuccess=()=>e(i.result)})),this.database}},Oe=class{records=new Map;async create(e){if(this.records.has(e))throw new Error(`Application identity already exists: ${e}`);let n=await Mi(e);return this.records.set(e,n),n}async get(e){return this.records.get(e)??null}async delete(e){this.records.delete(e)}},pe=class extends Error{constructor(e){super(e),this.name="ApplicationIdentityStoreError"}};async function Te(t){return Nn(t.signingPublicKey)}async function Xe(t,e){if(t.installation_signing_public_key!==e.signingPublicKey||t.application_installation_id!==await Te(e))throw new Error("Application authorization identity does not match its binding.");let n=Br(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.signingPrivateKey,Ln(t))));return{binding:t,signature:xi(n)}}async function wt(t,e,n){let i=`application-installation:v2:${e}:${n.id}`,o=await t.get(i);if(o)return o;try{return await t.create(i)}catch(r){let a=await t.get(i);if(a)return a;throw r}}async function Mi(t){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),n=xi(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),i=await crypto.subtle.exportKey("pkcs8",e.privateKey),o=await crypto.subtle.importKey("pkcs8",i,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,signingPrivateKey:o,signingPublicKey:n}}function Nr(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function Ii(t,e){return new Promise((n,i)=>{let o=t.transaction(Pe,"readwrite");e(o.objectStore(Pe)).onerror=()=>i(o.error),o.onerror=()=>i(o.error),o.onabort=()=>i(o.error??new Error("Identity transaction aborted.")),o.oncomplete=()=>n()})}function Lr(t){let e=new Uint8Array(t.reduce((i,o)=>i+o.byteLength,0)),n=0;for(let i of t)e.set(i,n),n+=i.byteLength;return e}function xi(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function Br(t){if(t.byteLength!==64)throw new Error("Application authorization signature is invalid.");let e=jr(t.slice(32));if(e===0n||e>=ln)throw new Error("Application authorization signature is invalid.");return e<=Ur?t:Lr([t.slice(0,32),Kr(ln-e,32)])}function jr(t){return BigInt(`0x${Hr(t)}`)}function Kr(t,e){let n=t.toString(16).padStart(e*2,"0");return Uint8Array.from({length:e},(i,o)=>Number.parseInt(n.slice(o*2,o*2+2),16))}function Hr(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}function Ei(t){if(t!==!1)return{initialDelayMs:Math.max(0,t?.initialDelayMs??500),maxDelayMs:Math.max(0,t?.maxDelayMs??15e3),multiplier:Math.max(1,t?.multiplier??2),...t?.maxAttempts===void 0?{}:{maxAttempts:Math.max(0,t.maxAttempts)}}}var ke=class{constructor(e,n=yt){this.transport=e;this.requestTimeoutMs=n}transport;requestTimeoutMs;operation(e,n,i){return I(()=>this.transport.operation(e,n,i),Wn)}async describe(e){let n=await this.rawOperation("describe",{},pt,e);return x(n,aa)}async changes(e={},n){let i=await this.rawOperation("changes",e,ft,n);return x(i,ra)}async read(e,n){let i=await this.envelopeOperation("read",$r(e),V,n);return x(i,St)}async query(e={},n){let i=await this.envelopeOperation("query",Vr(e),Jn,n);return x(i,({results:o,meta:r})=>({results:o.map($i),...r?{meta:{totalCount:r.total_count,hasMore:r.has_more,...r.snapshot?{snapshot:r.snapshot}:{}}}:{}}))}async*queryPages(e={},n={}){let{offset:i,limit:o,snapshot:r,...a}=e,s=sa(i,0),c=Ni(n.firstPageSize??o,200),d=Ni(n.pageSize??o,1e3),p=r,u=0,f=0;for(;!n.signal?.aborted;){let h=await this.query({...a,offset:s,limit:f===0?c:d,...p?{snapshot:p}:{}},{signal:n.signal,timeoutMs:n.pageTimeoutMs});if(!h.ok){yield h;return}let m=h.value,y=m.meta?.snapshot;if(p&&y&&p!==y){yield P(T("query_snapshot_changed","The collection query snapshot changed while paging. Refresh the query before continuing."));return}!p&&y&&(p=y),u+=m.results.length;let v=!m.meta?.hasMore||m.results.length===0,g={results:m.results,...m.meta?{meta:m.meta}:{},page:f,offset:s,loaded:u,complete:v,...p?{snapshot:p}:{}};if(n.onProgress?.(g),yield k(g,h.diagnostics),v)return;s+=m.results.length,f+=1}}async queryAll(e={},n={}){let i=te(n,this.requestTimeoutMs),o=[],r,a=[];try{for await(let s of this.queryPages(e,{firstPageSize:n.firstPageSize,pageSize:n.pageSize,signal:i.signal,pageTimeoutMs:null,onProgress:n.onProgress})){if(!s.ok)return s;let c=s.value;o.push(...c.results),r=c,a.push(...s.diagnostics)}if(i.signal.aborted)throw G(i.signal);return k({results:o,meta:{...r?.meta??{},totalCount:r?.meta?.totalCount??o.length,hasMore:r?!r.complete:!1,...r?.snapshot?{snapshot:r.snapshot}:{}}},a)}catch(s){if(s instanceof b)return P(s.problem);throw s}finally{i.dispose()}}async listViews(e){let n=await this.envelopeOperation("list_views",{},V,e);return x(n,i=>({views:i.views,meta:{totalCount:i.meta.total_count}}))}async executeView(e,n){let i=await this.envelopeOperation("execute_view",e,V,n);return x(i,ea)}readViewSource(e,n){return this.envelopeOperation("read_view_source",e,V,n)}createViewSource(e,n){return this.envelopeOperation("create_view_source",e,q,n)}updateViewSource(e,n){return this.envelopeOperation("update_view_source",dn(e),q,n)}deleteViewSource(e,n){return this.envelopeOperation("delete_view_source",dn(e),q,n)}async create(e,n){let i=await this.envelopeOperation("create",Gr(e),q,n);return x(i,St)}async update(e,n){let i=await this.envelopeOperation("update",Wr(e),q,n);return x(i,St)}async delete(e,n){let i=await this.envelopeOperation("delete",Di(e),q,n);return x(i,ji)}async preflightDelete(e,n){let i=await this.envelopeOperation("delete",{...Di(e),check_backlinks:!0,dry_run:!0},q,n);return x(i,Qr)}async rename(e,n){let i=await this.envelopeOperation("rename",qi(e),q,n);return x(i,Xr)}async preflightRename(e,n){let i=await this.envelopeOperation("rename",{...qi(e),dry_run:!0},q,n);return x(i,Zr)}validate(e={},n){return this.envelopeOperation("validate",e,V,n)}readType(e,n){return this.envelopeOperation("read_type",e,ee,n)}createType(e,n){return this.envelopeOperation("create_type",e,ee,n)}updateType(e,n){return this.envelopeOperation("update_type",dn(e),ee,n)}async assessTypePack(e,n){let i=await this.envelopeOperation("assess_type_pack",Li(e),ee,n);return x(i,pn)}async applyTypePack(e,n){let i=await this.envelopeOperation("apply_type_pack",Jr(e),ee,n);return x(i,na)}async assessCollectionSetup(e,n){let i=await this.envelopeOperation("assess_collection_setup",Bi(e),ee,n);return x(i,Ui)}async applyCollectionSetup(e,n){let i=await this.envelopeOperation("apply_collection_setup",Yr(e),ee,n);return x(i,o=>({assessment:Ui(o.assessment),receipt:ia(o.receipt)}))}async listTimers(e,n){let i=await this.rawOperation("list_timers",{namespace:e},V,n);return x(i,o=>({namespace:o.namespace,timers:o.timers.map(un)}))}async putTimer(e,n){let i=await this.rawOperation("put_timer",{namespace:e.namespace,criterion_id:e.criterionId,timer:Fi(e.timer)},q,n);return x(i,un)}cancelTimer(e,n){return this.rawOperation("cancel_timer",e,q,n)}async reconcileTimers(e,n){let i=await this.rawOperation("reconcile_timers",{namespace:e.namespace,criterion_id:e.criterionId,timers:e.timers.map(Fi)},q,n);return x(i,o=>({namespace:o.namespace,timers:o.timers.map(un),cancelledIds:o.cancelled_ids}))}async*watch(e={}){let n=e.cursor,i=Math.max(100,e.pollIntervalMs??1e3),o=Ei(e.retry),r=0,a=!1;for(e.onStatus?.({state:"connecting",...n===void 0?{}:{cursor:n}});!e.signal?.aborted;){let s=await this.changes(n===void 0?{}:{after:n,limit:200},{signal:e.signal,timeoutMs:e.timeoutMs});if(!s.ok){let p=s.problem;if(e.signal?.aborted)return;if(!o||p.recovery!=="retry"){yield s;return}if(a=!1,r+=1,o.maxAttempts!==void 0&&r>o.maxAttempts){yield s;return}let u=Math.min(o.maxDelayMs,Math.round(o.initialDelayMs*o.multiplier**(r-1)));e.onStatus?.({state:"reconnecting",...n===void 0?{}:{cursor:n},attempt:r,retryInMs:u,problem:p});try{await Qe(u,e.signal)}catch{if(!e.signal?.aborted)throw l("operation_failed","Watch retry delay failed unexpectedly.")}continue}let c=s.value;if(n===void 0){n=c.cursor;continue}if(c.reset){let p=T("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again.");e.onStatus?.({state:"reset_required",cursor:n,problem:p}),yield P(p);return}let d=r>0;r=0,(!a||d)&&e.onStatus?.({state:"connected",cursor:n,recovered:d}),a=!0;for(let p of c.events)yield k(p);if(n=c.cursor,!c.hasMore)try{await Qe(i,e.signal)}catch{if(!e.signal?.aborted)throw l("operation_failed","Watch polling delay failed unexpectedly.")}}}rawOperation(e,n,i,o){return I(()=>this.transport.operation(e,n,o),i)}async envelopeOperation(e,n,i,o){let r=await I(()=>this.transport.operation(e,n,o),i);if(!r.ok)return r;let a=r.value;return a.valid?k(a.result,a.diagnostics):P(ye(a))}};function x(t,e){return t.ok?k(e(t.value),t.diagnostics):t}function $r(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function Vr(t){return{...t.types?{types:t.types}:{},...t.timezone?{timezone:t.timezone}:{},...t.context?{context:t.context}:{},...t.projections?{projections:Object.fromEntries(Object.entries(t.projections).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.where?{where:t.where}:{},...t.select?{select:t.select.map(e=>typeof e=="string"?e:{name:e.name,expr:e.expression,...e.label?{label:e.label}:{},...e.description?{description:e.description}:{}})}:{},...t.orderBy?{order_by:t.orderBy}:{},...t.groupBy?{group_by:t.groupBy}:{},...t.summaryFunctions?{summary_functions:Object.fromEntries(Object.entries(t.summaryFunctions).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.summaries?{summaries:t.summaries}:{},...t.limit===void 0?{}:{limit:t.limit},...t.offset===void 0?{}:{offset:t.offset},...t.snapshot?{snapshot:t.snapshot}:{},...t.includeBody===void 0?{}:{include_body:t.includeBody},...t.frontmatterMode?{frontmatter_mode:t.frontmatterMode}:{},...t.contract?{contract:t.contract}:{}}}function Gr(t){return{...t.path?{path:t.path}:{},...t.type?{type:t.type}:{},...t.contract?{contract:t.contract}:{},...t.frontmatter?{frontmatter:t.frontmatter}:{},...t.body===void 0?{}:{body:t.body},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function Wr(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument},...t.document===void 0?{patch:t.patch,...t.body===void 0?{}:{body:t.body}}:{document:t.document}}}function Di(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.checkBacklinks===void 0?{}:{check_backlinks:t.checkBacklinks},...t.ifRevision?{if_revision:t.ifRevision}:{}}}function qi(t){return{from:t.from,to:t.to,...t.contract?{contract:t.contract}:{},...t.updateRefs===void 0?{}:{update_refs:t.updateRefs},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function dn(t){let{ifRevision:e,...n}=t;return{...n,...e?{if_revision:e}:{}}}function Li(t){return{provision:t.provision,installed_by:t.installedBy,...t.adoptResources?{adopt_resources:t.adoptResources}:{},...t.preserveSeedTargets?{preserve_seed_targets:t.preserveSeedTargets}:{},...t.targetOverrides?{target_overrides:t.targetOverrides}:{},...t.contractSetups?{contract_setups:t.contractSetups.map(Ki)}:{}}}function Jr(t){return{...Li(t),expected_assessment_digest:t.expectedAssessmentDigest,...t.allowDowngrade===void 0?{}:{allow_downgrade:t.allowDowngrade}}}function Bi(t){return{application_id:t.applicationId,declaration_digest:t.declarationDigest,requirements:t.requirements,provisions:{configuration:t.provisions.configuration,type_packs:t.provisions.typePacks},...t.contractSetups?{contract_setups:t.contractSetups.map(Ki)}:{},...t.typePackAdoptions?{type_pack_adoptions:t.typePackAdoptions}:{}}}function Yr(t){return{...Bi(t),expected_assessment_digest:t.expectedAssessmentDigest,expected_collection_revision:t.expectedCollectionRevision,expected_provision_digest:t.expectedProvisionDigest,...t.allowTypePackDowngrades?{allow_type_pack_downgrades:t.allowTypePackDowngrades}:{}}}function ji(t){return{path:t.path,deleted:t.deleted,...t.broken_links?{brokenLinks:t.broken_links}:{}}}function Qr(t){return{...ji(t),deleted:!1,dryRun:!0,wouldDelete:!0}}function Xr(t){let{references_updated:e,...n}=t;return{...St(n),from:t.from,to:t.to,...e?{referencesUpdated:e}:{}}}function Zr(t){return{from:t.from,to:t.to,dryRun:!0,wouldRename:!0,...t.references_affected?{referencesAffected:t.references_affected}:{},...t.warnings?{warnings:t.warnings}:{}}}function Fi(t){return{id:t.id,fire_at:t.fireAt,...t.data===void 0?{}:{data:t.data}}}function un(t){return{id:t.id,fireAt:t.fire_at,...t.data===void 0?{}:{data:t.data},criterionId:t.criterion_id,generation:t.generation,status:t.status,createdAt:t.created_at,updatedAt:t.updated_at,firedAt:t.fired_at}}function Ki(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",type_name:t.typeName,type_revision:t.typeRevision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function Hi(t){return{id:t.id,version:t.version,digest:t.digest,type:t.type,implementationDigest:t.implementation_digest}}function $i(t){let{effective_frontmatter:e,contract:n,...i}=t;return{...i,...e===void 0?{}:{effectiveFrontmatter:e},...n?{contract:Hi(n)}:{}}}function St(t){let{effective_frontmatter:e,contract:n,...i}=t;return{...i,effectiveFrontmatter:e,...n?{contract:Hi(n)}:{}}}function ea(t){return{results:t.results.map(e=>{let n=$i(e);if(!n.effectiveFrontmatter)throw new Error("Saved view result omitted canonical effective frontmatter.");return{...n,effectiveFrontmatter:n.effectiveFrontmatter}}),meta:{totalCount:t.meta.total_count,hasMore:t.meta.has_more,view:t.meta.view,...t.meta.context?{context:t.meta.context}:{},...t.meta.groups?{groups:t.meta.groups}:{}}}}function zi(t){return{source:t.source,target:t.target,kind:t.kind,mode:t.mode,action:t.action,digest:t.digest,...t.current_digest?{currentDigest:t.current_digest}:{},...t.installed_digest?{installedDigest:t.installed_digest}:{},...t.adopted_from_digest?{adoptedFromDigest:t.adopted_from_digest}:{},...t.reason?{reason:t.reason}:{}}}function Rt(t){return{id:t.id,version:t.version,digest:t.digest,installedBy:t.installed_by,resources:t.resources.map(e=>({source:e.source,target:e.target,kind:e.kind,mode:e.mode,digest:e.digest,...e.adopted_from_digest?{adoptedFromDigest:e.adopted_from_digest}:{}}))}}function ta(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",typeName:t.type_name,typeRevision:t.type_revision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function pn(t){return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessment_digest,...t.current?{current:Rt(t.current)}:{},desired:Rt(t.desired),resources:t.resources.map(zi),lock:t.lock,contractSetups:{choices:t.contract_setups.choices.map(ta),resources:t.contract_setups.resources.map(zi)}}}function na(t){return{...pn(t),receipt:Rt(t.receipt),cleanupDeferred:t.cleanup_deferred}}function Ui(t){return{status:t.status,applicable:t.applicable,applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,collectionRevision:t.collection_revision,finalCollectionRevision:t.final_collection_revision,baselineDiagnosticCount:t.baseline_diagnostic_count,finalDiagnosticCount:t.final_diagnostic_count,resolvedDiagnosticCount:t.resolved_diagnostic_count,introducedDiagnosticCount:t.introduced_diagnostic_count,baselineDiagnosticDigest:t.baseline_diagnostic_digest,configuration:t.configuration,typePacks:t.type_packs.map(pn),finalResourceRevisions:t.final_resource_revisions,assessmentDigest:t.assessment_digest}}function ia(t){return{applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,assessmentDigest:t.assessment_digest,collectionRevision:t.collection_revision,configuration:t.configuration,typePacks:t.type_packs.map(Rt),cleanupDeferred:t.cleanup_deferred}}function oa(t){return{cursor:t.cursor,type:t.type,occurredAt:t.occurred_at,payload:t.payload}}function ra(t){return{events:t.events.map(oa),cursor:t.cursor,hasMore:t.has_more,reset:t.reset}}function aa(t){return{protocolVersion:t.protocol_version,collectionId:t.collection_id,displayName:t.display_name,specVersion:t.spec_version,operations:t.operations,changeCursor:t.change_cursor,types:t.types,contracts:t.contracts.map(e=>({contractType:e.contract_type,id:e.id,version:e.version,digest:e.digest,schema:e.schema,...e.binding_schema?{bindingSchema:e.binding_schema}:{},implementations:e.implementations.map(n=>({typeName:n.type_name,typeVersion:n.type_version,...n.type_path?{typePath:n.type_path}:{},digest:n.digest,fields:n.fields,...n.binding?{binding:n.binding}:{}}))})),...t.configuration?{configuration:t.configuration}:{}}}function sa(t,e){return typeof t=="number"&&Number.isFinite(t)?Math.max(0,Math.floor(t)):e}function Ni(t,e){return typeof t=="number"&&Number.isFinite(t)&&t>0?Math.floor(t):e}var Pt=class{constructor(e){this.context=e}context;async registerNotifications(e){return F(e,this.context.requestTimeoutMs,n=>this.registerNotificationsWithinBudget(e,n.signal))}async registerNotificationsWithinBudget(e,n){let i=await this.context.authorizedToken(n);if(!i)throw l("not_authorized","Connect this application before enabling notifications.");let r=(await this.context.register(n)).notifications?.criteria.map(g=>g.id)??[],a=[...new Set(e.criteria??r)],s=a.find(g=>!r.includes(g));if(s)throw l("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw l("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=await J(`${this.context.serverUrl}/v1/notifications/vapid-public-key`,{signal:n},"notifications_unavailable","Push notifications are unavailable."),d=await S(c,"invalid_operation_response","Connect returned an invalid notification key response.");if(!c.ok)throw A(d,"notifications_unavailable","Push notifications are unavailable.",c.status);let p=await e.serviceWorker.pushManager.getSubscription();p||(p=await e.serviceWorker.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:yi(d.public_key)}));let u=p.toJSON();if(!u.endpoint||!u.keys?.p256dh||!u.keys.auth)throw l("invalid_push_subscription","The browser returned an incomplete push subscription.");let f=M(this.context.storage.getItem(this.context.notificationKey())),h=e.installationId??f?.installationId??j(24),m=await J(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${i.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:h,criteria:a,subscription:{endpoint:u.endpoint,expirationTime:u.expirationTime??null,keys:u.keys}}),signal:n},"notification_registration_failed","Could not register push notifications."),y=await S(m,"invalid_operation_response","Connect returned an invalid notification registration response.");if(!m.ok)throw A(y,"notification_registration_failed","Could not register push notifications.",m.status);f?.channelId&&f.channelId!==y.channel_id&&fetch(`${this.context.serverUrl}/v1/notifications/channels/${f.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${i.accessToken}`},signal:n}).catch(()=>{});let v={channelId:y.channel_id,installationId:h,criteria:a};return this.context.storage.setItem(this.context.notificationKey(),JSON.stringify(v)),v}async registerNativeNotifications(e){return F(e,this.context.requestTimeoutMs,n=>this.registerNativeNotificationsWithinBudget(e,n.signal))}async registerNativeNotificationsWithinBudget(e,n){let i=await this.context.authorizedToken(n);if(!i)throw l("not_authorized","Connect this application before enabling notifications.");let o=await this.context.register(n);if(o.notifications?.native_delivery?.mode!=="managed_fcm")throw l("managed_fcm_not_declared","This application does not declare Connect-managed native notifications.");let r=o.notifications.criteria.map(m=>m.id),a=[...new Set(e.criteria??r)],s=a.find(m=>!r.includes(m));if(s)throw l("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw l("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=this.context.notificationKey("fcm"),d=M(this.context.storage.getItem(c)),p=e.installationId??d?.installationId??j(24),u=await J(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${i.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:p,criteria:a,transport:"fcm",token:e.token}),signal:n},"notification_registration_failed","Could not register native notifications."),f=await S(u,"invalid_operation_response","Connect returned an invalid native notification response.");if(!u.ok)throw A(f,"notification_registration_failed","Could not register native notifications.",u.status);d?.channelId&&d.channelId!==f.channel_id&&this.deleteNotificationChannel(d.channelId,i.accessToken,n).catch(()=>{});let h={channelId:f.channel_id,installationId:p,transport:"fcm",criteria:a};return this.context.storage.setItem(c,JSON.stringify(h)),h}async unregisterNativeNotifications(e={}){return F(e,this.context.requestTimeoutMs,n=>this.unregisterNativeNotificationsWithinBudget(n.signal))}async unregisterNativeNotificationsWithinBudget(e){let n=this.context.notificationKey("fcm"),i=M(this.context.storage.getItem(n)),o=await this.context.authorizedToken(e);if(i?.channelId&&!o)throw l("not_authorized","Reconnect this application before disabling native notifications.");i?.channelId&&o&&await this.deleteNotificationChannel(i.channelId,o.accessToken,e),this.context.storage.removeItem(n)}async unregisterNotifications(e,n={}){return F(n,this.context.requestTimeoutMs,i=>this.unregisterNotificationsWithinBudget(e,i.signal))}async unregisterNotificationsWithinBudget(e,n){let i=M(this.context.storage.getItem(this.context.notificationKey())),o=await this.context.authorizedToken(n);if(i?.channelId&&!o)throw l("not_authorized","Reconnect this application before disabling push notifications.");if(i?.channelId&&o){let a=await J(`${this.context.serverUrl}/v1/notifications/channels/${i.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${o.accessToken}`},signal:n},"notification_unregistration_failed","Could not unregister push notifications.");if(!a.ok&&a.status!==404){let s=await S(a,"invalid_operation_response","Connect returned an invalid notification response.");throw A(s,"notification_unregistration_failed","Could not unregister push notifications.",a.status)}}this.context.storage.removeItem(this.context.notificationKey()),await(await e?.pushManager.getSubscription())?.unsubscribe()}async deleteNotificationChannel(e,n,i){let o=await J(`${this.context.serverUrl}/v1/notifications/channels/${e}`,{method:"DELETE",headers:{authorization:`Bearer ${n}`},signal:i},"notification_unregistration_failed","Could not unregister push notifications.");if(!o.ok&&o.status!==404){let r=await S(o,"invalid_operation_response","Connect returned an invalid notification response.");throw A(r,"notification_unregistration_failed","Could not unregister push notifications.",o.status)}}};async function At(t,e,n,i,o,r){if(!t.authority)throw l("not_remote_authority","This authorization has no remote authority endpoint.");let a=n===""||n.startsWith("?")?n:`/${n}`,s=`${t.authority.filesUrl}${a}`,c=i===void 0?void 0:JSON.stringify(i),d=await r(t,e,s,c,t.authority.accessToken);return fetch(s,{method:e,redirect:"error",headers:{authorization:`Bearer ${t.authority.accessToken}`,...c===void 0?{}:{"content-type":"application/json"},...d},...c===void 0?{}:{body:c},...o?{signal:o}:{}})}async function Vi(t,e,n,i,o,r,a){let s=t,c=await At(s,e,n,i,o,a);if(c.status===401&&s.refreshToken){if(s=await r(),!s.authority||!s.fileCapability)throw l("authority_authorization_changed","Reconnect this collection before accessing its files.");c=await At(s,e,n,i,o,a)}let d=await S(c,"invalid_operation_response","The hosted authority returned an invalid file response.");if(!c.ok)throw A(d,"operation_failed","Collection file request failed.",c.status);return d}async function Gi(t,e,n,i,o,r){let a=t,s=await At(a,"GET",e,void 0,i,r);if(s.status===401&&a.refreshToken){if(a=await o(),!a.authority||!a.fileCapability)throw l("authority_authorization_changed","Reconnect this collection before accessing its files.");s=await At(a,"GET",e,void 0,i,r)}if(!s.ok){let d=await S(s,"invalid_operation_response","The hosted authority returned an invalid file range error response.");throw A(d,"operation_failed","Collection file range request failed.",s.status)}let c=s.headers.get("content-length");if(c===null||!/^(0|[1-9][0-9]*)$/u.test(c)||Number(c)!==n)throw await s.body?.cancel().catch(()=>{}),l("invalid_operation_response","The hosted file response declared an unexpected byte length.");if(!s.body)throw l("invalid_operation_response","The hosted file response did not contain a byte stream.");return s.body}var ca="mdbase-connect file chunk key v1",Ot=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Y=class extends Error{constructor(n,i){super(i);this.code=n;this.name="FileTransferCryptoError"}code},Ie=class t{constructor(e,n){this.binding=e;this.key=n}binding;key;static async open(e,n,i){Wi(i);let o=await e.get(n);if(!o||o.agreementPublicKey!==i.encryption.application_agreement_public_key)throw new w("missing_grant_key","The encrypted grant key is unavailable or does not match the file transfer grant.");let r=await He(o.agreementPrivateKey,i.encryption.connector_agreement_public_key);return t.fromSharedSecret(r,i)}static async fromSharedSecret(e,n){Wi(n);let i=await fn(e,n);return new t(n,i)}async encryptChunk(e,n,i){if(this.validateHeader(n),i.byteLength!==n.plaintext_length)throw new Y("plaintext_length_mismatch","File chunk plaintext length does not match its authenticated header.");let o=it(e,n),r=await crypto.subtle.encrypt({name:"AES-GCM",iv:Ji(n.chunk_index),additionalData:Tt(o),tagLength:128},this.key,Tt(i));return In({kind:e,header:n,payload:new Uint8Array(r)})}async decryptChunk(e){let n=ot(e);this.validateHeader(n.header);let i=it(n.kind,n.header);try{let o=await crypto.subtle.decrypt({name:"AES-GCM",iv:Ji(n.header.chunk_index),additionalData:Tt(i),tagLength:128},this.key,Tt(n.payload));return new Uint8Array(o)}catch{throw new Y("authentication_failed","The encrypted file chunk could not be authenticated.")}}validateHeader(e){let n=this.binding.encryption;if(e.protocol_version!==1||e.protection!=="grant_aead_v1"||e.grant_id!==this.binding.grantId||e.authority_id!==this.binding.authorityId||e.collection_id!==n.collection_id||e.transfer_id!==this.binding.transferId||e.direction!==this.binding.direction||e.scope_epoch!==n.scope_epoch||e.key_id!==n.key_id)throw new Y("header_binding_mismatch","The file frame does not match its transfer encryption binding.")}};async function fn(t,e){let n=new TextEncoder().encode(la(e)),i=await crypto.subtle.digest("SHA-256",n),o=await crypto.subtle.importKey("raw",t,"HKDF",!1,["deriveKey"]);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:i,info:new TextEncoder().encode(ca)},o,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}function Wi(t){if(W(t.encryption),!Ot.test(t.grantId)||!Ot.test(t.applicationId)||!Ot.test(t.authorityId)||!Ot.test(t.transferId)||t.direction!=="upload"&&t.direction!=="download")throw new Y("invalid_binding","The file transfer encryption binding is invalid.")}function la(t){let e=t.encryption;return["mdbase-connect","file-transfer",1,e.suite,t.grantId,t.applicationId,e.connector_id,t.authorityId,e.collection_id,e.scope_epoch,e.key_id,t.transferId,t.direction].join("|")}function Ji(t){if(!Number.isSafeInteger(t)||t<0)throw new Y("invalid_chunk_index","The file chunk index is invalid.");let e=new Uint8Array(new ArrayBuffer(12));return new DataView(e.buffer).setBigUint64(4,BigInt(t),!1),e}function Tt(t){return Uint8Array.from(t).buffer}var It=class{constructor(e){this.options=e}options;async control(e,n,i,o,r){Me(e);let a=ya(n,i,o),s=await this.encryptControl(e,a),c;if(await this.options.shouldAttemptDirect(e)){try{c=await fetch(`${this.options.loopbackUrl}/v1/files/control`,le({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(s),signal:r}))}catch(d){if(r?.aborted)throw d;this.options.onDirectUnavailable()}if(c&&!Ce(c.status))return c.ok&&this.options.onDirectAvailable(),this.decryptControlResponse(e,s,c);c&&this.options.onDirectUnavailable()}return c=await this.sendRelayControl(e,s,r),await ua(c,e)&&(e=await this.options.refreshAuthorization(r),hn(e),s=await this.encryptControl(e,a),c=await this.sendRelayControl(e,s,r)),c.ok&&this.options.onRelayAvailable(),this.decryptControlResponse(e,s,c)}async decryptControlResponse(e,n,i){let o=await S(i,"invalid_operation_response","The collection authority returned an invalid file control response.");if(!i.ok)throw A(o,"operation_failed","Collection file request failed.",i.status);let r=o?.envelope;if(!r)throw l("invalid_encrypted_response","The connector omitted its encrypted file response.");let a=await ve(this.options.keyStore,e.keyHandle,yn(e),n,r);return a.ok||ha(a.problem),a.result}async uploadChunk(e,n,i,o){let a=await this.localFileToken(e,"upload",o),s=await Yi(this.options.keyStore,a,e,n,i),c;if(await this.options.shouldAttemptDirect(a)){try{c=await fetch(`${this.options.loopbackUrl}/v1/files/upload`,le(Qi(s,o)))}catch(d){if(o?.aborted)throw d;this.options.onDirectUnavailable()}if(c&&!Ce(c.status))return c.ok&&this.options.onDirectAvailable(),da(c,"Encrypted file chunk upload failed.");c&&this.options.onDirectUnavailable()}if(c=await this.sendRelayUpload(a,s,o),c.status===401&&a.refreshToken&&(a=await this.options.refreshAuthorization(o),hn(a),s=await Yi(this.options.keyStore,a,e,n,i),c=await this.sendRelayUpload(a,s,o)),!c.ok){let d=await S(c,"invalid_operation_response","The collection authority returned an invalid file upload response.");throw A(d,"operation_failed","Encrypted file chunk upload failed.",c.status)}this.options.onRelayAvailable()}async downloadChunk(e,n,i){let o=await this.localFileToken(e,"download",i),r;if(await this.options.shouldAttemptDirect(o)){try{r=await fetch(`${this.options.loopbackUrl}/v1/files/download/${encodeURIComponent(o.grantId)}/${encodeURIComponent(e.transfer_id)}/${n}`,le({method:"GET",signal:i}))}catch(a){if(i?.aborted)throw a;this.options.onDirectUnavailable()}if(r&&!Ce(r.status))return r.ok&&this.options.onDirectAvailable(),this.decryptDownloadResponse(o,e,n,r);r&&this.options.onDirectUnavailable()}return r=await this.sendRelayDownload(o,e,n,i),r.status===401&&o.refreshToken&&(o=await this.options.refreshAuthorization(i),hn(o),r=await this.sendRelayDownload(o,e,n,i)),r.ok&&this.options.onRelayAvailable(),this.decryptDownloadResponse(o,e,n,r)}async decryptDownloadResponse(e,n,i,o){if(!o.ok){let s=await S(o,"invalid_operation_response","The collection authority returned an invalid file download response.");throw A(s,"operation_failed","Encrypted file chunk download failed.",o.status)}if(o.headers.get("content-type")?.split(";",1)[0]!=="application/mdbase-connect-file")throw l("invalid_operation_response","The connector returned an invalid file response media type.");let r=new Uint8Array(await o.arrayBuffer()),a;try{fa(n,i,r),a=await(await Zi(this.options.keyStore,e,n)).decryptChunk(r)}catch(s){throw s instanceof b?s:l("invalid_operation_response","The connector returned an invalid encrypted file frame.",{cause:s})}if(a.byteLength!==mn(n,i))throw l("invalid_operation_response","The connector returned a truncated file chunk.");return a}encryptControl(e,n){return Me(e),ce(this.options.keyStore,e.keyHandle,yn(e),"file_control",n)}sendRelayControl(e,n,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/control`,{method:"POST",headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/json"},body:JSON.stringify(n),signal:i})}sendRelayUpload(e,n,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/upload`,{...Qi(n,i),headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/mdbase-connect-file"}})}sendRelayDownload(e,n,i,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/download/${encodeURIComponent(n.transfer_id)}/${i}`,{method:"GET",headers:{authorization:`Bearer ${e.accessToken}`},signal:o})}async localFileToken(e,n,i){let o=await this.options.authorizedToken(i);if(!o||o.authority||!o.fileCapability||!o.encryption||!o.grantId||!o.keyHandle||e.direction!==n||e.protection!=="grant_aead_v1")throw l("not_authorized","This connection cannot use encrypted local file delivery.");return Mt(e),o}};function hn(t){if(t.authority||!t.fileCapability)throw l("not_authorized","This connection cannot use encrypted local file delivery.");Me(t)}async function Yi(t,e,n,i,o){let r=pa(e,n,i,o.byteLength);return(await Zi(t,e,n)).encryptChunk("upload_chunk",r,o)}function Qi(t,e){return{method:"POST",headers:{"content-type":"application/mdbase-connect-file"},body:Uint8Array.from(t).buffer,signal:e}}async function da(t,e){if(t.ok)return;let n=await S(t,"invalid_operation_response","The collection authority returned an invalid file transfer response.");throw A(n,"operation_failed",e,t.status)}async function ua(t,e){return e.refreshToken?t.status===401?!0:t.status!==409?!1:(await S(t.clone(),"invalid_operation_response","The collection authority returned an invalid file response.").catch(()=>null))?.error?.code==="encryption_binding_stale":!1}function Me(t){if(!t.encryption||!t.grantId||!t.keyHandle)throw l("missing_grant_key","Reconnect this application to restore encrypted file access.")}function yn(t){return Me(t),{grantId:t.grantId,applicationId:t.clientId,encryption:t.encryption}}function Zi(t,e,n){return Me(e),Ie.open(t,e.keyHandle,{...yn(e),authorityId:e.encryption.connector_id,transferId:n.transfer_id,direction:n.direction})}function pa(t,e,n,i){Me(t);let o=Mt(e),r=mn(e,n);if(i!==r)throw l("invalid_request","The file chunk has the wrong byte length.");return{protocol_version:1,protection:"grant_aead_v1",grant_id:t.grantId,authority_id:t.encryption.connector_id,collection_id:t.collectionId,transfer_id:e.transfer_id,direction:e.direction,chunk_size:o,chunk_index:n,offset:n*o,plaintext_length:i,total_size:e.total_size,scope_epoch:t.encryption.scope_epoch,key_id:t.encryption.key_id}}function fa(t,e,n){let i=ot(n),o=mn(t,e),r=Mt(t);if(i.kind!=="download_chunk"||i.header.chunk_index!==e||i.header.chunk_size!==r||i.header.offset!==e*r||i.header.plaintext_length!==o||i.header.total_size!==t.total_size)throw l("invalid_operation_response","The connector returned a file frame for a different chunk.")}function ha(t){throw U(t.code==="unknown"?t.server_code:t.code,t.message,{details:t.details,operationOutcome:t.operation_outcome??"rejected",traceId:t.trace_id})}function ya(t,e,n){if(t==="GET"&&(e===""||e.startsWith("?"))){let o=new URLSearchParams(e.startsWith("?")?e.slice(1):e),r=o.get("limit");return{protocol_version:1,type:"list_files",...o.get("folder")?{folder:o.get("folder")}:{},...o.get("after")?{after:o.get("after")}:{},...r?{limit:Number(r)}:{}}}let i=e.split("/");if(t==="GET"&&i.length===2&&i[0]==="transfers")return Xi("get_file_transfer_status",i[1]);if(t==="DELETE"&&i.length===2&&i[0]==="transfers")return Xi("abort_file_transfer",i[1]);if(t==="POST"&&ma(n)){let o=e==="uploads"?"open_file_upload":e==="downloads"?"open_file_download":i.length===3&&i[0]==="uploads"&&i[2]==="commit"?"commit_file_upload":i.length===2&&i[1]==="move"&&n.file_id===decodeURIComponent(i[0])?"move_file":i.length===2&&i[1]==="delete"&&n.file_id===decodeURIComponent(i[0])?"delete_file":null;if(o&&n.type===o)return{...n}}throw l("invalid_request","The file control request path is invalid.")}function Xi(t,e){return{protocol_version:1,type:t,transfer_id:decodeURIComponent(e)}}function Mt(t){if(t.strategy.kind!=="framed_chunks"||!Number.isSafeInteger(t.strategy.chunk_size)||t.strategy.chunk_size<=0)throw l("invalid_operation_response","The connector returned an invalid framed transfer strategy.");return t.strategy.chunk_size}function mn(t,e){let n=Mt(t);if(!Number.isSafeInteger(e)||e<0||!Number.isSafeInteger(t.total_size)||t.total_size<0)throw l("invalid_request","The file chunk index is invalid.");let i=e*n;if(!Number.isSafeInteger(i)||i>=t.total_size)throw l("invalid_request","The file chunk index is outside the transfer.");return Math.min(n,t.total_size-i)}function ma(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var xt=class{constructor(e){this.options=e;this.local=new It(e)}options;local;async control(e,n="",i,o){let r=await this.requireFileToken(o);return r.authority?Vi(r,e,n,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders):this.local.control(r,e,n,i,o)}uploadChunk(e,n,i,o){return this.local.uploadChunk(e,n,i,o)}downloadChunk(e,n,i){return this.local.downloadChunk(e,n,i)}async downloadHostedPart(e,n,i,o){let r=await this.requireFileToken(o);if(!r.authority)throw l("not_remote_authority","Hosted file delivery requires a remote authority endpoint.");return Gi(r,`downloads/${encodeURIComponent(e.transfer_id)}/parts/${n}`,i,o,this.options.refreshAuthorization,this.options.authorityProofHeaders)}async requireFileToken(e){let n=await this.options.authorizedToken(e);if(!n?.fileCapability)throw l("not_authorized","This connection has no file capability.");return n}};async function Ze(t,e,n,i,o,r){if(!e.authority?.proofPublicKey)return{};if(!e.keyHandle)throw l("missing_grant_key","Reconnect this application to restore remote authority request signing.");try{let a=new URL(i);return await mt(t,e.keyHandle,e.authority.proofPublicKey,{method:n,target:`${a.pathname}${a.search}`,body:o,credential:r})}catch(a){throw a instanceof w?U(a.code,a.message):a}}var Et=class{constructor(e,n){this.storage=e;this.baseKey=n}storage;baseKey;list(e){if(!e)return[];let n=M(this.storage.getItem(this.baseKey));if(eo(n)&&n.collectionId===e){let o=this.key(n.requestId);this.storage.getItem(o)||this.storage.setItem(o,JSON.stringify(n)),this.storage.removeItem(this.baseKey)}let i=[];for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);r?.startsWith(`${this.baseKey}:`)&&i.push(r)}return i.map(o=>M(this.storage.getItem(o))).filter(o=>eo(o)&&o.collectionId===e).sort((o,r)=>o.createdAt-r.createdAt||o.requestId.localeCompare(r.requestId))}find(e,n){return this.list(e).find(i=>i.requestId===n)??null}identifier(e){return e.mutation??X(e.operation,e.request?.input??(e.operation==="sync"?{action:"mutate"}:{}))??(e.operation==="sync"?"sync:mutate":e.operation)}store(e){this.storage.setItem(this.key(e.requestId),JSON.stringify(e))}take(e){let n=this.key(e),i=M(this.storage.getItem(n));return this.storage.removeItem(n),i}key(e){return`${this.baseKey}:${encodeURIComponent(e)}`}};function eo(t){return!!(t&&typeof t.collectionId=="string"&&typeof t.requestId=="string"&&t.requestId.length>0&&Mn(t.operation)&&typeof t.inputFingerprint=="string"&&Number.isFinite(t.createdAt)&&t.createdAt>0&&(t.envelope||t.request)&&(t.operation==="sync"||X(t.operation,t.request?.input??{})!==null))}function to({stored:t,collectionId:e,relayEncryption:n,invalidate:i,directCapable:o}){let r=M(t),a=s=>(i(typeof s=="string"?s:void 0),null);if(!r)return t&&a(),null;if(r.version!==1||typeof r.accessToken!="string"||r.accessToken.length===0||typeof r.clientId!="string"||r.clientId.length===0||r.collectionId!==e||typeof r.collectionName!="string"||r.collectionName.length===0||!Array.isArray(r.operations)||r.operations.some(s=>typeof s!="string")||typeof r.expiresAt!="number"||!Number.isFinite(r.expiresAt)||r.refreshToken!==void 0&&(typeof r.refreshToken!="string"||r.refreshToken.length===0)||r.refreshExpiresAt!==void 0&&(typeof r.refreshExpiresAt!="number"||!Number.isFinite(r.refreshExpiresAt))||!bt(r.scope)||r.fileCapability&&!_t(r.fileCapability)||r.authority&&!gi(r.authority,r.collectionId))return a(r.keyHandle);if(n==="required"){if(r.authority){if(!r.keyHandle||!r.authority.proofPublicKey)return a(r.keyHandle)}else if(!r.grantId||!r.keyHandle||!_i(r.encryption,r.collectionId))return a(r.keyHandle)}return r.expiresAt<=Date.now()&&(!r.refreshToken||(r.refreshExpiresAt??0)<=Date.now())?o(r)?r:(i(r.keyHandle),null):r}var Dt=class{serverUrl;storage;keyStore;directAccessMode;loopbackUrl;collectionId;internals;onChange;timeouts;pendingMutationStore;files;refreshPromise=null;directStatus;currentRoute="relay";directFailures=0;directRetryAt=0;constructor(e){this.serverUrl=e.serverUrl,this.storage=e.storage,this.keyStore=e.keyStore,this.directAccessMode=e.directAccessMode,this.loopbackUrl=e.loopbackUrl,this.collectionId=e.collectionId,this.internals=e.internals,this.onChange=e.onChange,this.timeouts=e.timeouts,this.pendingMutationStore=new Et(this.storage,this.internals.pendingMutationKey(this.collectionId)),this.files=new xt({keyStore:this.keyStore,serverUrl:this.serverUrl,loopbackUrl:this.loopbackUrl,authorizedToken:n=>this.authorizedToken({signal:n,timeoutMs:null}),refreshAuthorization:n=>this.refreshAuthorization(n),shouldAttemptDirect:n=>this.shouldAttemptDirect(n),onDirectAvailable:()=>{this.markDirectAvailable(),this.setRoute("direct")},onDirectUnavailable:()=>this.markDirectUnavailable(),onRelayAvailable:()=>this.setRoute("relay"),authorityProofHeaders:(n,i,o,r,a)=>Ze(this.keyStore,n,i,o,r,a)}),this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable"}get directAccess(){return this.currentToken()?.authority?"disabled":this.directStatus}get route(){return this.currentToken()?.authority?"remote":this.currentRoute}notifyStorageChanged(){this.emitConnection()}async checkDirectAccess(e={}){return F(e,this.timeouts.watchStartMs,n=>this.checkDirectAccessWithinBudget(n.signal))}async checkDirectAccessWithinBudget(e){let n=this.currentToken();if(!this.directEligible(n))return this.setDirectStatus("disabled");let i=await $e();return i==="denied"?this.setDirectStatus("denied"):(i==="prompt"||i===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?this.setDirectStatus("permission_required"):this.probeDirectAccess(e)}async requestDirectAccess(e={}){return F(e,this.timeouts.watchStartMs,n=>this.requestDirectAccessWithinBudget(n.signal))}async requestDirectAccessWithinBudget(e){let n=this.currentToken();return this.directCapable(n)?(this.storage.setItem(this.internals.directPreferenceKey(),"enabled"),this.directRetryAt=0,this.probeDirectAccess(e)):this.setDirectStatus("disabled")}disableDirectAccess(){this.storage.setItem(this.internals.directPreferenceKey(),"disabled"),this.setDirectStatus("disabled"),this.setRoute("relay")}pendingMutations(){return this.storedPendingMutations().map(e=>({requestId:e.requestId,operation:this.pendingMutationStore.identifier(e),fingerprint:e.inputFingerprint,status:"outcome_unknown",createdAt:new Date(e.createdAt).toISOString()}))}pendingMutation(e){let n=this.storedPendingMutation(e);return n?{requestId:n.requestId,operation:this.pendingMutationStore.identifier(n),fingerprint:n.inputFingerprint,status:"outcome_unknown",createdAt:new Date(n.createdAt).toISOString()}:null}async recoverPendingMutation(e,n){let i=this.storedPendingMutation(e);if(!i)throw l("no_pending_mutation","There is no interrupted mutation to resume.");return N(n,this.timeouts.requestMs,o=>this.performOperationWithinBudget(i.operation,i.request?.input??{},{...n,signal:o.signal},i))}async performOperation(e,n,i={}){return N(i,this.timeouts.requestMs,o=>this.performOperationWithinBudget(e,n,{...i,signal:o.signal}))}async performOperationWithinBudget(e,n,i,o){de(i.signal);let r=this.currentToken();if(!r)throw l("not_authorized","Connect this application before accessing a collection.");if(!r.operations.includes(e))throw l("insufficient_access",`This connection does not allow ${e}.`,{details:{required_operations:[e],granted_operations:[...r.operations],missing_operations:[e]}});let a=await this.shouldAttemptDirect(r);if(!a&&(r=await this.authorizedToken({signal:i.signal,timeoutMs:null}),!r))throw l("not_authorized","Reconnect this application to continue.");let s=o?.requestId??(si(e,n)?crypto.randomUUID():void 0),c;try{c=await this.sendOperation(r,e,n,a,i,s)}catch(f){throw gt(f,i.signal,s!==void 0&&this.storedPendingMutation(s)!==null?s:void 0,r.authority?"hosted_provider_unavailable":"relay_unavailable")}let d=c.response,p=d.status===409&&(await S(d.clone(),"invalid_operation_response","The collection authority returned an invalid operation response.").catch(()=>null))?.error?.code==="encryption_binding_stale";if((d.status===401||p)&&r.refreshToken){if(c.pendingMutation&&(c.directDeliveryUncertain||c.encryptedRequest&&c.resumingMutation))throw l("operation_outcome_unknown","The direct operation may have completed, but its encrypted grant changed before the response could be recovered. Refresh before making another change.",{operationOutcome:"unknown",details:{request_id:c.requestId}});c.pendingMutation&&this.clearPendingMutation(c.requestId),r=await this.refreshAuthorization(i.signal),a=await this.shouldAttemptDirect(r);try{c=await this.sendOperation(r,e,n,a,i,s)}catch(f){throw gt(f,i.signal,s!==void 0&&this.storedPendingMutation(s)!==null?s:void 0,r.authority?"hosted_provider_unavailable":"relay_unavailable")}d=c.response}let u;try{u=await S(d,"invalid_operation_response","The collection authority returned a response that is not valid JSON.")}catch(f){throw c.pendingMutation?B(c.requestId,f):l("invalid_operation_response","The collection authority returned a response that is not valid JSON.",{cause:f})}if(!d.ok){let f=A(u,"operation_failed","Collection operation failed.",d.status);throw c.pendingMutation&&(c.directDeliveryUncertain||c.encryptedRequest&&c.resumingMutation)?B(c.requestId,f):(c.pendingMutation&&!c.directDeliveryUncertain&&this.clearPendingMutation(c.requestId),f.code==="direct_operation_rejected"&&f.status===403&&this.invalidateRejectedAuthorization(r),f)}if(c.encryptedRequest){let f=u?.envelope,h=c.pendingMutationRecord,m=h?.encryption??r.encryption,y=h?.grantId??r.grantId,v=h?.applicationId??r.clientId,g=h?.keyHandle??r.keyHandle;if(!f||!m||!y||!g)throw c.pendingMutation?B(c.requestId,new Error("Encrypted operation response was missing its envelope.")):l("invalid_encrypted_response","The relay did not return an encrypted connector response.");try{let _=await ve(this.keyStore,g,{grantId:y,applicationId:v,encryption:m},c.encryptedRequest,f);if(c.pendingMutation&&this.clearPendingMutation(c.requestId),!_.ok)throw U(_.problem.code==="unknown"?_.problem.server_code:_.problem.code,_.problem.message,{details:_.problem.details,operationOutcome:_.problem.operation_outcome??"rejected",traceId:_.problem.trace_id});return _.result}catch(_){throw _ instanceof b?_:_ instanceof w?c.pendingMutation?B(c.requestId,_):U(_.code,_.message):_}}if(u?.protocol_version!==Z||u?.request_id!==c.requestId)throw c.pendingMutation?B(c.requestId,new Error("Operation response protocol or request ID did not match.")):l("invalid_operation_response","The collection authority returned a response for a different protocol request.");if(u.ok===!1)throw ze(u.problem)?(c.pendingMutation&&this.clearPendingMutation(c.requestId),new b(u.problem)):c.pendingMutation?B(c.requestId,new Error("Operation rejection did not contain a canonical problem.")):l("invalid_operation_response","The collection authority returned an invalid operation problem.");if(u.ok!==!0||!("result"in u))throw c.pendingMutation?B(c.requestId,new Error("Successful operation response did not contain a result.")):l("invalid_operation_response","The collection authority returned an incomplete operation response.");return c.pendingMutation&&this.clearPendingMutation(c.requestId),u.result}async performAuthoritySyncRequest(e,n,i,o,r,a={}){return N(a,this.timeouts.syncMs,async s=>{let c=await this.authorizedToken({signal:s.signal,timeoutMs:null});if(!c?.authority||c.collectionId!==e||c.authority.replicaId!==n)throw l("authority_authorization_changed","Reconnect this collection authority before synchronizing.");try{let d=await this.sendAuthoritySyncRequest(c,i,o,r,s.signal);if(d.status===401&&c.refreshToken){if(c=await this.refreshAuthorization(s.signal),!c.authority||c.collectionId!==e||c.authority.replicaId!==n)throw l("authority_authorization_changed","Reconnect this collection authority before synchronizing.");d=await this.sendAuthoritySyncRequest(c,i,o,r,s.signal)}let p=await S(d,"invalid_operation_response","The collection authority returned an invalid synchronization response.");if(!d.ok)throw A(p,"sync_failed","Collection synchronization failed.",d.status);return p}catch(d){let p=i==="POST"&&o==="mutations"&&r&&typeof r=="object"&&typeof r.mutation_id=="string"?r.mutation_id:void 0;throw gt(d,s.signal,p,"hosted_provider_unavailable")}})}async sendAuthoritySyncRequest(e,n,i,o,r){if(!e.authority)throw l("not_remote_authority","This authorization has no remote authority endpoint.");let a=`${e.authority.syncUrl}/${i}`,s=o===void 0?void 0:JSON.stringify(o),c=await Ze(this.keyStore,e,n,a,s,e.authority.accessToken);return fetch(a,{method:n,headers:{authorization:`Bearer ${e.authority.accessToken}`,...o===void 0?{}:{"content-type":"application/json"},...c},...s===void 0?{}:{body:s},signal:r})}async sendOperation(e,n,i,o,r={},a){let s=i??{},c,d=!1,p=!1,u=a??crypto.randomUUID(),f=null,h;if(a!==void 0){if(f=this.storedPendingMutation(a),h=f?.inputFingerprint??await fi(n,i),f){if(f.collectionId!==e.collectionId||f.operation!==n||f.inputFingerprint!==h)throw l("pending_mutation_unresolved","A previous write still has an unknown outcome. Retry that exact write before making another change.");u=f.requestId,p=!0}d=!0}let m=f?.mutation??X(n,i);if(f?.envelope&&(e.authority||!e.encryption))throw l("pending_mutation_unresolved","The pending write requires its encrypted relay authority. Reconnect that authority before recovery.");if(f?.request&&e.encryption&&!e.authority)throw l("pending_mutation_unresolved","The pending write belongs to a different authority transport. Reconnect that authority before recovery.");if(e.encryption&&!e.authority){if(!e.grantId||!e.keyHandle)throw l("missing_grant_key","Reconnect this application to restore encrypted access.");try{if(d)if(f){if(!f.envelope)throw l("pending_mutation_unresolved","The pending write belongs to a different transport. Reconnect before retrying it.");c=f.envelope}else c=await ce(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,i,u),this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},keyId:e.encryption.key_id,keyHandle:e.keyHandle,applicationId:e.clientId,encryption:e.encryption,operation:n,mutation:m,inputFingerprint:h,requestId:u,envelope:c,createdAt:Date.now()});else c=await ce(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,i)}catch(O){throw O instanceof w?U(O.code,O.message):O}s=c}else{let O=f?.request??{protocol_version:Z,request_id:u,input:s};s=O,d&&!f&&this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},operation:n,mutation:m,inputFingerprint:h,requestId:u,request:O,createdAt:Date.now()})}if(o&&c&&!e.authority){let O=!1;try{let R=await fetch(`${this.loopbackUrl}/v1/operations`,le({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(c),signal:r.signal}));if(!Ce(R.status))return R.ok&&(this.markDirectAvailable(),this.setRoute("direct")),{response:R,requestId:u,encryptedRequest:c,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p};O=R.status>=500,this.markDirectUnavailable()}catch(R){if(r.signal?.aborted)throw R;O=!0,await $e()==="denied"?this.setDirectStatus("denied"):this.markDirectUnavailable()}let D;try{D=e.expiresAt>Date.now()+3e4?e:await this.refreshAuthorization(r.signal)}catch(R){throw d&&(O||p)?B(u,R):R}let L;try{L=await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(D.collectionId)}/operations/${n}`,{method:"POST",headers:{authorization:`Bearer ${D.accessToken}`,"content-type":"application/json"},body:JSON.stringify(c),signal:r.signal})}catch(R){throw d&&(O||p)?B(u,R):R}return L.ok&&this.setRoute("relay"),{response:L,requestId:u,encryptedRequest:c,directDeliveryUncertain:O,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p}}let y=e.authority?`${e.authority.operationsUrl}/${n}`:`${this.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/operations/${n}`,v=JSON.stringify(s),g=e.authority?await Ze(this.keyStore,e,"POST",y,v,e.authority.accessToken):{},_=await fetch(y,{method:"POST",headers:{authorization:`Bearer ${e.authority?.accessToken??e.accessToken}`,"content-type":"application/json",...g},body:v,signal:r.signal});return _.ok&&this.setRoute(e.authority?"remote":"relay"),{response:_,requestId:u,encryptedRequest:c,pendingMutation:d,...d?{pendingMutationRecord:f??this.storedPendingMutation(u)??void 0}:{},resumingMutation:p}}directCapable(e){return!(!e||e.authority||!e.encryption||!e.grantId||!e.keyHandle||this.directAccessMode==="disabled"||typeof location<"u"&&e.applicationOrigin&&e.applicationOrigin!==location.origin)}hasResumableMutationTransport(){return!!this.currentToken()}directEligible(e){return e!==null&&this.directCapable(e)&&this.storage.getItem(this.internals.directPreferenceKey())!=="disabled"}async shouldAttemptDirect(e){if(!this.directEligible(e))return!1;if(this.directStatus==="available")return!0;if(this.directStatus==="unavailable"&&Date.now()<this.directRetryAt)return!1;let n=await $e();return n==="denied"?(this.setDirectStatus("denied"),!1):(n==="prompt"||n===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?(this.setDirectStatus("permission_required"),!1):(this.setDirectStatus("checking"),!0)}async probeDirectAccess(e){this.setDirectStatus("checking");try{let n=await fetch(`${this.loopbackUrl}/v1/ready`,le({method:"GET",cache:"no-store",signal:e})),i=await S(n,"invalid_operation_response","The connector returned an invalid readiness response.").catch(()=>null);if(n.ok&&i?.service==="mdbase-connect"&&i?.loopback_protocol_version===1&&i?.operation_transport_protocol_version===Z)return this.markDirectAvailable(),"available"}catch{}return await $e()==="denied"?this.setDirectStatus("denied"):(this.markDirectUnavailable(),"unavailable")}markDirectAvailable(){this.directFailures=0,this.directRetryAt=0,this.setDirectStatus("available")}markDirectUnavailable(){this.directFailures+=1,this.directRetryAt=Date.now()+Math.min(6e4,1e3*2**(this.directFailures-1)),this.setDirectStatus("unavailable")}setDirectStatus(e){return this.directStatus!==e&&(this.directStatus=e,this.emitConnection()),e}setRoute(e){this.currentRoute!==e&&(this.currentRoute=e,this.emitConnection())}emitConnection(){this.onChange()}invalidateRejectedAuthorization(e){let n=M(this.storage.getItem(this.internals.tokenKey(this.collectionId)));!n||!ci(n,e)||(this.internals.removeToken(this.collectionId,n.keyHandle),this.currentRoute="relay",this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection())}currentToken(){return to({stored:this.storage.getItem(this.internals.tokenKey(this.collectionId)),collectionId:this.collectionId,relayEncryption:this.internals.relayEncryption,invalidate:e=>this.internals.removeToken(this.collectionId,e,"invalid_stored_grant"),directCapable:e=>this.directCapable(e)})}async authorizedToken(e={}){let n=this.currentToken();if(!n)return null;if(n.expiresAt>Date.now()+3e4)return n;if(!n.refreshToken||(n.refreshExpiresAt??0)<=Date.now()){if(this.directCapable(n))throw l("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");return this.internals.removeToken(this.collectionId,n.keyHandle),null}return this.refreshAuthorization(e.signal)}refreshAuthorization(e){return this.refreshPromise?this.refreshPromise:(this.refreshPromise=this.performRefresh(e).finally(()=>{this.refreshPromise=null}),this.refreshPromise)}async performRefresh(e){let n=this.currentToken();if(!n?.refreshToken)throw l("not_authorized","Reconnect this application to continue.");if((n.refreshExpiresAt??0)<=Date.now())throw l("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");let i=n.refreshToken,o=`${this.serverUrl}/oauth/token`,r=new URLSearchParams({grant_type:"refresh_token",refresh_token:n.refreshToken,client_id:n.clientId}).toString(),a=n.authority?await Ze(this.keyStore,n,"POST",o,r,n.refreshToken):{},s=await fetch(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...a},body:r,signal:e}),c=await S(s,"invalid_token_response","The authorization service returned an invalid token response.");if(!s.ok){let d=this.currentToken();if(d?.refreshToken&&d.refreshToken!==i)return d;throw this.directCapable(n)||this.internals.removeToken(this.collectionId,n.keyHandle),(Ge(c)??c?.error?.code)==="invalid_grant"?l("authorization_expired",c?.error_description??c?.error?.message??"Reconnect this application to continue.",{status:s.status}):A(c,"authorization_expired","Reconnect this application to continue.",s.status)}return this.storeTokenResponse(c,n.clientId,n.keyHandle)}storeTokenResponse(e,n,i){if(e.collection_id!==this.collectionId)throw l("collection_mismatch","The refreshed authorization belongs to a different collection.");let o=this.internals.storeTokenResponse(e,n,i);return this.currentRoute=o.authority?"remote":"relay",this.directStatus=o.authority||this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection(),o}storedPendingMutations(){return this.pendingMutationStore.list(this.currentToken()?.collectionId??null)}storedPendingMutation(e){return this.pendingMutationStore.find(this.currentToken()?.collectionId??null,e)}clearPendingMutation(e){let n=this.pendingMutationStore.take(e),i=this.currentToken()?.keyHandle;n?.keyHandle&&n.keyHandle!==i&&this.keyStore.delete(n.keyHandle).catch(()=>{})}};var ga=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),_a=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),fe=class{state=_a.slice();block=new Uint8Array(64);words=new Uint32Array(64);blockLength=0;byteLength=0;finished=!1;update(e){if(this.finished)throw new Error("SHA-256 digest is already finalized.");if(this.byteLength+=e.byteLength,!Number.isSafeInteger(this.byteLength))throw new Error("SHA-256 input exceeds the safe browser byte range.");let n=0;if(this.blockLength>0){let i=Math.min(64-this.blockLength,e.byteLength);this.block.set(e.subarray(0,i),this.blockLength),this.blockLength+=i,n+=i,this.blockLength===64&&(this.compress(this.block),this.blockLength=0)}for(;n+64<=e.byteLength;)this.compress(e.subarray(n,n+64)),n+=64;return n<e.byteLength&&(this.block.set(e.subarray(n),0),this.blockLength=e.byteLength-n),this}digestHex(){if(this.finished)throw new Error("SHA-256 digest is already finalized.");this.finished=!0,this.block[this.blockLength]=128,this.block.fill(0,this.blockLength+1),this.blockLength>=56&&(this.compress(this.block),this.block.fill(0));let e=this.byteLength*8,n=Math.floor(e/4294967296),i=e>>>0;return no(this.block,56,n),no(this.block,60,i),this.compress(this.block),[...this.state].map(o=>o.toString(16).padStart(8,"0")).join("")}compress(e){let n=this.words;for(let u=0;u<16;u+=1){let f=u*4;n[u]=(e[f]<<24|e[f+1]<<16|e[f+2]<<8|e[f+3])>>>0}for(let u=16;u<64;u+=1){let f=n[u-15],h=n[u-2],m=H(f,7)^H(f,18)^f>>>3,y=H(h,17)^H(h,19)^h>>>10;n[u]=n[u-16]+m+n[u-7]+y>>>0}let i=this.state[0],o=this.state[1],r=this.state[2],a=this.state[3],s=this.state[4],c=this.state[5],d=this.state[6],p=this.state[7];for(let u=0;u<64;u+=1){let f=H(s,6)^H(s,11)^H(s,25),h=s&c^~s&d,m=p+f+h+ga[u]+n[u]>>>0,y=H(i,2)^H(i,13)^H(i,22),v=i&o^i&r^o&r,g=y+v>>>0;p=d,d=c,c=s,s=a+m>>>0,a=r,r=o,o=i,i=m+g>>>0}this.state[0]=this.state[0]+i>>>0,this.state[1]=this.state[1]+o>>>0,this.state[2]=this.state[2]+r>>>0,this.state[3]=this.state[3]+a>>>0,this.state[4]=this.state[4]+s>>>0,this.state[5]=this.state[5]+c>>>0,this.state[6]=this.state[6]+d>>>0,this.state[7]=this.state[7]+p>>>0}};function H(t,e){return t>>>e|t<<32-e}function no(t,e,n){t[e]=n>>>24,t[e+1]=n>>>16,t[e+2]=n>>>8,t[e+3]=n}var qt=class{constructor(e,n){this.signal=n;this.iterator=ba(e)}signal;iterator;remainder=new Uint8Array;remainderOffset=0;maxSourceChunkBytes=null;iteratorClosing=!1;ended=!1;setMaxSourceChunkBytes(e){this.maxSourceChunkBytes=e}async read(e){let n=new Uint8Array(e),i=0;for(;i<e;){if(this.remainderOffset===this.remainder.byteLength){let r=await this.nextSourceChunk();if(r.done)throw this.ended=!0,l("invalid_request","Streamed file bytes ended before the declared size.");if(!(r.value instanceof Uint8Array))throw l("invalid_request","A streamed file chunk was not a Uint8Array.");if(this.maxSourceChunkBytes===null)throw new Error("Stream source was read before upload negotiation completed.");if(r.value.byteLength>this.maxSourceChunkBytes)throw l("invalid_request",`A streamed file chunk exceeded the negotiated ${this.maxSourceChunkBytes}-byte upload part size.`);if(this.remainder=r.value,this.remainderOffset=0,this.remainder.byteLength===0)continue}let o=Math.min(e-i,this.remainder.byteLength-this.remainderOffset);n.set(this.remainder.subarray(this.remainderOffset,this.remainderOffset+o),i),i+=o,this.remainderOffset+=o}return n}async expectEnd(){if(this.remainderOffset<this.remainder.byteLength)throw l("invalid_request","Streamed file bytes exceed the declared size.");for(;!this.ended;){let e=await this.nextSourceChunk();if(e.done){this.ended=!0;return}if(!(e.value instanceof Uint8Array))throw l("invalid_request","A streamed file chunk was not a Uint8Array.");if(e.value.byteLength>0)throw l("invalid_request","Streamed file bytes exceed the declared size.")}}async close(){this.ended=!0,this.closeIterator()}async nextSourceChunk(){io(this.signal);let e=this.iterator.next(),n=this.signal;if(!n)return e;let i=()=>{},o=new Promise((r,a)=>{let s=()=>{this.closeIterator(),a(oo(n))};n.addEventListener("abort",s,{once:!0}),i=()=>n.removeEventListener("abort",s),n.aborted&&s()});try{let r=await Promise.race([e,o]);return io(n),r}finally{i()}}closeIterator(){if(!this.iteratorClosing){this.iteratorClosing=!0;try{this.iterator.return?.()?.catch(()=>{})}catch{}}}};function ba(t){if(typeof t.getReader=="function"){let n=t.getReader(),i=!1,o=()=>{i||(i=!0,n.releaseLock())};return{async next(){if(i)return{done:!0,value:void 0};let r=await n.read();return r.done&&o(),r},async return(){if(!i)try{await n.cancel()}finally{o()}return{done:!0,value:void 0}}}}let e=t;if(typeof e[Symbol.asyncIterator]!="function")throw l("invalid_request","Streamed files require a readable byte stream.");return e[Symbol.asyncIterator]()}function io(t){if(t?.aborted)throw oo(t)}function oo(t){return l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t?.reason})}var ro=1024*1024,va=4,ao=8,he=3,gn=64*1024*1024,so=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu,co=/^sha256:[0-9a-f]{64}$/u;async function lo(t,e,n){let i=new fe;for(let o=0;o<t.size;o+=ro){ie(e);let r=new Uint8Array(await t.slice(o,o+ro).arrayBuffer());i.update(r),n(Math.min(t.size,o+r.byteLength))}return t.size===0&&n(0),i.digestHex()}function uo(t,e){if(t instanceof Blob)return e&&e!==t.type?t.slice(0,t.size,e):t;if(t instanceof ArrayBuffer)return new Blob([t],{type:e});let n=new Uint8Array(t.byteLength);return n.set(new Uint8Array(t.buffer,t.byteOffset,t.byteLength)),new Blob([n.buffer],{type:e})}function po(t){return t instanceof Blob?t.size:t.byteLength}async function fo(t){return t instanceof Blob?new Uint8Array(await t.arrayBuffer()):t}function _n(t=va){if(!Number.isInteger(t)||t<1||t>ao)throw l("invalid_request",`File concurrency must be between 1 and ${ao}.`);return t}function ho(t){if(!Number.isInteger(t)||t<1||t>1e3)throw l("invalid_request","File page size must be between 1 and 1000.");return t}function bn(t,e,n){if(t.protocol_version!==1||t.type!=="file_transfer"||t.transfer_id!==e||t.direction!==n||!Number.isSafeInteger(t.total_size)||t.total_size<0||!Array.isArray(t.received)||!Ca(t))throw l("invalid_operation_response","The authority returned an invalid file transfer session.");let i=t.strategy.kind==="framed_chunks"?t.strategy.chunk_size:t.strategy.kind==="object_put"?Math.max(1,t.total_size):t.strategy.part_size,o=t.strategy.kind==="object_put"?1:Math.ceil(t.total_size/i);if(new Set(t.received).size!==t.received.length||t.received.some(a=>!Number.isSafeInteger(a)||a<0||a>=o))throw l("invalid_operation_response","The authority returned invalid transfer progress.");let r=t.uploaded_parts??[];if(!Array.isArray(r)||r.some((a,s)=>!Number.isSafeInteger(a?.part_number)||a.part_number<1||a.part_number>o||typeof a.etag!="string"||a.etag.length===0||a.etag.length>255||s>0&&r[s-1].part_number>=a.part_number)||(t.strategy.kind==="object_multipart"?r.length!==t.received.length||r.some((a,s)=>a.part_number-1!==t.received[s]):r.length!==0))throw l("invalid_operation_response","The authority returned invalid uploaded part receipts.")}function yo(t,e){let n=e.strategy.kind==="framed_chunks"?e.strategy.chunk_size:e.strategy.kind==="object_put"?Math.max(1,e.total_size):e.strategy.part_size,i=e.strategy.kind==="object_put"?1:Math.ceil(e.total_size/n);if(t?.protocol_version!==1||t.type!=="file_transfer_status"||t.transfer_id!==e.transfer_id||!["open","committed","aborted","expired"].includes(t.state)||!Array.isArray(t.received)||new Set(t.received).size!==t.received.length||t.received.some(r=>!Number.isSafeInteger(r)||r<0||r>=i)||!Number.isSafeInteger(t.received_bytes)||t.received_bytes<0||t.received_bytes>e.total_size||t.received.reduce((r,a)=>r+vn(e.total_size,n,a),0)!==t.received_bytes)throw l("invalid_operation_response","The authority returned invalid transfer status.");let o=t.uploaded_parts;if(!Array.isArray(o)||o.some((r,a)=>!Number.isSafeInteger(r?.part_number)||r.part_number<1||r.part_number>i||typeof r.etag!="string"||r.etag.length===0||r.etag.length>255||a>0&&o[a-1].part_number>=r.part_number)||(e.strategy.kind==="object_multipart"?o.length!==t.received.length||o.some((r,a)=>r.part_number-1!==t.received[a]):o.length!==0))throw l("invalid_operation_response","The authority returned invalid uploaded part status.")}function Ca(t){return t.strategy.kind==="framed_chunks"?t.protection==="grant_aead_v1"&&Number.isSafeInteger(t.strategy.chunk_size)&&t.strategy.chunk_size>0:t.protection!=="transport_tls"?!1:t.strategy.kind==="object_put"?!0:Number.isSafeInteger(t.strategy.part_size)&&t.strategy.part_size>0}function vn(t,e,n){return Math.min(e,Math.max(0,t-n*e))}async function Ft(t,e){for(let n=1;n<=he;n+=1){ie(e);try{return await t()}catch(i){if(e?.aborted||n===he)throw i}}throw new Error("Unreachable file chunk retry state.")}function mo(t,e,n,i,o,r){let a;try{a=new URL(t.url)}catch{throw l("invalid_operation_response","The authority returned an invalid object URL.")}if(t.protocol_version!==1||t.type!=="file_part"||t.transfer_id!==e||t.part_index!==n||t.offset!==i||t.content_length!==o||t.method.toUpperCase()!==r||a.protocol!=="https:"&&!(a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))||a.username||a.password)throw l("invalid_operation_response","The authority returned an invalid prepared file part.")}function go(t){let e=new Headers;for(let[n,i]of Object.entries(t))["host","content-length"].includes(n.toLowerCase())||e.set(n,i);return e}async function _o(t,e,n){let i=new Array(t),o=0;return await Promise.all(Array.from({length:Math.min(t,e)},async()=>{for(;o<t;){let r=o;o+=1,i[r]=await n(r)}})),i}function ie(t){if(t?.aborted)throw l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t.reason})}function xe(t){return t instanceof b?t:typeof DOMException<"u"&&t instanceof DOMException&&t.name==="AbortError"?l("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t}):l("temporarily_unavailable","The file transfer could not be completed.",{cause:t})}var Ee=class{constructor(e,n,i,o,r=ge()){this.capability=e;this.request=n;this.framed=i;this.hosted=o;this.timeouts=r}capability;request;framed;hosted;timeouts;async*list(e={}){let n=te(e,this.timeouts.requestMs),i=n.signal;try{this.requireAction("list");let o;do{ie(i);let r=new URLSearchParams({protocol_version:String(1),...e.folder?{folder:e.folder}:{},...o?{after:o}:{},...e.pageSize?{limit:String(ho(e.pageSize))}:{}}),a=await this.request("GET",`?${r.toString()}`,void 0,i);if(a.protocol_version!==1||a.type!=="files_page"||!Array.isArray(a.files))throw l("invalid_operation_response","The authority returned an invalid file page.");for(let s of a.files)ie(i),yield zt(s);o=a.next}while(o)}finally{n.dispose()}}async upload(e,n,i={}){return N(i,this.timeouts.uploadMs,o=>this.uploadWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async uploadWithinBudget(e,n,i){this.requireAction(i.ifRevision?"replace":"add");let o=uo(n,i.mediaType),r=_n(i.concurrency),a=await lo(o,i.signal,s=>{i.onProgress?.({phase:"hashing",transferredBytes:s,totalBytes:o.size})});return this.uploadKnownSource(e,o.size,`sha256:${a}`,(i.mediaType??o.type)||void 0,i,r,async(s,c,d)=>o.slice(c,c+d))}async uploadStream(e,n,i={}){return N(i,this.timeouts.uploadMs,o=>this.uploadStreamWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async uploadStreamWithinBudget(e,n,i){if(this.requireAction(i.ifRevision?"replace":"add"),!Number.isSafeInteger(n.size)||n.size<0)throw l("invalid_request","Streamed file size must be a non-negative safe integer.");if(!co.test(n.contentDigest))throw l("invalid_request","Streamed files require a lowercase SHA-256 content digest.");let o=new qt(n.stream,i.signal),r=new fe;return this.uploadKnownSource(e,n.size,n.contentDigest,i.mediaType??n.mediaType,i,1,async(a,s,c)=>{let d=await o.read(c);return r.update(d),d},async()=>{if(await o.expectEnd(),`sha256:${r.digestHex()}`!==n.contentDigest)throw l("invalid_request","Streamed file bytes do not match the declared SHA-256 digest.")},()=>o.close(),a=>o.setMaxSourceChunkBytes(a))}async uploadKnownSource(e,n,i,o,r,a,s,c,d,p){let u=r.transferId??crypto.randomUUID();if(!so.test(u))throw l("invalid_request","File transfer ID must be a UUID.");let f=!1;try{let h=await this.request("POST","uploads",{protocol_version:1,type:"open_file_upload",transfer_id:u,path:e,size:n,content_digest:i,...o?{media_type:o}:{},...r.ifRevision?{if_revision:r.ifRevision}:{}},r.signal);if(bn(h,u,"upload"),h.total_size!==n||h.strategy.kind==="object_ranges")throw l("invalid_operation_response","The authority returned an incompatible upload strategy.");let m=h.strategy.kind==="framed_chunks";if(m&&!this.framed)throw l("invalid_operation_response","Encrypted file chunk delivery is unavailable.");let y=h.strategy.kind==="object_put"?Math.max(1,n):h.strategy.kind==="framed_chunks"?h.strategy.chunk_size:h.strategy.part_size,v=h.strategy.kind==="object_put"?1:Math.ceil(n/y),g=await this.request("GET",`transfers/${encodeURIComponent(u)}`,void 0,r.signal);if(yo(g,h),g.state!=="open"&&g.state!=="committed")throw l("invalid_operation_response",`The authority cannot resume a ${g.state} file transfer.`);if(p?.(y),!m&&g.received.length===v){let z=await this.tryReplayUploadCommit(u,h.strategy.kind==="object_multipart"?g.uploaded_parts:void 0,r.signal);if(z)return f=!0,zt(z.file)}let _=new Set(g.received),O=new Map(g.uploaded_parts.map(z=>[z.part_number-1,z])),D=[..._].reduce((z,Fe)=>z+vn(n,y,Fe),0),L=await _o(v,a,async z=>{let Fe=z*y,et=Math.min(y,Math.max(0,n-Fe)),Kt=await s(z,Fe,et);if(po(Kt)!==et)throw l("invalid_request","Streamed file bytes ended before the declared size.");if(_.has(z))return O.get(z)??null;let Ro=m?await Ft(async()=>this.framed.uploadChunk(h,z,await fo(Kt),r.signal),r.signal).then(()=>null):await this.uploadPart(u,z,Fe,Kt,et,h.strategy.kind==="object_multipart",r.signal);return D+=et,r.onProgress?.({phase:"uploading",transferredBytes:D,totalBytes:n}),Ro});await c?.();let R=await this.commitUpload(u,h.strategy.kind==="object_multipart"?L.filter(z=>z!==null):void 0,r.signal);if(R.protocol_version!==1||R.type!=="file_upload_committed"||R.transfer_id!==u||R.file.path!==e||R.file.size!==n||R.file.content_digest!==i)throw l("invalid_operation_response","The authority returned an invalid file receipt.");return f=!0,zt(R.file)}catch(h){throw xe(h)}finally{await d?.().catch(()=>{}),!f&&r.transferId===void 0&&await this.abort(u)}}async download(e,n={}){if(e.size>gn)throw l("invalid_request",`download() buffers at most ${gn} bytes; use downloadStream() for larger files.`);let i=await this.downloadStream(e,n),o=[],r=i.getReader();for(;;){let a=await r.read();if(a.done)break;o.push(a.value)}return new Blob(o.map(a=>{let s=new Uint8Array(a.byteLength);return s.set(a),s.buffer}),{type:e.mediaType??""})}async downloadStream(e,n={}){return N(n,this.timeouts.requestMs,i=>this.openDownloadStream(e,n,i.signal))}async openDownloadStream(e,n,i){this.requireAction("read"),_n(n.concurrency);let o=crypto.randomUUID(),r;try{if(r=await this.request("POST","downloads",{protocol_version:1,type:"open_file_download",transfer_id:o,file_id:e.fileId,revision:e.revision},i),bn(r,o,"download"),r.total_size!==e.size||r.strategy.kind!=="object_ranges"&&r.strategy.kind!=="framed_chunks")throw l("invalid_operation_response","The authority returned an incompatible download session.");if(r.strategy.kind==="framed_chunks"&&!this.framed)throw l("invalid_operation_response","Encrypted file chunk delivery is unavailable.");if(r.strategy.kind==="object_ranges"&&e.size>0&&!this.hosted)throw l("invalid_operation_response","Authenticated hosted file delivery is unavailable.")}catch(v){throw await this.abort(o),xe(v)}let a=r.strategy.kind==="framed_chunks"?r.strategy.chunk_size:r.strategy.part_size,s=Math.ceil(e.size/a),c=new fe,d=0,p=0,u=null,f=0,h=!1,m=async()=>{h||(h=!0,await u?.cancel().catch(()=>{}),u=null,await this.abort(o))},y=()=>{if(f!==e.size||`sha256:${c.digestHex()}`!==e.contentDigest)throw l("invalid_operation_response","Downloaded file bytes failed integrity verification.")};return new ReadableStream({pull:async v=>{try{if(ie(n.signal),r.strategy.kind==="object_ranges")for(;;){if(!u){if(d>=s){y(),await m(),v.close();return}let L=d*a;p=Math.min(a,e.size-L),u=(await Ft(()=>this.hosted.downloadPart(r,d,p,n.signal),n.signal)).getReader()}let D=await u.read();if(D.done){if(u.releaseLock(),u=null,p!==0)throw l("invalid_operation_response","A hosted file range ended before its declared byte length.");d+=1;continue}if(!(D.value instanceof Uint8Array))throw l("invalid_operation_response","A hosted file range returned a non-byte chunk.");if(D.value.byteLength!==0){if(D.value.byteLength>p)throw l("invalid_operation_response","A hosted file range exceeded its declared byte length.");p-=D.value.byteLength,c.update(D.value),f+=D.value.byteLength,n.onProgress?.({phase:"downloading",transferredBytes:f,totalBytes:e.size}),v.enqueue(D.value);return}}if(d>=s){y(),await m(),v.close();return}let g=d*a,_=Math.min(a,e.size-g),O=await Ft(()=>this.framed.downloadChunk(r,d,n.signal),n.signal);if(O.byteLength!==_)throw l("invalid_operation_response","A file chunk had the wrong byte length.");c.update(O),f+=O.byteLength,d+=1,n.onProgress?.({phase:"downloading",transferredBytes:f,totalBytes:e.size}),d===s&&y(),v.enqueue(O),d===s&&(await m(),v.close())}catch(g){await m(),v.error(xe(g))}},cancel:m})}async downloadBytes(e,n={}){return new Uint8Array(await(await this.download(e,n)).arrayBuffer())}async move(e,n,i={}){return N(i,this.timeouts.requestMs,o=>this.moveWithinBudget(e,n,{...i,signal:o.signal,timeoutMs:null}))}async moveWithinBudget(e,n,i){this.requireAction("move");let o=i.mutationId??crypto.randomUUID(),r;try{r=await this.request("POST",`${encodeURIComponent(e.fileId)}/move`,{protocol_version:1,type:"move_file",mutation_id:o,file_id:e.fileId,if_revision:i.ifRevision??e.revision,from_path:e.path,path:n,update_references:!1},i.signal)}catch(a){throw xe(a)}if(r.protocol_version!==1||r.type!=="file_moved"||r.mutation_id!==o||r.file.file_id!==e.fileId||r.file.path!==n)throw l("invalid_operation_response","The authority returned an invalid file move receipt.");return zt(r.file)}async delete(e,n={}){return N(n,this.timeouts.requestMs,i=>this.deleteWithinBudget(e,{...n,signal:i.signal,timeoutMs:null}))}async deleteWithinBudget(e,n){this.requireAction("delete");let i=n.mutationId??crypto.randomUUID(),o;try{o=await this.request("POST",`${encodeURIComponent(e.fileId)}/delete`,{protocol_version:1,type:"delete_file",mutation_id:i,file_id:e.fileId,if_revision:n.ifRevision??e.revision,path:e.path},n.signal)}catch(r){throw xe(r)}if(o.protocol_version!==1||o.type!=="file_deleted"||o.mutation_id!==i||o.file_id!==e.fileId||o.previous_path!==e.path)throw l("invalid_operation_response","The authority returned an invalid file delete receipt.");return{protocolVersion:o.protocol_version,type:o.type,mutationId:o.mutation_id,fileId:o.file_id,previousPath:o.previous_path,revision:o.revision}}async uploadPart(e,n,i,o,r,a,s){for(let c=1;c<=he;c+=1){ie(s);try{let d=await this.request("POST",`uploads/${encodeURIComponent(e)}/parts`,{protocol_version:1,type:"prepare_file_upload_part",transfer_id:e,part_number:n+1,content_length:r},s);mo(d,e,n,i,r,"PUT");let p=await fetch(d.url,{method:d.method,headers:go(d.headers),body:o,redirect:"error",signal:s});if(!p.ok)throw new Error(`Object upload failed with HTTP ${p.status}.`);let u=p.headers.get("etag");if(a&&!u)throw new Error("Multipart object upload did not return an ETag.");return{part_number:n+1,etag:u??""}}catch(d){if(s?.aborted||c===he)throw d}}throw new Error("Unreachable upload retry state.")}async tryReplayUploadCommit(e,n,i){try{return await this.commitUpload(e,n,i)}catch(o){if(o instanceof b&&o.code==="file_upload_incomplete")return null;throw o}}async commitUpload(e,n,i){let o;for(let r=1;r<=he;r+=1){ie(i);try{return await this.request("POST",`uploads/${encodeURIComponent(e)}/commit`,{protocol_version:1,type:"commit_file_upload",transfer_id:e,...n===void 0?{}:{parts:n}},i)}catch(a){if(o=a,i?.aborted||a instanceof b||r===he)throw a}}throw o}requireAction(e){if(!this.capability()?.actions.includes(e))throw l("not_authorized",`This connection is not authorized to ${e} files.`)}async abort(e){await this.request("DELETE",`transfers/${encodeURIComponent(e)}`).catch(()=>{})}};function zt(t){return{fileId:t.file_id,path:t.path,revision:t.revision,contentDigest:t.content_digest,size:t.size,...t.media_type?{mediaType:t.media_type}:{},mediaClass:t.media_class,modifiedAt:t.modified_at}}var De=class{constructor(e,n){this.internals=e;this.collectionId=n;this.transport=new Dt({serverUrl:e.serverUrl,storage:e.storage,keyStore:e.keyStore,directAccessMode:e.directAccessMode,loopbackUrl:e.loopbackUrl,collectionId:n,internals:e,timeouts:e.timeouts,onChange:()=>this.emitConnection()}),this.files=new Ee(()=>this.fileCapability,(i,o,r,a)=>this.transport.files.control(i,o,r,a),{uploadChunk:(i,o,r,a)=>this.transport.files.uploadChunk(i,o,r,a),downloadChunk:(i,o,r)=>this.transport.files.downloadChunk(i,o,r)},{downloadPart:(i,o,r,a)=>this.transport.files.downloadHostedPart(i,o,r,a)},e.timeouts),this.collectionClient=new ke({operation:(i,o,r)=>this.transport.performOperation(i,o,r)},e.timeouts.requestMs),this.notifications=new Pt({serverUrl:e.serverUrl,storage:e.storage,authorizedToken:i=>this.transport.authorizedToken({signal:i,timeoutMs:null}),register:i=>this.internals.register({signal:i,timeoutMs:null}),notificationKey:i=>e.notificationKey(n,i),requestTimeoutMs:e.timeouts.requestMs})}internals;collectionId;collectionClient;notifications;transport;files;connectionListeners=new Set;get displayName(){return this.transport.currentToken()?.collectionName??`Collection ${this.collectionId.slice(0,8)}`}get operations(){return[...this.transport.currentToken()?.operations??[]]}get scope(){return this.transport.currentToken()?.scope??null}get fileCapability(){return this.transport.currentToken()?.fileCapability??null}get directAccess(){return this.transport.directAccess}get route(){return this.transport.route}register(e){return I(()=>this.internals.register(e),se)}info(){let e=this.transport.currentToken();return e?{collectionId:e.collectionId,displayName:e.collectionName,operations:[...e.operations],scope:e.scope,...e.fileCapability?{fileCapability:e.fileCapability}:{},authority:e.authority?{kind:"hosted",durability:"provider"}:{kind:"connector",durability:"computer"},route:this.transport.route,directAccess:this.transport.directAccess}:null}authorizationCapabilities(e=ue){let n=this.operations,i=K(e).filter(o=>!n.includes(o));return{authorized:this.info()!==null,sufficient:this.info()!==null&&i.length===0,collectionId:this.collectionId,grantedOperations:n,missingOperations:i}}hasOperations(e){return this.authorizationCapabilities(e).sufficient}authorize(e={}){return I(()=>this.internals.authorize({...e,target:{kind:"collection",collectionId:this.collectionId}}),me)}async requestOperations(e,n={}){let i=this.authorizationCapabilities(e);return i.sufficient?k({kind:"unchanged",connection:this}):this.authorize({...n,operations:K([...i.grantedOperations,...i.missingOperations])})}onConnectionChange(e){return this.connectionListeners.add(e),e(this.info()),()=>this.connectionListeners.delete(e)}notifyStorageChanged(){this.transport.notifyStorageChanged()}checkDirectAccess(e){return I(()=>this.transport.checkDirectAccess(e),en)}requestDirectAccess(e){return I(()=>this.transport.requestDirectAccess(e),en)}disableDirectAccess(){this.transport.disableDirectAccess()}sync(){let e=this.transport.currentToken();if(!e)return null;let n=e.collectionId;if(!e.authority){if(!e.grantId||!e.operations.includes("sync"))return null;let o=e.grantId;return{collectionId:n,replicaId:o,transport:{openSession:r=>this.transport.performOperation("sync",{action:"open_session"},Ut(r,this.internals.timeouts.syncMs)),snapshot:(r,a,s)=>this.transport.performOperation("sync",{action:"snapshot",snapshot_id:r,...a?{page:a}:{}},Ut(s,this.internals.timeouts.syncMs)),changes:(r,a=200,s)=>this.transport.performOperation("sync",{action:"changes",after:r,limit:a},Ut(s,this.internals.timeouts.syncMs)),mutate:(r,a)=>this.transport.performOperation("sync",{action:"mutate",mutation:r},Ut(a,this.internals.timeouts.syncMs))}}}let i=e.authority.replicaId;return{collectionId:n,replicaId:i,transport:{openSession:o=>this.transport.performAuthoritySyncRequest(n,i,"POST","sessions",void 0,o),snapshot:(o,r,a)=>{let s=new URLSearchParams({snapshot_id:o});return r&&s.set("page",r),this.transport.performAuthoritySyncRequest(n,i,"GET",`snapshot?${s}`,void 0,a)},changes:(o,r=200,a)=>this.transport.performAuthoritySyncRequest(n,i,"GET",`changes?${new URLSearchParams({after:String(o),limit:String(r)})}`,void 0,a),mutate:(o,r)=>this.transport.performAuthoritySyncRequest(n,i,"POST","mutations",o,r)}}}registerNotifications(e){return I(()=>this.notifications.registerNotifications(e),je)}registerNativeNotifications(e){return I(()=>this.notifications.registerNativeNotifications(e),je)}unregisterNativeNotifications(e){return I(()=>this.notifications.unregisterNativeNotifications(e),je)}unregisterNotifications(e,n){return I(()=>this.notifications.unregisterNotifications(e,n),je)}forget(){let e=this.transport.currentToken();this.internals.removeToken(this.collectionId,e?.keyHandle,"not_authorized",!0),this.transport.notifyStorageChanged()}describe(e){return this.collectionClient.describe(e)}changes(e={},n){return this.collectionClient.changes(e,n)}read(e,n){return this.collectionClient.read(e,n)}query(e={},n){return this.collectionClient.query(e,n)}queryPages(e={},n={}){return this.collectionClient.queryPages(e,n)}queryAll(e={},n={}){return this.collectionClient.queryAll(e,n)}listViews(e){return this.collectionClient.listViews(e)}executeView(e,n){return this.collectionClient.executeView(e,n)}readViewSource(e,n){return this.collectionClient.readViewSource(e,n)}createViewSource(e,n){return this.collectionClient.createViewSource(e,n)}updateViewSource(e,n){return this.collectionClient.updateViewSource(e,n)}deleteViewSource(e,n){return this.collectionClient.deleteViewSource(e,n)}create(e,n){return this.collectionClient.create(e,n)}update(e,n){return this.collectionClient.update(e,n)}delete(e,n){return this.collectionClient.delete(e,n)}preflightDelete(e,n){return this.collectionClient.preflightDelete(e,n)}rename(e,n){return this.collectionClient.rename(e,n)}preflightRename(e,n){return this.collectionClient.preflightRename(e,n)}async renameWithProgress(e,n={}){return N(n,this.internals.timeouts.requestMs,async i=>{let o=Date.now(),r=!1,a,s=(c,d,p=0)=>{n.onProgress?.({operation:"rename",state:c,elapsedMs:Date.now()-o,cancellable:d,resumed:r,completedUnits:p,...a?{estimate:a}:{}})};try{de(i.signal),s("preflighting",!0);let c=n.preflight?k(n.preflight):await this.preflightRename(e,{signal:i.signal,timeoutMs:null});if(!c.ok)return c;let d=c.value;try{li(e,d)}catch(f){if(f instanceof b)return P(f.problem);throw f}a=ui(e,d),s("ready",!0),de(i.signal);let p=this.transport.hasResumableMutationTransport();s("applying",p);let u=await this.rename(e,p?{signal:i.signal,timeoutMs:null}:{timeoutMs:bo(i.remainingMs())});return u.ok&&s("completed",!1,a.totalUnits),u}catch(c){if(an(c,i.signal)&&s("cancelled",!1),c instanceof b)return P(c.problem);throw c}})}async deleteWithProgress(e,n={}){return N(n,this.internals.timeouts.requestMs,async i=>{let o=Date.now(),r=!1,a,s=(c,d,p=0)=>{n.onProgress?.({operation:"delete",state:c,elapsedMs:Date.now()-o,cancellable:d,resumed:r,completedUnits:p,...a?{estimate:a}:{}})};try{de(i.signal),s("preflighting",!0);let c=n.preflight?k(n.preflight):await this.preflightDelete(e,{signal:i.signal,timeoutMs:null});if(!c.ok)return c;let d=c.value;try{di(e,d)}catch(f){if(f instanceof b)return P(f.problem);throw f}a=pi(d),s("ready",!0),de(i.signal);let p=this.transport.hasResumableMutationTransport();s("applying",p);let u=await this.delete(e,p?{signal:i.signal,timeoutMs:null}:{timeoutMs:bo(i.remainingMs())});return u.ok&&s("completed",!1,a.totalUnits),u}catch(c){if(an(c,i.signal)&&s("cancelled",!1),c instanceof b)return P(c.problem);throw c}})}pendingMutations(){return this.transport.pendingMutations().map(e=>({...e,recover:n=>I(()=>this.recoverPendingMutation(e.requestId,n),q)}))}pendingMutation(e){let n=this.transport.pendingMutation(e);return n?{...n,recover:i=>I(()=>this.recoverPendingMutation(e,i),q)}:null}async recoverPendingMutation(e,n){let i=await this.transport.recoverPendingMutation(e,n);if(i&&typeof i=="object"&&"valid"in i){let o=i;if(!o.valid)throw new b(ye(o));return o.result}return i}validate(e={},n){return this.collectionClient.validate(e,n)}readType(e,n){return this.collectionClient.readType(e,n)}createType(e,n){return this.collectionClient.createType(e,n)}updateType(e,n){return this.collectionClient.updateType(e,n)}assessTypePack(e,n){return this.collectionClient.assessTypePack(e,n)}applyTypePack(e,n){return this.collectionClient.applyTypePack(e,n)}assessCollectionSetup(e,n){return this.collectionClient.assessCollectionSetup(e,n)}applyCollectionSetup(e,n){return this.collectionClient.applyCollectionSetup(e,n)}listTimers(e,n){return this.collectionClient.listTimers(e,n)}putTimer(e,n){return this.collectionClient.putTimer(e,n)}cancelTimer(e,n){return this.collectionClient.cancelTimer(e,n)}reconcileTimers(e,n){return this.collectionClient.reconcileTimers(e,n)}watch(e={},n={}){return I(()=>F(n,this.internals.timeouts.watchStartMs,async i=>{let o=await this.collectionClient.changes(e.cursor===void 0?{}:{after:e.cursor,limit:200},{signal:i.signal,timeoutMs:null});if(!o.ok)throw new b(o.problem);if(o.value.reset)throw new b(T("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again."));return new Cn(this.collectionClient,o.value.cursor,e,e.cursor===void 0?[]:o.value.events,this.internals.timeouts.watchStartMs)}),ft)}emitConnection(){let e=this.info();for(let n of this.connectionListeners)n(e)}},Cn=class{constructor(e,n,i,o,r){this.client=e;this.input=i;this.watchStartTimeoutMs=r;this.pendingChanges=[...o],this.currentStatus={state:"connected",cursor:n,recovered:!1};let a=i.lifetimeSignal;if(a?.aborted)this.close();else if(a){let s=()=>this.close();a.addEventListener("abort",s,{once:!0}),this.removeLifetimeAbort=()=>a.removeEventListener("abort",s)}this.controller.signal.aborted||this.run(n)}client;input;watchStartTimeoutMs;changes=new Set;statuses=new Set;problems=new Set;controller=new AbortController;removeLifetimeAbort;currentStatus;currentProblem=null;pendingChanges;get status(){return this.currentStatus}get problem(){return this.currentProblem}subscribe(e,n,i){this.changes.add(e),n&&(this.statuses.add(n),n(this.currentStatus)),i&&(this.problems.add(i),this.currentProblem&&i(this.currentProblem));for(let o of this.pendingChanges)e(o);return this.pendingChanges=[],()=>{this.changes.delete(e),n&&this.statuses.delete(n),i&&this.problems.delete(i)}}close(){if(this.controller.signal.aborted)return;this.controller.abort(),this.removeLifetimeAbort?.(),this.removeLifetimeAbort=void 0;let e="cursor"in this.currentStatus?this.currentStatus.cursor:void 0;this.publishStatus({state:"closed",...e===void 0?{}:{cursor:e}})}async run(e){let n=!0,i=this.client.watch({cursor:e,pollIntervalMs:this.input.pollIntervalMs,retry:this.input.retry,signal:this.controller.signal,timeoutMs:this.watchStartTimeoutMs,onStatus:o=>{if(n&&o.state==="connecting"){n=!1;return}n=!1,this.publishStatus(o)}});try{for await(let o of i){if(this.controller.signal.aborted)return;if(!o.ok){this.currentProblem=o.problem;for(let r of this.problems)r(o.problem);return}for(let r of this.changes)r(o.value)}}finally{this.controller.signal.aborted||this.close()}}publishStatus(e){this.currentStatus=e;for(let n of this.statuses)n(e)}};function Ut(t,e){return{...t,timeoutMs:t?.timeoutMs===void 0?e:t.timeoutMs}}function bo(t){return t===null?null:Math.max(1,Math.ceil(t))}function wn(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function qe(t,e,n){return t.reason instanceof b?t.reason:l("authorization_cancelled",e,{cause:n})}function vo({body:t,clientId:e,keyHandle:n,previous:i,defaultApplicationOrigin:o,pinConnectorIdentity:r}){let a=t.collection_id;if(typeof a!="string")throw l("invalid_token_response","Authorization returned no collection ID.");let s=bt(t.scope);if(!s)throw l("invalid_token_response","Authorization returned no valid collection scope.");if(t.authority&&!We(t.authority,a))throw l("invalid_token_response","Authorization returned an invalid remote authority capability.");if(t.authority&&t.encryption)throw l("invalid_token_response","Authorization returned conflicting collection transports.");if(t.file_capability!==null&&t.file_capability!==void 0&&!_t(t.file_capability))throw l("invalid_token_response","Authorization returned an invalid file capability.");if(t.encryption){try{W(t.encryption)}catch{throw l("invalid_token_response","Authorization returned an invalid encrypted relay binding.")}if(r(t.encryption.connector_id,t.encryption.connector_agreement_public_key),t.encryption.collection_id!==a||typeof t.grant_id!="string"||t.grant_id.length===0)throw l("invalid_token_response","Authorization returned an encrypted relay binding for another grant.")}if(i?.encryption&&t.encryption&&i.keyHandle&&i.keyHandle===n&&(i.grantId!==t.grant_id||i.encryption.connector_id!==t.encryption.connector_id||i.encryption.connector_agreement_public_key!==t.encryption.connector_agreement_public_key||i.encryption.application_agreement_public_key!==t.encryption.application_agreement_public_key))throw l("connector_identity_changed","The connector identity changed during authorization renewal. Reauthorize before sending collection data.");return{version:1,accessToken:t.access_token,refreshToken:t.refresh_token,clientId:e,collectionId:a,collectionName:t.collection_name??`Collection ${a.slice(0,8)}`,operations:t.operations,scope:s,expiresAt:Date.now()+t.expires_in*1e3,refreshExpiresAt:t.refresh_expires_in?Date.now()+t.refresh_expires_in*1e3:void 0,grantId:t.grant_id,encryption:t.encryption??void 0,fileCapability:t.file_capability??void 0,applicationOrigin:t.application_origin??o,keyHandle:n,savedAt:Date.now(),authority:t.authority?{operationsUrl:t.authority.operations_url,syncUrl:t.authority.sync_url,filesUrl:t.authority.files_url,replicaId:t.authority.replica_id,accessToken:t.authority.access_token,proofPublicKey:t.authority.proof_public_key}:void 0}}var Nt=class{serverUrl;manifest;manifestSource;redirectUri;storage;relayEncryption;keyStore;identityStore;directAccessMode;loopbackUrl;navigate;timeouts;credentialStorage;application=null;manifestPromise=null;completionPromises=new Map;connectionCache=new Map;listeners=new Set;invalidatedConnections=new Map;constructor(e){this.serverUrl=vi(String(e.serverUrl)),this.manifest=e.manifest instanceof URL?e.manifest.href:e.manifest??Ci(),this.manifestSource=typeof this.manifest=="string"?this.manifest:this.manifest.distribution==="portable"?`bundle:${this.manifest.id}:${Oi(this.manifest)}`:`bundle:${this.manifest.id}`;let n=Ai(this.manifest);this.redirectUri=e.redirectUri===void 0?typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"":wi():String(e.redirectUri),this.storage=e.storage??Pi(n),this.relayEncryption=e.relayEncryption??"required",this.keyStore=e.keyStore??(n?new be:new _e),this.identityStore=e.identityStore??(n?new Oe:new Ae),this.credentialStorage=e.storage||e.keyStore||e.identityStore?"custom":this.storage instanceof we?"memory":"persistent",this.directAccessMode=e.directAccess??"auto",this.loopbackUrl=mi(String(e.loopbackUrl??`http://127.0.0.1:${Hn}`)),this.navigate=e.navigate,this.timeouts=ge(e.timeouts),typeof window<"u"&&this.storage===window.localStorage&&window.addEventListener("storage",i=>{i.storageArea!==this.storage||!i.key?.startsWith(this.storagePrefix())||(this.connectionCache.get(Ri(i.key))?.notifyStorageChanged(),this.emitConnections())})}environment(){let e=typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"portable":this.application?.distribution??"web";return{distribution:e,applicationOrigin:e==="portable"?"null":this.defaultApplicationOrigin(),credentialStorage:this.credentialStorage}}register(e={}){return F(e,this.timeouts.requestMs,n=>this.registerWithinBudget(n.signal))}async registerWithinBudget(e){if(this.application)return this.application;let n=await J(`${this.serverUrl}/v1/apps/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({manifest:await this.manifestDeclaration({signal:e,timeoutMs:null})}),signal:e},"temporarily_unavailable","Application registration is temporarily unavailable."),i=await S(n,"invalid_operation_response","Connect returned an invalid application registration response.");if(!n.ok)throw A(i,"discovery_failed","Application discovery failed.",n.status);return this.application=i.application,this.application}manifestDeclaration(e={}){if(this.manifestPromise)return this.manifestPromise;let i=F(e,this.timeouts.requestMs,o=>this.loadManifest(o.signal)).catch(o=>{throw this.manifestPromise===i&&(this.manifestPromise=null),o});return this.manifestPromise=i,this.manifestPromise}async loadManifest(e){if(typeof this.manifest!="string")return this.manifest;let n=this.manifest,i;try{i=await fetch(n,{headers:{accept:"application/json"},signal:e})}catch(o){throw l("manifest_load_failed","The bundled application declaration could not be loaded.",{cause:o})}if(!i.ok)throw l("manifest_load_failed",`The bundled application declaration returned HTTP ${i.status}.`,{status:i.status});try{return await S(i,"invalid_application_manifest","The bundled application declaration is not valid JSON.")}catch(o){throw l("invalid_application_manifest","The bundled application declaration is not valid JSON.",{cause:o,details:{issues:[{path:"/",keyword:"json",message:"must be valid JSON",params:{}}]}})}}async authorize(e={}){return F(e,this.timeouts.requestMs,n=>this.authorizeWithinBudget({...e,signal:n.signal,timeoutMs:null}))}async authorizeWithinBudget(e){if(typeof location>"u"&&!this.navigate&&!e.openVerification)throw l("browser_required","Authorization navigation requires a browser environment.");let i=typeof this.manifest!="string"&&this.manifest.distribution==="portable"&&!e.openVerification&&!this.navigate&&typeof window<"u"?window.open("","mdbase-connect-authorization","popup,width=620,height=760"):null,o;try{o=await this.registerWithinBudget(e.signal)}catch(r){throw i?.close(),r}return o.distribution==="portable"?(e.openVerification&&i?.close(),this.authorizePortable(o,e,e.openVerification?null:i)):(i?.close(),this.authorizeWeb(o,e))}async authorizeWeb(e,n){let{verifier:i,challenge:o}=await Ve(),r=j(24),a=crypto.randomUUID(),s=n.target?.kind==="collection"?n.target.collectionId:void 0,c=`grant:${e.id}:${r}`,d=await this.keyStore.create(c),p;try{p=await this.loadApplicationIdentity(e)}catch(y){throw await this.keyStore.delete(c),y}let u=K(n.operations??ue),f=new Date,h=await Xe({protocol_version:Ue,authorization_id:a,application_id:e.id,application_declaration_id:wn(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Te(p),installation_signing_public_key:p.signingPublicKey,grant_agreement_public_key:d.agreementPublicKey,grant_signing_public_key:d.signingPublicKey,flow:"authorization_code",authorization_nonce:j(32),issued_at:f.toISOString(),expires_at:new Date(f.getTime()+600*1e3).toISOString(),redirect_uri:this.redirectUri,state:r,code_challenge:o,contracts:Qt(u,e.requirements?.files),requested_operations:u,...e.requirements?.files?{requested_files:e.requirements.files}:{},...s?{collection_id:s}:{}},p),m={version:1,verifier:i,state:r,clientId:e.id,redirectUri:this.redirectUri,relayEncryption:this.relayEncryption,collectionId:s,returnTo:n.returnTo,keyHandle:c,authorizationId:a,applicationAgreementPublicKey:d.agreementPublicKey,applicationSigningPublicKey:d.signingPublicKey};this.storage.setItem(this.pendingKey(r),JSON.stringify(m));try{let y=await fetch(`${this.serverUrl}/oauth/authorization_request`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,redirect_uri:this.redirectUri,code_challenge:o,code_challenge_method:"S256",state:r,operations:u.join(","),...s?{collection_id:s}:{},application_authorization:JSON.stringify(h)}),signal:n.signal}),v=await S(y,"invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(!y.ok)throw A(v,"device_authorization_failed","Application authorization could not be started.",y.status);if(typeof v.authorization_uri!="string"||v.authorization_id!==a||!Number.isInteger(v.expires_in)||v.expires_in<=0)throw l("invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(this.navigate)await this.navigate(v.authorization_uri);else if(typeof location<"u")location.assign(v.authorization_uri);else throw l("browser_required","Authorization navigation requires a browser environment.");return{kind:"redirecting"}}catch(y){throw this.storage.removeItem(this.pendingKey(r)),await this.keyStore.delete(c),n.signal?.aborted?qe(n.signal,"Application authorization was cancelled.",y):y}}async authorizePortable(e,n,i){if(this.relayEncryption!=="required")throw i?.close(),l("encryption_required","Downloaded applications require encrypted relay authorization.");let{verifier:o,challenge:r}=await Ve(),a=`grant:${e.id}:${j(24)}`,s=await this.keyStore.create(a),c;try{c=await this.loadApplicationIdentity(e)}catch(g){throw i?.close(),await this.keyStore.delete(a),g}let d=K(n.operations??ue),p=crypto.randomUUID(),u=new Date,f=await Xe({protocol_version:Ue,authorization_id:p,application_id:e.id,application_declaration_id:wn(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Te(c),installation_signing_public_key:c.signingPublicKey,grant_agreement_public_key:s.agreementPublicKey,grant_signing_public_key:s.signingPublicKey,flow:"device_code",authorization_nonce:j(32),issued_at:u.toISOString(),expires_at:new Date(u.getTime()+600*1e3).toISOString(),code_challenge:r,contracts:Qt(d,e.requirements?.files),requested_operations:d,...e.requirements?.files?{requested_files:e.requirements.files}:{},...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{}},c),h,m;try{h=await fetch(`${this.serverUrl}/oauth/device_authorization`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,operations:d.join(","),...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{},code_challenge:r,code_challenge_method:"S256",application_authorization:JSON.stringify(f)}),signal:n.signal}),m=await S(h,"invalid_device_authorization_response","The authorization service returned an invalid device authorization response.")}catch(g){throw i?.close(),await this.keyStore.delete(a),l("device_authorization_failed","Downloaded application authorization could not be started.",{cause:g})}if(!h.ok)throw i?.close(),await this.keyStore.delete(a),A(m,"device_authorization_failed","Downloaded application authorization could not be started.",h.status);let y;try{y=bi(m)}catch(g){throw i?.close(),await this.keyStore.delete(a),n.signal?.aborted?qe(n.signal,"Downloaded application authorization was cancelled.",g):g}if(n.onDeviceCode?.(y),n.openVerification)await n.openVerification(y);else if(i)try{i.location.href=y.verificationUriComplete}catch{}else throw await this.keyStore.delete(a),l("approval_window_blocked","The approval window was blocked. Show the provided verification link and code, then try again.",{details:{user_code:y.userCode,verification_uri:y.verificationUri,verification_uri_complete:y.verificationUriComplete,expires_at:y.expiresAt,interval_seconds:y.intervalSeconds}});let v=y.intervalSeconds;try{for(;Date.now()<y.expiresAt;){if(await Qe(v*1e3,n.signal),n.signal?.aborted)throw qe(n.signal,"Downloaded application authorization was cancelled.");let g;try{g=await fetch(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:m.device_code,client_id:e.id,code_verifier:o}),signal:n.signal})}catch(R){if(n.signal?.aborted)throw qe(n.signal,"Downloaded application authorization was cancelled.",R);continue}let _=await S(g,"invalid_token_response","The authorization service returned an invalid token response.");if(!g.ok){let R=Ge(_);if(R==="authorization_pending")continue;if(R==="slow_down"){v+=5;continue}throw A(_,"token_exchange_failed","Downloaded application authorization could not be completed.",g.status)}let O=We(_.authority,_.collection_id),D=_.encryption&&_.encryption.protocol_version===dt&&_.encryption.suite===Le&&_.encryption.application_agreement_public_key===s.agreementPublicKey;if(_.application_origin!=="null")throw l("invalid_token_response","Authorization did not bind the portable grant to its opaque application origin.");if(_.authority&&(!O||_.encryption!=null||_.authority.proof_public_key!==s.signingPublicKey))throw l("invalid_token_response","Authorization returned a remote authority capability that is not bound to this portable grant key.");if(!_.authority&&!D)throw l("encryption_required","Authorization did not establish the expected key-bound local portable grant.");let L=this.storeTokenResponse(_,e.id,a);if(n.target?.kind==="collection"&&n.target.collectionId!==L.collectionId)throw this.removeToken(L.collectionId,L.keyHandle),l("collection_mismatch","The approved collection does not match the collection requested by this link.");return i?.close(),{kind:"connected",connection:this.connection(L.collectionId),...n.returnTo?{returnTo:n.returnTo}:{}}}throw l("expired_token","The downloaded application authorization code expired.")}catch(g){throw i?.close(),await this.keyStore.delete(a),n.signal?.aborted?qe(n.signal,"Downloaded application authorization was cancelled.",g):g}}completeAuthorization(e,n={}){return F(n,this.timeouts.requestMs,i=>this.completeAuthorizationWithinBudget(e,i.signal))}completeAuthorizationWithinBudget(e,n){let i=new URL(e).searchParams.get("state");if(!i)return Promise.reject(l("invalid_callback","Authorization callback is missing its state."));let o=this.completionPromises.get(i);if(o)return o;let a=this.performAuthorizationCompletion(e,i,n).finally(()=>{this.completionPromises.get(i)===a&&this.completionPromises.delete(i)});return this.completionPromises.set(i,a),a}async performAuthorizationCompletion(e,n,i){let o=new URL(e),r=o.searchParams.get("code"),a=this.pendingKey(n),s=M(this.storage.getItem(a));if(!s||s.version!==1||n!==s.state)throw l("invalid_callback","Authorization callback is missing or does not match this browser session.");if(o.searchParams.has("error"))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),U(o.searchParams.get("error")??"access_denied",o.searchParams.get("error_description")??"Collection access was not approved.",{details:s.returnTo?{return_to:s.returnTo}:void 0});if(!r)throw l("invalid_callback","Authorization callback is missing its code.");let c=await J(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:r,client_id:s.clientId,redirect_uri:s.redirectUri,code_verifier:s.verifier}),signal:i},"temporarily_unavailable","Authorization completion is temporarily unavailable."),d=await S(c,"invalid_token_response","The authorization service returned an invalid token response.");if(!c.ok)throw A(d,"token_exchange_failed","Authorization could not be completed.",c.status);if(s.relayEncryption==="required"&&!d.authority&&(!d.encryption||!s.keyHandle||d.encryption.application_agreement_public_key!==s.applicationAgreementPublicKey))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),l("encryption_required","Authorization did not establish the required encrypted relay grant.");if(d.authority?.proof_public_key){if(!s.keyHandle||!s.applicationSigningPublicKey||d.authority.proof_public_key!==s.applicationSigningPublicKey)throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),l("invalid_token_response","Authorization returned a remote authority capability bound to another application key.")}else d.authority&&s.keyHandle&&await this.keyStore.delete(s.keyHandle);let p=this.storeTokenResponse(d,s.clientId,d.authority?.proof_public_key?s.keyHandle:d.authority?void 0:s.keyHandle);if(s.collectionId&&s.collectionId!==p.collectionId)throw this.removeToken(p.collectionId,p.keyHandle),this.storage.removeItem(a),l("collection_mismatch","The approved collection does not match the collection requested by this link.");return this.storage.removeItem(a),{connection:this.connection(p.collectionId),...s.returnTo?{returnTo:s.returnTo}:{}}}connections(){let e=[];for(let n of this.connectionIds()){let i=this.connection(n)?.info();i&&e.push(i)}return e.sort((n,i)=>n.displayName.localeCompare(i.displayName)||n.collectionId.localeCompare(i.collectionId))}connection(e){if(!this.storage.getItem(this.tokenKey(e)))return null;let n=this.connectionCache.get(e);return n||(n=new De(this,e),this.connectionCache.set(e,n)),n.info()?n:null}unavailableReason(e){return this.invalidatedConnections.get(e)??null}onConnectionsChange(e){return this.listeners.add(e),e(this.connections()),()=>this.listeners.delete(e)}storeTokenResponse(e,n,i){let o=e.collection_id;if(typeof o!="string")throw l("invalid_token_response","Authorization returned no collection ID.");let r=M(this.storage.getItem(this.tokenKey(o))),a=vo({body:e,clientId:n,keyHandle:i,previous:r,defaultApplicationOrigin:this.defaultApplicationOrigin(),pinConnectorIdentity:(s,c)=>this.pinConnectorIdentity(s,c)});return r?.keyHandle&&r.keyHandle!==i&&this.keyStore.delete(r.keyHandle).catch(()=>{}),this.storage.setItem(this.tokenKey(o),JSON.stringify(a)),this.addConnectionId(o),this.invalidatedConnections.delete(o),this.connectionCache.delete(o),this.emitConnections(),a}forgetConnectorIdentity(e){this.storage.removeItem(this.connectorPinKey(e))}pinConnectorIdentity(e,n){let i=this.connectorPinKey(e),o=M(this.storage.getItem(i));if(o&&(o.version!==1||o.publicKey!==n))throw l("connector_identity_changed","The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");o||this.storage.setItem(i,JSON.stringify({version:1,publicKey:n}))}connectorPinKey(e){return`mdbase-connect:${this.serverUrl}:connector-pin:${e}`}async loadApplicationIdentity(e){try{return await wt(this.identityStore,this.serverUrl,e)}catch(n){throw l("application_identity_unavailable",n instanceof pe?n.message:"The application installation identity is unavailable.",{cause:n})}}removeToken(e,n,i="authorization_lost",o=!1){this.invalidatedConnections.set(e,i),n&&(o||!this.pendingMutationsUseKey(e,n))&&this.keyStore.delete(n).catch(()=>{}),this.storage.removeItem(this.tokenKey(e)),o&&this.removePendingMutations(e);for(let r of["web_push","fcm"])this.storage.removeItem(this.notificationKey(e,r));this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:this.connectionIds().filter(r=>r!==e)})),this.connectionCache.delete(e),this.emitConnections()}tokenKey(e){return`${this.storagePrefix()}:token:${e}`}pendingMutationKey(e){return`${this.storagePrefix()}:pending-mutation:${e}`}removePendingMutations(e){let n=this.pendingMutationKey(e),i=[n];for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);r?.startsWith(`${n}:`)&&i.push(r)}for(let o of i){let r=M(this.storage.getItem(o));r?.keyHandle&&this.keyStore.delete(r.keyHandle).catch(()=>{}),this.storage.removeItem(o)}}pendingMutationsUseKey(e,n){let i=this.pendingMutationKey(e);for(let o=0;o<this.storage.length;o+=1){let r=this.storage.key(o);if(r!==i&&!r?.startsWith(`${i}:`))continue;if(M(this.storage.getItem(r))?.keyHandle===n)return!0}return!1}notificationKey(e,n="web_push"){return`${this.storagePrefix()}:notifications:${e}:${n}`}directPreferenceKey(){return`mdbase-connect:direct:${this.defaultApplicationOrigin()}`}defaultApplicationOrigin(){return Si(this.manifest,this.manifestSource,this.redirectUri,this.application?.distribution==="portable")}pendingKey(e){return`${this.storagePrefix()}:pending:${e}`}storagePrefix(){return`mdbase-connect:${this.serverUrl}:${this.manifestSource}`}connectionsKey(){return`${this.storagePrefix()}:connections`}connectionIds(){let e=M(this.storage.getItem(this.connectionsKey()));return e?.version===1&&Array.isArray(e.collectionIds)&&e.collectionIds.every(n=>typeof n=="string")?e.collectionIds:[]}addConnectionId(e){this.storage.setItem(this.connectionsKey(),JSON.stringify({version:1,collectionIds:[...new Set([...this.connectionIds(),e])]}))}emitConnections(){let e=this.connections();for(let n of this.listeners)n(e)}};var Lt=class{internals;constructor(e){this.internals=new Nt(e)}register(e){return I(()=>this.internals.register(e),se)}authorize(e={}){return I(()=>this.internals.authorize(e),me)}application(e){return new Re(this,e,this.internals.timeouts)}manifest(e){return I(()=>this.internals.manifestDeclaration(e),se)}environment(){return this.internals.environment()}completeAuthorization(e,n){return I(()=>this.internals.completeAuthorization(e===void 0?vt():String(e),n),me)}connections(){return this.internals.connections()}connection(e){return this.internals.connection(e)}unavailableReason(e){return this.internals.unavailableReason(e)}onConnectionsChange(e){return this.internals.onConnectionsChange(e)}forgetAll(){for(let e of this.connections())this.connection(e.collectionId)?.forget()}forgetConnectorIdentity(e){this.internals.forgetConnectorIdentity(e)}};function Sn(t){if(!t||typeof t!="object")throw l("invalid_push_payload","The push payload is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string"||!e.presentation||typeof e.presentation.title!="string")throw l("invalid_push_payload","The push payload is not an mdbase notification.");return e}function Co(t){if(!t||typeof t!="object")throw l("invalid_push_payload","The native notification data is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1&&e.version!=="1"||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string")throw l("invalid_push_payload","The native notification data is not an mdbase notification.");return{type:"mdbase.notification",version:1,signal_id:e.signal_id,criterion_id:e.criterion_id,cursor:e.cursor}}function wo(t,e){let n=Sn(e);return t.showNotification(n.presentation.title,{...n.presentation.body?{body:n.presentation.body}:{},...n.presentation.tag?{tag:n.presentation.tag}:{},data:{type:n.type,signal_id:n.signal_id,criterion_id:n.criterion_id,cursor:n.cursor}})}function So(t){return{subscribe:e=>t.subscribe(e),getSnapshot:()=>t.getSnapshot()}}var Bt=class{collectionParameter;fallbackPath;listeners=new Set;handlePopState=()=>this.emit();constructor(e={}){this.collectionParameter=e.collectionParameter??"collection",this.fallbackPath=e.fallbackPath??"/"}selectedCollectionId(){return this.currentUrl().searchParams.get(this.collectionParameter)}select(e,n={}){let i=Je(this.currentUrl());e?i.searchParams.set(this.collectionParameter,e):i.searchParams.delete(this.collectionParameter);let o=this.browserHistory();o[n.history==="push"?"pushState":"replaceState"](o.state,"",i),this.emit()}authorizationReturnTo(){let e=Je(this.currentUrl());return`${e.pathname}${e.search}${e.hash}`}authorizationCallback(){let e=this.currentUrl().href;return Ct(e)?e:null}finishAuthorization(e,n){let i=this.safeAppUrl(e??this.fallbackPath);Je(i),i.searchParams.set(this.collectionParameter,n),this.browserHistory().replaceState(null,"",i),this.emit()}clearAuthorizationCallback(e){let n=e?this.safeAppUrl(e):this.currentUrl(),i=this.browserHistory();i.replaceState(i.state,"",Je(n)),this.emit()}subscribe(e){let n=this.listeners.size===0;return this.listeners.add(e),n&&typeof window<"u"&&window.addEventListener("popstate",this.handlePopState),()=>{this.listeners.delete(e),this.listeners.size===0&&typeof window<"u"&&window.removeEventListener("popstate",this.handlePopState)}}emit(){for(let e of this.listeners)e()}safeAppUrl(e){let n=this.currentUrl(),i=new URL(e,n.origin);return i.origin===n.origin?i:new URL(this.fallbackPath,n.origin)}currentUrl(){if(typeof location>"u")throw l("browser_required","Browser selection requires a browser environment.");return new URL(location.href)}browserHistory(){if(typeof history>"u")throw l("browser_required","Browser selection requires a browser environment.");return history}},jt=class{collectionId=null;listeners=new Set;selectedCollectionId(){return this.collectionId}select(e){if(e!==this.collectionId){this.collectionId=e;for(let n of this.listeners)n()}}authorizationReturnTo(){}authorizationCallback(){return null}finishAuthorization(e,n){this.select(n)}clearAuthorizationCallback(){}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}};return Io(wa);})();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
sha384-
|
|
1
|
+
sha384-k89LcTH57x5XITrqrh0FhD8nlDMJn52VwtAiYIi/9ri0vszeFP64dln2V3O5FRgC
|
|
@@ -640,6 +640,11 @@ function wireCollectionSetupAssessment(value) {
|
|
|
640
640
|
provisionDigest: value.provision_digest,
|
|
641
641
|
collectionRevision: value.collection_revision,
|
|
642
642
|
finalCollectionRevision: value.final_collection_revision,
|
|
643
|
+
baselineDiagnosticCount: value.baseline_diagnostic_count,
|
|
644
|
+
finalDiagnosticCount: value.final_diagnostic_count,
|
|
645
|
+
resolvedDiagnosticCount: value.resolved_diagnostic_count,
|
|
646
|
+
introducedDiagnosticCount: value.introduced_diagnostic_count,
|
|
647
|
+
baselineDiagnosticDigest: value.baseline_diagnostic_digest,
|
|
643
648
|
configuration: value.configuration,
|
|
644
649
|
typePacks: value.type_packs.map(wireTypePackAssessment),
|
|
645
650
|
finalResourceRevisions: value.final_resource_revisions,
|
|
@@ -525,6 +525,11 @@ export interface CollectionSetupAssessment {
|
|
|
525
525
|
provisionDigest: string;
|
|
526
526
|
collectionRevision: string;
|
|
527
527
|
finalCollectionRevision: string;
|
|
528
|
+
baselineDiagnosticCount: number;
|
|
529
|
+
finalDiagnosticCount: number;
|
|
530
|
+
resolvedDiagnosticCount: number;
|
|
531
|
+
introducedDiagnosticCount: number;
|
|
532
|
+
baselineDiagnosticDigest: string;
|
|
528
533
|
configuration: ConfigurationSetupAssessment[];
|
|
529
534
|
typePacks: TypePackAssessment[];
|
|
530
535
|
finalResourceRevisions: Record<string, string>;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mdbase-dev/connect",
|
|
3
|
-
"version": "0.1.0-beta.
|
|
3
|
+
"version": "0.1.0-beta.50",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
"README.md"
|
|
34
34
|
],
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@mdbase-dev/connect-protocol": "0.1.0-beta.
|
|
36
|
+
"@mdbase-dev/connect-protocol": "0.1.0-beta.50"
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"esbuild": "^0.28.1",
|