@mdbase-dev/connect 0.1.0-beta.91 → 0.1.0-beta.92
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
"use strict";var MdbaseConnect=(()=>{var cn=Object.defineProperty;var xr=Object.getOwnPropertyDescriptor;var Er=Object.getOwnPropertyNames;var qr=Object.prototype.hasOwnProperty;var Dr=(t,e)=>{for(var n in e)cn(t,n,{get:e[n],enumerable:!0})},Fr=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Er(e))!qr.call(t,i)&&i!==n&&cn(t,i,{get:()=>e[i],enumerable:!(o=xr(e,i))||o.enumerable});return t};var zr=t=>Fr(cn({},"__esModule",{value:!0}),t);var $s={};Dr($s,{ApplicationIdentityStoreError:()=>we,FileTransferCryptoError:()=>re,GrantFileTransferCipher:()=>je,IndexedDbApplicationIdentityStore:()=>Ue,IndexedDbGrantKeyStore:()=>Ie,MDBASE_RECORD_CREATED_CONTRACT:()=>vo,MDBASE_TIMER_FIRED_CONTRACT:()=>wo,MdbaseApplicationSession:()=>Fe,MdbaseBrowserSelection:()=>an,MdbaseCollectionClient:()=>Be,MdbaseConnect:()=>rn,MdbaseConnectError:()=>_,MdbaseConnection:()=>$e,MdbaseFileClient:()=>He,MdbaseMemorySelection:()=>sn,MdbaseMemoryVerificationStore:()=>ut,MdbaseSession:()=>De,MemoryApplicationIdentityStore:()=>Le,MemoryGrantKeyStore:()=>Me,RelayCryptoError:()=>x,applicationIdentity:()=>Et,applicationInstallationId:()=>Ne,authorityProofMessage:()=>Rn,connectError:()=>d,connectFailure:()=>g,connectProblem:()=>w,connectSuccess:()=>I,createPkce:()=>at,decryptRelayResponse:()=>xe,deriveFileTransferKey:()=>qn,deriveP256SharedSecret:()=>it,effectiveCapabilities:()=>St,encryptRelayRequest:()=>ne,externalStore:()=>Ir,isRetryableConnectError:()=>Ao,operationProblem:()=>Ae,operationsForApplicationCapabilities:()=>_t,parseMdbaseNativeNotificationData:()=>Tr,parseMdbasePushPayload:()=>Xn,showMdbasePushNotification:()=>kr,signApplicationAuthorization:()=>pt,signAuthorityRequest:()=>At,validateGrantEncryption:()=>oe});var me={access_denied:{category:"authorization",recovery:"reauthorize"},access_paused:{category:"availability",recovery:"resume_connector_access"},application_declaration_mismatch:{category:"authorization",recovery:"reauthorize"},application_identity_unavailable:{category:"compatibility",recovery:"upgrade_application"},approval_window_blocked:{category:"authorization",recovery:"reauthorize"},authority_authorization_changed:{category:"authorization",recovery:"reauthorize"},authorization_binding_incompatible:{category:"compatibility",recovery:"upgrade_application"},authorization_cancelled:{category:"cancellation",recovery:"none"},authorization_expired:{category:"authorization",recovery:"reauthorize"},authorization_replayed:{category:"integrity",recovery:"reauthorize"},browser_required:{category:"compatibility",recovery:"none"},callback_url_required:{category:"validation",recovery:"fix_request"},capability_contract_incompatible:{category:"compatibility",recovery:"upgrade_application"},change_cursor_reset:{category:"conflict",recovery:"refresh"},collection_access_denied:{category:"authorization",recovery:"reauthorize"},collection_configuration_invalid:{category:"validation",recovery:"repair_collection"},collection_contracts_missing:{category:"compatibility",recovery:"choose_collection"},collection_incompatible:{category:"compatibility",recovery:"choose_collection"},collection_invalid:{category:"validation",recovery:"repair_collection"},collection_kind_unsupported:{category:"compatibility",recovery:"choose_collection"},collection_mismatch:{category:"selection",recovery:"choose_collection"},collection_not_found:{category:"selection",recovery:"choose_collection"},collection_not_ready:{category:"selection",recovery:"choose_collection"},collection_not_selected:{category:"selection",recovery:"choose_collection"},collection_type_registry_invalid:{category:"validation",recovery:"repair_collection"},collection_version_unsupported:{category:"compatibility",recovery:"upgrade_collection"},concurrent_modification:{category:"conflict",recovery:"refresh"},connector_busy:{category:"availability",recovery:"retry"},connector_identity_changed:{category:"integrity",recovery:"reauthorize"},connector_offline:{category:"availability",recovery:"retry"},connector_upgrade_required:{category:"compatibility",recovery:"upgrade_connector"},cursor_capacity_exhausted:{category:"availability",recovery:"retry"},device_authorization_failed:{category:"authorization",recovery:"reauthorize"},direct_operation_rejected:{category:"authorization",recovery:"reauthorize"},discovery_failed:{category:"availability",recovery:"retry"},durable_mutation_unsupported:{category:"compatibility",recovery:"upgrade_connector"},encrypted_relay_rejected:{category:"authorization",recovery:"reauthorize"},encryption_required:{category:"authorization",recovery:"reauthorize"},expired_token:{category:"authorization",recovery:"reauthorize"},file_changed_during_move:{category:"conflict",recovery:"refresh"},file_changed_during_read:{category:"conflict",recovery:"refresh"},file_index_warming:{category:"availability",recovery:"retry"},file_move_failed:{category:"internal",recovery:"contact_support"},file_mutation_conflict:{category:"conflict",recovery:"resolve_conflict"},file_not_found:{category:"conflict",recovery:"refresh"},file_source_mismatch:{category:"conflict",recovery:"refresh"},file_upload_incomplete:{category:"conflict",recovery:"retry"},fresh_request_required:{category:"availability",recovery:"retry"},generation_expired:{category:"conflict",recovery:"refresh"},hosted_provider_unavailable:{category:"availability",recovery:"retry"},insufficient_access:{category:"authorization",recovery:"reauthorize"},invalid_application_authorization:{category:"validation",recovery:"fix_request"},invalid_application_manifest:{category:"validation",recovery:"fix_request"},invalid_callback:{category:"validation",recovery:"fix_request"},invalid_device_authorization_response:{category:"integrity",recovery:"contact_support"},invalid_encrypted_response:{category:"integrity",recovery:"contact_support"},invalid_loopback_url:{category:"validation",recovery:"fix_request"},invalid_mutation_id:{category:"validation",recovery:"fix_request"},invalid_operation_response:{category:"integrity",recovery:"contact_support"},invalid_path:{category:"validation",recovery:"fix_request"},invalid_preflight:{category:"conflict",recovery:"refresh"},invalid_push_payload:{category:"validation",recovery:"fix_request"},invalid_push_subscription:{category:"validation",recovery:"fix_request"},invalid_read_cursor:{category:"validation",recovery:"fix_request"},invalid_request:{category:"validation",recovery:"fix_request"},invalid_token_response:{category:"integrity",recovery:"contact_support"},managed_fcm_not_declared:{category:"compatibility",recovery:"fix_request"},manifest_load_failed:{category:"availability",recovery:"retry"},manifest_required:{category:"validation",recovery:"fix_request"},missing_grant_key:{category:"authorization",recovery:"reauthorize"},mutation_recovery_expired:{category:"compatibility",recovery:"none"},mutation_request_conflict:{category:"conflict",recovery:"resolve_conflict"},no_pending_mutation:{category:"conflict",recovery:"refresh"},not_authorized:{category:"authorization",recovery:"reauthorize"},not_remote_authority:{category:"compatibility",recovery:"choose_collection"},notification_criterion_not_declared:{category:"validation",recovery:"fix_request"},notification_reauthorization_required:{category:"authorization",recovery:"reauthorize"},notification_registration_failed:{category:"availability",recovery:"retry"},notification_unregistration_failed:{category:"availability",recovery:"retry"},notifications_not_declared:{category:"compatibility",recovery:"fix_request"},notifications_unavailable:{category:"availability",recovery:"retry"},operation_cancelled:{category:"cancellation",recovery:"none"},operation_failed:{category:"internal",recovery:"contact_support"},operation_invalid:{category:"validation",recovery:"fix_request"},operation_outcome_unknown:{category:"conflict",recovery:"resolve_outcome"},path_occupied:{category:"conflict",recovery:"resolve_conflict"},pending_mutation_unresolved:{category:"conflict",recovery:"resolve_outcome"},query_snapshot_changed:{category:"conflict",recovery:"refresh"},rate_limited:{category:"availability",recovery:"retry"},reconnect_required:{category:"authorization",recovery:"reauthorize"},redirect_uri_required:{category:"validation",recovery:"fix_request"},reference_updates_unsupported:{category:"compatibility",recovery:"fix_request"},registry_backup_invalid:{category:"integrity",recovery:"contact_support"},registry_busy:{category:"availability",recovery:"retry"},registry_corrupt:{category:"integrity",recovery:"repair_collection"},registry_migration_failed:{category:"internal",recovery:"contact_support"},registry_schema_incompatible:{category:"compatibility",recovery:"upgrade_connector"},relay_authorization_expired:{category:"authorization",recovery:"reauthorize"},relay_unavailable:{category:"availability",recovery:"retry"},sandbox_unsupported:{category:"compatibility",recovery:"fix_request"},scope_denied:{category:"authorization",recovery:"reauthorize"},session_destroyed:{category:"cancellation",recovery:"none"},session_not_started:{category:"validation",recovery:"fix_request"},session_starting:{category:"availability",recovery:"retry"},stale_file_revision:{category:"conflict",recovery:"refresh"},storage_required:{category:"compatibility",recovery:"none"},sync_failed:{category:"availability",recovery:"retry"},temporarily_unavailable:{category:"availability",recovery:"retry"},timeout:{category:"availability",recovery:"retry"},token_exchange_failed:{category:"availability",recovery:"retry"},transport_protocol_incompatible:{category:"compatibility",recovery:"upgrade_connector"},type_pack_provision_failed:{category:"validation",recovery:"repair_collection"},unknown_collection:{category:"selection",recovery:"choose_collection"},unsafe_file_path:{category:"validation",recovery:"fix_request"},unsupported_encryption:{category:"compatibility",recovery:"upgrade_application"},unsupported_operation:{category:"compatibility",recovery:"fix_request"}},Ur={access_denied:{type:"object",required:[],properties:{return_to:{type:"string"}}},approval_window_blocked:{type:"object",required:["user_code","verification_uri","verification_uri_complete","expires_at","interval_seconds"],properties:{user_code:{type:"string"},verification_uri:{type:"string"},verification_uri_complete:{type:"string"},expires_at:{type:"integer"},interval_seconds:{type:"integer"}}},authorization_binding_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},capability_contract_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},collection_configuration_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_contracts_missing:{type:"object",required:["contracts"],properties:{contracts:{type:"array",items:{type:"object",required:["id","version"],properties:{id:{type:"string"},version:{type:"string"}}}}}},collection_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_type_registry_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_version_unsupported:{type:"object",required:["current_version","required_version"],properties:{current_version:{type:"string"},required_version:{type:"string"}}},connector_offline:{type:"object",required:[],properties:{connector_name:{type:"string"}}},durable_mutation_unsupported:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},insufficient_access:{type:"object",required:["required_operations","granted_operations","missing_operations"],properties:{required_operations:{type:"array",items:{type:"string"}},granted_operations:{type:"array",items:{type:"string"}},missing_operations:{type:"array",items:{type:"string"}}}},invalid_application_manifest:{type:"object",required:["issues"],properties:{issues:{type:"array",items:{type:"object",required:["path","keyword","message","params"],properties:{path:{type:"string"},keyword:{type:"string"},message:{type:"string"},params:{type:"object"}}}}}},mutation_request_conflict:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},operation_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}},partial_result:{}}},operation_outcome_unknown:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},rate_limited:{type:"object",required:[],properties:{retry_after_ms:{type:"integer"}}},transport_protocol_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}}};function Zn(t){return Object.hasOwn(me,t)}function Je(t){if(!eo(t))return!1;let e=t;if(e.problem_version!==1||typeof e.message!="string"||e.message.length===0||e.operation_outcome!==void 0&&e.operation_outcome!=="not_sent"&&e.operation_outcome!=="rejected"&&e.operation_outcome!=="unknown"||e.trace_id!==void 0&&(typeof e.trace_id!="string"||e.trace_id.length===0))return!1;if(e.code==="unknown")return typeof e.server_code=="string"&&e.server_code.length>0&&e.category==="unknown"&&e.recovery==="none";if(typeof e.code!="string"||!Zn(e.code)||e.server_code!==void 0)return!1;let n=me[e.code],o=Ur[e.code],i=o===void 0?e.details===void 0:e.details===void 0?(o.required?.length??0)===0:ln(e.details,o);return e.category===n.category&&e.recovery===n.recovery&&i}function ln(t,e){if(e.type===void 0)return!0;if(e.type==="string")return typeof t=="string";if(e.type==="integer")return typeof t=="number"&&Number.isInteger(t);if(e.type==="number")return typeof t=="number"&&Number.isFinite(t);if(e.type==="boolean")return typeof t=="boolean";if(e.type==="array")return Array.isArray(t)&&t.every(o=>ln(o,e.items??{}));if(!eo(t))return!1;if(!e.properties)return!0;let n=t;return!Object.keys(n).every(o=>Object.hasOwn(e.properties,o))||!(e.required??[]).every(o=>Object.hasOwn(n,o))?!1:Object.entries(n).every(([o,i])=>ln(i,e.properties[o]))}function eo(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function dn(t,e,n={}){if(Zn(t)){let o=me[t],i={problem_version:1,code:t,category:o.category,recovery:o.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}};if(Je(i))return i}return{problem_version:1,code:"unknown",server_code:t,category:"unknown",recovery:"none",message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}}}var to=new Uint8Array([77,68,66,70]),no=1,oo=0,Ys=new Uint8Array([77,68,66,82]);var io=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,k=class extends Error{code;constructor(e,n){super(n),this.code=e,this.name="FileFrameError"}};function Lr(t){return t==="upload_chunk"?1:2}function Nr(t){if(t===1)return"upload_chunk";if(t===2)return"download_chunk";throw new k("invalid_kind",`Unknown file frame kind ${t}`)}function Br(t){if(!t||typeof t!="object"||Array.isArray(t))throw new k("invalid_header","File frame header must be a JSON object");return t}function yt(t,e){let n=t[e];if(typeof n!="string"||n.length===0)throw new k("invalid_header",`File frame header ${e} must be a non-empty string`);return n}function ht(t,e){let n=yt(t,e);if(!io.test(n))throw new k("invalid_header",`File frame header ${e} must be a UUID`);return n}function ge(t,e,n=Number.MAX_SAFE_INTEGER){let o=t[e];if(!Number.isSafeInteger(o)||o<0||o>n)throw new k("invalid_header",`File frame header ${e} is outside its allowed range`);return o}function un(t){if(t.protocol_version!==1)throw new k("unsupported_version",`Unsupported file transfer protocol ${t.protocol_version}`);if(t.protection!=="grant_aead_v1"&&t.protection!=="transport_tls")throw new k("invalid_header","Unknown file transfer protection");if(t.direction!=="upload"&&t.direction!=="download")throw new k("invalid_header","Unknown file transfer direction");for(let[e,n]of[["grant_id",t.grant_id],["authority_id",t.authority_id],["collection_id",t.collection_id],["transfer_id",t.transfer_id]])if(!io.test(n))throw new k("invalid_header",`File frame header ${e} must be a UUID`);for(let[e,n,o]of[["chunk_size",t.chunk_size,4194304],["chunk_index",t.chunk_index,Number.MAX_SAFE_INTEGER],["offset",t.offset,Number.MAX_SAFE_INTEGER],["plaintext_length",t.plaintext_length,4194304],["total_size",t.total_size,Number.MAX_SAFE_INTEGER]])if(!Number.isSafeInteger(n)||n<0||n>o)throw new k("invalid_header",`File frame header ${e} is outside its allowed range`);if(t.chunk_size<64*1024)throw new k("invalid_header","File frame chunk_size is below the protocol minimum");if(!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<1)throw new k("invalid_header","File frame header scope_epoch must be a positive integer");if(t.protection==="grant_aead_v1"&&!t.key_id)throw new k("invalid_header","AEAD-protected file frames require key_id");return{protocol_version:1,protection:t.protection,grant_id:t.grant_id,authority_id:t.authority_id,collection_id:t.collection_id,transfer_id:t.transfer_id,direction:t.direction,chunk_size:t.chunk_size,chunk_index:t.chunk_index,offset:t.offset,plaintext_length:t.plaintext_length,total_size:t.total_size,scope_epoch:t.scope_epoch,...t.key_id===void 0?{}:{key_id:t.key_id}}}function jr(t){let e;try{e=new TextDecoder("utf-8",{fatal:!0}).decode(t)}catch{throw new k("invalid_header","File frame header is not valid UTF-8")}let n;try{n=Br(JSON.parse(e))}catch(l){throw l instanceof k?l:new k("invalid_header","File frame header is not valid JSON")}let o=new Set(["protocol_version","protection","grant_id","authority_id","collection_id","transfer_id","direction","chunk_size","chunk_index","offset","plaintext_length","total_size","scope_epoch","key_id"]);if(Object.keys(n).some(l=>!o.has(l)))throw new k("invalid_header","File frame header contains an unknown field");let i=ge(n,"protocol_version");if(i!==1)throw new k("unsupported_version",`Unsupported file transfer protocol ${i}`);let r=yt(n,"protection"),a=yt(n,"direction"),s=n.key_id===void 0?void 0:yt(n,"key_id"),c=un({protocol_version:1,protection:r,grant_id:ht(n,"grant_id"),authority_id:ht(n,"authority_id"),collection_id:ht(n,"collection_id"),transfer_id:ht(n,"transfer_id"),direction:a,chunk_size:ge(n,"chunk_size",4194304),chunk_index:ge(n,"chunk_index"),offset:ge(n,"offset"),plaintext_length:ge(n,"plaintext_length",4194304),total_size:ge(n,"total_size"),scope_epoch:ge(n,"scope_epoch"),...s===void 0?{}:{key_id:s}});if(JSON.stringify(c)!==e)throw new k("invalid_header","File frame header must use the canonical field order without duplicate fields or whitespace");return c}function pn(t,e,n){let o=t==="upload_chunk"?"upload":"download";if(e.direction!==o)throw new k("invalid_header",`Frame kind ${t} requires direction ${o}`);let i=e.chunk_index*e.chunk_size;if(!Number.isSafeInteger(i)||e.offset!==i)throw new k("invalid_header","Chunk offset does not match its index and protocol chunk size");if(e.offset+e.plaintext_length>e.total_size)throw new k("invalid_header","Chunk extends past the declared transfer size");let r=e.protection==="grant_aead_v1"?e.plaintext_length+16:e.plaintext_length;if(n!==r)throw new k("invalid_length","Payload length does not match the protected plaintext length")}function Kr(t){return t.plaintext_length+(t.protection==="grant_aead_v1"?16:0)}function mt(t,e){let n=un(e),o=Kr(n);pn(t,n,o);let i=new TextEncoder().encode(JSON.stringify(n));if(i.byteLength>16384)throw new k("limit_exceeded","File frame header exceeds the protocol limit");let r=new Uint8Array(16+i.byteLength);r.set(to,0);let a=new DataView(r.buffer,r.byteOffset,r.byteLength);return a.setUint8(4,no),a.setUint8(5,Lr(t)),a.setUint16(6,oo,!1),a.setUint32(8,i.byteLength,!1),a.setUint32(12,o,!1),r.set(i,16),r}function ro(t){let e=un(t.header);if(pn(t.kind,e,t.payload.byteLength),t.payload.byteLength>4194320)throw new k("limit_exceeded","File frame payload exceeds the protocol limit");let n=mt(t.kind,e),o=new Uint8Array(n.byteLength+t.payload.byteLength);return o.set(n,0),o.set(t.payload,n.byteLength),o}function gt(t,e={}){if(t.byteLength<16)throw new k("invalid_length","File frame is shorter than its fixed prefix");if(!to.every((f,h)=>t[h]===f))throw new k("invalid_magic","File frame magic is not MDBF");let n=new DataView(t.buffer,t.byteOffset,t.byteLength),o=n.getUint8(4);if(o!==no)throw new k("unsupported_version",`Unsupported file frame version ${o}`);let i=Nr(n.getUint8(5));if(n.getUint16(6,!1)!==oo)throw new k("unsupported_flags","File frame uses unsupported flags");let r=n.getUint32(8,!1),a=n.getUint32(12,!1),s=e.maxHeaderBytes??16384,c=e.maxPayloadBytes??4194320;if(r===0)throw new k("invalid_length","File frame header must not be empty");if(r>s||a>c)throw new k("limit_exceeded","File frame exceeds the configured decode limits");let l=16+r+a;if(!Number.isSafeInteger(l)||l!==t.byteLength)throw new k("invalid_length","File frame lengths do not match the supplied bytes");let u=16+r,p=jr(t.subarray(16,u));return pn(i,p,a),{kind:i,header:p,payload:t.slice(u)}}var Vr=["describe","changes","read","query","list_views","execute_view","read_view_source","create_view_source","update_view_source","delete_view_source","validate","create","update","delete","rename","read_type","create_type","update_type","assess_type_pack","apply_type_pack","assess_collection_setup","apply_collection_setup","list_timers","put_timer","cancel_timer","reconcile_timers","sync"],Gr=["list_files","open_file_upload","open_file_download","move_file","delete_file","get_file_transfer_status","commit_file_upload","abort_file_transfer"],Hr={describe:"never",changes:"never",read:"never",query:"never",list_views:"never",execute_view:"never",read_view_source:"never",create_view_source:"always",update_view_source:"always",delete_view_source:"always",validate:"never",create:"always",update:"always",delete:"always",rename:"always",read_type:"never",create_type:"always",update_type:"always",assess_type_pack:"never",apply_type_pack:"always",assess_collection_setup:"never",apply_collection_setup:"always",list_timers:"never",put_timer:"always",cancel_timer:"always",reconcile_timers:"always",sync:"sync_action"},$r={describe:1,changes:1,read:1,query:1,list_views:1,execute_view:1,read_view_source:1,create_view_source:1,update_view_source:1,delete_view_source:1,validate:1,create:1,update:1,delete:1,rename:1,read_type:1,create_type:1,update_type:1,assess_type_pack:1,apply_type_pack:1,assess_collection_setup:1,apply_collection_setup:1,list_timers:1,put_timer:1,cancel_timer:1,reconcile_timers:1,sync:1},Wr={list_files:1,open_file_upload:1,open_file_download:1,move_file:1,delete_file:1,get_file_transfer_status:1,commit_file_upload:1,abort_file_transfer:1},Jr=new Set(["open_file_upload","move_file","delete_file","commit_file_upload","abort_file_transfer"]),Qr=new Set(["delete","rename"]);var Yr=new Set(Vr),Xr=new Set(Gr);function ao(t){return Yr.has(t)}function Zr(t){return Xr.has(t)}function so(t,e){if(t==="file_control"){let n=co(e)&&typeof e.type=="string"?e.type:"";if(!Zr(n))throw new Error(`Unknown file-control message: ${n}`);return Wr[n]}return $r[t]}function ce(t,e){let n=co(e)?e:{};if(n.dry_run===!0&&Qr.has(t))return null;if(t==="file_control"){let i=typeof n.type=="string"?n.type:"";return Jr.has(i)?`file_control:${i}`:null}let o=Hr[t];return o==="always"?t:o==="sync_action"&&n.action==="mutate"?"sync:mutate":null}function le(t,e){return ce(t,e)!==null}function co(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var ea=1,ta="mdbase-connect mutation fingerprint v1\0",fn=new TextEncoder;function na(t){return hn(t,new Set)}function oa(t,e){let n=ce(t,e);if(n===null)throw new TypeError("The operation is not a canonical mutation.");let o=fn.encode(n),i=fn.encode(na(e)),r=fn.encode(ta),a=new Uint8Array(r.length+4+8+o.length+4+8+i.length),s=new DataView(a.buffer),c=0;return a.set(r,c),c+=r.length,s.setUint32(c,ea,!1),c+=4,c=uo(a,s,c,o),s.setUint32(c,so(t,e),!1),c+=4,uo(a,s,c,i),a}async function po(t,e){let n=new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",oa(t,e).buffer));return ia(n)}function hn(t,e){if(t===null)return"null";if(t===!0)return"true";if(t===!1)return"false";if(typeof t=="string")return lo(t),JSON.stringify(t);if(typeof t=="number"){if(!Number.isFinite(t))throw new TypeError("Mutation input numbers must be finite.");return JSON.stringify(t)}if(typeof t!="object")throw new TypeError(`Mutation input contains unsupported ${typeof t}.`);if(e.has(t))throw new TypeError("Mutation input must not contain cycles.");e.add(t);try{if(Array.isArray(t)){if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let i=[];for(let r=0;r<t.length;r+=1){if(!Object.hasOwn(t,r))throw new TypeError("Mutation input arrays must not be sparse.");i.push(hn(t[r],e))}return`[${i.join(",")}]`}let n=Object.getPrototypeOf(t);if(n!==Object.prototype&&n!==null)throw new TypeError("Mutation input objects must be plain JSON objects.");if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let o=Object.entries(t);for(let[i]of o)lo(i);return o.sort(([i],[r])=>i<r?-1:i>r?1:0),`{${o.map(([i,r])=>{let a=Object.getOwnPropertyDescriptor(t,i);if(!a||a.get||a.set)throw new TypeError("Mutation input must not contain accessor properties.");return`${JSON.stringify(i)}:${hn(r,e)}`}).join(",")}}`}finally{e.delete(t)}}function lo(t){for(let e=0;e<t.length;e+=1){let n=t.charCodeAt(e);if(n>=55296&&n<=56319){let o=t.charCodeAt(e+1);if(!(o>=56320&&o<=57343))throw new TypeError("Mutation input strings must not contain lone surrogates.");e+=1}else if(n>=56320&&n<=57343)throw new TypeError("Mutation input strings must not contain lone surrogates.")}}function uo(t,e,n,o){return e.setBigUint64(n,BigInt(o.length),!1),n+=8,t.set(o,n),n+o.length}function ia(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}var H=3,ra=2,fo=[H,ra],Y=5,yn=4,ho=[Y,yn],aa=1,sa=1,oc={operation_transport:[...fo],authorization_binding:[...ho],semantic_capabilities:[aa],durable_mutation:[sa]};function mn(t,e,n=[]){let o={operation_transport:H,authorization_binding:Y,semantic_capabilities:1},i=[...new Set(n)].filter(r=>r!==H).sort((r,a)=>a-r);return i.length>0&&(o.operation_transport_recovery=i),(t.some(r=>le(r,{action:"mutate"}))||e?.actions.some(r=>r!=="list"&&r!=="read")===!0)&&(o.durable_mutation=1),o}function Qe(t){return fo.includes(t)}function yo(t){return ho.includes(t)}var mo={"collection.inspect":["describe"],"records.watch":["changes"],"records.read":["read"],"records.query":["query"],"records.validate":["validate"],"records.create":["create"],"records.update":["update"],"records.delete":["delete"],"records.rename":["rename"],"views.list":["list_views"],"views.execute":["execute_view"],"views.source.read":["read_view_source"],"views.source.create":["create_view_source"],"views.source.update":["update_view_source"],"views.source.delete":["delete_view_source"],"definitions.contracts.current":[],"definitions.read":["read_type"],"definitions.create":["create_type"],"definitions.update":["update_type"],"definitions.type-pack.inspect":["assess_type_pack"],"definitions.type-pack.apply":["assess_type_pack","apply_type_pack"],"collection.setup.apply":["assess_collection_setup","apply_collection_setup"],"timers.list":["list_timers"],"timers.put":["put_timer"],"timers.cancel":["cancel_timer"],"timers.reconcile":["reconcile_timers"],"sync.offline-replica":["sync"],"notifications.background-delivery":[],"files.list":[],"files.read":[],"files.add":[],"files.replace":[],"files.move":[],"files.delete":[]};function _t(t,e={}){let n=e.includeOptional===!1?t.required:[...t.required,...t.optional??[]];return[...new Set(n.flatMap(o=>mo[o]))]}function bt(t){return[...mo[t]]}var ca=new TextEncoder().encode("mdbase-connect application installation id v2\0"),la=new TextEncoder().encode("mdbase-connect application authorization proof v4\0"),da=new TextEncoder().encode("mdbase-connect application authorization proof v5\0");async function _o(t){let e=Ct(t),o=new Uint8Array(await crypto.subtle.digest("SHA-256",_e([ca,N(e)]))).slice(0,16);return o[6]=o[6]&15|128,o[8]=o[8]&63|128,[Ye(o.slice(0,4)),Ye(o.slice(4,6)),Ye(o.slice(6,8)),Ye(o.slice(8,10)),Ye(o.slice(10,16))].join("-")}function bo(t){let e=[Ct(t.installation_signing_public_key),Ct(t.grant_agreement_public_key),Ct(t.grant_signing_public_key)];if(e.some((c,l)=>e.slice(l+1).some(u=>ma(c,u))))throw new Error("Application authorization keys must be distinct.");let n=gn(t.authorization_nonce),o=gn(t.code_challenge),i=t.contracts,r=i.operation_transport_recovery??[],a=t.requested_operations.some(c=>le(c,{action:"mutate"}))||t.requested_files?.actions.some(c=>!["list","read"].includes(c))===!0;if(!yo(t.protocol_version)||n.byteLength!==32||!/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)+$/u.test(t.application_declaration_id)||!/^[0-9a-f]{64}$/u.test(t.application_manifest_digest)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.issued_at)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.expires_at)||o.byteLength!==32||![i.operation_transport,i.authorization_binding,i.semantic_capabilities,i.durable_mutation??1].every(c=>Number.isInteger(c)&&c>0)||i.authorization_binding!==t.protocol_version||!Qe(i.operation_transport)||t.protocol_version===Y&&i.operation_transport!==H||r.some(c=>!Qe(c)||c===i.operation_transport)||new Set(r).size!==r.length||t.protocol_version===yn&&r.length>0||r.length>0&&!a||(a?i.durable_mutation!==1:i.durable_mutation!==void 0)||t.requested_operations.length===0&&t.requested_files===void 0||new Set(t.requested_operations).size!==t.requested_operations.length||t.requested_operations.some(c=>!c||c.includes("\0"))||(t.flow==="authorization_code"?t.redirect_uri===void 0||t.state===void 0:t.flow!=="device_code"||t.redirect_uri!==void 0||t.state!==void 0))throw new Error("Application authorization binding is invalid.");pa(t.requested_files);let s=t.requested_operations.map(c=>N(new TextEncoder().encode(c)));return _e([t.protocol_version===Y?da:la,W(t.protocol_version),N(vt(t.application_id)),N(vt(t.authorization_id)),N(new TextEncoder().encode(t.application_declaration_id)),N(Co(t.application_manifest_digest)),N(vt(t.application_installation_id)),...e.map(N),N(new TextEncoder().encode(t.flow)),N(n),N(new TextEncoder().encode(t.issued_at)),N(new TextEncoder().encode(t.expires_at)),go(t.redirect_uri),go(t.state),N(new TextEncoder().encode(t.code_challenge)),W(i.operation_transport),...t.protocol_version===Y?[W(r.length),...r.map(W)]:[],W(i.authorization_binding),W(i.semantic_capabilities),ua(i.durable_mutation),W(s.length),...s,fa(t.requested_files),ha(t.collection_id)])}function ua(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),W(t)])}function pa(t){if(t!==void 0&&(t.actions.length===0||new Set(t.actions).size!==t.actions.length||t.scope.kind==="selected_folders"&&(t.scope.folders.length===0||new Set(t.scope.folders).size!==t.scope.folders.length||t.scope.folders.some(e=>!e||e.includes("\0")))))throw new Error("Application authorization file request is invalid.")}function fa(t){if(t===void 0)return new Uint8Array(1);let e=t.actions.map(n=>N(new TextEncoder().encode(n)));return _e([new Uint8Array([1]),W(e.length),...e,N(new TextEncoder().encode(t.scope.kind)),...t.scope.kind==="selected_folders"?[W(t.scope.folders.length),...t.scope.folders.map(n=>N(new TextEncoder().encode(n)))]:[]])}function go(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),N(new TextEncoder().encode(t))])}function ha(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),N(vt(t))])}function Ct(t){let e=gn(t);if(e.byteLength!==65||e[0]!==4)throw new Error("Application authorization public key is invalid.");return e}function gn(t){if(!/^[A-Za-z0-9_-]+$/u.test(t))throw new Error("Invalid base64url value.");let e=t.replaceAll("-","+").replaceAll("_","/"),n=e.padEnd(Math.ceil(e.length/4)*4,"="),o=Uint8Array.from(atob(n),i=>i.charCodeAt(0));if(ya(o)!==t)throw new Error("Non-canonical base64url value.");return o}function vt(t){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(t))throw new Error("Invalid UUID value.");let e=t.replaceAll("-","");return Co(e)}function Co(t){if(!/^[0-9a-f]+$/u.test(t)||t.length%2!==0)throw new Error("Invalid hexadecimal value.");return Uint8Array.from({length:t.length/2},(e,n)=>Number.parseInt(t.slice(n*2,n*2+2),16))}function N(t){return _e([W(t.byteLength),t])}function W(t){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,t,!1),e}function _e(t){let e=new Uint8Array(t.reduce((o,i)=>o+i.byteLength,0)),n=0;for(let o of t)e.set(o,n),n+=o.byteLength;return e}function ya(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function ma(t,e){return t.byteLength===e.byteLength&&t.every((n,o)=>n===e[o])}function Ye(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}var vo={id:"mdbase.record.created",version:"1.0.0",digest:"sha256:7f3bed6baa356ee9389e977ae7b77a102e2bee871a7c1d9f2026fc21cacdbfc9"};var wo={id:"mdbase.runtime.timer.fired",version:"1.0.0",digest:"sha256:41105be7a7abf33b31ced47e1e1965242236e40ccaea286b959b0a8c591f5642"};var So=28485,Xe="P256-HKDF-SHA256-AES256GCM",wt=1;var ga="contract-setup-v1",_a="file-relay-v1",ba="protocol-usage-report-v1",Ca="policy-freshness-lease-v1",va=["application-authorization-v4","authorization-activation","encrypted-relay","policy-ack",Ca];var wa=["durable-mutation-journal-v1","durable-file-lifecycle-v1"],Sa="candidate-b-activation-v1",dc=[...wa,"mutation-replay-after-credential-retirement-v1",Sa],uc=[...va,"application-authorization-v5",ga,_a,ba],_n=1;var Ro="mdbase-authority-request-proof-v1",Ze={version:"x-mdbase-proof-version",timestamp:"x-mdbase-proof-timestamp",nonce:"x-mdbase-proof-nonce",signature:"x-mdbase-proof-signature"};function St(t,e,n){let o=new Set(t.required),i=[...new Set([...t.required,...t.optional??[]])],r={};for(let a of i)r[a]=Ra(a,o.has(a),e,n);return{contractVersion:1,values:r,requiredAvailable:t.required.every(a=>r[a]?.state==="available")}}function Ra(t,e,n,o){let i=bt(t),r=i.filter(s=>!o.operations.includes(s)),a={id:t,requirement:e?"required":"optional",operations:i,missingOperations:r,evidence:[{source:"application",fact:`${e?"Required":"Optional"} in capability contract v1.`}]};if(r.length>0)return{...a,state:"requires_authorization",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${r.join(", ")}.`}],reason:"The current grant does not include every operation for this capability."};if(t==="definitions.contracts.current"&&o.scope.access!=="full_collection"){let s=new Set(o.scope.contracts.map(({id:l,version:u,digest:p})=>`${l}@${u}:${p}`)),c=(n.requirements?.contracts??[]).filter(({id:l,version:u,digest:p})=>!s.has(`${l}@${u}:${p}`));if(c.length>0)return{...a,state:"requires_authorization",reason:"The current grant does not approve the exact required contract definitions.",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${c.map(({id:l,version:u})=>`${l}@${u}`).join(", ")}.`}],details:{missingContracts:c}}}if(t.startsWith("files.")){let s=t.slice(6);if(!o.fileCapability?.actions.includes(s))return{...a,state:o.fileCapability?"requires_authorization":"unsupported",reason:o.fileCapability?`The current file grant does not include ${s}.`:"This connection has no file capability.",evidence:[...a.evidence,{source:"authorization",fact:o.fileCapability?`Granted file actions: ${o.fileCapability.actions.join(", ")}.`:"No file capability was granted."}]}}return t==="notifications.background-delivery"&&(n.notifications?.criteria.length??0)===0?{...a,state:"requires_setup",reason:"The application manifest declares no notification criteria.",evidence:[...a.evidence,{source:"application",fact:"No authority notification criteria are declared."}]}:{...a,state:"available",evidence:[...a.evidence,{source:"authorization",fact:i.length>0?`Granted operations: ${i.join(", ")}.`:"No record operation is required."},{source:"authority",fact:o.authority.kind==="hosted"?"Backed by a durable hosted mdbase authority.":"Backed by a user-operated mdbase connector."}],...t==="sync.offline-replica"?{details:{durability:"device",writes:"queued",authority:o.authority.kind}}:{},...t==="notifications.background-delivery"?{details:{delivery:"authority",payload:"opaque"}}:{}}}var _=class extends Error{constructor(n,o={}){super(n.message,o.cause===void 0?void 0:{cause:o.cause});this.problem=n;this.name="MdbaseConnectError",this.code=n.code,this.status=o.status}problem;code;status;get retryable(){return this.problem.recovery==="retry"&&this.problem.operation_outcome!=="unknown"}get requiresAuthorization(){return this.problem.category==="authorization"}get outcomeUnknown(){return this.problem.operation_outcome==="unknown"}get recovery(){return this.problem.recovery}get details(){return this.problem.details}};function w(t,e,...[n={}]){let o=me[t];return{problem_version:1,code:t,category:o.category,recovery:o.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operationOutcome===void 0?{}:{operation_outcome:n.operationOutcome},...n.traceId===void 0?{}:{trace_id:n.traceId}}}function Po(t,e,n={}){return dn(t,e,{details:n.details,operation_outcome:n.operationOutcome,trace_id:n.traceId})}function d(t,e,...n){let o=n[0];return new _(w(t,e,...n),{status:o?.status,cause:o?.cause})}function F(t,e,n={}){let{status:o,cause:i,...r}=n;return new _(dn(t,e,{details:r.details,operation_outcome:r.operationOutcome,trace_id:r.traceId}),{status:o,cause:i})}function Ae(t){let e=Aa(t.diagnostics),n=ka(t.diagnostics);if(e==="collection_version_unsupported"){let o=Oa(t.diagnostics);return w(e,n,{operationOutcome:"rejected",details:o})}return e!=="operation_invalid"?w(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics}}):w(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics,partial_result:t.result}})}function Aa(t){let e=new Set(t.filter(n=>n.severity==="error").map(n=>n.code));return["migration_required","migration_lossy","unsupported_version"].some(n=>e.has(n))?"collection_version_unsupported":["invalid_config","invalid_configuration","missing_config","missing_spec_version"].some(n=>e.has(n))?"collection_configuration_invalid":["duplicate_type","invalid_contract_definition","invalid_data_contract","invalid_type_definition","invalid_type_path"].some(n=>e.has(n))?"collection_type_registry_invalid":["collection_invalid","collection_open_failed"].some(n=>e.has(n))?"collection_invalid":"operation_invalid"}function Oa(t){let e=t.map(n=>n.details).find(n=>Ta(n));return{current_version:typeof e?.current_version=="string"?e.current_version:"0.2.x",required_version:typeof e?.required_version=="string"?e.required_version:"0.3.0"}}function Ta(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function Ao(t){return t instanceof _&&t.retryable}function ka(t){return t.filter(e=>e.severity==="error").map(e=>e.message).join(" ")||t.map(e=>e.message).join(" ")||"The collection rejected this operation."}var Ia=["access_denied","access_paused","application_declaration_mismatch","authorization_binding_incompatible","authorization_expired","capability_contract_incompatible","collection_access_denied","connector_identity_changed","connector_offline","connector_upgrade_required","direct_operation_rejected","durable_mutation_unsupported","operation_outcome_unknown","encryption_required","encrypted_relay_rejected","hosted_provider_unavailable","insufficient_access","invalid_encrypted_response","invalid_operation_response","invalid_request","missing_grant_key","mutation_recovery_expired","mutation_request_conflict","not_authorized","operation_cancelled","operation_failed","rate_limited","relay_authorization_expired","relay_unavailable","temporarily_unavailable","timeout","transport_protocol_incompatible","unsupported_operation"],Oo=Object.keys(me),be=["discovery_failed","invalid_operation_response","invalid_application_manifest","invalid_request","manifest_load_failed","rate_limited","temporarily_unavailable","timeout"],Oe=[...be,"access_denied","application_declaration_mismatch","application_identity_unavailable","approval_window_blocked","authorization_binding_incompatible","authorization_cancelled","authorization_replayed","browser_required","capability_contract_incompatible","collection_access_denied","collection_configuration_invalid","collection_contracts_missing","collection_incompatible","collection_invalid","collection_kind_unsupported","collection_mismatch","collection_not_found","collection_type_registry_invalid","collection_version_unsupported","connector_identity_changed","connector_offline","connector_upgrade_required","device_authorization_failed","durable_mutation_unsupported","encryption_required","expired_token","invalid_application_authorization","invalid_callback","invalid_device_authorization_response","invalid_token_response","scope_denied","reconnect_required","token_exchange_failed","transport_protocol_incompatible"],et=[...be,"authorization_expired","invalid_operation_response","invalid_push_subscription","managed_fcm_not_declared","not_authorized","notification_criterion_not_declared","notification_reauthorization_required","notification_registration_failed","notification_unregistration_failed","notifications_not_declared","notifications_unavailable"],bn=["connector_offline","connector_upgrade_required","invalid_operation_response","not_authorized","operation_failed","temporarily_unavailable","timeout"],kc=[...Oe,"collection_not_ready","collection_not_selected","operation_cancelled","session_destroyed","session_not_started","session_starting","unknown_collection"],Ma=["collection_configuration_invalid","collection_invalid","collection_type_registry_invalid","collection_version_unsupported"],Rt=[...Ia,...Ma],te=[...Rt,"invalid_path","operation_invalid"],Cn=[...te,"cursor_capacity_exhausted","generation_expired","invalid_read_cursor","query_snapshot_changed","sandbox_unsupported"],B=[...te,"concurrent_modification","invalid_preflight","pending_mutation_unresolved"],Pt=[...Rt,"change_cursor_reset"],de=[...B,"type_pack_provision_failed"];function I(t,e=[]){return{ok:!0,value:t,diagnostics:e}}function g(t){return{ok:!1,problem:t}}async function z(t,e){try{return I(await t())}catch(n){if(!(n instanceof _))throw n;let o=n.problem;return o.code==="unknown"||e.includes(o.code)?g(o):g(Po(o.code,o.message,{details:o.details,operationOutcome:o.operation_outcome,traceId:o.trace_id}))}}var Te=3e4,vn=1e4,xa=10*6e4,Ea=12e4,qa=6e4;function ke(t={}){return{requestMs:tt(t.requestMs,Te,"requestMs"),watchStartMs:tt(t.watchStartMs,vn,"watchStartMs"),fileIndexMs:tt(t.fileIndexMs,xa,"fileIndexMs"),uploadMs:tt(t.uploadMs,Ea,"uploadMs"),syncMs:tt(t.syncMs,qa,"syncMs")}}function nt(t,e){return{...t,signal:e.signal,...e.deadline===null?{}:{deadlineUnixMs:e.deadline}}}function ue(t={},e=Te,n=Date.now){let o=t.timeoutMs===void 0?e:t.timeoutMs,i=o===null?null:Da(o),r=new AbortController,a=i===null?null:n()+i,s=()=>r.abort(t.signal?.reason);t.signal?.aborted?s():t.signal?.addEventListener("abort",s,{once:!0});let c=i===null?void 0:setTimeout(()=>r.abort(d("timeout","The operation exceeded its request deadline.",{operationOutcome:"not_sent"})),i),l=!1;return{signal:r.signal,deadline:a,remainingMs:()=>a===null?null:Math.max(0,a-n()),dispose:()=>{l||(l=!0,c!==void 0&&clearTimeout(c),t.signal?.removeEventListener("abort",s))}}}async function U(t,e,n){let o=ue(t,e),i,r=new Promise((s,c)=>{i=c}),a=()=>i?.($(o.signal));o.signal.addEventListener("abort",a,{once:!0});try{if(o.signal.aborted)throw $(o.signal);return await Promise.race([n(o),r])}finally{o.signal.removeEventListener("abort",a),o.dispose()}}async function j(t,e,n){let o=ue(t,e);try{if(o.signal.aborted)throw $(o.signal);return await n(o)}finally{o.dispose()}}function $(t){return t.reason instanceof _?t.reason:d("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function Da(t){if(!Number.isSafeInteger(t)||t<=0)throw new TypeError("timeoutMs must be a positive safe integer or null.");return t}function tt(t,e,n){if(t===void 0)return e;if(t===null)return null;if(!Number.isSafeInteger(t)||t<=0)throw new TypeError(`${n} must be a positive safe integer or null.`);return t}var Fa="mdbase-connect-keys",pe="grant-keys",Sn=18446744073709551615n,za="mdbase-connect relay request key v1",Ua="mdbase-connect relay response key v1",To=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ie=class{database=null;async create(e){let n=await Mo(e),o=await this.open();return await Io(o,i=>i.add({...n,counter:"0"})),n}async get(e){let n=await this.open(),o=await ja(n.transaction(pe).objectStore(pe).get(e));return o?{handle:o.handle,agreementPrivateKey:o.agreementPrivateKey,agreementPublicKey:o.agreementPublicKey,signingPrivateKey:o.signingPrivateKey,signingPublicKey:o.signingPublicKey}:null}async nextCounter(e){let n=await this.open();return new Promise((o,i)=>{let r=n.transaction(pe,"readwrite"),a=r.objectStore(pe),s=a.get(e),c=null;s.onerror=()=>i(s.error),s.onsuccess=()=>{let l=s.result;if(!l){r.abort(),i(new x("missing_grant_key","The encrypted grant key is unavailable."));return}let u=BigInt(l.counter)+1n;if(u>Sn){r.abort(),i(new x("counter_exhausted","The encrypted grant must be authorized again."));return}c=u.toString(),a.put({...l,counter:c})},r.onerror=()=>i(r.error),r.onabort=()=>i(r.error??new Error("Key counter transaction aborted.")),r.oncomplete=()=>{c&&o(c)}})}async delete(e){let n=await this.open();await Io(n,o=>o.delete(e))}open(){if(typeof indexedDB>"u")throw new x("key_storage_unavailable","Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");return this.database||(this.database=new Promise((e,n)=>{let o=indexedDB.open(Fa,1);o.onupgradeneeded=()=>{o.result.objectStoreNames.contains(pe)||o.result.createObjectStore(pe,{keyPath:"handle"})},o.onerror=()=>n(o.error),o.onsuccess=()=>e(o.result)})),this.database}},Me=class{records=new Map;sequence=Promise.resolve();async create(e){if(this.records.has(e))throw new Error(`Grant key already exists: ${e}`);let n=await Mo(e);return this.records.set(e,{...n,counter:"0"}),n}async get(e){let n=this.records.get(e);return n?{handle:n.handle,agreementPrivateKey:n.agreementPrivateKey,agreementPublicKey:n.agreementPublicKey,signingPrivateKey:n.signingPrivateKey,signingPublicKey:n.signingPublicKey}:null}nextCounter(e){let n,o,i=new Promise((r,a)=>{n=r,o=a});return this.sequence=this.sequence.then(()=>{let r=this.records.get(e);if(!r)throw new x("missing_grant_key","The encrypted grant key is unavailable.");let a=BigInt(r.counter)+1n;if(a>Sn)throw new x("counter_exhausted","The encrypted grant must be authorized again.");r.counter=a.toString(),n(r.counter)}).catch(r=>{o(r)}),i}async delete(e){this.records.delete(e)}};async function At(t,e,n,o){let i=await La(t,e,n),r=o.timestamp??Math.floor(Date.now()/1e3),a=o.nonce??crypto.randomUUID(),s=await Rn({...o,timestamp:r,nonce:a}),c=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},i.signingPrivateKey,new TextEncoder().encode(s));return{[Ze.version]:String(_n),[Ze.timestamp]:String(r),[Ze.nonce]:a,[Ze.signature]:ot(new Uint8Array(c))}}async function Rn(t){let e=t.method.toUpperCase(),n=await ko(t.body??""),o=await ko(t.credential);for(let i of[e,t.target,String(t.timestamp),t.nonce])if(!i||i.includes(`
|
|
1
|
+
"use strict";var MdbaseConnect=(()=>{var cn=Object.defineProperty;var xr=Object.getOwnPropertyDescriptor;var Er=Object.getOwnPropertyNames;var qr=Object.prototype.hasOwnProperty;var Dr=(t,e)=>{for(var n in e)cn(t,n,{get:e[n],enumerable:!0})},Fr=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let i of Er(e))!qr.call(t,i)&&i!==n&&cn(t,i,{get:()=>e[i],enumerable:!(o=xr(e,i))||o.enumerable});return t};var zr=t=>Fr(cn({},"__esModule",{value:!0}),t);var $s={};Dr($s,{ApplicationIdentityStoreError:()=>we,FileTransferCryptoError:()=>re,GrantFileTransferCipher:()=>je,IndexedDbApplicationIdentityStore:()=>Ue,IndexedDbGrantKeyStore:()=>Ie,MDBASE_RECORD_CREATED_CONTRACT:()=>vo,MDBASE_TIMER_FIRED_CONTRACT:()=>wo,MdbaseApplicationSession:()=>Fe,MdbaseBrowserSelection:()=>an,MdbaseCollectionClient:()=>Be,MdbaseConnect:()=>rn,MdbaseConnectError:()=>_,MdbaseConnection:()=>$e,MdbaseFileClient:()=>He,MdbaseMemorySelection:()=>sn,MdbaseMemoryVerificationStore:()=>ut,MdbaseSession:()=>De,MemoryApplicationIdentityStore:()=>Le,MemoryGrantKeyStore:()=>Me,RelayCryptoError:()=>x,applicationIdentity:()=>Et,applicationInstallationId:()=>Ne,authorityProofMessage:()=>Rn,connectError:()=>d,connectFailure:()=>g,connectProblem:()=>w,connectSuccess:()=>I,createPkce:()=>at,decryptRelayResponse:()=>xe,deriveFileTransferKey:()=>qn,deriveP256SharedSecret:()=>it,effectiveCapabilities:()=>St,encryptRelayRequest:()=>ne,externalStore:()=>Ir,isRetryableConnectError:()=>Ao,operationProblem:()=>Ae,operationsForApplicationCapabilities:()=>_t,parseMdbaseNativeNotificationData:()=>Tr,parseMdbasePushPayload:()=>Xn,showMdbasePushNotification:()=>kr,signApplicationAuthorization:()=>pt,signAuthorityRequest:()=>At,validateGrantEncryption:()=>oe});var me={access_denied:{category:"authorization",recovery:"reauthorize"},access_paused:{category:"availability",recovery:"resume_connector_access"},application_declaration_mismatch:{category:"authorization",recovery:"reauthorize"},application_identity_unavailable:{category:"compatibility",recovery:"upgrade_application"},approval_window_blocked:{category:"authorization",recovery:"reauthorize"},authority_authorization_changed:{category:"authorization",recovery:"reauthorize"},authorization_binding_incompatible:{category:"compatibility",recovery:"upgrade_application"},authorization_cancelled:{category:"cancellation",recovery:"none"},authorization_expired:{category:"authorization",recovery:"reauthorize"},authorization_replayed:{category:"integrity",recovery:"reauthorize"},browser_required:{category:"compatibility",recovery:"none"},callback_url_required:{category:"validation",recovery:"fix_request"},capability_contract_incompatible:{category:"compatibility",recovery:"upgrade_application"},change_cursor_reset:{category:"conflict",recovery:"refresh"},collection_access_denied:{category:"authorization",recovery:"reauthorize"},collection_configuration_invalid:{category:"validation",recovery:"repair_collection"},collection_contracts_missing:{category:"compatibility",recovery:"choose_collection"},collection_incompatible:{category:"compatibility",recovery:"choose_collection"},collection_invalid:{category:"validation",recovery:"repair_collection"},collection_kind_unsupported:{category:"compatibility",recovery:"choose_collection"},collection_mismatch:{category:"selection",recovery:"choose_collection"},collection_not_found:{category:"selection",recovery:"choose_collection"},collection_not_ready:{category:"selection",recovery:"choose_collection"},collection_not_selected:{category:"selection",recovery:"choose_collection"},collection_type_registry_invalid:{category:"validation",recovery:"repair_collection"},collection_version_unsupported:{category:"compatibility",recovery:"upgrade_collection"},concurrent_modification:{category:"conflict",recovery:"refresh"},connector_busy:{category:"availability",recovery:"retry"},connector_identity_changed:{category:"integrity",recovery:"reauthorize"},connector_offline:{category:"availability",recovery:"retry"},connector_upgrade_required:{category:"compatibility",recovery:"upgrade_connector"},cursor_capacity_exhausted:{category:"availability",recovery:"retry"},device_authorization_failed:{category:"authorization",recovery:"reauthorize"},direct_operation_rejected:{category:"authorization",recovery:"reauthorize"},discovery_failed:{category:"availability",recovery:"retry"},durable_mutation_unsupported:{category:"compatibility",recovery:"upgrade_connector"},encrypted_relay_rejected:{category:"authorization",recovery:"reauthorize"},encryption_required:{category:"authorization",recovery:"reauthorize"},expired_token:{category:"authorization",recovery:"reauthorize"},file_changed_during_move:{category:"conflict",recovery:"refresh"},file_changed_during_read:{category:"conflict",recovery:"refresh"},file_index_warming:{category:"availability",recovery:"retry"},file_move_failed:{category:"internal",recovery:"contact_support"},file_mutation_conflict:{category:"conflict",recovery:"resolve_conflict"},file_not_found:{category:"conflict",recovery:"refresh"},file_source_mismatch:{category:"conflict",recovery:"refresh"},file_upload_incomplete:{category:"conflict",recovery:"retry"},fresh_request_required:{category:"availability",recovery:"retry"},generation_expired:{category:"conflict",recovery:"refresh"},hosted_provider_unavailable:{category:"availability",recovery:"retry"},insufficient_access:{category:"authorization",recovery:"reauthorize"},invalid_application_authorization:{category:"validation",recovery:"fix_request"},invalid_application_manifest:{category:"validation",recovery:"fix_request"},invalid_callback:{category:"validation",recovery:"fix_request"},invalid_device_authorization_response:{category:"integrity",recovery:"contact_support"},invalid_encrypted_response:{category:"integrity",recovery:"contact_support"},invalid_loopback_url:{category:"validation",recovery:"fix_request"},invalid_mutation_id:{category:"validation",recovery:"fix_request"},invalid_operation_response:{category:"integrity",recovery:"contact_support"},invalid_path:{category:"validation",recovery:"fix_request"},invalid_preflight:{category:"conflict",recovery:"refresh"},invalid_push_payload:{category:"validation",recovery:"fix_request"},invalid_push_subscription:{category:"validation",recovery:"fix_request"},invalid_read_cursor:{category:"validation",recovery:"fix_request"},invalid_request:{category:"validation",recovery:"fix_request"},invalid_token_response:{category:"integrity",recovery:"contact_support"},managed_fcm_not_declared:{category:"compatibility",recovery:"fix_request"},manifest_load_failed:{category:"availability",recovery:"retry"},manifest_required:{category:"validation",recovery:"fix_request"},missing_grant_key:{category:"authorization",recovery:"reauthorize"},mutation_recovery_expired:{category:"compatibility",recovery:"none"},mutation_request_conflict:{category:"conflict",recovery:"resolve_conflict"},no_pending_mutation:{category:"conflict",recovery:"refresh"},not_authorized:{category:"authorization",recovery:"reauthorize"},not_remote_authority:{category:"compatibility",recovery:"choose_collection"},notification_criterion_not_declared:{category:"validation",recovery:"fix_request"},notification_reauthorization_required:{category:"authorization",recovery:"reauthorize"},notification_registration_failed:{category:"availability",recovery:"retry"},notification_unregistration_failed:{category:"availability",recovery:"retry"},notifications_not_declared:{category:"compatibility",recovery:"fix_request"},notifications_unavailable:{category:"availability",recovery:"retry"},operation_cancelled:{category:"cancellation",recovery:"none"},operation_failed:{category:"internal",recovery:"contact_support"},operation_invalid:{category:"validation",recovery:"fix_request"},operation_outcome_unknown:{category:"conflict",recovery:"resolve_outcome"},path_occupied:{category:"conflict",recovery:"resolve_conflict"},pending_mutation_unresolved:{category:"conflict",recovery:"resolve_outcome"},query_snapshot_changed:{category:"conflict",recovery:"refresh"},rate_limited:{category:"availability",recovery:"retry"},reconnect_required:{category:"authorization",recovery:"reauthorize"},redirect_uri_required:{category:"validation",recovery:"fix_request"},reference_updates_unsupported:{category:"compatibility",recovery:"fix_request"},registry_backup_invalid:{category:"integrity",recovery:"contact_support"},registry_busy:{category:"availability",recovery:"retry"},registry_corrupt:{category:"integrity",recovery:"repair_collection"},registry_migration_failed:{category:"internal",recovery:"contact_support"},registry_schema_incompatible:{category:"compatibility",recovery:"upgrade_connector"},relay_authorization_expired:{category:"authorization",recovery:"reauthorize"},relay_unavailable:{category:"availability",recovery:"retry"},sandbox_unsupported:{category:"compatibility",recovery:"fix_request"},scope_denied:{category:"authorization",recovery:"reauthorize"},session_destroyed:{category:"cancellation",recovery:"none"},session_not_started:{category:"validation",recovery:"fix_request"},session_starting:{category:"availability",recovery:"retry"},stale_file_revision:{category:"conflict",recovery:"refresh"},storage_required:{category:"compatibility",recovery:"none"},sync_failed:{category:"availability",recovery:"retry"},temporarily_unavailable:{category:"availability",recovery:"retry"},timeout:{category:"availability",recovery:"retry"},token_exchange_failed:{category:"availability",recovery:"retry"},transport_protocol_incompatible:{category:"compatibility",recovery:"upgrade_connector"},type_pack_provision_failed:{category:"validation",recovery:"repair_collection"},unknown_collection:{category:"selection",recovery:"choose_collection"},unsafe_file_path:{category:"validation",recovery:"fix_request"},unsupported_encryption:{category:"compatibility",recovery:"upgrade_application"},unsupported_operation:{category:"compatibility",recovery:"fix_request"}},Ur={access_denied:{type:"object",required:[],properties:{return_to:{type:"string"}}},approval_window_blocked:{type:"object",required:["user_code","verification_uri","verification_uri_complete","expires_at","interval_seconds"],properties:{user_code:{type:"string"},verification_uri:{type:"string"},verification_uri_complete:{type:"string"},expires_at:{type:"integer"},interval_seconds:{type:"integer"}}},authorization_binding_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},capability_contract_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},collection_configuration_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_contracts_missing:{type:"object",required:["contracts"],properties:{contracts:{type:"array",items:{type:"object",required:["id","version"],properties:{id:{type:"string"},version:{type:"string"}}}}}},collection_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_type_registry_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}}}},collection_version_unsupported:{type:"object",required:["current_version","required_version"],properties:{current_version:{type:"string"},required_version:{type:"string"}}},connector_offline:{type:"object",required:[],properties:{connector_name:{type:"string"}}},durable_mutation_unsupported:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}},insufficient_access:{type:"object",required:["required_operations","granted_operations","missing_operations"],properties:{required_operations:{type:"array",items:{type:"string"}},granted_operations:{type:"array",items:{type:"string"}},missing_operations:{type:"array",items:{type:"string"}}}},invalid_application_manifest:{type:"object",required:["issues"],properties:{issues:{type:"array",items:{type:"object",required:["path","keyword","message","params"],properties:{path:{type:"string"},keyword:{type:"string"},message:{type:"string"},params:{type:"object"}}}}}},mutation_request_conflict:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},operation_invalid:{type:"object",required:["diagnostics"],properties:{diagnostics:{type:"array",items:{type:"object"}},partial_result:{}}},operation_outcome_unknown:{type:"object",required:["request_id"],properties:{request_id:{type:"string"}}},rate_limited:{type:"object",required:[],properties:{retry_after_ms:{type:"integer"}}},transport_protocol_incompatible:{type:"object",required:["contract","required","supported","peer"],properties:{contract:{type:"string"},required:{type:"array",items:{type:"integer"}},supported:{type:"array",items:{type:"integer"}},peer:{type:"string"},operation:{type:"string"}}}};function Zn(t){return Object.hasOwn(me,t)}function Je(t){if(!eo(t))return!1;let e=t;if(e.problem_version!==1||typeof e.message!="string"||e.message.length===0||e.operation_outcome!==void 0&&e.operation_outcome!=="not_sent"&&e.operation_outcome!=="rejected"&&e.operation_outcome!=="unknown"||e.trace_id!==void 0&&(typeof e.trace_id!="string"||e.trace_id.length===0))return!1;if(e.code==="unknown")return typeof e.server_code=="string"&&e.server_code.length>0&&e.category==="unknown"&&e.recovery==="none";if(typeof e.code!="string"||!Zn(e.code)||e.server_code!==void 0)return!1;let n=me[e.code],o=Ur[e.code],i=o===void 0?e.details===void 0:e.details===void 0?(o.required?.length??0)===0:ln(e.details,o);return e.category===n.category&&e.recovery===n.recovery&&i}function ln(t,e){if(e.type===void 0)return!0;if(e.type==="string")return typeof t=="string";if(e.type==="integer")return typeof t=="number"&&Number.isInteger(t);if(e.type==="number")return typeof t=="number"&&Number.isFinite(t);if(e.type==="boolean")return typeof t=="boolean";if(e.type==="array")return Array.isArray(t)&&t.every(o=>ln(o,e.items??{}));if(!eo(t))return!1;if(!e.properties)return!0;let n=t;return!Object.keys(n).every(o=>Object.hasOwn(e.properties,o))||!(e.required??[]).every(o=>Object.hasOwn(n,o))?!1:Object.entries(n).every(([o,i])=>ln(i,e.properties[o]))}function eo(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function dn(t,e,n={}){if(Zn(t)){let o=me[t],i={problem_version:1,code:t,category:o.category,recovery:o.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}};if(Je(i))return i}return{problem_version:1,code:"unknown",server_code:t,category:"unknown",recovery:"none",message:e,...n.details===void 0?{}:{details:n.details},...n.operation_outcome===void 0?{}:{operation_outcome:n.operation_outcome},...n.trace_id===void 0?{}:{trace_id:n.trace_id}}}var to=new Uint8Array([77,68,66,70]),no=1,oo=0,Ys=new Uint8Array([77,68,66,82]);var io=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,k=class extends Error{code;constructor(e,n){super(n),this.code=e,this.name="FileFrameError"}};function Lr(t){return t==="upload_chunk"?1:2}function Nr(t){if(t===1)return"upload_chunk";if(t===2)return"download_chunk";throw new k("invalid_kind",`Unknown file frame kind ${t}`)}function Br(t){if(!t||typeof t!="object"||Array.isArray(t))throw new k("invalid_header","File frame header must be a JSON object");return t}function yt(t,e){let n=t[e];if(typeof n!="string"||n.length===0)throw new k("invalid_header",`File frame header ${e} must be a non-empty string`);return n}function ht(t,e){let n=yt(t,e);if(!io.test(n))throw new k("invalid_header",`File frame header ${e} must be a UUID`);return n}function ge(t,e,n=Number.MAX_SAFE_INTEGER){let o=t[e];if(!Number.isSafeInteger(o)||o<0||o>n)throw new k("invalid_header",`File frame header ${e} is outside its allowed range`);return o}function un(t){if(t.protocol_version!==1)throw new k("unsupported_version",`Unsupported file transfer protocol ${t.protocol_version}`);if(t.protection!=="grant_aead_v1"&&t.protection!=="transport_tls")throw new k("invalid_header","Unknown file transfer protection");if(t.direction!=="upload"&&t.direction!=="download")throw new k("invalid_header","Unknown file transfer direction");for(let[e,n]of[["grant_id",t.grant_id],["authority_id",t.authority_id],["collection_id",t.collection_id],["transfer_id",t.transfer_id]])if(!io.test(n))throw new k("invalid_header",`File frame header ${e} must be a UUID`);for(let[e,n,o]of[["chunk_size",t.chunk_size,4194304],["chunk_index",t.chunk_index,Number.MAX_SAFE_INTEGER],["offset",t.offset,Number.MAX_SAFE_INTEGER],["plaintext_length",t.plaintext_length,4194304],["total_size",t.total_size,Number.MAX_SAFE_INTEGER]])if(!Number.isSafeInteger(n)||n<0||n>o)throw new k("invalid_header",`File frame header ${e} is outside its allowed range`);if(t.chunk_size<64*1024)throw new k("invalid_header","File frame chunk_size is below the protocol minimum");if(!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<1)throw new k("invalid_header","File frame header scope_epoch must be a positive integer");if(t.protection==="grant_aead_v1"&&!t.key_id)throw new k("invalid_header","AEAD-protected file frames require key_id");return{protocol_version:1,protection:t.protection,grant_id:t.grant_id,authority_id:t.authority_id,collection_id:t.collection_id,transfer_id:t.transfer_id,direction:t.direction,chunk_size:t.chunk_size,chunk_index:t.chunk_index,offset:t.offset,plaintext_length:t.plaintext_length,total_size:t.total_size,scope_epoch:t.scope_epoch,...t.key_id===void 0?{}:{key_id:t.key_id}}}function jr(t){let e;try{e=new TextDecoder("utf-8",{fatal:!0}).decode(t)}catch{throw new k("invalid_header","File frame header is not valid UTF-8")}let n;try{n=Br(JSON.parse(e))}catch(l){throw l instanceof k?l:new k("invalid_header","File frame header is not valid JSON")}let o=new Set(["protocol_version","protection","grant_id","authority_id","collection_id","transfer_id","direction","chunk_size","chunk_index","offset","plaintext_length","total_size","scope_epoch","key_id"]);if(Object.keys(n).some(l=>!o.has(l)))throw new k("invalid_header","File frame header contains an unknown field");let i=ge(n,"protocol_version");if(i!==1)throw new k("unsupported_version",`Unsupported file transfer protocol ${i}`);let r=yt(n,"protection"),a=yt(n,"direction"),s=n.key_id===void 0?void 0:yt(n,"key_id"),c=un({protocol_version:1,protection:r,grant_id:ht(n,"grant_id"),authority_id:ht(n,"authority_id"),collection_id:ht(n,"collection_id"),transfer_id:ht(n,"transfer_id"),direction:a,chunk_size:ge(n,"chunk_size",4194304),chunk_index:ge(n,"chunk_index"),offset:ge(n,"offset"),plaintext_length:ge(n,"plaintext_length",4194304),total_size:ge(n,"total_size"),scope_epoch:ge(n,"scope_epoch"),...s===void 0?{}:{key_id:s}});if(JSON.stringify(c)!==e)throw new k("invalid_header","File frame header must use the canonical field order without duplicate fields or whitespace");return c}function pn(t,e,n){let o=t==="upload_chunk"?"upload":"download";if(e.direction!==o)throw new k("invalid_header",`Frame kind ${t} requires direction ${o}`);let i=e.chunk_index*e.chunk_size;if(!Number.isSafeInteger(i)||e.offset!==i)throw new k("invalid_header","Chunk offset does not match its index and protocol chunk size");if(e.offset+e.plaintext_length>e.total_size)throw new k("invalid_header","Chunk extends past the declared transfer size");let r=e.protection==="grant_aead_v1"?e.plaintext_length+16:e.plaintext_length;if(n!==r)throw new k("invalid_length","Payload length does not match the protected plaintext length")}function Kr(t){return t.plaintext_length+(t.protection==="grant_aead_v1"?16:0)}function mt(t,e){let n=un(e),o=Kr(n);pn(t,n,o);let i=new TextEncoder().encode(JSON.stringify(n));if(i.byteLength>16384)throw new k("limit_exceeded","File frame header exceeds the protocol limit");let r=new Uint8Array(16+i.byteLength);r.set(to,0);let a=new DataView(r.buffer,r.byteOffset,r.byteLength);return a.setUint8(4,no),a.setUint8(5,Lr(t)),a.setUint16(6,oo,!1),a.setUint32(8,i.byteLength,!1),a.setUint32(12,o,!1),r.set(i,16),r}function ro(t){let e=un(t.header);if(pn(t.kind,e,t.payload.byteLength),t.payload.byteLength>4194320)throw new k("limit_exceeded","File frame payload exceeds the protocol limit");let n=mt(t.kind,e),o=new Uint8Array(n.byteLength+t.payload.byteLength);return o.set(n,0),o.set(t.payload,n.byteLength),o}function gt(t,e={}){if(t.byteLength<16)throw new k("invalid_length","File frame is shorter than its fixed prefix");if(!to.every((f,h)=>t[h]===f))throw new k("invalid_magic","File frame magic is not MDBF");let n=new DataView(t.buffer,t.byteOffset,t.byteLength),o=n.getUint8(4);if(o!==no)throw new k("unsupported_version",`Unsupported file frame version ${o}`);let i=Nr(n.getUint8(5));if(n.getUint16(6,!1)!==oo)throw new k("unsupported_flags","File frame uses unsupported flags");let r=n.getUint32(8,!1),a=n.getUint32(12,!1),s=e.maxHeaderBytes??16384,c=e.maxPayloadBytes??4194320;if(r===0)throw new k("invalid_length","File frame header must not be empty");if(r>s||a>c)throw new k("limit_exceeded","File frame exceeds the configured decode limits");let l=16+r+a;if(!Number.isSafeInteger(l)||l!==t.byteLength)throw new k("invalid_length","File frame lengths do not match the supplied bytes");let u=16+r,p=jr(t.subarray(16,u));return pn(i,p,a),{kind:i,header:p,payload:t.slice(u)}}var Vr=["describe","changes","read","query","list_views","execute_view","read_view_source","create_view_source","update_view_source","delete_view_source","validate","create","update","delete","rename","read_type","create_type","update_type","assess_type_pack","apply_type_pack","assess_collection_setup","apply_collection_setup","list_timers","put_timer","cancel_timer","reconcile_timers","sync"],Gr=["list_files","open_file_upload","open_file_download","move_file","delete_file","get_file_transfer_status","commit_file_upload","abort_file_transfer"],Hr={describe:"never",changes:"never",read:"never",query:"never",list_views:"never",execute_view:"never",read_view_source:"never",create_view_source:"always",update_view_source:"always",delete_view_source:"always",validate:"never",create:"always",update:"always",delete:"always",rename:"always",read_type:"never",create_type:"always",update_type:"always",assess_type_pack:"never",apply_type_pack:"always",assess_collection_setup:"never",apply_collection_setup:"always",list_timers:"never",put_timer:"always",cancel_timer:"always",reconcile_timers:"always",sync:"sync_action"},$r={describe:1,changes:1,read:1,query:1,list_views:1,execute_view:1,read_view_source:1,create_view_source:1,update_view_source:1,delete_view_source:1,validate:1,create:1,update:1,delete:1,rename:1,read_type:1,create_type:1,update_type:1,assess_type_pack:1,apply_type_pack:1,assess_collection_setup:1,apply_collection_setup:1,list_timers:1,put_timer:1,cancel_timer:1,reconcile_timers:1,sync:1},Wr={list_files:1,open_file_upload:1,open_file_download:1,move_file:1,delete_file:1,get_file_transfer_status:1,commit_file_upload:1,abort_file_transfer:1},Jr=new Set(["open_file_upload","move_file","delete_file","commit_file_upload","abort_file_transfer"]),Qr=new Set(["delete","rename"]);var Yr=new Set(Vr),Xr=new Set(Gr);function ao(t){return Yr.has(t)}function Zr(t){return Xr.has(t)}function so(t,e){if(t==="file_control"){let n=co(e)&&typeof e.type=="string"?e.type:"";if(!Zr(n))throw new Error(`Unknown file-control message: ${n}`);return Wr[n]}return $r[t]}function ce(t,e){let n=co(e)?e:{};if(n.dry_run===!0&&Qr.has(t))return null;if(t==="file_control"){let i=typeof n.type=="string"?n.type:"";return Jr.has(i)?`file_control:${i}`:null}let o=Hr[t];return o==="always"?t:o==="sync_action"&&n.action==="mutate"?"sync:mutate":null}function le(t,e){return ce(t,e)!==null}function co(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var ea=1,ta="mdbase-connect mutation fingerprint v1\0",fn=new TextEncoder;function na(t){return hn(t,new Set)}function oa(t,e){let n=ce(t,e);if(n===null)throw new TypeError("The operation is not a canonical mutation.");let o=fn.encode(n),i=fn.encode(na(e)),r=fn.encode(ta),a=new Uint8Array(r.length+4+8+o.length+4+8+i.length),s=new DataView(a.buffer),c=0;return a.set(r,c),c+=r.length,s.setUint32(c,ea,!1),c+=4,c=uo(a,s,c,o),s.setUint32(c,so(t,e),!1),c+=4,uo(a,s,c,i),a}async function po(t,e){let n=new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256",oa(t,e).buffer));return ia(n)}function hn(t,e){if(t===null)return"null";if(t===!0)return"true";if(t===!1)return"false";if(typeof t=="string")return lo(t),JSON.stringify(t);if(typeof t=="number"){if(!Number.isFinite(t))throw new TypeError("Mutation input numbers must be finite.");return JSON.stringify(t)}if(typeof t!="object")throw new TypeError(`Mutation input contains unsupported ${typeof t}.`);if(e.has(t))throw new TypeError("Mutation input must not contain cycles.");e.add(t);try{if(Array.isArray(t)){if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let i=[];for(let r=0;r<t.length;r+=1){if(!Object.hasOwn(t,r))throw new TypeError("Mutation input arrays must not be sparse.");i.push(hn(t[r],e))}return`[${i.join(",")}]`}let n=Object.getPrototypeOf(t);if(n!==Object.prototype&&n!==null)throw new TypeError("Mutation input objects must be plain JSON objects.");if(Object.getOwnPropertySymbols(t).length>0)throw new TypeError("Mutation input must not contain symbol properties.");let o=Object.entries(t);for(let[i]of o)lo(i);return o.sort(([i],[r])=>i<r?-1:i>r?1:0),`{${o.map(([i,r])=>{let a=Object.getOwnPropertyDescriptor(t,i);if(!a||a.get||a.set)throw new TypeError("Mutation input must not contain accessor properties.");return`${JSON.stringify(i)}:${hn(r,e)}`}).join(",")}}`}finally{e.delete(t)}}function lo(t){for(let e=0;e<t.length;e+=1){let n=t.charCodeAt(e);if(n>=55296&&n<=56319){let o=t.charCodeAt(e+1);if(!(o>=56320&&o<=57343))throw new TypeError("Mutation input strings must not contain lone surrogates.");e+=1}else if(n>=56320&&n<=57343)throw new TypeError("Mutation input strings must not contain lone surrogates.")}}function uo(t,e,n,o){return e.setBigUint64(n,BigInt(o.length),!1),n+=8,t.set(o,n),n+o.length}function ia(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}var H=3,ra=2,fo=[H,ra],Y=5,yn=4,ho=[Y,yn],aa=1,sa=1,oc={operation_transport:[...fo],authorization_binding:[...ho],semantic_capabilities:[aa],durable_mutation:[sa]};function mn(t,e,n=[]){let o={operation_transport:H,authorization_binding:Y,semantic_capabilities:1},i=[...new Set(n)].filter(r=>r!==H).sort((r,a)=>a-r);return i.length>0&&(o.operation_transport_recovery=i),(t.some(r=>le(r,{action:"mutate"}))||e?.actions.some(r=>r!=="list"&&r!=="read")===!0)&&(o.durable_mutation=1),o}function Qe(t){return fo.includes(t)}function yo(t){return ho.includes(t)}var mo={"collection.inspect":["describe"],"records.watch":["changes"],"records.read":["read"],"records.query":["query"],"records.validate":["validate"],"records.create":["create"],"records.update":["update"],"records.delete":["delete"],"records.rename":["rename"],"views.list":["list_views"],"views.execute":["execute_view"],"views.source.read":["read_view_source"],"views.source.create":["create_view_source"],"views.source.update":["update_view_source"],"views.source.delete":["delete_view_source"],"definitions.contracts.current":[],"definitions.read":["read_type"],"definitions.create":["create_type"],"definitions.update":["update_type"],"definitions.type-pack.inspect":["assess_type_pack"],"definitions.type-pack.apply":["assess_type_pack","apply_type_pack"],"collection.setup.apply":["assess_collection_setup","apply_collection_setup"],"timers.list":["list_timers"],"timers.put":["put_timer"],"timers.cancel":["cancel_timer"],"timers.reconcile":["reconcile_timers"],"sync.offline-replica":["sync"],"notifications.background-delivery":[],"files.list":[],"files.read":[],"files.add":[],"files.replace":[],"files.move":[],"files.delete":[]};function _t(t,e={}){let n=e.includeOptional===!1?t.required:[...t.required,...t.optional??[]];return[...new Set(n.flatMap(o=>mo[o]))]}function bt(t){return[...mo[t]]}var ca=new TextEncoder().encode("mdbase-connect application installation id v2\0"),la=new TextEncoder().encode("mdbase-connect application authorization proof v4\0"),da=new TextEncoder().encode("mdbase-connect application authorization proof v5\0");async function _o(t){let e=Ct(t),o=new Uint8Array(await crypto.subtle.digest("SHA-256",_e([ca,N(e)]))).slice(0,16);return o[6]=o[6]&15|128,o[8]=o[8]&63|128,[Ye(o.slice(0,4)),Ye(o.slice(4,6)),Ye(o.slice(6,8)),Ye(o.slice(8,10)),Ye(o.slice(10,16))].join("-")}function bo(t){let e=[Ct(t.installation_signing_public_key),Ct(t.grant_agreement_public_key),Ct(t.grant_signing_public_key)];if(e.some((c,l)=>e.slice(l+1).some(u=>ma(c,u))))throw new Error("Application authorization keys must be distinct.");let n=gn(t.authorization_nonce),o=gn(t.code_challenge),i=t.contracts,r=i.operation_transport_recovery??[],a=t.requested_operations.some(c=>le(c,{action:"mutate"}))||t.requested_files?.actions.some(c=>!["list","read"].includes(c))===!0;if(!yo(t.protocol_version)||n.byteLength!==32||!/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)+$/u.test(t.application_declaration_id)||!/^[0-9a-f]{64}$/u.test(t.application_manifest_digest)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.issued_at)||!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/u.test(t.expires_at)||o.byteLength!==32||![i.operation_transport,i.authorization_binding,i.semantic_capabilities,i.durable_mutation??1].every(c=>Number.isInteger(c)&&c>0)||i.authorization_binding!==t.protocol_version||!Qe(i.operation_transport)||t.protocol_version===Y&&i.operation_transport!==H||r.some(c=>!Qe(c)||c===i.operation_transport)||new Set(r).size!==r.length||t.protocol_version===yn&&r.length>0||r.length>0&&!a||(a?i.durable_mutation!==1:i.durable_mutation!==void 0)||t.requested_operations.length===0&&t.requested_files===void 0||new Set(t.requested_operations).size!==t.requested_operations.length||t.requested_operations.some(c=>!c||c.includes("\0"))||(t.flow==="authorization_code"?t.redirect_uri===void 0||t.state===void 0:t.flow!=="device_code"||t.redirect_uri!==void 0||t.state!==void 0))throw new Error("Application authorization binding is invalid.");pa(t.requested_files);let s=t.requested_operations.map(c=>N(new TextEncoder().encode(c)));return _e([t.protocol_version===Y?da:la,W(t.protocol_version),N(vt(t.application_id)),N(vt(t.authorization_id)),N(new TextEncoder().encode(t.application_declaration_id)),N(Co(t.application_manifest_digest)),N(vt(t.application_installation_id)),...e.map(N),N(new TextEncoder().encode(t.flow)),N(n),N(new TextEncoder().encode(t.issued_at)),N(new TextEncoder().encode(t.expires_at)),go(t.redirect_uri),go(t.state),N(new TextEncoder().encode(t.code_challenge)),W(i.operation_transport),...t.protocol_version===Y?[W(r.length),...r.map(W)]:[],W(i.authorization_binding),W(i.semantic_capabilities),ua(i.durable_mutation),W(s.length),...s,fa(t.requested_files),ha(t.collection_id)])}function ua(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),W(t)])}function pa(t){if(t!==void 0&&(t.actions.length===0||new Set(t.actions).size!==t.actions.length||t.scope.kind==="selected_folders"&&(t.scope.folders.length===0||new Set(t.scope.folders).size!==t.scope.folders.length||t.scope.folders.some(e=>!e||e.includes("\0")))))throw new Error("Application authorization file request is invalid.")}function fa(t){if(t===void 0)return new Uint8Array(1);let e=t.actions.map(n=>N(new TextEncoder().encode(n)));return _e([new Uint8Array([1]),W(e.length),...e,N(new TextEncoder().encode(t.scope.kind)),...t.scope.kind==="selected_folders"?[W(t.scope.folders.length),...t.scope.folders.map(n=>N(new TextEncoder().encode(n)))]:[]])}function go(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),N(new TextEncoder().encode(t))])}function ha(t){return t===void 0?new Uint8Array(1):_e([new Uint8Array([1]),N(vt(t))])}function Ct(t){let e=gn(t);if(e.byteLength!==65||e[0]!==4)throw new Error("Application authorization public key is invalid.");return e}function gn(t){if(!/^[A-Za-z0-9_-]+$/u.test(t))throw new Error("Invalid base64url value.");let e=t.replaceAll("-","+").replaceAll("_","/"),n=e.padEnd(Math.ceil(e.length/4)*4,"="),o=Uint8Array.from(atob(n),i=>i.charCodeAt(0));if(ya(o)!==t)throw new Error("Non-canonical base64url value.");return o}function vt(t){if(!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(t))throw new Error("Invalid UUID value.");let e=t.replaceAll("-","");return Co(e)}function Co(t){if(!/^[0-9a-f]+$/u.test(t)||t.length%2!==0)throw new Error("Invalid hexadecimal value.");return Uint8Array.from({length:t.length/2},(e,n)=>Number.parseInt(t.slice(n*2,n*2+2),16))}function N(t){return _e([W(t.byteLength),t])}function W(t){let e=new Uint8Array(4);return new DataView(e.buffer).setUint32(0,t,!1),e}function _e(t){let e=new Uint8Array(t.reduce((o,i)=>o+i.byteLength,0)),n=0;for(let o of t)e.set(o,n),n+=o.byteLength;return e}function ya(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function ma(t,e){return t.byteLength===e.byteLength&&t.every((n,o)=>n===e[o])}function Ye(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}var vo={id:"mdbase.record.created",version:"1.0.0",digest:"sha256:7f3bed6baa356ee9389e977ae7b77a102e2bee871a7c1d9f2026fc21cacdbfc9"};var wo={id:"mdbase.runtime.timer.fired",version:"1.0.0",digest:"sha256:41105be7a7abf33b31ced47e1e1965242236e40ccaea286b959b0a8c591f5642"};var So=28485,Xe="P256-HKDF-SHA256-AES256GCM",wt=1;var ga="contract-setup-v1",_a="file-relay-v1",ba="protocol-usage-report-v1",Ca="policy-freshness-lease-v1",va=["application-authorization-v4","authorization-activation","encrypted-relay","policy-ack"];var wa=["durable-mutation-journal-v1","durable-file-lifecycle-v1"],Sa="candidate-b-activation-v1",dc=[...wa,"mutation-replay-after-credential-retirement-v1",Sa],uc=[...va,Ca,"application-authorization-v5",ga,_a,ba],_n=1;var Ro="mdbase-authority-request-proof-v1",Ze={version:"x-mdbase-proof-version",timestamp:"x-mdbase-proof-timestamp",nonce:"x-mdbase-proof-nonce",signature:"x-mdbase-proof-signature"};function St(t,e,n){let o=new Set(t.required),i=[...new Set([...t.required,...t.optional??[]])],r={};for(let a of i)r[a]=Ra(a,o.has(a),e,n);return{contractVersion:1,values:r,requiredAvailable:t.required.every(a=>r[a]?.state==="available")}}function Ra(t,e,n,o){let i=bt(t),r=i.filter(s=>!o.operations.includes(s)),a={id:t,requirement:e?"required":"optional",operations:i,missingOperations:r,evidence:[{source:"application",fact:`${e?"Required":"Optional"} in capability contract v1.`}]};if(r.length>0)return{...a,state:"requires_authorization",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${r.join(", ")}.`}],reason:"The current grant does not include every operation for this capability."};if(t==="definitions.contracts.current"&&o.scope.access!=="full_collection"){let s=new Set(o.scope.contracts.map(({id:l,version:u,digest:p})=>`${l}@${u}:${p}`)),c=(n.requirements?.contracts??[]).filter(({id:l,version:u,digest:p})=>!s.has(`${l}@${u}:${p}`));if(c.length>0)return{...a,state:"requires_authorization",reason:"The current grant does not approve the exact required contract definitions.",evidence:[...a.evidence,{source:"authorization",fact:`Missing ${c.map(({id:l,version:u})=>`${l}@${u}`).join(", ")}.`}],details:{missingContracts:c}}}if(t.startsWith("files.")){let s=t.slice(6);if(!o.fileCapability?.actions.includes(s))return{...a,state:o.fileCapability?"requires_authorization":"unsupported",reason:o.fileCapability?`The current file grant does not include ${s}.`:"This connection has no file capability.",evidence:[...a.evidence,{source:"authorization",fact:o.fileCapability?`Granted file actions: ${o.fileCapability.actions.join(", ")}.`:"No file capability was granted."}]}}return t==="notifications.background-delivery"&&(n.notifications?.criteria.length??0)===0?{...a,state:"requires_setup",reason:"The application manifest declares no notification criteria.",evidence:[...a.evidence,{source:"application",fact:"No authority notification criteria are declared."}]}:{...a,state:"available",evidence:[...a.evidence,{source:"authorization",fact:i.length>0?`Granted operations: ${i.join(", ")}.`:"No record operation is required."},{source:"authority",fact:o.authority.kind==="hosted"?"Backed by a durable hosted mdbase authority.":"Backed by a user-operated mdbase connector."}],...t==="sync.offline-replica"?{details:{durability:"device",writes:"queued",authority:o.authority.kind}}:{},...t==="notifications.background-delivery"?{details:{delivery:"authority",payload:"opaque"}}:{}}}var _=class extends Error{constructor(n,o={}){super(n.message,o.cause===void 0?void 0:{cause:o.cause});this.problem=n;this.name="MdbaseConnectError",this.code=n.code,this.status=o.status}problem;code;status;get retryable(){return this.problem.recovery==="retry"&&this.problem.operation_outcome!=="unknown"}get requiresAuthorization(){return this.problem.category==="authorization"}get outcomeUnknown(){return this.problem.operation_outcome==="unknown"}get recovery(){return this.problem.recovery}get details(){return this.problem.details}};function w(t,e,...[n={}]){let o=me[t];return{problem_version:1,code:t,category:o.category,recovery:o.recovery,message:e,...n.details===void 0?{}:{details:n.details},...n.operationOutcome===void 0?{}:{operation_outcome:n.operationOutcome},...n.traceId===void 0?{}:{trace_id:n.traceId}}}function Po(t,e,n={}){return dn(t,e,{details:n.details,operation_outcome:n.operationOutcome,trace_id:n.traceId})}function d(t,e,...n){let o=n[0];return new _(w(t,e,...n),{status:o?.status,cause:o?.cause})}function F(t,e,n={}){let{status:o,cause:i,...r}=n;return new _(dn(t,e,{details:r.details,operation_outcome:r.operationOutcome,trace_id:r.traceId}),{status:o,cause:i})}function Ae(t){let e=Aa(t.diagnostics),n=ka(t.diagnostics);if(e==="collection_version_unsupported"){let o=Oa(t.diagnostics);return w(e,n,{operationOutcome:"rejected",details:o})}return e!=="operation_invalid"?w(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics}}):w(e,n,{operationOutcome:"rejected",details:{diagnostics:t.diagnostics,partial_result:t.result}})}function Aa(t){let e=new Set(t.filter(n=>n.severity==="error").map(n=>n.code));return["migration_required","migration_lossy","unsupported_version"].some(n=>e.has(n))?"collection_version_unsupported":["invalid_config","invalid_configuration","missing_config","missing_spec_version"].some(n=>e.has(n))?"collection_configuration_invalid":["duplicate_type","invalid_contract_definition","invalid_data_contract","invalid_type_definition","invalid_type_path"].some(n=>e.has(n))?"collection_type_registry_invalid":["collection_invalid","collection_open_failed"].some(n=>e.has(n))?"collection_invalid":"operation_invalid"}function Oa(t){let e=t.map(n=>n.details).find(n=>Ta(n));return{current_version:typeof e?.current_version=="string"?e.current_version:"0.2.x",required_version:typeof e?.required_version=="string"?e.required_version:"0.3.0"}}function Ta(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}function Ao(t){return t instanceof _&&t.retryable}function ka(t){return t.filter(e=>e.severity==="error").map(e=>e.message).join(" ")||t.map(e=>e.message).join(" ")||"The collection rejected this operation."}var Ia=["access_denied","access_paused","application_declaration_mismatch","authorization_binding_incompatible","authorization_expired","capability_contract_incompatible","collection_access_denied","connector_identity_changed","connector_offline","connector_upgrade_required","direct_operation_rejected","durable_mutation_unsupported","operation_outcome_unknown","encryption_required","encrypted_relay_rejected","hosted_provider_unavailable","insufficient_access","invalid_encrypted_response","invalid_operation_response","invalid_request","missing_grant_key","mutation_recovery_expired","mutation_request_conflict","not_authorized","operation_cancelled","operation_failed","rate_limited","relay_authorization_expired","relay_unavailable","temporarily_unavailable","timeout","transport_protocol_incompatible","unsupported_operation"],Oo=Object.keys(me),be=["discovery_failed","invalid_operation_response","invalid_application_manifest","invalid_request","manifest_load_failed","rate_limited","temporarily_unavailable","timeout"],Oe=[...be,"access_denied","application_declaration_mismatch","application_identity_unavailable","approval_window_blocked","authorization_binding_incompatible","authorization_cancelled","authorization_replayed","browser_required","capability_contract_incompatible","collection_access_denied","collection_configuration_invalid","collection_contracts_missing","collection_incompatible","collection_invalid","collection_kind_unsupported","collection_mismatch","collection_not_found","collection_type_registry_invalid","collection_version_unsupported","connector_identity_changed","connector_offline","connector_upgrade_required","device_authorization_failed","durable_mutation_unsupported","encryption_required","expired_token","invalid_application_authorization","invalid_callback","invalid_device_authorization_response","invalid_token_response","scope_denied","reconnect_required","token_exchange_failed","transport_protocol_incompatible"],et=[...be,"authorization_expired","invalid_operation_response","invalid_push_subscription","managed_fcm_not_declared","not_authorized","notification_criterion_not_declared","notification_reauthorization_required","notification_registration_failed","notification_unregistration_failed","notifications_not_declared","notifications_unavailable"],bn=["connector_offline","connector_upgrade_required","invalid_operation_response","not_authorized","operation_failed","temporarily_unavailable","timeout"],kc=[...Oe,"collection_not_ready","collection_not_selected","operation_cancelled","session_destroyed","session_not_started","session_starting","unknown_collection"],Ma=["collection_configuration_invalid","collection_invalid","collection_type_registry_invalid","collection_version_unsupported"],Rt=[...Ia,...Ma],te=[...Rt,"invalid_path","operation_invalid"],Cn=[...te,"cursor_capacity_exhausted","generation_expired","invalid_read_cursor","query_snapshot_changed","sandbox_unsupported"],B=[...te,"concurrent_modification","invalid_preflight","pending_mutation_unresolved"],Pt=[...Rt,"change_cursor_reset"],de=[...B,"type_pack_provision_failed"];function I(t,e=[]){return{ok:!0,value:t,diagnostics:e}}function g(t){return{ok:!1,problem:t}}async function z(t,e){try{return I(await t())}catch(n){if(!(n instanceof _))throw n;let o=n.problem;return o.code==="unknown"||e.includes(o.code)?g(o):g(Po(o.code,o.message,{details:o.details,operationOutcome:o.operation_outcome,traceId:o.trace_id}))}}var Te=3e4,vn=1e4,xa=10*6e4,Ea=12e4,qa=6e4;function ke(t={}){return{requestMs:tt(t.requestMs,Te,"requestMs"),watchStartMs:tt(t.watchStartMs,vn,"watchStartMs"),fileIndexMs:tt(t.fileIndexMs,xa,"fileIndexMs"),uploadMs:tt(t.uploadMs,Ea,"uploadMs"),syncMs:tt(t.syncMs,qa,"syncMs")}}function nt(t,e){return{...t,signal:e.signal,...e.deadline===null?{}:{deadlineUnixMs:e.deadline}}}function ue(t={},e=Te,n=Date.now){let o=t.timeoutMs===void 0?e:t.timeoutMs,i=o===null?null:Da(o),r=new AbortController,a=i===null?null:n()+i,s=()=>r.abort(t.signal?.reason);t.signal?.aborted?s():t.signal?.addEventListener("abort",s,{once:!0});let c=i===null?void 0:setTimeout(()=>r.abort(d("timeout","The operation exceeded its request deadline.",{operationOutcome:"not_sent"})),i),l=!1;return{signal:r.signal,deadline:a,remainingMs:()=>a===null?null:Math.max(0,a-n()),dispose:()=>{l||(l=!0,c!==void 0&&clearTimeout(c),t.signal?.removeEventListener("abort",s))}}}async function U(t,e,n){let o=ue(t,e),i,r=new Promise((s,c)=>{i=c}),a=()=>i?.($(o.signal));o.signal.addEventListener("abort",a,{once:!0});try{if(o.signal.aborted)throw $(o.signal);return await Promise.race([n(o),r])}finally{o.signal.removeEventListener("abort",a),o.dispose()}}async function j(t,e,n){let o=ue(t,e);try{if(o.signal.aborted)throw $(o.signal);return await n(o)}finally{o.dispose()}}function $(t){return t.reason instanceof _?t.reason:d("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function Da(t){if(!Number.isSafeInteger(t)||t<=0)throw new TypeError("timeoutMs must be a positive safe integer or null.");return t}function tt(t,e,n){if(t===void 0)return e;if(t===null)return null;if(!Number.isSafeInteger(t)||t<=0)throw new TypeError(`${n} must be a positive safe integer or null.`);return t}var Fa="mdbase-connect-keys",pe="grant-keys",Sn=18446744073709551615n,za="mdbase-connect relay request key v1",Ua="mdbase-connect relay response key v1",To=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,Ie=class{database=null;async create(e){let n=await Mo(e),o=await this.open();return await Io(o,i=>i.add({...n,counter:"0"})),n}async get(e){let n=await this.open(),o=await ja(n.transaction(pe).objectStore(pe).get(e));return o?{handle:o.handle,agreementPrivateKey:o.agreementPrivateKey,agreementPublicKey:o.agreementPublicKey,signingPrivateKey:o.signingPrivateKey,signingPublicKey:o.signingPublicKey}:null}async nextCounter(e){let n=await this.open();return new Promise((o,i)=>{let r=n.transaction(pe,"readwrite"),a=r.objectStore(pe),s=a.get(e),c=null;s.onerror=()=>i(s.error),s.onsuccess=()=>{let l=s.result;if(!l){r.abort(),i(new x("missing_grant_key","The encrypted grant key is unavailable."));return}let u=BigInt(l.counter)+1n;if(u>Sn){r.abort(),i(new x("counter_exhausted","The encrypted grant must be authorized again."));return}c=u.toString(),a.put({...l,counter:c})},r.onerror=()=>i(r.error),r.onabort=()=>i(r.error??new Error("Key counter transaction aborted.")),r.oncomplete=()=>{c&&o(c)}})}async delete(e){let n=await this.open();await Io(n,o=>o.delete(e))}open(){if(typeof indexedDB>"u")throw new x("key_storage_unavailable","Encrypted relay authorization requires browser IndexedDB or an injected grant key store.");return this.database||(this.database=new Promise((e,n)=>{let o=indexedDB.open(Fa,1);o.onupgradeneeded=()=>{o.result.objectStoreNames.contains(pe)||o.result.createObjectStore(pe,{keyPath:"handle"})},o.onerror=()=>n(o.error),o.onsuccess=()=>e(o.result)})),this.database}},Me=class{records=new Map;sequence=Promise.resolve();async create(e){if(this.records.has(e))throw new Error(`Grant key already exists: ${e}`);let n=await Mo(e);return this.records.set(e,{...n,counter:"0"}),n}async get(e){let n=this.records.get(e);return n?{handle:n.handle,agreementPrivateKey:n.agreementPrivateKey,agreementPublicKey:n.agreementPublicKey,signingPrivateKey:n.signingPrivateKey,signingPublicKey:n.signingPublicKey}:null}nextCounter(e){let n,o,i=new Promise((r,a)=>{n=r,o=a});return this.sequence=this.sequence.then(()=>{let r=this.records.get(e);if(!r)throw new x("missing_grant_key","The encrypted grant key is unavailable.");let a=BigInt(r.counter)+1n;if(a>Sn)throw new x("counter_exhausted","The encrypted grant must be authorized again.");r.counter=a.toString(),n(r.counter)}).catch(r=>{o(r)}),i}async delete(e){this.records.delete(e)}};async function At(t,e,n,o){let i=await La(t,e,n),r=o.timestamp??Math.floor(Date.now()/1e3),a=o.nonce??crypto.randomUUID(),s=await Rn({...o,timestamp:r,nonce:a}),c=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},i.signingPrivateKey,new TextEncoder().encode(s));return{[Ze.version]:String(_n),[Ze.timestamp]:String(r),[Ze.nonce]:a,[Ze.signature]:ot(new Uint8Array(c))}}async function Rn(t){let e=t.method.toUpperCase(),n=await ko(t.body??""),o=await ko(t.credential);for(let i of[e,t.target,String(t.timestamp),t.nonce])if(!i||i.includes(`
|
|
2
2
|
`)||i.includes("\r"))throw new x("invalid_proof_input","Authority request proof metadata is invalid.");return[Ro,_n,e,t.target,n,o,t.timestamp,t.nonce].join(`
|
|
3
3
|
`)}async function ne(t,e,n,o,i,r=crypto.randomUUID(),a){if(oe(n.encryption),a!==void 0&&(!Number.isSafeInteger(a)||a<=0))throw new x("invalid_deadline","The operation deadline is invalid.");let s=await xo(t,e,n.encryption.application_agreement_public_key),c=await t.nextCounter(e),l={binding:n,protocolVersion:H,requestId:r,operation:o,counter:c},u=await Eo(s.agreementPrivateKey,n,l.protocolVersion,"request"),p=new TextEncoder().encode(JSON.stringify(i??{})),f=await crypto.subtle.encrypt({name:"AES-GCM",iv:Fo(c),additionalData:new TextEncoder().encode(Do(l,"request")),tagLength:128},u,p);return{type:"encrypted_operation_request",...Na(l),...a===void 0?{}:{deadline_unix_ms:a},ciphertext:ot(new Uint8Array(f))}}async function xe(t,e,n,o,i){if(!Ba(o,i))throw new x("invalid_encrypted_response","Encrypted response metadata does not match its request.");let r=await xo(t,e,n.encryption.application_agreement_public_key),a={binding:n,protocolVersion:o.protocol_version,requestId:o.request_id,operation:o.operation,counter:o.counter},s=await Eo(r.agreementPrivateKey,n,o.protocol_version,"response");try{let c=await crypto.subtle.decrypt({name:"AES-GCM",iv:Fo(o.counter),additionalData:new TextEncoder().encode(Do(a,"response")),tagLength:128},s,Uo(zo(i.ciphertext))),l=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c));if(l?.ok===!0&&"result"in l||l?.ok===!1&&Je(l.problem))return l;throw new Error("invalid response body")}catch(c){throw c instanceof x?c:new x("encrypted_response_rejected","The encrypted connector response could not be authenticated.")}}var x=class extends Error{constructor(n,o){super(o);this.code=n}code};async function Mo(t){let e=await crypto.subtle.generateKey({name:"ECDH",namedCurve:"P-256"},!0,["deriveBits"]),n=ot(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),o=await crypto.subtle.exportKey("pkcs8",e.privateKey),i=await crypto.subtle.importKey("pkcs8",o,{name:"ECDH",namedCurve:"P-256"},!1,["deriveBits"]),r=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),a=ot(new Uint8Array(await crypto.subtle.exportKey("raw",r.publicKey))),s=await crypto.subtle.exportKey("pkcs8",r.privateKey),c=await crypto.subtle.importKey("pkcs8",s,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,agreementPrivateKey:i,agreementPublicKey:n,signingPrivateKey:c,signingPublicKey:a}}async function xo(t,e,n){let o=await t.get(e);if(!o||o.agreementPublicKey!==n)throw new x("missing_grant_key","The encrypted grant key is unavailable or does not match the grant.");return o}async function La(t,e,n){let o=await t.get(e);if(!o||o.signingPublicKey!==n)throw new x("missing_grant_key","The remote authority signing key is unavailable or does not match the grant.");return o}async function Eo(t,e,n,o){let i=await it(t,e.encryption.connector_agreement_public_key),r=await crypto.subtle.importKey("raw",i,"HKDF",!1,["deriveKey"]),a=new TextEncoder().encode(qo(e,n)),s=await crypto.subtle.digest("SHA-256",a);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:s,info:new TextEncoder().encode(o==="request"?za:Ua)},r,{name:"AES-GCM",length:256},!1,o==="request"?["encrypt"]:["decrypt"])}async function it(t,e){try{let n=await crypto.subtle.importKey("raw",Uo(wn(e)),{name:"ECDH",namedCurve:"P-256"},!1,[]);return await crypto.subtle.deriveBits({name:"ECDH",public:n},t,256)}catch{throw new x("invalid_public_key","The connector relay public key is invalid.")}}function qo(t,e){let n=t.encryption;return["mdbase-connect",e,n.suite,t.grantId,t.applicationId,n.connector_id,n.collection_id,n.scope_epoch,n.key_id].join("|")}function Do(t,e){return[qo(t.binding,t.protocolVersion),t.requestId,e,t.operation,t.counter].join("|")}function Na(t){let e=t.binding.encryption;return{protocol_version:t.protocolVersion,suite:Xe,request_id:t.requestId,grant_id:t.binding.grantId,application_id:t.binding.applicationId,connector_id:e.connector_id,collection_id:e.collection_id,operation:t.operation,scope_epoch:e.scope_epoch,key_id:e.key_id,counter:t.counter}}function Ba(t,e){return e.type==="encrypted_operation_response"&&typeof e.ciphertext=="string"&&t.protocol_version===e.protocol_version&&t.suite===e.suite&&t.request_id===e.request_id&&t.grant_id===e.grant_id&&t.application_id===e.application_id&&t.connector_id===e.connector_id&&t.collection_id===e.collection_id&&t.operation===e.operation&&t.scope_epoch===e.scope_epoch&&t.key_id===e.key_id&&t.counter===e.counter}function oe(t){if(t.protocol_version!==wt||t.suite!==Xe||!Number.isSafeInteger(t.scope_epoch)||t.scope_epoch<=0||typeof t.key_id!="string"||t.key_id.length===0||t.key_id.length>200||t.key_id.includes("|"))throw new x("unsupported_encryption","The grant uses an unsupported relay encryption profile.");if(typeof t.connector_id!="string"||!To.test(t.connector_id)||typeof t.collection_id!="string"||!To.test(t.collection_id))throw new x("unsupported_encryption","The grant uses invalid encrypted relay identities.");wn(t.application_agreement_public_key),wn(t.connector_agreement_public_key)}function Fo(t){let e=BigInt(t);if(e<=0n||e>Sn||e.toString()!==t)throw new x("invalid_counter","The encrypted relay counter is invalid.");let n=new Uint8Array(new ArrayBuffer(12));return new DataView(n.buffer).setBigUint64(4,e,!1),n}function ot(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}async function ko(t){let e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return ot(new Uint8Array(e))}function zo(t){if(!/^[A-Za-z0-9_-]+$/.test(t))throw new x("invalid_base64","Encrypted relay data is malformed.");let e="=".repeat((4-t.length%4)%4),n=atob(t.replaceAll("-","+").replaceAll("_","/")+e);return Uint8Array.from(n,o=>o.charCodeAt(0))}function wn(t){let e=zo(t);if(e.length!==65||e[0]!==4)throw new x("invalid_public_key","Encrypted relay public keys must be uncompressed P-256 points.");return e}function Uo(t){return Uint8Array.from(t).buffer}function ja(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function Io(t,e){return new Promise((n,o)=>{let i=t.transaction(pe,"readwrite"),r=e(i.objectStore(pe));r.onerror=()=>o(r.error),i.onerror=()=>o(i.error),i.onabort=()=>o(i.error??new Error("Grant key transaction aborted.")),i.oncomplete=()=>n()})}function fe(t){return{...t,credentials:"omit",targetAddressSpace:"loopback"}}async function rt(){if(typeof navigator>"u"||!navigator.permissions?.query)return null;try{return(await navigator.permissions.query({name:"local-network-access"})).state}catch{return null}}function Ee(t){return t===404||t===405||t===426||t>=500}function Lo(t,e){return le(t,e)}function No(t,e){if(t.deadline_unix_ms===e)return t;let{deadline_unix_ms:n,...o}=t;return{...o,...e===void 0?{}:{deadline_unix_ms:e}}}function X(t){return[...new Set(t)]}function Bo(t,e){return t.grantId||e.grantId?t.grantId===e.grantId&&t.keyHandle===e.keyHandle&&t.encryption?.key_id===e.encryption?.key_id:t.accessToken===e.accessToken}function Ce(t){if(t?.aborted)throw d("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t.reason})}function Ot(t,e,n,o){return t instanceof _?t:e?.aborted?n?V(n,t):e.reason instanceof _?e.reason:d("operation_cancelled","The operation was cancelled before it changed the collection.",{operationOutcome:"not_sent",cause:t}):n?V(n,t):t instanceof TypeError?d(o,o==="hosted_provider_unavailable"?"The hosted collection provider is unavailable.":"The Connect relay is unavailable.",{cause:t}):t instanceof Error?t:new Error(String(t))}function jo(t){return F(t.code==="unknown"?t.server_code:t.code,t.message,{details:t.details,operationOutcome:t.operation_outcome??"rejected",traceId:t.trace_id})}function Ko(t,e,n,o,i){return fetch(t,{method:"POST",headers:{authorization:`Bearer ${e}`,"content-type":"application/json",...n},body:o,signal:i})}function An(t,e){return e?.aborted===!0||t instanceof _&&t.code==="operation_cancelled"}function Vo(t,e){if(e.dryRun!==!0||e.wouldRename!==!0||e.from!==t.from||e.to!==t.to)throw d("invalid_preflight","The rename preview does not match this mutation. Run the preview again.")}function Go(t,e){if(e.dryRun!==!0||e.wouldDelete!==!0||e.path!==t.path)throw d("invalid_preflight","The delete preview does not match this mutation. Run the preview again.")}function Ho(t,e){if(t.updateRefs===!1)return{affectedRecords:0,totalUnits:1,warnings:0};let n=e.referencesAffected??[];return{affectedRecords:new Set(n.map(o=>o.path)).size,totalUnits:1+n.length,warnings:e.warnings?.length??0}}function $o(t){return{affectedRecords:new Set((t.brokenLinks??[]).map(e=>e.path)).size,totalUnits:1,warnings:0}}async function Wo(t,e){return po(t,e??{})}function Jo(t){return JSON.stringify(Pn(t))}function Pn(t){return Array.isArray(t)?t.map(e=>Pn(e)):t&&typeof t=="object"?Object.fromEntries(Object.entries(t).filter(([,e])=>e!==void 0).sort(([e],[n])=>e<n?-1:e>n?1:0).map(([e,n])=>[e,Pn(n)])):t}function V(t,e){return d("operation_outcome_unknown","The write may have completed, but mdbase could not recover its authoritative result. Retry the exact same write to recover safely.",{operationOutcome:"unknown",details:{request_id:t},cause:e})}function J(t){let e=new Uint8Array(t);return crypto.getRandomValues(e),On(e)}function On(t){let e="";for(let n of t)e+=String.fromCharCode(n);return btoa(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function Qo(t){let e=t.replaceAll("-","+").replaceAll("_","/").padEnd(Math.ceil(t.length/4)*4,"="),n=atob(e),o=new Uint8Array(new ArrayBuffer(n.length));for(let i=0;i<n.length;i+=1)o[i]=n.charCodeAt(i);return o}async function ie(t,e,n,o){try{return await fetch(t,e)}catch(i){throw d(n,o,{cause:i})}}async function E(t,e,n){let o;try{o=await t.text()}catch(i){throw F(e,n,{status:t.status,cause:i})}if(o.trim()==="")throw F(e,n,{status:t.status});try{return JSON.parse(o)}catch(i){throw F(e,n,{status:t.status,cause:i})}}function Yo(t){let e=new URL(t);if(e.protocol!=="http:"||!["127.0.0.1","[::1]"].includes(e.hostname)||e.username||e.password||e.pathname!=="/"||e.search||e.hash)throw d("invalid_loopback_url","loopbackUrl must be an HTTP origin on 127.0.0.1 or ::1.");return e.origin}async function at(){let t=J(32),e=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t));return{verifier:t,challenge:On(new Uint8Array(e))}}function D(t,e,n,o){return F(st(t)??t?.error?.code??e,t?.error_description??t?.error?.message??n,{status:o,details:t?.error?.details,operationOutcome:t?.error?.operation_outcome,traceId:t?.error?.trace_id})}function st(t){return typeof t?.error=="string"?t.error:void 0}function ct(t,e){if(!t||typeof t!="object"||Array.isArray(t)||typeof e!="string")return!1;let n=t;if(typeof n.operations_url!="string"||typeof n.sync_url!="string"||typeof n.files_url!="string"||typeof n.replica_id!="string"||n.replica_id.length===0||typeof n.access_token!="string"||n.access_token.length===0||n.proof_public_key!==void 0&&(typeof n.proof_public_key!="string"||n.proof_public_key.length===0))return!1;try{let o=new URL(n.operations_url),i=new URL(n.sync_url),r=new URL(n.files_url);return[o,i,r].every(a=>(a.protocol==="https:"||a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))&&!a.username&&!a.password&&!a.search&&!a.hash)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/operations$/i.test(o.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/sync$/i.test(i.pathname)&&/^\/v1\/authorities\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/files$/i.test(r.pathname)&&o.origin===i.origin&&o.origin===r.origin&&o.pathname.split("/")[3]===e&&i.pathname.split("/")[3]===e&&r.pathname.split("/")[3]===e}catch{return!1}}function Xo(t,e){return ct({operations_url:t?.operationsUrl,sync_url:t?.syncUrl,files_url:t?.filesUrl,replica_id:t?.replicaId,access_token:t?.accessToken,proof_public_key:t?.proofPublicKey},e)}function Tt(t){if(!t||typeof t!="object"||Array.isArray(t))return!1;let e=t,n=e.actions;if(e.kind!=="files"||e.protocol_version!==1||!Array.isArray(n)||n.length===0||n.length>6||new Set(n).size!==n.length||n.some(i=>!["list","read","add","replace","move","delete"].includes(i)))return!1;let o=e.scope;return!o||typeof o!="object"||Array.isArray(o)?!1:o.kind==="collection"?Object.keys(o).length===1:o.kind==="selected_folders"&&Object.keys(o).length===2&&Array.isArray(o.folders)&&o.folders.length>0&&o.folders.length<=100&&new Set(o.folders).size===o.folders.length&&o.folders.every(i=>typeof i=="string"&&i.length>0&&i.length<=1024&&Ka(i))}function Ka(t){let e=new Set([".mdbase",".git","node_modules","_contracts","_schemas","_types","_views"]);return!t.startsWith("/")&&!t.endsWith("/")&&!t.includes("\\")&&t.split("/").every(n=>{let o=n.split(".")[0]?.toUpperCase()??"";return n!==""&&n!=="."&&n!==".."&&!n.startsWith(".")&&!n.endsWith(" ")&&!n.endsWith(".")&&!/[<>:"|?*]/.test(n)&&!e.has(n.toLowerCase())&&!["CON","PRN","AUX","NUL"].includes(o)&&!/^(COM|LPT)[1-9]$/.test(o)})}function Zo(t,e){if(!t||typeof t!="object"||Array.isArray(t)||t.collection_id!==e)return!1;try{return oe(t),!0}catch{return!1}}function ei(t){if(typeof t?.device_code!="string"||typeof t?.user_code!="string"||typeof t?.verification_uri!="string"||typeof t?.verification_uri_complete!="string"||!Number.isFinite(t?.expires_in)||!Number.isFinite(t?.interval))throw d("invalid_device_authorization_response","Connect returned an invalid downloaded application authorization response.");return{userCode:t.user_code,verificationUri:t.verification_uri,verificationUriComplete:t.verification_uri_complete,expiresAt:Date.now()+Math.max(1,t.expires_in)*1e3,intervalSeconds:Math.max(1,t.interval)}}function M(t){if(!t)return null;try{return JSON.parse(t)}catch{return null}}function kt(t){if(!t||typeof t!="object"||Array.isArray(t))return null;let e=t;return e.access!=="contract"&&e.access!=="full_collection"||!Array.isArray(e.contracts)||e.contracts.some(n=>!n||typeof n!="object"||n.contract_type!=="record"||typeof n.id!="string"||typeof n.version!="string"||!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(n.version)||!/^sha256:[0-9a-f]{64}$/.test(n.digest)||!n.schema||typeof n.schema!="object"||Array.isArray(n.schema)||!Array.isArray(n.implementations)||n.implementations.some(o=>!o||typeof o!="object"||typeof o.type_name!="string"||!Number.isInteger(o.type_version)||!/^sha256:[0-9a-f]{64}$/.test(o.digest)||!o.fields||typeof o.fields!="object"||Array.isArray(o.fields)||Object.values(o.fields).some(i=>typeof i!="string")))?null:e}function ti(t){return t.endsWith("/")?t.slice(0,-1):t}function ni(){if(typeof location>"u")throw d("manifest_required","manifest is required outside a browser environment.");if(location.origin==="null")throw d("manifest_required","Downloaded applications must provide their v1 portable manifest inline.");return new URL("/.well-known/mdbase-app.json",location.origin).href}function oi(){if(typeof location>"u")throw d("redirect_uri_required","redirectUri is required outside a browser environment.");return location.href.split(/[?#]/)[0]}function ii(t,e,n,o){if(typeof t!="string"&&t.distribution==="portable"||o)return"null";let i=new URL(n);if(["http:","https:"].includes(i.protocol))return i.origin;if(typeof location<"u")return location.origin;if(typeof t!="string")return new URL(t.homepage).origin;try{return new URL(e).origin}catch{return""}}function ri(t){let e=":token:",n=t.lastIndexOf(e);return n<0?"":t.slice(n+e.length)}function It(){if(typeof location>"u")throw d("callback_url_required","callbackUrl is required outside a browser environment.");return location.href}function ai(t){if(t)return new qe;if(typeof localStorage>"u")throw d("storage_required","storage is required outside a browser environment.");try{let e=`mdbase-connect:probe:${J(8)}`;return localStorage.setItem(e,"1"),localStorage.removeItem(e),localStorage}catch{return new qe}}var qe=class{values=new Map;get length(){return this.values.size}clear(){this.values.clear()}getItem(e){return this.values.get(e)??null}key(e){return[...this.values.keys()][e]??null}removeItem(e){this.values.delete(e)}setItem(e,n){this.values.set(String(e),String(n))}};function si(t){return typeof t=="string"||t.distribution!=="portable"?!1:typeof location>"u"||location.origin==="null"||!["http:","https:"].includes(location.protocol)}function ci(t){let e=Jo(t),n=2166136261,o=2654435769;for(let i=0;i<e.length;i+=1){let r=e.charCodeAt(i);n=Math.imul(n^r,16777619),o=Math.imul(o^r,2246822507)}return`${(n>>>0).toString(16).padStart(8,"0")}${(o>>>0).toString(16).padStart(8,"0")}`}function lt(t){for(let e of["code","state","error","error_description"])t.searchParams.delete(e);return t}function Mt(t){let e;try{e=new URL(t)}catch{return!1}return e.searchParams.has("state")&&(e.searchParams.has("code")||e.searchParams.has("error"))}function xt(t){try{let e=new URL(t).searchParams.get("state");return e&&e.length>0?e:null}catch{return null}}function li(t){if(!t.details||typeof t.details!="object"||Array.isArray(t.details))return;let e=t.details.return_to;return typeof e=="string"?e:void 0}var ve=["describe","changes","read","query"];var De=class{constructor(e,n){this.connect=e;this.operations=X(n.operations??ve),this.selection=n.selection,this.autoSelect=n.autoSelect??"only",this.snapshot={status:"not_started",connections:[]}}connect;operations;selection;autoSelect;listeners=new Set;snapshot;snapshotKey="";stopConnections;stopSelection;stopActiveConnection;activeCollectionId=null;unavailableReason="not_authorized";started=!1;destroyed=!1;refreshing=!1;refreshQueued=!1;transactionDepth=0;lifecycleGeneration=0;operationControllers=new Set;startOperation=null;callbackCompletions=new Map;start(e){if(this.destroyed)return Promise.resolve(g(w("session_destroyed","This session has been destroyed.")));if(this.started&&!this.startOperation)return Promise.resolve(I(this.snapshot));let n=this.startOperation??this.beginStart();return this.waitForStart(n,e)}beginStart(){let e=new AbortController,n=++this.lifecycleGeneration;this.publish({status:"starting",connections:this.connect.connections()});let o={promise:this.performStart({signal:e.signal,timeoutMs:null},n),controller:e,waiters:0,generation:n};this.startOperation=o;let i=()=>{this.startOperation===o&&(this.startOperation=null)};return o.promise.then(i,i),o}async waitForStart(e,n){e.waiters+=1;try{return await U(n,vn,()=>e.promise)}catch(o){if(o instanceof _)return g(o.problem);throw o}finally{e.waiters-=1,e.waiters===0&&this.startOperation===e&&(e.controller.abort(),this.startOperation=null,this.lifecycleGeneration+=1,this.stopLifecycleSubscriptions(),this.started=!1,this.publish({status:"not_started",connections:this.connect.connections()}))}}async performStart(e,n){try{this.started=!0,this.stopConnections=this.connect.onConnectionsChange(()=>this.refresh()),this.stopSelection=this.selection.subscribe(()=>{this.unavailableReason="not_authorized",this.refresh()});let o=this.selection.authorizationCallback();if(o){let i=await this.completeAuthorizationCallback(o,e);if(!i.ok)return n===this.lifecycleGeneration&&!this.destroyed&&(this.stopLifecycleSubscriptions(),this.started=!1,this.publish({status:"start_failed",problem:i.problem,connections:this.connect.connections()})),i}else this.autoSelectOnlyConnection();return n!==this.lifecycleGeneration||this.destroyed?g(w("session_destroyed","This session has been destroyed.")):(this.publishCurrent(),I(this.snapshot))}catch(o){if(o instanceof _){let i=o.problem;return n===this.lifecycleGeneration&&!this.destroyed&&(this.stopLifecycleSubscriptions(),this.started=!1,this.publish({status:"start_failed",problem:i,connections:this.connect.connections()})),g(i)}throw n===this.lifecycleGeneration&&!this.destroyed&&(this.stopLifecycleSubscriptions(),this.started=!1,this.publish({status:"not_started",connections:this.connect.connections()})),o}}destroy(){if(!this.destroyed){this.lifecycleGeneration+=1,this.startOperation?.controller.abort(),this.startOperation=null;for(let e of this.operationControllers)e.abort();this.operationControllers.clear(),this.stopLifecycleSubscriptions(),this.started=!1,this.destroyed=!0,this.callbackCompletions.clear(),this.publish({status:"destroyed",connections:[]}),this.listeners.clear()}}stopLifecycleSubscriptions(){this.stopConnections?.(),this.stopSelection?.(),this.stopActiveConnection?.(),this.stopConnections=void 0,this.stopSelection=void 0,this.stopActiveConnection=void 0,this.activeCollectionId=null}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}select(e,n={}){let o=this.lifecycleProblem();if(o)return g(o);let i=this.connect.connection(e);return i?(this.unavailableReason="not_authorized",this.selection.select(e,n),this.refresh(),I(i)):g(w("unknown_collection","This collection is not authorized for this application."))}clearSelection(e={}){let n=this.lifecycleProblem();return n?g(n):(this.unavailableReason="not_authorized",this.selection.select(null,e),this.refresh(),I(void 0))}forget(e){let n=this.lifecycleProblem();if(n)return g(n);this.transactionDepth+=1;try{let o=this.selection.selectedCollectionId()===e;this.connect.connection(e)?.forget(),o&&this.selection.select(null,{history:"replace"})}finally{this.transactionDepth-=1,this.refresh()}return I(void 0)}async authorize(e,n={}){let o=this.lifecycleProblem();if(o)return g(o);let i=this.selection.selectedCollectionId();if(e==="selected"&&!i)return g(w("collection_not_selected","Choose a collection before updating its access."));let r=typeof e=="object"?e.collectionId:e==="selected"?i:null,a=this.beginLifecycleOperation(n);this.transactionDepth+=1;try{let s=await this.connect.authorize({...a.options,operations:this.operations,target:r===null?{kind:"choose"}:{kind:"collection",collectionId:r},returnTo:this.selection.authorizationReturnTo()});return this.lifecycleCurrent(a.generation)?(s.ok&&s.value.kind==="connected"&&this.selection.finishAuthorization(s.value.returnTo,s.value.connection.collectionId),s):this.destroyedOutcome(s)}finally{a.dispose(),this.transactionDepth-=1,this.refresh()}}async ensureOperations(e,n){let o=this.lifecycleProblem();if(o)return g(o);let i=this.snapshot;if(i.status!=="ready")return g(w("collection_not_ready","Choose an authorized collection first."));let r=X(e),a=i.connection.authorizationCapabilities(r);if(a.sufficient)return I({kind:"unchanged",connection:i.connection});let s=this.beginLifecycleOperation(n);this.transactionDepth+=1;try{let c=await this.connect.authorize({...s.options,operations:X([...a.grantedOperations,...a.missingOperations]),target:{kind:"collection",collectionId:i.collectionId},returnTo:this.selection.authorizationReturnTo()});return this.lifecycleCurrent(s.generation)?(c.ok&&c.value.kind==="connected"&&this.selection.finishAuthorization(c.value.returnTo,c.value.connection.collectionId),c):this.destroyedOutcome(c)}finally{s.dispose(),this.transactionDepth-=1,this.refresh()}}handleAuthorizationCallback(e,n){let o=this.lifecycleProblem();return o?Promise.resolve(g(o)):Mt(e)?this.completeAuthorizationCallback(e,n):Promise.resolve(g(w("invalid_callback","This URL is not an authorization callback.")))}completeAuthorizationCallback(e,n){if(n?.signal?.aborted){let r=$(n.signal);return Promise.resolve(g(r.problem))}let o=xt(e);if(!o)return Promise.resolve(g(w("invalid_callback","Authorization callback is missing its state.")));let i=this.callbackCompletions.get(o)??this.beginCallbackCompletion(e,o);return this.waitForCallbackCompletion(i,n)}beginCallbackCompletion(e,n){let o=new AbortController,i=this.lifecycleGeneration;this.transactionDepth+=1,this.operationControllers.add(o);let r={state:n,controller:o,waiters:0,settled:!1,abandoned:!1,promise:void 0},a=this.connect.completeAuthorization(e,{signal:o.signal,timeoutMs:null}).catch(s=>{if(s instanceof _)return g(s.problem);throw s});return r.promise=a.then(s=>{if(i!==this.lifecycleGeneration||this.destroyed)return this.destroyedOutcome(s);if(!s.ok){if(!r.abandoned&&s.problem.recovery!=="retry"){let l=li(s.problem);this.selection.clearAuthorizationCallback(l)}return this.refresh(),s}let c=s.value;return this.unavailableReason="not_authorized",this.selection.finishAuthorization(c.returnTo,c.connection.collectionId),this.refresh(),I(c.connection,s.diagnostics)}).catch(s=>{if(i!==this.lifecycleGeneration||this.destroyed)return g(w("session_destroyed","This session was destroyed before authorization completion finished."));throw r.abandoned||(this.selection.clearAuthorizationCallback(),this.refresh()),s}).finally(()=>{r.settled=!0,this.operationControllers.delete(o),this.transactionDepth-=1,this.refresh(),this.callbackCompletions.get(n)===r&&this.callbackCompletions.delete(n)}),this.callbackCompletions.set(n,r),r}async waitForCallbackCompletion(e,n){e.waiters+=1;try{return await U(n,Te,()=>e.promise)}catch(o){if(o instanceof _)return g(o.problem);throw o}finally{e.waiters-=1,e.waiters===0&&!e.settled&&this.callbackCompletions.get(e.state)===e&&(e.abandoned=!0,this.callbackCompletions.delete(e.state),e.controller.abort())}}lifecycleProblem(){return this.destroyed?w("session_destroyed","This session has been destroyed."):this.snapshot.status==="starting"?w("session_starting","The session is still starting."):this.snapshot.status==="start_failed"?this.snapshot.problem:this.started?null:w("session_not_started","Start the session before using it.")}beginLifecycleOperation(e={}){let n=new AbortController,o=()=>n.abort(e.signal?.reason);return e.signal?.aborted?o():e.signal?.addEventListener("abort",o,{once:!0}),this.operationControllers.add(n),{generation:this.lifecycleGeneration,options:{...e,signal:n.signal},dispose:()=>{e.signal?.removeEventListener("abort",o),this.operationControllers.delete(n)}}}lifecycleCurrent(e){return!this.destroyed&&e===this.lifecycleGeneration}destroyedOutcome(e){return!e.ok&&e.problem.code==="operation_outcome_unknown"?e:g(w("session_destroyed","This session was destroyed before the operation finished."))}autoSelectOnlyConnection(){if(this.autoSelect!=="only"||this.selection.selectedCollectionId())return;let e=this.connect.connections();e.length===1&&this.selection.select(e[0].collectionId,{history:"replace"})}refresh(){if(!(!this.started||this.destroyed||this.snapshot.status==="starting"||this.snapshot.status==="start_failed")){if(this.transactionDepth>0){this.refreshQueued=!0;return}if(this.refreshing){this.refreshQueued=!0;return}this.refreshing=!0;try{do this.refreshQueued=!1,this.publishCurrent();while(this.refreshQueued)}finally{this.refreshing=!1}}}publishCurrent(){let e=this.selection.selectedCollectionId(),n=this.connect.connections(),o=e?this.connect.connection(e):null;o?.collectionId!==this.activeCollectionId&&(this.stopActiveConnection?.(),this.activeCollectionId=o?.collectionId??null,this.stopActiveConnection=o?.onConnectionChange(r=>{!r&&this.selection.selectedCollectionId()===o.collectionId&&(this.unavailableReason="authorization_lost"),this.refresh()}));let i;if(!e)i={status:"unselected",connections:n};else if(!o||!o.info())i={status:"unavailable",collectionId:e,reason:this.connect.unavailableReason(e)??this.unavailableReason,connections:n};else{let r=o.info();i={status:"ready",collectionId:e,connection:o,info:r,access:o.authorizationCapabilities(this.operations),connections:n}}this.publish(i)}publish(e){if(this.snapshot.status==="destroyed"&&e.status!=="destroyed")return;let n=Va(e);if(n!==this.snapshotKey){this.snapshot=e,this.snapshotKey=n;for(let o of this.listeners)o()}}};function Va(t){return t.status==="not_started"||t.status==="starting"||t.status==="destroyed"?JSON.stringify(t):t.status==="start_failed"?JSON.stringify({status:t.status,problem:t.problem,connections:t.connections}):t.status==="unselected"?JSON.stringify({status:t.status,connections:t.connections}):t.status==="unavailable"?JSON.stringify({status:t.status,collectionId:t.collectionId,reason:t.reason,connections:t.connections}):JSON.stringify({status:t.status,collectionId:t.collectionId,info:t.info,access:t.access,connections:t.connections})}var ut=class{values=new Map;read(e){return this.values.get(e)??null}write(e,n){this.values.set(e,n)}remove(e){this.values.delete(e)}},Fe=class{constructor(e,n,o=ke()){this.connect=e;this.options=n;this.timeouts=o;this.verificationStore=n.verificationStore??Xa()}connect;options;timeouts;listeners=new Set;verificationStore;snapshot={status:"not_started",connections:[]};manifest=null;application=null;base=null;stopBase;setupAssessment=null;setupTypePackAdoptions=null;verificationGeneration=0;lifecycleGeneration=0;operationControllers=new Set;startOperation=null;start(e){if(this.snapshot.status==="destroyed")return Promise.resolve(g(w("session_destroyed","This application session has been destroyed.")));if(this.base&&!this.startOperation)return Promise.resolve(I(this.snapshot));let n=this.startOperation??this.beginStart();return this.waitForStart(n,e,this.timeouts.watchStartMs)}async waitForStart(e,n,o){e.waiters+=1;try{return await U(n,o,()=>e.promise)}catch(i){if(i instanceof _)return g(i.problem);throw i}finally{e.waiters-=1,e.waiters===0&&this.startOperation===e&&this.abandonStart(e)}}abandonStart(e){e.controller.abort(),this.startOperation=null,this.lifecycleGeneration+=1,this.verificationGeneration+=1,this.base&&this.cleanupBase(this.base),this.application=null,this.manifest=null,this.setupAssessment=null,this.setupTypePackAdoptions=null,this.publish({status:"not_started",connections:this.connect.connections()})}beginStart(){this.publish({status:"starting",connections:this.connect.connections()});let e=new AbortController,n=++this.lifecycleGeneration,o={promise:this.startWithinBudget({signal:e.signal,timeoutMs:null},n),controller:e,waiters:0,generation:n};this.startOperation=o;let i=()=>{this.startOperation===o&&(this.startOperation=null)};return o.promise.then(i,i),o}async startWithinBudget(e,n){try{return await this.performStartWithinBudget(e,n)}catch(o){if(o instanceof _)return this.startFailure(o.problem,n);throw n===this.lifecycleGeneration&&(this.verificationGeneration+=1,this.base&&this.cleanupBase(this.base),this.application=null,this.manifest=null,this.setupAssessment=null,this.setupTypePackAdoptions=null,this.publish({status:"not_started",connections:this.connect.connections()})),o}}async performStartWithinBudget(e,n){let o=await this.connect.register(e);if(!o.ok)return this.startFailure(o.problem,n);let i=await this.connect.manifest(e);if(!i.ok)return this.startFailure(i.problem,n);let r=i.value.requirements?.capabilities;if(!r)return this.startFailure(w("invalid_application_manifest","Application sessions require a versioned semantic capability contract.",{details:{issues:[{path:"/requirements/capabilities",keyword:"required",message:"is required for application sessions",params:{}}]}}),n);if(n!==this.lifecycleGeneration||e.signal?.aborted)return g(w("operation_cancelled","Application session startup was cancelled.",{operationOutcome:"not_sent"}));this.application=o.value,this.manifest=i.value;let a=new De(this.connect,{selection:this.options.selection,autoSelect:this.options.autoSelect,operations:Ga(r)});this.base=a;try{let s=await a.start(e);return s.ok?n!==this.lifecycleGeneration||e.signal?.aborted?(this.cleanupBase(a),g(w("operation_cancelled","Application session startup was cancelled.",{operationOutcome:"not_sent"}))):(this.stopBase=a.subscribe(()=>{this.base===a&&this.refresh()}),await this.refresh(!0,e),n!==this.lifecycleGeneration||e.signal?.aborted?(this.cleanupBase(a),g(w("operation_cancelled","Application session startup was cancelled.",{operationOutcome:"not_sent"}))):I(this.snapshot)):(this.cleanupBase(a),this.startFailure(s.problem,n))}catch(s){throw this.cleanupBase(a),s}}startFailure(e,n){return n===this.lifecycleGeneration&&this.publish({status:"start_failed",problem:e,connections:this.connect.connections()}),g(e)}destroy(){if(this.snapshot.status!=="destroyed"){this.lifecycleGeneration+=1,this.verificationGeneration+=1,this.startOperation?.controller.abort(),this.startOperation=null;for(let e of this.operationControllers)e.abort();this.operationControllers.clear(),this.base&&this.cleanupBase(this.base),this.application=null,this.manifest=null,this.setupAssessment=null,this.setupTypePackAdoptions=null,this.publish({status:"destroyed",connections:[]}),this.listeners.clear()}}cleanupBase(e){this.base===e&&(this.stopBase?.(),this.stopBase=void 0,e.destroy(),this.base=null)}getSnapshot(){return this.snapshot}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}connection(){let e=this.base?.getSnapshot();return e?.status==="ready"?e.connection:null}select(e,n={}){let o=this.lifecycleBase();return o.ok?o.value.select(e,n):o}clearSelection(e={}){let n=this.lifecycleBase();return n.ok?(n.value.clearSelection(e),I(void 0)):n}forget(e){let n=this.lifecycleBase();return n.ok?(n.value.forget(e),I(void 0)):n}authorize(e,n={}){return this.withLifecycleBase(n,async(o,i,r)=>{let a=await o.authorize(e,{...n,...i});return a.ok&&a.value.kind==="connected"&&this.lifecycleCurrent(r)&&await this.refresh(!0,i),a})}handleAuthorizationCallback(e,n){let o=String(e),i=this.startOperation!==null&&this.options.selection.authorizationCallback()===o;return this.withLifecycleBase(n,async(r,a,s)=>{if(i){let l=r.getSnapshot();return l.status==="ready"?I(l.connection):g(w("collection_not_ready","Authorization did not produce a ready collection."))}let c=await r.handleAuthorizationCallback(o,a);return c.ok&&this.lifecycleCurrent(s)&&await this.refresh(!0,a),c})}completeAuthorization(e,n){let o=e===void 0?It():String(e),i=this.startOperation!==null&&this.options.selection.authorizationCallback()===o;return this.withLifecycleBase(n,async(r,a,s)=>{if(i){let l=r.getSnapshot();return l.status==="ready"?I(l.connection):g(w("collection_not_ready","Authorization did not produce a ready collection."))}let c=await r.handleAuthorizationCallback(o,a);return c.ok&&this.lifecycleCurrent(s)&&await this.refresh(!0,a),c})}ensureCapabilities(e,n){return this.withLifecycleBase(n,(o,i,r)=>{let a=this.manifest.requirements?.capabilities,s=new Set([...a?.required??[],...a?.optional??[]]);return e.some(c=>!s.has(c))?Promise.resolve(g(w("invalid_application_manifest","Applications may only request capabilities declared in their manifest.",{details:{issues:[{path:"/requirements/capabilities",keyword:"undeclaredCapability",message:"must declare every capability requested by the application",params:{requested:e,declared:[...s]}}]}}))):o.ensureOperations(Ha(e),i).then(async c=>(c.ok&&c.value.kind==="connected"&&this.lifecycleCurrent(r)&&await this.refresh(!0,i),c))})}applyCollectionSetup(e){return this.withLifecycleBase(e,(n,o,i)=>this.applyCollectionSetupStarted(o,i))}async applyCollectionSetupStarted(e,n){if(this.snapshot.status!=="setup_review_required"||!this.setupAssessment)return g(w("collection_not_ready","There is no reviewed collection setup to apply."));if(!this.setupAssessment.applicable)return g(w("collection_not_ready","Resolve the collection setup conflicts before applying this update."));let o=this.connection();if(!o)return g(w("collection_not_ready","The collection is not ready."));let i=this.setupAssessment,r={...this.collectionSetupInput(this.setupTypePackAdoptions??void 0),expectedAssessmentDigest:i.assessmentDigest,expectedCollectionRevision:i.collectionRevision,expectedProvisionDigest:i.provisionDigest,allowTypePackDowngrades:i.typePacks.filter(s=>s.status==="downgrade").map(s=>s.desired.id)},a=await o.applyCollectionSetup(r,e);return this.lifecycleCurrent(n)?a.ok?(this.setupAssessment=null,this.setupTypePackAdoptions=null,await this.verifySetup(this.context(o),++this.verificationGeneration,e),I(this.snapshot)):(a.problem.code==="application_declaration_mismatch"&&(this.setupAssessment=null,this.setupTypePackAdoptions=null,this.publish({status:"authorization_required",...this.context(o)})),a):!a.ok&&a.problem.code==="operation_outcome_unknown"?g(a.problem):g(w("session_destroyed",dt("session_destroyed")))}async refresh(e=!1,n){if(!this.base||!this.manifest)return;let o=this.base.getSnapshot();this.verificationGeneration+=1;let i=this.verificationGeneration;if(this.setupAssessment=null,this.setupTypePackAdoptions=null,o.status==="unselected"){this.publish({status:"unselected",connections:o.connections});return}if(o.status==="unavailable"){this.publish(o);return}if(o.status!=="ready")return;let r=this.context(o.connection);if(this.connect.connectionApplicationId(o.collectionId)!==this.application?.id){this.publish({status:"authorization_required",...r});return}if(!r.capabilities.requiredAvailable||!Qa(this.manifest,r.info)){this.publish({status:"authorization_required",...r});return}if(!(this.manifest.requirements?.capabilities?.required.includes("collection.setup.apply")??!1)){this.publish({status:"ready",verification:"verified",...r});return}let s=Tn(this.manifest,o.collectionId);this.verificationStore.read(s)===di(this.manifest)?this.publish({status:"ready",verification:"cached",...r}):this.publish({status:"checking_setup",...r});let c=this.verifySetup(r,i,n);e&&await c}async verifySetup(e,n,o){let i=this.connection(),r=this.requireManifest();if(!i||i.collectionId!==e.collectionId)return;let a=this.collectionSetupInput(),s=o?await i.assessCollectionSetup(a,o):await i.assessCollectionSetup(a);if(n===this.verificationGeneration){if(!s.ok){this.publish(s.problem.code==="application_declaration_mismatch"?{status:"authorization_required",...e}:{status:"blocked",problem:s.problem,...e});return}if(!s.value.applicable){let c=Ja(s.value);if(Object.keys(c).length>0){if(s=o?await i.assessCollectionSetup(this.collectionSetupInput(c),o):await i.assessCollectionSetup(this.collectionSetupInput(c)),n!==this.verificationGeneration)return;if(!s.ok){this.publish(s.problem.code==="application_declaration_mismatch"?{status:"authorization_required",...e}:{status:"blocked",problem:s.problem,...e});return}this.setupTypePackAdoptions=c}}if(n===this.verificationGeneration){if(s.value.status!=="current"){this.setupAssessment=s.value,this.verificationStore.remove(Tn(r,e.collectionId)),this.publish({status:"setup_review_required",update:Wa(s.value,r.provisions?.type_packs??[]),...e});return}this.verificationStore.write(Tn(r,e.collectionId),di(r)),this.publish({status:"ready",verification:"verified",...e})}}}collectionSetupInput(e){let n=this.requireManifest(),o=this.requireApplication();return{applicationId:Ya(o.family_identity),declarationDigest:`sha256:${o.manifest_digest}`,requirements:{configuration:n.requirements?.configuration??[]},provisions:{configuration:n.provisions?.configuration??[],typePacks:n.provisions?.type_packs??[]},...e?{typePackAdoptions:e}:{}}}context(e){let n=e.info();return{collectionId:e.collectionId,info:n,capabilities:St(this.requireManifest().requirements.capabilities,this.requireManifest(),n),connections:this.connect.connections()}}publish(e){if(!(this.snapshot.status==="destroyed"&&e.status!=="destroyed")&&JSON.stringify(this.snapshot)!==JSON.stringify(e)){this.snapshot=e;for(let n of this.listeners)n()}}lifecycleBase(){let e=this.snapshot.status;if(this.startOperation||e==="starting")return g(w("session_starting","The application session is still starting."));if(this.snapshot.status==="start_failed")return g(this.snapshot.problem);if(this.base)return I(this.base);let n=e==="destroyed"?"session_destroyed":"session_not_started";return g(w(n,dt(n)))}async withLifecycleBase(e,n){let o=this.beginLifecycleOperation(e),i=ue(o.options,this.timeouts.requestMs),r={signal:i.signal,timeoutMs:null};try{let a=this.startOperation;if(a){let l=await this.waitForStart(a,r,null);if(!l.ok)return l}if(!this.lifecycleCurrent(o.generation))return g(w("session_destroyed",dt("session_destroyed")));let s=this.lifecycleBase();if(!s.ok)return s;let c=await n(s.value,r,o.generation);return this.lifecycleCurrent(o.generation)?c:this.destroyedOutcome(c)}catch(a){if(a instanceof _)return this.lifecycleCurrent(o.generation)?g(a.problem):a.problem.code==="operation_outcome_unknown"?g(a.problem):g(w("session_destroyed",dt("session_destroyed")));throw a}finally{i.dispose(),o.dispose()}}beginLifecycleOperation(e={}){let n=new AbortController,o=()=>n.abort(e.signal?.reason);return e.signal?.aborted?o():e.signal?.addEventListener("abort",o,{once:!0}),this.operationControllers.add(n),{generation:this.lifecycleGeneration,options:{...e,signal:n.signal},dispose:()=>{e.signal?.removeEventListener("abort",o),this.operationControllers.delete(n)}}}lifecycleCurrent(e){return this.snapshot.status!=="destroyed"&&e===this.lifecycleGeneration}destroyedOutcome(e){return!e.ok&&e.problem.code==="operation_outcome_unknown"?e:g(w("session_destroyed",dt("session_destroyed")))}requireManifest(){if(!this.manifest)throw new Error("Start the application session before using it.");return this.manifest}requireApplication(){if(!this.application)throw new Error("Start the application session before using it.");return this.application}};function Ga(t){return _t(t)}function Ha(t){let e=t.flatMap(n=>bt(n));return[...new Set(e)]}function $a(t,e){let n=e.status==="conflict"?"Existing user-owned resources conflict with this application definition pack.":e.status==="install"?"This collection needs the application definitions installed.":`This collection has a ${e.status} definition change to review.`;return{id:e.desired.id,name:t.manifest.name??e.desired.id,status:e.status,applicable:e.applicable,assessmentDigest:e.assessmentDigest,...e.current?{currentVersion:e.current.version}:{},desiredVersion:e.desired.version,resources:e.resources,contractSetups:e.contractSetups,canApply:e.applicable,reason:n}}function Wa(t,e){let n=t.typePacks.map(r=>{let a=e.find(s=>s.manifest.id===r.desired.id);if(!a)throw new Error(`Collection setup returned undeclared type pack '${r.desired.id}'.`);return $a(a,r)}),o=t.configuration.filter(r=>r.action!=="current").length,i=t.status==="conflict"?"Existing collection policy conflicts with this application's required setup.":`This application requires ${o} configuration change${o===1?"":"s"} and ${n.length} definition update${n.length===1?"":"s"}.`;return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessmentDigest,collectionRevision:t.collectionRevision,provisionDigest:t.provisionDigest,configuration:t.configuration,typePacks:n,canApply:t.applicable,reason:i}}function Ja(t){let e={};for(let n of t.typePacks){let o=Object.fromEntries(n.resources.filter(i=>i.action==="conflict"&&i.mode==="managed"&&i.currentDigest!==void 0&&i.installedDigest===void 0).map(i=>[i.target,i.currentDigest]));Object.keys(o).length>0&&(e[n.desired.id]=o)}return e}function Tn(t,e){return`mdbase-application-session:v1:${t.id}:${e}`}function di(t){return JSON.stringify({capabilities:t.requirements?.capabilities,requirements:t.requirements?.configuration??[],provisions:t.provisions??{}})}function Qa(t,e){return t.requirements?.access!=="full_collection"||e.scope.access==="full_collection"}function Ya(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function dt(t){return t==="session_destroyed"?"This application session has been destroyed.":t==="session_starting"?"The application session is still starting.":"Start the application session before using it."}function Xa(){return typeof localStorage<"u"?{read:t=>localStorage.getItem(t),write:(t,e)=>localStorage.setItem(t,e),remove:t=>localStorage.removeItem(t)}:new ut}function Q(t,e){return new Promise((n,o)=>{if(e?.aborted){o(e?.reason??new DOMException("Aborted","AbortError"));return}let i=()=>e?.removeEventListener("abort",a),r=setTimeout(()=>{i(),n()},t),a=()=>{clearTimeout(r),i(),o(e?.reason??new DOMException("Aborted","AbortError"))};e?.addEventListener("abort",a,{once:!0})})}var Za="mdbase-connect-identities",ze="application-identities",kn=BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),es=kn/2n,Ue=class{database=null;async create(e){let n=await pi(e),o=await this.open();return await ui(o,i=>i.add(n)),n}async get(e){let n=await this.open();return await ts(n.transaction(ze).objectStore(ze).get(e))??null}async delete(e){let n=await this.open();await ui(n,o=>o.delete(e))}open(){if(typeof indexedDB>"u")throw new we("Persistent application identity requires browser IndexedDB or an injected identity store.");return this.database||(this.database=new Promise((e,n)=>{let o=indexedDB.open(Za,1);o.onupgradeneeded=()=>{o.result.objectStoreNames.contains(ze)||o.result.createObjectStore(ze,{keyPath:"handle"})},o.onerror=()=>n(o.error),o.onsuccess=()=>e(o.result)})),this.database}},Le=class{records=new Map;async create(e){if(this.records.has(e))throw new Error(`Application identity already exists: ${e}`);let n=await pi(e);return this.records.set(e,n),n}async get(e){return this.records.get(e)??null}async delete(e){this.records.delete(e)}},we=class extends Error{constructor(e){super(e),this.name="ApplicationIdentityStoreError"}};async function Ne(t){return _o(t.signingPublicKey)}async function pt(t,e){if(t.installation_signing_public_key!==e.signingPublicKey||t.application_installation_id!==await Ne(e))throw new Error("Application authorization identity does not match its binding.");let n=os(new Uint8Array(await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},e.signingPrivateKey,bo(t))));return{binding:t,signature:fi(n)}}async function Et(t,e,n){let o=`application-installation:v2:${e}:${n.id}`,i=await t.get(o);if(i)return i;try{return await t.create(o)}catch(r){let a=await t.get(o);if(a)return a;throw r}}async function pi(t){let e=await crypto.subtle.generateKey({name:"ECDSA",namedCurve:"P-256"},!0,["sign","verify"]),n=fi(new Uint8Array(await crypto.subtle.exportKey("raw",e.publicKey))),o=await crypto.subtle.exportKey("pkcs8",e.privateKey),i=await crypto.subtle.importKey("pkcs8",o,{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]);return{handle:t,signingPrivateKey:i,signingPublicKey:n}}function ts(t){return new Promise((e,n)=>{t.onerror=()=>n(t.error),t.onsuccess=()=>e(t.result)})}function ui(t,e){return new Promise((n,o)=>{let i=t.transaction(ze,"readwrite");e(i.objectStore(ze)).onerror=()=>o(i.error),i.onerror=()=>o(i.error),i.onabort=()=>o(i.error??new Error("Identity transaction aborted.")),i.oncomplete=()=>n()})}function ns(t){let e=new Uint8Array(t.reduce((o,i)=>o+i.byteLength,0)),n=0;for(let o of t)e.set(o,n),n+=o.byteLength;return e}function fi(t){return btoa(String.fromCharCode(...t)).replaceAll("+","-").replaceAll("/","_").replace(/=+$/u,"")}function os(t){if(t.byteLength!==64)throw new Error("Application authorization signature is invalid.");let e=is(t.slice(32));if(e===0n||e>=kn)throw new Error("Application authorization signature is invalid.");return e<=es?t:ns([t.slice(0,32),rs(kn-e,32)])}function is(t){return BigInt(`0x${as(t)}`)}function rs(t,e){let n=t.toString(16).padStart(e*2,"0");return Uint8Array.from({length:e},(o,i)=>Number.parseInt(n.slice(i*2,i*2+2),16))}function as(t){return[...t].map(e=>e.toString(16).padStart(2,"0")).join("")}async function*yi(t,e,n={},o={}){let{offset:i,limit:r,cursor:a,pagination:s,snapshot:c,...l}=n,u=ss(i,0),p=hi(o.firstPageSize??r,200),f=hi(o.pageSize??r,1e3),h=a,m=a!==void 0,b=a,C=c,y=0,S=0;try{for(;!o.signal?.aborted;){let v=h,R={signal:o.signal,timeoutMs:o.pageTimeoutMs,coordination:{...o.coordination,coalesce:!1}},T=S===0&&a===void 0&&s===void 0&&c===void 0,A=await t({...l,limit:S===0?p:f,...m?v?{cursor:v}:{pagination:"cursor"}:{offset:u,...C?{snapshot:C}:{},...!C&&s==="cursor"?{pagination:"cursor"}:{}},...!m&&!C&&T?{pagination:"cursor"}:{}},R);if(T&&!A.ok&&A.problem.code==="operation_invalid"&&(A=await t({...l,limit:p,offset:u},R)),!A.ok){yield A;return}let O=A.value,P=O.meta?.cursor;if(P?(m=!0,h=P,b=P):m&&(h=void 0,b=v),m&&O.meta?.hasMore&&!P){yield g(w("invalid_operation_response","The collection authority omitted the cursor required for the next query page."));return}let q=O.meta?.snapshot;if(!m&&C&&q&&C!==q){yield g(w("query_snapshot_changed","The collection query snapshot changed while paging. Refresh the query before continuing."));return}!m&&!C&&q&&(C=q),y+=O.results.length;let G=!O.meta?.hasMore||O.results.length===0,ee={results:O.results,...O.meta?{meta:O.meta}:{},page:S,offset:u,loaded:y,complete:G,...P?{cursor:P}:{},...!m&&C?{snapshot:C}:{}};if(o.onProgress?.(ee),yield I(ee,A.diagnostics),G)return;u+=O.results.length,S+=1}}finally{m&&b&&await e(b)}}function ss(t,e){return typeof t=="number"&&Number.isFinite(t)?Math.max(0,Math.floor(t)):e}function hi(t,e){return typeof t=="number"&&Number.isFinite(t)&&t>0?Math.floor(t):e}async function*gi(t,e,n,o={}){let{offset:i,limit:r,cursor:a,...s}=n,c=cs(i,0),l=mi(o.firstPageSize??r,200),u=mi(o.pageSize??r,1e3),p=a,f=a!==void 0,h=a,m=0,b=0;try{for(;!o.signal?.aborted;){let C=p,y=await t({...s,limit:b===0?l:u,...f&&C?{cursor:C}:{offset:c}},{signal:o.signal,timeoutMs:o.pageTimeoutMs,coordination:{...o.coordination,coalesce:!1}});if(!y.ok){yield y;return}let S=y.value,v=S.meta.cursor;if(v?(f=!0,p=v,h=v):f&&(p=void 0,h=C),f&&S.meta.hasMore&&!v){yield g(w("invalid_operation_response","The collection authority omitted the cursor required for the next saved-view page."));return}m+=S.results.length;let R=!S.meta.hasMore||S.results.length===0,T={...S,page:b,offset:c,loaded:m,complete:R,...v?{cursor:v}:{}};if(o.onProgress?.(T),yield I(T,y.diagnostics),R)return;c+=S.results.length,b+=1}}finally{f&&h&&await e(h)}}function cs(t,e){return typeof t=="number"&&Number.isFinite(t)?Math.max(0,Math.floor(t)):e}function mi(t,e){return typeof t=="number"&&Number.isFinite(t)&&t>0?Math.floor(t):e}function _i(t){if(t!==!1)return{initialDelayMs:Math.max(0,t?.initialDelayMs??500),maxDelayMs:Math.max(0,t?.maxDelayMs??15e3),multiplier:Math.max(1,t?.multiplier??2),...t?.maxAttempts===void 0?{}:{maxAttempts:Math.max(0,t.maxAttempts)}}}var Be=class{constructor(e,n=Te){this.transport=e;this.requestTimeoutMs=n}transport;requestTimeoutMs;operation(e,n,o){return z(()=>this.transport.operation(e,n,o),Oo)}async describe(e){let n=await this.rawOperation("describe",{},Rt,e);return L(n,Rs)}async changes(e={},n){let o=await this.rawOperation("changes",e,Pt,n);return L(o,Ss)}async read(e,n){let o=await this.envelopeOperation("read",ls(e),te,n);return L(o,qt)}async query(e={},n){let o=await this.envelopeOperation("query",ds(e),Cn,n);return L(o,({results:i,meta:r})=>({results:i.map(ki),...r?{meta:{...typeof r.total_count=="number"?{totalCount:r.total_count}:{},...r.total_count_outcome===void 0?{}:{totalCountOutcome:r.total_count_outcome},hasMore:r.has_more,...r.cursor?{cursor:r.cursor}:{},...r.snapshot?{snapshot:r.snapshot}:{}}}:{}}))}async*queryPages(e={},n={}){yield*yi((o,i)=>this.query(o,i),o=>this.releaseQueryCursor(o),e,n)}async queryAll(e={},n={}){let o=ue(n,this.requestTimeoutMs),i=[],r,a=[];try{for await(let s of this.queryPages(e,{firstPageSize:n.firstPageSize,pageSize:n.pageSize,signal:o.signal,pageTimeoutMs:null,coordination:n.coordination,onProgress:n.onProgress})){if(!s.ok)return s;let c=s.value;i.push(...c.results),r=c,a.push(...s.diagnostics)}if(o.signal.aborted)throw $(o.signal);return I({results:i,meta:{totalCount:r?.meta?.totalCount??i.length,hasMore:r?!r.complete:!1,...r?.snapshot?{snapshot:r.snapshot}:{}}},a)}catch(s){if(s instanceof _)return g(s.problem);throw s}finally{o.dispose()}}async listViews(e){let n=await this.envelopeOperation("list_views",{},te,e);return L(n,o=>({views:o.views,meta:{totalCount:o.meta.total_count}}))}async executeView(e,n){let o=await this.envelopeOperation("execute_view",e,te,n);return L(o,_s)}async*executeViewPages(e,n={}){yield*gi((o,i)=>this.executeView(o,i),o=>this.releaseQueryCursor(o),e,n)}readViewSource(e,n){return this.envelopeOperation("read_view_source",e,te,n)}createViewSource(e,n){return this.envelopeOperation("create_view_source",e,B,n)}updateViewSource(e,n){return this.envelopeOperation("update_view_source",In(e),B,n)}deleteViewSource(e,n){return this.envelopeOperation("delete_view_source",In(e),B,n)}async create(e,n){let o=await this.envelopeOperation("create",us(e),B,n);return L(o,qt)}async update(e,n){let o=await this.envelopeOperation("update",ps(e),B,n);return L(o,qt)}async delete(e,n){let o=await this.envelopeOperation("delete",bi(e),B,n);return L(o,Ai)}async preflightDelete(e,n){let o=await this.envelopeOperation("delete",{...bi(e),check_backlinks:!0,dry_run:!0},B,n);return L(o,ys)}async rename(e,n){let o=await this.envelopeOperation("rename",Ci(e),B,n);return L(o,ms)}async preflightRename(e,n){let o=await this.envelopeOperation("rename",{...Ci(e),dry_run:!0},B,n);return L(o,gs)}validate(e={},n){return this.envelopeOperation("validate",e,te,n)}readType(e,n){return this.envelopeOperation("read_type",e,de,n)}createType(e,n){return this.envelopeOperation("create_type",e,de,n)}updateType(e,n){return this.envelopeOperation("update_type",In(e),de,n)}async assessTypePack(e,n){let o=await this.envelopeOperation("assess_type_pack",Ri(e),de,n);return L(o,xn)}async applyTypePack(e,n){let o=await this.envelopeOperation("apply_type_pack",fs(e),de,n);return L(o,Cs)}async assessCollectionSetup(e,n){let o=await this.envelopeOperation("assess_collection_setup",Pi(e),de,n);return L(o,Si)}async applyCollectionSetup(e,n){let o=await this.envelopeOperation("apply_collection_setup",hs(e),de,n);return L(o,i=>({assessment:Si(i.assessment),receipt:vs(i.receipt)}))}async listTimers(e,n){let o=await this.rawOperation("list_timers",{namespace:e},te,n);return L(o,i=>({namespace:i.namespace,timers:i.timers.map(Mn)}))}async putTimer(e,n){let o=await this.rawOperation("put_timer",{namespace:e.namespace,criterion_id:e.criterionId,timer:vi(e.timer)},B,n);return L(o,Mn)}cancelTimer(e,n){return this.rawOperation("cancel_timer",e,B,n)}async reconcileTimers(e,n){let o=await this.rawOperation("reconcile_timers",{namespace:e.namespace,criterion_id:e.criterionId,timers:e.timers.map(vi)},B,n);return L(o,i=>({namespace:i.namespace,timers:i.timers.map(Mn),cancelledIds:i.cancelled_ids}))}async*watch(e={}){let n=e.cursor,o=Math.max(100,e.pollIntervalMs??1e3),i=_i(e.retry),r=0,a=!1;for(e.onStatus?.({state:"connecting",...n===void 0?{}:{cursor:n}});!e.signal?.aborted;){let s=await this.changes(n===void 0?{}:{after:n,limit:200},{signal:e.signal,timeoutMs:e.timeoutMs});if(!s.ok){let u=s.problem;if(e.signal?.aborted)return;if(!i||u.recovery!=="retry"){yield s;return}if(a=!1,r+=1,i.maxAttempts!==void 0&&r>i.maxAttempts){yield s;return}let p=Math.min(i.maxDelayMs,Math.round(i.initialDelayMs*i.multiplier**(r-1)));e.onStatus?.({state:"reconnecting",...n===void 0?{}:{cursor:n},attempt:r,retryInMs:p,problem:u});try{await Q(p,e.signal)}catch{if(!e.signal?.aborted)throw d("operation_failed","Watch retry delay failed unexpectedly.")}continue}let c=s.value;if(n===void 0){n=c.cursor;continue}if(c.reset){let u=w("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again.");e.onStatus?.({state:"reset_required",cursor:n,problem:u}),yield g(u);return}let l=r>0;r=0,(!a||l)&&e.onStatus?.({state:"connected",cursor:n,recovered:l}),a=!0;for(let u of c.events)yield I(u);if(n=c.cursor,!c.hasMore)try{await Q(o,e.signal)}catch{if(!e.signal?.aborted)throw d("operation_failed","Watch polling delay failed unexpectedly.")}}}rawOperation(e,n,o,i){return z(()=>this.transport.operation(e,n,i),o)}async releaseQueryCursor(e){try{await this.envelopeOperation("query",{release_cursor:e},Cn,{timeoutMs:2e3,coordination:{coalesce:!1}})}catch{}}async envelopeOperation(e,n,o,i){let r=await z(()=>this.transport.operation(e,n,i),o);if(!r.ok)return r;let a=r.value;return a.valid?I(a.result,a.diagnostics):g(Ae(a))}};function L(t,e){return t.ok?I(e(t.value),t.diagnostics):t}function ls(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function ds(t){return{...t.types?{types:t.types}:{},...t.timezone?{timezone:t.timezone}:{},...t.context?{context:t.context}:{},...t.projections?{projections:Object.fromEntries(Object.entries(t.projections).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.where?{where:t.where}:{},...t.select?{select:t.select.map(e=>typeof e=="string"?e:{name:e.name,expr:e.expression,...e.label?{label:e.label}:{},...e.description?{description:e.description}:{}})}:{},...t.orderBy?{order_by:t.orderBy}:{},...t.groupBy?{group_by:t.groupBy}:{},...t.summaryFunctions?{summary_functions:Object.fromEntries(Object.entries(t.summaryFunctions).map(([e,n])=>[e,{expr:n.expression,...n.description?{description:n.description}:{}}]))}:{},...t.summaries?{summaries:t.summaries}:{},...t.limit===void 0?{}:{limit:t.limit},...t.offset===void 0?{}:{offset:t.offset},...t.pagination?{pagination:t.pagination}:{},...t.cursor?{cursor:t.cursor}:{},...t.snapshot?{snapshot:t.snapshot}:{},...t.includeBody===void 0?{}:{include_body:t.includeBody},...t.frontmatterMode?{frontmatter_mode:t.frontmatterMode}:{},...t.contract?{contract:t.contract}:{}}}function us(t){return{...t.path?{path:t.path}:{},...t.type?{type:t.type}:{},...t.contract?{contract:t.contract}:{},...t.frontmatter?{frontmatter:t.frontmatter}:{},...t.body===void 0?{}:{body:t.body},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function ps(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument},...t.document===void 0?{patch:t.patch,...t.body===void 0?{}:{body:t.body}}:{document:t.document}}}function bi(t){return{path:t.path,...t.contract?{contract:t.contract}:{},...t.checkBacklinks===void 0?{}:{check_backlinks:t.checkBacklinks},...t.ifRevision?{if_revision:t.ifRevision}:{}}}function Ci(t){return{from:t.from,to:t.to,...t.contract?{contract:t.contract}:{},...t.updateRefs===void 0?{}:{update_refs:t.updateRefs},...t.ifRevision?{if_revision:t.ifRevision}:{},...t.includeDocument===void 0?{}:{include_document:t.includeDocument}}}function In(t){let{ifRevision:e,...n}=t;return{...n,...e?{if_revision:e}:{}}}function Ri(t){return{provision:t.provision,installed_by:t.installedBy,...t.adoptResources?{adopt_resources:t.adoptResources}:{},...t.preserveSeedTargets?{preserve_seed_targets:t.preserveSeedTargets}:{},...t.targetOverrides?{target_overrides:t.targetOverrides}:{},...t.contractSetups?{contract_setups:t.contractSetups.map(Oi)}:{}}}function fs(t){return{...Ri(t),expected_assessment_digest:t.expectedAssessmentDigest,...t.allowDowngrade===void 0?{}:{allow_downgrade:t.allowDowngrade}}}function Pi(t){return{application_id:t.applicationId,declaration_digest:t.declarationDigest,requirements:t.requirements,provisions:{configuration:t.provisions.configuration,type_packs:t.provisions.typePacks},...t.contractSetups?{contract_setups:t.contractSetups.map(Oi)}:{},...t.typePackAdoptions?{type_pack_adoptions:t.typePackAdoptions}:{}}}function hs(t){return{...Pi(t),expected_assessment_digest:t.expectedAssessmentDigest,expected_collection_revision:t.expectedCollectionRevision,expected_provision_digest:t.expectedProvisionDigest,...t.allowTypePackDowngrades?{allow_type_pack_downgrades:t.allowTypePackDowngrades}:{}}}function Ai(t){return{path:t.path,deleted:t.deleted,...t.broken_links?{brokenLinks:t.broken_links}:{}}}function ys(t){return{...Ai(t),deleted:!1,dryRun:!0,wouldDelete:!0}}function ms(t){let{references_updated:e,...n}=t;return{...qt(n),from:t.from,to:t.to,...e?{referencesUpdated:e}:{}}}function gs(t){return{from:t.from,to:t.to,dryRun:!0,wouldRename:!0,...t.references_affected?{referencesAffected:t.references_affected}:{},...t.warnings?{warnings:t.warnings}:{}}}function vi(t){return{id:t.id,fire_at:t.fireAt,...t.data===void 0?{}:{data:t.data}}}function Mn(t){return{id:t.id,fireAt:t.fire_at,...t.data===void 0?{}:{data:t.data},criterionId:t.criterion_id,generation:t.generation,status:t.status,createdAt:t.created_at,updatedAt:t.updated_at,firedAt:t.fired_at}}function Oi(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",type_name:t.typeName,type_revision:t.typeRevision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function Ti(t){return{id:t.id,version:t.version,digest:t.digest,type:t.type,implementationDigest:t.implementation_digest}}function ki(t){let{effective_frontmatter:e,contract:n,...o}=t;return{...o,...e===void 0?{}:{effectiveFrontmatter:e},...n?{contract:Ti(n)}:{}}}function qt(t){let{effective_frontmatter:e,contract:n,...o}=t;return{...o,effectiveFrontmatter:e,...n?{contract:Ti(n)}:{}}}function _s(t){return{results:t.results.map(e=>{let n=ki(e);if(!n.effectiveFrontmatter)throw new Error("Saved view result omitted canonical effective frontmatter.");return{...n,effectiveFrontmatter:n.effectiveFrontmatter}}),meta:{totalCount:t.meta.total_count,hasMore:t.meta.has_more,...t.meta.cursor?{cursor:t.meta.cursor}:{},view:t.meta.view,...t.meta.context?{context:t.meta.context}:{},...t.meta.groups?{groups:t.meta.groups}:{}}}}function wi(t){return{source:t.source,target:t.target,kind:t.kind,mode:t.mode,action:t.action,digest:t.digest,...t.current_digest?{currentDigest:t.current_digest}:{},...t.installed_digest?{installedDigest:t.installed_digest}:{},...t.adopted_from_digest?{adoptedFromDigest:t.adopted_from_digest}:{},...t.reason?{reason:t.reason}:{}}}function Dt(t){return{id:t.id,version:t.version,digest:t.digest,installedBy:t.installed_by,resources:t.resources.map(e=>({source:e.source,target:e.target,kind:e.kind,mode:e.mode,digest:e.digest,...e.adopted_from_digest?{adoptedFromDigest:e.adopted_from_digest}:{}}))}}function bs(t){return t.mode==="starter"?t:{contract:t.contract,mode:"existing",typeName:t.type_name,typeRevision:t.type_revision,fields:t.fields,...t.binding?{binding:t.binding}:{}}}function xn(t){return{status:t.status,applicable:t.applicable,assessmentDigest:t.assessment_digest,...t.current?{current:Dt(t.current)}:{},desired:Dt(t.desired),resources:t.resources.map(wi),lock:t.lock,contractSetups:{choices:t.contract_setups.choices.map(bs),resources:t.contract_setups.resources.map(wi)}}}function Cs(t){return{...xn(t),receipt:Dt(t.receipt),cleanupDeferred:t.cleanup_deferred}}function Si(t){return{status:t.status,applicable:t.applicable,applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,collectionRevision:t.collection_revision,finalCollectionRevision:t.final_collection_revision,baselineDiagnosticCount:t.baseline_diagnostic_count,finalDiagnosticCount:t.final_diagnostic_count,resolvedDiagnosticCount:t.resolved_diagnostic_count,introducedDiagnosticCount:t.introduced_diagnostic_count,baselineDiagnosticDigest:t.baseline_diagnostic_digest,configuration:t.configuration,typePacks:t.type_packs.map(xn),finalResourceRevisions:t.final_resource_revisions,assessmentDigest:t.assessment_digest}}function vs(t){return{applicationId:t.application_id,declarationDigest:t.declaration_digest,provisionDigest:t.provision_digest,assessmentDigest:t.assessment_digest,collectionRevision:t.collection_revision,configuration:t.configuration,typePacks:t.type_packs.map(Dt),cleanupDeferred:t.cleanup_deferred}}function ws(t){return{cursor:t.cursor,type:t.type,occurredAt:t.occurred_at,payload:t.payload}}function Ss(t){return{events:t.events.map(ws),cursor:t.cursor,hasMore:t.has_more,reset:t.reset}}function Rs(t){return{protocolVersion:t.protocol_version,collectionId:t.collection_id,displayName:t.display_name,specVersion:t.spec_version,operations:t.operations,changeCursor:t.change_cursor,types:t.types,contracts:t.contracts.map(e=>({contractType:e.contract_type,id:e.id,version:e.version,digest:e.digest,schema:e.schema,...e.binding_schema?{bindingSchema:e.binding_schema}:{},implementations:e.implementations.map(n=>({typeName:n.type_name,typeVersion:n.type_version,...n.type_path?{typePath:n.type_path}:{},digest:n.digest,fields:n.fields,...n.binding?{binding:n.binding}:{}}))})),...t.configuration?{configuration:t.configuration}:{}}}var Ft=class{constructor(e){this.context=e}context;async registerNotifications(e){return U(e,this.context.requestTimeoutMs,n=>this.registerNotificationsWithinBudget(e,n.signal))}async registerNotificationsWithinBudget(e,n){let o=await this.context.authorizedToken(n);if(!o)throw d("not_authorized","Connect this application before enabling notifications.");let r=(await this.context.register(n)).notifications?.criteria.map(y=>y.id)??[],a=[...new Set(e.criteria??r)],s=a.find(y=>!r.includes(y));if(s)throw d("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw d("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=await ie(`${this.context.serverUrl}/v1/notifications/vapid-public-key`,{signal:n},"notifications_unavailable","Push notifications are unavailable."),l=await E(c,"invalid_operation_response","Connect returned an invalid notification key response.");if(!c.ok)throw D(l,"notifications_unavailable","Push notifications are unavailable.",c.status);let u=await e.serviceWorker.pushManager.getSubscription();u||(u=await e.serviceWorker.pushManager.subscribe({userVisibleOnly:!0,applicationServerKey:Qo(l.public_key)}));let p=u.toJSON();if(!p.endpoint||!p.keys?.p256dh||!p.keys.auth)throw d("invalid_push_subscription","The browser returned an incomplete push subscription.");let f=M(this.context.storage.getItem(this.context.notificationKey())),h=e.installationId??f?.installationId??J(24),m=await ie(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${o.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:h,criteria:a,subscription:{endpoint:p.endpoint,expirationTime:p.expirationTime??null,keys:p.keys}}),signal:n},"notification_registration_failed","Could not register push notifications."),b=await E(m,"invalid_operation_response","Connect returned an invalid notification registration response.");if(!m.ok)throw D(b,"notification_registration_failed","Could not register push notifications.",m.status);f?.channelId&&f.channelId!==b.channel_id&&fetch(`${this.context.serverUrl}/v1/notifications/channels/${f.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${o.accessToken}`},signal:n}).catch(()=>{});let C={channelId:b.channel_id,installationId:h,criteria:a};return this.context.storage.setItem(this.context.notificationKey(),JSON.stringify(C)),C}async registerNativeNotifications(e){return U(e,this.context.requestTimeoutMs,n=>this.registerNativeNotificationsWithinBudget(e,n.signal))}async registerNativeNotificationsWithinBudget(e,n){let o=await this.context.authorizedToken(n);if(!o)throw d("not_authorized","Connect this application before enabling notifications.");let i=await this.context.register(n);if(i.notifications?.native_delivery?.mode!=="managed_fcm")throw d("managed_fcm_not_declared","This application does not declare Connect-managed native notifications.");let r=i.notifications.criteria.map(m=>m.id),a=[...new Set(e.criteria??r)],s=a.find(m=>!r.includes(m));if(s)throw d("notification_criterion_not_declared",`The application manifest does not declare notification criterion ${s}.`);if(a.length===0)throw d("notifications_not_declared","This application manifest does not declare any notification criteria.");let c=this.context.notificationKey("fcm"),l=M(this.context.storage.getItem(c)),u=e.installationId??l?.installationId??J(24),p=await ie(`${this.context.serverUrl}/v1/notifications/channels`,{method:"POST",headers:{authorization:`Bearer ${o.accessToken}`,"content-type":"application/json"},body:JSON.stringify({installation_id:u,criteria:a,transport:"fcm",token:e.token}),signal:n},"notification_registration_failed","Could not register native notifications."),f=await E(p,"invalid_operation_response","Connect returned an invalid native notification response.");if(!p.ok)throw D(f,"notification_registration_failed","Could not register native notifications.",p.status);l?.channelId&&l.channelId!==f.channel_id&&this.deleteNotificationChannel(l.channelId,o.accessToken,n).catch(()=>{});let h={channelId:f.channel_id,installationId:u,transport:"fcm",criteria:a};return this.context.storage.setItem(c,JSON.stringify(h)),h}async unregisterNativeNotifications(e={}){return U(e,this.context.requestTimeoutMs,n=>this.unregisterNativeNotificationsWithinBudget(n.signal))}async unregisterNativeNotificationsWithinBudget(e){let n=this.context.notificationKey("fcm"),o=M(this.context.storage.getItem(n)),i=await this.context.authorizedToken(e);if(o?.channelId&&!i)throw d("not_authorized","Reconnect this application before disabling native notifications.");o?.channelId&&i&&await this.deleteNotificationChannel(o.channelId,i.accessToken,e),this.context.storage.removeItem(n)}async unregisterNotifications(e,n={}){return U(n,this.context.requestTimeoutMs,o=>this.unregisterNotificationsWithinBudget(e,o.signal))}async unregisterNotificationsWithinBudget(e,n){let o=M(this.context.storage.getItem(this.context.notificationKey())),i=await this.context.authorizedToken(n);if(o?.channelId&&!i)throw d("not_authorized","Reconnect this application before disabling push notifications.");if(o?.channelId&&i){let a=await ie(`${this.context.serverUrl}/v1/notifications/channels/${o.channelId}`,{method:"DELETE",headers:{authorization:`Bearer ${i.accessToken}`},signal:n},"notification_unregistration_failed","Could not unregister push notifications.");if(!a.ok&&a.status!==404){let s=await E(a,"invalid_operation_response","Connect returned an invalid notification response.");throw D(s,"notification_unregistration_failed","Could not unregister push notifications.",a.status)}}this.context.storage.removeItem(this.context.notificationKey()),await(await e?.pushManager.getSubscription())?.unsubscribe()}async deleteNotificationChannel(e,n,o){let i=await ie(`${this.context.serverUrl}/v1/notifications/channels/${e}`,{method:"DELETE",headers:{authorization:`Bearer ${n}`},signal:o},"notification_unregistration_failed","Could not unregister push notifications.");if(!i.ok&&i.status!==404){let r=await E(i,"invalid_operation_response","Connect returned an invalid notification response.");throw D(r,"notification_unregistration_failed","Could not unregister push notifications.",i.status)}}};async function zt(t,e,n,o,i,r){if(!t.authority)throw d("not_remote_authority","This authorization has no remote authority endpoint.");let a=n===""||n.startsWith("?")?n:`/${n}`,s=`${t.authority.filesUrl}${a}`,c=o===void 0?void 0:JSON.stringify(o),l=await r(t,e,s,c,t.authority.accessToken);return fetch(s,{method:e,redirect:"error",headers:{authorization:`Bearer ${t.authority.accessToken}`,...c===void 0?{}:{"content-type":"application/json"},...l},...c===void 0?{}:{body:c},...i?{signal:i}:{}})}async function Ii(t,e,n,o,i,r,a,s=async c=>c){let c=t,l=await zt(c,e,n,o,i,a);if(l.status===401&&c.refreshToken){if(c=await s(await r(i)),!c.authority||!c.fileCapability)throw d("authority_authorization_changed","Reconnect this collection before accessing its files.");l=await zt(c,e,n,o,i,a)}let u=await E(l,"invalid_operation_response","The hosted authority returned an invalid file response.");if(!l.ok)throw D(u,"operation_failed","Collection file request failed.",l.status);return u}async function Mi(t,e,n,o,i,r,a=async s=>s){let s=t,c=await zt(s,"GET",e,void 0,o,r);if(c.status===401&&s.refreshToken){if(s=await a(await i(o)),!s.authority||!s.fileCapability)throw d("authority_authorization_changed","Reconnect this collection before accessing its files.");c=await zt(s,"GET",e,void 0,o,r)}if(!c.ok){let u=await E(c,"invalid_operation_response","The hosted authority returned an invalid file range error response.");throw D(u,"operation_failed","Collection file range request failed.",c.status)}let l=c.headers.get("content-length");if(l===null||!/^(0|[1-9][0-9]*)$/u.test(l)||Number(l)!==n)throw await c.body?.cancel().catch(()=>{}),d("invalid_operation_response","The hosted file response declared an unexpected byte length.");if(!c.body)throw d("invalid_operation_response","The hosted file response did not contain a byte stream.");return c.body}var Ut=class{constructor(e,n){this.namespace=e;this.onFinalRelease=n}namespace;onFinalRelease;leases=new Map;locks=Ps();retainAutomaticallyRetiredKeys=this.locks===null;async acquire(e,n,o){let i=this.acquireLocal(e,n);if(!this.locks)return i;try{let r=await As(this.locks,this.lockName(e,n),o);return En(()=>{r(),i()})}catch(r){throw i(),r}}deleteExclusive(e,n,o){this.retainAutomaticallyRetiredKeys||(this.locks?this.locks.request(this.lockName(e,n),{mode:"exclusive"},o).catch(()=>{}):this.has(e,n)||Promise.resolve().then(o).catch(()=>{}))}has(e,n){return this.leases.get(e)?.has(n)??!1}handles(e){return this.leases.get(e)?.keys()??[]}acquireLocal(e,n){let o=this.leases.get(e)??new Map;return o.set(n,(o.get(n)??0)+1),this.leases.set(e,o),En(()=>{let i=(o.get(n)??1)-1;i>0?o.set(n,i):(o.delete(n),o.size===0&&this.leases.delete(e),this.onFinalRelease(e,n))})}lockName(e,n){return`mdbase-connect:grant-key:${this.namespace}:${e}:${n}`}},he=class{constructor(e,n){this.collectionId=e;this.acquire=n}collectionId;acquire;releases=new Map;async retain(e,n){let o=typeof e=="string"?e:e?.keyHandle;if(!o)return;let i=this.releases.get(o);i||(i=this.acquire(this.collectionId,o,n),this.releases.set(o,i));try{await i}catch(r){throw this.releases.get(o)===i&&this.releases.delete(o),this.release(),r}}release(){for(let e of this.releases.values())e.then(n=>n());this.releases.clear()}};async function K(t,e,n){for(;;){let o=t();if(!o)return null;await e.retain(o,n);let i=t();if(!i)return null;if(i.keyHandle===o.keyHandle)return i}}function Ps(){let t=typeof navigator>"u"?void 0:navigator.locks;return t||(typeof window<"u"||typeof globalThis.importScripts=="function"?null:void 0)}async function As(t,e,n){let o,i,r,a=new Promise((l,u)=>{o=l,i=u}),s=new Promise(l=>{r=l});return t.request(e,{mode:"shared",...n?{signal:n}:{}},async()=>{o(),await s}).catch(i),await a,En(r)}function En(t){let e=!1;return()=>{e||(e=!0,t())}}var Os="mdbase-connect file chunk key v1",Lt=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,re=class extends Error{constructor(n,o){super(o);this.code=n;this.name="FileTransferCryptoError"}code},je=class t{constructor(e,n){this.binding=e;this.key=n}binding;key;static async open(e,n,o){xi(o);let i=await e.get(n);if(!i||i.agreementPublicKey!==o.encryption.application_agreement_public_key)throw new x("missing_grant_key","The encrypted grant key is unavailable or does not match the file transfer grant.");let r=await it(i.agreementPrivateKey,o.encryption.connector_agreement_public_key);return t.fromSharedSecret(r,o)}static async fromSharedSecret(e,n){xi(n);let o=await qn(e,n);return new t(n,o)}async encryptChunk(e,n,o){if(this.validateHeader(n),o.byteLength!==n.plaintext_length)throw new re("plaintext_length_mismatch","File chunk plaintext length does not match its authenticated header.");let i=mt(e,n),r=await crypto.subtle.encrypt({name:"AES-GCM",iv:Ei(n.chunk_index),additionalData:Nt(i),tagLength:128},this.key,Nt(o));return ro({kind:e,header:n,payload:new Uint8Array(r)})}async decryptChunk(e){let n=gt(e);this.validateHeader(n.header);let o=mt(n.kind,n.header);try{let i=await crypto.subtle.decrypt({name:"AES-GCM",iv:Ei(n.header.chunk_index),additionalData:Nt(o),tagLength:128},this.key,Nt(n.payload));return new Uint8Array(i)}catch{throw new re("authentication_failed","The encrypted file chunk could not be authenticated.")}}validateHeader(e){let n=this.binding.encryption;if(e.protocol_version!==1||e.protection!=="grant_aead_v1"||e.grant_id!==this.binding.grantId||e.authority_id!==this.binding.authorityId||e.collection_id!==n.collection_id||e.transfer_id!==this.binding.transferId||e.direction!==this.binding.direction||e.scope_epoch!==n.scope_epoch||e.key_id!==n.key_id)throw new re("header_binding_mismatch","The file frame does not match its transfer encryption binding.")}};async function qn(t,e){let n=new TextEncoder().encode(Ts(e)),o=await crypto.subtle.digest("SHA-256",n),i=await crypto.subtle.importKey("raw",t,"HKDF",!1,["deriveKey"]);return crypto.subtle.deriveKey({name:"HKDF",hash:"SHA-256",salt:o,info:new TextEncoder().encode(Os)},i,{name:"AES-GCM",length:256},!1,["encrypt","decrypt"])}function xi(t){if(oe(t.encryption),!Lt.test(t.grantId)||!Lt.test(t.applicationId)||!Lt.test(t.authorityId)||!Lt.test(t.transferId)||t.direction!=="upload"&&t.direction!=="download")throw new re("invalid_binding","The file transfer encryption binding is invalid.")}function Ts(t){let e=t.encryption;return["mdbase-connect","file-transfer",1,e.suite,t.grantId,t.applicationId,e.connector_id,t.authorityId,e.collection_id,e.scope_epoch,e.key_id,t.transferId,t.direction].join("|")}function Ei(t){if(!Number.isSafeInteger(t)||t<0)throw new re("invalid_chunk_index","The file chunk index is invalid.");let e=new Uint8Array(new ArrayBuffer(12));return new DataView(e.buffer).setBigUint64(4,BigInt(t),!1),e}function Nt(t){return Uint8Array.from(t).buffer}var jt=8,Dn=10;function Kt(t){return t instanceof _&&t.code==="connector_busy"}async function qi(t){if(!Kt(t.error)||t.completedRetries>=jt)return{retried:!1};try{await Vt(t.completedRetries,t.signal)}catch(e){throw t.attempt.pendingMutation&&(t.knownRejectedMutationRetry||!t.attempt.resumingMutation)&&t.clearPending(t.attempt.requestId),e}return{retried:!0,result:await t.retry(t.attempt.pendingMutationRecord,t.knownRejectedMutationRetry||t.attempt.pendingMutation===!0&&!t.attempt.resumingMutation)}}async function Ke(t){if(t.status!==502&&t.status!==503)return!1;let e=await t.clone().json().catch(()=>null);return e?.error==="connector_busy"||typeof e?.error=="object"&&e.error?.code==="connector_busy"}function Vt(t,e){return Fi(zi(50,800,t),e)}function Di(t,e){return Fi(zi(100,1e3,t-1),e)}async function Fi(t,e){try{await Q(t,e)}catch(n){throw e?.aborted?e.reason instanceof _?e.reason:d("operation_cancelled","The operation was cancelled while waiting for connector capacity.",{operationOutcome:"not_sent",cause:n}):n}}function zi(t,e,n){let o=Math.min(e,t*2**Math.max(0,n));return Math.max(1,Math.round(o*(.75+Math.random()*.5)))}var Ht=class{constructor(e){this.options=e}options;async control(e,n,o,i,r){let a=this.grantKeyLeases(e.collectionId);try{return e=await this.retainEntryToken(e,a,r),await this.controlAttempt(e,n,o,i,r,!1,0,a)}finally{a.release()}}async controlAttempt(e,n,o,i,r,a,s,c){Ve(e);let l=qs(n,o,i),u=await this.encryptControl(e,l),p,f=await this.options.shouldAttemptDirect(e);if(f){try{p=await fetch(`${this.options.loopbackUrl}/v1/files/control`,fe({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(u),signal:r}))}catch(h){if(r?.aborted)throw h;this.options.onDirectUnavailable()}if(p&&(!Ee(p.status)||await Ke(p)))return p.ok&&this.options.onDirectAvailable(),this.decryptControlResponse(e,n,o,i,r,u,p,a,s,c);p&&this.options.onDirectUnavailable()}return f&&n==="GET"&&(e=e.expiresAt>Date.now()+3e4?e:await this.options.refreshAuthorization(r),e=await this.retainEntryToken(e,c,r),Gt(e),u=await this.encryptControl(e,l)),p=await this.sendRelayControl(e,u,r),await Is(p,e)&&(e=await this.options.refreshAuthorization(r),e=await this.retainEntryToken(e,c,r),Gt(e),u=await this.encryptControl(e,l),p=await this.sendRelayControl(e,u,r)),p.ok&&this.options.onRelayAvailable(),this.decryptControlResponse(e,n,o,i,r,u,p,a,s,c)}async decryptControlResponse(e,n,o,i,r,a,s,c,l,u){let p=await E(s,"invalid_operation_response","The collection authority returned an invalid file control response.");if(!s.ok){let m=D(p,"operation_failed","Collection file request failed.",s.status);if(Kt(m)&&l<jt)return await Vt(l,r),this.controlAttempt(e,n,o,i,r,c,l+1,u);if(m.code==="fresh_request_required"&&n==="GET"&&!c)return this.controlAttempt(e,n,o,i,r,!0,l,u);throw m}let f=p?.envelope;if(!f)throw d("invalid_encrypted_response","The connector omitted its encrypted file response.");let h=await xe(this.options.keyStore,e.keyHandle,zn(e),a,f);if(!h.ok&&h.problem.code==="fresh_request_required"&&n==="GET"&&!c)return this.controlAttempt(e,n,o,i,r,!0,l,u);if(!h.ok){let m=Es(h.problem);if(Kt(m)&&l<jt)return await Vt(l,r),this.controlAttempt(e,n,o,i,r,c,l+1,u);throw m}return h.result}async uploadChunk(e,n,o,i,r){let a=r??await this.localFileToken(e,"upload",i),s=this.grantKeyLeases(a.collectionId);try{let c=await this.retainEntryToken(a,s,i);return Fn(c,e,"upload"),await this.uploadChunkWithLease(c,s,e,n,o,i)}finally{s.release()}}async uploadChunkWithLease(e,n,o,i,r,a){let s=e,c=await Ui(this.options.keyStore,s,o,i,r),l;if(await this.options.shouldAttemptDirect(s)){try{l=await fetch(`${this.options.loopbackUrl}/v1/files/upload`,fe(Li(c,a)))}catch(u){if(a?.aborted)throw u;this.options.onDirectUnavailable()}if(l&&(!Ee(l.status)||await Ke(l)))return l.ok&&this.options.onDirectAvailable(),ks(l,"Encrypted file chunk upload failed.");l&&this.options.onDirectUnavailable()}if(l=await this.sendRelayUpload(s,c,a),l.status===401&&s.refreshToken&&(s=await this.options.refreshAuthorization(a),s=await this.retainEntryToken(s,n,a),Gt(s),c=await Ui(this.options.keyStore,s,o,i,r),l=await this.sendRelayUpload(s,c,a)),!l.ok){let u=await E(l,"invalid_operation_response","The collection authority returned an invalid file upload response.");throw D(u,"operation_failed","Encrypted file chunk upload failed.",l.status)}this.options.onRelayAvailable()}async downloadChunk(e,n,o,i){let r=i??await this.localFileToken(e,"download",o),a=this.grantKeyLeases(r.collectionId);try{return r=await this.retainEntryToken(r,a,o),Fn(r,e,"download"),await this.downloadChunkWithLease(r,a,e,n,o)}finally{a.release()}}async downloadChunkWithLease(e,n,o,i,r){let a;if(await this.options.shouldAttemptDirect(e)){try{a=await fetch(`${this.options.loopbackUrl}/v1/files/download/${encodeURIComponent(e.grantId)}/${encodeURIComponent(o.transfer_id)}/${i}`,fe({method:"GET",signal:r}))}catch(s){if(r?.aborted)throw s;this.options.onDirectUnavailable()}if(a&&(!Ee(a.status)||await Ke(a)))return a.ok&&this.options.onDirectAvailable(),this.decryptDownloadResponse(e,o,i,a);a&&this.options.onDirectUnavailable()}return a=await this.sendRelayDownload(e,o,i,r),a.status===401&&e.refreshToken&&(e=await this.options.refreshAuthorization(r),e=await this.retainEntryToken(e,n,r),Gt(e),a=await this.sendRelayDownload(e,o,i,r)),a.ok&&this.options.onRelayAvailable(),this.decryptDownloadResponse(e,o,i,a)}async decryptDownloadResponse(e,n,o,i){if(!i.ok){let s=await E(i,"invalid_operation_response","The collection authority returned an invalid file download response.");throw D(s,"operation_failed","Encrypted file chunk download failed.",i.status)}if(i.headers.get("content-type")?.split(";",1)[0]!=="application/mdbase-connect-file")throw d("invalid_operation_response","The connector returned an invalid file response media type.");let r=new Uint8Array(await i.arrayBuffer()),a;try{xs(n,o,r),a=await(await Bi(this.options.keyStore,e,n)).decryptChunk(r)}catch(s){throw s instanceof _?s:d("invalid_operation_response","The connector returned an invalid encrypted file frame.",{cause:s})}if(a.byteLength!==Un(n,o))throw d("invalid_operation_response","The connector returned a truncated file chunk.");return a}encryptControl(e,n){return Ve(e),ne(this.options.keyStore,e.keyHandle,zn(e),"file_control",n)}sendRelayControl(e,n,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/control`,{method:"POST",headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/json"},body:JSON.stringify(n),signal:o})}sendRelayUpload(e,n,o){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/upload`,{...Li(n,o),headers:{authorization:`Bearer ${e.accessToken}`,"content-type":"application/mdbase-connect-file"}})}sendRelayDownload(e,n,o,i){return fetch(`${this.options.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/files/download/${encodeURIComponent(n.transfer_id)}/${o}`,{method:"GET",headers:{authorization:`Bearer ${e.accessToken}`},signal:i})}async localFileToken(e,n,o){let i=await this.options.authorizedToken(o);return Fn(i,e,n),i}grantKeyLeases(e){return new he(e,this.options.acquireGrantKeyLease??(()=>Promise.resolve(()=>{})))}async retainEntryToken(e,n,o){if(!this.options.currentToken)return await n.retain(e,o),e;let i=await K(this.options.currentToken,n,o);if(i)return i;throw d("not_authorized","Reconnect this application to continue.")}};function Fn(t,e,n){if(!t||t.authority||!t.fileCapability||!t.encryption||!t.grantId||!t.keyHandle||e.direction!==n||e.protection!=="grant_aead_v1")throw d("not_authorized","This connection cannot use encrypted local file delivery.");$t(e)}function Gt(t){if(t.authority||!t.fileCapability)throw d("not_authorized","This connection cannot use encrypted local file delivery.");Ve(t)}async function Ui(t,e,n,o,i){let r=Ms(e,n,o,i.byteLength);return(await Bi(t,e,n)).encryptChunk("upload_chunk",r,i)}function Li(t,e){return{method:"POST",headers:{"content-type":"application/mdbase-connect-file"},body:Uint8Array.from(t).buffer,signal:e}}async function ks(t,e){if(t.ok)return;let n=await E(t,"invalid_operation_response","The collection authority returned an invalid file transfer response.");throw D(n,"operation_failed",e,t.status)}async function Is(t,e){return e.refreshToken?t.status===401?!0:t.status!==409?!1:(await E(t.clone(),"invalid_operation_response","The collection authority returned an invalid file response.").catch(()=>null))?.error?.code==="encryption_binding_stale":!1}function Ve(t){if(!t.encryption||!t.grantId||!t.keyHandle)throw d("missing_grant_key","Reconnect this application to restore encrypted file access.")}function zn(t){return Ve(t),{grantId:t.grantId,applicationId:t.clientId,encryption:t.encryption}}function Bi(t,e,n){return Ve(e),je.open(t,e.keyHandle,{...zn(e),authorityId:e.encryption.connector_id,transferId:n.transfer_id,direction:n.direction})}function Ms(t,e,n,o){Ve(t);let i=$t(e),r=Un(e,n);if(o!==r)throw d("invalid_request","The file chunk has the wrong byte length.");return{protocol_version:1,protection:"grant_aead_v1",grant_id:t.grantId,authority_id:t.encryption.connector_id,collection_id:t.collectionId,transfer_id:e.transfer_id,direction:e.direction,chunk_size:i,chunk_index:n,offset:n*i,plaintext_length:o,total_size:e.total_size,scope_epoch:t.encryption.scope_epoch,key_id:t.encryption.key_id}}function xs(t,e,n){let o=gt(n),i=Un(t,e),r=$t(t);if(o.kind!=="download_chunk"||o.header.chunk_index!==e||o.header.chunk_size!==r||o.header.offset!==e*r||o.header.plaintext_length!==i||o.header.total_size!==t.total_size)throw d("invalid_operation_response","The connector returned a file frame for a different chunk.")}function Es(t){return F(t.code==="unknown"?t.server_code:t.code,t.message,{details:t.details,operationOutcome:t.operation_outcome??"rejected",traceId:t.trace_id})}function qs(t,e,n){if(t==="GET"&&(e===""||e.startsWith("?"))){let i=new URLSearchParams(e.startsWith("?")?e.slice(1):e),r=i.get("limit");return{protocol_version:1,type:"list_files",...i.get("folder")?{folder:i.get("folder")}:{},...i.get("after")?{after:i.get("after")}:{},...r?{limit:Number(r)}:{}}}let o=e.split("/");if(t==="GET"&&o.length===2&&o[0]==="transfers")return Ni("get_file_transfer_status",o[1]);if(t==="DELETE"&&o.length===2&&o[0]==="transfers")return Ni("abort_file_transfer",o[1]);if(t==="POST"&&Ds(n)){let i=e==="uploads"?"open_file_upload":e==="downloads"?"open_file_download":o.length===3&&o[0]==="uploads"&&o[2]==="commit"?"commit_file_upload":o.length===2&&o[1]==="move"&&n.file_id===decodeURIComponent(o[0])?"move_file":o.length===2&&o[1]==="delete"&&n.file_id===decodeURIComponent(o[0])?"delete_file":null;if(i&&n.type===i)return{...n}}throw d("invalid_request","The file control request path is invalid.")}function Ni(t,e){return{protocol_version:1,type:t,transfer_id:decodeURIComponent(e)}}function $t(t){if(t.strategy.kind!=="framed_chunks"||!Number.isSafeInteger(t.strategy.chunk_size)||t.strategy.chunk_size<=0)throw d("invalid_operation_response","The connector returned an invalid framed transfer strategy.");return t.strategy.chunk_size}function Un(t,e){let n=$t(t);if(!Number.isSafeInteger(e)||e<0||!Number.isSafeInteger(t.total_size)||t.total_size<0)throw d("invalid_request","The file chunk index is invalid.");let o=e*n;if(!Number.isSafeInteger(o)||o>=t.total_size)throw d("invalid_request","The file chunk index is outside the transfer.");return Math.min(n,t.total_size-o)}function Ds(t){return t!==null&&typeof t=="object"&&!Array.isArray(t)}var Wt=class{constructor(e){this.options=e;this.local=new Ht(e)}options;local;async control(e,n="",o,i){let r=await this.requireFileToken(i),a=r.token;try{return a.authority?await Ii(a,e,n,o,i,this.options.refreshAuthorization,this.options.authorityProofHeaders,r.retain):await this.local.control(a,e,n,o,i)}finally{r.release()}}async uploadChunk(e,n,o,i){let r=await this.requireFileToken(i);try{return await this.local.uploadChunk(e,n,o,i,r.token)}finally{r.release()}}async downloadChunk(e,n,o){let i=await this.requireFileToken(o);try{return await this.local.downloadChunk(e,n,o,i.token)}finally{i.release()}}async downloadHostedPart(e,n,o,i){let r=await this.requireFileToken(i),a=r.token;try{if(!a.authority)throw d("not_remote_authority","Hosted file delivery requires a remote authority endpoint.");return await Mi(a,`downloads/${encodeURIComponent(e.transfer_id)}/parts/${n}`,o,i,this.options.refreshAuthorization,this.options.authorityProofHeaders,r.retain)}finally{r.release()}}async requireFileToken(e){let n=new he(this.options.collectionId,this.options.acquireGrantKeyLease);try{await K(this.options.currentToken,n,e),await this.options.authorizedToken(e);let o=await K(this.options.currentToken,n,e);if(!o?.fileCapability)throw d("not_authorized","This connection has no file capability.");return{token:o,retain:async i=>{let r=await K(this.options.currentToken,n,e);if(r)return r;throw d("not_authorized","Reconnect this application to continue.")},release:()=>n.release()}}catch(o){throw n.release(),o}}};async function Se(t,e,n,o,i,r){if(!e.authority?.proofPublicKey)return{};if(!e.keyHandle)throw d("missing_grant_key","Reconnect this application to restore remote authority request signing.");try{let a=new URL(o);return await At(t,e.keyHandle,e.authority.proofPublicKey,{method:n,target:`${a.pathname}${a.search}`,body:i,credential:r})}catch(a){throw a instanceof x?F(a.code,a.message):a}}async function ji(t){let e=t.current;if(!e?.refreshToken)throw d("not_authorized","Reconnect this application to continue.");if((e.refreshExpiresAt??0)<=Date.now())throw d("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");let n=e.refreshToken,o=`${t.serverUrl}/oauth/token`,i=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken,client_id:e.clientId}).toString(),r=e.authority?await Se(t.keyStore,e,"POST",o,i,e.refreshToken):{},a=await fetch(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...r},body:i,signal:t.signal}),s=await E(a,"invalid_token_response","The authorization service returned an invalid token response.");if(!a.ok){let c=t.currentToken();if(c?.refreshToken&&c.refreshToken!==n)return c;throw t.directCapable(e)||t.removeToken(e.keyHandle),(st(s)??s?.error?.code)==="invalid_grant"?d("authorization_expired",s?.error_description??s?.error?.message??"Reconnect this application to continue.",{status:a.status}):D(s,"authorization_expired","Reconnect this application to continue.",a.status)}return t.storeTokenResponse(s,e.clientId,e.keyHandle)}var Jt=class{constructor(e,n){this.storage=e;this.baseKey=n}storage;baseKey;list(e){if(!e)return[];let n=M(this.storage.getItem(this.baseKey));if(Ki(n)&&n.collectionId===e){let i=this.key(n.requestId);this.storage.getItem(i)||this.storage.setItem(i,JSON.stringify(n)),this.storage.removeItem(this.baseKey)}let o=[];for(let i=0;i<this.storage.length;i+=1){let r=this.storage.key(i);r?.startsWith(`${this.baseKey}:`)&&o.push(r)}return o.map(i=>M(this.storage.getItem(i))).filter(i=>Ki(i)&&i.collectionId===e).sort((i,r)=>i.createdAt-r.createdAt||i.requestId.localeCompare(r.requestId))}find(e,n){return this.list(e).find(o=>o.requestId===n)??null}identifier(e){return e.mutation??ce(e.operation,e.request?.input??(e.operation==="sync"?{action:"mutate"}:{}))??(e.operation==="sync"?"sync:mutate":e.operation)}store(e){this.storage.setItem(this.key(e.requestId),JSON.stringify(e))}take(e){let n=this.key(e),o=M(this.storage.getItem(n));return this.storage.removeItem(n),o}key(e){return`${this.baseKey}:${encodeURIComponent(e)}`}};function Ki(t){return!!(t&&typeof t.collectionId=="string"&&typeof t.requestId=="string"&&t.requestId.length>0&&ao(t.operation)&&typeof t.inputFingerprint=="string"&&Number.isFinite(t.createdAt)&&t.createdAt>0&&(t.envelope||t.request)&&(t.operation==="sync"||ce(t.operation,t.request?.input??{})!==null))}function Vi({stored:t,collectionId:e,relayEncryption:n,invalidate:o,directCapable:i}){let r=M(t),a=s=>(o(typeof s=="string"?s:void 0),null);if(!r)return t&&a(),null;if(r.version!==1||typeof r.accessToken!="string"||r.accessToken.length===0||typeof r.clientId!="string"||r.clientId.length===0||r.collectionId!==e||typeof r.collectionName!="string"||r.collectionName.length===0||!Array.isArray(r.operations)||r.operations.some(s=>typeof s!="string")||typeof r.expiresAt!="number"||!Number.isFinite(r.expiresAt)||r.refreshToken!==void 0&&(typeof r.refreshToken!="string"||r.refreshToken.length===0)||r.refreshExpiresAt!==void 0&&(typeof r.refreshExpiresAt!="number"||!Number.isFinite(r.refreshExpiresAt))||!kt(r.scope)||r.fileCapability&&!Tt(r.fileCapability)||r.authority&&!Xo(r.authority,r.collectionId))return a(r.keyHandle);if(n==="required"){if(r.authority){if(!r.keyHandle||!r.authority.proofPublicKey)return a(r.keyHandle)}else if(!r.grantId||!r.keyHandle||!Zo(r.encryption,r.collectionId))return a(r.keyHandle)}return r.expiresAt<=Date.now()&&(!r.refreshToken||(r.refreshExpiresAt??0)<=Date.now())?i(r)?r:(o(r.keyHandle),null):r}async function Ln(t,e,n,o,i,r){if(!e.authority)throw d("not_remote_authority","This authorization has no remote authority endpoint.");let a=`${e.authority.syncUrl}/${o}`,s=i===void 0?void 0:JSON.stringify(i),c=await Se(t,e,n,a,s,e.authority.accessToken);return fetch(a,{method:n,headers:{authorization:`Bearer ${e.authority.accessToken}`,...i===void 0?{}:{"content-type":"application/json"},...c},...s===void 0?{}:{body:s},signal:r})}async function Gi(t,e,n,o,i){if(!e.encryption||!e.grantId||!e.keyHandle)throw d("authorization_binding_incompatible","The refreshed authorization no longer supports encrypted connector operations.",{details:{contract:"grant_encryption",required:[1],supported:e.encryption?[e.encryption.protocol_version]:[],peer:"connector",operation:n}});try{return await ne(t,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,o,void 0,i)}catch(r){throw r instanceof x?F(r.code,r.message):r}}var Ge=class{operations=new Map;run(e,n,o,i){if(n?.signal?.aborted)return Promise.reject($(n.signal));let r=this.operations.get(e)??this.begin(e,i);return this.wait(e,r,n,o)}begin(e,n){let o=new AbortController,i={controller:o,waiters:0,settled:!1,promise:void 0};return i.promise=Promise.resolve().then(()=>n(o.signal)).finally(()=>{i.settled=!0,this.operations.get(e)===i&&this.operations.delete(e)}),this.operations.set(e,i),i}async wait(e,n,o,i){n.waiters+=1;try{return await U(o,i,()=>n.promise)}finally{n.waiters-=1,n.waiters===0&&!n.settled&&this.operations.get(e)===n&&(this.operations.delete(e),n.controller.abort())}}};function Hi(t,e){return!t||t.authority||!t.encryption||!t.grantId||!t.keyHandle||e==="disabled"?!1:typeof location>"u"||!t.applicationOrigin||t.applicationOrigin===location.origin}async function $i(t,e,n){try{let o=await fetch(`${t}/v1/ready`,fe({method:"GET",cache:"no-store",signal:n})),i=await E(o,"invalid_operation_response","The connector returned an invalid readiness response.").catch(()=>null);return o.ok&&i?.service==="mdbase-connect"&&i?.loopback_protocol_version===1&&i?.operation_transport_protocol_version===e}catch{return!1}}async function Wi(t,e){try{return{body:await E(t,"invalid_operation_response","The collection authority returned a response that is not valid JSON.")}}catch(n){if(!t.ok&&e&&Fs(t.status))return{body:void 0,httpError:F("operation_failed","Collection operation failed.",{status:t.status,operationOutcome:"rejected"})};throw d("invalid_operation_response","The collection authority returned a response that is not valid JSON.",{cause:n})}}function Fs(t){return t>=400&&t<500&&![408,425,429].includes(t)}var Qt=class{serverUrl;storage;keyStore;directAccessMode;loopbackUrl;collectionId;internals;onChange;timeouts;pendingMutationStore;files;refreshOperations=new Ge;directStatus;currentRoute="relay";directFailures=0;directRetryAt=0;constructor(e){this.serverUrl=e.serverUrl,this.storage=e.storage,this.keyStore=e.keyStore,this.directAccessMode=e.directAccessMode,this.loopbackUrl=e.loopbackUrl,this.collectionId=e.collectionId,this.internals=e.internals,this.onChange=e.onChange,this.timeouts=e.timeouts,this.pendingMutationStore=new Jt(this.storage,this.internals.pendingMutationKey(this.collectionId)),this.files=new Wt({keyStore:this.keyStore,serverUrl:this.serverUrl,loopbackUrl:this.loopbackUrl,collectionId:this.collectionId,currentToken:()=>this.currentToken(),authorizedToken:n=>this.authorizedToken({signal:n,timeoutMs:null}),refreshAuthorization:n=>this.refreshAuthorization({signal:n,timeoutMs:null}),shouldAttemptDirect:n=>this.shouldAttemptDirect(n),onDirectAvailable:()=>{this.markDirectAvailable(),this.setRoute("direct")},onDirectUnavailable:()=>this.markDirectUnavailable(),onRelayAvailable:()=>this.setRoute("relay"),acquireGrantKeyLease:(n,o,i)=>this.internals.acquireGrantKeyLease(n,o,i),authorityProofHeaders:(n,o,i,r,a)=>Se(this.keyStore,n,o,i,r,a)}),this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable"}get directAccess(){return this.currentToken()?.authority?"disabled":this.directStatus}get route(){return this.currentToken()?.authority?"remote":this.currentRoute}notifyStorageChanged(){this.emitConnection()}async checkDirectAccess(e={}){return U(e,this.timeouts.watchStartMs,n=>this.checkDirectAccessWithinBudget(n.signal))}async checkDirectAccessWithinBudget(e){let n=this.currentToken();if(!this.directEligible(n))return this.setDirectStatus("disabled");let o=await rt();return o==="denied"?this.setDirectStatus("denied"):(o==="prompt"||o===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?this.setDirectStatus("permission_required"):this.probeDirectAccess(e)}async requestDirectAccess(e={}){return U(e,this.timeouts.watchStartMs,n=>this.requestDirectAccessWithinBudget(n.signal))}async requestDirectAccessWithinBudget(e){let n=this.currentToken();return this.directCapable(n)?(this.storage.setItem(this.internals.directPreferenceKey(),"enabled"),this.directRetryAt=0,this.probeDirectAccess(e)):this.setDirectStatus("disabled")}disableDirectAccess(){this.storage.setItem(this.internals.directPreferenceKey(),"disabled"),this.setDirectStatus("disabled"),this.setRoute("relay")}pendingMutations(){return this.storedPendingMutations().map(e=>({requestId:e.requestId,operation:this.pendingMutationStore.identifier(e),fingerprint:e.inputFingerprint,status:"outcome_unknown",createdAt:new Date(e.createdAt).toISOString()}))}pendingMutation(e){let n=this.storedPendingMutation(e);return n?{requestId:n.requestId,operation:this.pendingMutationStore.identifier(n),fingerprint:n.inputFingerprint,status:"outcome_unknown",createdAt:new Date(n.createdAt).toISOString()}:null}async recoverPendingMutation(e,n){let o=this.storedPendingMutation(e);if(!o)throw d("no_pending_mutation","There is no interrupted mutation to resume.");return j(n,this.timeouts.requestMs,i=>this.performOperationWithinBudget(o.operation,o.request?.input??{},nt(n??{},i),o))}async performOperation(e,n,o={}){return j(o,this.timeouts.requestMs,i=>this.performOperationWithinBudget(e,n,nt(o,i)))}async performOperationWithinBudget(e,n,o,i,r=!1,a=0,s=!1){Ce(o.signal);let c=this.grantKeyLeases();try{let l=await K(()=>this.currentToken(),c,o.signal);if(!l)throw d("not_authorized","Connect this application before accessing a collection.");return await c.retain(i?.keyHandle,o.signal),await this.performLeasedOperation(l,e,n,o,c,i,r,a,s)}finally{c.release()}}async performLeasedOperation(e,n,o,i,r,a,s=!1,c=0,l=!1){if(!e.operations.includes(n))throw d("insufficient_access",`This connection does not allow ${n}.`,{details:{required_operations:[n],granted_operations:[...e.operations],missing_operations:[n]}});let u=await this.shouldAttemptDirect(e);if(!u){if(!await this.authorizedToken({signal:i.signal,timeoutMs:null}))throw d("not_authorized","Reconnect this application to continue.");let R=await K(()=>this.currentToken(),r,i.signal);if(!R)throw d("not_authorized","Reconnect this application to continue.");e=R}let p=a?.requestId??(Lo(n,o)?crypto.randomUUID():void 0),f;try{f=await this.sendOperation(e,n,o,u,r,i,p,l)}catch(v){throw Ot(v,i.signal,p!==void 0&&this.storedPendingMutation(p)!==null?p:void 0,e.authority?"hosted_provider_unavailable":"relay_unavailable")}let h=f.response,m=h.status===409&&(await E(h.clone(),"invalid_operation_response","The collection authority returned an invalid operation response.").catch(()=>null))?.error?.code==="encryption_binding_stale";if((h.status===401||m)&&e.refreshToken){if(f.pendingMutation&&(f.directDeliveryUncertain||f.encryptedRequest&&f.resumingMutation))throw d("operation_outcome_unknown","The direct operation may have completed, but its encrypted grant changed before the response could be recovered. Refresh before making another change.",{operationOutcome:"unknown",details:{request_id:f.requestId}});f.pendingMutation&&this.clearPendingMutation(f.requestId),e=await this.refreshAuthorization({signal:i.signal,timeoutMs:null});let v=await K(()=>this.currentToken(),r,i.signal);if(!v)throw d("not_authorized","Reconnect this application to continue.");e=v,u=await this.shouldAttemptDirect(e);try{f=await this.sendOperation(e,n,o,u,r,i,p,l)}catch(R){throw Ot(R,i.signal,p!==void 0&&this.storedPendingMutation(p)!==null?p:void 0,e.authority?"hosted_provider_unavailable":"relay_unavailable")}h=f.response}let b=v=>qi({error:v,attempt:f,completedRetries:c,signal:i.signal,knownRejectedMutationRetry:l,clearPending:R=>this.clearPendingMutation(R),retry:(R,T)=>this.performOperationWithinBudget(n,o,i,R,s,c+1,T)}),C;try{C=await Wi(h,e.authority!==void 0)}catch(v){throw f.pendingMutation?V(f.requestId,v):v}let y=C.body;if(!h.ok){let v=C.httpError??D(y,"operation_failed","Collection operation failed.",h.status),R=await b(v);if(R.retried)return R.result;if(v.code==="fresh_request_required"&&!f.pendingMutation&&!s)return this.performOperationWithinBudget(n,o,i,void 0,!0);throw f.pendingMutation&&v.outcomeUnknown?v:f.pendingMutation&&(f.directDeliveryUncertain||f.encryptedRequest&&f.resumingMutation)?V(f.requestId,v):(f.pendingMutation&&!f.directDeliveryUncertain&&this.clearPendingMutation(f.requestId),v.code==="direct_operation_rejected"&&v.status===403&&this.invalidateRejectedAuthorization(e),v)}if(f.encryptedRequest){let v=y?.envelope,R=f.pendingMutationRecord,T=R?.encryption??e.encryption,A=R?.grantId??e.grantId,O=R?.applicationId??e.clientId,P=R?.keyHandle??e.keyHandle;if(!v||!T||!A||!P)throw f.pendingMutation?V(f.requestId,new Error("Encrypted operation response was missing its envelope.")):d("invalid_encrypted_response","The relay did not return an encrypted connector response.");try{let q=await xe(this.keyStore,P,{grantId:A,applicationId:O,encryption:T},f.encryptedRequest,v);if(!q.ok&&q.problem.code==="fresh_request_required"&&!f.pendingMutation&&!s)return this.performOperationWithinBudget(n,o,i,void 0,!0);if(!q.ok){let G=jo(q.problem);throw f.pendingMutation&&!G.outcomeUnknown&&this.clearPendingMutation(f.requestId),G}return f.pendingMutation&&this.clearPendingMutation(f.requestId),q.result}catch(q){throw q instanceof _?q:q instanceof x?f.pendingMutation?V(f.requestId,q):F(q.code,q.message):q}}let S=f.pendingMutationRecord?.request?.protocol_version??H;if(y?.protocol_version!==S||y?.request_id!==f.requestId)throw f.pendingMutation?V(f.requestId,new Error("Operation response protocol or request ID did not match.")):d("invalid_operation_response","The collection authority returned a response for a different protocol request.");if(y.ok===!1){if(!Je(y.problem))throw f.pendingMutation?V(f.requestId,new Error("Operation rejection did not contain a canonical problem.")):d("invalid_operation_response","The collection authority returned an invalid operation problem.");let v=new _(y.problem),R=await b(v);if(R.retried)return R.result;throw f.pendingMutation&&!v.outcomeUnknown&&this.clearPendingMutation(f.requestId),v}if(y.ok!==!0||!("result"in y))throw f.pendingMutation?V(f.requestId,new Error("Successful operation response did not contain a result.")):d("invalid_operation_response","The collection authority returned an incomplete operation response.");return f.pendingMutation&&this.clearPendingMutation(f.requestId),y.result}async performAuthoritySyncRequest(e,n,o,i,r,a={}){return j(a,this.timeouts.syncMs,async s=>{let c=this.grantKeyLeases();try{let l=await K(()=>this.currentToken(),c,s.signal);l&&await this.authorizedToken({signal:s.signal,timeoutMs:null}),l=await K(()=>this.currentToken(),c,s.signal),Ji(l,e,n);let u=await Ln(this.keyStore,l,o,i,r,s.signal);u.status===401&&l.refreshToken&&(l=await this.refreshAuthorization({signal:s.signal,timeoutMs:null}),l=await K(()=>this.currentToken(),c,s.signal),Ji(l,e,n),u=await Ln(this.keyStore,l,o,i,r,s.signal));let p=await E(u,"invalid_operation_response","The collection authority returned an invalid synchronization response.");if(!u.ok)throw D(p,"sync_failed","Collection synchronization failed.",u.status);return p}catch(l){let u=o==="POST"&&i==="mutations"&&r&&typeof r=="object"&&typeof r.mutation_id=="string"?r.mutation_id:void 0;throw Ot(l,s.signal,u,"hosted_provider_unavailable")}finally{c.release()}})}async sendOperation(e,n,o,i,r,a={},s,c=!1){let l=o??{},u,p=!1,f=!1,h=s??crypto.randomUUID(),m=null,b;if(s!==void 0){if(m=this.storedPendingMutation(s),b=m?.inputFingerprint??await Wo(n,o),m){if(m.collectionId!==e.collectionId||m.operation!==n||m.inputFingerprint!==b)throw d("pending_mutation_unresolved","A previous write still has an unknown outcome. Retry that exact write before making another change.");h=m.requestId,f=!c}p=!0}let C=m?.mutation??ce(n,o);if(m?.envelope&&(e.authority||!e.encryption))throw d("pending_mutation_unresolved","The pending write requires its encrypted relay authority. Reconnect that authority before recovery.");if(m?.request&&e.encryption&&!e.authority)throw d("pending_mutation_unresolved","The pending write belongs to a different authority transport. Reconnect that authority before recovery.");if(e.encryption&&!e.authority){if(!e.grantId||!e.keyHandle)throw d("missing_grant_key","Reconnect this application to restore encrypted access.");try{if(p)if(m){if(!m.envelope)throw d("pending_mutation_unresolved","The pending write belongs to a different transport. Reconnect before retrying it.");u=No(m.envelope,a.deadlineUnixMs)}else u=await ne(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,o,h,a.deadlineUnixMs),this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},keyId:e.encryption.key_id,keyHandle:e.keyHandle,applicationId:e.clientId,encryption:e.encryption,operation:n,mutation:C,inputFingerprint:b,requestId:h,envelope:u,createdAt:Date.now()});else u=await ne(this.keyStore,e.keyHandle,{grantId:e.grantId,applicationId:e.clientId,encryption:e.encryption},n,o,void 0,a.deadlineUnixMs)}catch(T){throw T instanceof x?F(T.code,T.message):T}h=u.request_id,l=u}else{let T=m?.request??{protocol_version:H,request_id:h,input:l};l=T,p&&!m&&this.pendingMutationStore.store({collectionId:e.collectionId,...e.grantId?{grantId:e.grantId}:{},operation:n,mutation:C,inputFingerprint:b,requestId:h,request:T,createdAt:Date.now()})}if(i&&u&&!e.authority){let T=!1;try{let P=await fetch(`${this.loopbackUrl}/v1/operations`,fe({method:"POST",headers:{"content-type":"application/mdbase-connect+json"},body:JSON.stringify(u),signal:a.signal}));if(!Ee(P.status)||await Ke(P))return P.ok&&(this.markDirectAvailable(),this.setRoute("direct")),{response:P,requestId:h,encryptedRequest:u,pendingMutation:p,...p?{pendingMutationRecord:m??this.storedPendingMutation(h)??void 0}:{},resumingMutation:f};T=P.status>=500,this.markDirectUnavailable()}catch(P){if(a.signal?.aborted)throw p?V(h,P):P;T=!0,await rt()==="denied"?this.setDirectStatus("denied"):this.markDirectUnavailable()}let A;try{e.expiresAt<=Date.now()+3e4&&await this.refreshAuthorization({signal:a.signal,timeoutMs:null});let P=await K(()=>this.currentToken(),r,a.signal);if(!P)throw d("not_authorized","Reconnect this application to continue.");A=P}catch(P){throw p&&(T||f)?V(h,P):P}let O;p||(u=await Gi(this.keyStore,A,n,o,a.deadlineUnixMs),h=u.request_id);try{O=await fetch(`${this.serverUrl}/v1/authorities/${encodeURIComponent(A.collectionId)}/operations/${n}`,{method:"POST",headers:{authorization:`Bearer ${A.accessToken}`,"content-type":"application/json"},body:JSON.stringify(u),signal:a.signal})}catch(P){throw p?V(h,P):P}return O.ok&&this.setRoute("relay"),{response:O,requestId:h,encryptedRequest:u,directDeliveryUncertain:T,pendingMutation:p,...p?{pendingMutationRecord:m??this.storedPendingMutation(h)??void 0}:{},resumingMutation:f}}let y=e.authority?`${e.authority.operationsUrl}/${n}`:`${this.serverUrl}/v1/authorities/${encodeURIComponent(e.collectionId)}/operations/${n}`,S=JSON.stringify(l),v=e.authority?await Se(this.keyStore,e,"POST",y,S,e.authority.accessToken):{},R;try{R=await Ko(y,e.authority?.accessToken??e.accessToken,v,S,a.signal)}catch(T){throw p?V(h,T):T}return R.ok&&this.setRoute(e.authority?"remote":"relay"),{response:R,requestId:h,encryptedRequest:u,pendingMutation:p,...p?{pendingMutationRecord:m??this.storedPendingMutation(h)??void 0}:{},resumingMutation:f}}directCapable(e){return Hi(e,this.directAccessMode)}hasResumableMutationTransport(){return this.currentToken()!==null}directEligible(e){return e!==null&&this.directCapable(e)&&this.storage.getItem(this.internals.directPreferenceKey())!=="disabled"}async shouldAttemptDirect(e){if(!this.directEligible(e))return!1;if(this.directStatus==="available")return!0;if(this.directStatus==="unavailable"&&Date.now()<this.directRetryAt)return!1;let n=await rt();return n==="denied"?(this.setDirectStatus("denied"),!1):(n==="prompt"||n===null)&&this.storage.getItem(this.internals.directPreferenceKey())!=="enabled"?(this.setDirectStatus("permission_required"),!1):(this.setDirectStatus("checking"),!0)}async probeDirectAccess(e){return this.setDirectStatus("checking"),await $i(this.loopbackUrl,H,e)?(this.markDirectAvailable(),"available"):await rt()==="denied"?this.setDirectStatus("denied"):(this.markDirectUnavailable(),"unavailable")}markDirectAvailable(){this.directFailures=0,this.directRetryAt=0,this.setDirectStatus("available")}markDirectUnavailable(){this.directFailures+=1,this.directRetryAt=Date.now()+Math.min(6e4,1e3*2**(this.directFailures-1)),this.setDirectStatus("unavailable")}setDirectStatus(e){return this.directStatus!==e&&(this.directStatus=e,this.emitConnection()),e}setRoute(e){this.currentRoute!==e&&(this.currentRoute=e,this.emitConnection())}emitConnection(){this.onChange()}invalidateRejectedAuthorization(e){let n=M(this.storage.getItem(this.internals.tokenKey(this.collectionId)));!n||!Bo(n,e)||(this.internals.removeToken(this.collectionId,n.keyHandle),this.currentRoute="relay",this.directStatus=this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection())}currentToken(){return Vi({stored:this.storage.getItem(this.internals.tokenKey(this.collectionId)),collectionId:this.collectionId,relayEncryption:this.internals.relayEncryption,invalidate:e=>this.internals.removeToken(this.collectionId,e,"invalid_stored_grant"),directCapable:e=>this.directCapable(e)})}async authorizedToken(e={}){let n=this.currentToken();if(!n)return null;if(n.expiresAt>Date.now()+3e4)return n;if(!n.refreshToken||(n.refreshExpiresAt??0)<=Date.now()){if(this.directCapable(n))throw d("relay_authorization_expired","Direct access is still available on this computer, but using the relay requires reconnecting this application.");return this.internals.removeToken(this.collectionId,n.keyHandle),null}return this.refreshAuthorization(e)}refreshAuthorization(e={}){return this.refreshOperations.run("refresh",e,this.timeouts.requestMs,n=>this.performRefresh(n))}async performRefresh(e){let n=this.grantKeyLeases();try{let o=await K(()=>this.currentToken(),n,e);return await ji({current:o,serverUrl:this.serverUrl,keyStore:this.keyStore,signal:e,currentToken:()=>this.currentToken(),directCapable:i=>this.directCapable(i),removeToken:i=>this.internals.removeToken(this.collectionId,i),storeTokenResponse:(i,r,a)=>this.storeTokenResponse(i,r,a)})}finally{n.release()}}storeTokenResponse(e,n,o){if(e.collection_id!==this.collectionId)throw d("collection_mismatch","The refreshed authorization belongs to a different collection.");let i=this.internals.storeTokenResponse(e,n,o);return this.currentRoute=i.authority?"remote":"relay",this.directStatus=i.authority||this.directAccessMode==="disabled"?"disabled":"unavailable",this.emitConnection(),i}storedPendingMutations(){return this.pendingMutationStore.list(this.currentToken()?.collectionId??null)}storedPendingMutation(e){return this.pendingMutationStore.find(this.currentToken()?.collectionId??null,e)}clearPendingMutation(e){let n=this.pendingMutationStore.take(e);n?.keyHandle&&this.internals.deleteGrantKeyWhenUnused(this.collectionId,n.keyHandle)}grantKeyLeases(){return new he(this.collectionId,(e,n,o)=>this.internals.acquireGrantKeyLease(e,n,o))}};function Ji(t,e,n){if(!(t?.authority&&t.collectionId===e&&t.authority.replicaId===n))throw d("authority_authorization_changed","Reconnect this collection authority before synchronizing.")}var zs=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]),Us=new Uint32Array([1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225]),Re=class{state=Us.slice();block=new Uint8Array(64);words=new Uint32Array(64);blockLength=0;byteLength=0;finished=!1;update(e){if(this.finished)throw new Error("SHA-256 digest is already finalized.");if(this.byteLength+=e.byteLength,!Number.isSafeInteger(this.byteLength))throw new Error("SHA-256 input exceeds the safe browser byte range.");let n=0;if(this.blockLength>0){let o=Math.min(64-this.blockLength,e.byteLength);this.block.set(e.subarray(0,o),this.blockLength),this.blockLength+=o,n+=o,this.blockLength===64&&(this.compress(this.block),this.blockLength=0)}for(;n+64<=e.byteLength;)this.compress(e.subarray(n,n+64)),n+=64;return n<e.byteLength&&(this.block.set(e.subarray(n),0),this.blockLength=e.byteLength-n),this}digestHex(){if(this.finished)throw new Error("SHA-256 digest is already finalized.");this.finished=!0,this.block[this.blockLength]=128,this.block.fill(0,this.blockLength+1),this.blockLength>=56&&(this.compress(this.block),this.block.fill(0));let e=this.byteLength*8,n=Math.floor(e/4294967296),o=e>>>0;return Qi(this.block,56,n),Qi(this.block,60,o),this.compress(this.block),[...this.state].map(i=>i.toString(16).padStart(8,"0")).join("")}compress(e){let n=this.words;for(let p=0;p<16;p+=1){let f=p*4;n[p]=(e[f]<<24|e[f+1]<<16|e[f+2]<<8|e[f+3])>>>0}for(let p=16;p<64;p+=1){let f=n[p-15],h=n[p-2],m=Z(f,7)^Z(f,18)^f>>>3,b=Z(h,17)^Z(h,19)^h>>>10;n[p]=n[p-16]+m+n[p-7]+b>>>0}let o=this.state[0],i=this.state[1],r=this.state[2],a=this.state[3],s=this.state[4],c=this.state[5],l=this.state[6],u=this.state[7];for(let p=0;p<64;p+=1){let f=Z(s,6)^Z(s,11)^Z(s,25),h=s&c^~s&l,m=u+f+h+zs[p]+n[p]>>>0,b=Z(o,2)^Z(o,13)^Z(o,22),C=o&i^o&r^i&r,y=b+C>>>0;u=l,l=c,c=s,s=a+m>>>0,a=r,r=i,i=o,o=m+y>>>0}this.state[0]=this.state[0]+o>>>0,this.state[1]=this.state[1]+i>>>0,this.state[2]=this.state[2]+r>>>0,this.state[3]=this.state[3]+a>>>0,this.state[4]=this.state[4]+s>>>0,this.state[5]=this.state[5]+c>>>0,this.state[6]=this.state[6]+l>>>0,this.state[7]=this.state[7]+u>>>0}};function Z(t,e){return t>>>e|t<<32-e}function Qi(t,e,n){t[e]=n>>>24,t[e+1]=n>>>16,t[e+2]=n>>>8,t[e+3]=n}var Yt=class{constructor(e,n){this.signal=n;this.iterator=Ls(e)}signal;iterator;remainder=new Uint8Array;remainderOffset=0;maxSourceChunkBytes=null;iteratorClosing=!1;ended=!1;setMaxSourceChunkBytes(e){this.maxSourceChunkBytes=e}async read(e){let n=new Uint8Array(e),o=0;for(;o<e;){if(this.remainderOffset===this.remainder.byteLength){let r=await this.nextSourceChunk();if(r.done)throw this.ended=!0,d("invalid_request","Streamed file bytes ended before the declared size.");if(!(r.value instanceof Uint8Array))throw d("invalid_request","A streamed file chunk was not a Uint8Array.");if(this.maxSourceChunkBytes===null)throw new Error("Stream source was read before upload negotiation completed.");if(r.value.byteLength>this.maxSourceChunkBytes)throw d("invalid_request",`A streamed file chunk exceeded the negotiated ${this.maxSourceChunkBytes}-byte upload part size.`);if(this.remainder=r.value,this.remainderOffset=0,this.remainder.byteLength===0)continue}let i=Math.min(e-o,this.remainder.byteLength-this.remainderOffset);n.set(this.remainder.subarray(this.remainderOffset,this.remainderOffset+i),o),o+=i,this.remainderOffset+=i}return n}async expectEnd(){if(this.remainderOffset<this.remainder.byteLength)throw d("invalid_request","Streamed file bytes exceed the declared size.");for(;!this.ended;){let e=await this.nextSourceChunk();if(e.done){this.ended=!0;return}if(!(e.value instanceof Uint8Array))throw d("invalid_request","A streamed file chunk was not a Uint8Array.");if(e.value.byteLength>0)throw d("invalid_request","Streamed file bytes exceed the declared size.")}}async close(){this.ended=!0,this.closeIterator()}async nextSourceChunk(){Yi(this.signal);let e=this.iterator.next(),n=this.signal;if(!n)return e;let o=()=>{},i=new Promise((r,a)=>{let s=()=>{this.closeIterator(),a(Xi(n))};n.addEventListener("abort",s,{once:!0}),o=()=>n.removeEventListener("abort",s),n.aborted&&s()});try{let r=await Promise.race([e,i]);return Yi(n),r}finally{o()}}closeIterator(){if(!this.iteratorClosing){this.iteratorClosing=!0;try{this.iterator.return?.()?.catch(()=>{})}catch{}}}};function Ls(t){if(typeof t.getReader=="function"){let n=t.getReader(),o=!1,i=()=>{o||(o=!0,n.releaseLock())};return{async next(){if(o)return{done:!0,value:void 0};let r=await n.read();return r.done&&i(),r},async return(){if(!o)try{await n.cancel()}finally{i()}return{done:!0,value:void 0}}}}let e=t;if(typeof e[Symbol.asyncIterator]!="function")throw d("invalid_request","Streamed files require a readable byte stream.");return e[Symbol.asyncIterator]()}function Yi(t){if(t?.aborted)throw Xi(t)}function Xi(t){return d("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t?.reason})}var Zi=1024*1024,Ns=4,er=8,ft=3,Nn=64*1024*1024,tr=/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu,nr=/^sha256:[0-9a-f]{64}$/u;async function or(t,e,n){let o=new Re;for(let i=0;i<t.size;i+=Zi){ye(e);let r=new Uint8Array(await t.slice(i,i+Zi).arrayBuffer());o.update(r),n(Math.min(t.size,i+r.byteLength))}return t.size===0&&n(0),o.digestHex()}function ir(t,e){if(t instanceof Blob)return e&&e!==t.type?t.slice(0,t.size,e):t;if(t instanceof ArrayBuffer)return new Blob([t],{type:e});let n=new Uint8Array(t.byteLength);return n.set(new Uint8Array(t.buffer,t.byteOffset,t.byteLength)),new Blob([n.buffer],{type:e})}function rr(t){return t instanceof Blob?t.size:t.byteLength}async function ar(t){return t instanceof Blob?new Uint8Array(await t.arrayBuffer()):t}function Bn(t=Ns){if(!Number.isInteger(t)||t<1||t>er)throw d("invalid_request",`File concurrency must be between 1 and ${er}.`);return t}function sr(t){if(!Number.isInteger(t)||t<1||t>1e3)throw d("invalid_request","File page size must be between 1 and 1000.");return t}function jn(t,e,n){if(t.protocol_version!==1||t.type!=="file_transfer"||t.transfer_id!==e||t.direction!==n||!Number.isSafeInteger(t.total_size)||t.total_size<0||!Array.isArray(t.received)||!Bs(t))throw d("invalid_operation_response","The authority returned an invalid file transfer session.");let o=t.strategy.kind==="framed_chunks"?t.strategy.chunk_size:t.strategy.kind==="object_put"?Math.max(1,t.total_size):t.strategy.part_size,i=t.strategy.kind==="object_put"?1:Math.ceil(t.total_size/o);if(new Set(t.received).size!==t.received.length||t.received.some(a=>!Number.isSafeInteger(a)||a<0||a>=i))throw d("invalid_operation_response","The authority returned invalid transfer progress.");let r=t.uploaded_parts??[];if(!Array.isArray(r)||r.some((a,s)=>!Number.isSafeInteger(a?.part_number)||a.part_number<1||a.part_number>i||typeof a.etag!="string"||a.etag.length===0||a.etag.length>255||s>0&&r[s-1].part_number>=a.part_number)||(t.strategy.kind==="object_multipart"?r.length!==t.received.length||r.some((a,s)=>a.part_number-1!==t.received[s]):r.length!==0))throw d("invalid_operation_response","The authority returned invalid uploaded part receipts.")}function cr(t,e){let n=e.strategy.kind==="framed_chunks"?e.strategy.chunk_size:e.strategy.kind==="object_put"?Math.max(1,e.total_size):e.strategy.part_size,o=e.strategy.kind==="object_put"?1:Math.ceil(e.total_size/n);if(t?.protocol_version!==1||t.type!=="file_transfer_status"||t.transfer_id!==e.transfer_id||!["open","committed","aborted","expired"].includes(t.state)||!Array.isArray(t.received)||new Set(t.received).size!==t.received.length||t.received.some(r=>!Number.isSafeInteger(r)||r<0||r>=o)||!Number.isSafeInteger(t.received_bytes)||t.received_bytes<0||t.received_bytes>e.total_size||t.received.reduce((r,a)=>r+Kn(e.total_size,n,a),0)!==t.received_bytes)throw d("invalid_operation_response","The authority returned invalid transfer status.");let i=t.uploaded_parts;if(!Array.isArray(i)||i.some((r,a)=>!Number.isSafeInteger(r?.part_number)||r.part_number<1||r.part_number>o||typeof r.etag!="string"||r.etag.length===0||r.etag.length>255||a>0&&i[a-1].part_number>=r.part_number)||(e.strategy.kind==="object_multipart"?i.length!==t.received.length||i.some((r,a)=>r.part_number-1!==t.received[a]):i.length!==0))throw d("invalid_operation_response","The authority returned invalid uploaded part status.")}function Bs(t){return t.strategy.kind==="framed_chunks"?t.protection==="grant_aead_v1"&&Number.isSafeInteger(t.strategy.chunk_size)&&t.strategy.chunk_size>0:t.protection!=="transport_tls"?!1:t.strategy.kind==="object_put"?!0:Number.isSafeInteger(t.strategy.part_size)&&t.strategy.part_size>0}function Kn(t,e,n){return Math.min(e,Math.max(0,t-n*e))}async function Xt(t,e){for(let n=1;n<=Dn;n+=1){ye(e);try{return await t()}catch(o){if(e?.aborted||n===Dn||o instanceof _&&!o.retryable)throw o;await Di(n,e)}}throw new Error("Unreachable file chunk retry state.")}function lr(t,e,n,o,i,r){let a;try{a=new URL(t.url)}catch{throw d("invalid_operation_response","The authority returned an invalid object URL.")}if(t.protocol_version!==1||t.type!=="file_part"||t.transfer_id!==e||t.part_index!==n||t.offset!==o||t.content_length!==i||t.method.toUpperCase()!==r||a.protocol!=="https:"&&!(a.protocol==="http:"&&["localhost","127.0.0.1","[::1]","::1"].includes(a.hostname))||a.username||a.password)throw d("invalid_operation_response","The authority returned an invalid prepared file part.")}function dr(t){let e=new Headers;for(let[n,o]of Object.entries(t))["host","content-length"].includes(n.toLowerCase())||e.set(n,o);return e}async function ur(t,e,n){let o=new Array(t),i=0;return await Promise.all(Array.from({length:Math.min(t,e)},async()=>{for(;i<t;){let r=i;i+=1,o[r]=await n(r)}})),o}function ye(t){if(t?.aborted)throw d("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t.reason})}function Pe(t){return t instanceof _?t:typeof DOMException<"u"&&t instanceof DOMException&&t.name==="AbortError"?d("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:t}):d("temporarily_unavailable","The file transfer could not be completed.",{cause:t})}var He=class{constructor(e,n,o,i,r=ke()){this.capability=e;this.request=n;this.framed=o;this.hosted=i;this.timeouts=r}capability;request;framed;hosted;timeouts;async*list(e={}){let n=ue(e,this.timeouts.fileIndexMs),o=n.signal;try{this.requireAction("list");let i;do{ye(o);let r=new URLSearchParams({protocol_version:String(1),...e.folder?{folder:e.folder}:{},...i?{after:i}:{},...e.pageSize?{limit:String(sr(e.pageSize))}:{}}),a;for(;;)try{a=await this.request("GET",`?${r.toString()}`,void 0,o);break}catch(s){let c=Pe(s);if(c.code!=="file_index_warming")throw c;e.onIndexing?.(),await Q(500,o)}if(a.protocol_version!==1||a.type!=="files_page"||!Array.isArray(a.files))throw d("invalid_operation_response","The authority returned an invalid file page.");for(let s of a.files)ye(o),yield Zt(s);i=a.next}while(i)}finally{n.dispose()}}async upload(e,n,o={}){return j(o,this.timeouts.uploadMs,i=>this.uploadWithinBudget(e,n,{...o,signal:i.signal,timeoutMs:null}))}async uploadWithinBudget(e,n,o){this.requireAction(o.ifRevision?"replace":"add");let i=ir(n,o.mediaType),r=Bn(o.concurrency),a=await or(i,o.signal,s=>{o.onProgress?.({phase:"hashing",transferredBytes:s,totalBytes:i.size})});return this.uploadKnownSource(e,i.size,`sha256:${a}`,(o.mediaType??i.type)||void 0,o,r,async(s,c,l)=>i.slice(c,c+l))}async uploadStream(e,n,o={}){return j(o,this.timeouts.uploadMs,i=>this.uploadStreamWithinBudget(e,n,{...o,signal:i.signal,timeoutMs:null}))}async uploadStreamWithinBudget(e,n,o){if(this.requireAction(o.ifRevision?"replace":"add"),!Number.isSafeInteger(n.size)||n.size<0)throw d("invalid_request","Streamed file size must be a non-negative safe integer.");if(!nr.test(n.contentDigest))throw d("invalid_request","Streamed files require a lowercase SHA-256 content digest.");let i=new Yt(n.stream,o.signal),r=new Re;return this.uploadKnownSource(e,n.size,n.contentDigest,o.mediaType??n.mediaType,o,1,async(a,s,c)=>{let l=await i.read(c);return r.update(l),l},async()=>{if(await i.expectEnd(),`sha256:${r.digestHex()}`!==n.contentDigest)throw d("invalid_request","Streamed file bytes do not match the declared SHA-256 digest.")},()=>i.close(),a=>i.setMaxSourceChunkBytes(a))}async uploadKnownSource(e,n,o,i,r,a,s,c,l,u){let p=r.transferId??crypto.randomUUID();if(!tr.test(p))throw d("invalid_request","File transfer ID must be a UUID.");let f=!1;try{let h=await this.request("POST","uploads",{protocol_version:1,type:"open_file_upload",transfer_id:p,path:e,size:n,content_digest:o,...i?{media_type:i}:{},...r.ifRevision?{if_revision:r.ifRevision}:{}},r.signal);if(jn(h,p,"upload"),h.total_size!==n||h.strategy.kind==="object_ranges")throw d("invalid_operation_response","The authority returned an incompatible upload strategy.");let m=h.strategy.kind==="framed_chunks";if(m&&!this.framed)throw d("invalid_operation_response","Encrypted file chunk delivery is unavailable.");let b=h.strategy.kind==="object_put"?Math.max(1,n):h.strategy.kind==="framed_chunks"?h.strategy.chunk_size:h.strategy.part_size,C=h.strategy.kind==="object_put"?1:Math.ceil(n/b),y=await this.request("GET",`transfers/${encodeURIComponent(p)}`,void 0,r.signal);if(cr(y,h),y.state!=="open"&&y.state!=="committed")throw d("invalid_operation_response",`The authority cannot resume a ${y.state} file transfer.`);if(u?.(b),!m&&y.received.length===C){let O=await this.tryReplayUploadCommit(p,h.strategy.kind==="object_multipart"?y.uploaded_parts:void 0,r.signal);if(O)return f=!0,Zt(O.file)}let S=new Set(y.received),v=new Map(y.uploaded_parts.map(O=>[O.part_number-1,O])),R=[...S].reduce((O,P)=>O+Kn(n,b,P),0),T=await ur(C,a,async O=>{let P=O*b,q=Math.min(b,Math.max(0,n-P)),G=await s(O,P,q);if(rr(G)!==q)throw d("invalid_request","Streamed file bytes ended before the declared size.");if(S.has(O))return v.get(O)??null;let ee=m?await Xt(async()=>this.framed.uploadChunk(h,O,await ar(G),r.signal),r.signal).then(()=>null):await this.uploadPart(p,O,P,G,q,h.strategy.kind==="object_multipart",r.signal);return R+=q,r.onProgress?.({phase:"uploading",transferredBytes:R,totalBytes:n}),ee});await c?.();let A=await this.commitUpload(p,h.strategy.kind==="object_multipart"?T.filter(O=>O!==null):void 0,r.signal);if(A.protocol_version!==1||A.type!=="file_upload_committed"||A.transfer_id!==p||A.file.path!==e||A.file.size!==n||A.file.content_digest!==o)throw d("invalid_operation_response","The authority returned an invalid file receipt.");return f=!0,Zt(A.file)}catch(h){throw Pe(h)}finally{await l?.().catch(()=>{}),!f&&r.transferId===void 0&&await this.abort(p)}}async download(e,n={}){if(e.size>Nn)throw d("invalid_request",`download() buffers at most ${Nn} bytes; use downloadStream() for larger files.`);let o=await this.downloadStream(e,n),i=[],r=o.getReader();for(;;){let a=await r.read();if(a.done)break;i.push(a.value)}return new Blob(i.map(a=>{let s=new Uint8Array(a.byteLength);return s.set(a),s.buffer}),{type:e.mediaType??""})}async downloadStream(e,n={}){return j(n,this.timeouts.requestMs,o=>this.openDownloadStream(e,n,o.signal))}async openDownloadStream(e,n,o){this.requireAction("read");let i=Bn(n.concurrency),r=crypto.randomUUID(),a;try{if(a=await this.request("POST","downloads",{protocol_version:1,type:"open_file_download",transfer_id:r,file_id:e.fileId,revision:e.revision},o),jn(a,r,"download"),a.total_size!==e.size||a.strategy.kind!=="object_ranges"&&a.strategy.kind!=="framed_chunks")throw d("invalid_operation_response","The authority returned an incompatible download session.");if(a.strategy.kind==="framed_chunks"&&!this.framed)throw d("invalid_operation_response","Encrypted file chunk delivery is unavailable.");if(a.strategy.kind==="object_ranges"&&e.size>0&&!this.hosted)throw d("invalid_operation_response","Authenticated hosted file delivery is unavailable.")}catch(A){throw await this.abort(r),Pe(A)}let s=a.strategy.kind==="framed_chunks"?a.strategy.chunk_size:a.strategy.part_size,c=Math.ceil(e.size/s),l=new Re,u=0,p=0,f=null,h=0,m=!1,b=new AbortController,C=n.signal?AbortSignal.any([n.signal,b.signal]):b.signal,y=new Map,S=0,v=()=>{if(a.strategy.kind==="framed_chunks")for(;S<c&&y.size<i;){let A=S;S+=1;let O=Xt(()=>this.framed.downloadChunk(a,A,C),C).then(P=>({ok:!0,chunk:P}),P=>({ok:!1,error:P}));y.set(A,O)}},R=async()=>{m||(m=!0,b.abort(),await f?.cancel().catch(()=>{}),f=null,await Promise.all(y.values()),y.clear(),await this.abort(r))},T=()=>{if(h!==e.size||`sha256:${l.digestHex()}`!==e.contentDigest)throw d("invalid_operation_response","Downloaded file bytes failed integrity verification.")};return new ReadableStream({pull:async A=>{try{if(ye(C),a.strategy.kind==="object_ranges")for(;;){if(!f){if(u>=c){T(),A.close(),R();return}let Mr=u*s;p=Math.min(s,e.size-Mr),f=(await Xt(()=>this.hosted.downloadPart(a,u,p,C),C)).getReader()}let se=await f.read();if(se.done){if(f.releaseLock(),f=null,p!==0)throw d("invalid_operation_response","A hosted file range ended before its declared byte length.");u+=1;continue}if(!(se.value instanceof Uint8Array))throw d("invalid_operation_response","A hosted file range returned a non-byte chunk.");if(se.value.byteLength!==0){if(se.value.byteLength>p)throw d("invalid_operation_response","A hosted file range exceeded its declared byte length.");p-=se.value.byteLength,l.update(se.value),h+=se.value.byteLength,n.onProgress?.({phase:"downloading",transferredBytes:h,totalBytes:e.size}),A.enqueue(se.value);return}}if(u>=c){T(),A.close(),R();return}let O=u*s,P=Math.min(s,e.size-O);v();let q=y.get(u);if(!q)throw d("invalid_operation_response","A file chunk was not scheduled.");let G=await q;if(y.delete(u),!G.ok)throw G.error;let ee=G.chunk;if(ee.byteLength!==P)throw d("invalid_operation_response","A file chunk had the wrong byte length.");l.update(ee),h+=ee.byteLength,u+=1,v(),n.onProgress?.({phase:"downloading",transferredBytes:h,totalBytes:e.size}),u===c&&T(),A.enqueue(ee),u===c&&(A.close(),R())}catch(O){let P=n.signal?.aborted?d("operation_cancelled","The file transfer was cancelled.",{operationOutcome:"not_sent",cause:n.signal.reason}):O;await R(),A.error(Pe(P))}},cancel:R})}async downloadBytes(e,n={}){return new Uint8Array(await(await this.download(e,n)).arrayBuffer())}async move(e,n,o={}){return j(o,this.timeouts.requestMs,i=>this.moveWithinBudget(e,n,{...o,signal:i.signal,timeoutMs:null}))}async moveWithinBudget(e,n,o){this.requireAction("move");let i=o.mutationId??crypto.randomUUID(),r;try{r=await this.request("POST",`${encodeURIComponent(e.fileId)}/move`,{protocol_version:1,type:"move_file",mutation_id:i,file_id:e.fileId,if_revision:o.ifRevision??e.revision,from_path:e.path,path:n,update_references:!1},o.signal)}catch(a){throw Pe(a)}if(r.protocol_version!==1||r.type!=="file_moved"||r.mutation_id!==i||r.file.file_id!==e.fileId||r.file.path!==n)throw d("invalid_operation_response","The authority returned an invalid file move receipt.");return Zt(r.file)}async delete(e,n={}){return j(n,this.timeouts.requestMs,o=>this.deleteWithinBudget(e,{...n,signal:o.signal,timeoutMs:null}))}async deleteWithinBudget(e,n){this.requireAction("delete");let o=n.mutationId??crypto.randomUUID(),i;try{i=await this.request("POST",`${encodeURIComponent(e.fileId)}/delete`,{protocol_version:1,type:"delete_file",mutation_id:o,file_id:e.fileId,if_revision:n.ifRevision??e.revision,path:e.path},n.signal)}catch(r){throw Pe(r)}if(i.protocol_version!==1||i.type!=="file_deleted"||i.mutation_id!==o||i.file_id!==e.fileId||i.previous_path!==e.path)throw d("invalid_operation_response","The authority returned an invalid file delete receipt.");return{protocolVersion:i.protocol_version,type:i.type,mutationId:i.mutation_id,fileId:i.file_id,previousPath:i.previous_path,revision:i.revision}}async uploadPart(e,n,o,i,r,a,s){for(let c=1;c<=ft;c+=1){ye(s);try{let l=await this.request("POST",`uploads/${encodeURIComponent(e)}/parts`,{protocol_version:1,type:"prepare_file_upload_part",transfer_id:e,part_number:n+1,content_length:r},s);lr(l,e,n,o,r,"PUT");let u=await fetch(l.url,{method:l.method,headers:dr(l.headers),body:i,redirect:"error",signal:s});if(!u.ok)throw new Error(`Object upload failed with HTTP ${u.status}.`);let p=u.headers.get("etag");if(a&&!p)throw new Error("Multipart object upload did not return an ETag.");return{part_number:n+1,etag:p??""}}catch(l){if(s?.aborted||c===ft)throw l}}throw new Error("Unreachable upload retry state.")}async tryReplayUploadCommit(e,n,o){try{return await this.commitUpload(e,n,o)}catch(i){if(i instanceof _&&i.code==="file_upload_incomplete")return null;throw i}}async commitUpload(e,n,o){let i;for(let r=1;r<=ft;r+=1){ye(o);try{return await this.request("POST",`uploads/${encodeURIComponent(e)}/commit`,{protocol_version:1,type:"commit_file_upload",transfer_id:e,...n===void 0?{}:{parts:n}},o)}catch(a){if(i=a,o?.aborted||a instanceof _||r===ft)throw a}}throw i}requireAction(e){if(!this.capability()?.actions.includes(e))throw d("not_authorized",`This connection is not authorized to ${e} files.`)}async abort(e){await this.request("DELETE",`transfers/${encodeURIComponent(e)}`).catch(()=>{})}};function Zt(t){return{fileId:t.file_id,path:t.path,revision:t.revision,contentDigest:t.content_digest,size:t.size,...t.media_type?{mediaType:t.media_type}:{},mediaClass:t.media_class,modifiedAt:t.modified_at}}var js=4,pr=32,en=class{constructor(e,n,o={}){this.transport=e;this.requestTimeoutMs=n;this.foregroundCapacity=Vn(o.foregroundCapacity,js),this.foregroundQueueCapacity=Vn(o.foregroundQueueCapacity,pr),this.mutationQueueCapacity=Vn(o.mutationQueueCapacity,pr)}transport;requestTimeoutMs;foregroundCapacity;foregroundQueueCapacity;mutationQueueCapacity;foregroundQueue=[];mutationQueue=[];identicalReads=new Map;latestFamilies=new Map;activeForeground=0;mutationActive=!1;operation(e,n,o={}){let i=!le(e,n),r=Ks(o.coordination,i),a=i&&r.coalesce!==!1&&!r.latestWins&&o.signal===void 0?Vs(e,n,o.timeoutMs):void 0;if(a){let c=this.identicalReads.get(a);if(c)return c}let s=j(o,this.requestTimeoutMs,c=>this.schedule(e,n,o,r,i,c));return a&&(this.identicalReads.set(a,s),s.finally(()=>{this.identicalReads.get(a)===s&&this.identicalReads.delete(a)}).catch(()=>{})),s}schedule(e,n,o,i,r,a){let s=i.latestWins?this.replaceLatest(i.family):void 0,c=Gs(a.signal,s?.signal),{coordination:l,...u}=o,p=nt({...u,timeoutMs:null},a),f=()=>this.transport.operation(e,n,{...p,signal:c.signal}),h=r?this.foregroundQueue:this.mutationQueue,m=r?this.foregroundQueueCapacity:this.mutationQueueCapacity;return h.length>=m?(c.dispose(),this.releaseLatest(i.family,s),Promise.reject(d("connector_busy","The selected connection request queue is full.",{operationOutcome:"not_sent",status:503}))):new Promise((b,C)=>{let y={budget:a,run:f,resolve:R=>b(R),reject:C,started:!1,settled:!1},S=()=>{y.started||y.settled||(y.settled=!0,y.reject($(c.signal)),c.dispose(),this.releaseLatest(i.family,s))};c.signal.addEventListener("abort",S,{once:!0});let v=y.run;y.run=async()=>{c.signal.removeEventListener("abort",S);try{if(c.signal.aborted)throw $(c.signal);return await v()}finally{c.dispose(),this.releaseLatest(i.family,s)}},h.push(y),this.pump()})}replaceLatest(e){let n=new AbortController;return this.latestFamilies.get(e)?.abort(d("operation_cancelled","A newer request replaced this read before it changed the collection.",{operationOutcome:"not_sent"})),this.latestFamilies.set(e,n),n}releaseLatest(e,n){e&&n&&this.latestFamilies.get(e)===n&&this.latestFamilies.delete(e)}pump(){for(;this.activeForeground<this.foregroundCapacity;){let e=fr(this.foregroundQueue);if(!e)break;this.activeForeground+=1,this.start(e,()=>{this.activeForeground-=1,this.pump()})}if(!this.mutationActive){let e=fr(this.mutationQueue);e&&(this.mutationActive=!0,this.start(e,()=>{this.mutationActive=!1,this.pump()}))}}start(e,n){e.started=!0,e.run().then(o=>{e.settled||(e.settled=!0,e.resolve(o))},o=>{e.settled||(e.settled=!0,e.reject(o))}).finally(n)}};function fr(t){for(;t.length>0;){let e=t.shift();if(!e.settled)return e}}function Ks(t,e){let n=t??{};if(n.latestWins&&!e)throw new TypeError("latestWins coordination is available only for read operations.");if(n.latestWins&&!n.family?.trim())throw new TypeError("latestWins coordination requires a non-empty family.");return n}function Vs(t,e,n){return`${t}:${n===void 0?"default":String(n)}:${Gn(e)}`}function Gn(t){return t===null||typeof t!="object"?JSON.stringify(t)??String(t):Array.isArray(t)?`[${t.map(Gn).join(",")}]`:`{${Object.entries(t).sort(([e],[n])=>e.localeCompare(n)).map(([e,n])=>`${JSON.stringify(e)}:${Gn(n)}`).join(",")}}`}function Gs(t,e){if(!e)return{signal:t,dispose:()=>{}};let n=new AbortController,o=()=>n.abort(t.reason),i=()=>n.abort(e.reason);return t.aborted?o():t.addEventListener("abort",o,{once:!0}),e.aborted?i():e.addEventListener("abort",i,{once:!0}),{signal:n.signal,dispose:()=>{t.removeEventListener("abort",o),e.removeEventListener("abort",i)}}}function Vn(t,e){let n=t??e;if(!Number.isSafeInteger(n)||n<=0)throw new TypeError("Request coordinator capacities must be positive safe integers.");return n}var $e=class{constructor(e,n){this.internals=e;this.collectionId=n;this.transport=new Qt({serverUrl:e.serverUrl,storage:e.storage,keyStore:e.keyStore,directAccessMode:e.directAccessMode,loopbackUrl:e.loopbackUrl,collectionId:n,internals:e,timeouts:e.timeouts,onChange:()=>this.emitConnection()}),this.files=new He(()=>this.fileCapability,(o,i,r,a)=>this.transport.files.control(o,i,r,a),{uploadChunk:(o,i,r,a)=>this.transport.files.uploadChunk(o,i,r,a),downloadChunk:(o,i,r)=>this.transport.files.downloadChunk(o,i,r)},{downloadPart:(o,i,r,a)=>this.transport.files.downloadHostedPart(o,i,r,a)},e.timeouts),this.collectionClient=new Be(new en({operation:(o,i,r)=>this.transport.performOperation(o,i,r)},e.timeouts.requestMs),e.timeouts.requestMs),this.notifications=new Ft({serverUrl:e.serverUrl,storage:e.storage,authorizedToken:o=>this.transport.authorizedToken({signal:o,timeoutMs:null}),register:o=>this.internals.register({signal:o,timeoutMs:null}),notificationKey:o=>e.notificationKey(n,o),requestTimeoutMs:e.timeouts.requestMs})}internals;collectionId;collectionClient;notifications;transport;files;connectionListeners=new Set;get displayName(){return this.transport.currentToken()?.collectionName??`Collection ${this.collectionId.slice(0,8)}`}get operations(){return[...this.transport.currentToken()?.operations??[]]}get scope(){return this.transport.currentToken()?.scope??null}get fileCapability(){return this.transport.currentToken()?.fileCapability??null}get directAccess(){return this.transport.directAccess}get route(){return this.transport.route}register(e){return z(()=>this.internals.register(e),be)}info(){let e=this.transport.currentToken();return e?{collectionId:e.collectionId,displayName:e.collectionName,operations:[...e.operations],scope:e.scope,...e.fileCapability?{fileCapability:e.fileCapability}:{},authority:e.authority?{kind:"hosted",durability:"provider"}:{kind:"connector",durability:"computer"},route:this.transport.route,directAccess:this.transport.directAccess}:null}authorizationCapabilities(e=ve){let n=this.operations,o=X(e).filter(i=>!n.includes(i));return{authorized:this.info()!==null,sufficient:this.info()!==null&&o.length===0,collectionId:this.collectionId,grantedOperations:n,missingOperations:o}}hasOperations(e){return this.authorizationCapabilities(e).sufficient}authorize(e={}){return z(()=>this.internals.authorize({...e,target:{kind:"collection",collectionId:this.collectionId}}),Oe)}async requestOperations(e,n={}){let o=this.authorizationCapabilities(e);return o.sufficient?I({kind:"unchanged",connection:this}):this.authorize({...n,operations:X([...o.grantedOperations,...o.missingOperations])})}onConnectionChange(e){return this.connectionListeners.add(e),e(this.info()),()=>this.connectionListeners.delete(e)}notifyStorageChanged(){this.transport.notifyStorageChanged()}checkDirectAccess(e){return z(()=>this.transport.checkDirectAccess(e),bn)}requestDirectAccess(e){return z(()=>this.transport.requestDirectAccess(e),bn)}disableDirectAccess(){this.transport.disableDirectAccess()}sync(){let e=this.transport.currentToken();if(!e)return null;let n=e.collectionId;if(!e.authority){if(!e.grantId||!e.operations.includes("sync"))return null;let i=e.grantId;return{collectionId:n,replicaId:i,transport:{openSession:r=>this.transport.performOperation("sync",{action:"open_session"},tn(r,this.internals.timeouts.syncMs)),snapshot:(r,a,s)=>this.transport.performOperation("sync",{action:"snapshot",snapshot_id:r,...a?{page:a}:{}},tn(s,this.internals.timeouts.syncMs)),changes:(r,a=200,s)=>this.transport.performOperation("sync",{action:"changes",after:r,limit:a},tn(s,this.internals.timeouts.syncMs)),mutate:(r,a)=>this.transport.performOperation("sync",{action:"mutate",mutation:r},tn(a,this.internals.timeouts.syncMs))}}}let o=e.authority.replicaId;return{collectionId:n,replicaId:o,transport:{openSession:i=>this.transport.performAuthoritySyncRequest(n,o,"POST","sessions",void 0,i),snapshot:(i,r,a)=>{let s=new URLSearchParams({snapshot_id:i});return r&&s.set("page",r),this.transport.performAuthoritySyncRequest(n,o,"GET",`snapshot?${s}`,void 0,a)},changes:(i,r=200,a)=>this.transport.performAuthoritySyncRequest(n,o,"GET",`changes?${new URLSearchParams({after:String(i),limit:String(r)})}`,void 0,a),mutate:(i,r)=>this.transport.performAuthoritySyncRequest(n,o,"POST","mutations",i,r)}}}registerNotifications(e){return z(()=>this.notifications.registerNotifications(e),et)}registerNativeNotifications(e){return z(()=>this.notifications.registerNativeNotifications(e),et)}unregisterNativeNotifications(e){return z(()=>this.notifications.unregisterNativeNotifications(e),et)}unregisterNotifications(e,n){return z(()=>this.notifications.unregisterNotifications(e,n),et)}forget(){let e=this.transport.currentToken();this.internals.removeToken(this.collectionId,e?.keyHandle,"not_authorized",!0),this.transport.notifyStorageChanged()}describe(e){return this.collectionClient.describe(e)}changes(e={},n){return this.collectionClient.changes(e,n)}read(e,n){return this.collectionClient.read(e,n)}query(e={},n){return this.collectionClient.query(e,n)}queryPages(e={},n={}){return this.collectionClient.queryPages(e,n)}queryAll(e={},n={}){return this.collectionClient.queryAll(e,n)}listViews(e){return this.collectionClient.listViews(e)}executeView(e,n){return this.collectionClient.executeView(e,n)}executeViewPages(e,n={}){return this.collectionClient.executeViewPages(e,n)}readViewSource(e,n){return this.collectionClient.readViewSource(e,n)}createViewSource(e,n){return this.collectionClient.createViewSource(e,n)}updateViewSource(e,n){return this.collectionClient.updateViewSource(e,n)}deleteViewSource(e,n){return this.collectionClient.deleteViewSource(e,n)}create(e,n){return this.collectionClient.create(e,n)}update(e,n){return this.collectionClient.update(e,n)}delete(e,n){return this.collectionClient.delete(e,n)}preflightDelete(e,n){return this.collectionClient.preflightDelete(e,n)}rename(e,n){return this.collectionClient.rename(e,n)}preflightRename(e,n){return this.collectionClient.preflightRename(e,n)}async renameWithProgress(e,n={}){return j(n,this.internals.timeouts.requestMs,async o=>{let i=Date.now(),r=!1,a,s=(c,l,u=0)=>{n.onProgress?.({operation:"rename",state:c,elapsedMs:Date.now()-i,cancellable:l,resumed:r,completedUnits:u,...a?{estimate:a}:{}})};try{Ce(o.signal),s("preflighting",!0);let c=n.preflight?I(n.preflight):await this.preflightRename(e,{signal:o.signal,timeoutMs:null});if(!c.ok)return c;let l=c.value;try{Vo(e,l)}catch(f){if(f instanceof _)return g(f.problem);throw f}a=Ho(e,l),s("ready",!0),Ce(o.signal);let u=this.transport.hasResumableMutationTransport();s("applying",u);let p=await this.rename(e,u?{signal:o.signal,timeoutMs:null}:{timeoutMs:hr(o.remainingMs())});return p.ok&&s("completed",!1,a.totalUnits),p}catch(c){if(An(c,o.signal)&&s("cancelled",!1),c instanceof _)return g(c.problem);throw c}})}async deleteWithProgress(e,n={}){return j(n,this.internals.timeouts.requestMs,async o=>{let i=Date.now(),r=!1,a,s=(c,l,u=0)=>{n.onProgress?.({operation:"delete",state:c,elapsedMs:Date.now()-i,cancellable:l,resumed:r,completedUnits:u,...a?{estimate:a}:{}})};try{Ce(o.signal),s("preflighting",!0);let c=n.preflight?I(n.preflight):await this.preflightDelete(e,{signal:o.signal,timeoutMs:null});if(!c.ok)return c;let l=c.value;try{Go(e,l)}catch(f){if(f instanceof _)return g(f.problem);throw f}a=$o(l),s("ready",!0),Ce(o.signal);let u=this.transport.hasResumableMutationTransport();s("applying",u);let p=await this.delete(e,u?{signal:o.signal,timeoutMs:null}:{timeoutMs:hr(o.remainingMs())});return p.ok&&s("completed",!1,a.totalUnits),p}catch(c){if(An(c,o.signal)&&s("cancelled",!1),c instanceof _)return g(c.problem);throw c}})}pendingMutations(){return this.transport.pendingMutations().map(e=>({...e,recover:n=>z(()=>this.recoverPendingMutation(e.requestId,n),B)}))}pendingMutation(e){let n=this.transport.pendingMutation(e);return n?{...n,recover:o=>z(()=>this.recoverPendingMutation(e,o),B)}:null}async recoverPendingMutation(e,n){let o=await this.transport.recoverPendingMutation(e,n);if(o&&typeof o=="object"&&"valid"in o){let i=o;if(!i.valid)throw new _(Ae(i));return i.result}return o}validate(e={},n){return this.collectionClient.validate(e,n)}readType(e,n){return this.collectionClient.readType(e,n)}createType(e,n){return this.collectionClient.createType(e,n)}updateType(e,n){return this.collectionClient.updateType(e,n)}assessTypePack(e,n){return this.collectionClient.assessTypePack(e,n)}applyTypePack(e,n){return this.collectionClient.applyTypePack(e,n)}assessCollectionSetup(e,n){return this.collectionClient.assessCollectionSetup(e,n)}applyCollectionSetup(e,n){return this.collectionClient.applyCollectionSetup(e,n)}listTimers(e,n){return this.collectionClient.listTimers(e,n)}putTimer(e,n){return this.collectionClient.putTimer(e,n)}cancelTimer(e,n){return this.collectionClient.cancelTimer(e,n)}reconcileTimers(e,n){return this.collectionClient.reconcileTimers(e,n)}watch(e={},n={}){return z(()=>U(n,this.internals.timeouts.watchStartMs,async o=>{let i=await this.collectionClient.changes(e.cursor===void 0?{}:{after:e.cursor,limit:200},{signal:o.signal,timeoutMs:null});if(!i.ok)throw new _(i.problem);if(i.value.reset)throw new _(w("change_cursor_reset","The collection change cursor expired. Refresh collection state before subscribing again."));return new Hn(this.collectionClient,i.value.cursor,e,e.cursor===void 0?[]:i.value.events,this.internals.timeouts.watchStartMs)}),Pt)}emitConnection(){let e=this.info();for(let n of this.connectionListeners)n(e)}},Hn=class{constructor(e,n,o,i,r){this.client=e;this.input=o;this.watchStartTimeoutMs=r;this.pendingChanges=[...i],this.currentStatus={state:"connected",cursor:n,recovered:!1};let a=o.lifetimeSignal;if(a?.aborted)this.close();else if(a){let s=()=>this.close();a.addEventListener("abort",s,{once:!0}),this.removeLifetimeAbort=()=>a.removeEventListener("abort",s)}this.controller.signal.aborted||this.run(n)}client;input;watchStartTimeoutMs;changes=new Set;statuses=new Set;problems=new Set;controller=new AbortController;removeLifetimeAbort;currentStatus;currentProblem=null;pendingChanges;get status(){return this.currentStatus}get problem(){return this.currentProblem}subscribe(e,n,o){this.changes.add(e),n&&(this.statuses.add(n),n(this.currentStatus)),o&&(this.problems.add(o),this.currentProblem&&o(this.currentProblem));for(let i of this.pendingChanges)e(i);return this.pendingChanges=[],()=>{this.changes.delete(e),n&&this.statuses.delete(n),o&&this.problems.delete(o)}}close(){if(this.controller.signal.aborted)return;this.controller.abort(),this.removeLifetimeAbort?.(),this.removeLifetimeAbort=void 0;let e="cursor"in this.currentStatus?this.currentStatus.cursor:void 0;this.publishStatus({state:"closed",...e===void 0?{}:{cursor:e}})}async run(e){let n=!0,o=this.client.watch({cursor:e,pollIntervalMs:this.input.pollIntervalMs,retry:this.input.retry,signal:this.controller.signal,timeoutMs:this.watchStartTimeoutMs,onStatus:i=>{if(n&&i.state==="connecting"){n=!1;return}n=!1,this.publishStatus(i)}});try{for await(let i of o){if(this.controller.signal.aborted)return;if(!i.ok){this.currentProblem=i.problem;for(let r of this.problems)r(i.problem);return}for(let r of this.changes)r(i.value)}}finally{this.controller.signal.aborted||this.close()}}publishStatus(e){this.currentStatus=e;for(let n of this.statuses)n(e)}};function tn(t,e){return{...t,timeoutMs:t?.timeoutMs===void 0?e:t.timeoutMs}}function hr(t){return t===null?null:Math.max(1,Math.ceil(t))}function nn(t,e){let n=M(t.getItem(`${e}:connections`));return n?.version===1&&Array.isArray(n.collectionIds)&&n.collectionIds.every(o=>typeof o=="string")?n.collectionIds:[]}function yr(t,e,n){gr(t,e,[...nn(t,e),n])}function mr(t,e,n){gr(t,e,nn(t,e).filter(o=>o!==n))}function gr(t,e,n){t.setItem(`${e}:connections`,JSON.stringify({version:1,collectionIds:[...new Set(n)]}))}function $n(t){let e="bundle:";if(!t.startsWith(e)||t.length===e.length)throw new Error("The registered application has no valid declaration identity.");return t.slice(e.length)}function We(t,e,n){return t.reason instanceof _?t.reason:d("authorization_cancelled",e,{cause:n})}async function Cr(t){if(typeof location>"u"&&!t.navigate&&!t.options.openVerification)throw d("browser_required","Authorization navigation requires a browser environment.");let n=(t.options.presentation==="popup"||t.portableDeclared)&&!t.options.openVerification&&!t.navigate&&typeof window<"u"?window.open("","mdbase-connect-authorization","popup,width=620,height=760"):null;try{return{application:await t.register(t.options.signal),popup:n}}catch(o){throw n?.close(),o}}async function vr(t){let e=Sr(t.storagePrefix,t.state);try{for(;;){let n=M(t.storage.getItem(e));if(n?.version===1){if(t.storage.removeItem(e),n.status==="failed")throw F(n.code,n.message,{details:n.returnTo?{return_to:n.returnTo}:void 0});let o=t.connection(n.collectionId);if(!o)throw d("invalid_callback","Authorization completed without a usable saved connection.");return{kind:"connected",connection:o,...n.returnTo?{returnTo:n.returnTo}:{}}}await Q(200,t.signal)}}finally{t.popup.close(),t.storage.removeItem(e);let n=`${t.storagePrefix}:pending:${t.state}`;M(t.storage.getItem(n))?.state===t.state&&(t.storage.removeItem(n),t.pending.keyHandle&&await t.keyStore.delete(t.pending.keyHandle))}}function wr(t){return t.completion.then(e=>(t.popupAttempt&&_r(t,{version:1,status:"connected",collectionId:e.connection.collectionId,...e.returnTo?{returnTo:e.returnTo}:{}}),t.popupAttempt&&br(),e)).catch(e=>{throw t.popupAttempt&&_r(t,{version:1,status:"failed",code:e instanceof _?e.code:"invalid_callback",message:e instanceof Error?e.message:"Authorization could not be completed.",...t.pending?.returnTo?{returnTo:t.pending.returnTo}:{}}),t.popupAttempt&&br(),e})}function _r(t,e){t.storage.setItem(Sr(t.storagePrefix,t.state),JSON.stringify(e))}function Sr(t,e){return`${t}:completion:${e}`}function br(){typeof window<"u"&&typeof window.close=="function"&&window.close()}function Wn(t,e,n,o){let i=`${e}:pending-mutation:`,r=new Set;for(let a=0;a<t.length;a+=1){let s=t.key(a);if(!s?.startsWith(i))continue;let c=M(t.getItem(s));if(!c||!n.includes(c.operation)||o&&c.collectionId!==o)continue;let l=c.envelope?.protocol_version??c.request?.protocol_version;l!==void 0&&l!==H&&Qe(l)&&r.add(l)}return[...r].sort((a,s)=>s-a)}function Jn(t,e,n){return Qn(t,e).has(n)}function Qn(t,e){let n=new Set;for(let o=0;o<t.length;o+=1){let i=t.key(o);if(i!==e&&!i?.startsWith(`${e}:`))continue;let r=M(t.getItem(i));r?.keyHandle&&n.add(r.keyHandle)}return n}function Rr(t,e,n){let o=[e];for(let i=0;i<t.length;i+=1){let r=t.key(i);r?.startsWith(`${e}:`)&&o.push(r)}for(let i of o){let r=M(t.getItem(i));r?.keyHandle&&n(r.keyHandle),t.removeItem(i)}}function Pr({body:t,clientId:e,keyHandle:n,previous:o,retiredKeyHandles:i,defaultApplicationOrigin:r,pinConnectorIdentity:a}){let s=t.collection_id;if(typeof s!="string")throw d("invalid_token_response","Authorization returned no collection ID.");let c=kt(t.scope);if(!c)throw d("invalid_token_response","Authorization returned no valid collection scope.");if(t.authority&&!ct(t.authority,s))throw d("invalid_token_response","Authorization returned an invalid remote authority capability.");if(t.authority&&t.encryption)throw d("invalid_token_response","Authorization returned conflicting collection transports.");if(t.file_capability!==null&&t.file_capability!==void 0&&!Tt(t.file_capability))throw d("invalid_token_response","Authorization returned an invalid file capability.");if(t.encryption){try{oe(t.encryption)}catch{throw d("invalid_token_response","Authorization returned an invalid encrypted relay binding.")}if(a(t.encryption.connector_id,t.encryption.connector_agreement_public_key),t.encryption.collection_id!==s||typeof t.grant_id!="string"||t.grant_id.length===0)throw d("invalid_token_response","Authorization returned an encrypted relay binding for another grant.")}if(o?.encryption&&t.encryption&&o.keyHandle&&o.keyHandle===n&&(o.grantId!==t.grant_id||o.encryption.connector_id!==t.encryption.connector_id||o.encryption.connector_agreement_public_key!==t.encryption.connector_agreement_public_key||o.encryption.application_agreement_public_key!==t.encryption.application_agreement_public_key))throw d("connector_identity_changed","The connector identity changed during authorization renewal. Reauthorize before sending collection data.");return{version:1,accessToken:t.access_token,refreshToken:t.refresh_token,clientId:e,collectionId:s,collectionName:t.collection_name??`Collection ${s.slice(0,8)}`,operations:t.operations,scope:c,expiresAt:Date.now()+t.expires_in*1e3,refreshExpiresAt:t.refresh_expires_in?Date.now()+t.refresh_expires_in*1e3:void 0,grantId:t.grant_id,encryption:t.encryption??void 0,fileCapability:t.file_capability??void 0,applicationOrigin:t.application_origin??r,keyHandle:n,...i?.length?{retiredKeyHandles:i}:{},savedAt:Date.now(),authority:t.authority?{operationsUrl:t.authority.operations_url,syncUrl:t.authority.sync_url,filesUrl:t.authority.files_url,replicaId:t.authority.replica_id,accessToken:t.authority.access_token,proofPublicKey:t.authority.proof_public_key}:void 0}}function Yn(t,e){let n=new Set;if(e&&n.add(e),t?.keyHandle&&n.add(t.keyHandle),Array.isArray(t?.retiredKeyHandles))for(let o of t.retiredKeyHandles)typeof o=="string"&&o.length>0&&n.add(o);return n}function Ar(t,e,n,o,i=[],r=!1){let a=[],s=[],c=Yn(n);for(let u of Qn(t,e))c.add(u);let l=new Set(i);for(let u of l)c.add(u);for(let u of c)u!==o&&(r||l.has(u)||Jn(t,e,u)?a:s).push(u);return{retained:a,disposable:s}}function Hs(t,e,n){let o=M(t.getItem(e));if(!o||!Array.isArray(o.retiredKeyHandles))return;let i=o.retiredKeyHandles.filter(r=>r!==n);i.length!==o.retiredKeyHandles.length&&(i.length>0?o.retiredKeyHandles=i:delete o.retiredKeyHandles,t.setItem(e,JSON.stringify(o)))}async function Or(t,e,n,o,i){M(t.getItem(o))?.keyHandle===i||Jn(t,n,i)||(await e.delete(i),Hs(t,o,i))}var on=class{serverUrl;manifest;manifestSource;redirectUri;storage;relayEncryption;keyStore;identityStore;directAccessMode;loopbackUrl;navigate;timeouts;credentialStorage;application=null;manifestPromise=null;completionPromises=new Ge;grantKeyLeases;connectionCache=new Map;listeners=new Set;invalidatedConnections=new Map;constructor(e){this.serverUrl=ti(String(e.serverUrl)),this.manifest=e.manifest instanceof URL?e.manifest.href:e.manifest??ni(),this.manifestSource=typeof this.manifest=="string"?this.manifest:this.manifest.distribution==="portable"?`bundle:${this.manifest.id}:${ci(this.manifest)}`:`bundle:${this.manifest.id}`;let n=si(this.manifest);this.redirectUri=e.redirectUri===void 0?typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"":oi():String(e.redirectUri),this.storage=e.storage??ai(n),this.relayEncryption=e.relayEncryption??"required",this.keyStore=e.keyStore??(n?new Me:new Ie),this.identityStore=e.identityStore??(n?new Le:new Ue),this.credentialStorage=e.storage||e.keyStore||e.identityStore?"custom":this.storage instanceof qe?"memory":"persistent",this.directAccessMode=e.directAccess??"auto",this.loopbackUrl=Yo(String(e.loopbackUrl??`http://127.0.0.1:${So}`)),this.navigate=e.navigate,this.timeouts=ke(e.timeouts),this.grantKeyLeases=new Ut(this.storagePrefix(),(o,i)=>this.deleteGrantKeyWhenUnused(o,i)),typeof window<"u"&&this.storage===window.localStorage&&window.addEventListener("storage",o=>{o.storageArea!==this.storage||!o.key?.startsWith(this.storagePrefix())||(this.connectionCache.get(ri(o.key))?.notifyStorageChanged(),this.emitConnections())})}environment(){let e=typeof this.manifest!="string"&&this.manifest.distribution==="portable"?"portable":this.application?.distribution??"web";return{distribution:e,applicationOrigin:e==="portable"?"null":this.defaultApplicationOrigin(),credentialStorage:this.credentialStorage}}register(e={}){return U(e,this.timeouts.requestMs,n=>this.registerWithinBudget(n.signal))}async registerWithinBudget(e){if(this.application)return this.application;let n=await ie(`${this.serverUrl}/v1/apps/register`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({manifest:await this.manifestDeclaration({signal:e,timeoutMs:null})}),signal:e},"temporarily_unavailable","Application registration is temporarily unavailable."),o=await E(n,"invalid_operation_response","Connect returned an invalid application registration response.");if(!n.ok)throw D(o,"discovery_failed","Application discovery failed.",n.status);return this.application=o.application,this.application}manifestDeclaration(e={}){if(this.manifestPromise)return this.manifestPromise;let o=U(e,this.timeouts.requestMs,i=>this.loadManifest(i.signal)).catch(i=>{throw this.manifestPromise===o&&(this.manifestPromise=null),i});return this.manifestPromise=o,this.manifestPromise}async loadManifest(e){if(typeof this.manifest!="string")return this.manifest;let n=this.manifest,o;try{o=await fetch(n,{headers:{accept:"application/json"},signal:e})}catch(i){throw d("manifest_load_failed","The bundled application declaration could not be loaded.",{cause:i})}if(!o.ok)throw d("manifest_load_failed",`The bundled application declaration returned HTTP ${o.status}.`,{status:o.status});try{return await E(o,"invalid_application_manifest","The bundled application declaration is not valid JSON.")}catch(i){throw d("invalid_application_manifest","The bundled application declaration is not valid JSON.",{cause:i,details:{issues:[{path:"/",keyword:"json",message:"must be valid JSON",params:{}}]}})}}async authorize(e={}){let n=e.presentation==="popup"?6e5:this.timeouts.requestMs;return U(e,n,o=>this.authorizeWithinBudget({...e,signal:o.signal,timeoutMs:null}))}async authorizeWithinBudget(e){let n=typeof this.manifest!="string"&&this.manifest.distribution==="portable",{application:o,popup:i}=await Cr({options:e,portableDeclared:n,navigate:this.navigate,register:r=>this.registerWithinBudget(r)});return o.distribution==="portable"?(e.openVerification&&i?.close(),this.authorizePortable(o,e,e.openVerification?null:i)):this.authorizeWeb(o,e,i)}async authorizeWeb(e,n,o){let{verifier:i,challenge:r}=await at(),a=J(24),s=crypto.randomUUID(),c=n.target?.kind==="collection"?n.target.collectionId:void 0,l=`grant:${e.id}:${a}`,u=await this.keyStore.create(l),p;try{p=await this.loadApplicationIdentity(e)}catch(C){throw await this.keyStore.delete(l),C}let f=X(n.operations??ve),h=new Date,m=await pt({protocol_version:Y,authorization_id:s,application_id:e.id,application_declaration_id:$n(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Ne(p),installation_signing_public_key:p.signingPublicKey,grant_agreement_public_key:u.agreementPublicKey,grant_signing_public_key:u.signingPublicKey,flow:"authorization_code",authorization_nonce:J(32),issued_at:h.toISOString(),expires_at:new Date(h.getTime()+600*1e3).toISOString(),redirect_uri:this.redirectUri,state:a,code_challenge:r,contracts:mn(f,e.requirements?.files,Wn(this.storage,this.storagePrefix(),f,c)),requested_operations:f,...e.requirements?.files?{requested_files:e.requirements.files}:{},...c?{collection_id:c}:{}},p),b={version:1,verifier:i,state:a,clientId:e.id,redirectUri:this.redirectUri,relayEncryption:this.relayEncryption,collectionId:c,returnTo:n.returnTo,keyHandle:l,authorizationId:s,applicationAgreementPublicKey:u.agreementPublicKey,applicationSigningPublicKey:u.signingPublicKey,...n.presentation==="popup"&&o?{presentation:"popup"}:{}};this.storage.setItem(this.pendingKey(a),JSON.stringify(b));try{let C=await fetch(`${this.serverUrl}/oauth/authorization_request`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,redirect_uri:this.redirectUri,code_challenge:r,code_challenge_method:"S256",state:a,operations:f.join(","),...c?{collection_id:c}:{},application_authorization:JSON.stringify(m)}),signal:n.signal}),y=await E(C,"invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(!C.ok)throw D(y,"device_authorization_failed","Application authorization could not be started.",C.status);if(typeof y.authorization_uri!="string"||y.authorization_id!==s||!Number.isInteger(y.expires_in)||y.expires_in<=0)throw d("invalid_device_authorization_response","The authorization service returned an invalid authorization response.");if(n.presentation==="popup"&&o)return o.location.href=y.authorization_uri,await vr({storage:this.storage,storagePrefix:this.storagePrefix(),state:a,pending:b,popup:o,signal:n.signal,keyStore:this.keyStore,connection:S=>this.connection(S)});if(o?.close(),this.navigate)await this.navigate(y.authorization_uri);else if(typeof location<"u")location.assign(y.authorization_uri);else throw d("browser_required","Authorization navigation requires a browser environment.");return{kind:"redirecting"}}catch(C){throw o?.close(),this.storage.removeItem(this.pendingKey(a)),await this.keyStore.delete(l),n.signal?.aborted?We(n.signal,"Application authorization was cancelled.",C):C}}async authorizePortable(e,n,o){if(this.relayEncryption!=="required")throw o?.close(),d("encryption_required","Downloaded applications require encrypted relay authorization.");let{verifier:i,challenge:r}=await at(),a=`grant:${e.id}:${J(24)}`,s=await this.keyStore.create(a),c;try{c=await this.loadApplicationIdentity(e)}catch(y){throw o?.close(),await this.keyStore.delete(a),y}let l=X(n.operations??ve),u=crypto.randomUUID(),p=new Date,f=await pt({protocol_version:Y,authorization_id:u,application_id:e.id,application_declaration_id:$n(e.family_identity),application_manifest_digest:e.manifest_digest,application_installation_id:await Ne(c),installation_signing_public_key:c.signingPublicKey,grant_agreement_public_key:s.agreementPublicKey,grant_signing_public_key:s.signingPublicKey,flow:"device_code",authorization_nonce:J(32),issued_at:p.toISOString(),expires_at:new Date(p.getTime()+600*1e3).toISOString(),code_challenge:r,contracts:mn(l,e.requirements?.files,Wn(this.storage,this.storagePrefix(),l,n.target?.kind==="collection"?n.target.collectionId:void 0)),requested_operations:l,...e.requirements?.files?{requested_files:e.requirements.files}:{},...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{}},c),h,m;try{h=await fetch(`${this.serverUrl}/oauth/device_authorization`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e.id,operations:l.join(","),...n.target?.kind==="collection"?{collection_id:n.target.collectionId}:{},code_challenge:r,code_challenge_method:"S256",application_authorization:JSON.stringify(f)}),signal:n.signal}),m=await E(h,"invalid_device_authorization_response","The authorization service returned an invalid device authorization response.")}catch(y){throw o?.close(),await this.keyStore.delete(a),d("device_authorization_failed","Downloaded application authorization could not be started.",{cause:y})}if(!h.ok)throw o?.close(),await this.keyStore.delete(a),D(m,"device_authorization_failed","Downloaded application authorization could not be started.",h.status);let b;try{b=ei(m)}catch(y){throw o?.close(),await this.keyStore.delete(a),n.signal?.aborted?We(n.signal,"Downloaded application authorization was cancelled.",y):y}if(n.onDeviceCode?.(b),n.openVerification)await n.openVerification(b);else if(o)try{o.location.href=b.verificationUriComplete}catch{}else throw await this.keyStore.delete(a),d("approval_window_blocked","The approval window was blocked. Show the provided verification link and code, then try again.",{details:{user_code:b.userCode,verification_uri:b.verificationUri,verification_uri_complete:b.verificationUriComplete,expires_at:b.expiresAt,interval_seconds:b.intervalSeconds}});let C=b.intervalSeconds;try{for(;Date.now()<b.expiresAt;){if(await Q(C*1e3,n.signal),n.signal?.aborted)throw We(n.signal,"Downloaded application authorization was cancelled.");let y;try{y=await fetch(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:m.device_code,client_id:e.id,code_verifier:i}),signal:n.signal})}catch(A){if(n.signal?.aborted)throw We(n.signal,"Downloaded application authorization was cancelled.",A);continue}let S=await E(y,"invalid_token_response","The authorization service returned an invalid token response.");if(!y.ok){let A=st(S);if(A==="authorization_pending")continue;if(A==="slow_down"){C+=5;continue}throw D(S,"token_exchange_failed","Downloaded application authorization could not be completed.",y.status)}let v=ct(S.authority,S.collection_id),R=S.encryption&&S.encryption.protocol_version===wt&&S.encryption.suite===Xe&&S.encryption.application_agreement_public_key===s.agreementPublicKey;if(S.application_origin!=="null")throw d("invalid_token_response","Authorization did not bind the portable grant to its opaque application origin.");if(S.authority&&(!v||S.encryption!=null||S.authority.proof_public_key!==s.signingPublicKey))throw d("invalid_token_response","Authorization returned a remote authority capability that is not bound to this portable grant key.");if(!S.authority&&!R)throw d("encryption_required","Authorization did not establish the expected key-bound local portable grant.");let T=this.storeTokenResponse(S,e.id,a);if(n.target?.kind==="collection"&&n.target.collectionId!==T.collectionId)throw this.removeToken(T.collectionId,T.keyHandle),d("collection_mismatch","The approved collection does not match the collection requested by this link.");return o?.close(),{kind:"connected",connection:this.connection(T.collectionId),...n.returnTo?{returnTo:n.returnTo}:{}}}throw d("expired_token","The downloaded application authorization code expired.")}catch(y){throw o?.close(),await this.keyStore.delete(a),n.signal?.aborted?We(n.signal,"Downloaded application authorization was cancelled.",y):y}}completeAuthorization(e,n={}){let o=xt(e);if(!o)return Promise.reject(d("invalid_callback","Authorization callback is missing its state."));let i=M(this.storage.getItem(this.pendingKey(o))),r=i?.presentation==="popup";return this.completionPromises.run(o,n,this.timeouts.requestMs,a=>wr({storage:this.storage,storagePrefix:this.storagePrefix(),state:o,pending:i,popupAttempt:r,completion:this.performAuthorizationCompletion(e,o,a)}))}async performAuthorizationCompletion(e,n,o){let i=new URL(e),r=i.searchParams.get("code"),a=this.pendingKey(n),s=M(this.storage.getItem(a));if(!s||s.version!==1||n!==s.state)throw d("invalid_callback","Authorization callback is missing or does not match this browser session.");if(i.searchParams.has("error"))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),F(i.searchParams.get("error")??"access_denied",i.searchParams.get("error_description")??"Collection access was not approved.",{details:s.returnTo?{return_to:s.returnTo}:void 0});if(!r)throw d("invalid_callback","Authorization callback is missing its code.");let c=await ie(`${this.serverUrl}/oauth/token`,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:r,client_id:s.clientId,redirect_uri:s.redirectUri,code_verifier:s.verifier}),signal:o},"temporarily_unavailable","Authorization completion is temporarily unavailable."),l=await E(c,"invalid_token_response","The authorization service returned an invalid token response.");if(!c.ok)throw D(l,"token_exchange_failed","Authorization could not be completed.",c.status);if(s.relayEncryption==="required"&&!l.authority&&(!l.encryption||!s.keyHandle||l.encryption.application_agreement_public_key!==s.applicationAgreementPublicKey))throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),d("encryption_required","Authorization did not establish the required encrypted relay grant.");if(l.authority?.proof_public_key){if(!s.keyHandle||!s.applicationSigningPublicKey||l.authority.proof_public_key!==s.applicationSigningPublicKey)throw s.keyHandle&&await this.keyStore.delete(s.keyHandle),this.storage.removeItem(a),d("invalid_token_response","Authorization returned a remote authority capability bound to another application key.")}else l.authority&&s.keyHandle&&await this.keyStore.delete(s.keyHandle);let u=this.storeTokenResponse(l,s.clientId,l.authority?.proof_public_key?s.keyHandle:l.authority?void 0:s.keyHandle);if(s.collectionId&&s.collectionId!==u.collectionId)throw this.removeToken(u.collectionId,u.keyHandle),this.storage.removeItem(a),d("collection_mismatch","The approved collection does not match the collection requested by this link.");return this.storage.removeItem(a),{connection:this.connection(u.collectionId),...s.returnTo?{returnTo:s.returnTo}:{}}}connections(){let e=[];for(let n of nn(this.storage,this.storagePrefix())){let o=this.connection(n)?.info();o&&e.push(o)}return e.sort((n,o)=>n.displayName.localeCompare(o.displayName)||n.collectionId.localeCompare(o.collectionId))}connection(e){if(!this.storage.getItem(this.tokenKey(e)))return null;let n=this.connectionCache.get(e);return n||(n=new $e(this,e),this.connectionCache.set(e,n)),n.info()?n:null}unavailableReason(e){return this.invalidatedConnections.get(e)??null}connectionApplicationId(e){if(!this.connection(e))return null;let n=M(this.storage.getItem(this.tokenKey(e)));return typeof n?.clientId=="string"&&n.clientId.length>0?n.clientId:null}onConnectionsChange(e){return this.listeners.add(e),e(this.connections()),()=>this.listeners.delete(e)}storeTokenResponse(e,n,o){let i=e.collection_id;if(typeof i!="string")throw d("invalid_token_response","Authorization returned no collection ID.");let r=M(this.storage.getItem(this.tokenKey(i))),a=Ar(this.storage,this.pendingMutationKey(i),r,o,this.grantKeyLeases.handles(i),this.grantKeyLeases.retainAutomaticallyRetiredKeys),s=Pr({body:e,clientId:n,keyHandle:o,previous:r,retiredKeyHandles:a.retained,defaultApplicationOrigin:this.defaultApplicationOrigin(),pinConnectorIdentity:(c,l)=>this.pinConnectorIdentity(c,l)});this.storage.setItem(this.tokenKey(i),JSON.stringify(s));for(let c of a.disposable)this.deleteGrantKeyWhenUnused(i,c);return yr(this.storage,this.storagePrefix(),i),this.invalidatedConnections.delete(i),this.connectionCache.delete(i),this.emitConnections(),s}forgetConnectorIdentity(e){this.storage.removeItem(this.connectorPinKey(e))}pinConnectorIdentity(e,n){let o=this.connectorPinKey(e),i=M(this.storage.getItem(o));if(i&&(i.version!==1||i.publicKey!==n))throw d("connector_identity_changed","The connector identity changed since this application first connected. Forget the saved connector identity only after verifying the computer, then authorize again.");i||this.storage.setItem(o,JSON.stringify({version:1,publicKey:n}))}connectorPinKey(e){return`mdbase-connect:${this.serverUrl}:connector-pin:${e}`}async loadApplicationIdentity(e){try{return await Et(this.identityStore,this.serverUrl,e)}catch(n){throw d("application_identity_unavailable",n instanceof we?n.message:"The application installation identity is unavailable.",{cause:n})}}removeToken(e,n,o="authorization_lost",i=!1){this.invalidatedConnections.set(e,o);let r=M(this.storage.getItem(this.tokenKey(e))),a=Yn(r,n);this.storage.removeItem(this.tokenKey(e)),i&&Rr(this.storage,this.pendingMutationKey(e),s=>a.add(s));for(let s of a)this.deleteGrantKeyWhenUnused(e,s);for(let s of["web_push","fcm"])this.storage.removeItem(this.notificationKey(e,s));mr(this.storage,this.storagePrefix(),e),this.connectionCache.delete(e),this.emitConnections()}acquireGrantKeyLease(e,n,o){return this.grantKeyLeases.acquire(e,n,o)}deleteGrantKeyWhenUnused(e,n){this.grantKeyLeases.deleteExclusive(e,n,()=>Or(this.storage,this.keyStore,this.pendingMutationKey(e),this.tokenKey(e),n))}tokenKey(e){return`${this.storagePrefix()}:token:${e}`}pendingMutationKey(e){return`${this.storagePrefix()}:pending-mutation:${e}`}notificationKey(e,n="web_push"){return`${this.storagePrefix()}:notifications:${e}:${n}`}directPreferenceKey(){return`mdbase-connect:direct:${this.defaultApplicationOrigin()}`}defaultApplicationOrigin(){return ii(this.manifest,this.manifestSource,this.redirectUri,this.application?.distribution==="portable")}pendingKey(e){return`${this.storagePrefix()}:pending:${e}`}storagePrefix(){return`mdbase-connect:${this.serverUrl}:${this.manifestSource}`}emitConnections(){let e=this.connections();for(let n of this.listeners)n(e)}};var rn=class{internals;constructor(e){this.internals=new on(e)}register(e){return z(()=>this.internals.register(e),be)}authorize(e={}){return z(()=>this.internals.authorize(e),Oe)}application(e){return new Fe(this,e,this.internals.timeouts)}manifest(e){return z(()=>this.internals.manifestDeclaration(e),be)}environment(){return this.internals.environment()}completeAuthorization(e,n){return z(()=>this.internals.completeAuthorization(e===void 0?It():String(e),n),Oe)}connections(){return this.internals.connections()}connection(e){return this.internals.connection(e)}unavailableReason(e){return this.internals.unavailableReason(e)}connectionApplicationId(e){return this.internals.connectionApplicationId(e)}onConnectionsChange(e){return this.internals.onConnectionsChange(e)}forgetAll(){for(let e of this.connections())this.connection(e.collectionId)?.forget()}forgetConnectorIdentity(e){this.internals.forgetConnectorIdentity(e)}};function Xn(t){if(!t||typeof t!="object")throw d("invalid_push_payload","The push payload is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string"||!e.presentation||typeof e.presentation.title!="string")throw d("invalid_push_payload","The push payload is not an mdbase notification.");return e}function Tr(t){if(!t||typeof t!="object")throw d("invalid_push_payload","The native notification data is not an object.");let e=t;if(e.type!=="mdbase.notification"||e.version!==1&&e.version!=="1"||typeof e.signal_id!="string"||typeof e.criterion_id!="string"||typeof e.cursor!="string")throw d("invalid_push_payload","The native notification data is not an mdbase notification.");return{type:"mdbase.notification",version:1,signal_id:e.signal_id,criterion_id:e.criterion_id,cursor:e.cursor}}function kr(t,e){let n=Xn(e);return t.showNotification(n.presentation.title,{...n.presentation.body?{body:n.presentation.body}:{},...n.presentation.tag?{tag:n.presentation.tag}:{},data:{type:n.type,signal_id:n.signal_id,criterion_id:n.criterion_id,cursor:n.cursor}})}function Ir(t){return{subscribe:e=>t.subscribe(e),getSnapshot:()=>t.getSnapshot()}}var an=class{collectionParameter;fallbackPath;listeners=new Set;handlePopState=()=>this.emit();constructor(e={}){this.collectionParameter=e.collectionParameter??"collection",this.fallbackPath=e.fallbackPath??"/"}selectedCollectionId(){return this.currentUrl().searchParams.get(this.collectionParameter)}select(e,n={}){let o=lt(this.currentUrl());e?o.searchParams.set(this.collectionParameter,e):o.searchParams.delete(this.collectionParameter);let i=this.browserHistory();i[n.history==="push"?"pushState":"replaceState"](i.state,"",o),this.emit()}authorizationReturnTo(){let e=lt(this.currentUrl());return`${e.pathname}${e.search}${e.hash}`}authorizationCallback(){let e=this.currentUrl().href;return Mt(e)?e:null}finishAuthorization(e,n){let o=this.safeAppUrl(e??this.fallbackPath);lt(o),o.searchParams.set(this.collectionParameter,n),this.browserHistory().replaceState(null,"",o),this.emit()}clearAuthorizationCallback(e){let n=e?this.safeAppUrl(e):this.currentUrl(),o=this.browserHistory();o.replaceState(o.state,"",lt(n)),this.emit()}subscribe(e){let n=this.listeners.size===0;return this.listeners.add(e),n&&typeof window<"u"&&window.addEventListener("popstate",this.handlePopState),()=>{this.listeners.delete(e),this.listeners.size===0&&typeof window<"u"&&window.removeEventListener("popstate",this.handlePopState)}}emit(){for(let e of this.listeners)e()}safeAppUrl(e){let n=this.currentUrl(),o=new URL(e,n.origin);return o.origin===n.origin?o:new URL(this.fallbackPath,n.origin)}currentUrl(){if(typeof location>"u")throw d("browser_required","Browser selection requires a browser environment.");return new URL(location.href)}browserHistory(){if(typeof history>"u")throw d("browser_required","Browser selection requires a browser environment.");return history}},sn=class{collectionId=null;listeners=new Set;selectedCollectionId(){return this.collectionId}select(e){if(e!==this.collectionId){this.collectionId=e;for(let n of this.listeners)n()}}authorizationReturnTo(){}authorizationCallback(){return null}finishAuthorization(e,n){this.select(n)}clearAuthorizationCallback(){}subscribe(e){return this.listeners.add(e),()=>this.listeners.delete(e)}};return zr($s);})();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
sha384-
|
|
1
|
+
sha384-G9S7H692RFcmy7JJ8CrePVKzJb4fvERv7ZfJfsbaNMtdu0ffE1SRdTgZAyhrMtJk
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mdbase-dev/connect",
|
|
3
|
-
"version": "0.1.0-beta.
|
|
3
|
+
"version": "0.1.0-beta.92",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
"README.md"
|
|
34
34
|
],
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@mdbase-dev/connect-protocol": "0.1.0-beta.
|
|
36
|
+
"@mdbase-dev/connect-protocol": "0.1.0-beta.92"
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"esbuild": "^0.28.1",
|