@opensesame-labs/web-pwa 0.0.0-alpha.0

package/dist/assets/session-connections-oSO_RMA1.css

@@ -0,0 +1 @@
+.cx-setup{display:grid;gap:1rem;max-width:40rem}.cx-step{display:inline-grid;place-items:center;width:1.4rem;height:1.4rem;margin-right:.6rem;background:var(--ink);color:var(--surface);font-size:.8rem}.cx-pending-step{color:var(--ink-2)}.cx-modes{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));border:1px solid var(--line)}.cx-mode{display:flex;align-items:center;gap:.5rem;padding:.6rem;min-height:44px;cursor:pointer}.cx-mode:has(input:checked){background:var(--surface-2)}.cx-selection{border-bottom:1px solid var(--line)}.cx-selection>summary,.cx-application>summary{min-height:44px;display:flex;align-items:center;justify-content:space-between;gap:1rem;cursor:pointer;font-size:.875rem}.cx-selection__count{color:var(--ink-2);white-space:nowrap}.cx-selection__count:after{content:" ▾"}.cx-selection__choices{display:grid;gap:.5rem;border:0;padding:.5rem 0 1rem;margin:0}.cx-selection__choices .check{min-height:44px}.cx-application>.cx-form{padding-block:.75rem}.cx-icon-field{display:grid;gap:.5rem}.cx-icon-field__row{display:flex;align-items:center;gap:.75rem;min-width:0}.cx-icon-field__row input{min-height:44px;min-width:0;max-width:var(--field-max);font-size:1rem}.cx-icon-field__row input::file-selector-button{min-height:44px;background:var(--surface-2);color:var(--ink);border:1px solid var(--line);cursor:pointer}.cx-icon-field__row img{object-fit:cover}.cx-form{display:grid;gap:1rem}.cx-grid{display:grid;gap:.75rem;grid-template-columns:repeat(auto-fit,minmax(16rem,1fr))}.cx-block{display:grid;gap:.75rem;border:0;padding:0;margin:0;min-width:0}.cx-block>legend,.cx-block>h3{margin:0 0 .25rem;padding:0;font-size:.875rem;font-weight:600;color:var(--ink)}.cx-select{display:grid;gap:.35rem;min-width:0}.cx-select select,.cx-textarea{min-height:2.75rem;font-size:1rem;width:100%;max-width:var(--field-max)}.cx-textarea{min-height:6rem;max-width:var(--text-max);resize:vertical;font-family:var(--mono)}.cx-param{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr) auto;gap:.5rem;align-items:end}.cx-facts{display:grid;grid-template-columns:9rem minmax(0,1fr);gap:.4rem .75rem;margin:0;font-size:.8438rem}.cx-fact{display:contents}.cx-facts dt{color:var(--ink-2)}.cx-facts dd{margin:0;display:flex;align-items:center;gap:.4rem;min-width:0;font-family:var(--mono);overflow-wrap:anywhere}.cx-inline{display:inline-flex;align-items:center;gap:.4rem;min-width:0}.cx-links{display:flex;flex-wrap:wrap;gap:.5rem 1rem}.cx-argument-schema{max-height:20rem;overflow:auto;white-space:pre-wrap;overflow-wrap:anywhere}@media(max-width:40rem){.cx-param,.cx-facts{grid-template-columns:minmax(0,1fr)}}.mkey__row{display:flex;align-items:center;gap:.75rem;padding:.875rem 1.25rem;border-top:1px solid var(--line)}.mkey__row:first-child{border-top:0}.mkey__row--child{padding-inline-start:2.5rem}.mkey__copy{flex:1;min-width:0}.mkey__copy h3,.mkey__copy p{margin:0}.mkey__copy p{margin-top:.2rem;color:var(--ink-2);font-size:.8125rem;overflow-wrap:anywhere}.mkey__token{align-items:flex-start;gap:.5rem;padding:.5rem 0;overflow:visible}.mkey__token-text{flex:1;min-width:0;font-family:var(--mono);font-size:.875rem;overflow-wrap:anywhere;-webkit-user-select:all;user-select:all}.mkey-group>legend{margin-bottom:.3rem;padding:0}.mkey-choices{display:flex;flex-wrap:wrap;gap:6px;margin:4px 0 8px}.mkey-choice{position:relative;display:inline-flex;align-items:center;min-height:32px;padding:0 12px;border:1px solid var(--line-strong);border-radius:0;background:var(--canvas);color:var(--ink);font-size:13px;cursor:pointer}.mkey-choice input[type=radio]{-webkit-appearance:none;appearance:none;position:absolute;inset:0;width:100%;height:100%;min-height:0;margin:0;border:0;border-radius:0;background:none;opacity:0;cursor:inherit}.mkey-choice:has(input:checked){background:var(--ink);border-color:var(--ink);color:var(--canvas)}.mkey-choice:has(input:focus-visible){outline:2px solid var(--ink);outline-offset:2px}.mkey-choice:has(input:disabled){opacity:.5;cursor:not-allowed}@media(pointer:coarse){.mkey-choice{min-height:44px;font-size:16px}.mkey__row{flex-wrap:wrap}}

package/dist/assets/settings-CHnpwTwf.css

@@ -0,0 +1 @@
+.set__nav{display:flex;flex-wrap:wrap;gap:1.1rem;border-bottom:1px solid var(--line);max-width:100%}.set__nav-link{-webkit-appearance:none;appearance:none;display:inline-flex;align-items:center;border:0;border-bottom:2px solid transparent;margin-bottom:-1px;background:transparent;color:var(--ink-2);font:inherit;font-size:.875rem;padding:.3rem 0 .55rem;text-decoration:none;cursor:pointer;transition:border-color .14s var(--ease),color .14s var(--ease)}.set__nav-link:hover{color:var(--ink)}.set__nav-link[aria-current=page]{color:var(--ink);border-bottom-color:var(--ink);font-weight:550}.set__themes{display:flex;gap:.4rem;flex-wrap:wrap}.set__theme{-webkit-appearance:none;appearance:none;display:inline-flex;align-items:center;gap:.45rem;min-height:2.25rem;padding:0 .85rem;border:1px solid var(--line-strong);border-radius:var(--radius);background:var(--surface);color:var(--ink);font:inherit;font-size:.875rem;font-weight:550;cursor:pointer;transition:background .14s var(--ease),border-color .14s var(--ease)}.set__theme:hover{background:var(--surface-3)}.set__theme[aria-pressed=true]{background:var(--ink);border-color:transparent;color:var(--canvas)}.set__danger{border-color:color-mix(in srgb,var(--err) 30%,var(--line))}.set__danger .panel__head{border-bottom-color:color-mix(in srgb,var(--err) 22%,var(--line))}.set__danger .keyed-row{max-width:none}.transfer-choices{display:flex;flex-wrap:wrap;gap:6px;margin:4px 0 8px}.transfer-choice{min-height:32px;padding:0 12px;border:1px solid var(--line-strong);border-radius:0;background:var(--canvas);color:var(--ink);font:inherit;font-size:13px;cursor:pointer}.transfer-choice[aria-pressed=true]{background:var(--ink);border-color:var(--ink);color:var(--canvas)}.transfer-choice:focus-visible{outline:2px solid var(--ink);outline-offset:2px}@media(pointer:coarse){.transfer-choice{min-height:44px;font-size:16px}}.set__danger-target{flex:1;min-width:0;margin:0;color:var(--ink-2)}.set__danger-target strong{color:var(--ink)}.set__trash-list{list-style:none;margin:.75rem 0 0;padding:.75rem 0 0;border-top:1px dashed var(--line)}.set__trash-row{display:flex;align-items:center;gap:.5rem;min-width:0;padding:.2rem 0}.set__trash-name{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--ink)}.set__trash-when{flex:none;color:var(--ink-3);font-size:.75rem;font-variant-numeric:tabular-nums}.set__trash-keys{flex:none;display:flex;align-items:center;gap:.35rem}@media(pointer:coarse),(max-width:900px){.set__theme{min-height:2.75rem;flex:1 1 auto;justify-content:center}}@media(max-width:900px){.set__nav-link{flex:none;scroll-snap-align:start;white-space:nowrap}}.sw--method{align-items:center;padding:.7rem 0}.sw--method .sw__name{display:flex;align-items:center;flex-wrap:wrap;gap:.4rem;font-weight:600}.sw--method .sw__name svg{flex:none;color:var(--ink-2)}.sw--method .sw__sub{display:block;margin-top:.15rem;font-family:var(--font);line-height:1.45}.sw--method .btn{align-self:center}.set__security .panel__body{gap:0}.set__security .set__lead,.set__security .set__status{margin:0 0 .8rem;max-width:68ch;line-height:1.5}.set__security .set__finding{display:block;margin-top:.15rem;color:var(--ink);font-size:.8125rem;line-height:1.45;overflow-wrap:anywhere}.codes{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:.35rem 1rem;margin:0;padding:0;list-style:none;font-family:var(--mono);font-size:.875rem;letter-spacing:.04em;font-variant-numeric:tabular-nums}.codes li{padding:.3rem 0;border-bottom:1px dashed var(--line)}.codes li.is-used{color:var(--ink-2);text-decoration:line-through}.found .f__fills-label,.found .hint{color:var(--ink-2)}.set-raw__path{margin:0;font-family:var(--mono);font-size:.75rem;color:var(--ink-2)}.set-raw__stage{--set-raw-size: max(.8125rem, var(--field-min));display:grid;min-height:16rem;overflow-x:auto;border-bottom:1px solid var(--line)}.set-raw__stage:focus-within{border-bottom-color:var(--ink);box-shadow:0 1px 0 0 var(--ink)}.set-raw__paint,.set-raw__input{grid-area:1 / 1;margin:0;box-sizing:border-box;width:max(100%,calc(var(--cols, 0) * 1ch + 1rem));max-width:none;min-height:16rem;padding:.75rem 0;border:0;font-family:var(--mono);font-size:var(--set-raw-size);line-height:1.55;white-space:pre;tab-size:2}.set-raw__paint{pointer-events:none;color:var(--ink)}.set-raw__input{height:100%;overflow:hidden;resize:none;color:transparent;caret-color:var(--ink);background:transparent}.set-raw__stage--ro .set-raw__paint{color:var(--ink-2)}.set-raw__key{color:var(--ink);font-weight:600}.set-raw__str{color:var(--ok)}.set-raw__num{color:var(--warn)}.set-raw__bool{color:var(--err)}.set-raw__comment{color:var(--ink-3)}.sw__select{width:12rem;max-width:100%}

package/dist/assets/settings-files-NL7VAn-D.css

@@ -0,0 +1 @@
+.vfiles{display:grid;grid-template-columns:minmax(12rem,16rem) minmax(0,1fr);gap:1.5rem;align-items:start}.vfiles__list{display:grid;gap:.6rem;font-family:var(--mono);font-size:.8125rem}.vfiles__list ul{list-style:none;margin:0;padding:0 0 0 .9rem;border-left:1px solid var(--line)}.vfiles__dirname{display:flex;align-items:center;gap:.4rem;min-height:1.75rem;color:var(--ink-2);cursor:default}details>.vfiles__dirname{cursor:pointer}.vfiles__count{color:var(--ink-3);font-size:.75rem;font-variant-numeric:tabular-nums}.vfiles__dirname .icon-btn{margin-left:auto}.vfiles__file{-webkit-appearance:none;appearance:none;display:flex;align-items:center;gap:.35rem;width:100%;min-height:1.75rem;padding:0 .4rem;border:0;border-radius:var(--radius);background:transparent;color:var(--ink);font:inherit;text-align:left;cursor:pointer;overflow-wrap:anywhere}.vfiles__file:hover{background:var(--surface-2)}.vfiles__file.is-open{background:var(--ink);color:var(--canvas)}.vfiles__ro{display:inline-flex;color:var(--ink-3)}.vfiles__file.is-open .vfiles__ro{color:inherit}.vfiles__open{min-width:0}.vfile .panel__head{align-items:center}.vfile__keys{display:inline-flex;align-items:center;gap:.25rem}.vfile__lock{display:inline-flex;color:var(--ink-3)}@media(max-width:900px){.vfiles{grid-template-columns:minmax(0,1fr)}}@media(pointer:coarse),(max-width:900px){.vfiles__file,.vfiles__dirname{min-height:2.75rem}}

package/dist/assets/settings-files-OnHfWPp_.js

@@ -0,0 +1 @@
+import{h as t}from"./vault-ui-seam-BQGS7RR6.js";import{ap as e}from"./drop-open-BjgdLxWM.js";import{j as n,r as o}from"./react-dom-BwC4eQlG.js";import{K as r,bW as s,n as a,z as l,o as i}from"./main-BrkS-iow.js";import{S as c}from"./InvokeScreen-C-kFFYVF.js";import"./pane-trail-dW-2RSUm.js";import"./identity-BVf8yWa4.js";async function u(e){const n=await crypto.subtle.digest("SHA-256",t(e));return function(t){let e="";for(const n of t)e+=n.toString(16).padStart(2,"0");return e}(new Uint8Array(n))}async function d(t){return`sha256:${await u(e(t))}`}function f(t,e,n,o,r){return t<n+r?t-(n+r):e>o-r?e-(o-r):0}function m(t,e,n){return{x:f(t.left,t.right,e.left,e.right,n.x),y:f(t.top,t.bottom,e.top,e.bottom,n.y)}}function p(t){return void 0!==t&&t.bottom-t.top>0}function h(t,e){const n=document.createTreeWalker(t,NodeFilter.SHOW_TEXT);let o,r=0;for(let s=n.nextNode();s;s=n.nextNode()){const t=s.textContent?.length??0;if(e<r+t)return{node:s,at:e-r};o={node:s,at:t},r+=t}return o}function g(t,e){return{left:e,right:e,top:t.top,bottom:t.bottom}}function x(t){const e=t.getBoundingClientRect?.();if(p(e))return e;const n=t.getClientRects?.()?.[0];return p(n)?n:void 0}function v(t,e){const n=h(t,e);if(!n||n.at>=(n.node.textContent?.length??0))return;const o=document.createRange();return o.setStart(n.node,n.at),o.setEnd(n.node,n.at+1),x(o)}function y(t){const e=getComputedStyle(t).overflowY;return("auto"===e||"scroll"===e)&&t.scrollHeight>t.clientHeight}function b(t){const e=t.replace(/\s#.*$/,"").trim();return"true"===e||"false"===e?"set-raw__bool":/^-?\d+$/.test(e)?"set-raw__num":"set-raw__str"}const j=/-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/y,_=["true","false","null"];function N(t){return void 0!==t&&/\w/.test(t)}function w(t,e){let n=e+1;for(;n<t.length;){const e=t[n];if("\\"===e)n+=2;else{if('"'===e)return n+1;n+=1}}return t.length}function S(t,e){let n=e;for(;n<t.length&&/\s/.test(t[n]??"");)n+=1;return":"===t[n]}function k(t,e){if(N(t[e-1]))return;const n=_.find(n=>t.startsWith(n,e));return void 0===n||N(t[e+n.length])?void 0:n}function C(t){const e=[];let o=0,r=0;const s=(s,a)=>{r>o&&e.push(t.slice(o,r)),e.push(n.jsx("span",{className:a,children:t.slice(r,s)},r)),o=s,r=s};for(;r<t.length;){const e=t[r]??"";if('"'===e){const e=w(t,r);s(e,S(t,e)?"set-raw__key":"set-raw__str");continue}if("-"===e||e>="0"&&e<="9"){j.lastIndex=r;const e=j.exec(t);if(e){s(r+e[0].length,"set-raw__num");continue}}const n="t"===e||"f"===e||"n"===e?k(t,r):void 0;void 0===n?r+=1:s(r+n.length,"set-raw__bool")}return o<t.length&&e.push(t.slice(o)),e}function R(t){return"yaml"===t?$:"json"===t?C:T}const E=o.memo(function({language:t,line:e}){return n.jsxs("span",{children:[R(t)(e),"\n"]})});function O(t,e){return e.split("\n").map((e,o)=>n.jsx(E,{language:t,line:e},o))}function T(t){return t}function $(t){if(t.trimStart().startsWith("#"))return n.jsx("span",{className:"set-raw__comment",children:t});const e=/^(\s*-\s+)(.*)$/.exec(t);if(e)return function(t,e){const o=/^([\w.-]+):(\s.*|)$/.exec(e);return n.jsxs(n.Fragment,o?{children:[t,n.jsx("span",{className:"set-raw__key",children:o[1]}),":",F(o[2]??"")]}:{children:[t,F(e)]})}(e[1]??"",e[2]??"");const o=t.indexOf(":");return o<0?t:n.jsxs(n.Fragment,{children:[n.jsx("span",{className:"set-raw__key",children:t.slice(0,o)}),":",F(t.slice(o+1))]})}function F(t){const e=t.search(/\s#/),o=e<0?t:t.slice(0,e),r=e<0?"":t.slice(e);return n.jsxs(n.Fragment,{children:[n.jsx("span",{className:b(o),children:o}),r?n.jsx("span",{className:"set-raw__comment",children:r}):null]})}function I({language:t,path:e,source:r,readOnly:s=!1,busy:a=!1,invalid:l=!1,inputRef:i,onChange:c,onKeyDown:u,onKeyUp:d,onFocus:f,painter:p=O}){const b=function(t){let e=0,n=0;for(;n<=t.length;){const o=t.indexOf("\n",n),r=o<0?t.length:o;if(r-n>e&&(e=r-n),o<0)break;n=o+1}return e}(r),j=o.useRef(null),_=o.useRef(null);return o.useLayoutEffect(()=>{j.current?.style.setProperty("--cols",String(b))},[b]),o.useLayoutEffect(()=>{const t=j.current?.querySelector("textarea");j.current&&_.current&&t&&function(t,e,n){if(document.activeElement!==n)return;if(n.selectionStart!==n.selectionEnd)return;const o=function(t,e){const n=t.textContent??"";return function(t,e){const n=h(t,e);if(!n)return;const o=document.createRange();return o.setStart(n.node,n.at),o.collapse(!0),x(o)}(t,e)??function(t,e,n){const o=n>0&&"\n"!==e[n-1]?v(t,n-1):void 0;if(o)return g(o,o.right);const r=n<e.length&&"\n"!==e[n]?v(t,n):void 0;return r?g(r,r.left):void 0}(t,n,e)??function(t,e,n){const o=e.slice(0,n).split("\n").length-1,r=getComputedStyle(t),s=Number.parseFloat(r.lineHeight);if(!(s>0))return;const a=t.getBoundingClientRect(),l=a.top+(Number.parseFloat(r.paddingTop)||0)+o*s;return{left:a.left,right:a.left,top:l,bottom:l+s}}(t,n,e)}(e,n.selectionStart);if(!o)return;const r=o.bottom-o.top,s=t.getBoundingClientRect(),a=m(o,{left:s.left,right:s.left+t.clientWidth,top:Number.NEGATIVE_INFINITY,bottom:Number.POSITIVE_INFINITY},{x:16,y:0});0!==a.x&&(t.scrollLeft+=a.x);const l=function(t){for(let e=t.parentElement;e;e=e.parentElement)if(y(e))return e;return document.scrollingElement??document.documentElement}(t);if(!l)return;const i=m(o,function(t){if(t===document.scrollingElement||t===document.documentElement){const t=document.documentElement;return{left:0,top:0,right:t.clientWidth,bottom:t.clientHeight}}const e=t.getBoundingClientRect();return{left:e.left,top:e.top,right:e.left+t.clientWidth,bottom:e.top+t.clientHeight}}(l),{x:0,y:2*r});0!==i.y&&(l.scrollTop+=i.y)}(j.current,_.current,t)},[r]),n.jsxs("div",{ref:j,className:"set-raw__stage"+(s?" set-raw__stage--ro":""),children:[n.jsx("pre",{ref:_,className:"set-raw__paint","aria-hidden":"true",children:p(t,r)}),n.jsx("textarea",{ref:i,className:"set-raw__input","aria-label":e,"aria-invalid":!!l||void 0,"aria-busy":!!a||void 0,spellCheck:!1,autoComplete:"off",wrap:"off",readOnly:s||a,value:r,onFocus:f,onChange:t=>c?.(t.target.value,t.target.selectionStart),onKeyUp:t=>d?.(t.currentTarget.selectionStart),onKeyDown:u})]})}function K({path:t,onRemove:e}){const[r,s]=o.useState(!1);return r?n.jsxs(n.Fragment,{children:[n.jsx("button",{type:"button",className:"icon-btn icon-btn--sm is-armed","aria-label":`Remove ${t}; items of this type keep their values`,title:"Remove; items keep their values",onClick:e,children:n.jsx(l,{size:16})}),n.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":`Keep ${t}`,title:"Keep it",onClick:()=>s(!1),children:n.jsx(i,{size:16})})]}):n.jsx("button",{type:"button",className:"icon-btn icon-btn--sm","aria-label":`Remove ${t}`,title:"Remove this file",onClick:()=>s(!0),children:n.jsx(l,{size:16})})}function W({file:t,outcome:e,refusal:o,loaded:r,onSave:l,onRemove:i}){const u=null!==o?{tone:"err",text:o}:e??null;return n.jsxs("span",{className:"vfile__keys",children:[u?n.jsx(c,{tone:u.tone,label:u.text}):null,t.readOnly?n.jsx("span",{className:"vfile__lock",role:"img","aria-label":t.readOnlyLabel??"Part of the build; read-only",title:t.readOnlyLabel??"Part of the build; read-only",children:n.jsx(s,{size:14})}):n.jsx("button",{type:"button",className:"icon-btn icon-btn--sm",disabled:null!==o||!r,"aria-label":`Save ${t.path}`,title:"Save",onClick:l,children:n.jsx(a,{size:14})}),t.removable?n.jsx(K,{path:t.path,onRemove:i}):null]})}function H({file:t,files:e,initial:s,onMoved:a}){const l=function(t,e,n){const[r,s]=o.useState(n??""),[a,l]=o.useState(void 0!==n),[i,c]=o.useState(null);return o.useEffect(()=>{if(c(null),void 0!==n)return s(n),void l(!0);l(!1);let o=!0;return e.read(t.path).then(t=>{o&&(s(t),l(!0))}),()=>{o=!1}},[t.path,e,n]),{text:r,setText:s,loaded:a,outcome:i,setOutcome:c}}(t,e,s),{text:i,setText:c,loaded:u,outcome:d,setOutcome:f}=l,{save:m,remove:p}=function(t,e,{text:n,loaded:o,setText:r,setOutcome:s},a){return{save:async()=>{if(t.readOnly||!o)return;const l=await e.write(t.path,n);l.ok?(s({tone:l.tone??"ok",text:l.message??`Saved ${l.path}.`}),void 0!==l.text&&r(l.text),l.path!==t.path&&a(l.path)):s({tone:"err",text:l.message})},remove:async()=>{const n=await e.remove(t.path);n.ok?a(null):s({tone:"err",text:n.message})}}}(t,e,l,a),h=t.readOnly||!u?{ok:!0}:e.check(t.path,i),g=h.ok?null:h.message;return n.jsxs("section",{className:"panel set-raw vfile","aria-label":t.path,children:[n.jsx(r,{id:`settings-file:${t.path}`,title:"Settings file",message:"err"===d?.tone?d.text:null}),n.jsxs("div",{className:"panel__head",children:[n.jsx("p",{className:"set-raw__path",children:t.path}),n.jsx(W,{file:t,outcome:d,refusal:g,loaded:u,onSave:()=>{m()},onRemove:()=>{p()}})]}),n.jsxs("div",{className:"panel__body",children:[n.jsx(I,{language:t.language,path:t.path,source:i,readOnly:t.readOnly,busy:!u,invalid:!h.ok,onChange:t=>{c(t),f(null)},onKeyDown:t=>{(t.metaKey||t.ctrlKey)&&"s"===t.key&&(t.preventDefault(),m())}}),n.jsx("output",{className:"visually-hidden","aria-live":"polite",children:"err"===d?.tone?"":d?.text??""}),n.jsx(r,{id:`settings-file:${t.path}`,title:"Settings file",message:"err"===d?.tone?d.text:null})]})]})}export{H as V,d as c,u as s};

package/dist/assets/sha3-Bm70HrE3.js

@@ -0,0 +1 @@
+import{k as t,l as s,d as e,m as n,u as i,n as o,o as r,a as h,p as a,q as u,t as c,v as f}from"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";const l=BigInt(0),d=BigInt(1),p=BigInt(2),k=BigInt(7),w=BigInt(256),b=BigInt(113),g=[],O=[],y=[];for(let q=0,R=d,T=1,z=0;q<24;q++){[T,z]=[z,(2*T+3*z)%5],g.push(2*(5*z+T)),O.push((q+1)*(q+2)/2%64);let t=l;for(let s=0;s<7;s++)R=(R<<d^(R>>k)*b)%w,R&p&&(t^=d<<(d<<BigInt(s))-d);y.push(t)}const L=c(y,!0),I=L[0],x=L[1],F=(t,s,e)=>e>32?((t,s,e)=>s<<e-32|t>>>64-e)(t,s,e):((t,s,e)=>t<<e|s>>>32-e)(t,s,e),X=(t,s,e)=>e>32?((t,s,e)=>t<<e-32|s>>>64-e)(t,s,e):((t,s,e)=>s<<e|t>>>32-e)(t,s,e),A=new Uint32Array(10);class B{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;canXOF;enableXOF=!1;rounds;constructor(t,s,o,r=!1,h=24){if(e(t,"blockLen"),e(s,"suffix"),e(h,"rounds"),n(r,"enableXOF"),this.blockLen=t,this.suffix=s,this.outputLen=o,this.enableXOF=r,this.canXOF=r,this.rounds=h,e(o,"outputLen"),!(0<t&&t<200))throw new Error('"blockLen" must be 1..199');this.state=new Uint8Array(200),this.state32=i(this.state)}clone(){return this._cloneInto()}keccak(){o(this.state32),function(t,s=24){if(!(t instanceof Uint32Array))throw new TypeError('"s" expected Uint32Array(50), got type='+typeof t);if(50!==t.length)throw new RangeError('"s" expected Uint32Array(50), got length='+t.length);if(e(s,"rounds"),s<1||s>24)throw new Error('"rounds" expected integer 1..24');for(let e=24-s;e<24;e++){for(let e=0;e<10;e++)A[e]=t[e]^t[e+10]^t[e+20]^t[e+30]^t[e+40];for(let e=0;e<10;e+=2){const s=(e+8)%10,n=(e+2)%10,i=A[n],o=A[n+1],r=F(i,o,1)^A[s],h=X(i,o,1)^A[s+1];for(let a=0;a<50;a+=10)t[e+a]^=r,t[e+a+1]^=h}let s=t[2],n=t[3];for(let e=0;e<24;e++){const i=O[e],o=F(s,n,i),r=X(s,n,i),h=g[e];s=t[h],n=t[h+1],t[h]=o,t[h+1]=r}for(let e=0;e<50;e+=10){const s=t[e],n=t[e+1],i=t[e+2],o=t[e+3];t[e]^=~t[e+2]&t[e+4],t[e+1]^=~t[e+3]&t[e+5],t[e+2]^=~t[e+4]&t[e+6],t[e+3]^=~t[e+5]&t[e+7],t[e+4]^=~t[e+6]&t[e+8],t[e+5]^=~t[e+7]&t[e+9],t[e+6]^=~t[e+8]&s,t[e+7]^=~t[e+9]&n,t[e+8]^=~s&i,t[e+9]^=~n&o}t[0]^=I[e],t[1]^=x[e]}u(A)}(this.state32,this.rounds),o(this.state32),this.posOut=0,this.pos=0}update(t){r(this),h(t);const{blockLen:s,state:e,state32:n}=this,o=t.length,a=s/4,u=s%4==0&&t.byteOffset%4==0&&o>=s?i(t):void 0;for(let i=0;i<o;){if(void 0!==u&&0===this.pos&&i%4==0&&o-i>=s){for(let t=0,s=i/4;t<a;t++)n[t]^=u[s+t];i+=s,this.pos=s,this.keccak();continue}const r=Math.min(s-this.pos,o-i);for(let s=0;s<r;s++)e[this.pos++]^=t[i++];this.pos===s&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;const{state:t,suffix:s,pos:e,blockLen:n}=this;t[e]^=s,128&s&&e===n-1&&this.keccak(),t[n-1]^=128,this.keccak()}writeInto(t){r(this,!1),h(t),this.finish();const s=this.state,{blockLen:e}=this;for(let n=0,i=t.length;n<i;){this.posOut>=e&&this.keccak();const o=Math.min(e-this.posOut,i-n);t.set(s.subarray(this.posOut,this.posOut+o),n),this.posOut+=o,n+=o}return t}xofInto(t){if(!this.enableXOF)throw new Error("XOF is not enabled");return this.writeInto(t)}xof(t){return e(t),this.xofInto(new Uint8Array(t))}digestInto(t){if(a(t,this),this.finished)throw new Error("digest() was already called");this.writeInto(t.length===this.outputLen?t:t.subarray(0,this.outputLen)),this.destroy()}digest(){const t=new Uint8Array(this.outputLen);return this.digestInto(t),t}destroy(){this.destroyed=!0,u(this.state)}_cloneInto(t){const{blockLen:s,suffix:e,outputLen:n,rounds:i,enableXOF:o}=this;return t||=new B(s,e,n,o,i),t.blockLen=s,t.state32.set(this.state32),t.pos=this.pos,t.posOut=this.posOut,t.finished=this.finished,t.rounds=i,t.suffix=e,t.outputLen=n,t.enableXOF=o,t.canXOF=this.canXOF,t.destroyed=this.destroyed,t}}const U=(s,e,n,i={})=>t(()=>new B(e,s,n),i),m=U(6,136,32,f(8)),E=U(6,72,64,f(10)),v=U(1,136,32),M=(e,n,i,o={})=>t((t={})=>(t=s({},t),new B(n,e,void 0===t.dkLen?i:t.dkLen,!0)),o),_=M(31,168,16,f(11)),j=M(31,136,32,f(12));export{j as a,E as b,m as c,v as k,_ as s};

package/dist/assets/shared-Ck7e2FJN.js

@@ -0,0 +1 @@
+import{s as e,a as t,f as n,b as r,d as o,e as s,C as i,g as a}from"./native-catalog-status-INsDvLpU.js";import{r as c}from"./react-dom-BwC4eQlG.js";import{u}from"./wake-lock-C_y0fQco.js";import{o as d}from"./identity-BVf8yWa4.js";import{o as l}from"./certs-CDCfMuEi.js";import{i as f}from"./vault-ui-seam-BQGS7RR6.js";import{i as m,f as h,a as p,a5 as g}from"./drop-open-BjgdLxWM.js";function v(){c.useSyncExternalStore(e,t,t);const{status:i,guest:a,tomb:d}=u(),l="unlocked"===i&&!a&&Boolean(d);return{pages:s(),acts:e=>o(e,l),tile:e=>r(e,l),form:e=>n(e.id,e.authKind)}}function y(e){return!d(e.id)&&"fido2"!==e.id&&!e.autoConfigurable}function b(e){return[...e].sort((e,t)=>Number(t.id.startsWith("byo-"))-Number(e.id.startsWith("byo-")))}const _="connections.firstRun.v1",k=["pending","needs_reauth","expired","error"];function w(e){return e.filter(e=>"revoked"!==e.status&&function(e){return k.includes(e.status)}(e))}function C(e){switch(e){case"active":return"connected";case"pending":case"needs_reauth":case"expired":return"needs_you";case"error":return"broken";default:return"idle"}}function N(e,t){return t?C(t.status):!e.configured&&e.missingConfig.some(e=>e.includes("CONNECTION_KEY"))?"needs_install":"idle"}const R={connected:"Connected",needs_you:"Needs you",needs_install:"Needs install",broken:"Broken",idle:"Not enabled"},T={connected:"chip--ok",needs_you:"chip--warn",needs_install:"chip--warn",broken:"chip--err",idle:"chip"};function $(e,t){return e.some(e=>function(e){if(null!==e.deletedAt)return"";if("secret"===e.kind)return e.connectionRef;if("typed"!==e.kind)return"";const t=e.values.connectionRef;return f(t)?t:""}(e)===t.connectionRef)}function I(e,t){const n=m().get("server");if(void 0===n)return h("secret",`${e.displayName} connector`);const r=p(n,{...g(n),connectionRef:t.connectionRef},`${e.displayName} connector`);return r.notes="Credential stays with the connection. This item is a reminder and a grant target.",r}const A={identity:"Identity",backup_recovery:"Backup/recovery",encryption:"Encryption (secrets in git)",password_managers:"Password managers",agent_harnesses:"Agent harnesses",cua_runtime:"Computer-use runtimes",ai_model_provider:"AI model providers",networking:"Networking",wallet:"Wallet",custom:"Custom connectors",cloud_secret_storage:"Cloud secret storage",local_storage:"Local storage",certificates:"Certificates",developer:"Developer tools",productivity:"Productivity",communication:"Communication",storage:"Storage",crm:"CRM",testing:"Testing"};function x(e){return e.startsWith("/settings/connections")?"/settings/connections":"/connections"}function j(e,t,n="/connections"){const r=`${n}/${encodeURIComponent(e)}`;return t?`${r}/${encodeURIComponent(t)}`:r}new Set(["identity","backup_recovery","encryption","password_managers","agent_harnesses","cua_runtime","ai_model_provider","networking","wallet","cloud_secret_storage","local_storage","certificates"]);const D=new Intl.DateTimeFormat(void 0,{dateStyle:"medium",timeStyle:"short"});function S(e){if(!e)return"—";const t=Date.parse(e);return Number.isNaN(t)?e:D.format(t)}function z(e){if(e instanceof i)return"exchange_failed"===e.code&&/bad credentials|401|unauthorized/i.test(e.message)?"GitHub rejected that token. Use a classic PAT (ghp_…) or fine-grained token with Contents: Read and Write on the store repo (repo scope).":e.message;if(e instanceof Error&&"issues"in e&&Array.isArray(e.issues))return"The response could not be read. Try Reload.";if(e instanceof Error){const t=e.message.trim();return t.startsWith("[")||t.includes('"code":')?"Connect returned data this page does not understand. Try Reload.":t}return"Something went wrong."}const E={pending:{tone:T.needs_you,label:R.needs_you},active:{tone:T.connected,label:R.connected},needs_reauth:{tone:T.needs_you,label:R.needs_you},expired:{tone:T.needs_you,label:R.needs_you},revoked:{tone:T.idle,label:"Revoked"},error:{tone:T.broken,label:R.broken}};function P(e){return"revoked"!==e.status&&(!l(e)||"active"===e.status)}function W(e,t,n){return l(e)?e.statusDetail??("active"===e.status?"google-drive"===e.providerId?"Google account verified; Drive access was not checked.":t&&a(t,n)?"Configuration verified locally; provider access was not checked.":"Connection verified on this device.":"Provider authorization or verification required before using this connection."):function(e,t){const n=e.accountLabel?` as ${e.accountLabel}`:"";switch(e.status){case"pending":return"Created, but nobody has approved it yet. Authorize it to finish.";case"active":{if("git"===t?.id)return function(e){return e.accountLabel?`Remote ${e.accountLabel}.`:"Git remote configured."}(e);const r=function(e){if(!e)return null;const t=Date.parse(e);if(Number.isNaN(t))return null;const n=Math.round((t-Date.now())/1e3),r=[["second",60],["minute",60],["hour",24],["day",30],["month",12],["year",Number.POSITIVE_INFINITY]];let o=n;for(const[s,i]of r){if(Math.abs(o)<i)return new Intl.RelativeTimeFormat(void 0,{numeric:"auto"}).format(o,s);o=Math.round(o/i)}return null}(e.expiresAt);return e.refreshable?r?`Authorized${n}. The access token expires ${r} and renews itself.`:`Authorized${n}. Renews itself; no further sign-in needed.`:r?`Authorized${n}. This provider issues no refresh token, so it expires ${r} for good.`:`Authorized${n}. This provider issues a long-lived token with no refresh.`}case"needs_reauth":return e.statusDetail??"Renewal was refused by the provider. Authorize it again to restore it.";case"expired":return"The access token expired and there is no refresh token to renew it.";case"revoked":return"Revoked here. Its bindings and history are kept for the record.";case"error":return e.statusDetail??"The provider returned an error."}}(e,t)}export{A as C,_ as F,E as S,R as V,w as a,b,j as c,P as d,z as e,C as f,T as g,S as h,y as i,$ as j,I as k,x as l,N as p,W as s,v as u};

package/dist/assets/signaling-BgALI1Na.js

@@ -0,0 +1 @@
+import{D as e,P as n}from"./vault-ui-seam-BQGS7RR6.js";import{s as r,c as t,d as o,v as s,e as i,i as a,f as c,g as l,h as p,j as u,k as g}from"./peer-trust-CZzPSQ-X.js";import{o as d,a as f,l as m,n as k,s as w}from"./native-worker-zod-5c0ed887-B342B6ko.js";function h(e){let n="";for(const r of e)n+=String.fromCharCode(r);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function B(e){if(!/^[A-Za-z0-9_-]*$/.test(e))return null;try{const n=e.replace(/-/g,"+").replace(/_/g,"/"),r=atob(n+"=".repeat((4-n.length%4)%4)),t=new Uint8Array(r.length);for(let e=0;e<r.length;e+=1)t[e]=r.charCodeAt(e);return h(t)===e?t:null}catch{return null}}function E(e){return/^[\da-f]{64}$/.test(e)?`${e.slice(0,4)}-${e.slice(4,8)}-${e.slice(8,12)}-${e.slice(12,16)}`:null}function y(e){return new Promise((n,r)=>{e.onsuccess=()=>n(e.result),e.onerror=()=>r(e.error??new Error("IndexedDB failed"))})}function S(){return new Promise((r,t)=>{const o=e(n,1);o.onupgradeneeded=()=>{const e=o.result;e.objectStoreNames.contains("trust")||e.createObjectStore("trust",{keyPath:"id"}),e.objectStoreNames.contains("ark")||e.createObjectStore("ark",{keyPath:"id"})},o.onsuccess=()=>r(o.result),o.onerror=()=>t(o.error??new Error("IndexedDB failed")),o.onblocked=()=>t(new Error("IndexedDB blocked"))})}async function x(e){return r(e)}async function v(e){const n=o(e);return n?x(n):null}async function N(e){const n=new Uint8Array(await crypto.subtle.exportKey("spki",e));return t(n)}const b="PeerTrustRecord.v1",D="opensesame.peer-trust-signal.v1",$=d({schemaVersion:m(1),kind:m(b),spkiFingerprint:w().regex(/^[0-9a-f]{64}$/),enrollmentEpoch:k().int().min(1),spkiB64:w().min(1),signatureB64:w().min(1)}),F=/^(?:absent|sha-256 [0-9a-f]{2}(?::[0-9a-f]{2}){31})$/,P=/^[A-Za-z0-9_-]{43}$/,j=d({kind:m(D),envelope:$,ownerNonce:w().regex(P),ownerDtls:w().regex(F),introSignatureB64:w().regex(/^[A-Za-z0-9+/]{40,200}={0,2}$/)}),A=d({fingerprint:w().regex(/^[0-9a-f]{64}$/),epoch:k().int().min(1)}),K=d({id:m("peers"),peers:f(A).max(32)}),V=d({id:m("commitment"),ownerKey:w().regex(/^[0-9a-f]{64}$/),ownerNonce:w().regex(P),ownerDtls:w().regex(F),ownerSpkiB64:w().regex(/^[A-Za-z0-9+/]{80,200}={0,2}$/),enrollmentEpoch:k().int().min(1)}),_=d({id:m("signed"),envelope:$,highWaterEpoch:k().int().min(0)});function z(e){const n=_.safeParse(e);return n.success?n.data:null}function O(e){const n=K.safeParse(e);return n.success?n.data.peers:[]}function Z(e){const n=V.safeParse(e);return n.success?{ownerKey:n.data.ownerKey,ownerNonce:n.data.ownerNonce,ownerDtls:n.data.ownerDtls,ownerSpkiB64:n.data.ownerSpkiB64,enrollmentEpoch:n.data.enrollmentEpoch}:null}const C=d({id:m("signing"),publicSpkiB64:w().min(1)});function I(e,n){const r=C.safeParse(e);return r.success?{id:"signing",privateKey:n,publicSpkiB64:r.data.publicSpkiB64}:null}function J(e){const n=JSON.stringify({enrollmentEpoch:e.enrollmentEpoch,kind:e.kind,schemaVersion:e.schemaVersion,spkiB64:e.spkiB64,spkiFingerprint:e.spkiFingerprint});return(new TextEncoder).encode(n)}async function T(e,n,r){const t={schemaVersion:1,kind:b,spkiFingerprint:n.spkiFingerprint,enrollmentEpoch:n.enrollmentEpoch,spkiB64:r},o=await i(e,J(t));if(!o)throw new Error("peer_trust_sign");return{...t,signatureB64:o}}async function U(e){return 1===e.schemaVersion&&e.kind===b&&!(e.enrollmentEpoch<1)&&s(e.spkiB64,e.signatureB64,J({schemaVersion:e.schemaVersion,kind:e.kind,spkiFingerprint:e.spkiFingerprint,enrollmentEpoch:e.enrollmentEpoch,spkiB64:e.spkiB64}))}function M(e){return e.enrollmentEpoch<1?null:{spkiFingerprint:e.spkiFingerprint,enrollmentEpoch:e.enrollmentEpoch}}async function R(e,n,r){if(!a(r))return null;const t={enrollmentEpoch:n.enrollmentEpoch,ownerDtls:r,ownerKey:n.spkiFingerprint,ownerNonce:c()},o=await l(e,t);return o?function(e,n){return p(n.ownerNonce)&&a(n.ownerDtls)&&u(n.introSignatureB64)?{kind:D,envelope:e,ownerNonce:n.ownerNonce,ownerDtls:n.ownerDtls,introSignatureB64:n.introSignatureB64}:null}(n,o):null}async function W(e){return e.kind===D&&await v(e.envelope.spkiB64)===e.envelope.spkiFingerprint&&!!(await U(e.envelope))&&g(e.envelope.spkiB64,{enrollmentEpoch:e.envelope.enrollmentEpoch,ownerDtls:e.ownerDtls,ownerKey:e.envelope.spkiFingerprint,ownerNonce:e.ownerNonce},e.introSignatureB64)}function q(e){return JSON.stringify(e)}function G(e){try{return function(e){const n=j.safeParse(e);return n.success?n.data:null}(JSON.parse(e))}catch{return null}}export{Z as a,x as b,I as c,G as d,N as e,B as f,v as g,T as h,y as i,z as j,W as k,R as l,q as m,S as o,O as p,M as r,E as s,h as t,U as v};

package/dist/assets/signals-DdOHdr--.js

@@ -0,0 +1 @@
+import{x as e,o as t,c as n,i as r,at as a,b as s,h as o,B as i,aa as c,l as d,R as u,a as l,v as p,y as f}from"./vault-ui-seam-BQGS7RR6.js";import{X as h,G as m,V as g,r as y,R as w,p as v,T as I,w as k,k as b,u as A,a5 as T,a6 as _,d as j,a7 as S,_ as E,P as x,B as D,I as P,a2 as O,j as C,t as $,x as N,m as q,c as J,b as R,J as M,a8 as U}from"./model-provider-B6oAnQX9.js";import{a8 as L,T as V,a9 as z,aa as K,ab as B,ac as F,ad as H,ae as W,a7 as Z,X as G,af as Y,ag as X,Y as Q,ah as ee,ai as te}from"./identity-BVf8yWa4.js";const ne=["access_token","id_token","refresh_token","token","bearer","authorization","code","device_code","client_secret","secret","secret_ref","password","passphrase","claim_token","session","session_token","sid","api_key","apikey","credential","credential_offer","vp_token","presentation","assertion","pan","cvv","card_number"];function re(e){let t="";for(const n of e)t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/u,"")}function ae(e=32){const t=new Uint8Array(e);return crypto.getRandomValues(t),re(t)}async function se(e){const t=(new TextEncoder).encode(e),n=await crypto.subtle.digest("SHA-256",t);return re(new Uint8Array(n))}async function oe(){const e=ae(32);return{codeVerifier:e,codeChallenge:await se(e),state:ae(16),nonce:ae(16)}}function ie(e){const t=(e+"=".repeat((4-e.length%4)%4)).replace(/-/g,"+").replace(/_/g,"/"),n=atob(t),r=new Uint8Array(n.length);for(let a=0;a<n.length;a++)r[a]=n.charCodeAt(a);return r}function ce(e){const t=e instanceof Uint8Array?e:new Uint8Array(e);let n="";for(const r of t)n+=String.fromCharCode(r);return btoa(n).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function de(e){return a(e)||s(e)&&Number.isFinite(e)&&e>=0}const ue=["ble","hybrid","internal","nfc","usb"],le=["discouraged","preferred","required"];function pe(e){return r(e)&&e.length>0&&/^[A-Za-z0-9_-]+$/.test(e)}function fe(e){return!(!n(e)||!pe(e.id)||"public-key"!==e.type)&&(void 0===e.transports||Array.isArray(e.transports)&&e.transports.every(e=>r(e)&&ue.includes(e)))}function he(e){return n(e)&&n(e.rp)&&n(e.user)&&r(e.rp.name)&&(a(e.rp.id)||r(e.rp.id))&&pe(e.user.id)&&r(e.user.name)&&r(e.user.displayName)&&pe(e.challenge)&&Array.isArray(e.pubKeyCredParams)&&e.pubKeyCredParams.length>0&&e.pubKeyCredParams.every(e=>n(e)&&"public-key"===e.type&&s(e.alg)&&Number.isInteger(e.alg))&&de(e.timeout)&&(a(e.attestation)||r(e.attestation)&&["direct","enterprise","indirect","none"].includes(e.attestation))&&(a(e.authenticatorSelection)||function(e){return!!n(e)&&(a(e.authenticatorAttachment)||r(e.authenticatorAttachment)&&["cross-platform","platform"].includes(e.authenticatorAttachment))&&(a(e.residentKey)||r(e.residentKey)&&le.includes(e.residentKey))&&(a(e.requireResidentKey)||i(e.requireResidentKey))&&(a(e.userVerification)||r(e.userVerification)&&le.includes(e.userVerification))}(e.authenticatorSelection))&&(void 0===e.excludeCredentials||Array.isArray(e.excludeCredentials)&&e.excludeCredentials.every(fe))?t(e):null}function me(e){return n(e)&&pe(e.challenge)&&de(e.timeout)&&(a(e.rpId)||r(e.rpId))&&(void 0===e.allowCredentials||Array.isArray(e.allowCredentials)&&e.allowCredentials.every(fe))&&(void 0===e.userVerification||r(e.userVerification)&&le.includes(e.userVerification))?t(e):null}function ge(n){const r=t(n);return"public-key"===n.type&&r.rawId instanceof ArrayBuffer&&void 0!==r.response&&e(r.getClientExtensionResults)}function ye(e){const{excludeCredentials:t,...n}=e;return{publicKey:{...n,challenge:o(ie(e.challenge)),user:{...e.user,id:o(ie(e.user.id))},...t?{excludeCredentials:t.map(e=>({...e,id:o(ie(e.id))}))}:void 0}}}function we(e){const{allowCredentials:t,...n}=e;return{publicKey:{...n,challenge:o(ie(e.challenge)),...t?{allowCredentials:t.map(e=>({...e,id:o(ie(e.id))}))}:void 0}}}function ve(n){const r=t(n.response);if(!(r.clientDataJSON instanceof ArrayBuffer&&r.attestationObject instanceof ArrayBuffer))throw new TypeError("WebAuthn registration response is not an attestation response");const a=e(r.getTransports)?r.getTransports.bind(r):void 0;return{id:n.id,rawId:ce(n.rawId),type:"public-key",response:{clientDataJSON:ce(r.clientDataJSON),attestationObject:ce(r.attestationObject),transports:a?.()??[]},clientExtensionResults:n.getClientExtensionResults()}}function Ie(e){const n=t(e.response);if(!(n.clientDataJSON instanceof ArrayBuffer&&n.authenticatorData instanceof ArrayBuffer&&n.signature instanceof ArrayBuffer))throw new TypeError("WebAuthn assertion response is not an authenticator assertion");return{credentialId:e.id,clientDataJSON:ce(n.clientDataJSON),authenticatorData:ce(n.authenticatorData),signature:ce(n.signature)}}function ke(e){const n=Ie(e);return{id:e.id,rawId:ce(e.rawId),type:"public-key",response:{clientDataJSON:n.clientDataJSON,authenticatorData:n.authenticatorData,signature:n.signature,...(()=>{const n=t(e.response);return n.userHandle instanceof ArrayBuffer?{userHandle:ce(n.userHandle)}:{}})()},clientExtensionResults:e.getClientExtensionResults()}}const be="config/device-identity-key",Ae="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";function Te(e){return r(e)&&43===e.length&&[...e].every(e=>Ae.includes(e))&&Ae.indexOf(e.charAt(42))%4==0}const _e=4096,je=864e5;function Se(e,t=Date.now()){const n=void 0===e?Number.NaN:Date.parse(e),r=Number.isFinite(n)?n-je:1;return{now:t,notBefore:Math.min(Math.max(1,Math.floor(r)),t)}}function Ee(e,t){const n=Math.min(Math.max(e.createdAt,t.notBefore),t.now);return n===e.createdAt?e:{...e,createdAt:n}}function xe(e,t=Date.now(),a=1){if(!n(e)||1!==e.version)return null;const o=e.publicJwk;return Te(e.keyId)&&r(e.privateJwkJson)&&!(e.privateJwkJson.length>4096)&&function(e,t,n){return s(e)&&Number.isSafeInteger(e)&&e>=Math.max(1,n)&&e<=t+je}(e.createdAt,t,a)&&function(e){return n(e)&&"EC"===e.kty&&"P-256"===e.crv&&Te(e.x)&&Te(e.y)}(o)?{version:1,keyId:e.keyId,publicJwk:{kty:"EC",crv:"P-256",x:o.x,y:o.y},privateJwkJson:e.privateJwkJson,createdAt:e.createdAt}:null}function De(e){return n(e)&&s(e.version)&&Number.isSafeInteger(e.version)&&e.version>1&&r(e.keyId)&&e.keyId.length<=128&&n(e.publicJwk)&&JSON.stringify(e).length<=8192}function Pe(e){return{version:1,keyId:e.keyId,publicJwk:{...e.publicJwk},privateJwkJson:e.privateJwkJson,createdAt:e.createdAt}}function Oe(e,t){return e.createdAt!==t.createdAt?e.createdAt<t.createdAt?e:t:e.keyId<=t.keyId?e:t}function Ce(e,t){const r=n(e)?e:void 0,a=n(t)?t:void 0;if(void 0===r)return a;if(void 0===a)return r;const s=xe(r),o=xe(a);return s&&o&&s.keyId!==o.keyId?Oe(s,o)===s?r:a:s&&!o?a:o&&!s||JSON.stringify(r)<=JSON.stringify(a)?r:a}const $e=JSON.parse('{"routes":{"interaction":{"path":"/i/{ref}","summary":"Cross-device interaction approval (ADR 0086)"},"claim":{"path":"/claim","fragment":["token","key"],"summary":"Ownership claim (#token=), or a drop when the fragment also carries key (#token=&key=)"},"device":{"path":"/device","query":["user_code"],"summary":"Device-authorization approval"},"approve":{"path":"/approve/{ref}","summary":"Authorization-request review"},"invoke":{"path":"/invoke/{kind}","summary":"Authenticator hand-off: open the native app, or fall back to the browser ceremony","kinds":{"mfa":{"query":["request_id","user_code"],"app":"opensesame://invoke/mfa","fallback":"device"},"oid4vp":{"query":["request_uri"],"app":"openid4vp://","appParameter":"request_uri"},"oid4vci":{"query":["request_uri"],"app":"openid-credential-offer://","appParameter":"credential_offer_uri"}}},"guest":{"path":"/guest","aliasOf":"guest","summary":"Alias for the guest road (ADR 0140 D12)"},"delegate":{"path":"/delegate","aliasOf":"join","fragment":["token"],"summary":"Alias into Join a session (ADR 0136, ADR 0140 D5)"}},"legacy":{"opens":"device","query":["user_code","code"],"links":[{"scheme":"https"},{"scheme":"http"},{"scheme":"opensesame","route":"invoke/mfa"},{"scheme":"opensesame-mfa","route":"approve"}]}}'),Ne=$e.routes,qe=$e.legacy,Je=Ne.invoke.kinds??{},Re=Object.keys(Je);function Me(e){return Je[e]}function Ue(e){return"string"==typeof e&&Object.hasOwn(Je,e)}const Le=/^\{(\w+)\}$/;function Ve(e){return Ne[e].path.split("/").slice(1)}function ze(e,t={}){return`/${Ve(e).map(n=>{const r=Le.exec(n)?.[1];if(void 0===r)return n;const a=t[r];if(void 0===a||""===a)throw new Error(`The ${e} route needs a ${r}.`);return encodeURIComponent(a)}).join("/")}`}function Ke(e,t){const n=Ve(e),r=t.split("/");if(r.length<=n.length)return null;const a=r.slice(-n.length),s={};for(const[o,i]of n.entries()){const e=a[o]??"",t=Le.exec(i)?.[1];if(void 0===t){if(e!==i)return null}else{if(""===e)return null;s[t]=e}}return s}const Be=new Set(["127.0.0.1","[::1]","localhost"]);class Fe extends Error{reason;constructor(e,t){super(t),this.name="InteractionLinkError",this.reason=e}}const He=/^i_[A-Za-z0-9_-]{1,256}\.[A-Za-z0-9_-]{16,128}$/,We=/^[A-Z0-9._-]{1,64}$/;function Ze(e){return e.toLowerCase().replace(/[_\-.\s]/g,"")}const Ge=new Set(Array.isArray(ne)?ne.map(Ze):[]);function Ye(e){if(0===e.length)return[];const t=[];for(const n of e.split(/[?#&;]/)){const e=n.indexOf("=");if(e<=0)continue;const r=n.slice(0,e).replace(/^\/+/,"");let a=r;try{a=decodeURIComponent(r.replace(/\+/g," "))}catch{a=r}t.push(a)}return t}function Xe(e,t){!function(){if(0===Ge.size)throw new Fe("deny_list_unavailable","The forbidden-parameter list is unavailable, so this link cannot be checked.")}();const{query:n,fragment:r}=function(e){const t=e.indexOf("#"),n=-1===t?e:e.slice(0,t),r=-1===t?"":e.slice(t+1),a=n.indexOf("?");return{query:-1===a?"":n.slice(a+1),fragment:r}}(e);for(const a of[n,r])for(const e of Ye(a)){const n=Ze(e);if(!t.has(n)&&Ge.has(n))throw new Fe("forbidden_parameter","This link carries credential material and was refused.")}}function Qe(e){Xe(e,new Set)}function et(e){return He.test(e)}function tt(e){if(!r(e))return null;if(0===e.length||e.length>2048)return null;let t;try{t=new URL(e)}catch{return null}if(!function(e){return"https:"===e.protocol||"http:"===e.protocol&&Be.has(e.hostname.toLowerCase())}(t))return null;if(""!==t.username||""!==t.password)return null;if(""!==t.search||""!==t.hash)return null;const n=Ke("interaction",t.pathname)?.ref;return void 0!==n&&et(n)?{origin:t.origin,ref:n}:null}const nt=new Set([Ze("code")]);function rt(e){if(!r(e))return null;if(0===e.length||e.length>2048)return null;let t;Xe(e,nt);try{t=new URL(e)}catch{return null}const n=`${t.hostname}${t.pathname}`.toLowerCase(),a=qe.links.find(e=>`${e.scheme}:`===t.protocol);if(void 0===a)return null;if(void 0!==a.route&&n!==a.route)return null;const s=qe.query.map(e=>t.searchParams.get(e)).find(e=>null!==e);if(null==s)return null;const o=s.trim().toUpperCase();return 0===o.length||o.length>64?null:We.test(o)?{userCode:o}:null}class at extends Error{constructor(e){super(e),this.name="AuthenticatorInvocationError"}}const st=/^[A-Za-z0-9._-]+$/;function ot(e){return e.toLowerCase().replace(/[_\-.\s]/g,"")}const it=new Set(ne.map(ot)),ct=new Set(Re.flatMap(e=>Me(e).query)),dt={request_id:128,user_code:64};function ut(e){throw new at(e)}function lt(e,t){const n=e.getAll(t);return n.length>1&&ut(`Duplicate ${t} parameters are not allowed.`),n[0]??null}function pt(e,t,n){const r=Me(e).fallback;return void 0===r?null:(Ne[r].query??[]).includes(t)?`${ze(r)}?${t}=${encodeURIComponent(n)}`:null}function ft(e,t){const n=new URLSearchParams(t);!function(e){for(const t of e.keys())it.has(ot(t))&&ut("This link contains credential material and was refused."),ct.has(t)||ut("This link contains an unsupported parameter.")}(n);const[r,a]=function(e){const t=[...ct].map(t=>[t,lt(e,t)]).filter(e=>null!==e[1]),[n]=t;return 1===t.length&&void 0!==n||ut("This link must contain exactly one request handle."),[n[0],n[1]]}(n),s=Me(e);s.query.includes(r)||function(e,t){"mfa"===e&&ut("MFA links cannot contain a remote request URI."),"user_code"===t&&ut("Protocol links cannot contain an MFA user code."),ut("Protocol links require a standard HTTPS request URI.")}(e,r);const o=e=>`${s.app}?${s.appParameter??r}=${encodeURIComponent(e)}`;if("request_uri"===r){const t=function(e){let t;try{t=new URL(e)}catch{return ut("The protocol request URI is malformed.")}return("https:"!==t.protocol||""!==t.username||""!==t.password||""!==t.hash||function(e){const t=e.toLowerCase();if("localhost"===t||t.endsWith(".localhost")||"[::1]"===t)return!0;const n=t.split(".").map(Number);return 4!==n.length||n.some(e=>!Number.isInteger(e))?t.startsWith("[fc")||t.startsWith("[fd")||t.startsWith("[fe80:"):function(e){const[t=-1,n=-1]=e;return 0===t||10===t||127===t||169===t&&254===n||172===t&&n>=16&&n<=31||192===t&&168===n||t>=224}(n)}(t.hostname))&&ut("The protocol request URI is not a safe public HTTPS URL."),t}(a);return{kind:e,handleName:r,handle:t.href,appUrl:o(t.href),browserFallback:null,requestHost:t.host}}const i=function(e,t){return(0===e.length||e.length>t||!st.test(e))&&ut("The request handle is malformed or expired."),e}(a,dt[r]??0),c="user_code"===r?i.toUpperCase():i;return{kind:e,handleName:r,handle:c,appUrl:o(c),browserFallback:pt(e,r,c),requestHost:null}}const ht="config/projects";async function mt(e){const t=new Set(h()),n=e.filter(e=>!t.has(e)),r=n.map(e=>_t(Z[0],e));return await C(r),n.filter((e,t)=>null!==b(r[t]??""))}const gt=new Set,yt=new class{unsealedNames=new Map;#e=null;#t=null;#n=0;#r;#a;constructor(e,t){this.#r=e,this.#a=t}get activeTomb(){return this.#t}boot(e=[]){const t=L(),n=new Set([V,...h(),t,...e]),r=[z()];for(const a of[...n].sort()){if(a===V||a===m)continue;const e=this.unsealedNames.get(a);r.push({id:a,name:e?.name??a,kind:"standard",createdAt:e?.createdAt??new Date(0).toISOString()})}return{v:1,projects:r,activeId:t}}state(){return this.#e||(this.#e=this.boot()),this.#e}reset(){this.#n++,this.#e=this.boot(),this.#t=null,this.#r()}#s(e,t){t();const n=++this.#n;return this.#t=e,()=>{if(t(),this.#n!==n||this.#t!==e)throw new g("locked","The original project-view session ended.")}}async hydrate(e,t){const n=this.#s(e,t);let r;try{const t=await y(e,ht);n(),r=K(JSON.parse((new TextDecoder).decode(t)))}catch(c){if(n(),c instanceof g&&"locked"===c.code)throw c;return this.#e=this.boot(),this.unsealedNames.has(e)&&w(e)?this.write(this.#e):this.#r()}const a=r.projects.map(e=>e.id),s=await v(I,1<<20).then(()=>this.#a(a),()=>null);n();const o=s?B(this.boot(s),r):r;this.#e=o;const i=new Set(o.projects.map(e=>e.id));if(a.some(e=>!i.has(e))){const t=(new TextEncoder).encode(JSON.stringify(o));await k(e,ht,t).catch(e=>{if(e instanceof g&&"locked"===e.code)throw e}),n()}this.#r()}async migrate(e,t){const r=b(F);if(!r)return;let a;try{a=JSON.parse(r)}catch{return}if(!n(a)||!Array.isArray(a.projects))return;const s=this.#s(e,t),o=K(a);await k(e,ht,(new TextEncoder).encode(JSON.stringify(o))),s();const i={v:1,activeId:o.activeId};await A(F,JSON.stringify(i)),s(),this.#e=o}async write(e){const t=++this.#n,n=this.#t,r={v:1,activeId:e.activeId};if(await A(F,JSON.stringify(r)),t===this.#n){if(this.#e=e,n&&w(n)){if(await k(n,ht,(new TextEncoder).encode(JSON.stringify(e))),t!==this.#n)return;this.unsealedNames.delete(n)}this.#r()}}async carry(e,t){if(!w(e))return;const n=this.#n;try{return void(await y(e,ht))}catch(a){if(a instanceof g&&"locked"===a.code)throw a}if(n!==this.#n)return;this.#t=e;const r=H(this.boot(),t);await this.write({...r,activeId:L()})}}(function(){for(const e of gt)e()},mt);function wt(){yt.reset()}async function vt(){const e=yt.activeTomb;e&&w(e)?await It(e):wt()}function It(e,t=()=>{}){return yt.hydrate(e,t)}function kt(e,t=()=>{}){return yt.migrate(e,t)}function bt(e){return yt.write(e)}function At(e,t){return yt.carry(e,t)}function Tt(){return Dt().projects}function _t(e,t=Ot().id){return t===V?e:`project.${t}.${e}`}function jt(e=Ot().id){return[...W,...Z].map(t=>_t(t,e))}async function St(e,t){const n=t.trim();if(!n)throw new Error("Give the project a name.");const r=Dt();if(e===V)throw new Error("The personal project cannot be renamed.");await bt({...r,projects:r.projects.map(t=>t.id===e?{...t,name:n}:t)})}async function Et(e){const t=new Set(e);for(const r of t)yt.unsealedNames.delete(r);const n=Dt();await bt({v:1,projects:n.projects.filter(e=>e.id===V||!t.has(e.id)),activeId:t.has(n.activeId)?V:n.activeId})}const xt={projectsState:function(){return yt.state()},subscribeProjects:function(e){return gt.add(e),()=>gt.delete(e)},activeProject:function(){const e=Dt();return e.projects.find(t=>t.id===e.activeId)??e.projects[0]??z()},createProject:async function(e){const t=e.trim();if(!t)throw new Error("Give the project a name.");if(t.toLowerCase()===m)throw new Error("guest is the continue-as-guest road, not a vault name.");const n=Dt();if(n.projects.some(e=>e.name.toLowerCase()===t.toLowerCase()))throw new Error("A project with that name already exists.");const r={id:`prj_${crypto.randomUUID()}`,name:t,kind:"standard",createdAt:(new Date).toISOString()};return yt.unsealedNames.set(r.id,{name:r.name,createdAt:r.createdAt}),await E(r.id),await bt({...n,projects:[...n.projects,r]}),r},setActiveProject:async function(e){const t=Dt();if(!t.projects.some(t=>t.id===e))throw new Error("That project no longer exists on this device.");t.activeId!==e&&await bt({...t,activeId:e})},deleteProject:async function(e){if(e===V)throw new Error("The personal project cannot be deleted.");const t=Dt();t.projects.some(t=>t.id===e)&&(await Promise.all([...jt(e).map(e=>T(e)),...[x,D,P,O].map(t=>_(e,t)),j(e,"config/prefs"),j(e,"config/idp-registry"),j(e,"config/projects"),j(e,"config/org-profile"),S(e)]),yt.unsealedNames.delete(e),await bt({v:1,projects:t.projects.filter(t=>t.id!==e),activeId:t.activeId===e?V:t.activeId}))}};function Dt(){return xt.projectsState()}function Pt(e){return xt.subscribeProjects(e)}function Ot(){return xt.activeProject()}async function Ct(e){return xt.createProject(e)}async function $t(e){return xt.setActiveProject(e)}async function Nt(e){return xt.deleteProject(e)}const qt=Object.freeze(Object.defineProperty({__proto__:null,PERSONAL_PROJECT_ID:V,PROJECTS_CONFIG_PATH:ht,PROJECTS_KEY:F,PROJECT_SCOPED_KEYS:W,activeProject:Ot,carryProjectsViewInto:At,createProject:Ct,deleteProject:Nt,forgetDepartedProjects:Et,hydrateProjectsFromVfs:It,legacyVaultsAmong:mt,listProjects:Tt,migrateProjectsToVfs:kt,projectScopedKeys:jt,projectSeams:xt,projectsState:Dt,refreshProjectsView:vt,rehydrateProjects:wt,renameProject:St,scopedKey:_t,setActiveProject:$t,subscribeProjects:Pt},Symbol.toStringTag,{value:"Module"})),Jt=new EventTarget,Rt=new EventTarget;let Mt,Ut,Lt=!1;function Vt(){void 0===Ut?(Rt.dispatchEvent(new Event("change")),Ut=setTimeout(()=>{Ut=void 0,Lt&&(Lt=!1,Vt())},200)):Lt=!0}function zt(){if(void 0!==Mt)return Mt;try{Mt=c("opensesame:local-iam")}catch{Mt=null}return Mt&&(Mt.onmessage=Vt),Mt}function Kt(){Jt.dispatchEvent(new Event("change"));try{zt()?.postMessage({type:"changed"})}catch{}G({category:"identity",type:"identity.changed",summary:"Identity or access state changed",outcome:"info"})}function Bt(e){return Jt.addEventListener("change",e),()=>Jt.removeEventListener("change",e)}function Ft(e){return zt(),Rt.addEventListener("change",e),()=>Rt.removeEventListener("change",e)}const Ht={carried:()=>{},bounds:()=>({}),publish:()=>Promise.resolve()};class Wt extends Error{name="LocalDirectoryError"}const Zt="config/device-receipts",Gt="config/device-receipts-pending",Yt=256e3;function Xt(e){return!!n(e)&&r(e.id)&&r(e.occurredAt)&&r(e.eventType)&&function(e){return"succeeded"===e||"failed"===e||"denied"===e}(e.outcome)&&r(e.targetType)&&r(e.targetId)&&n(e.metadata)}class Qt extends Wt{}async function en(e,t){await v($(e,t),512e3);try{const r=await y(e,t);if(r.length>Yt)throw new Qt("The receipts exceed their storage.");return function(e,t){let r;try{r=JSON.parse(e)}catch{throw new Qt(`The ${t} is corrupt.`)}if(!n(r)||1!==r.version||!Array.isArray(r.receipts)||!r.receipts.every(Xt))throw new Qt(`The ${t} is corrupt.`);return r.receipts}((new TextDecoder).decode(r),t===Zt?"receipt trail":"pending receipt list")}catch(r){if(r instanceof g&&"not-found"===r.code)return[];if(r instanceof g&&"corrupt"===r.code||r instanceof N)throw new Qt("The receipts do not open.");throw r}}async function tn(e,t,n){const r=(new TextEncoder).encode(JSON.stringify({version:1,receipts:n}));if(r.length>Yt)throw new Wt("The receipts exceed their storage.");await k(e,t,r)}function nn(e){const t=new Set;return e.filter(e=>!t.has(e.id)&&(t.add(e.id),!0))}const rn=new Map;function an(e,t,n,r,a){const s=`opensesame:local-${t}:${e}`,o=(rn.get(s)??Promise.resolve()).then(async()=>{const t=$(e,n),o=d();if(o)return o.request(s,async()=>(await v(t,r),a()));if(await v(t,r),"persistent"===q())throw new Error("Web Locks are required for shared access writes.");return a()});return rn.set(s,o.catch(()=>{})),o}const sn={"request.created":["access.request.created","succeeded"],"request.approved":["access.request.approved","succeeded"],"request.denied":["access.request.denied","denied"],"request.withdrawn":["access.request.withdrawn","succeeded"],"sign_in.granted":["access.sign_in.granted","succeeded"],"sign_in.denied":["access.sign_in.denied","denied"],"sign_in.revoked":["access.sign_in.revoked","succeeded"],"session.ended":["access.session.revoked","succeeded"],"siop.approved":["access.siop.approved","succeeded"],"siop.denied":["access.siop.denied","denied"],"drop.sent":["access.drop.sent","succeeded"],"drop.opened":["access.drop.opened","succeeded"],"drop.expired":["access.drop.expired","succeeded"],"drop.locked_out":["access.drop.locked_out","denied"],"drop.refused":["access.drop.refused","denied"],"drop.revoked":["access.drop.revoked","succeeded"],"live.granted":["access.live.granted","succeeded"],"live.ended":["access.live.ended","succeeded"],"share.requested":["access.share.requested","succeeded"],"share.granted":["access.share.granted","succeeded"],"share.revoked":["access.share.revoked","succeeded"],"share.approved":["access.share.approved","succeeded"],"share.denied":["access.share.denied","denied"]};Object.values(sn).map(([e])=>e);const on=new Map,cn=e=>nn(e).slice(-256);async function dn(e,t){await an(e,"receipts",Zt,512e3,async()=>{const n=await en(e,Gt).catch(()=>[]),r=nn([...t,...on.get(e)??[],...n]),{trail:a,replaced:s}=await async function(e){try{return{trail:await en(e,Zt),replaced:!1}}catch(t){if(t instanceof Qt)return{trail:[{id:crypto.randomUUID(),occurredAt:(new Date).toISOString(),eventType:"access.receipts.reset",outcome:"failed",targetType:"device",targetId:"receipts",metadata:{}}],replaced:!0};throw t}}(e);return!(0===r.length&&!s||(await tn(e,Zt,function(e,t){return nn([...e,...t]).sort((e,t)=>e.occurredAt<t.occurredAt?1:e.occurredAt>t.occurredAt?-1:0).slice(0,256)}(r,a)),on.delete(e),n.length>0&&await tn(e,Gt,[]).catch(()=>{}),0))})&&Kt()}function un(e){return void 0!==e.claimId?{targetType:"claim",targetId:e.claimId}:void 0!==e.shareId?{targetType:"share",targetId:e.shareId}:void 0!==e.liveSessionId?{targetType:"live_session",targetId:e.liveSessionId}:void 0!==e.sessionOf?{targetType:"principal",targetId:e.sessionOf}:{targetType:"application",targetId:e.applicationId}}async function ln(e,t,n){const r=function(e,t){const[n,r]=sn[e];return a={eventType:n,outcome:r,...un(t)},s=function(e){const t={};return e.requestId&&(t.authReqId=e.requestId),e.subject&&(t.subject=e.subject),e.actor&&(t.actor=e.actor),e.organizationId&&(t.organizationId=e.organizationId),e.claimId&&(t.claimId=e.claimId),e.resourceId&&(t.resourceId=e.resourceId),void 0!==e.count&&(t.count=e.count),t}(t),{id:crypto.randomUUID(),occurredAt:(new Date).toISOString(),...a,metadata:Y(s)};var a,s}(t,n);try{await dn(e,[r])}catch{await async function(e,t){if(!w(e))return;const n=cn([...on.get(e)??[],t]);on.set(e,n);try{await an(e,"receipts",Gt,512e3,async()=>{const t=await en(e,Gt).catch(()=>[]);await tn(e,Gt,cn([...t,...n]))})}catch{}}(e,r)}}async function pn(e){if(!w(e))return 0;const t=await en(e,Gt).catch(()=>[]),n=nn([...on.get(e)??[],...t]),r=new Set((await en(e,Zt).catch(()=>[])).map(e=>e.id));return n.filter(e=>!r.has(e.id)).length}async function fn(e){try{await dn(e,[])}catch{w(e)||on.delete(e)}return pn(e)}function hn(e){return{id:e.id,occurredAt:e.occurredAt,eventType:e.eventType,outcome:e.outcome,metadata:{...e.metadata,targetType:e.targetType,targetId:e.targetId}}}async function mn(e,t){return await fn(e),(await en(e,Zt)).slice(0,Math.max(0,t)).map(hn)}function gn(e){return{applicationId:e.applicationId,requestId:e.id,subject:e.requesterId,organizationId:e.organizationId}}function yn(e){return{applicationId:e.applicationId,subject:e.principalId,organizationId:e.organizationId}}function wn(e){return{sessionOf:e.principalId,subject:e.principalId}}const vn=new Map;function In(e){return`Refused · ${e} wrong ${1===e?"code":"codes"}`}const kn=new Set;let bn,An=Promise.resolve(),Tn=()=>null,_n=()=>{};function jn(e,t){Tn=e,_n=t}function Sn(e){return Tn(e)??ee.activeTomb()}function En(){const e=bn;e&&Sn(e)&&(bn=void 0,Nn(e))}function xn(e){const t=e.trim();return 0===t.length||t.length>128||Q(t)!==t?null:t}function Dn(e){return!kn.has(e)&&(kn.size>=256&&kn.clear(),kn.add(e),!0)}function Pn(e,t,n,r){const a=Promise.all([te(e,t).then(()=>{},()=>{}),ln(e,n,r)]).then(()=>{},()=>{});An=An.then(()=>a,()=>a)}function On(e,t,n){const r=xn(t);if(!r||!e||!Dn(`drop-sent:${r}`))return;const a={claimId:r},s=n?.sourceItemId?xn(n.sourceItemId):null,o=n?.vaultItemId?xn(n.vaultItemId):null;s&&(a.sourceItemId=s),o&&(a.vaultItemId=o),Pn(e,{category:"vault",type:"vault.drop.sent",summary:"Drop sent",outcome:"succeeded",targetType:"claim",targetId:r,metadata:a},"drop.sent",s?{claimId:r,resourceId:s}:{claimId:r})}function Cn(e){const t=xn(e);if(!t)return;const n={category:"vault",type:"vault.drop.opened",summary:"Drop opened",outcome:"succeeded",targetType:"claim",targetId:t,metadata:{claimId:t}};for(const r of function(e){const t=[],n=Tn(e),r=ee.activeTomb();return n&&t.push(n),r&&r!==n&&t.push(r),t}(t))Dn(`drop-opened:${r}:${t}`)&&Pn(r,n,"drop.opened",{claimId:t})}function $n(e,t,n,r,a,s,o){const i=xn(e);if(!i)return!1;const c=Sn(i);if(!c||!Dn(`${t}:${c}:${i}`))return!1;const d={claimId:i};return void 0!==o&&(d.count=o),Pn(c,{category:"vault",type:n,summary:r,outcome:a,targetType:"claim",targetId:i,metadata:d},s,void 0===o?{claimId:i}:{claimId:i,count:o}),!0}function Nn(e){const t=xn(e);t&&(Sn(t)?$n(e,"drop-expired","vault.drop.expired","Drop expired","succeeded","drop.expired"):bn=t)}function qn(e,t){const n=xn(e),r=n?Sn(n):null,a=null!==n&&null!==r&&kn.has(`drop-refused:${r}:${n}`),o=function(e,t,n,r){if(!e||!t)return{action:"skip"};const a=`${t}:${e}`,s=function(e){return void 0===e||!Number.isInteger(e)||e<1?null:e}(n),o=vn.get(a)??0;if(null===s)return r?{action:"skip"}:{action:"write",summary:"Drop refused"};const i=Math.max(o,s);vn.set(a,i);const c=In(i);return r?i<=o?{action:"skip"}:{action:"revise",summary:c,count:i}:{action:"write",summary:c,count:i}}(n,r,t,a);var i;n&&r&&"skip"!==o.action&&("revise"!==o.action?$n(e,"drop-refused","vault.drop.refused",o.summary,"denied","drop.refused",o.count):An=An.then(i=()=>async function(e,t,n,r){try{await X(e,"vault.drop.refused",t,r,n)}catch{}try{await async function(e,t,n){await an(e,"receipts",Zt,512e3,async()=>{const r=await en(e,Zt);let a=!1;const o=r.map(e=>{if("access.drop.refused"!==e.eventType||e.targetId!==t)return e;const r=e.metadata.count;return s(r)&&r>=n?e:(a=!0,{...e,metadata:Y({...e.metadata,count:n})})});return!!a&&(await tn(e,Zt,o),!0)})&&Kt()}(e,t,n)}catch{}}(r,n,o.count,o.summary),i))}function Jn(e){$n(e,"drop-revoked","vault.drop.revoked","Drop revoked","succeeded","drop.revoked")}function Rn(e){const t=xn(e),n=ee.activeTomb();t&&n&&Dn(`live-ended:${t}`)&&Pn(n,{category:"access",type:"access.live.ended",summary:"Live session ended",outcome:"succeeded",targetType:"live_session",targetId:t,metadata:{}},"live.ended",{liveSessionId:t})}function Mn(e,t){const n=xn(e),r=xn(t),a=ee.activeTomb();n&&r&&a&&Dn(`live:${n}:${r}`)&&Pn(a,{category:"access",type:"access.live.granted",summary:"Live session granted",outcome:"succeeded",targetType:"live_session",targetId:n,metadata:{subject:r}},"live.granted",{liveSessionId:n,subject:r})}const Un=["share.approved","share.denied"];function Ln(e,t){const n=xn(t.id),r=xn(t.principalId),a=xn(t.resourceId);e&&n&&r&&a&&Dn(`share.requested:${n}`)&&Pn(e,{category:"access",type:"access.share.requested",summary:"Share requested",outcome:"succeeded",targetType:"share",targetId:n,metadata:{subject:r,resourceId:a}},"share.requested",{shareId:n,subject:r,resourceId:a})}function Vn(e,t,n){const r=xn(n.id),a=xn(n.principalId),s=xn(n.resourceId),o=Un[t];if(!(e&&r&&a&&s))return;if(!Dn(`${o}:${r}`))return;const[i,c]=sn[o],d={subject:a,resourceId:s};Pn(e,{category:"access",type:i,summary:`Share ${o.slice(6)}`,outcome:c,targetType:"share",targetId:r,metadata:d},o,{shareId:r,subject:a,resourceId:s})}function zn(e,t,n){const r=xn(n.id),a=xn(n.principalId),s=xn(n.resourceId);if(!(e&&r&&a&&s))return;if(!Dn(`share:${t}:${r}`))return;const o="granted"===t;Pn(e,{category:"access",type:o?"access.share.granted":"access.share.revoked",summary:o?"Share granted":"Share revoked",outcome:"succeeded",targetType:"share",targetId:r,metadata:{subject:a,resourceId:s}},o?"share.granted":"share.revoked",{shareId:r,subject:a,resourceId:s})}function Kn(e){const t=e.split(".");if(2!==t.length||!t[0]?.startsWith("osc_clm_"))return null;const n=t[0].slice(8);return n.length>0?n:null}async function Bn(e){const t=(new TextEncoder).encode(e.join("\0"));return ce(new Uint8Array(await crypto.subtle.digest("SHA-256",t)))}function Fn(e,t){if(e.length!==t.length)return!1;let n=0;for(let r=0;r<e.length;r+=1)n|=e.charCodeAt(r)^t.charCodeAt(r);return 0===n}function Hn(e){if(!Number.isInteger(e)||e<=0)throw new Error("randomIndex needs a positive bound");const t=Math.floor(2**32/e)*e,n=new Uint32Array(1),r=new DataView(n.buffer);let a;do{crypto.getRandomValues(n),a=r.getUint32(0)}while(a>=t);return a%e}function Wn(){try{return u()??null}catch{return null}}function Zn(e){let t=!1;function n(){if(t)return;t=!0;const n=Wn();if(n)for(const t of e){const e=n.getItem(t);null!==e&&null===b(t)&&R(t,e),n.removeItem(t)}}return{storage:{get length(){return 0},getItem:e=>(n(),b(e)),key:()=>null,removeItem(e){J(e)},setItem(e,t){n(),R(e,t)}},reset(){t=!1;const n=Wn();for(const t of e)J(t),n?.removeItem(t)}}}const Gn="opensesame.local-drop-claims.v1",Yn="opensesame.local-drop-pepper.v1",Xn=[Gn,Yn],Qn="Locked out. Too many wrong codes — ask the sender for a fresh drop.",er=Zn(Xn);function tr(){return er.storage}function nr(e){const t="That code does not match this drop.";return e>1?`${t} ${e} tries left.`:1===e?`${t} This is your last try.`:`${t} No tries left.`}async function rr(e){const n=async()=>{await v(Gn,4194304);const n=function(){const e=tr()?.getItem(Gn);if(!e)return{claims:{}};try{const n=JSON.parse(e);if(null===n||!l(n)||Array.isArray(n))return{claims:{}};const r=t(n).claims;return!l(r)||Array.isArray(r)?{claims:{}}:{claims:t(r)}}catch{return{claims:{}}}}(),r=e(n);return r.changed&&await A(Gn,JSON.stringify(n)),r.value},r=d();if(r)return r.request("opensesame.local-drop-claims.v1",n);if("persistent"===q())throw new Error("Web Locks are required for shared drop-claim writes.");return n()}async function ar(){const e=tr(),t=()=>{const t=e.getItem(Yn);return r(t)&&t.length>=32?t:null},n=t();if(n)return n;const a=d(),s=async()=>{await v(Yn,65536);const n=t();if(n)return n;const r=ce(crypto.getRandomValues(new Uint8Array(32)));return e.setItem(Yn,r),r};return a?a.request("opensesame.local-drop-pepper",s):s()}function sr(e,t){const n="pending"===e.state&&e.expiresAtMs<=t;return n||"pending"!==e.state&&function(e){const t=e.targetManifest;return!(l(t)&&!Array.isArray(t))||Object.keys(t).length>0}(e)?{...e,state:n?"expired":e.state,targetManifest:{},version:e.version+1}:e}async function or(e,t){return Bn([e,"token",t])}async function ir(e,t,n){return Bn([e,"code",t,n.trim()])}class cr extends Error{constructor(e,t,n=e,r){super(t),this.attemptsLeft=r,this.name="LocalDropClaimError",this.code=e,this.wire=n}attemptsLeft;code;wire}async function dr(e=Date.now()){await rr(t=>{let n=!1;for(const[r,a]of Object.entries(t.claims)){const s=sr(a,e);s!==a&&(t.claims[r]=s,n=!0)}return{value:void 0,changed:n}})}function ur(e=p()?.location.origin??"",t=f().BASE_URL||"/"){const n=()=>new cr("unreachable","This page has no origin, so a drop link cannot be minted here.");if(!r(e)||0===e.length)throw n();try{return new URL(t,e).href.replace(/\/$/,"")}catch{throw n()}}function lr(e=ur()){return`${e}${ze("claim")}`}async function pr(e,t){const n=await ar(),r=`clm_${ce(crypto.getRandomValues(new Uint8Array(16)))}`,a=ce(crypto.getRandomValues(new Uint8Array(24))),s=`osc_clm_${r}.${a}`,o=function(){let e="";for(let t=0;t<8;t+=1)e+="ABCDEFGHJKLMNPQRSTUVWXYZ23456789"[Hn(32)]??"A",3===t&&(e+="-");return e}(),i=Date.now(),c={id:r,tokenDigest:await or(n,s),userCodeDigest:await ir(n,r,o),targetManifest:structuredClone(e),state:"pending",expiresAtMs:i+Math.max(1e3,t),attempts:0,version:1};return await rr(e=>(e.claims[r]=c,{value:void 0,changed:!0})),{claimId:r,bearerToken:s,userCode:o,verifyUrl:lr(ur()),expiresAt:new Date(c.expiresAtMs).toISOString()}}async function fr(e,t){const n=await ar(),r=await or(n,t);return rr(t=>{const n=t.claims[e];if(!n)throw new cr("refused","This drop claim was not found on this device.");const a=sr(n,Date.now());if(!Fn(r,a.tokenDigest))throw new cr("refused","This drop's claim token was refused.");return a!==n&&(t.claims[e]=a),{value:(s=a.state,"pending"===s?"pending":"presented"===s?"consumed":"revoked"===s?"revoked":"locked_out"===s?"locked_out":"expired"),changed:a!==n};var s})}async function hr(e,t){const n=(e,t,n)=>new cr("refused",t,e,n),r=Kn(e);if(!r)throw n("invalid_token","This drop link's claim token is not well formed.");const a=await ar(),s=await or(a,e),o=await ir(a,r,t),i=await rr(e=>{const t=e.claims[r];if(!t)throw qn(r),n("not_found","This drop is not on this device. Open the link in the browser that sealed it, or connect a sign-in service for cross-device drops.");const a=sr(t,Date.now()),i=a!==t;if("pending"!==a.state)return i&&(e.claims[r]=a),"revoked"===a.state?{value:{kind:"refused",wire:"REVOKED",message:"This drop was revoked.",note:"refused"},changed:i}:"expired"===a.state?{value:{kind:"refused",wire:"EXPIRED",message:"This drop has expired.",note:"refused"},changed:i}:"locked_out"===a.state?{value:{kind:"refused",wire:"too_many_attempts",message:Qn,note:"locked"},changed:i}:{value:{kind:"refused",wire:"INVALID_TRANSITION",message:"This drop was already opened and cannot be opened again.",note:"refused"},changed:i};if(!Fn(s,a.tokenDigest))throw n("invalid_token","This drop's claim token was refused.");if(a.attempts>=5)return e.claims[r]={...a,state:"locked_out",targetManifest:{},version:a.version+1},{value:{kind:"refused",wire:"too_many_attempts",message:Qn,note:"locked"},changed:!0};if(!Fn(o,a.userCodeDigest)){const t=a.attempts+1,n=5-t,s=t>=5;return e.claims[r]={...a,attempts:t,state:s?"locked_out":a.state,...s?{targetManifest:{}}:void 0,version:a.version+1},{value:{kind:"refused",wire:s?"too_many_attempts":"invalid_user_code",message:s?Qn:nr(n),...s?void 0:{attemptsLeft:n},wrongCodes:t,note:s?"locked":"refused"},changed:!0}}const c=structuredClone(a.targetManifest);return e.claims[r]={...a,state:"presented",targetManifest:{},attempts:0,version:a.version+1},{value:{kind:"presented",manifest:c},changed:!0}});if("presented"===i.kind)return Cn(r),{claimId:r,state:"consumed",targetManifest:i.manifest};throw"locked"===i.note?function(e){$n(e,"drop-locked","vault.drop.locked_out","Drop locked out","denied","drop.locked_out")&&_n(e)}(r):qn(r,i.wrongCodes),n(i.wire,i.message,i.attemptsLeft)}async function mr(e,t){const n=await ar(),r=await or(n,t);return rr(t=>{const n=t.claims[e];if(!n)return{value:"missing",changed:!1};const a=sr(n,Date.now());if(!Fn(r,a.tokenDigest))throw new cr("refused","This drop's claim token was refused.");return"presented"===a.state?(a!==n&&(t.claims[e]=a),{value:"already_consumed",changed:a!==n}):(t.claims[e]={...a,state:"revoked",targetManifest:{},version:a.version+1},{value:"revoked",changed:!0})})}const gr=12e5;function yr(e){const t=e.normalize("NFKC");return/^\d+$/u.test(t)?t.length*Math.log2(10):t.length*Math.log2(36)}function wr(e){const t=yr(e),n=Math.ceil(gr*2**(50-t));return Math.min(U,Math.max(gr,n))}const vr=Object.freeze(Object.defineProperty({__proto__:null,PIN_KDF_SECURITY_BITS:50,PIN_PBKDF2_ITERATIONS:gr,assertPinKdfIterations:function(e,t){M(e);const n=wr(t);if(!(e.iterations>=n||e.iterations===gr&&n>gr))throw new N("key derivation parameters were altered")},estimatePinEntropyBits:yr,pinPbkdf2Iterations:wr},Symbol.toStringTag,{value:"Module"}));class Ir extends Error{name="AbortError";constructor(e="lease aborted"){super(e)}}function kr(e){const t=new AbortController,n=()=>{t.signal.aborted||t.abort()};for(const r of e){if(r.aborted){n();break}r.addEventListener("abort",n,{once:!0})}return t.signal}function br(e,t){return e.aborted?Promise.reject(new Ir):new Promise((n,r)=>{const a=()=>r(new Ir);e.addEventListener("abort",a,{once:!0}),t().then(t=>{e.removeEventListener("abort",a),e.aborted||n(t)},t=>{e.removeEventListener("abort",a),e.aborted||r(t)})})}export{wn as $,ke as A,re as B,ce as C,ye as D,ge as E,he as F,me as G,ve as H,we as I,se as J,De as K,cr as L,xe as M,_e as N,be as O,je as P,Ht as Q,Pe as R,Tt as S,Ot as T,Ee as U,Oe as V,jt as W,$t as X,Ct as Y,Nt as Z,ze as _,hr as a,vt as a0,et as a1,gn as a2,mn as a3,pn as a4,yn as a5,In as a6,Mn as a7,Rn as a8,_t as a9,ft as aA,at as aB,qe as aC,zn as aD,qt as aE,vr as aF,St as aa,Et as ab,mt as ac,ne as ad,Ce as ae,kt as af,It as ag,wt as ah,ht as ai,At as aj,Se as ak,mr as al,Nn as am,Jn as an,Zn as ao,En as ap,On as aq,jn as ar,Kn as as,Cn as at,qn as au,Qe as av,Fe as aw,tt as ax,rt as ay,Ue as az,kr as b,pr as c,Ir as d,Wt as e,fn as f,Ft as g,ie as h,Pt as i,Dt as j,Vn as k,Ln as l,Ke as m,Kt as n,ur as o,fr as p,lr as q,br as r,Bt as s,Xn as t,dr as u,ln as v,an as w,ae as x,oe as y,Ie as z};

package/dist/assets/support-context-DrcseTKK.js

@@ -0,0 +1 @@
+import{N as t,i as n,o as e,m as s,a as o,r,b as i,c as u,d as c,e as a,S as f,f as l,g as d,h as g,j as m,p as b,R as v,G as p,M as k,k as y}from"./pane-trail-dW-2RSUm.js";import{c as h,B as j,i as O}from"./vault-ui-seam-BQGS7RR6.js";import{r as $}from"./react-dom-BwC4eQlG.js";const x=["vault","rail"],K={vault:"in the vault list",rail:"in the rail"};function q(t){return"vault"===t||"rail"===t}const w={bindings:{},macros:{},singleKeys:!0},M=/^(https?:|javascript:|data:|\/\/)|:\/\//i;function W(t){const n=b(t);if(null===n)return`"${t}" is not a key.`;for(const e of n){const t=v.get(e);if(void 0!==t)return`${e} is fixed: ${t}.`}return null}function N(o,r,i,u,c){return W(o)||(M.test(r)?"Keybindings cannot name URLs or endpoints.":r===t?null:n(r)?void 0===e(u,s(r))?`No macro "${s(r)}".`:null:void 0!==a(r,i)||r.startsWith(f)?function(t,n,e,s){return"authority"===a(n,e)?.kind&&s.get(t)!==n}(o,r,i,c)?`Action "${r}" requires confirmation and cannot be rebound to skip it.`:null:`Unknown action "${r}".`)}function S(n,e){if(!h(n))return r("Keybindings must be a mapping of keys to action ids.");const{commands:s,macros:o,defaults:i,base:a}=e,f={};for(const[c,l]of Object.entries(n)){const n=u(c);if(null===n)return r(`"${c}" is not a key.`);const e=null===l?t:l;if(!O(e))return r(`Binding for "${c}" is not an action id.`);const d=N(n,e,s,o,i);if(d)return r(d);a.get(n)!==e&&(e!==t||a.has(n))&&(f[n]=e)}return c(f)}function A(o,r,i){for(const[u,c]of Object.entries(r))c===t||n(c)&&void 0===e(i,s(c))?o.delete(u):o.set(u,c);return o}function B(n,e,s){if(!h(n))return r("A keymap is a mapping.");const o=i(n.macros??{},e);if(!o.ok)return o;const u={commands:e,macros:o.value,defaults:s,base:s},a=S(n.bindings??n.keybindings??{},u);if(!a.ok)return a;const f=A(new Map(s),a.value,o.value),b=function(t,n){if(null==t)return c({});if(!h(t))return r("contexts is a mapping of vault and rail to keybindings.");const e={};for(const[s,o]of Object.entries(t)){if(!q(s))return r(`"${s}" is not a context: vault or rail.`);const t=S(o??{},n);if(!t.ok)return r(`In ${s}: ${t.message}`);Object.keys(t.value).length>0&&(e[s]=t.value)}return c(e)}(n.contexts,{...u,base:f});if(!b.ok)return b;const v=n.singleKeys??!0;if(!j(v))return r("singleKeys must be true or false.");const p=function(n,e,s){const o=function(n,e,s){if(null==n)return c({});if(!h(n))return r("gestures is a mapping of gestures to action ids.");const o={};for(const[i,u]of Object.entries(n)){if(!l(i))return r(d(i)??`"${i}" is not a gesture.`);const n=null===u?t:u;if(!O(n))return r(`Gesture "${i}" is not an action id.`);const c=g(n,e,s);if(c)return r(c);const a=m(i)?.default;n!==a&&(o[i]=n)}return c(o)}(n.gestures,e,s);if(!o.ok)return o;const i=n.motion??!0;return j(i)?c({gestures:o.value,motion:i}):r("motion must be true or false.")}(n,e,o.value);if(!p.ok)return p;let k={bindings:a.value,macros:o.value,singleKeys:v};return C(b.value)&&(k={...k,contexts:b.value}),Object.keys(p.value.gestures).length>0&&(k={...k,gestures:p.value.gestures}),p.value.motion||(k={...k,motion:!1}),{ok:!0,config:k}}function C(t){return Object.values(t??{}).some(t=>Object.keys(t).length>0)}function E(t){const n={bindings:{...t.bindings},macros:Object.fromEntries(Object.entries(t.macros).map(([t,n])=>[t,o(n)])),singleKeys:t.singleKeys};if(C(t.contexts)){const e={};for(const[n,s]of Object.entries(t.contexts??{}))q(n)&&Object.keys(s).length>0&&(e[n]={...s});n.contexts=e}return Object.keys(t.gestures??{}).length>0&&(n.gestures={...t.gestures}),!1===t.motion&&(n.motion=!1),n}function G(t){return!1!==t.motion}function R(t){return t.gestures??{}}function U(o){const r=new Map(p.map(t=>[t.id,t.default]));for(const[i,u]of Object.entries(R(o))){if(!l(i))continue;const c=n(u)&&void 0===e(o.macros,s(u));u===t||c?r.delete(i):r.set(i,u)}if(!G(o))for(const t of p)"motion"===t.family&&r.delete(t.id);return r}function I(n){const e=R(n),s=U(n),o=G(n);return p.map(n=>{const r=e[n.id],i=void 0===r?"default":r===t?"removed":"user";return{id:n.id,label:n.label,family:n.family,target:s.get(n.id)??null,source:i,defaultTarget:n.default,changed:void 0!==r,off:!o&&"motion"===n.family}})}function L(n,e,s){const o={...R(n)},r=m(e)?.default;return s===r?delete o[e]:o[e]=null===s?t:s,F(n,o)}function T(t,n){const e={...R(t)};return delete e[n],F(t,e)}function z(t){const e={};for(const[r,i]of Object.entries(R(t)))l(r)&&!n(i)&&(e[r]=i);const s={bindings:{},macros:{},singleKeys:!0},o=!1===t.motion?{motion:!1}:{};return 0===Object.keys(e).length?{...s,...o}:{...s,...o,gestures:e}}function D(t){const{gestures:n,motion:e,...s}=t;return s}function F(t,n){const{gestures:e,...s}=t;return 0===Object.keys(n).length?s:{...s,gestures:n}}function H(t){const n=new Map;for(const e of t)for(const t of e.defaults)n.has(t)||n.set(t,e.id);return n}function J(t){const n=b(t)?.[0];return void 0!==n&&y(n)}function P(t,n,e){const s=A(H(n),t.bindings,t.macros);if(void 0!==e&&A(s,Q(t,e),t.macros),!t.singleKeys)for(const o of[...s.keys()])J(o)&&s.delete(o);return s}function Q(t,n){return void 0===n?t.bindings:t.contexts?.[n]??{}}function V(t,n,e){const s=H(n);return void 0===e?s:A(s,t.bindings,t.macros)}function X(t,n,e){if(void 0===n)return{...t,bindings:e};const s={...t.contexts,[n]:e};return 0===Object.keys(e).length&&delete s[n],{...t,contexts:s}}function Y(t,n,e,s){if(void 0!==s)return function(t,n,e,s){const o=Q(n,s),r=[];for(const i of Y(t,n,e))void 0===o[i.sequence]?r.push(i):"removed"!==i.source&&r.push({sequence:i.sequence,source:"removed",scope:s});for(const[i,u]of Object.entries(o))u===t&&r.push({sequence:i,source:"user",scope:s});return r}(t,n,e,s);const o=H(e),r=[];for(const[i,u]of o)u===t&&r.push({sequence:i,source:void 0===n.bindings[i]?"default":"removed"});for(const[i,u]of Object.entries(n.bindings))u===t&&r.push({sequence:i,source:"user"});return r}function Z(t,n,e,s){return Y(t,n,e,s).some(t=>void 0===s?"default"!==t.source:t.scope===s)}function _(t,n,e){const s=e.get(t);if(void 0!==s&&s!==n)return{kind:"taken",target:s};const o=[...e.keys()].filter(n=>n!==t&&(n.startsWith(`${t} `)||t.startsWith(`${n} `)));return o.length>0?{kind:"prefix",with:o}:{kind:"none"}}function tt(t){const n=new Set,e=[...t.keys()];for(const s of e)for(const t of e)t.startsWith(`${s} `)&&(n.add(s),n.add(t));return n}function nt(n,e,s,o){e.get(s)===o?delete n[s]:o!==t||e.has(s)?n[s]=o:delete n[s]}function et(n,e,s,o,r={}){const{previous:i,mode:u="replace",context:c}=r,a=V(n,e,c),f={...Q(n,c)},l=P(n,e,c).get(s);return void 0!==i&&i!==s&&nt(f,a,i,"swap"===u&&void 0!==l?l:t),nt(f,a,s,o),X(n,c,f)}function st(n,e,s,o){const r={...Q(n,o)};return nt(r,V(n,e,o),s,t),X(n,o,r)}function ot(t,n,e){const s={...Q(t,e)};return delete s[n],X(t,e,s)}function rt(t,n,e,s){const o=V(t,n,s),r={};for(const[i,u]of Object.entries(Q(t,s))){const t=o.get(i)===e;u===e||t||(r[i]=u)}return X(t,s,r)}function it(t,n,e){const s=t=>{const s={};for(const[o,r]of Object.entries(t))r!==n?s[o]=r:null!==e&&(s[o]=e);return s};let o=X(t,void 0,s(t.bindings));for(const r of x){const n=t.contexts?.[r];n&&(o=X(o,r,s(n)))}return function(t,n,e){const s={};for(const[o,r]of Object.entries(R(t)))l(o)&&(r!==n?s[o]=r:null!==e&&(s[o]=e));return F(t,s)}(o,n,e)}function ut(t,n){return t.startsWith(k)?`@${s(t)}`:a(t,n)?.label??t}const ct=$.createContext(null);export{K as C,w as E,x as K,ct as S,D as a,L as b,J as c,ot as d,P as e,et as f,I as g,W as h,Z as i,_ as j,Y as k,rt as l,it as m,H as n,B as o,tt as p,R as q,T as r,E as s,ut as t,st as u,z as v,U as w};

package/dist/assets/tailnet-devices-B4-KR7Lk.css

@@ -0,0 +1 @@
+.tailnet-row__marks{display:flex;flex-wrap:wrap;gap:4px 12px;margin-top:4px}.tailnet-choices{display:flex;flex-wrap:wrap;gap:6px;margin:4px 0 8px}.tailnet-choice{min-height:32px;padding:0 12px;border:1px solid var(--line-strong);border-radius:0;background:var(--canvas);color:var(--ink);font:inherit;font-size:13px;cursor:pointer}.tailnet-choice[aria-pressed=true]{background:var(--ink);border-color:var(--ink);color:var(--canvas)}.tailnet-choice:focus-visible{outline:2px solid var(--ink);outline-offset:2px}.tailnet-switch{display:flex;align-items:center;justify-content:space-between;gap:12px;min-height:40px}@media(pointer:coarse){.tailnet-choice{min-height:44px;font-size:16px}.tailnet-switch{min-height:44px}}

package/dist/assets/tailnet-devices-CRKI2IIc.js

@@ -0,0 +1 @@
+import{c as e,i as t,B as n,b as a,C as i,n as r}from"./vault-ui-seam-BQGS7RR6.js";import{n as s}from"./identity-BVf8yWa4.js";import{ce as o}from"./main-BrkS-iow.js";import{S as l,i as u}from"./tailnet-plugin-pairing-DTK4jAlP.js";import{d as c,w as d,n as h,i as p,r as f,V as m,G as g}from"./model-provider-B6oAnQX9.js";import{b as y}from"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import{v as b}from"./drop-open-BjgdLxWM.js";class w extends Error{constructor(e,t=0,n=""){super(e),this.code=e,this.status=t,this.detail=n,this.name="TailnetAdminError"}code;status;detail}const v={"not-a-code":"That is not a tailnet pairing code. Run `opensesame daemon tailnet pair` and paste what it prints.","other-origin":"This code was printed for another web address. Pair again with --origin set to this page's address.",locked:"Unlock a vault you own to pair; a guest cannot hold the key.","shared-origin":"This shared-origin demo cannot manage tailnet devices. Use a dedicated or loopback deployment.",unreachable:"The daemon did not answer. Check that it runs and that Tailscale Serve reaches it.","pairing-refused":"The daemon refused the code: it was used, expired after five minutes, or is unknown. Pair again.",malformed:"The daemon answered with something this page cannot read.","target-changed":"The pairing changed while this was in flight. Try again.","no-daemon":"No daemon is paired for device management.",tailnet_pairing_required:"The daemon no longer knows this page's key. Pair again.",role_forbidden:"This pairing may read the tailnet but not change it.",tailnet_not_connected:"The daemon has no tailnet connected. Run `opensesame daemon tailnet connect` on it.",tailnet_admin_unavailable:"The daemon has nowhere to keep its tailnet state.",tailscale_credential_refused:"Tailscale refused the daemon's credential: it expired or lacks the scope this needs.",tailscale_unavailable:"Tailscale did not answer. Try again shortly.",tailscale_rejected:"Tailscale refused the change.",tags_required:"A key minted through an OAuth client must carry at least one tag.",not_found:"That device or key is no longer on the tailnet.",rate_limited:"Too many changes at once. Wait a moment and try again.",invalid_name:"A name is one label of lowercase letters, digits and hyphens.",invalid_tags:"Each tag is tag: and a lowercase name that starts with a letter.",invalid_routes:"Each route is an address range such as 10.0.0.0/16, with no host bits set.",invalid_description:"A description is at most 50 letters, digits, spaces and hyphens.",invalid_expiry:"A key lasts between one hour and 90 days."};function k(e){const t=function(e){for(const[t,n]of Object.entries(v))if(t===e)return n}(e.code)??`The daemon refused the request (${e.code}).`;return e.detail?`${t} ${e.detail}`:t}const T="/v1/tailnet/pairing",x="config/tailnet-admin";function _(e){return"read"===e||"manage"===e}function E(e){const t=h(e);return t&&p(t)?t:null}function $(e){return t(e)?e.slice(0,80):""}function z(n){const a=n.trim();if(!a.startsWith("opensesame-tailnet:v1:"))return null;const i=function(e){try{return JSON.parse((new TextDecoder).decode(y(e)))}catch{return null}}(a.slice(22));if(!e(i))return null;const{url:r,code:s,origin:o,role:c}=i;if(!t(r)||!t(s)||!t(o))return null;const d=E(r);return d&&l.test(s)&&u(o)&&_(c)?{url:d,code:s,origin:o,role:c,label:$(i.label)}:null}async function N(e,t){if(!t)return void(await c(e,x));const n=JSON.stringify({v:1,pairing:t});await d(e,x,(new TextEncoder).encode(n))}let A=null,S=null,D="",O=0,R=null;const j=new Set;function I(){O+=1;for(const e of j)e()}function C(){const e=b.getSnapshot();return"unlocked"===e.status&&!e.guest&&e.tomb!==g}function P(){const e=b.getSnapshot();return`${e.tomb}:${e.status}:${e.guest}`}async function L(){const n=null!==A;if(A=null,S=null,n?I():O+=1,!C())return;const a=P(),i=b.activeTomb(),r=await async function(n){let a;try{a=await f(n,x)}catch(i){if(i instanceof m&&"not-found"===i.code)return null;throw i}try{const n=JSON.parse((new TextDecoder).decode(a));return e(n)&&1===n.v?function(n){if(!e(n))return null;const{url:a,token:i,origin:r,role:s}=n;if(!t(a)||!t(i)||!t(r))return null;const o=E(a);return o&&l.test(i)&&u(r)&&_(s)?{url:o,token:i,origin:r,role:s,label:$(n.label)}:null}(n.pairing):null}catch{return null}}(i).catch(()=>null);P()===a&&null!==R&&(A=r,S=r?i:null,r&&I())}function K(){const e=P();e!==D&&(D=e,L())}const B=/^[A-Za-z0-9]{1,64}$/;function M(e){return t(e)?e.slice(0,255):""}function W(e){return t(e)&&""!==e?e.slice(0,64):null}function J(e){return n(e)&&e}function U(e){const n=[];if(!Array.isArray(e))return n;for(const a of e){if(n.length>=256)break;t(a)&&n.push(a.slice(0,255))}return n}function q(e){return t(e.id)&&B.test(e.id)?e.id:null}function V(t){if(!e(t))return null;const n=q(t);return n?{id:n,name:M(t.name),hostname:M(t.hostname),os:M(t.os),clientVersion:M(t.client_version),updateAvailable:J(t.update_available),user:M(t.user),addresses:U(t.addresses),tags:U(t.tags),authorized:J(t.authorized),external:J(t.external),ephemeral:J(t.ephemeral),keyExpiryDisabled:J(t.key_expiry_disabled),expires:W(t.expires),created:W(t.created),lastSeen:W(t.last_seen),connected:J(t.connected),blocksIncoming:J(t.blocks_incoming),sshEnabled:J(t.ssh_enabled),multipleConnections:J(t.multiple_connections),advertisedRoutes:U(t.advertised_routes),enabledRoutes:U(t.enabled_routes),tailnetLockError:W(t.tailnet_lock_error)}:null}function F(t,n,a){if(!e(t))return null;const i=t[n];return Array.isArray(i)?i.flatMap(e=>{const t=a(e);return null===t?[]:[t]}):null}function G(e){return F(e,"devices",V)}function Z(t){if(!e(t))return null;const n=q(t);return n?{id:n,description:M(t.description),created:W(t.created),expires:W(t.expires),revoked:W(t.revoked),invalid:J(t.invalid),reusable:J(t.reusable),ephemeral:J(t.ephemeral),preauthorized:J(t.preauthorized),tags:U(t.tags)}:null}function H(e){return F(e,"keys",Z)}function Q(t){if(!e(t)||!_(t.role))return null;const n="oauth"===t.credential||"api_key"===t.credential?t.credential:null;return{connected:J(t.connected),tailnet:M(t.tailnet),credential:n,role:t.role,label:M(t.label)}}function Y(t){return e(t)&&a(t.at)&&a(t.status)?{at:t.at,pairing:M(t.pairing),label:M(t.label),origin:M(t.origin),action:M(t.action),target:M(t.target),status:t.status}:null}function X(e){return F(e,"entries",Y)}const ee={pairing:function(){return A&&C()&&b.activeTomb()===S?A:null},revision:function(){return O},subscribe:function(e){return j.add(e),null===R&&(D=P(),R=b.subscribe(K),L()),()=>{j.delete(e),j.size>0||null===R||(R(),R=null,A=null,S=null,O+=1)}},vaultReady:C,eligible:()=>r.eligible(),bind:function(){return{tomb:b.activeTomb(),revision:O}},keep:async function(e,t){if(!C())throw new w("locked");const n=b.activeTomb();if(n!==t.tomb)throw new w("locked");if(O!==t.revision)throw new w("target-changed");if(await N(n,e),b.activeTomb()!==n)throw new w("locked");A=e,S=n,I()},drop:async function(e){C()&&O===e&&(await N(b.activeTomb(),null),A=null,S=null,I())},pageOrigin:()=>i()};function te(){return ee.eligible()?ee.vaultReady()?null:"locked":"shared-origin"}function ne(e){try{return new URL(e).host}catch{return e}}async function ae(e){return 204===e.status?null:s(e,2097152,2e4).catch(()=>{throw new w("malformed",e.status)})}function ie(n,a){if(!e(a)||!t(a.error))return new w("malformed",n);const i=t(a.detail)?a.detail.slice(0,200):"";return new w(a.error,n,i)}function re(e,t){if(null===e)throw new w("malformed",t);return e}function se(e){return encodeURIComponent(e)}function oe(){const e=ee.pairing();return e?{label:e.label,host:ne(e.url),role:e.role,revision:ee.revision()}:null}async function le(e,t,n){await e.send(t.url,T,{method:"DELETE",headers:{Authorization:`Bearer ${t.token}`},signal:n}).catch(()=>null)}function ue({call:t,read:n}){async function a(e,n,a){await t("POST",`/devices/${se(e)}/${n}`,a)}return{listDevices:e=>n("/devices",G,e),getDevice:(e,t)=>n(`/devices/${se(e)}`,V,t),setAuthorized:(e,t)=>a(e,"authorized",{authorized:t}),rename:(e,t)=>a(e,"name",{name:t}),setTags:(e,t)=>a(e,"tags",{tags:[...t]}),setKeyExpiryDisabled:(e,t)=>a(e,"key-expiry",{disabled:t}),expire:e=>a(e,"expire"),async setRoutes(n,a){const i=await t("POST",`/devices/${se(n)}/routes`,{enabled_routes:[...a]});return re(e(r=i.body)?{advertisedRoutes:U(r.advertised_routes),enabledRoutes:U(r.enabled_routes)}:null,i.status);var r},async deleteDevice(e){await t("DELETE",`/devices/${se(e)}`)}}}function ce({call:n,read:a}){return{listKeys:e=>a("/keys",H,e),async createKey(a){const i=await n("POST","/keys",{description:a.description,reusable:a.reusable,ephemeral:a.ephemeral,preauthorized:a.preauthorized,tags:[...a.tags],expiry_seconds:a.expirySeconds});return re(function(n){const a=Z(n);return a&&e(n)&&t(n.key)?!n.key.startsWith("tskey-auth-")||n.key.length>255?null:{...a,key:n.key}:null}(i.body),i.status)},async deleteKey(e){await n("DELETE",`/keys/${se(e)}`)}}}function de(n,a){const i=function(e,t){const n={capability:t,purpose:o};function a(t,a,i){return e.fetch(`${t}${a}`,{...i,credentials:"omit",cache:"no-store"},n)}async function i(e,t,n,i){const r=ee.pairing();if(!r)throw new w("no-daemon");const s=new Headers({Authorization:`Bearer ${r.token}`});void 0!==n&&s.set("Content-Type","application/json");const o=await a(r.url,`/v1/tailnet${t}`,{method:e,headers:s,body:void 0===n?void 0:JSON.stringify(n),signal:i}).catch(()=>{throw new w("unreachable")}),l=await ae(o);if(!o.ok)throw ie(o.status,l);return{status:o.status,body:l}}return{send:a,call:i,read:async function(e,t,n){const a=await i("GET",e,void 0,n);return re(t(a.body),a.status)}}}(n,a);return{subscribe:e=>ee.subscribe(e),canPair:()=>null===te(),pairBlocker:te,target:oe,pair:(n,a)=>async function(n,a,i){const r=z(a);if(!r)throw new w("not-a-code");if(r.origin!==ee.pageOrigin())throw new w("other-origin");const s=te();if(s)throw new w(s);const o=ee.pairing(),u=ee.bind(),c=await n.send(r.url,T,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:r.code}),signal:i}).catch(()=>{throw new w("unreachable")});if(403===c.status||429===c.status)throw new w("pairing-refused",c.status);const d=await ae(c);if(!c.ok)throw ie(c.status,d);const h=function(n,a,i){if(!(e(a)&&t(a.token)&&l.test(a.token)&&a.origin===n.origin&&_(a.role)))throw new w("malformed",i);return{url:n.url,token:a.token,origin:n.origin,role:a.role,label:n.label}}(r,d,c.status);await ee.keep(h,u),o&&o.token!==h.token&&await le(n,o,i)}(i,n,a),forget:e=>async function(e,t){const n=ee.pairing();if(!n)return;const a=ee.revision();await le(e,n,t),await ee.drop(a)}(i,e),status:e=>i.read("/status",Q,e),...ue(i),...ce(i),audit:e=>i.read("/audit",X,e)}}const he=[{id:"identity.tailnet-devices",description:"The Tailnet devices panel under Identity › Devices: every machine Tailscale reports for the tailnet, read through the daemon this page is paired with. Each row says what needs someone (waiting for approval, a key expiring, routes waiting, an update) and carries keys to approve it, open its settings (name, tags, approval, key expiry, subnet routes, exit node), expire its key and remove it. With no daemon paired, its only key pairs one.",role:"surface",routes:["/identity"],capabilityId:"tailnet.devices.manage"},{id:"identity.tailnet-devices.add",description:"The Add a device key on the Tailnet devices panel: it opens a sheet that mints a Tailscale auth key through the daemon, with a lifetime, whether it is reusable, ephemeral or pre-approved, and its tags, then shows the key and the tailscale up command once.",role:"action",routes:["/identity"],capabilityId:"tailnet.keys.manage"}],pe=[{id:"identity.tailnet.devices.manage",title:"Manage the tailnet's devices",routes:["/identity"],guide:["guide/1",'goal "identity.tailnet.devices.manage"','wait state "vault.unlocked" is=true timeout=60000','navigate "/identity"','wait route "/identity" timeout=15000','focus "identity.devices" "The Devices tab. The tailnet\'s machines are listed first, read through the daemon on a machine on your tailnet: it holds the Tailscale credential and makes every change. Pair it once with opensesame daemon tailnet pair and this page\'s address, then open the link it prints." side=bottom','wait target "identity.tailnet-devices" event=appear timeout=60000','focus "identity.tailnet-devices" "Each machine Tailscale reports, waiting ones first. Its marks say what needs someone; its keys approve it, open its settings, expire its key or remove it. Every change goes through the daemon and is in the Activity list below." side=top','focus "identity.tailnet-devices.add" "Add a device mints an auth key for the next machine. It is shown once, with the tailscale up command that joins with it; neither this page nor the daemon keeps it." side=bottom',"end"].join("\n")}],fe=["0.0.0.0/0","::/0"],me=new Intl.RelativeTimeFormat(void 0,{numeric:"auto"});function ge(e,t){if(!e)return null;const n=Date.parse(e);if(Number.isNaN(n))return null;const a=Math.round((n-t)/1e3),i=[["second",60],["minute",60],["hour",24],["day",30],["month",12],["year",Number.POSITIVE_INFINITY]];let r=a;for(const[s,o]of i){if(Math.abs(r)<o)return me.format(r,s);r=Math.round(r/o)}return null}function ye(e){return fe.every(t=>e.advertisedRoutes.includes(t))}function be(e){return e.advertisedRoutes.filter(e=>!fe.includes(e))}function we(e,t){const n=[];e.multipleConnections&&n.push({tone:"err",label:"Several machines share this device's key"}),e.tailnetLockError&&n.push({tone:"err",label:`Tailnet lock: ${e.tailnetLockError}`}),function(e,t){if(e.keyExpiryDisabled||!e.expires)return!1;const n=Date.parse(e.expires);return!Number.isNaN(n)&&n<=t}(e,t)&&n.push({tone:"err",label:"Key expired"}),e.authorized||n.push({tone:"warn",label:"Waiting for approval"}),function(e,t){if(e.keyExpiryDisabled||!e.expires)return!1;const n=Date.parse(e.expires);return!Number.isNaN(n)&&n>t&&n-t<=12096e5}(e,t)&&n.push({tone:"warn",label:`Key expires ${ge(e.expires,t)}`});const a=function(e){return be(e).filter(t=>!e.enabledRoutes.includes(t)).length+(ye(e)&&!function(e){return fe.every(t=>e.enabledRoutes.includes(t))}(e)?1:0)}(e);return a>0&&n.push({tone:"warn",label:1===a?"1 route waiting for approval":`${a} routes waiting for approval`}),e.updateAvailable&&n.push({tone:"warn",label:"Update available"}),n.push(function(e,t){if(e.connected)return{tone:"ok",label:"Online"};const n=ge(e.lastSeen,t);return{tone:"idle",label:n?`Offline, last seen ${n}`:"Never seen"}}(e,t)),n}function ve(e,t){return we(e,t).some(e=>"err"===e.tone||"warn"===e.tone)}const ke=[{id:"all",label:"All"},{id:"attention",label:"Needs attention"},{id:"online",label:"Online"},{id:"offline",label:"Offline"}];function Te(e){return e.name.split(".")[0]||e.hostname||e.id}function xe(e,t,n,a){const i=e.filter(e=>!!function(e,t){const n=t.trim().toLowerCase();return!n||[Te(e),e.hostname,e.user,e.os,...e.tags,...e.addresses].some(e=>e.toLowerCase().includes(n))}(e,n)&&("attention"===t?ve(e,a):"online"===t?e.connected:"offline"!==t||!e.connected));return[...i].sort((e,t)=>Number(e.authorized)-Number(t.authorized)||Te(e).localeCompare(Te(t)))}const _e=/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;function Ee(e){const t=e.trim().toLowerCase();return""===t||_e.test(t)}function $e(e){const t=e.split(/[\s,]+/).filter(Boolean),n=[];for(const a of t){const e=a.startsWith("tag:")?a:`tag:${a}`,t=e.slice(4);if(!_e.test(t)||!/^[a-z]/.test(t))return null;n.includes(e)||n.push(e)}return n.length>50?null:n.sort()}function ze(e){return/^[A-Za-z0-9 -]{0,50}$/.test(e.trim())}const Ne=[{seconds:3600,label:"1 hour"},{seconds:86400,label:"1 day"},{seconds:604800,label:"7 days"},{seconds:2592e3,label:"30 days"},{seconds:7776e3,label:"90 days"}];function Ae(e){return`tailscale up --auth-key=${e}`}function Se(e){return[e.reusable?"reusable":"one use",e.ephemeral?"ephemeral":null,e.preauthorized?"pre-approved":null,...e.tags].filter(Boolean).join(" · ")}export{ke as D,fe as E,Ne as K,w as T,Ee as a,be as b,z as c,we as d,xe as e,pe as f,he as g,de as h,Ae as j,Se as k,ve as n,ye as o,$e as p,ge as r,Te as s,k as t,ze as v};

package/dist/assets/tailnet-plugin-pairing-DTK4jAlP.js

@@ -0,0 +1 @@
+import{c as n,i as t}from"./vault-ui-seam-BQGS7RR6.js";import{d as r,w as e,n as o,i,r as s,V as a}from"./model-provider-B6oAnQX9.js";import{b as l}from"./native-worker-bytes-a0e18d71-DFmKzL3P.js";const u="/v1/plugins/pairing",c="config/plugin-daemon",f=/^[A-Za-z0-9_-]{43}$/;function p(n){let t;try{t=new URL(n)}catch{return!1}return t.origin===n&&!t.username&&!t.password&&("https:"===t.protocol?!t.hostname.endsWith("."):"http:"===t.protocol&&"localhost"===t.hostname&&""!==t.port)}function d(n){const t=o(n);return t&&i(t)?t:null}function m(r){const e=r.trim();if(!e.startsWith("opensesame-plugins:v1:"))return null;const o=function(n){try{return JSON.parse((new TextDecoder).decode(l(n)))}catch{return null}}(e.slice(22));if(!n(o))return null;const{url:i,code:s,origin:a,label:u}=o;if(!t(i)||!t(s)||!t(a))return null;const c=d(i);return c&&f.test(s)&&p(a)?{url:c,code:s,origin:a,label:t(u)?u.slice(0,80):""}:null}async function g(r){let e;try{e=await s(r,c)}catch(o){if(o instanceof a&&"not-found"===o.code)return null;throw o}try{const r=JSON.parse((new TextDecoder).decode(e));return n(r)&&1===r.v?function(r){if(!n(r))return null;const{url:e,token:o,origin:i,label:s}=r;if(!t(e)||!t(o)||!t(i))return null;const a=d(e);return a&&f.test(o)&&p(i)?{url:a,token:o,origin:i,label:t(s)?s.slice(0,80):""}:null}(r.pairing):null}catch{return null}}async function h(n,t){if(!t)return void(await r(n,c));const o=JSON.stringify({v:1,pairing:t});await e(n,c,(new TextEncoder).encode(o))}export{u as P,f as S,p as i,m as p,g as r,h as w};

package/dist/assets/tailscale-artifacts-FyY85j_Y.js

@@ -0,0 +1 @@
+import{v as t,cI as e,c$ as n}from"./drop-open-BjgdLxWM.js";import{r,a as o,u as a}from"./bucket-saved-vQCiVvN_.js";import{B as s,T as i,s as c,D as l,h as u}from"./certs-CDCfMuEi.js";import{i as d,a as f,s as h,d as w,r as p}from"./vault-credential-custody-DpnBb4qo.js";import{u as b,l as g,d as v,a4 as m,o as y,s as T,r as S}from"./native-worker-zod-5c0ed887-B342B6ko.js";import{c as E,i as k,b as O,o as I,k as N,aj as A,h as j,v as P,V as C,a6 as L}from"./vault-ui-seam-BQGS7RR6.js";import{j as H,k as J,l as R}from"./InvokeScreen-C-kFFYVF.js";import{a0 as U}from"./signals-DdOHdr--.js";import{b as x}from"./vaults-B043odav.js";import{Y as $,j as z,U as B,B as M,_ as D,A as _,t as V,$ as q,P as G,S as F,n as W,i as K,d as Y,w as Q,r as Z,V as X,G as tt}from"./model-provider-B6oAnQX9.js";import{V as et}from"./identity-BVf8yWa4.js";import{a as nt,b as rt}from"./native-worker-bytes-a0e18d71-DFmKzL3P.js";let ot=null;function at(t){const e=ot,n=Object.freeze({create:t,lifetime:new AbortController});if(ot=n,e?.lifetime.abort(),ot!==n)throw n.lifetime.abort(),new Error("Identity peering activation changed during installation.");return()=>{ot===n&&(ot=null),n.lifetime.abort()}}function st(t){const e=ot,n=t.signal,r=t.assertCurrent;let o=!1;const a=()=>{if(n.throwIfAborted(),ot!==e||t.signal!==n||t.assertCurrent!==r)throw new Error("Original identity peering activation changed.");if(r.call(t),n.throwIfAborted(),ot!==e)throw new Error("Original identity peering activation changed.")};return()=>{if(o)throw new Error("Original identity peering was already opened.");o=!0,a();const t=function(t){const e=t.signal,n=t.assertCurrent,r=ot,o=r?AbortSignal.any([e,r.lifetime.signal]):e,a=()=>{if(o.throwIfAborted(),t.signal!==e||t.assertCurrent!==n||ot!==r)throw new Error("Original identity peering owner changed.");if(n.call(t),o.throwIfAborted(),t.signal!==e||t.assertCurrent!==n||ot!==r)throw new Error("Original identity peering owner changed.")};if(a(),!r)return null;const s=r.create(Object.freeze({signal:o,assertCurrent:a})),i={snapshot:s.snapshot,subscribe:s.subscribe,start:s.start,login:s.login,capture:s.captureNativeHTTP,stop:s.stop},c=()=>{if(a(),s.snapshot!==i.snapshot||s.subscribe!==i.subscribe||s.start!==i.start||s.login!==i.login||s.captureNativeHTTP!==i.capture||s.stop!==i.stop)throw new Error("Original identity peering node changed.")};return c(),Object.freeze({snapshot(){c();const t=i.snapshot.call(s);return c(),t},subscribe(t){c();const e=i.subscribe.call(s,t);return c(),e},start(t){c(),i.start.call(s,t),c()},login(){c(),i.login.call(s),c()},captureNativeHTTP(t){c();const e=i.capture.call(s,t);return c(),function(t,e){const{fetch:n,assertCurrent:r,signal:o,supportsNativeOrigin:a}=t,s=()=>{if(e(),t.fetch!==n||t.assertCurrent!==r||t.signal!==o||t.supportsNativeOrigin!==a)throw new Error("Original identity HTTP carrier changed.")},i=()=>{s(),o.throwIfAborted(),r.call(t),s()};return i(),Object.freeze({signal:o,assertCurrent:i,fetch:async(e,r)=>{i();const o=await n.call(t,e,r);try{i()}catch(a){throw await(o.body?.cancel()),a}return o},supportsNativeOrigin(e){i();const n=a.call(t,e);return i(),n}})}(e,c)},stop:()=>i.stop.call(s)})}(Object.freeze({signal:n,assertCurrent:a}));return a(),t}}const[it,ct]=s.options;function lt(t){const[e="",n=""]=t.split("/");if(m().safeParse(e).success){const[t,r=0]=e.split(".").map(Number);return 100===t&&r>=64&&r<=127&&Number(n)>=10}return Number(n)>=48&&/^fd7a:115c:a1e0:/i.test(e)}const ut=it.shape,dt={version:g(2),routeMode:g("peer"),peerID:ut.exitNodeID,targets:ut.targets.refine(t=>t.every(t=>t.prefixes.every(lt)))},ft=v("trustMode",[it.omit({exitNodeID:!0}).extend(dt).strict(),ct.omit({exitNodeID:!0}).extend(dt).strict()]),ht=b([s,ft]),wt=v("trustMode",[ft.options[0].omit({version:!0}).strict(),ft.options[1].omit({version:!0}).strict()]);function pt(t){const e={};return void 0!==t.nativeHTTP&&(e.nativeHTTP=ht.parse(t.nativeHTTP)),void 0!==t.peerTLS&&(e.peerTLS=i.parse(t.peerTLS)),e}const bt="tailscale_browser_node",gt=y({hostname:T(),controlURL:T().url(),reference:T(),tomb:T(),nativeHTTP:ht.optional(),peerTLS:i.optional()}).strict(),vt=S(T(),T().max(1e6));function mt(t){return e({providerId:"tailscale-browser-node",hostname:t.hostname,controlURL:t.controlURL})}function yt(t){return r().find(e=>"tailscale"===e.providerId&&e.fields[bt]&&gt.parse(JSON.parse(e.fields[bt])).tomb===t)}async function Tt(t,n,r){const{nativeHTTP:o,peerTLS:a}=pt(t),s={hostname:t.hostname,controlURL:t.controlURL};await d(),r();const i=yt(n);if(i){const t=gt.parse(JSON.parse(i.fields[bt]??""));if(t.tomb!==n||mt(t)!==mt(s))throw new Error("This vault has a different saved browser node. Use its hostname and control server.");if(void 0!==o&&e(t.nativeHTTP??null)!==e(o))throw new Error("Update the saved native HTTPS configuration before reconnecting.");if(void 0!==a&&e(t.peerTLS??null)!==e(a))throw new Error("Update the saved peer TLS trust before reconnecting.");const c=Ot(t),l=Nt(c.fields.get("nodeState"));return f(c,n,r),{record:t,state:l,connectionId:i.connectionId,credentialReceipt:JSON.stringify(c.items),publicReceipt:kt(t,i.connectionId)}}const l=await h({name:s.hostname,targetBinding:mt(s),fields:[{field:"nodeState",label:"Tailscale browser node private state",value:"{}"}]},n,r),u={...s,reference:l.reference,tomb:n};void 0!==o&&(u.nativeHTTP=o),void 0!==a&&(u.peerTLS=a);let p=!1;try{const t=await c(()=>({providerId:"tailscale",displayName:s.hostname,scopes:[],fields:{[bt]:JSON.stringify(u),self_hosted_configuration:"tailscale-browser-v1"},secrets:{}}),void 0,()=>f(l,n,r));return p=!0,r(),f(l,n,r),{record:u,state:{},connectionId:t.connectionId,credentialReceipt:JSON.stringify(l.items),publicReceipt:kt(u,t.connectionId)}}catch(b){throw p||await w(l,n,r).catch(()=>{}),b}}async function St(t,n,r){const o=l(t),{nativeHTTP:s,peerTLS:i}=pt(t);r();const c=await Tt(o,n,r);return r(),async function(t,n,r){const o=gt.parse(t),s=pt(n),i=yt(o.tomb);if(!i)throw new Error("The saved Tailscale browser node changed.");const c=kt(o,i.connectionId),l=Ot(o),u=()=>{if(f(l,o.tomb,r),kt(o,i.connectionId)!==c)throw new Error("The saved Tailscale browser node changed.")};u();const d=gt.parse({hostname:o.hostname,controlURL:o.controlURL,reference:o.reference,tomb:o.tomb,...s});return await a(i.connectionId,async t=>{if(u(),JSON.stringify(t.row)!==c)throw new Error("The saved Tailscale browser node changed.");return e(o)===e(d)?t:{...t,row:{...t.row,updatedAt:(new Date).toISOString(),fields:{...t.row.fields,[bt]:JSON.stringify(d)}}}},u),f(l,o.tomb,r),kt(d,i.connectionId),d}(c.record,{nativeHTTP:s,peerTLS:i},r)}function Et(){try{const e=yt(t.getSnapshot().tomb);if(!e)return null;const n=gt.parse(JSON.parse(e.fields[bt]??""));return{hostname:n.hostname,controlURL:n.controlURL,...pt(n)}}catch{return null}}function kt(t,e){const n=r().find(t=>t.connectionId===e);if(!n||"tailscale"!==n.providerId||n.fields[bt]!==JSON.stringify(t))throw new Error("The saved Tailscale browser node changed.");return JSON.stringify(n)}function Ot(t){const n=yt(t.tomb);if(!n||e(gt.parse(JSON.parse(n.fields[bt]??"")))!==e(t))throw new Error("The saved Tailscale browser node changed.");return p(t.reference,mt(t),["nodeState"],t.tomb)}function It(t){return JSON.stringify(Ot(t).items)}function Nt(t){if(!t||t.length>4e6)throw new Error("Tailscale node state is missing or oversized.");return vt.parse(JSON.parse(t))}async function At(n,r,o,a){const s=Ot(n);if(e(function(t){return Nt(Ot(t).fields.get("nodeState"))}(n))!==e(r))throw new Error("Tailscale private state changed. Reconnect the browser node.");const i=JSON.stringify(vt.parse(o));if(i.length>4e6)throw new Error("Tailscale node state exceeds its limit.");const c=s.items.map(t=>{if("token"!==t.method.type)throw new Error("Tailscale node credential changed.");return{...t,method:{...t.method,token:i}}});f(s,n.tomb,a),await t.saveItems(c,void 0,()=>{a();const t=yt(n.tomb);if(!t||e(gt.parse(JSON.parse(t.fields[bt]??"")))!==e(n))throw new Error("Browser node configuration changed during persistence.")});const l=Ot(n);if(l.fields.get("nodeState")!==i)throw new Error("The saved browser node private state differs.");const u=JSON.stringify(l.items);if(f(l,n.tomb,a),It(n)!==u)throw new Error("Tailscale private state changed after persistence.");return u}async function jt(t,e){await d();const n=()=>f({items:[]},t,e);n();const a=yt(t);if(!a)return;const s=gt.parse(JSON.parse(a.fields[bt]??""));if(s.tomb!==t)throw new Error("Open the vault that owns this browser node.");let i=null;try{i=Ot(s)}catch{n()}const c=()=>{n();const t=r().find(t=>t.connectionId===a.connectionId);if(!t||t.fields[bt]!==a.fields[bt])throw new Error("Browser node configuration changed.")};i&&(c(),await w(i,t,n).catch(n)),await o(a.connectionId,c,n)}let Pt=null;const Ct=new Set,Lt=()=>Pt;function Ht(t){return Ct.add(t),()=>{Ct.delete(t)}}function Jt(){for(const t of Ct)t()}class Rt{constructor(t,e,n,r,o){this.node=t,this.owner=e,this.label=n,this.resolve=r,this.reject=o}node;owner;label;resolve;reject;done=!1;ending=!1;unsubscribe=null;timer=null;finish(t){if(this.done)return;this.done=!0,null!==this.timer&&clearTimeout(this.timer),this.unsubscribe?.(),this.owner.signal.removeEventListener("abort",this.abort);const e=Pt?.node===this.node;e&&(Pt=null),t?this.reject(t):this.resolve(),e&&Jt()}abort=()=>{this.done||this.ending||(this.ending=!0,this.node.stop().then(t=>this.finish(new Error(t?"Original identity enrollment was cancelled":"Original identity node did not acknowledge physical drain")),()=>this.finish(new Error("Original identity node could not close"))))};observe=()=>{if(!this.done&&!this.ending)try{this.owner.signal.throwIfAborted(),this.owner.assertCurrent();const t=this.node.snapshot();if("connected"===t.status)return this.owner.assertCurrent(),void this.finish();if("error"===t.status||"stopped"===t.status)return void this.abort();Pt=Object.freeze({label:this.label,node:this.node,state:t,cancel:this.abort}),Jt(),this.owner.signal.throwIfAborted(),this.owner.assertCurrent()}catch{this.abort()}};start(){try{this.owner.signal.throwIfAborted(),this.owner.assertCurrent();const t=Et();if(!t?.nativeHTTP)throw new Error("Configure Networking's native HTTPS route and trust before native identity sign-in");this.unsubscribe=this.node.subscribe(this.observe),this.owner.signal.addEventListener("abort",this.abort,{once:!0}),this.timer=setTimeout(this.abort,6e5),this.node.start({controlURL:t.controlURL,nativeHTTP:t.nativeHTTP}),this.observe()}catch(t){this.ending=!0,this.node.stop().then(()=>this.finish(t instanceof Error?t:new Error("Original identity enrollment failed")),()=>this.finish(new Error("Original identity node could not close")))}}}async function Ut(t,e,n){if(!t)throw new Error("Enable Networking before native identity sign-in");if(Pt)throw new Error("Finish the original identity enrollment first");return await new Promise((r,o)=>new Rt(t,e,n,r,o).start()),e.signal.throwIfAborted(),e.assertCurrent(),t}async function xt(t){if(t&&!(await t.stop()))throw new Error("Original identity node did not acknowledge physical drain")}const $t="opensesame-vault-drive-snapshot";function zt(t,e){const n=function(t){if(!t)return;const{pin:e,...n}=t;return Object.keys(n).length>0?n:void 0}(t.unlocks);return{v:1,createdAt:t.createdAt,...t.kdf&&t.wrap?{kdf:t.kdf,wrap:t.wrap}:void 0,...n?{unlocks:n}:void 0,bodyRev:e}}function Bt(t){return{format:$t,v:1,tomb:t.tomb,header:zt(t.header,t.rev),body:t.body,rev:t.rev,rootEpoch:(e=t.header,e.protection?.rootEpoch??0)};var e}function Mt(t){if(!(E(t)&&t.format===$t&&1===t.v&&k(t.tomb)&&O(t.rev)&&Number.isSafeInteger(t.rev)&&!(t.rev<0)&&function(t){return E(t)&&k(t.ivB64)&&k(t.ctB64)&&t.ivB64.length>0&&t.ctB64.length>0}(t.body)&&E(t.header)&&1===t.header.v&&k(t.header.createdAt)))throw new Error("The drive holds something that is not a vault snapshot.");return{format:$t,v:1,tomb:t.tomb,header:I(t.header),body:{ivB64:t.body.ivB64,ctB64:t.body.ctB64},rev:t.rev,...O(t.rootEpoch)&&Number.isSafeInteger(t.rootEpoch)?{rootEpoch:t.rootEpoch}:void 0}}function Dt(t){return{tomb:t.tomb,createdAt:t.header.createdAt,body:t.body,rev:t.rev}}const _t=/^prj_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;function Vt(t){return _t.test(t)}let qt=()=>u("tailscale");function Gt(t){const e=qt;return qt=t,()=>{qt===t&&(qt=e)}}function Ft(t){}function Wt(t={},e=u("tailscale")){const n={...t};if(!e.ok)return n;for(const[o,a]of Object.entries(e.action))n[`x-tailnet-${o.replaceAll("_","-")}`]=a;const r=e.secrets.auth_key;r&&(n["x-tailscale-auth-key"]=r);for(const[o,a]of Object.entries(e.secrets))"auth_key"!==o&&(n[`x-tailscale-${o.replaceAll("_","-")}`]=a);return n}class Kt extends Error{constructor(t,e){super(t),this.status=e,this.name="DriveError"}status}const Yt=(t,e)=>N(t,function(t,e){return{timeoutMs:15e3,...e,ciphertextDrive:!0,skipAddressSpace:t.startsWith("https:")}}(t,e));function Qt(t){return`${t.url}/v1/vault-drive/slots/${encodeURIComponent(t.slot)}`}function Zt(t){return`${Qt(t)}/snapshot`}function Xt(t,e="application/json"){return Wt({Authorization:`Bearer ${t.key}`,"Content-Type":e},qt())}function te(t){return Xt(t)}function ee(t){if(!E(t)||!O(t.generation))throw new Kt("The drive answered without a generation.",502);return t.generation}async function ne(t){try{return await t.json()}catch{throw new Kt("The drive answered with something unreadable.",502)}}function re(t){return 401===t.status||404===t.status?new Kt("The drive no longer knows this device's key. Pair again.",t.status):413===t.status?new Kt("The vault is larger than the drive accepts.",413):new Kt(`The drive refused the request (${t.status}).`,t.status)}function oe(t,e){return Yt(Zt(t),{...e?{timeoutMs:e}:void 0,method:"GET",headers:te(t),credentials:"omit",cache:"no-store"})}const ae="opensesame-drive:v1:",se=/^[a-z0-9][a-z0-9-]{7,63}$/,ie=/^[A-Za-z0-9_-]{32,128}$/;function ce(t){const e=t.trim();if(!e.startsWith(ae))return null;const n=function(t){try{return JSON.parse((new TextDecoder).decode(rt(t)))}catch{return null}}(e.slice(20));if(!E(n))return null;const{url:r,slot:o,key:a,label:s}=n;if(!k(r)||!k(o)||!k(a))return null;const i=W(r);return i&&K(i)&&se.test(o)&&ie.test(a)?{url:i,slot:o,key:a,label:k(s)?s.slice(0,80):""}:null}function le(t){const e=JSON.stringify({url:t.url,slot:t.slot,key:t.key,label:t.label});return`${ae}${nt((new TextEncoder).encode(e))}`}const ue="config/tailnet-drive";let de=null;async function fe(t,e){if(!e)return void(await Y(t,ue));const n=JSON.stringify({v:1,code:le(e)});await Q(t,ue,(new TextEncoder).encode(n))}const he={read:async function(t){const e=await oe(t);if(!e.ok)throw re(e);const n=await ne(e),r=ee(n),o=E(n)?n.snapshot:null;return{generation:r,snapshot:null==o?null:Mt(o)}},write:async function(t,e,n){const r=await Yt(Zt(t),{method:"PUT",headers:te(t),credentials:"omit",body:JSON.stringify({expected_generation:e,snapshot:n})});if(409===r.status)return{ok:!1,generation:ee(await ne(r))};if(!r.ok)throw re(r);return{ok:!0,generation:ee(await ne(r))}}};function we(t,e){return null!==e&&e.header.createdAt===t.header.createdAt&&(t.rootEpoch??0)>(e.rootEpoch??0)}async function pe(t,e,n=he){let r=!1;for(let o=0;o<4;o+=1){const o=await n.read(e);let a=null;if(o.snapshot){const e=await t.mergeSnapshot(Dt(o.snapshot)).catch(async e=>{if(a=Bt(await t.sealedSnapshot()),!we(a,o.snapshot))throw e;return null});if(e&&(r=r||e.localChanged,!e.remoteBehind))return{pulled:r,pushed:!1,generation:o.generation}}a??=Bt(await t.sealedSnapshot());const s=await n.write(e,o.generation,a);if(s.ok)return{pulled:r,pushed:!0,generation:s.generation}}throw new Error("Another device kept changing the drive. Sync will try again shortly.")}const be={query:A},ge="This browser blocks the site from your local network. Allow local network access for this site in the browser's site settings, then sync again.";function ve(t,e){return`${Qt(t)}/parts/${encodeURIComponent(e)}`}async function me(t,e,n){const r=await Yt(ve(t,e),{method:"PUT",headers:Xt(t,"application/octet-stream"),credentials:"omit",body:j(n)});if(!r.ok)throw re(r)}function ye(t,e){return{async getObject(n){const r=await async function(t,e){const n=await Yt(ve(t,e),{method:"GET",headers:Xt(t,"application/octet-stream"),credentials:"omit",cache:"no-store"});if(404===n.status)return null;if(!n.ok)throw re(n);return new Uint8Array(await n.arrayBuffer())}(t,n).catch(()=>null);return r&&await e.putObject(n,r).catch(()=>{}),r},async putObject(e,n){await me(t,e,n).catch(()=>{})}}}const Te={phase:"off",drive:null,lastSyncedAt:null,error:null},Se={transport:he,reach:async function(t,e){const n=await oe(t,e);if(!n.ok)throw re(n)},debounceMs:1500,intervalMs:6e4,now:()=>(new Date).toISOString(),localFiles:R,putParts:async function(t,e,n){const r=function(t){const e=new Set,n=t=>{if(k(t)){if(!t.startsWith("{"))return;for(const n of H(t)?.parts??[])e.add(n.key)}else if(Array.isArray(t))for(const e of t)n(e);else if(E(t))for(const e of Object.values(t))n(e)};for(const r of t)n(I(r));return e}(e);if(0===r.size)return 0;const o=await async function(t){const e=await Yt(`${Qt(t)}/parts`,{method:"GET",headers:Xt(t),credentials:"omit",cache:"no-store"});if(!e.ok)throw re(e);const n=await ne(e),r=E(n)&&Array.isArray(n.parts)?n.parts:[];return new Set(r.filter(k))}(t);let a=0;for(const s of r){if(o.has(s))continue;const e=await n.getObject(s);e&&(await me(t,s,e),a+=1)}return a}};let Ee=Te;const ke=new Set;let Oe=null,Ie=null,Ne=null,Ae=!1,je=!1,Pe=!1,Ce=null,Le=null,He=null,Je=null,Re=null,Ue="";function xe(t){Ee={...Ee,...t};for(const e of ke)e()}function $e(){return Ee}function ze(t){return ke.add(t),()=>ke.delete(t)}function Be(){const e=t.getSnapshot();return"unlocked"===e.status&&!e.guest&&e.tomb!==tt}function Me(t){return t?{label:t.label,url:t.url}:null}async function De(t,e){return k(t)?t:await async function(t,e="local"){const n="TimeoutError"===t.name||"AbortError"===t.name;if(!n&&"TypeError"!==t.name)return null;const r=await be.query(e);return"denied"===r?ge:"prompt"===r&&n?"The browser is still asking for local network access. Allow it, then sync again.":null}(t,e)??t.message}function _e(t){return"loopback"===L(t)?"loopback":"local"}async function Ve(t,e){const n=_e(t.url),r=await async function(t,e="local"){const n=await be.query(e);return"denied"===n?{go:!1,reason:ge}:"prompt"===n?t?{go:!0,waitMs:12e4}:{go:!1,reason:"Sync is waiting for local network access. Sync now, and allow it when the browser asks."}:{go:!0,waitMs:null}}(e,n);return r.go?(r.waitMs&&await Se.reach(t,r.waitMs),null):r.reason}async function qe(e){const n=Oe;if(n&&Be()&&t.activeTomb()===Ie){xe({phase:"syncing"});try{const r=await Ve(n,e);if(r)return void xe({phase:"blocked",error:r});await pe(t,n,Se.transport),await async function(e){const n=await Se.localFiles().catch(()=>null);n&&await Se.putParts(e,t.getSnapshot().items,n)}(n),xe({phase:"idle",lastSyncedAt:Se.now(),error:null})}catch(r){xe({phase:"error",error:await De(r instanceof Error?r:String(r),_e(n.url))})}}}async function Ge(t={}){const e=!0===t.interactive;return Ne?(Ae=!0,je=je||e,Ne):(Ne=(async()=>{let t=e;do{Ae=!1,await qe(t),t=je,je=!1}while(Ae)})().finally(()=>{Ne=null}),Ne)}async function Fe(){if(Oe=null,Ie=null,!Be())return void xe(Te);const e=We(),n=t.activeTomb(),r=function(t){if(de?.tomb!==t)return null;const e=de.pairing;return de=null,e}(n);r&&await fe(n,r);const o=r??await async function(t){let e;try{e=await Z(t,ue)}catch(n){if(n instanceof X&&"not-found"===n.code)return null;throw n}try{const t=JSON.parse((new TextDecoder).decode(e));return E(t)&&k(t.code)?ce(t.code):null}catch{return null}}(n);We()===e&&(Oe=o,Ie=o?n:null,xe({...Te,phase:o?"idle":"off",drive:Me(o)}),o&&Ge())}function We(){const e=t.getSnapshot();return`${e.tomb}:${e.status}:${e.guest}`}function Ke(){const t=We();if(t!==Ue)return Ue=t,void Fe();Oe&&Be()&&(Le&&clearTimeout(Le),Le=setTimeout(()=>{Le=null,Ge()},Se.debounceMs))}async function Ye(e){const r=ce(e);if(!r)throw new Error("That is not a drive pairing code.");const o=t.getSnapshot();try{const t=await Ve(r,!0);if(t)throw new Error(t)}catch(c){throw new Error(await De(c instanceof Error?c:String(c),_e(r.url)))}const a=(await Se.transport.read(r)).snapshot,s=null!==a&&Vt(a.tomb)&&a.tomb!==t.activeTomb();if("empty"===o.status||o.guest||s){if(!a)throw new Error("The drive is empty. Sync from a device that holds the vault first.");return await async function(t){const{tomb:e}=t;if(e!==$&&!Vt(e))throw new Error("The drive holds a vault this device cannot set up.");const r=zt(t.header,t.rev);if(!function(t){return void 0!==t.kdf&&void 0!==t.wrap||(t.unlocks?.passkeys?.length??0)>0||void 0!==t.unlocks?.passkey}(r))throw new Error("That vault opens only with a PIN, which never leaves its device. Add a master password or passkey there first.");await z(n(e));const o=function(t){const e=F(t,G);if(null===e)return null;try{const t=JSON.parse(e);return E(t)&&k(t.createdAt)?t.createdAt:""}catch{return""}}(e);if(o===r.createdAt)return"already-here";if(null!==o||B(e,M))throw new Error("This device already holds a different vault. Set it aside before syncing another one here.");return e!==$&&await D(e),await _.writeRaw(V(e,M),JSON.stringify(t.body)),await q(e,G,JSON.stringify(r)),e===$&&et($),"adopted"}(a),function(t,e){de={pairing:t,tomb:e}}(r,a.tomb),s?(await U(),await x(a.tomb),"adopted"):(o.guest&&t.lock({recordLastVault:!1}),t.rehydrate(),"adopted")}if(!Be())throw new Error("Unlock the vault to pair it with a drive.");const i=t.activeTomb();if(await pe(t,r,Se.transport),t.activeTomb()!==i)throw new Error("The vault changed while pairing; pair it again.");return await fe(i,r),Oe=r,Ie=i,xe({phase:"idle",drive:Me(r),lastSyncedAt:Se.now(),error:null}),"paired"}async function Qe(){Be()&&(await fe(t.activeTomb(),null),Oe=null,Ie=null,xe(Te))}function Ze(){return Pe||(Pe=!0,Ue=We(),Ce=t.subscribe(Ke),He=setInterval(()=>{Ge()},Se.intervalMs),Je=function(){const t=P(),e=t?.onVisibilityChange(()=>{"visible"===t.visibilityState&&Ge()}),n=C()?.onOnlineChange(t=>{t&&Ge()});return()=>{e?.(),n?.()}}(),Re=J(e=>{const n=Oe&&Be()&&t.activeTomb()===Ie?Oe:null;return n?[ye(n,e)]:[]}),Fe()),Xe}function Xe(){Pe=!1,Ce?.(),Ce=null,Je?.(),Je=null,Re?.(),Re=null,Le&&clearTimeout(Le),He&&clearInterval(He),Le=null,He=null,Oe=null,Ie=null,Ee=Te;for(const t of ke)t()}const tn={sdk:{version:"native-b31d8a75a-go1.27.3",browserSDKVersion:"1.102.3-3-tb31d8a75a-g5e651e16f",browserSDKHash:"318a91bdbc32d4aa57a7ffa554368d390e96bf7128419b4561f98001e86e3795",gzipHash:"7b2a0868bcb7f638beb1d7b568efa2673cc11bbdc7a0e93c352f04fa005851d6",wasmHash:"d75d560c13e4f1dfaab486c496916fdd4bb484602b2d9f6d3d769c25d52c9f2d",runtimeHash:"3e61b3267aa67a553c289335805e5947e2f80935f782d3d6bcb30adb15674017",nativeHTTPHash:"1992487ea59d7d1745441fd77e538fba3d0086aefd72ceafb43446068211e54f"},native:{sourceMetadataSha256:"d6eb47d21b7b93e096435bdc19b171b4bb54ac8c2ab9b1bff3dc59536f361669",manifestSha256:"564b46506130e6dfd29b37b3f63764b09126829c4042f3810e1b594c0aa1e99d",sourceCommit:"b31d8a75af155bcf19853d1a66041782d13e56ae",compilerCommit:"7ef7b403648ac3a9481a6e88e8b894eff50b0167",publicRootsVersion:"v0.0.0-20261014201258-cf169cd0986f"},assets:{wasm:"tailscale/main-7b2a0868bcb7f638.wasm.gz",runtime:"tailscale/go-runtime-3e61b3267aa67a55.js",nativeHTTP:"tailscale/native-http-1992487ea59d7d17.js",license:"tailscale/LICENSE.txt",notices:"tailscale/OPEN-SOURCE-LICENSES.md"}};export{wt as T,Ht as a,ze as b,Ge as c,kt as d,It as e,Qe as f,tn as g,pt as h,jt as i,at as j,Ft as k,Ze as l,Xe as m,Lt as n,Tt as o,Ye as p,Wt as q,Gt as r,Et as s,$e as t,st as u,xt as v,At as w,Ut as x,ht as y,St as z};

package/dist/assets/tailscale-node-Bxh73eIz.js

@@ -0,0 +1 @@
+import{z as e}from"./native-worker-zod-jitless-ba55e4a3-DZHC6DC7.js";import{c as t,d as i}from"./native-worker-bytes-a0e18d71-DFmKzL3P.js";import{a as n,o as s,s as r,l as a,d as o,a4 as c,a5 as d,u as l,n as h,t as u,b as p,_ as T,f,N as g,r as m,e as v,g as P}from"./native-worker-zod-5c0ed887-B342B6ko.js";function b(e){if(48!==e[0]||void 0===e[1])return!1;const t=e[1];if(t<128)return t===e.length-2;const i=127&t;if(i<1||i>4||0===e[2])return!1;let n=0;for(const s of e.slice(2,2+i))n=256*n+s;return n>=128&&n===e.length-2-i}e();const y=n(s({origin:r().max(2048).refine(function(e){try{const t=new URL(e);return"https:"===t.protocol&&t.origin===e}catch{return!1}}),prefixes:n(r().max(64).refine(function(e){const[t="",i="",n]=e.split("/");if(void 0!==n||!/^(0|[1-9][0-9]{0,2})$/.test(i))return!1;const s=c().safeParse(t).success;if(!s&&!d().safeParse(t).success)return!1;const r=s?32:128;if(Number(i)>r)return!1;const a=s?t.split(".").reduce((e,t)=>e<<8n|BigInt(t),0n):function(e){let t=e;const i=t.lastIndexOf(":");if(t.includes(".")){const e=t.slice(i+1).split(".").map(Number),n=(e[0]??0)<<8|(e[1]??0),s=(e[2]??0)<<8|(e[3]??0);t=`${t.slice(0,i+1)}${n.toString(16)}:${s.toString(16)}`}const n=t.split("::"),s=n[0]?.split(":").filter(Boolean)??[],r=n[1]?.split(":").filter(Boolean)??[];return(1===n.length?s:[...s,...Array(8-s.length-r.length).fill("0"),...r]).reduce((e,t)=>e<<16n|BigInt(`0x${t}`),0n)}(t);return!(!s&&a>>32n==65535n)&&0n==(a&(1n<<BigInt(r-Number(i)))-1n)})).min(1).max(16)}).strict()).min(1).max(16).refine(e=>new Set(e.map(e=>e.origin)).size===e.length),w=r().min(1).max(256).refine(e=>e.trim()===e&&!Array.from(e).some(e=>e.charCodeAt(0)<=32||127===e.charCodeAt(0))&&(new TextEncoder).encode(e).length<=256),k=s({version:a(1),exitNodeID:w,targets:y}),H=o("trustMode",[k.extend({trustMode:a("public")}).strict(),k.extend({trustMode:a("operator"),operatorCAPEM:r().min(1).max(65536).refine(function(e){const n=/-----BEGIN CERTIFICATE-----\r?\n([A-Za-z0-9+/=\r\n]+)-----END CERTIFICATE-----/g;let s=0,r=0;try{for(const a of e.matchAll(n)){if(e.slice(s,a.index).trim())return!1;const n=(a[1]??"").replace(/[\r\n]/g,""),o=t(n);if(i(o)!==n||!b(o))return!1;s=a.index+a[0].length,r++}return r>0&&r<=8&&!e.slice(s).trim()}catch{return!1}})}).strict()]),E=o("trustMode",[H.options[0].pick({trustMode:!0}),H.options[1].pick({trustMode:!0,operatorCAPEM:!0})]),[x,C]=H.options;function N(e){const[t="",i=""]=e.split("/");if(c().safeParse(t).success){const[e,n=0]=t.split(".").map(Number);return 100===e&&n>=64&&n<=127&&Number(i)>=10}return Number(i)>=48&&/^fd7a:115c:a1e0:/i.test(t)}const S=x.shape,A={version:a(2),routeMode:a("peer"),peerID:S.exitNodeID,targets:S.targets.refine(e=>e.every(e=>e.prefixes.every(N)))},I=o("trustMode",[x.omit({exitNodeID:!0}).extend(A).strict(),C.omit({exitNodeID:!0}).extend(A).strict()]);l([H,I]);const L=o("trustMode",[I.options[0].omit({version:!0}).strict(),I.options[1].omit({version:!0}).strict()]),M=h().int().min(1).max(Number.MAX_SAFE_INTEGER),O=n(u([r().max(32768),r().max(32768)])).max(64).refine(function(e){const t=new TextEncoder;return e.reduce((e,i)=>e+t.encode(i[0]).length+t.encode(i[1]).length,0)<=32768}),R=s({method:T(["GET","HEAD","POST","PUT","PATCH","DELETE"]),url:r().url().max(8192),headers:O.refine(e=>e.length<64),body:p(Uint8Array).refine(e=>e.byteLength<=1048576)}).strict(),G=s({status:h().int().min(200).max(599),statusText:r().max(32768),url:r().url().max(8192),headers:O,body:p(Uint8Array).refine(e=>e.byteLength<=4194304)}).strict(),j=G.omit({body:!0}),z=s({sequence:M,body:P(e=>e instanceof Uint8Array).refine(e=>e.buffer instanceof ArrayBuffer&&e.byteLength<=32768),eof:v()}).strict(),U=n(s({origin:r().url().max(2048),prefixes:n(r().min(1).max(64)).min(1).max(16)}).strict()).min(1).max(16),D=l([f().transform((e,t)=>{const i=L.safeParse(e);return i.success?i.data:(t.addIssue({code:"custom",message:"Invalid peer HTTPS configuration."}),g)}),s({exitNodeID:r().min(1).max(256),trustMode:a("public"),targets:U}).strict(),s({exitNodeID:r().min(1).max(256),trustMode:a("operator").default("operator"),operatorCAPEM:r().min(1).max(65536),targets:U}).strict()]),q=f().transform((e,t)=>{const i=E.safeParse(e);return i.success?i.data:(t.addIssue({code:"custom",message:"Invalid peer TLS trust."}),g)}),B=s({ephemeral:v().default(!1),hostname:r().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/),controlURL:r().url(),authKey:r().max(16384),state:m(r(),r().max(1e6)),assets:s({runtime:r().url(),wasm:r().url(),nativeHTTP:r().url().optional()}),nativeHTTP:D.optional(),peerTLS:q.optional()}).refine(e=>!e.ephemeral||""===e.authKey&&0===Object.keys(e.state).length,{message:"Memory-only identity enrollment cannot accept stored node state or an auth key."}),$=o("kind",[s({kind:a("nativeHTTPReady")}),s({kind:a("nativeHTTP"),id:M,request:R}),s({kind:a("nativeHTTPStream"),id:M,request:R}).strict(),s({kind:a("pullHTTP"),id:M,sequence:M}).strict(),s({kind:a("cancelHTTP"),id:M}),s({kind:a("closeHTTP")}),s({kind:a("start"),config:B}),s({kind:a("login")}),s({kind:a("get"),id:h().int(),url:r().url()}),s({kind:a("decision"),id:h().int(),url:r().url(),method:r(),allowed:v()})]);async function F(e,t,i){const n=[t.runtime,t.wasm];t.nativeHTTP&&n.push(t.nativeHTTP);for(const d of n){const e=new URL(d);if(e.origin!==globalThis.location.origin||e.search||e.hash)throw new Error("Tailscale runtime assets must belong to this deployment.")}const s=await fetch(t.wasm);if(!s.ok||!s.body)throw new Error("Tailscale browser client is unavailable offline.");const r=await new Response(s.body.pipeThrough(new DecompressionStream("gzip"))).arrayBuffer();await(import(t.runtime)),Object.defineProperty(fs,"writeSync",{value:(e,t)=>t.length});const a=new Go,o=await WebAssembly.instantiate(r,a.importObject);a.run(o.instance).then(i,i);const c=newIPN(e);if(t.nativeHTTP&&(c.nativePeerGET=await async function(e,t){const i=e.nativePeerGETPort,n=e.nativePeerGETReady;if(!i||!n||!i.drain)throw new Error("This native build has no peer GET contract.");const s=i.drain.bind(i),r=Object.freeze({begin:i.begin.bind(i),current:i.current.bind(i),cancel:i.cancel.bind(i),close:i.close.bind(i)}),a=n.bind(e),o=new AbortController,c=Object.freeze({});let d=!1,l=0,h=null;const u=()=>!d&&!o.signal.aborted&&a(),p=(await(import(t))).bindNativeHTTP(r,{generation:c,signal:o.signal,current:u}),T={ready:u,nativeHTTP:(e,t,i)=>!Number.isSafeInteger(e)||e<1||e<=l?Promise.reject(new Error("Consumed original peer GET id.")):(l=e,d||i.aborted||"GET"!==t.method||t.headers.length||t.body.byteLength||!["http:","https:"].includes(new URL(t.url).protocol)?Promise.reject(new Error("Invalid original peer GET.")):p.nativeHTTP(e,t,{generation:c,signal:i,current:()=>u()&&!i.aborted})),cancelHTTP:e=>(Number.isSafeInteger(e)&&e>l&&(l=e),p.cancelHTTP(e)),close(){if(h)return h;d=!0;const e=p.closeHTTP();return o.abort(),h=new Promise(t=>{const i=Object.freeze({id:0});let n=!1;const r=e=>{n||(n=!0,t(e))};try{""!==s(i,(t,n,s,a)=>t===i&&0===n&&null===s&&(r(e&&""===a),!0))&&r(!1)}catch{r(!1)}}),h}};return Object.freeze(T)}(c,t.nativeHTTP)),e.nativeHTTP){if(!t.nativeHTTP)throw new Error("Native HTTPS asset is unavailable.");c.nativeHTTP=await async function(e,t){const i=e.nativeHTTPPort,n=e.nativeHTTPReady;if(!i||!n)throw new Error("Native HTTPS node is unavailable.");const s=await(import(t)),r=Object.freeze({}),a=new AbortController,o=()=>!a.signal.aborted&&n(),c=s.bindNativeHTTP(i,{generation:r,signal:a.signal,current:o});let d=!1,l=!1;return Object.freeze({ready:o,nativeHTTP:(e,t,i)=>c.nativeHTTP(e,t,{generation:r,signal:i,current:()=>o()&&!i.aborted}),nativeHTTPStream:(e,t,i)=>c.nativeHTTPStream(e,t,{generation:r,signal:i,current:()=>o()&&!i.aborted}),pullHTTP:c.pullHTTP,cancelHTTP:c.cancelHTTP,closeHTTP:()=>(d||(d=!0,l=c.closeHTTP(),a.abort()),l)})}(c,t.nativeHTTP)}return c}function K(e){return new Uint8Array(e)}async function W(e,t){const i=await e(t,{redirect:"error",credentials:"omit"});if("HEAD"!==t.method)return i;t.signal.throwIfAborted();const n=i.clone();try{return await i.arrayBuffer(),t.signal.throwIfAborted(),n}catch(s){throw n.body?.cancel().catch(()=>{}),s}}function _(e,t){const i=globalThis.fetch.bind(globalThis),n=globalThis.WebSocket;Object.defineProperty(globalThis,"fetch",{value:async(n,s)=>{const r=new Request(n,s),a=new URL(r.url);if(t.includes(a.href))return W(i,r);if(!["https:","http:"].includes(a.protocol)||a.username||a.password||!(await e(a.href,r.method)))throw new Error("Tailscale HTTP destination denied.");return W(i,r)}}),Object.defineProperty(globalThis,"WebSocket",{value:Z(n,e)})}o("kind",[s({kind:a("nativeHTTPReady"),ready:v()}),s({kind:a("closeHTTP"),closed:v()}),s({kind:a("nativeHTTP"),id:M,result:G}),s({kind:a("nativeHTTPStream"),id:M,result:j}).strict(),s({kind:a("nativeHTTPChunk"),id:M,result:z}).strict(),s({kind:a("nativeHTTPError"),id:M}),s({kind:a("decision"),id:h().int(),url:r().url(),method:r()}),s({kind:a("state"),state:r()}),s({kind:a("storage"),state:m(r(),r().max(1e6))}),s({kind:a("netmap"),value:r().max(4e6)}),s({kind:a("auth"),url:r().url()}),s({kind:a("error")}),s({kind:a("get"),id:h().int(),status:h().int(),text:r().max(1e6)})]),s({self:s({machineStatus:r(),addresses:n(r()).max(32)}),peers:n(s({})).max(1e4),lockedOut:v()});class X extends EventTarget{static CONNECTING=0;static OPEN=1;static CLOSING=2;static CLOSED=3;CONNECTING=0;OPEN=1;CLOSING=2;CLOSED=3;url;onopen=null;onerror=null;onclose=null;onmessage=null;socket=null;closed=!1;closeSent=!1;closeCode=1e3;closeReason="";binary="blob";constructor(e,t,i,n){super(),this.url=new URL(e).href,this.open(i,t,n)}get readyState(){return this.closed?3:this.socket?.readyState??0}get bufferedAmount(){return this.socket?.bufferedAmount??0}get protocol(){return this.socket?.protocol??""}get extensions(){return this.socket?.extensions??""}get binaryType(){return this.binary}set binaryType(e){this.binary=e,this.socket&&(this.socket.binaryType=e)}send(e){if(!this.socket||this.closed)throw new Error("Tailscale socket is not open.");"string"!=typeof e?e instanceof Blob?this.socket.send(e):e instanceof ArrayBuffer||e instanceof SharedArrayBuffer?this.socket.send(K(new Uint8Array(e))):this.socket.send(K(new Uint8Array(e.buffer,e.byteOffset,e.byteLength))):this.socket.send(e)}close(e,t){this.closed=!0,this.socket?this.socket.close(e,t):(this.closeCode=e??1e3,this.closeReason=t??"")}emitClose(e){this.closeSent||(this.closeSent=!0,this.dispatchEvent(e),this.onclose?.(e))}async open(e,t,i){try{const n=new URL(this.url);if(!["wss:","ws:"].includes(n.protocol)||n.username||n.password||!(await i(n.href,"CONNECT")))throw new Error("Tailscale socket destination denied.");if(this.closed)return void this.emitClose(new CloseEvent("close",{code:this.closeCode,reason:this.closeReason,wasClean:!0}));this.socket=new e(this.url,t),this.socket.binaryType=this.binary,this.socket.addEventListener("open",()=>{const e=new Event("open");this.dispatchEvent(e),this.onopen?.(e)}),this.socket.addEventListener("error",()=>{const e=new Event("error");this.dispatchEvent(e),this.onerror?.(e)}),this.socket.addEventListener("message",e=>{const t=new MessageEvent("message",{data:e.data,origin:e.origin,lastEventId:e.lastEventId});this.dispatchEvent(t),this.onmessage?.(t)}),this.socket.addEventListener("close",e=>{this.closed=!0,this.emitClose(new CloseEvent("close",{code:e.code,reason:e.reason,wasClean:e.wasClean}))})}catch{this.closed=!0;const e=new Event("error");this.dispatchEvent(e),this.onerror?.(e),this.emitClose(new CloseEvent("close",{code:1008,reason:"Destination denied"}))}}}function Z(e,t){return class extends X{constructor(i,n){super(i,n,e,t)}}}class J{constructor(e,t){this.port=e,this.post=t}port;post;high=0;ended=!1;pending=new Map;get closed(){return this.ended}identity(e){const t=this.port(),i=performance.now();return t===e.port&&i<e.deadline&&this.pending.get(e.id)===e&&!e.caller.signal.aborted&&!this.ended}methodsCurrent(e){return e.port.ready===e.ready&&e.port.nativeHTTP===e.buffered&&(!e.stream||e.port.nativeHTTPStream===e.open&&e.port.pullHTTP===e.pull)}current(e){try{return this.identity(e)&&this.methodsCurrent(e)&&e.ready()&&this.methodsCurrent(e)&&this.identity(e)}catch{return!1}}cancelPort(e,t){try{e?.cancelHTTP(t)}catch{}}retire(e){this.pending.get(e.id)===e&&(this.pending.delete(e.id),clearTimeout(e.timer),e.timer=void 0)}cancel(e){this.high=Math.max(this.high,e);const t=this.pending.get(e);t&&this.retire(t),t?.caller.abort(),this.cancelPort(t?.port??this.port(),e)}fail(e){this.pending.get(e.id)===e&&(this.cancel(e.id),this.post({kind:"nativeHTTPError",id:e.id}))}close(){this.ended=!0;for(const e of[...this.pending.values()])this.cancel(e.id);return this.port()?.closeHTTP()??!0}admit(e,t,i){if(e<=this.high)return void this.post({kind:"nativeHTTPError",id:e});this.high=e;const n=this.port();if(!n||this.ended||this.pending.size>=4||i&&(!n.nativeHTTPStream||!n.pullHTTP))return this.cancelPort(n,e),void this.post({kind:"nativeHTTPError",id:e});const s={id:e,port:n,caller:new AbortController,ready:n.ready,buffered:n.nativeHTTP,open:n.nativeHTTPStream,pull:n.pullHTTP,request:{...t,body:t.body.slice(),headers:t.headers.map(([e,t])=>[e,t])},stream:i,opened:!1,pulling:!1,next:1,bytes:0,deadline:performance.now()+3e4,timer:void 0};if(this.pending.set(e,s),s.timer=setTimeout(()=>this.fail(s),3e4),this.current(s))try{if(i){const t=s.open?.call(n,e,s.request,s.caller.signal);if(!t)throw new Error("Missing native stream callback.");t.then(e=>this.headers(s,e)).catch(()=>this.fail(s))}else s.buffered.call(n,e,s.request,s.caller.signal).then(e=>this.buffered(s,e)).catch(()=>this.fail(s))}catch{this.fail(s)}else this.fail(s)}buffered(e,t){if(this.pending.get(e.id)!==e)return;const i=G.safeParse(t);if(!i.success||i.data.url!==e.request.url||!this.current(e))return void this.fail(e);const n={...i.data,body:i.data.body.slice()};this.current(e)?(this.retire(e),this.post({kind:"nativeHTTP",id:e.id,result:n})):this.fail(e)}headers(e,t){if(this.pending.get(e.id)!==e)return;const i=j.safeParse(t);if(!i.success||i.data.url!==e.request.url||!this.current(e))return void this.fail(e);const n={...i.data,headers:i.data.headers.map(([e,t])=>[e,t])};this.current(e)?(e.opened=!0,this.post({kind:"nativeHTTPStream",id:e.id,result:n})):this.fail(e)}chunk(e,t,i){if(this.pending.get(e.id)!==e)return;const n=z.safeParse(i);if(!n.success||n.data.sequence!==t||!e.pulling||e.next!==t||e.bytes+n.data.body.byteLength>4194304||!this.current(e))return void this.fail(e);const s={...n.data,body:n.data.body.slice()};this.current(e)?(e.bytes+=s.body.byteLength,e.next++,s.eof&&this.retire(e),this.post({kind:"nativeHTTPChunk",id:e.id,result:s}),this.pending.get(e.id)===e&&(e.pulling=!1)):this.fail(e)}pull(e,t){const i=this.pending.get(e);if(i)if(i.stream&&i.opened&&!i.pulling&&t===i.next&&this.current(i)){i.pulling=!0;try{const n=i.pull?.call(i.port,e,t);if(!n)throw new Error("Missing native pull callback.");n.then(e=>this.chunk(i,t,e)).catch(()=>this.fail(i))}catch{this.fail(i)}}else this.fail(i);else this.post({kind:"nativeHTTPError",id:e})}receive(e){if("nativeHTTPReady"===e.kind)this.post({kind:"nativeHTTPReady",ready:!this.ended&&!0===this.port()?.ready()});else if("nativeHTTP"===e.kind||"nativeHTTPStream"===e.kind)this.admit(e.id,e.request,"nativeHTTPStream"===e.kind);else if("pullHTTP"===e.kind)this.pull(e.id,e.sequence);else if("cancelHTTP"===e.kind)this.cancel(e.id);else{if("closeHTTP"!==e.kind)return!1;this.post({kind:"closeHTTP",closed:this.close()})}return!0}}class Q{constructor(e,t){this.node=e,this.post=t}node;post;ended=!1;high=0;pending=new Map;retirement=null;originalPeer=null;get closed(){return this.ended}current(e){const t=this.node(),i=t?.nativePeerGET;return!this.ended&&this.pending.get(e.id)===e&&!e.caller.signal.aborted&&i===e.port&&i.ready===e.ready&&i.nativeHTTP===e.read&&i.cancelHTTP===e.cancel&&e.ready.call(i)}retire(e){this.pending.get(e.id)===e&&(this.pending.delete(e.id),clearTimeout(e.timer),e.caller.abort())}fail(e){this.pending.get(e.id)===e&&(this.retire(e),e.cancel.call(e.port,e.id),this.post({kind:"error"}))}get(e,t){const i=function(e){if(e.length>8192)return null;try{const t=new URL(e);return!["http:","https:"].includes(t.protocol)||t.username||t.password||t.hash?null:t}catch{return null}}(t);if(this.ended||!Number.isSafeInteger(e)||e<=this.high||e<1||!i)return void this.post({kind:"error"});this.high=e;const n=this.node(),s=n?.nativePeerGET;if(!s||this.originalPeer&&this.originalPeer!==s||this.pending.size>=4)return void this.post({kind:"error"});this.originalPeer=s;const r=new AbortController,a={id:e,url:i.href,port:s,read:s.nativeHTTP,ready:s.ready,cancel:s.cancelHTTP,caller:r,timer:setTimeout(()=>this.fail(a),3e4)};this.pending.set(e,a);try{if(!this.current(a))throw new Error("Original peer node ended");const t={method:"GET",url:a.url,headers:[],body:new Uint8Array};a.read.call(s,e,t,r.signal).then(t=>{const i=G.safeParse(t);if(!i.success||i.data.url!==a.url||i.data.status>=300&&i.data.status<400||i.data.body.byteLength>1e6||!this.current(a))return void this.fail(a);const n=i.data.body.slice(),s=(new TextDecoder).decode(n);s.length>1e6||!this.current(a)?this.fail(a):(this.retire(a),this.post({kind:"get",id:e,status:i.data.status,text:s}))}).catch(()=>this.fail(a))}catch{this.fail(a)}}withdraw(){this.ended=!0;for(const e of[...this.pending.values()])this.retire(e),e.cancel.call(e.port,e.id)}close(){if(this.retirement)return this.retirement;this.withdraw();const e=this.originalPeer??this.node()?.nativePeerGET;return e?(this.retirement=e.close().catch(()=>!1),this.retirement):Promise.resolve(!0)}}class V{constructor(e,t={load:F,egress:_}){this.post=e,this.dependencies=t}post;dependencies;client=null;sequence=0;started=!1;loading=null;lateNativeClose=!0;peer=new Q(()=>this.client,e=>this.post(e));native=new J(()=>this.client?.nativeHTTP,e=>this.post(e));decisions=new Map;port=null;get channel(){return this.port}panic(){this.native.close(),this.peer.close(),this.post({kind:"error"})}decide(e,t){return new Promise(i=>{const n=++this.sequence,s=setTimeout(()=>{this.decisions.delete(n),i(!1)},3e4);this.decisions.set(n,{url:e,method:t,settle:e=>{clearTimeout(s),i(e)}}),this.post({kind:"decision",id:n,url:e,method:t})})}async start(e,t){const i=[t.runtime,t.wasm];t.nativeHTTP&&i.push(t.nativeHTTP),this.dependencies.egress(this.decide.bind(this),i);const n=await this.dependencies.load(e,t,()=>this.panic());this.client=n,this.native.closed&&(this.lateNativeClose=n.nativeHTTP?.closeHTTP()??!0),this.peer.closed||n.run({notifyState:t=>{this.post({kind:"state",state:t}),"NeedsLogin"===t&&e.authKey&&setTimeout(()=>n.login(),0)},notifyNetMap:e=>this.post({kind:"netmap",value:e}),notifyBrowseToURL:e=>this.post({kind:"auth",url:e}),notifyPanicRecover:()=>this.panic()})}receive(e){const t=$.safeParse(e.data),[i]=e.ports;if(!t.success||"start"!==t.data.kind)return;if(this.started||!i||1!==e.ports.length)return;this.started=!0,this.port=i,i.onmessage=e=>this.command(e);const{state:n,ephemeral:s}=t.data.config,r={...t.data.config,stateStorage:{getState:e=>n[e]??"",setState:(e,t)=>{n[e]=t,s||this.post({kind:"storage",state:n})}}};this.loading=this.start(r,t.data.config.assets),this.loading.catch(()=>this.panic())}command(e){const t=$.safeParse(e.data);if(!t.success)return;const i=t.data;"closeHTTP"===i.kind?this.retire():"decision"===i.kind?this.settle(i):"login"===i.kind?this.client?.login():"get"===i.kind?this.peer.get(i.id,i.url):this.native.receive(i)}retire(){this.peer.withdraw();const e=this.native.close();(this.loading??Promise.resolve()).catch(()=>{}).then(async()=>{const t=await this.peer.close();this.post({kind:"closeHTTP",closed:e&&this.lateNativeClose&&t})})}settle(e){const t=this.decisions.get(e.id);t?.url===e.url&&t.method===e.method&&(this.decisions.delete(e.id),t.settle(e.allowed))}}const Y=new V(e=>Y.channel?.postMessage(e));globalThis.addEventListener("message",e=>{""!==e.origin&&e.origin!==globalThis.location.origin||Y.receive(e)});export{V as BrowserNodeWorker};

package/dist/assets/trusted-contacts-BUPioBSb.css

@@ -0,0 +1 @@
+.trusted-contacts__body{gap:0}.trusted-contacts__group{display:grid;gap:.75rem;min-width:0;padding-block:1rem;border-top:1px solid var(--line)}.trusted-contacts__group:first-child{padding-block-start:0;border-top:0}.trusted-contacts__group-head{display:flex;align-items:center;justify-content:space-between;gap:1rem;min-width:0}.trusted-contacts__group-head h3{margin:0}.trusted-contacts__group-body{display:grid;gap:.9rem;min-width:0}.trusted-contacts__commands{margin:0;padding:0;border:0}.tc-rows{list-style:none;margin:0;padding:0;display:grid;gap:.75rem}.tc-row{display:grid;gap:.125rem;min-width:0;padding:.75rem 1rem;border:1px solid var(--line);border-radius:0;background:var(--surface-2)}.tc-row h3{margin:0;font-size:.9375rem;font-weight:600;overflow-wrap:anywhere}.tc-row__facts,.tc-fact{font-size:.75rem;color:var(--ink-3);overflow-wrap:anywhere}.tc-row__marks{display:flex;flex-wrap:wrap;gap:4px 12px;min-width:0}.tc-packet{min-width:0;overflow-wrap:anywhere}.tc-packet-in{display:grid;gap:.25rem;min-width:0}@media(pointer:coarse){.tc-packet-in .f__labelrow{gap:.8rem}}.tc-packet-in textarea{font-family:var(--mono);font-size:max(.8125rem,var(--field-min));overflow-wrap:anywhere}.unlock-circle-people{display:grid;gap:.4rem;margin:0;padding:0;list-style:none}.unlock-circle-people label{display:flex;align-items:center;gap:.5rem;min-height:2.25rem}.unlock-circle-person{display:flex;align-items:center;gap:.6rem;min-width:0}.unlock-circle-person label{flex:1;min-width:0}.unlock-circle-person__missing{display:inline-flex;align-items:center;gap:.3rem;flex:none;color:var(--ink-3);font-size:.75rem}

package/dist/assets/trusted-contacts-QkvTYGDn.js

@@ -0,0 +1 @@
+import{h as e,S as n,o as t,g as i,T as r,B as a,i as s,b as o}from"./vault-ui-seam-BQGS7RR6.js";import{b6 as c,b7 as l,v as d,i as u,c as p}from"./drop-open-BjgdLxWM.js";import{s as h,_ as g,u as y,l as f,o as m,e as w,a as b,n as v,r as I}from"./native-worker-zod-5c0ed887-B342B6ko.js";import{e as k}from"./noble-crypto-Mv8l2A7D.js";import{g as x}from"./native-worker-noble-hashes-b1a58353-IgGIMWEC.js";const S=[{id:"/settings/security",title:"Settings — security: trusted contacts and circles"}],K=[{id:"settings.trusted-contacts",description:"The Trusted contacts section of Settings › Security: the circles you keep, kept on this device and handed between people as packets.",role:"navigation",routes:["/settings"],capabilityId:"quorum.circle.manage"},{id:"settings.trusted-contacts-circles",description:"The Circles panel: each circle you own is listed with its rule, such as 2 of 3, how many contacts it has and where it stands.",role:"surface",routes:["/settings"],capabilityId:"quorum.circle.manage"},{id:"circle.new",description:"The Start a circle key on the Circles panel: opens a sheet that names a circle and says what it protects, makes the invitation to hand to each contact, and sets the rule and the clocks for the people who answer.",role:"action",routes:["/settings"],capabilityId:"quorum.circle.manage"}],_=[{id:"settings.trusted-contacts.circle",title:"Start a circle of trusted contacts",routes:["/settings"],libraryOnly:!0,guide:["guide/1",'goal "settings.trusted-contacts.circle"','navigate "/settings/security"','wait route "/settings/security" timeout=15000','focus "settings.trusted-contacts" "A circle is the people you trust to approve a request, with a delay that gives you time to object. Each answers with their own security key, and what passes between you is a packet you hand over yourself. Nothing goes to a service." side=bottom','focus "settings.trusted-contacts-circles" "Circles are the ones you own. Each is a rule, the contacts in it and where it stands." side=top',"end"].join("\n")},{id:"settings.trusted-contacts.owner",title:"Make a circle and invite its contacts",routes:["/settings"],libraryOnly:!0,guide:["guide/1",'goal "settings.trusted-contacts.owner"','say "A circle is the people you trust to approve a request. You make it here: name it, hand an invitation to each person, and set how many of them it takes."','navigate "/settings/security"','wait route "/settings/security" timeout=15000','focus "settings.trusted-contacts-circles" "Your circles are listed here, each with its rule, how many contacts it has and where it stands. Open one to invite more people, change it, ask its contacts to approve a share, or retire it." side=top','focus "circle.new" "Start a circle names it, makes the invitation and sets the rule and the clocks. Each contact answers with their own security key, and you hand each of them a packet." side=bottom','success "That is a circle: an invitation, the people who answer it, a rule, and a packet for each. Nothing goes to a service."',"end"].join("\n")}],$=new TextEncoder;function A(e){return $.encode(e)}function q(e){return new TextDecoder("utf-8",{fatal:!0}).decode(e)}function N(e){const n=e instanceof Uint8Array?e:new Uint8Array(e);let t="";for(const i of n)t+=String.fromCharCode(i);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}const O=/^[A-Za-z0-9_-]*$/;function P(e){if(!O.test(e)||e.length%4==1)throw new Error("not base64url");const n=e+"=".repeat((4-e.length%4)%4),t=atob(n.replace(/-/g,"+").replace(/_/g,"/"));return Uint8Array.from(t,e=>e.charCodeAt(0))}function E(e){return[...e].map(e=>e.toString(16).padStart(2,"0")).join("")}function D(n){return n.map(n=>({type:"public-key",id:e(P(n))}))}function T(e,n,i){if(null===e||"public-key"!==e.type)throw new l(n,i);return t(e)}function C(a=n()){return{register:async n=>function(e){const n=T(e,"unsupported","no credential was created"),i=t(n.response),r=i.getPublicKeyAlgorithm(),a=i.getPublicKey();if(null===a)throw new l("unsupported","this browser does not expose the credential's public key");if(-7!==r&&-8!==r)throw new l("unsupported","the key must be ES256 or Ed25519");return{credentialId:N(n.rawId),publicKey:N(a),alg:r,prfEnabled:!0===n.getClientExtensionResults().prf?.enabled}}(await a.create({publicKey:{rp:{id:n.rpId,name:n.rpName},user:{id:e(n.userId),name:n.userName,displayName:n.userName},challenge:e(n.challenge),pubKeyCredParams:[{type:"public-key",alg:-7},{type:"public-key",alg:-8}],excludeCredentials:D(n.excludeCredentialIds),authenticatorSelection:{userVerification:n.requireUserVerification?"required":"preferred",residentKey:"discouraged"},attestation:"none",extensions:{prf:{eval:{first:e(n.prfInput)}}}}})),async assert(n){const s={rpId:n.rpId,challenge:e(n.challenge),allowCredentials:D(n.allowCredentialIds),userVerification:n.requireUserVerification?"required":"preferred"};return n.prfInput&&(s.extensions={prf:{eval:{first:e(n.prfInput)}}}),function(e,n,a){const s=T(e,"canceled","no assertion was made"),o=t(s.response),d=s.getClientExtensionResults().prf?.results?.first;let u=null;if(n&&d){const e=r(d);c(i(e).buffer),u=e}else if(n&&!a)throw new l("prf_missing_output","this key did not return a PRF result");return{credentialId:N(s.rawId),proof:{clientDataJSON:N(o.clientDataJSON),authenticatorData:N(o.authenticatorData),signature:N(o.signature)},prfOutput:u}}(await a.get({publicKey:s}),void 0!==n.prfInput,!0===n.prfOptional)}}}class j extends Error{constructor(e,n){super(n),this.code=e,this.name="DeskError"}code}const J=[{id:"trusted-circle",version:"1.0.0",text:'{\n  "apiVersion": "opensesame.dev/v1alpha1",\n  "kind": "VaultItemType",\n  "metadata": {\n    "id": "trusted-circle",\n    "version": "1.0.0",\n    "publisher": "https://opensesame.dev"\n  },\n  "spec": {\n    "title": "Trusted circle",\n    "plural": "Trusted circles",\n    "extension": ".circle",\n    "summary": "The people you trust to approve a request or to hold a share of a recovery key, how many of them must agree, and how long you have to object.",\n    "categories": ["access"],\n    "sections": [\n      {\n        "id": "circle",\n        "title": "Circle",\n        "fields": [\n          {\n            "id": "label",\n            "type": "string",\n            "label": "Name",\n            "required": true\n          },\n          {\n            "id": "collection",\n            "type": "string",\n            "label": "Protects"\n          },\n          {\n            "id": "status",\n            "type": "select",\n            "label": "State",\n            "options": ["inviting", "armed", "recovering", "retired"],\n            "default": "inviting"\n          },\n          {\n            "id": "rule",\n            "type": "string",\n            "label": "Rule",\n            "help": "For example 3 of 5, or 2 of 3 family and 2 of 4 friends."\n          },\n          {\n            "id": "guardians",\n            "type": "string",\n            "label": "Trusted contacts",\n            "multiple": true\n          },\n          {\n            "id": "approvalMinutes",\n            "type": "number",\n            "label": "Approval window (minutes)"\n          },\n          {\n            "id": "delayHours",\n            "type": "number",\n            "label": "Release delay (hours)"\n          },\n          {\n            "id": "epoch",\n            "type": "number",\n            "label": "Epoch"\n          }\n        ]\n      },\n      {\n        "id": "record",\n        "title": "Record",\n        "fields": [\n          {\n            "id": "circleId",\n            "type": "string",\n            "label": "Circle id"\n          },\n          {\n            "id": "policy",\n            "type": "multiline",\n            "label": "Signed policy"\n          },\n          {\n            "id": "ownerKey",\n            "type": "key-material",\n            "label": "Owner signing key"\n          }\n        ]\n      }\n    ],\n    "native": {\n      "secret": "ownerKey",\n      "trailer": [\n        {\n          "key": "name",\n          "field": "label"\n        },\n        {\n          "key": "protects",\n          "field": "collection"\n        },\n        {\n          "key": "state",\n          "field": "status"\n        },\n        {\n          "key": "rule",\n          "field": "rule"\n        },\n        {\n          "key": "contact",\n          "field": "guardians"\n        },\n        {\n          "key": "approval_minutes",\n          "field": "approvalMinutes"\n        },\n        {\n          "key": "delay_hours",\n          "field": "delayHours"\n        },\n        {\n          "key": "epoch",\n          "field": "epoch"\n        },\n        {\n          "key": "circle_id",\n          "field": "circleId"\n        },\n        {\n          "key": "policy",\n          "field": "policy"\n        }\n      ]\n    },\n    "cxf": {\n      "credential": "custom-fields"\n    },\n    "subtitle": ["rule", "status"],\n    "search": ["label", "collection", "rule", "guardians"]\n  }\n}\n'},{id:"guardian-share",version:"1.0.0",text:'{\n  "apiVersion": "opensesame.dev/v1alpha1",\n  "kind": "VaultItemType",\n  "metadata": {\n    "id": "guardian-share",\n    "version": "1.0.0",\n    "publisher": "https://opensesame.dev"\n  },\n  "spec": {\n    "title": "Guardian share",\n    "plural": "Guardian shares",\n    "extension": ".share",\n    "summary": "A share of someone else\'s recovery key that you hold for them, wrapped so that only your own security key opens it.",\n    "categories": ["access"],\n    "sections": [\n      {\n        "id": "share",\n        "title": "Share",\n        "fields": [\n          {\n            "id": "owner",\n            "type": "string",\n            "label": "Held for",\n            "required": true\n          },\n          {\n            "id": "circleLabel",\n            "type": "string",\n            "label": "Circle"\n          },\n          {\n            "id": "status",\n            "type": "select",\n            "label": "State",\n            "options": ["held", "approved", "released", "retired"],\n            "default": "held"\n          },\n          {\n            "id": "epoch",\n            "type": "number",\n            "label": "Epoch"\n          },\n          {\n            "id": "circleId",\n            "type": "string",\n            "label": "Circle id"\n          },\n          {\n            "id": "guardianId",\n            "type": "string",\n            "label": "Your guardian id"\n          }\n        ]\n      },\n      {\n        "id": "record",\n        "title": "Record",\n        "fields": [\n          {\n            "id": "ownerKey",\n            "type": "string",\n            "label": "Owner key (pinned)"\n          },\n          {\n            "id": "policy",\n            "type": "multiline",\n            "label": "Signed policy"\n          },\n          {\n            "id": "wrapped",\n            "type": "key-material",\n            "label": "Wrapped share"\n          },\n          {\n            "id": "receivingKey",\n            "type": "key-material",\n            "label": "Receiving key"\n          }\n        ]\n      }\n    ],\n    "native": {\n      "secret": "wrapped",\n      "trailer": [\n        {\n          "key": "held_for",\n          "field": "owner"\n        },\n        {\n          "key": "circle",\n          "field": "circleLabel"\n        },\n        {\n          "key": "state",\n          "field": "status"\n        },\n        {\n          "key": "epoch",\n          "field": "epoch"\n        },\n        {\n          "key": "circle_id",\n          "field": "circleId"\n        },\n        {\n          "key": "guardian_id",\n          "field": "guardianId"\n        },\n        {\n          "key": "owner_key",\n          "field": "ownerKey"\n        },\n        {\n          "key": "policy",\n          "field": "policy"\n        },\n        {\n          "key": "receiving_key",\n          "field": "receivingKey"\n        }\n      ]\n    },\n    "cxf": {\n      "credential": "custom-fields"\n    },\n    "subtitle": ["owner", "circleLabel"],\n    "search": ["owner", "circleLabel", "status"]\n  }\n}\n'}],z=new WeakMap;function R(e=d){const n=z.get(e);if(n)return n;const t=async function(e){for(const{id:n,version:t,text:i}of J){const r=u().get(n);if(r&&p(r.metadata.version,t)>=0)continue;const a=await e.installItemTypeDefinition(i);if(!a.ok)throw new Error(`The ${n} item type could not be installed: ${a.message}`)}}(e).finally(()=>z.delete(e));return z.set(e,t),t}function L(e){if(null===e||a(e)||s(e))return JSON.stringify(e);if(o(e)){if(!Number.isSafeInteger(e))throw new Error("canonical JSON allows safe integers only");return JSON.stringify(e)}return Array.isArray(e)?`[${e.map(e=>L(e)).join(",")}]`:function(e){return`{${Object.entries(e).filter(e=>void 0!==e[1]).sort(([e],[n])=>e<n?-1:e>n?1:0).map(([e,n])=>`${JSON.stringify(e)}:${L(n)}`).join(",")}}`}(e)}function U(e){const n=[];for(const t of e){const e=A(t);n.push(...A(`${e.length}\0`),...e)}return Uint8Array.from(n)}const Z=h().regex(/^[A-Za-z0-9_-]+$/).max(8192),M=h().datetime({offset:!0}),V=h().regex(/^sha256:[0-9a-f]{64}$/),W=h().regex(/^[A-Za-z0-9._:-]{1,64}$/),F=h().min(1).max(120),H=["recover-collection","grant-access","replace-owner-credential","export-items"],G=g(H),B=y([f(-7),f(-8)]),Y=m({credentialId:Z,publicKey:Z,alg:B,label:F,prf:w(),addedAt:M}).strict(),Q=m({id:W,name:F,contactRef:W.nullable(),custodyDomain:W,hpkePublicKey:Z,credentials:b(Y).min(1).max(8)}).strict(),X=m({id:W,threshold:v().int().min(1).max(16),guardianIds:b(W).min(1).max(16)}).strict(),ee=m({v:f(1),circleId:W,epoch:v().int().min(1),label:F,collection:F,rpId:h().min(1).max(253),origins:b(h().url().max(256)).min(1).max(8),ownerKey:Z,groupThreshold:v().int().min(1).max(16),groups:b(X).min(1).max(16),guardians:b(Q).min(1).max(32),shareCommitments:I(W,V),operations:b(G).min(1).max(H.length),approvalWindowSec:v().int().min(60).max(604800),releaseDelaySec:v().int().min(0).max(7776e3),requestLifetimeSec:v().int().min(300).max(10368e3),requireUserVerification:w(),createdAt:M,supersedes:m({epoch:v().int().min(1),digest:V}).strict().optional()}).strict(),ne=m({policy:ee,digest:V,signature:Z}).strict(),te=m({principalId:W,resourceKind:g(["vault","connection","folder","item"]),resourceId:h().min(1).max(128),resourceLabel:h().min(1).max(128),policy:h().min(1).max(32),durationSeconds:v().int().min(60).max(604800)}).strict();m({v:f(1),requestId:Z,circleId:W,policyDigest:V,epoch:v().int().min(1),operation:G,scope:m({collection:F,items:b(W).max(256)}).strict(),recipient:m({hpkePublicKey:Z,label:F}).strict(),grant:te.optional(),summary:h().min(1).max(600),createdAt:M,approveBy:M,releaseNotBefore:M,expiresAt:M}).strict();const ie=m({clientDataJSON:Z,authenticatorData:Z,signature:Z}).strict();m({v:f(1),kind:f("approval"),requestDigest:V,guardianId:W,credentialId:Z,assertion:ie}).strict(),m({v:f(1),kind:f("release"),requestDigest:V,guardianId:W,credentialId:Z,assertion:ie,sealed:m({enc:Z,ciphertext:Z}).strict()}).strict(),m({v:f(1),kind:f("cancellation"),circleId:W,requestDigest:V,issuedAt:M,signature:Z}).strict();class re extends Error{constructor(e,n){super(n),this.code=e,this.name="PolicyError"}code}function ae(e,n){const t=ne.parse(e);var i;if(function(e){const{epoch:n,supersedes:t}=e;if(1===n&&t)throw new re("chain","the first epoch replaces nothing");if(n>1&&t?.epoch!==n-1)throw new re("chain","a later epoch must name the epoch before it")}(i=t.policy),function(e){const n=e.guardians.map(e=>e.id);if(new Set(n).size!==n.length)throw new re("duplicate_guardian","guardian ids must be unique");const t=e.groups.flatMap(e=>e.guardianIds);if(new Set(t).size!==t.length)throw new re("guardian_in_two_groups","a guardian holds one share, so sits in one group");if(t.some(e=>!n.includes(e))||n.some(e=>!t.includes(e)))throw new re("group_membership","every guardian is in exactly one group");if(e.groupThreshold>e.groups.length)throw new re("group_threshold","the group threshold exceeds the group count");for(const i of e.groups){if(i.threshold>i.guardianIds.length)throw new re("member_threshold",`group ${i.id} needs more guardians than it has`);if(1===i.threshold&&i.guardianIds.length>1)throw new re("member_threshold_one","a 1-of-N group adds no security: use one guardian")}}(i),function(e){const n=new Set;for(const r of e.guardians){for(const e of r.credentials){if(n.has(e.credentialId))throw new re("shared_credential","a credential belongs to one guardian only");n.add(e.credentialId)}if(e.operations.includes("recover-collection")&&!r.credentials.some(e=>e.prf))throw new re("no_prf",`${r.name} has no key that can protect a share (WebAuthn PRF)`)}const t=Object.keys(e.shareCommitments).sort(),i=e.operations.includes("recover-collection")?e.guardians.map(e=>e.id).sort():[];if(t.join()!==i.join())throw new re("commitments","a share commitment is needed for each guardian of a recovering circle, and for no other")}(i),function(e){for(const n of e.origins){const t=se(n);if(t!==e.rpId&&!t.endsWith(`.${e.rpId}`))throw new re("rp_id",`${n} is not under the RP ID ${e.rpId}`)}if(e.approvalWindowSec>e.requestLifetimeSec)throw new re("lifetime","the approval window outlasts the request");if(e.releaseDelaySec>=e.requestLifetimeSec)throw new re("lifetime","the request would expire before any share could be released")}(i),function(e){return n=[L(e)],`sha256:${E(x(U(["opensesame:quorum-policy:v1",...n])))}`;var n}(t.policy)!==t.digest)throw new re("digest_mismatch","the policy does not match its digest");if(void 0!==n&&t.policy.ownerKey!==n)throw new re("owner_key_changed","the policy is signed by a different owner key");if(!k.verify(P(t.signature),U(["opensesame:quorum-policy-signature:v1",t.digest]),P(t.policy.ownerKey)))throw new re("bad_signature","the owner signature does not verify");return t}function se(e){return new URL(e).hostname}(new TextEncoder).encode("HPKE-v1"),new TextEncoder,[...Array.from({length:4},(e,n)=>n)].reverse();const oe=m({credentialId:h().regex(/^[A-Za-z0-9_-]+$/),nonce:h().regex(/^[A-Za-z0-9_-]+$/),ciphertext:h().regex(/^[A-Za-z0-9_-]+$/)}).strict(),ce=m({v:f(1),circleId:h(),guardianId:h(),epoch:v().int().min(1),policyDigest:h().regex(/^sha256:[0-9a-f]{64}$/),envelopes:b(oe).min(1).max(8)}).strict();m({v:f(1),signedPolicy:ne,nonce:h().regex(/^[A-Za-z0-9_-]+$/),ciphertext:h().regex(/^[A-Za-z0-9_-]+$/)}).strict(),m({v:f(1),kind:f("share-delivery"),circleId:h(),guardianId:h(),epoch:v().int().min(1),enc:h().regex(/^[A-Za-z0-9_-]+$/),ciphertext:h().regex(/^[A-Za-z0-9_-]+$/)}).strict(),Uint8Array.from([48,89,48,19,6,7,42,134,72,206,61,2,1,6,8,42,134,72,206,61,3,1,7,3,66,0]),Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),m({type:h(),challenge:h(),origin:h(),crossOrigin:w().optional()}).passthrough();class le extends Error{constructor(e,n){super(n),this.code=e,this.name="GuardianError"}code}function de(e){return{signedPolicy:e.signedPolicy,guardianId:e.wrapped.guardianId}}m({v:f(1),kind:f("custody-receipt"),circleId:h(),guardianId:h(),epoch:v().int().min(1),policyDigest:h(),commitment:h(),credentialId:h(),wrappedCredentialIds:b(h()).min(1),assertion:ie}).strict();const ue="trusted-circle",pe="guardian-share";function he(e){const n=e.groups.map(e=>`${e.threshold} of ${e.guardianIds.length} ${e.id}`),[t]=e.groups;return 1===e.groups.length&&t?`${t.threshold} of ${t.guardianIds.length}`:`${e.groupThreshold} of ${e.groups.length} groups: ${n.join(", ")}`}function ge(e){return s(e)?e:""}function ye(e){const{policy:n}=e.signedPolicy;return{label:n.label,collection:n.collection,status:e.state,rule:he(n),guardians:n.guardians.map(e=>e.name),approvalMinutes:String(Math.round(n.approvalWindowSec/60)),delayHours:String(Math.round(n.releaseDelaySec/3600)),epoch:String(n.epoch),circleId:n.circleId,policy:JSON.stringify(e.signedPolicy),ownerKey:N(e.ownerSecretKey)}}function fe(e){return{signedPolicy:ae(ne.parse(JSON.parse(ge(e.policy)))),ownerSecretKey:P(ge(e.ownerKey))}}function me(e){const{signedPolicy:n,wrapped:t}=e.holding;return{owner:e.heldFor,circleLabel:n.policy.label,status:e.state,epoch:String(t.epoch),circleId:t.circleId,guardianId:t.guardianId,ownerKey:n.policy.ownerKey,policy:JSON.stringify(n),wrapped:JSON.stringify(t),receivingKey:e.receivingKey?N(e.receivingKey):""}}function we(e){const{signedPolicy:n}=e;return{owner:e.heldFor,circleLabel:n.policy.label,status:e.state,epoch:String(n.policy.epoch),circleId:n.policy.circleId,guardianId:e.guardianId,ownerKey:n.policy.ownerKey,policy:JSON.stringify(n),wrapped:"",receivingKey:e.receivingKey?N(e.receivingKey):""}}function be(e){const n=function(e){const n=ge(e);return"approved"===n||"released"===n||"retired"===n?n:"held"}(e.status);if(""!==ge(e.wrapped)){const{holding:t,receivingKey:i}=function(e){const n=function(e,n){const t=m({signedPolicy:ne,wrapped:ce}).parse(e),i=ae(t.signedPolicy,n),{wrapped:r}=t;if(r.policyDigest!==i.digest)throw new le("holding","the wrapped share is for another policy");return{signedPolicy:i,wrapped:r}}({signedPolicy:JSON.parse(ge(e.policy)),wrapped:ce.parse(JSON.parse(ge(e.wrapped)))},ge(e.ownerKey)),t=ge(e.receivingKey);return{holding:n,receivingKey:""===t?null:P(t)}}(e);return{seat:de(t),holding:t,receivingKey:i,state:n}}const t=ae(ne.parse(JSON.parse(ge(e.policy))),ge(e.ownerKey)),i=ge(e.receivingKey);return{seat:{signedPolicy:t,guardianId:ge(e.guardianId)},holding:null,receivingKey:""===i?null:P(i),state:n}}export{j as D,pe as G,re as P,ue as T,q as a,fe as b,ye as c,we as d,R as e,S as f,_ as g,K as h,be as r,me as s,E as t,A as u,C as w};

package/dist/assets/types-Ctz6L20B.js

@@ -0,0 +1 @@
+import{v as e,c as r,r as t,h as n,p as o}from"./certs-CDCfMuEi.js";import{c as s}from"./main-BrkS-iow.js";function i(t,n){const o=new Set(t),s=[];for(const i of e()){const e=r(i.providerId);if(!e||!o.has(e.category))continue;e.id!==i.providerId&&(e.id=i.providerId);const t=n(e);t.ok&&s.push(t)}return s}const a="backup.cloud-secrets";function c(e){return n(e)}function u(){return i(["cloud_secret_storage","encryption"],c)}function p(){return u().map(e=>d(e.providerId))}function d(e){return o(e)}function l(){return p()}const f=Object.freeze(Object.defineProperty({__proto__:null,CAPABILITY:a,applySavedStorageConnectors:u,capabilityRuntime:{capability:a,async activate(e){const r=s(e,a);if(r.disposed())return r.handle();const n=t("cloud_secret_storage",l),o=t("encryption",l);return r.onDispose(n),r.onDispose(o),r.handle()}},runSavedStorageConnectors:l,savedStorageOperation:c,startStorageConnectors:p,storageOperation:d},Symbol.toStringTag,{value:"Module"}));class _ extends Error{constructor(e,r){super(r),this.code=e,this.name="AiConnectionError"}code}function b(e){return"stability_sd3"===e}function g(e){return"elevenlabs_scribe"===e||"deepgram_listen"===e||"assemblyai_transcript"===e}function m(e){return"replicate_predictions"===e||"assemblyai_transcript"===e}function y(e){if("bedrock_converse"===e||"replicate_predictions"===e||g(e)||b(e))throw new _("configuration","Use this family's signed or finite protocol adapter.");return e}export{_ as A,i as a,b,m as c,g as i,f as r,y as t};

package/dist/assets/use-access-book-1e-Lb3_j.css

@@ -0,0 +1 @@
+.access-record-choices{list-style:none;margin:0;padding:0;border-block:1px solid var(--line)}.access-record-choices .access-record-choice{width:100%;border:0;background:transparent;color:var(--ink);font:inherit;text-align:start;text-decoration:none}.access-record-choices .access-record-choice.is-cursor{color:var(--canvas);background:var(--ink)}@media(max-width:700px),(pointer:coarse){.access-record-choices .access-record-choice{min-height:44px}}.access-record-choices .access-record-choice:hover:not(.is-cursor){background:var(--surface-2)}.access-record-review{min-width:0;margin:0;padding:0;border:0}.access-local-records{list-style:none;padding:0;margin:0}.access-local-records li{padding-block:.9rem;border-bottom:1px solid var(--line);overflow-wrap:anywhere}.access-local-confirmation{min-width:0;padding:.9rem;border:1px solid var(--line);margin-block:.9rem;overflow-wrap:anywhere}.access-local-confirmation p{margin-block:.4rem}.access-head{display:flex;align-items:center;justify-content:space-between;gap:.75rem}.access-pathbar__keys{display:flex;align-items:center;gap:.25rem}.access-pathbar__file{position:relative;overflow:hidden;cursor:pointer}.access-pathbar__file input[type=file]{position:absolute;inset:-1px;width:calc(100% + 2px);height:calc(100% + 2px);opacity:0;cursor:pointer}.access-ref{justify-self:start;max-width:100%;font-family:var(--mono);font-size:.75rem;color:var(--ink-3);background:var(--surface-3);border:1px solid var(--line);border-radius:var(--radius);padding:.0625rem .5rem;word-break:break-all}.access-request{display:grid;gap:.625rem;padding:.875rem 1rem 1rem;border:1px solid var(--line);border-radius:var(--radius);background:var(--surface-2)}.access-trail{list-style:none;margin:0;padding:0}.access-trail li{display:grid;grid-template-columns:minmax(0,max-content) minmax(0,1fr) max-content;align-items:center;gap:.5rem .75rem;padding:.5rem 1rem;border-bottom:1px solid var(--line);font-size:.8125rem}.access-trail li:last-child{border-bottom:0}.access-trail__when{display:inline-flex;align-items:center;gap:.3125rem;color:var(--ink-2);white-space:nowrap}.access-trail__when svg{width:.875rem;height:.875rem}.access-trail__type{font-family:var(--mono);font-size:.75rem;color:var(--ink);word-break:break-word}.access-policy-title{margin:0;font-size:.9375rem;font-weight:600}.access-domain-list{list-style:none;margin:.75rem 0 0;padding:0;display:grid;gap:.35rem}.access-domain-row{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:.5rem;padding:.45rem .6rem;border-radius:var(--radius);background:var(--surface);border:1px solid var(--line)}.access-domain-row code{font-size:.8125rem;word-break:break-all}.sites-effect-toggle{display:inline-flex;border:1px solid var(--line-strong);border-radius:0;overflow:hidden;background:var(--surface)}.sites-effect{-webkit-appearance:none;appearance:none;border:0;margin:0;padding:.35rem .7rem;background:transparent;color:var(--ink-2);font:inherit;font-size:.75rem;font-weight:600;cursor:pointer}.sites-effect.is-on.is-allow{background:var(--ok-wash);color:var(--ok)}.access-connector__chips{display:inline-flex;flex-wrap:wrap;gap:.375rem}@media(max-width:30rem){#local-connectors .identity-row__main{display:grid;grid-template-columns:auto minmax(0,1fr) auto;align-items:center}#local-connectors .identity-row__id{grid-row:1;grid-column:2}#local-connectors .access-connector__chips{grid-row:2;grid-column:2 / -1}#local-connectors .identity-row .actions{grid-row:1;grid-column:3;margin-left:0}}.access-bindings{list-style:none;margin:0;padding:0}.access-binding{display:flex;flex-wrap:wrap;align-items:center;gap:.375rem .75rem;padding:.55rem 0;border-top:1px solid var(--line);font-size:.875rem}.access-binding__policy,.access-binding__until{font-family:var(--mono);font-size:.75rem;color:var(--ink-2)}.access-binding .btn{margin-left:auto}.access-bind{min-width:0;padding:.75rem 0 .25rem;border-top:1px solid var(--line)}.access-bind legend{padding:0;margin-bottom:.5rem;font-size:.75rem;font-weight:600;color:var(--ink-2)}.access-bind__fields{display:grid;grid-template-columns:repeat(auto-fit,minmax(10rem,1fr));gap:.75rem;margin-bottom:.75rem}.access-bind p{margin:0 0 .6rem;max-width:62ch}.access-policy{display:grid;gap:.5rem;padding-block:.75rem}.access-policy+.access-policy{border-top:1px solid var(--line)}.access-policy>:is(h3,p){margin:0}.access-pick{display:grid;gap:.75rem;min-width:0;margin:0;padding:0 0 .75rem;border:0}.access-pick .conn-grid{margin:0}