@seedprotocol/sdk 0.7.2 → 0.7.3-next.654.g52217f6

package/dist/{index.browser-DO20vYuP.js → index.browser-Cm06tP4X.js}

@@ -1,12 +1,13 @@
-import { t as BasePathResolver, a as BaseDb, b as appState, B as BaseFileManager } from './BasePathResolver-BdxCSIzn.js';
+import { r as BasePathResolver, B as BaseDb, a as appState, t as BaseFileManager } from './BasePathResolver-CfSfMW5_.js';
 import { eq, sql } from 'drizzle-orm';
-import { q as withDbTabLock, u as notifyFilesWrittenOutsideCache, v as withSeedDbLock } from './tabEvents-C9qUKx_z.js';
+import { D as withDbTabLock, p as contentSha256TagMatches, E as notifyFilesWrittenOutsideCache, G as withSeedDbLock } from './tabEvents-DguZpCCv.js';
+import { M as MIME_TO_EXTENSION } from './mimeTypes-DHAHC4eZ.js';
 import debug from 'debug';
 import { F as FileSystemLockedError } from './errors-CrBxGWah.js';
 import { drizzle } from 'drizzle-orm/sqlite-proxy';
 import { sha256 } from '@noble/hashes/sha256';
 import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
-import { s as schema } from './index-CSOQFAOn.js';
+import { s as schema } from './index-DglvthOk.js';
 import { SQLocalDrizzle } from 'sqlocal/drizzle';
 import { Observable, distinctUntilChanged } from 'rxjs';
 import { BaseArweaveClient, getPreferredArweaveReadBaseUrls, fetchArweaveRawFromBaseUrl, GET_TRANSACTION_TAGS } from '@seedprotocol/arweave';
@@ -111,7 +112,8 @@ async function addExcludedTransactions(transactionIds) {
     });
 }
 
-var filesDownload = `(
+var filesDownload = `const SEED_MIME_TO_EXTENSION = ${JSON.stringify(MIME_TO_EXTENSION)};
+(
   ${function () {
     const identifyString = (str) => {
         try {
@@ -229,6 +231,15 @@ var filesDownload = `(
         const root = filesRoot.replace(/\/$/, '');
         return [root, ...parts].filter(Boolean).join('/').replace(/\/+/g, '/');
     };
+    /** Per-gateway limit for one `/raw/{id}` request, body included. */
+    const RAW_FETCH_TIMEOUT_MS = 60000;
+    const errorInfo = (error) => {
+        const e = (error ?? {});
+        return {
+            name: typeof e.name === 'string' && e.name ? e.name : 'Error',
+            message: typeof e.message === 'string' ? e.message : String(error),
+        };
+    };
     const toBaseUrl = (hostOrUrl) => {
         const h = (hostOrUrl || '').trim().replace(/\/$/, '');
         if (!h)
@@ -240,30 +251,213 @@ var filesDownload = `(
             : 'https';
         return `${protocol}://${h}`;
     };
+    const toHex = (buffer) => {
+        const view = new Uint8Array(buffer);
+        let hex = '';
+        for (let i = 0; i < view.length; i++)
+            hex += view[i].toString(16).padStart(2, '0');
+        return hex;
+    };
+    /** Verification requests waiting for the page's answer, by request id. */
+    const pendingVerifications = new Map();
+    let lastVerificationId = 0;
+    /**
+     * Ask the page whether `bytes` match a Content-SHA-256 tag. The page runs `contentSha256TagMatches`,
+     * which also accepts the SHA3-256 digests older SDKs wrote under that tag (no SHA3 in WebCrypto, and
+     * this worker cannot import a hash library). The bytes are copied, not transferred.
+     */
+    const verifyOnPage = (transactionId, bytes, expected) => new Promise((resolve) => {
+        const requestId = ++lastVerificationId;
+        pendingVerifications.set(requestId, resolve);
+        globalThis.postMessage({ message: 'verifyContent', requestId, transactionId, expected, bytes });
+    });
+    /**
+     * True when the downloaded bytes match the upload's Content-SHA-256 tag. SHA-256 is checked here
+     * with WebCrypto when available (secure contexts); anything else goes to the page.
+     */
+    const contentMatchesTag = async (transactionId, bytes, expected) => {
+        const want = expected.trim().toLowerCase();
+        try {
+            const subtle = globalThis.crypto && globalThis.crypto.subtle;
+            if (subtle && toHex(await subtle.digest('SHA-256', bytes)) === want)
+                return true;
+        }
+        catch (error) {
+            /* fall back to the page */
+        }
+        return verifyOnPage(transactionId, bytes, want);
+    };
     /**
      * GET /raw/{id} from each gateway in order. `networkFailedEverywhere` is true only when no gateway
      * answered at all; a non-2xx (e.g. not yet propagated) is not a reason to exclude the transaction.
+     * `contentType` is the response's Content-Type (gateways serve the upload's Content-Type tag).
+     * With `expectedHash` (the upload's Content-SHA-256 tag), a body that does not match it is skipped
+     * and the next gateway tried; `hashMismatch` says that happened and no gateway served matching bytes.
      */
-    const fetchRaw = async (baseUrls, transactionId) => {
+    const fetchRaw = async (baseUrls, transactionId, expectedHash) => {
         let answered = false;
+        let hashMismatch = false;
         for (const base of baseUrls) {
+            let arrayBuffer;
+            let contentType = '';
+            // A hung gateway must not stall the batch: abort the request (body included) after a while.
+            const controller = typeof AbortController !== 'undefined' ? new AbortController() : undefined;
+            const timer = controller ? setTimeout(() => controller.abort(), RAW_FETCH_TIMEOUT_MS) : undefined;
             try {
-                const response = await fetch(`${base}/raw/${transactionId}`);
+                const response = await fetch(`${base}/raw/${transactionId}`, controller ? { signal: controller.signal } : undefined);
                 answered = true;
                 if (!response.ok)
                     continue;
-                const arrayBuffer = await response.arrayBuffer();
-                if (arrayBuffer.byteLength > 0) {
-                    return { arrayBuffer, networkFailedEverywhere: false };
-                }
+                arrayBuffer = await response.arrayBuffer();
+                contentType = (response.headers?.get('content-type') || '')
+                    .split(';')[0]
+                    .trim()
+                    .toLowerCase();
             }
             catch (error) {
                 /* next gateway */
+                continue;
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+            if (!arrayBuffer || arrayBuffer.byteLength === 0)
+                continue;
+            if (expectedHash) {
+                if (!(await contentMatchesTag(transactionId, arrayBuffer, expectedHash))) {
+                    // E.g. a gateway's error page served with 200: don't trust it, try the next gateway.
+                    hashMismatch = true;
+                    continue;
+                }
+                return { arrayBuffer, contentType, networkFailedEverywhere: false, verified: true };
+            }
+            return { arrayBuffer, contentType, networkFailedEverywhere: false };
+        }
+        return { networkFailedEverywhere: !answered, hashMismatch };
+    };
+    /**
+     * Downloaded bytes on their way to OPFS. The one place a read-side transform (e.g. decrypting a
+     * future private upload) would go for downloads: this worker runs from a string, so it cannot
+     * import the main thread's `transformArweaveContent`; keys or config would arrive in the message.
+     * Identity for now.
+     */
+    const transformDownloadedContent = async (bytes, _context) => bytes;
+    /** True when the bytes start with the signature of an image format the SDK stores in `images/`. */
+    const hasImageSignature = (bytes) => {
+        const at = (offset, ...sig) => sig.every((b, i) => bytes[offset + i] === b);
+        const ascii = (offset, s) => at(offset, ...Array.from(s).map((c) => c.charCodeAt(0)));
+        if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a))
+            return true; // PNG
+        if (at(0, 0xff, 0xd8, 0xff))
+            return true; // JPEG
+        if (ascii(0, 'GIF87a') || ascii(0, 'GIF89a'))
+            return true;
+        if (ascii(0, 'RIFF') && ascii(8, 'WEBP'))
+            return true;
+        if (ascii(0, 'BM'))
+            return true; // BMP
+        if (at(0, 0x00, 0x00, 0x01, 0x00))
+            return true; // ICO
+        if (at(0, 0x49, 0x49, 0x2a, 0x00) || at(0, 0x4d, 0x4d, 0x00, 0x2a))
+            return true; // TIFF
+        if (ascii(4, 'ftyp')) {
+            // ISO-BMFF images (AVIF / HEIC); ftyp is also MP4, so check the brand
+            const brand = String.fromCharCode(...Array.from(bytes.slice(8, 12)));
+            return ['avif', 'avis', 'heic', 'heix', 'heif', 'mif1', 'msf1'].includes(brand);
+        }
+        return false;
+    };
+    /**
+     * Content-Types that say nothing about the content: these are sniffed instead. `text/plain` is
+     * here because some gateways send it for anything textual.
+     */
+    const GENERIC_CONTENT_TYPES = ['', 'application/octet-stream', 'binary/octet-stream', 'text/plain'];
+    /** Where a declared Content-Type goes; undefined means sniff the bytes. */
+    const directoryForContentType = (contentType) => {
+        if (GENERIC_CONTENT_TYPES.indexOf(contentType) !== -1)
+            return undefined;
+        if (contentType.startsWith('image/'))
+            return 'images';
+        if (contentType === 'text/html' || contentType === 'application/xhtml+xml')
+            return 'html';
+        if (contentType === 'application/json' || contentType.endsWith('+json'))
+            return 'json';
+        return 'files';
+    };
+    /** Shared with the upload side (`helpers/mimeTypes.ts`), injected into this worker's source. */
+    const FILE_EXTENSIONS = SEED_MIME_TO_EXTENSION;
+    /** `files/{txId}` plus an extension when the Content-Type has a well-known one. */
+    const fileNameForFiles = (transactionId, contentType) => {
+        const ext = FILE_EXTENSIONS[contentType];
+        return ext ? `${transactionId}.${ext}` : transactionId;
+    };
+    const decodeBase64 = (base64) => {
+        try {
+            const binaryString = atob(base64);
+            const binaryData = new Uint8Array(binaryString.length);
+            for (let i = 0; i < binaryString.length; i++) {
+                binaryData[i] = binaryString.charCodeAt(i);
+            }
+            return binaryData;
+        }
+        catch (error) {
+            return undefined;
+        }
+    };
+    /**
+     * Composite format: a copy of `helpers/compositeUpload.ts` (this worker cannot import; a test
+     * decodes the SDK encoder's output through this worker). Children are
+     * `===FILE_SEPARATOR===<name>===FILE_SEPARATOR===<text>`; a binary child's name ends in `;base64`
+     * and its content is base64.
+     */
+    const COMPOSITE_SEPARATOR = '===FILE_SEPARATOR===';
+    const COMPOSITE_BASE64_SUFFIX = ';base64';
+    const startsWithCompositeSeparator = (bytes) => {
+        if (bytes.length < COMPOSITE_SEPARATOR.length)
+            return false;
+        for (let i = 0; i < COMPOSITE_SEPARATOR.length; i++) {
+            if (bytes[i] !== COMPOSITE_SEPARATOR.charCodeAt(i))
+                return false;
+        }
+        return true;
+    };
+    const decodeComposite = (bytes) => {
+        const parts = new TextDecoder('utf-8').decode(bytes).split(COMPOSITE_SEPARATOR).slice(1);
+        if (parts.length % 2 !== 0)
+            return undefined;
+        const encoder = new TextEncoder();
+        const children = [];
+        for (let i = 0; i < parts.length; i += 2) {
+            const rawName = parts[i];
+            const content = parts[i + 1];
+            if (rawName.endsWith(COMPOSITE_BASE64_SUFFIX)) {
+                const decoded = decodeBase64(content.replace(/\s/g, ''));
+                if (!decoded)
+                    return undefined;
+                children.push({ name: rawName.slice(0, -COMPOSITE_BASE64_SUFFIX.length), bytes: decoded });
             }
+            else {
+                children.push({ name: rawName, bytes: encoder.encode(content) });
+            }
+        }
+        return children;
+    };
+    /**
+     * A composite child's path from the page, relative to the files root. Only plain relative paths
+     * are taken: nothing absolute, no `.` / `..` segments, no backslashes.
+     */
+    const safeRelativePath = (path) => {
+        if (typeof path !== 'string' || !path || path.startsWith('/') || path.indexOf('\\') !== -1)
+            return undefined;
+        const segments = path.split('/');
+        for (const segment of segments) {
+            if (!segment || segment === '.' || segment === '..')
+                return undefined;
         }
-        return { networkFailedEverywhere: !answered };
+        return path;
     };
-    const downloadFiles = async ({ transactionIds, arweaveHost, arweaveBaseUrls, filesRoot = '/files', }) => {
+    const downloadFiles = async ({ transactionIds, arweaveHost, arweaveBaseUrls, filesRoot = '/files', expectedContentHashes, compositeChildPaths, }) => {
         // Preferred / resolved gateways first, then the configured host; deduped.
         const baseUrls = [];
         for (const candidate of (arweaveBaseUrls || []).concat([arweaveHost])) {
@@ -273,134 +467,189 @@ var filesDownload = `(
             }
         }
         for (const transactionId of transactionIds) {
-            const { arrayBuffer, networkFailedEverywhere } = await fetchRaw(baseUrls, transactionId);
-            if (!arrayBuffer) {
-                if (networkFailedEverywhere) {
-                    globalThis.postMessage({
-                        message: 'excludeTransaction',
-                        transactionId,
-                    });
-                }
-                continue;
+            // One bad file (failed OPFS write, quota, malformed content) must not stall or abort the batch.
+            try {
+                await downloadFile(transactionId, baseUrls, filesRoot, expectedContentHashes?.[transactionId], compositeChildPaths?.[transactionId]);
             }
-            let dataString;
-            const isBinaryData = isBinary(arrayBuffer);
-            if (!isBinaryData) {
-                const decoder = new TextDecoder('utf-8');
-                const text = decoder.decode(arrayBuffer);
-                dataString = text;
+            catch (error) {
+                globalThis.postMessage({ message: 'fileError', transactionId, error: errorInfo(error) });
             }
-            if (dataString && dataString.startsWith('===FILE_SEPARATOR===')) {
-                const dataStringParts = dataString
-                    .split('===FILE_SEPARATOR===')
-                    .slice(1);
-                if (dataStringParts.length % 2 !== 0) {
-                    throw new Error('Input array must have an even number of elements.');
-                }
-                for (let i = 0; i < dataStringParts.length; i += 2) {
-                    const contentType = dataStringParts[i];
-                    const content = dataStringParts[i + 1];
-                    const encoder = new TextEncoder();
-                    if (contentType === 'html') {
-                        const fileName = `${transactionId}.html`;
-                        const buffer = encoder.encode(content);
-                        await saveBufferToOPFS(getFilesPath(filesRoot, 'html', fileName), buffer);
-                    }
-                    if (contentType === 'json') {
-                        const fileName = `${transactionId}.json`;
-                        const buffer = encoder.encode(content);
-                        await saveBufferToOPFS(getFilesPath(filesRoot, 'json', fileName), buffer);
-                    }
-                }
-                continue;
+            // Liveness signal for the page's inactivity watchdog.
+            globalThis.postMessage({ message: 'fileProcessed', transactionId });
+        }
+    };
+    const downloadFile = async (transactionId, baseUrls, filesRoot, expectedHash, childPaths) => {
+        const encoder = new TextEncoder();
+        const fetched = await fetchRaw(baseUrls, transactionId, expectedHash);
+        if (fetched.verified) {
+            globalThis.postMessage({ message: 'contentVerified', transactionId });
+        }
+        if (!fetched.arrayBuffer) {
+            if (fetched.hashMismatch) {
+                // Nothing saved: the bytes are not what was uploaded. Not excluded, a later run may get them.
+                globalThis.postMessage({ message: 'contentHashMismatch', transactionId });
             }
-            if (!dataString && arrayBuffer) {
-                await saveBufferToOPFS(getFilesPath(filesRoot, 'images', transactionId), new Uint8Array(arrayBuffer));
-                continue;
+            else if (fetched.networkFailedEverywhere) {
+                globalThis.postMessage({
+                    message: 'excludeTransaction',
+                    transactionId,
+                });
             }
-            if (!dataString) {
-                continue;
+            return;
+        }
+        const contentType = fetched.contentType || '';
+        const bytes = await transformDownloadedContent(new Uint8Array(fetched.arrayBuffer));
+        const saveToFiles = (data) => saveBufferToOPFS(getFilesPath(filesRoot, 'files', fileNameForFiles(transactionId, contentType)), data);
+        // Composite upload (several ItemStorage files in one transaction, uploaded as
+        // application/octet-stream). Detected on the bytes: a composite of mostly non-ASCII text (e.g.
+        // CJK html) would fail the isBinary heuristic below.
+        if (startsWithCompositeSeparator(bytes)) {
+            const children = decodeComposite(bytes);
+            if (!children) {
+                // Not a composite after all: keep the bytes rather than fail the whole download.
+                await saveToFiles(bytes);
+                return;
             }
-            let contentType = identifyString(dataString);
-            if (contentType !== 'json' &&
-                contentType !== 'base64' &&
-                contentType !== 'html') {
-                const possibleImageType = getDataTypeFromString(dataString);
-                if (!possibleImageType) {
-                    continue;
+            for (const child of children) {
+                // Children are routed by property name: to the path the page gave for it (the model's
+                // ItemStorage directory and extension), else the html / json layout older SDKs assumed.
+                const routed = childPaths && Object.prototype.hasOwnProperty.call(childPaths, child.name)
+                    ? safeRelativePath(childPaths[child.name])
+                    : undefined;
+                if (routed) {
+                    await saveBufferToOPFS(getFilesPath(filesRoot, routed), child.bytes);
                 }
-                contentType = possibleImageType;
-            }
-            if (contentType === 'url') {
-                const url = dataString;
-                let buffer;
-                try {
-                    const response = await fetch(url);
-                    if (!response.ok) {
-                        continue;
-                    }
-                    buffer = await response.arrayBuffer();
+                else if (child.name === 'html') {
+                    await saveBufferToOPFS(getFilesPath(filesRoot, 'html', `${transactionId}.html`), child.bytes);
                 }
-                catch (error) {
-                    globalThis.postMessage({
-                        message: 'excludeTransaction',
-                        transactionId,
-                    });
-                    continue;
+                else if (child.name === 'json') {
+                    await saveBufferToOPFS(getFilesPath(filesRoot, 'json', `${transactionId}.json`), child.bytes);
                 }
-                const bufferUint8Array = new Uint8Array(buffer);
-                // Extract the file extension from the URL
-                const extensionMatch = url.match(/\.(jpg|jpeg|png|gif|bmp|webp|svg)$/i);
-                if (!extensionMatch) {
-                    throw new Error('Unable to determine the file extension from the URL.');
+                else {
+                    // No local item knows this child's property yet; a later download (after sync) places it.
+                    globalThis.postMessage({ message: 'compositeChildUnrouted', transactionId, name: child.name });
                 }
-                extensionMatch[0]; // e.g., ".jpg"
-                // Set the file name (you can customize this)
-                // const fileNameFromUrl = `${transactionId}${fileExtension}`
-                await saveBufferToOPFS(getFilesPath(filesRoot, 'images', transactionId), bufferUint8Array);
-                continue;
             }
-            const mimeType = getMimeType(dataString);
-            let fileExtension = mimeType;
-            if (fileExtension && fileExtension?.startsWith('image')) {
-                fileExtension = fileExtension.replace('image/', '');
+            return;
+        }
+        let dataString;
+        if (!isBinary(bytes)) {
+            dataString = new TextDecoder('utf-8').decode(bytes);
+        }
+        // The upload said what it is (Content-Type tag, served as the response header).
+        const declaredDir = directoryForContentType(contentType);
+        const isLegacyDataUri = !!dataString && dataString.startsWith('data:');
+        if (declaredDir && !isLegacyDataUri) {
+            if (declaredDir === 'images') {
+                await saveBufferToOPFS(getFilesPath(filesRoot, 'images', transactionId), bytes);
             }
-            let fileName = transactionId;
-            if (contentType === 'base64') {
-                if (fileExtension) {
-                    fileName += `.${fileExtension}`;
-                }
-                // Remove the Base64 header if it exists (e.g., "data:image/png;base64,")
-                const base64Data = dataString.split(',').pop() || '';
-                // Decode the Base64 string to binary
-                const binaryString = atob(base64Data);
-                const length = binaryString.length;
-                const binaryData = new Uint8Array(length);
-                for (let i = 0; i < length; i++) {
-                    binaryData[i] = binaryString.charCodeAt(i);
+            else if (declaredDir === 'html') {
+                await saveBufferToOPFS(getFilesPath(filesRoot, 'html', `${transactionId}.html`), bytes);
+            }
+            else if (declaredDir === 'json') {
+                await saveBufferToOPFS(getFilesPath(filesRoot, 'json', `${transactionId}.json`), bytes);
+            }
+            else {
+                await saveToFiles(bytes);
+            }
+            return;
+        }
+        // No useful Content-Type: sniff. Binary is an image only when it has an image signature.
+        if (!dataString) {
+            if (hasImageSignature(bytes)) {
+                await saveBufferToOPFS(getFilesPath(filesRoot, 'images', transactionId), bytes);
+            }
+            else {
+                await saveToFiles(bytes);
+            }
+            return;
+        }
+        let textType = identifyString(dataString);
+        if (textType !== 'json' &&
+            textType !== 'base64' &&
+            textType !== 'html') {
+            const possibleImageType = getDataTypeFromString(dataString);
+            if (!possibleImageType) {
+                // Plain text / markdown / anything else textual.
+                await saveToFiles(bytes);
+                return;
+            }
+            textType = possibleImageType;
+        }
+        if (textType === 'url') {
+            const url = dataString;
+            // Legacy: an upload whose content is the URL of an image.
+            if (!/\.(jpg|jpeg|png|gif|bmp|webp|svg)$/i.test(url)) {
+                await saveToFiles(bytes);
+                return;
+            }
+            let buffer;
+            try {
+                const response = await fetch(url);
+                if (!response.ok) {
+                    return;
                 }
-                await saveBufferToOPFS(getFilesPath(filesRoot, 'images', fileName), binaryData);
+                buffer = await response.arrayBuffer();
             }
-            if (contentType === 'html') {
-                fileName += '.html';
-                const encoder = new TextEncoder();
-                const buffer = encoder.encode(dataString);
-                await saveBufferToOPFS(getFilesPath(filesRoot, 'html', fileName), buffer);
+            catch (error) {
+                globalThis.postMessage({
+                    message: 'excludeTransaction',
+                    transactionId,
+                });
+                return;
+            }
+            await saveBufferToOPFS(getFilesPath(filesRoot, 'images', transactionId), new Uint8Array(buffer));
+            return;
+        }
+        let fileName = transactionId;
+        if (textType === 'base64') {
+            const mimeType = getMimeType(dataString);
+            const isDataUri = dataString.startsWith('data:');
+            // Remove the Base64 header if it exists (e.g., "data:image/png;base64,")
+            const binaryData = decodeBase64(dataString.split(',').pop() || '');
+            // A data:image URI, or bare base64 that decodes to an image. Anything else is kept as text.
+            const isImage = !!binaryData &&
+                ((isDataUri && !!mimeType && mimeType.startsWith('image/')) || hasImageSignature(binaryData));
+            if (!binaryData || !isImage) {
+                await saveToFiles(bytes);
+                return;
             }
-            if (contentType === 'json') {
-                fileName += '.json';
-                const encoder = new TextEncoder();
-                const buffer = encoder.encode(dataString);
-                await saveBufferToOPFS(getFilesPath(filesRoot, 'json', fileName), buffer);
+            const fileExtension = mimeType && mimeType.startsWith('image/') ? mimeType.replace('image/', '') : mimeType;
+            if (fileExtension) {
+                fileName += `.${fileExtension}`;
             }
+            await saveBufferToOPFS(getFilesPath(filesRoot, 'images', fileName), binaryData);
+        }
+        if (textType === 'html') {
+            fileName += '.html';
+            await saveBufferToOPFS(getFilesPath(filesRoot, 'html', fileName), encoder.encode(dataString));
+        }
+        if (textType === 'json') {
+            fileName += '.json';
+            await saveBufferToOPFS(getFilesPath(filesRoot, 'json', fileName), encoder.encode(dataString));
         }
     };
     onmessage = async (e) => {
-        const { debug, filesRoot } = e.data;
+        const data = (e && e.data) || {};
+        if (data.message === 'verifyContentResult') {
+            const resolve = pendingVerifications.get(data.requestId);
+            pendingVerifications.delete(data.requestId);
+            if (resolve)
+                resolve(!!data.ok);
+            return;
+        }
+        const { debug, filesRoot } = data;
         if (!debug) {
             console.log = () => { };
         }
-        await downloadFiles({ ...e.data, filesRoot });
+        try {
+            await downloadFiles({ ...data, filesRoot });
+        }
+        catch (error) {
+            // Anything not caught per file: tell the page instead of leaving it waiting for `done`.
+            globalThis.postMessage({ message: 'filesDownload failed', error: errorInfo(error) });
+            return;
+        }
         globalThis.postMessage({
             message: 'filesDownload onmessage done',
             done: true,
@@ -410,56 +659,177 @@ var filesDownload = `(
 )()`;
 
 const logger$6 = debug('seedSdk:browser:workers:FileDownloader');
+/**
+ * Longest the worker may go without posting anything before the download is failed. The worker
+ * posts after every transaction and each gateway request times out after 60s, so this only fires
+ * when the worker died without an error event (e.g. killed for memory) or is wedged.
+ */
+const FILE_DOWNLOAD_INACTIVITY_TIMEOUT_MS = 5 * 60000;
+class FileDownloadWorkerError extends Error {
+    constructor(message, options) {
+        super(message);
+        this.name = 'FileDownloadWorkerError';
+        if (options && 'cause' in options)
+            this.cause = options.cause;
+    }
+}
+const toError = (raw, fallback) => {
+    if (raw instanceof Error)
+        return raw;
+    if (raw && typeof raw === 'object' && 'message' in raw) {
+        const error = new FileDownloadWorkerError(String(raw.message));
+        const name = raw.name;
+        if (typeof name === 'string' && name)
+            error.name = name;
+        return error;
+    }
+    return new FileDownloadWorkerError(raw == null ? fallback : String(raw));
+};
 class FileDownloader {
-    constructor() {
-        this.workersArchive = [];
-        this.downloadAll = async ({ transactionIds, arweaveHost, arweaveBaseUrls, excludedTransactions }) => {
-            if (this.workersArchive.length > 0) {
-                for (let i = 0; i < this.workersArchive.length; i++) {
-                    this.workersArchive[i].terminate();
-                    delete this.workersArchive[i];
-                }
-                this.workersArchive = [];
+    constructor(options = {}) {
+        this.options = options;
+        this.downloadAll = async ({ transactionIds, arweaveHost, arweaveBaseUrls, excludedTransactions, expectedContentHashes, compositeChildPaths, }) => {
+            // One download per instance at a time: a newer call replaces the older one, which rejects
+            // instead of waiting forever on a terminated worker.
+            this.abortCurrent?.(new FileDownloadWorkerError('Superseded by a newer download'));
+            const workerBlobUrl = globalThis.URL.createObjectURL(new Blob([filesDownload], { type: 'application/javascript' }));
+            let worker;
+            try {
+                worker = new Worker(workerBlobUrl);
+            }
+            catch (error) {
+                globalThis.URL.revokeObjectURL(workerBlobUrl);
+                throw error;
             }
-            const worker = new Worker(this.workerBlobUrl);
-            this.workersArchive.push(worker);
+            this.worker = worker;
             const localExcludedTransactions = new Set(excludedTransactions);
             const savedPaths = [];
+            const verified = new Set();
+            const hashMismatch = new Set();
+            const failed = new Set();
+            const inactivityTimeoutMs = this.options.inactivityTimeoutMs ?? FILE_DOWNLOAD_INACTIVITY_TIMEOUT_MS;
             return new Promise((resolve, reject) => {
+                let settled = false;
+                let watchdog;
+                const cleanup = () => {
+                    if (watchdog)
+                        clearTimeout(watchdog);
+                    worker.onmessage = null;
+                    worker.onerror = null;
+                    worker.onmessageerror = null;
+                    worker.terminate();
+                    globalThis.URL.revokeObjectURL(workerBlobUrl);
+                    if (this.worker === worker)
+                        this.worker = undefined;
+                    if (this.abortCurrent === fail)
+                        this.abortCurrent = undefined;
+                };
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    logger$6('file download failed', error);
+                    // Files the worker already wrote are on disk: refresh caches for them anyway.
+                    if (savedPaths.length) {
+                        void notifyFilesWrittenOutsideCache(savedPaths).catch(() => { });
+                    }
+                    reject(error);
+                };
+                const succeed = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    cleanup();
+                    addExcludedTransactions(localExcludedTransactions)
+                        // The worker wrote to OPFS directly; refresh caches here and in other tabs.
+                        .then(() => notifyFilesWrittenOutsideCache(savedPaths))
+                        .then(() => resolve({
+                        verifiedTransactionIds: [...verified].filter((id) => !failed.has(id)),
+                        hashMismatchTransactionIds: [...hashMismatch],
+                        failedTransactionIds: [...failed],
+                    }))
+                        .catch(reject);
+                };
+                const armWatchdog = () => {
+                    if (watchdog)
+                        clearTimeout(watchdog);
+                    watchdog = setTimeout(() => fail(new FileDownloadWorkerError(`File download worker sent nothing for ${inactivityTimeoutMs}ms; assuming it stopped`)), inactivityTimeoutMs);
+                };
+                this.abortCurrent = fail;
                 worker.onmessage = (e) => {
-                    logger$6('filesDownload main thread onmessage', e.data);
-                    if (e.data.message === 'excludeTransaction') {
-                        localExcludedTransactions.add(e.data.transactionId);
+                    armWatchdog();
+                    const data = e.data ?? {};
+                    logger$6('filesDownload main thread onmessage', data);
+                    if (data.message === 'excludeTransaction') {
+                        localExcludedTransactions.add(data.transactionId);
+                    }
+                    if (data.message === 'fileSaved') {
+                        savedPaths.push(data.filePath);
                     }
-                    if (e.data.message === 'fileSaved') {
-                        savedPaths.push(e.data.filePath);
+                    if (data.message === 'verifyContent') {
+                        // The worker could not confirm the bytes itself (legacy SHA3-256 tag, or no WebCrypto).
+                        let ok = false;
+                        try {
+                            ok = contentSha256TagMatches(new Uint8Array(data.bytes), String(data.expected ?? ''));
+                        }
+                        catch (error) {
+                            logger$6('content verification failed', error);
+                        }
+                        worker.postMessage({ message: 'verifyContentResult', requestId: data.requestId, ok });
+                        return;
                     }
-                    if (e.data.done) {
-                        addExcludedTransactions(localExcludedTransactions)
-                            // The worker wrote to OPFS directly; refresh caches here and in other tabs.
-                            .then(() => notifyFilesWrittenOutsideCache(savedPaths))
-                            .then(() => {
-                            resolve(e.data);
-                        })
-                            .catch((error) => {
-                            reject(error);
-                        });
+                    if (data.message === 'compositeChildUnrouted') {
+                        // No local ItemStorage property for this child (e.g. its item is not synced yet).
+                        logger$6(`composite ${data.transactionId}: no local path for child "${data.name}"; not saved`);
+                    }
+                    if (data.message === 'contentVerified') {
+                        verified.add(data.transactionId);
+                    }
+                    if (data.message === 'contentHashMismatch') {
+                        hashMismatch.add(data.transactionId);
+                        console.warn(`[FileDownloader] ${data.transactionId}: no gateway served bytes matching its Content-SHA-256 tag; not saved`);
+                    }
+                    if (data.message === 'fileError') {
+                        failed.add(data.transactionId);
+                        // One file failed (e.g. OPFS write); the worker carries on with the rest.
+                        console.warn(`[FileDownloader] failed to save ${data.transactionId}: ${data.error?.name ?? 'Error'}: ${data.error?.message ?? ''}`);
+                    }
+                    if (data.error && data.message !== 'fileError') {
+                        fail(toError(data.error, 'File download worker failed'));
+                        return;
                     }
-                    if (e.data.error) {
-                        reject(e.data.error);
+                    if (data.done) {
+                        succeed();
                     }
                 };
-                worker.postMessage({
-                    transactionIds,
-                    arweaveHost,
-                    arweaveBaseUrls,
-                    debug: logger$6.enabled,
-                    filesRoot: BaseFileManager.getWorkingDir(),
-                });
+                worker.onerror = (event) => {
+                    // Keep it from also surfacing as an uncaught error; the promise carries it.
+                    event.preventDefault?.();
+                    const where = event.filename ? ` (${event.filename}:${event.lineno ?? 0})` : '';
+                    fail(new FileDownloadWorkerError(`File download worker error: ${event.message || 'unknown error'}${where}`, { cause: event.error }));
+                };
+                worker.onmessageerror = () => {
+                    fail(new FileDownloadWorkerError('File download worker sent a message that could not be deserialized'));
+                };
+                armWatchdog();
+                try {
+                    worker.postMessage({
+                        transactionIds,
+                        arweaveHost,
+                        arweaveBaseUrls,
+                        expectedContentHashes,
+                        compositeChildPaths,
+                        debug: logger$6.enabled,
+                        filesRoot: BaseFileManager.getWorkingDir(),
+                    });
+                }
+                catch (error) {
+                    fail(toError(error, 'Could not start the file download worker'));
+                }
             });
         };
         this.cores = Math.min(navigator.hardwareConcurrency || 4, 4);
-        this.workerBlobUrl = globalThis.URL.createObjectURL(new Blob([filesDownload], { type: 'application/javascript' }));
     }
 }
 
@@ -1053,6 +1423,8 @@ function sleep(ms) {
 class BrowserFileManager {
     constructor() {
         this.zenfsCache = null;
+        /** Invalidations run one at a time: two refreshing the same path at once could interleave. */
+        this.invalidations = Promise.resolve();
     }
     async getFs() {
         if (!this.zenfsCache) {
@@ -1075,7 +1447,10 @@ class BrowserFileManager {
     }
     async initializeFileSystem(_workingDir) {
         const zenfs = await this.getFs();
-        const { TolerantWebAccess } = await import('./tolerantWebAccess-B-9bwxbw.js');
+        const { TolerantWebAccess, TolerantWebAccessFS } = await import('./tolerantWebAccess-BZYWt09Y.js');
+        const _mod_0 = await import('./tabEvents-DguZpCCv.js');
+        const _ns_0 = _mod_0._;
+        const { queueFilesChangedNotice } = _ns_0;
         const { configureSingle } = zenfs;
         const configureRoot = async () => {
             const handle = await navigator.storage.getDirectory();
@@ -1090,6 +1465,12 @@ class BrowserFileManager {
         for (let attempt = 0;; attempt++) {
             try {
                 await configureRoot();
+                // Every write through ZenFS (saveFile, saveFileSync, fs.promises / fs.*Sync used directly)
+                // reaches OPFS through this mount: tell other tabs once each change lands, coalesced.
+                const mounted = zenfs.mounts.get('/');
+                if (mounted instanceof TolerantWebAccessFS) {
+                    mounted.onOpfsChange = (path) => queueFilesChangedNotice([path]);
+                }
                 return;
             }
             catch (error) {
@@ -1104,9 +1485,9 @@ class BrowserFileManager {
             }
         }
     }
-    async downloadAllFiles({ transactionIds, arweaveHost, arweaveBaseUrls, excludedTransactions, }) {
+    async downloadAllFiles(params) {
         const fileDownloader = new FileDownloader();
-        await fileDownloader.downloadAll({ transactionIds, arweaveHost, arweaveBaseUrls, excludedTransactions });
+        return fileDownloader.downloadAll(params);
     }
     async resizeImage({ filePath, width, height }) {
         const imageResizer = new ImageResizer();
@@ -1130,12 +1511,17 @@ class BrowserFileManager {
         return entries.filter((entry) => entry.isFile()).map((entry) => entry.name);
     }
     async invalidateCachedPaths(filePaths) {
+        const run = this.invalidations.then(() => this.invalidateNow(filePaths));
+        this.invalidations = run.catch(() => { });
+        return run;
+    }
+    async invalidateNow(filePaths) {
         const { mounts } = await this.getFs();
-        const { TolerantWebAccessFS } = await import('./tolerantWebAccess-B-9bwxbw.js');
+        const { TolerantWebAccessFS } = await import('./tolerantWebAccess-BZYWt09Y.js');
         const mounted = mounts.get('/');
         if (!(mounted instanceof TolerantWebAccessFS))
             return;
-        for (const filePath of filePaths) {
+        for (const filePath of new Set(filePaths)) {
             const absolute = filePath.startsWith('/') ? filePath : `/${filePath}`;
             try {
                 await mounted.invalidate(absolute);
@@ -1350,8 +1736,9 @@ class BrowserFileManager {
         else {
             throw new Error('Unsupported content type');
         }
-        await zenfs.writeFile(filePath, writeContent);
-        await this.waitForFileWithContent(filePath, 100, 5000);
+        // The promise API: zenfs.writeFile is the Node callback API, which returns before the write
+        // lands, so a read right after saveFile could see the previous content.
+        await zenfs.promises.writeFile(filePath, writeContent);
         // try {
         //   // Get a handle to the OPFS root directory
         //   const root = await navigator.storage.getDirectory();
@@ -1530,6 +1917,7 @@ class CancelableInterval {
     }
 }
 BaseFileManager.configure(new BrowserFileManager());
+new BrowserFileManager();
 
 // This file embeds the drizzle migration files as strings for browser runtime
 // These files are copied from packages/sdk/src/db/drizzle at build time
@@ -3668,10 +4056,10 @@ class BrowserDb {
             await raceSqlocalStartup((async () => {
                 await this.runMigrations(db);
                 this.appDb = db;
-                const { backfillMetadataPropertyIds } = await import('./backfillMetadataPropertyIds-Ck6fumnm.js');
+                const { backfillMetadataPropertyIds } = await import('./backfillMetadataPropertyIds-SXW-8C64.js');
                 await backfillMetadataPropertyIds();
                 // One-time: clear item data whose model can't be determined (seeds.model_file_id, migration 0015)
-                const { resetAmbiguousLegacyItemData } = await import('./resetAmbiguousLegacyItemData-Ci6PM_vC.js');
+                const { resetAmbiguousLegacyItemData } = await import('./resetAmbiguousLegacyItemData-Bk0QyDW8.js');
                 await resetAmbiguousLegacyItemData();
             })(), workerFailed);
             return this.appDb;
@@ -4136,4 +4524,4 @@ function createPlatformServices() {
 }
 
 export { createPlatformServices as c, isSkippableOpfsEntryError as i };
-//# sourceMappingURL=index.browser-DO20vYuP.js.map
+//# sourceMappingURL=index.browser-Cm06tP4X.js.map