tempest-react-sdk 0.80.0 → 0.82.0

package/dist/sw/background-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"background-sync.js","names":["getSwScope","DEFAULT_QUEUE_NAME","DB_VERSION","STORE","META","EPOCH_KEY","BACKGROUND_SYNC_CREDENTIALS_MESSAGE","CREDENTIALS_TIMEOUT_MS","OWNER_STAMP_GRACE_MS","splitHeaders","kept","stripped","name","value","headers","credentialHeaders","migrateLegacyEntries","cursorRequest","store","cursor","entry","openQueueDb","credentialHeaderSet","request","db","event","resolve","reject","txDone","tx","readEpoch","get","enqueue","id","current","epoch","add","stampOwner","ownerState","owner","readAll","all","req","stillQueued","count","remove","serializeRequest","buffer","deserializeRequest","askClient","channel","answer","client","deadline","hasPrincipal","startDeadline","timer","askAllClients","clients","sw","answers","createReplayRun","warned","key","pending","isDevBuild","chooseAnswer","context","defaultBeforeReplay","credentialed","unchecked","ownerPolicy","run","chosen","provided","replayQueue","config","prepare","beforeReplay","entries","now","maxRetentionMs","state","stored","response","replaysInFlight","drainQueue","running","pass","matches","match","url","stampFromIssuer","issuer","installBackgroundSync","options","DEFAULT_CREDENTIAL_HEADERS","replay","queueName","maxRetentionMinutes","attempt","queued","error","stamp","periodicSyncTag","clearBackgroundSyncQueue","meta","ownerFingerprint","principal","digest","byte","provideBackgroundSyncCredentials","container","onMessage","data","port","getHeaders","getPrincipal"],"sources":["../../src/sw/background-sync.ts"],"sourcesContent":["/**\n * Background-sync helper: queue failed mutating requests (POST/PUT/PATCH/DELETE)\n * while offline and replay them when connectivity returns. A dependency-free\n * take on Workbox's `BackgroundSyncPlugin`, backed by a tiny IndexedDB queue.\n *\n * Import inside your `sw.ts`. Uses the Background Sync API (`registration.sync`)\n * when available, and also replays opportunistically on the next request as a\n * fallback for browsers without it (e.g. Safari).\n *\n * Credential headers (`Authorization` and the rest of\n * {@link DEFAULT_CREDENTIAL_HEADERS}) are never written to IndexedDB: the queue\n * outlives the session, and a stored bearer stayed readable after logout and was\n * replayed with the old identity (reproduced in Chromium 153, 11/10/2026). On\n * replay the worker asks the open pages for the *current* credentials — see\n * {@link provideBackgroundSyncCredentials} — or a custom `beforeReplay` hook.\n * Credentials carried in the URL or the body are out of reach and are stored\n * as sent.\n *\n * @example\n *   import { installBackgroundSync } from \"tempest-react-sdk/sw\";\n *\n *   installBackgroundSync({ match: (url) => url.pathname.startsWith(\"/api/\") });\n */\nimport { isDevBuild } from \"../utils/dev-mode\";\nimport { DEFAULT_CREDENTIAL_HEADERS, credentialHeaderSet } from \"./credential-headers\";\n\ninterface SyncEventLike {\n    tag: string;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface BgFetchEventLike {\n    request: Request;\n    /** Id of the window client that issued the request, when there is one. */\n    clientId?: string;\n    respondWith(response: Response | Promise<Response>): void;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface PeriodicSyncEventLike {\n    tag: string;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\n/** Minimal shape of a window client the worker can message. */\ninterface WindowClientLike {\n    postMessage(message: unknown, transfer: Transferable[]): void;\n}\n\ninterface BgSwGlobal {\n    registration: { sync?: { register(tag: string): Promise<void> } };\n    clients?: {\n        matchAll(options: { type: \"window\" }): Promise<readonly WindowClientLike[]>;\n        get(id: string): Promise<WindowClientLike | undefined>;\n    };\n    addEventListener(type: \"sync\", listener: (event: SyncEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: BgFetchEventLike) => void): void;\n    addEventListener(type: \"periodicsync\", listener: (event: PeriodicSyncEventLike) => void): void;\n}\n\nfunction getSwScope(): BgSwGlobal {\n    return globalThis as unknown as BgSwGlobal;\n}\n\n/**\n * How an entry is tied to whoever queued it:\n * - `\"bound\"`: the issuing page reported a principal (or `null` for nobody);\n *   the entry only goes out while the same one is signed in.\n * - `\"unbound\"`: the issuing page answered without `getPrincipal`.\n * - `\"unknown\"`: nobody could say — no issuing tab, no answer, an error, or an\n *   entry written before owners existed. Fails closed, with or without stripped\n *   credentials: a cookie session rides along on the replay, so an entry with no\n *   credential header is checked like any other.\n *\n * While the worker is still asking, the stored state is `\"pending\"`, which a\n * replay never sees: it waits, then reads a stamp that never came as `\"unknown\"`.\n */\nexport type BackgroundSyncOwnerState = \"bound\" | \"unbound\" | \"unknown\";\n\n/**\n * How the default `beforeReplay` treats an `\"unknown\"` owner on an entry that\n * carried no credential header:\n * - `\"strict\"` (default): it asks the open pages like any other entry — replayed\n *   only when every answer lacks a principal, dropped as soon as one answer has\n *   one, pending while nobody answers.\n * - `\"lenient\"`: it is replayed as-is, without asking (the behavior up to 0.77.0).\n *\n * An entry with stripped credentials always asks, under either policy.\n */\nexport type BackgroundSyncOwnerPolicy = \"strict\" | \"lenient\";\n\n/** A serialized request stored in the queue. */\ninterface QueuedRequest {\n    id?: number;\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body: ArrayBuffer | null;\n    timestamp: number;\n    /** The original `credentials` mode, so cookie-based APIs replay with cookies. */\n    credentials?: RequestCredentials;\n    /** Lower-cased names of the credential headers removed before persisting. */\n    strippedHeaders?: string[];\n    /** Absent on entries written before 0.77 — read as `\"unknown\"`. */\n    ownerState?: BackgroundSyncOwnerState | \"pending\";\n    /** Fingerprint of the principal under `\"bound\"`; `null` for \"nobody signed in\". */\n    owner?: string | null;\n}\n\n/** Default IndexedDB database name (and sync tag) of the background-sync queue. */\nconst DEFAULT_QUEUE_NAME = \"tempest-bg-sync\";\n\n/**\n * Schema version of the queue database. Version 2 adds the `meta` store (the\n * clear epoch) and migrates version-1 entries, scrubbing their plaintext\n * credential headers on first open.\n */\nconst DB_VERSION = 2;\nconst STORE = \"requests\";\nconst META = \"meta\";\nconst EPOCH_KEY = \"epoch\";\n\n/**\n * `type` of the message the worker posts to window clients to ask about a queued\n * request. Answered by {@link provideBackgroundSyncCredentials}.\n */\nexport const BACKGROUND_SYNC_CREDENTIALS_MESSAGE = \"tempest:bg-sync-credentials\";\n\n/** How long the worker waits for the window clients to answer, in milliseconds. */\nconst CREDENTIALS_TIMEOUT_MS = 3000;\n\n/**\n * How long a replay waits on an entry whose owner is still being stamped. Past\n * it (the worker died mid-question), the owner is read as `\"unknown\"`.\n */\nconst OWNER_STAMP_GRACE_MS = CREDENTIALS_TIMEOUT_MS * 2;\n\n/** What a queued request looked like when it was stored, passed to `beforeReplay`. */\nexport interface BackgroundSyncReplayContext {\n    /** Epoch milliseconds of the original failed attempt. */\n    queuedAt: number;\n    /** Lower-cased credential header names stripped before the entry was stored. */\n    strippedHeaders: readonly string[];\n    /** How the entry is tied to its owner. */\n    ownerState: BackgroundSyncOwnerState;\n    /** Owner fingerprint under `\"bound\"` (`null` for nobody); `undefined` otherwise. */\n    owner: string | null | undefined;\n}\n\n/** The request a window client is asked about, as sent by the worker. */\nexport interface BackgroundSyncCredentialsRequest {\n    /** Absolute URL of the queued request. */\n    url: string;\n    /** HTTP method of the queued request. */\n    method: string;\n    /**\n     * `\"enqueue\"` when the worker only wants the owner of a request that just\n     * failed; `\"replay\"` when it is about to send it and needs the credentials.\n     */\n    phase: \"enqueue\" | \"replay\";\n}\n\n/**\n * Resolve the credentials for a queued request: a header record to apply, or\n * `null` when there is no session (the entry is then dropped).\n */\nexport type BackgroundSyncCredentialsProvider = (\n    request: BackgroundSyncCredentialsRequest,\n) => Record<string, string> | null | Promise<Record<string, string> | null>;\n\n/** Options for {@link provideBackgroundSyncCredentials}. */\nexport interface ProvideBackgroundSyncCredentialsOptions {\n    /**\n     * Who is signed in right now — a stable, non-secret id such as the user id;\n     * `null`/`undefined` when nobody is. Read when a request is queued and again\n     * when it is replayed: an entry is only sent while the same principal is\n     * signed in, and dropped otherwise, so a mutation queued by one account is\n     * never sent with another account's credentials even when the app forgets\n     * `clearSessionData()` on logout. Only a SHA-256 fingerprint reaches the\n     * queue, never the value itself. A throw is answered as an explicit error,\n     * which leaves the owner unknown (fail closed).\n     */\n    getPrincipal?: () => string | null | undefined | Promise<string | null | undefined>;\n}\n\n/** Options for {@link installBackgroundSync}. */\nexport interface InstallBackgroundSyncOptions {\n    /**\n     * Which requests to queue on failure. A `RegExp` against the URL or a\n     * predicate. Only non-`GET` requests are ever considered. Default: all\n     * non-`GET` requests.\n     */\n    match?: RegExp | ((url: URL, request: Request) => boolean);\n    /** IndexedDB database name, also used as the sync tag. Default `tempest-bg-sync`. */\n    queueName?: string;\n    /** Drop queued requests older than this (minutes) on replay. Default `1440` (24h). */\n    maxRetentionMinutes?: number;\n    /**\n     * Also drain the queue on the `periodicsync` event carrying this tag,\n     * complementing the one-off `sync` replay so long-pending mutations retry\n     * even without a fresh navigation. Register the periodic sync from the main\n     * thread with {@link registerPeriodicSync}. Default `${queueName}-periodic`.\n     */\n    periodicSyncTag?: string;\n    /**\n     * Header names stripped before a request is persisted — and stripped again on\n     * replay, so entries written by an older version never go out with the\n     * credential they stored. Default {@link DEFAULT_CREDENTIAL_HEADERS}; extend it\n     * for a custom credential header (`[...DEFAULT_CREDENTIAL_HEADERS,\n     * \"x-tenant-key\"]`). Passing `[]` restores the pre-0.77 behavior of\n     * persisting and replaying every header, credentials included.\n     */\n    credentialHeaders?: readonly string[];\n    /**\n     * Prepare each queued request right before it is replayed: return the\n     * request to send (typically with the current credentials applied) or\n     * `null` to drop the entry for good. A thrown error keeps the entry pending.\n     * The context carries the entry's owner, so a custom hook can apply the\n     * same rule as the default.\n     *\n     * Default: only an `\"unbound\"` entry with no stripped credentials (and, under\n     * `ownerPolicy: \"lenient\"`, an `\"unknown\"` one) is replayed as-is, without\n     * asking. Every other entry — credentialed or not —\n     * asks every open window client in parallel (see\n     * {@link provideBackgroundSyncCredentials}) and picks the answer that fits:\n     * - `\"bound\"`: the answer whose owner matches; none among valid answers →\n     *   dropped, never sent anonymously or as somebody else;\n     * - `\"unknown\"`: only when every answer lacks a principal (an app that does\n     *   not use `getPrincipal`); a single answer with one → dropped, since a\n     *   stale tab without `getPrincipal` says nothing about who is signed in\n     *   next to it. This holds for an entry\n     *   with no credential header too, since the browser attaches the cookies of\n     *   whoever is signed in at replay time;\n     * - `\"unbound\"`: any answer, preferring one without a principal.\n     * Then `null` headers drop a credentialed entry, an answer that lacks one of\n     * the stripped headers keeps it pending, and only the stripped names are\n     * re-applied. No valid answer at all keeps it pending until\n     * `maxRetentionMinutes` (and warns once per replay in development builds) —\n     * so a page that never calls {@link provideBackgroundSyncCredentials} leaves\n     * every entry it queued `\"unknown\"`, and none of them is replayed.\n     */\n    /**\n     * How an `\"unknown\"` owner is handled on an entry with no stripped\n     * credentials (see {@link BackgroundSyncOwnerPolicy}). Default `\"strict\"`.\n     *\n     * `\"lenient\"` restores the replay-as-is of 0.77.0 and earlier for an app without sign-in,\n     * where no page ever reports a principal. Do not use it with a cookie\n     * session: the browser attaches on replay the cookie of whoever is signed in\n     * at that moment, so a mutation queued by A whose owner was never stamped\n     * (issuing tab closed, empty `clientId`, stamp lost, legacy entry) goes out\n     * with B's session. Entries with stripped credentials ask the pages either\n     * way. Ignored when a custom `beforeReplay` is given.\n     */\n    ownerPolicy?: BackgroundSyncOwnerPolicy;\n    beforeReplay?: (\n        request: Request,\n        context: BackgroundSyncReplayContext,\n    ) => Request | null | Promise<Request | null>;\n}\n\n/**\n * Move credential headers out of a header list.\n *\n * @returns The remaining headers and the lower-cased names removed.\n */\nfunction splitHeaders(\n    headers: Iterable<[string, string]>,\n    credentialHeaders: ReadonlySet<string>,\n): { kept: [string, string][]; stripped: string[] } {\n    const kept: [string, string][] = [];\n    const stripped: string[] = [];\n    for (const [name, value] of headers) {\n        if (credentialHeaders.has(name.toLowerCase())) stripped.push(name.toLowerCase());\n        else kept.push([name, value]);\n    }\n    return { kept, stripped };\n}\n\n/**\n * Scrub version-1 entries during the upgrade: their credential headers were\n * stored in plaintext, so they are removed from disk on the first open, recorded\n * as stripped, and the owner is marked unknown.\n */\nfunction migrateLegacyEntries(store: IDBObjectStore, credentialHeaders: ReadonlySet<string>): void {\n    const cursorRequest = store.openCursor();\n    cursorRequest.onsuccess = () => {\n        const cursor = cursorRequest.result;\n        if (!cursor) return;\n        const entry = cursor.value as QueuedRequest;\n        const { kept, stripped } = splitHeaders(entry.headers, credentialHeaders);\n        cursor.update({\n            ...entry,\n            headers: kept,\n            strippedHeaders: [...new Set([...(entry.strippedHeaders ?? []), ...stripped])],\n            ownerState: entry.ownerState ?? \"unknown\",\n        });\n        cursor.continue();\n    };\n}\n\nfunction openQueueDb(\n    name: string,\n    credentialHeaders: ReadonlySet<string> = credentialHeaderSet(),\n): Promise<IDBDatabase> {\n    return new Promise((resolve, reject) => {\n        const request = indexedDB.open(name, DB_VERSION);\n        request.onupgradeneeded = (event) => {\n            const db = request.result;\n            if (!db.objectStoreNames.contains(STORE)) {\n                db.createObjectStore(STORE, { keyPath: \"id\", autoIncrement: true });\n            } else if (event.oldVersion < 2 && request.transaction) {\n                migrateLegacyEntries(request.transaction.objectStore(STORE), credentialHeaders);\n            }\n            if (!db.objectStoreNames.contains(META)) db.createObjectStore(META);\n        };\n        request.onsuccess = () => {\n            const db = request.result;\n            db.onversionchange = () => db.close();\n            resolve(db);\n        };\n        request.onerror = () => reject(request.error);\n    });\n}\n\nfunction txDone(tx: IDBTransaction): Promise<void> {\n    return new Promise((resolve, reject) => {\n        tx.oncomplete = () => resolve();\n        tx.onerror = () => reject(tx.error);\n        tx.onabort = () => reject(tx.error);\n    });\n}\n\n/** The current clear epoch: bumped by every {@link clearBackgroundSyncQueue}. */\nasync function readEpoch(name: string, credentialHeaders: ReadonlySet<string>): Promise<number> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction(META, \"readonly\");\n    const get = tx.objectStore(META).get(EPOCH_KEY);\n    await txDone(tx);\n    db.close();\n    return (get.result as number | undefined) ?? 0;\n}\n\n/**\n * Add an entry unless the queue was cleared since `epoch` was read — checked in\n * the same transaction as the write, so a logout that lands while the request\n * is still failing never lets it into the next session's queue.\n *\n * @returns The new entry's key, or `undefined` when the clear won.\n */\nasync function enqueue(\n    name: string,\n    entry: QueuedRequest,\n    epoch: number,\n    credentialHeaders: ReadonlySet<string>,\n): Promise<number | undefined> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction([STORE, META], \"readwrite\");\n    let id: number | undefined;\n    const current = tx.objectStore(META).get(EPOCH_KEY);\n    current.onsuccess = () => {\n        if (((current.result as number | undefined) ?? 0) !== epoch) return;\n        const add = tx.objectStore(STORE).add(entry);\n        add.onsuccess = () => {\n            id = add.result as number;\n        };\n    };\n    await txDone(tx);\n    db.close();\n    return id;\n}\n\n/**\n * Record how an entry is owned. A no-op when the entry is already gone\n * (replayed, or the queue was cleared).\n */\nasync function stampOwner(\n    name: string,\n    id: number,\n    ownerState: BackgroundSyncOwnerState,\n    owner: string | null | undefined,\n): Promise<void> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readwrite\");\n    const store = tx.objectStore(STORE);\n    const get = store.get(id);\n    get.onsuccess = () => {\n        const entry = get.result as QueuedRequest | undefined;\n        if (!entry) return;\n        entry.ownerState = ownerState;\n        if (ownerState === \"bound\") entry.owner = owner ?? null;\n        store.put(entry);\n    };\n    await txDone(tx);\n    db.close();\n}\n\nasync function readAll(\n    name: string,\n    credentialHeaders: ReadonlySet<string>,\n): Promise<QueuedRequest[]> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction(STORE, \"readonly\");\n    const all = await new Promise<QueuedRequest[]>((resolve, reject) => {\n        const req = tx.objectStore(STORE).getAll();\n        req.onsuccess = () => resolve(req.result as QueuedRequest[]);\n        req.onerror = () => reject(req.error);\n    });\n    db.close();\n    return all;\n}\n\n/** Whether an entry is still in the queue — `false` once it was cleared. */\nasync function stillQueued(name: string, id: number): Promise<boolean> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readonly\");\n    const count = tx.objectStore(STORE).count(id);\n    await txDone(tx);\n    db.close();\n    return count.result > 0;\n}\n\nasync function remove(name: string, id: number): Promise<void> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readwrite\");\n    tx.objectStore(STORE).delete(id);\n    await txDone(tx);\n    db.close();\n}\n\n/**\n * Serialize a request for the queue, leaving out every credential header and\n * recording which ones were present.\n */\nasync function serializeRequest(\n    request: Request,\n    timestamp: number,\n    credentialHeaders: ReadonlySet<string>,\n    ownerState: QueuedRequest[\"ownerState\"],\n): Promise<QueuedRequest> {\n    const buffer = await request.clone().arrayBuffer();\n    const { kept, stripped } = splitHeaders(request.headers.entries(), credentialHeaders);\n    return {\n        url: request.url,\n        method: request.method,\n        headers: kept,\n        body: buffer.byteLength > 0 ? buffer : null,\n        timestamp,\n        credentials: request.credentials,\n        strippedHeaders: stripped,\n        ownerState,\n    };\n}\n\n/**\n * Rebuild a stored request, stripping credential headers once more so an entry\n * that still holds one (a custom `credentialHeaders` the migration did not know)\n * never replays it.\n */\nfunction deserializeRequest(\n    entry: QueuedRequest,\n    credentialHeaders: ReadonlySet<string>,\n): { request: Request; strippedHeaders: string[] } {\n    const { kept, stripped } = splitHeaders(entry.headers, credentialHeaders);\n    return {\n        request: new Request(entry.url, {\n            method: entry.method,\n            headers: kept,\n            body: entry.body ?? undefined,\n            credentials: entry.credentials,\n        }),\n        strippedHeaders: [...new Set([...(entry.strippedHeaders ?? []), ...stripped])],\n    };\n}\n\n/** A window client's parsed answer. */\ninterface ClientAnswer {\n    headers: Record<string, string> | null;\n    /** Whether the page has `getPrincipal`. */\n    hasPrincipal: boolean;\n    owner: string | null;\n}\n\n/**\n * Ask one window client about a queued request over a `MessageChannel`.\n *\n * @returns The parsed answer, or `undefined` when the client stayed silent until\n *   `deadline`, answered `{ error: true }`, or answered something unrecognizable.\n */\nasync function askClient(\n    client: WindowClientLike,\n    request: BackgroundSyncCredentialsRequest,\n    deadline: Promise<void>,\n): Promise<ClientAnswer | undefined> {\n    const channel = new MessageChannel();\n    const answer = await Promise.race([\n        new Promise<unknown>((resolve) => {\n            channel.port1.onmessage = (event: MessageEvent) => resolve(event.data);\n            client.postMessage({ type: BACKGROUND_SYNC_CREDENTIALS_MESSAGE, ...request }, [\n                channel.port2,\n            ]);\n        }),\n        deadline.then(() => undefined),\n    ]);\n    channel.port1.close();\n    if (answer === null || typeof answer !== \"object\" || !(\"headers\" in answer)) return undefined;\n    const { headers, owner } = answer as { headers: unknown; owner?: unknown };\n    const hasPrincipal = \"owner\" in answer;\n    if (hasPrincipal && typeof owner !== \"string\" && owner !== null) return undefined;\n    return {\n        headers:\n            headers !== null && typeof headers === \"object\"\n                ? (headers as Record<string, string>)\n                : null,\n        hasPrincipal,\n        owner: hasPrincipal ? (owner as string | null) : null,\n    };\n}\n\n/** A deadline shared by every client asked in one round. */\nfunction startDeadline(): { promise: Promise<void>; cancel: () => void } {\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const promise = new Promise<void>((resolve) => {\n        timer = setTimeout(resolve, CREDENTIALS_TIMEOUT_MS);\n    });\n    return { promise, cancel: () => clearTimeout(timer) };\n}\n\n/**\n * Ask every open window client in parallel, under one shared deadline.\n *\n * @returns Every valid answer; empty when nobody answered.\n */\nasync function askAllClients(\n    sw: BgSwGlobal,\n    request: BackgroundSyncCredentialsRequest,\n): Promise<ClientAnswer[]> {\n    const clients = (await sw.clients?.matchAll({ type: \"window\" })) ?? [];\n    if (clients.length === 0) return [];\n    const deadline = startDeadline();\n    const answers = await Promise.all(\n        clients.map((client) => askClient(client, request, deadline.promise)),\n    );\n    deadline.cancel();\n    return answers.filter((answer): answer is ClientAnswer => answer !== undefined);\n}\n\n/** State of one replay pass: answers cached per URL + method, and the warning flag. */\ninterface ReplayRun {\n    ask(request: Request): Promise<ClientAnswer[]>;\n    warnNoAnswer(): void;\n}\n\nfunction createReplayRun(sw: BgSwGlobal): ReplayRun {\n    const answers = new Map<string, Promise<ClientAnswer[]>>();\n    let warned = false;\n    return {\n        ask(request) {\n            const key = `${request.method} ${request.url}`;\n            let pending = answers.get(key);\n            if (!pending) {\n                pending = askAllClients(sw, {\n                    url: request.url,\n                    method: request.method,\n                    phase: \"replay\",\n                });\n                answers.set(key, pending);\n            }\n            return pending;\n        },\n        warnNoAnswer() {\n            if (warned || !isDevBuild()) return;\n            warned = true;\n            console.warn(\n                \"[tempest-react-sdk/sw] background-sync: a queued request needs an open page \" +\n                    \"to confirm who is signed in or to supply the current credentials, and no \" +\n                    \"open page answered. Call \" +\n                    \"provideBackgroundSyncCredentials() in the page; the entry stays pending.\",\n            );\n        },\n    };\n}\n\n/**\n * Pick the answer an entry may be replayed with, per its owner state.\n *\n * An `\"unknown\"` owner replays only when every valid answer lacks a principal:\n * one tab reporting a principal (even `null`) is enough to drop it, because a\n * principal-less answer — say a tab still running a bundle from before the app\n * adopted `getPrincipal` — says nothing about whose cookie the replay carries.\n */\nfunction chooseAnswer(\n    answers: readonly ClientAnswer[],\n    context: BackgroundSyncReplayContext,\n): ClientAnswer | undefined {\n    switch (context.ownerState) {\n        case \"bound\":\n            return answers.find((answer) => answer.hasPrincipal && answer.owner === context.owner);\n        case \"unknown\":\n            return answers.every((answer) => !answer.hasPrincipal) ? answers[0] : undefined;\n        case \"unbound\":\n            return answers.find((answer) => !answer.hasPrincipal) ?? answers[0];\n    }\n}\n\n/**\n * The default `beforeReplay` (rules on {@link InstallBackgroundSyncOptions}).\n *\n * @throws {Error} When no page answered, or the chosen answer lacks a stripped\n *   header — the entry stays pending.\n */\nasync function defaultBeforeReplay(\n    run: ReplayRun,\n    request: Request,\n    context: BackgroundSyncReplayContext,\n    ownerPolicy: BackgroundSyncOwnerPolicy,\n): Promise<Request | null> {\n    const credentialed = context.strippedHeaders.length > 0;\n    const unchecked =\n        context.ownerState === \"unbound\" ||\n        (ownerPolicy === \"lenient\" && context.ownerState === \"unknown\");\n    if (!credentialed && unchecked) return request;\n    const answers = await run.ask(request);\n    if (answers.length === 0) {\n        run.warnNoAnswer();\n        throw new Error(\"background-sync: no client answered\");\n    }\n    const chosen = chooseAnswer(answers, context);\n    if (!chosen) return null;\n    if (!credentialed) return request;\n    if (chosen.headers === null) return null;\n    const provided = new Map(\n        Object.entries(chosen.headers).map(([name, value]) => [name.toLowerCase(), value]),\n    );\n    if (context.strippedHeaders.some((name) => !provided.has(name))) {\n        throw new Error(\"background-sync: the answer lacks a stripped credential header\");\n    }\n    const headers = new Headers(request.headers);\n    for (const name of context.strippedHeaders) headers.set(name, provided.get(name) as string);\n    return new Request(request, { headers });\n}\n\n/** Everything {@link replayQueue} needs besides the clock. */\ninterface ReplayConfig {\n    sw: BgSwGlobal;\n    name: string;\n    maxRetentionMs: number;\n    credentialHeaders: ReadonlySet<string>;\n    beforeReplay?: InstallBackgroundSyncOptions[\"beforeReplay\"];\n    ownerPolicy: BackgroundSyncOwnerPolicy;\n}\n\n/**\n * Replay every queued request once. Entries that succeed, are stale, get a 4xx\n * (a client error that will not fix itself) or that the preparation rejects with\n * `null` are removed; entries that fail again — network error, 5xx, or a\n * preparation that throws — are kept, and so is an entry whose owner is still\n * being stamped (for up to {@link OWNER_STAMP_GRACE_MS}). Each entry is checked\n * against the store right before it is sent, so a queue cleared mid-replay stops\n * the replay. Throws if any entry is still pending, so a `sync` handler keeps\n * the sync registered.\n */\nasync function replayQueue(config: ReplayConfig, now: number): Promise<void> {\n    const { sw, name, maxRetentionMs, credentialHeaders, beforeReplay, ownerPolicy } = config;\n    const run = createReplayRun(sw);\n    const prepare =\n        beforeReplay ??\n        ((request: Request, context: BackgroundSyncReplayContext) =>\n            defaultBeforeReplay(run, request, context, ownerPolicy));\n    const entries = await readAll(name, credentialHeaders);\n    let pending = 0;\n\n    for (const entry of entries) {\n        if (entry.id === undefined) continue;\n        if (now - entry.timestamp > maxRetentionMs) {\n            await remove(name, entry.id);\n            continue;\n        }\n        const state = entry.ownerState ?? \"unknown\";\n        if (state === \"pending\" && now - entry.timestamp < OWNER_STAMP_GRACE_MS) {\n            pending += 1;\n            continue;\n        }\n        const ownerState: BackgroundSyncOwnerState = state === \"pending\" ? \"unknown\" : state;\n        try {\n            const { request: stored, strippedHeaders } = deserializeRequest(\n                entry,\n                credentialHeaders,\n            );\n            const request = await prepare(stored, {\n                queuedAt: entry.timestamp,\n                strippedHeaders,\n                ownerState,\n                owner: ownerState === \"bound\" ? (entry.owner ?? null) : undefined,\n            });\n            if (!(await stillQueued(name, entry.id))) continue;\n            if (request === null) {\n                await remove(name, entry.id);\n                continue;\n            }\n            const response = await fetch(request);\n            if (response.ok || (response.status >= 400 && response.status < 500)) {\n                await remove(name, entry.id);\n            } else {\n                pending += 1;\n            }\n        } catch {\n            pending += 1;\n        }\n    }\n\n    if (pending > 0) throw new Error(`background-sync: ${pending} request(s) still pending`);\n}\n\n/**\n * The replay in flight per queue. `sync`, `periodicsync` and the Safari fallback\n * can fire together; sharing one pass keeps a mutation from being sent twice.\n */\nconst replaysInFlight = new Map<string, Promise<void>>();\n\nfunction drainQueue(config: ReplayConfig): Promise<void> {\n    const running = replaysInFlight.get(config.name);\n    if (running) return running;\n    const pass = replayQueue(config, Date.now()).finally(() => {\n        replaysInFlight.delete(config.name);\n    });\n    replaysInFlight.set(config.name, pass);\n    return pass;\n}\n\nfunction matches(\n    match: InstallBackgroundSyncOptions[\"match\"],\n    url: URL,\n    request: Request,\n): boolean {\n    if (!match) return true;\n    return typeof match === \"function\" ? match(url, request) : match.test(url.href);\n}\n\n/**\n * Ask the issuing page who owns a just-queued entry and record it.\n *\n * @returns Resolves once the owner is stamped; never rejects.\n */\nasync function stampFromIssuer(\n    name: string,\n    id: number,\n    issuer: WindowClientLike,\n    request: Request,\n): Promise<void> {\n    const deadline = startDeadline();\n    const answer = await askClient(\n        issuer,\n        { url: request.url, method: request.method, phase: \"enqueue\" },\n        deadline.promise,\n    );\n    deadline.cancel();\n    const state: BackgroundSyncOwnerState = !answer\n        ? \"unknown\"\n        : answer.hasPrincipal\n          ? \"bound\"\n          : \"unbound\";\n    await stampOwner(name, id, state, answer?.owner);\n}\n\n/**\n * Install the background-sync queue: on a failed mutating request, the request\n * is serialized to IndexedDB (without its credential headers) and a sync is\n * registered; the original fetch still rejects (so your app can show an offline\n * state), and the request is replayed later when the network returns.\n *\n * Right after queueing, the worker asks the page that issued the request who is\n * signed in (`getPrincipal` on {@link provideBackgroundSyncCredentials}) and\n * stamps the entry with that owner, without delaying the rejection. The work is\n * handed to `event.waitUntil` synchronously, so the worker stays alive for it\n * in every engine. Without the Background Sync API (every non-Chromium\n * browser), the queue is drained opportunistically whenever a `GET` goes\n * through the worker.\n *\n * @tempest-limits empty-catch — `registration.sync.register` is unavailable on\n * every non-Chromium browser and fails on a revoked background-sync permission.\n * The entry is already durable in IndexedDB at that point, and the queue is also\n * drained opportunistically on the next successful request, so losing the OS-level\n * wakeup degrades *when* the replay happens, not *whether* it happens.\n */\nexport function installBackgroundSync(options: InstallBackgroundSyncOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        match,\n        queueName = DEFAULT_QUEUE_NAME,\n        maxRetentionMinutes = 1440,\n        periodicSyncTag = `${options.queueName ?? DEFAULT_QUEUE_NAME}-periodic`,\n        credentialHeaders = DEFAULT_CREDENTIAL_HEADERS,\n        beforeReplay,\n        ownerPolicy = \"strict\",\n    } = options;\n    const stripped = credentialHeaderSet(credentialHeaders);\n    const replay: ReplayConfig = {\n        sw,\n        name: queueName,\n        maxRetentionMs: maxRetentionMinutes * 60 * 1000,\n        credentialHeaders: stripped,\n        beforeReplay,\n        ownerPolicy,\n    };\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method === \"GET\" || request.method === \"HEAD\") return;\n\n        const url = new URL(request.url);\n        if (!matches(match, url, request)) return;\n\n        const epoch = readEpoch(queueName, stripped);\n        epoch.catch(() => undefined);\n        const attempt = fetch(request.clone());\n        const queued = attempt.then(\n            () => undefined,\n            async () => {\n                const issuer = event.clientId ? await sw.clients?.get(event.clientId) : undefined;\n                const entry = await serializeRequest(\n                    request,\n                    Date.now(),\n                    stripped,\n                    issuer ? \"pending\" : \"unknown\",\n                );\n                const id = await enqueue(queueName, entry, await epoch, stripped);\n                if (id === undefined) return undefined;\n                try {\n                    await sw.registration.sync?.register(queueName);\n                } catch {\n                    /* empty */\n                }\n                return issuer ? { id, issuer } : undefined;\n            },\n        );\n        event.respondWith(\n            attempt.catch(async (error: unknown) => {\n                await queued;\n                throw error;\n            }),\n        );\n        event.waitUntil(\n            queued\n                .then((stamp) =>\n                    stamp ? stampFromIssuer(queueName, stamp.id, stamp.issuer, request) : undefined,\n                )\n                .catch(() => undefined),\n        );\n    });\n\n    sw.addEventListener(\"sync\", (event) => {\n        if (event.tag !== queueName) return;\n        event.waitUntil(drainQueue(replay));\n    });\n\n    sw.addEventListener(\"periodicsync\", (event) => {\n        if (event.tag !== periodicSyncTag) return;\n        event.waitUntil(drainQueue(replay).catch(() => undefined));\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        if (sw.registration.sync) return;\n        if (event.request.method !== \"GET\") return;\n        event.waitUntil(drainQueue(replay).catch(() => undefined));\n    });\n}\n\n/**\n * Empty the background-sync queue — every request still waiting to be replayed —\n * and bump its clear epoch. Call it on logout (or use `clearSessionData()`, which\n * also clears the runtime caches) so mutations made under one session are never\n * replayed under the next.\n *\n * Works from the page and from the worker, and reaches work already in flight\n * in the worker: a replay checks each entry right before sending it, and a\n * request still failing when the queue is cleared is not written afterwards.\n *\n * @param queueName - The `queueName` given to {@link installBackgroundSync}.\n *   Default `tempest-bg-sync`.\n * @returns `true` once the queue is empty; `false` when IndexedDB is\n *   unavailable (SSR, old browsers).\n *\n * @example\n * import { clearBackgroundSyncQueue } from \"tempest-react-sdk/sw\";\n *\n * await clearBackgroundSyncQueue();\n */\nexport async function clearBackgroundSyncQueue(\n    queueName: string = DEFAULT_QUEUE_NAME,\n): Promise<boolean> {\n    if (typeof indexedDB === \"undefined\") return false;\n    const db = await openQueueDb(queueName);\n    const tx = db.transaction([STORE, META], \"readwrite\");\n    tx.objectStore(STORE).clear();\n    const meta = tx.objectStore(META);\n    const current = meta.get(EPOCH_KEY);\n    current.onsuccess = () => {\n        meta.put(((current.result as number | undefined) ?? 0) + 1, EPOCH_KEY);\n    };\n    await txDone(tx);\n    db.close();\n    return true;\n}\n\n/**\n * One-way fingerprint of a principal: hex SHA-256, so the queue can compare\n * owners without ever holding the id itself.\n *\n * @returns The fingerprint, or `null` when nobody is signed in.\n */\nasync function ownerFingerprint(principal: string | null | undefined): Promise<string | null> {\n    if (principal === null || principal === undefined || principal === \"\") return null;\n    const digest = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(`tempest-bg-sync:${principal}`),\n    );\n    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Answer the worker's questions about queued requests (see `beforeReplay` on\n * {@link installBackgroundSync}). Install it once in every page, next to your\n * auth setup; it reads the token at replay time, so the queue never has to store\n * it. Without it, a queued request that carried a credential header is never\n * replayed.\n *\n * `getHeaders` must return **every** credential header the app sends (the worker\n * keeps an entry pending when one it stripped is missing), or `null` when there\n * is no session — the worker then drops the entry instead of replaying it\n * anonymously. A throw from `getHeaders` or `getPrincipal` is answered as an\n * explicit `{ error: true }`. The worker only applies headers whose names the\n * original request carried, so returning `Authorization` for every URL never\n * leaks it to a URL that did not receive it in the first place.\n *\n * Pass `getPrincipal` to bind each entry to whoever queued it: the worker asks\n * the issuing tab right after queueing, asks every tab again before replaying,\n * and drops the entry when no signed-in tab is its owner.\n *\n * @param getHeaders - Resolves the headers for one queued request at replay.\n * @param options - `getPrincipal` binds entries to their owner.\n * @returns A function that removes the listener. A no-op outside the browser.\n *\n * @example\n * import { provideBackgroundSyncCredentials } from \"tempest-react-sdk/sw\";\n *\n * const stop = provideBackgroundSyncCredentials(\n *     () => {\n *         const token = localStorage.getItem(\"token\");\n *         return token ? { Authorization: `Bearer ${token}` } : null;\n *     },\n *     { getPrincipal: () => localStorage.getItem(\"userId\") },\n * );\n */\nexport function provideBackgroundSyncCredentials(\n    getHeaders: BackgroundSyncCredentialsProvider,\n    options: ProvideBackgroundSyncCredentialsOptions = {},\n): () => void {\n    if (typeof navigator === \"undefined\" || !navigator.serviceWorker) return () => undefined;\n    const container = navigator.serviceWorker;\n    const { getPrincipal } = options;\n    const onMessage = (event: MessageEvent): void => {\n        const data = event.data as Partial<BackgroundSyncCredentialsRequest> & { type?: unknown };\n        const port = event.ports[0];\n        if (data?.type !== BACKGROUND_SYNC_CREDENTIALS_MESSAGE || !port) return;\n        const request: BackgroundSyncCredentialsRequest = {\n            url: String(data.url),\n            method: String(data.method),\n            phase: data.phase === \"enqueue\" ? \"enqueue\" : \"replay\",\n        };\n        void (async () => {\n            try {\n                const headers = request.phase === \"enqueue\" ? null : await getHeaders(request);\n                const answer: { headers: Record<string, string> | null; owner?: string | null } = {\n                    headers,\n                };\n                if (getPrincipal) answer.owner = await ownerFingerprint(await getPrincipal());\n                port.postMessage(answer);\n            } catch {\n                port.postMessage({ error: true });\n            }\n        })();\n    };\n    container.addEventListener(\"message\", onMessage);\n    return () => container.removeEventListener(\"message\", onMessage);\n}\n"],"mappings":";;;AA4DA,SAASA,IAAyB;CAC9B,OAAO;AACX;AAgDA,IAAMC,IAAqB,mBAOrBC,IAAa,GACbC,IAAQ,YACRC,IAAO,QACPC,IAAY,SAMLC,IAAsC,+BAG7CC,IAAyB,KAMzBC,IAAuBD,IAAyB;AAkItD,SAASE,EACL,GACA,GACgD;CAChD,IAAMC,IAA2B,CAAC,GAC5BC,IAAqB,CAAC;CAC5B,KAAK,IAAM,CAACC,GAAMC,MAAUC,GACxB,AAAIC,EAAkB,IAAIH,EAAK,YAAY,CAAC,IAAGD,EAAS,KAAKC,EAAK,YAAY,CAAC,IAC1EF,EAAK,KAAK,CAACE,GAAMC,CAAK,CAAC;CAEhC,OAAO;EAAE;EAAM;CAAS;AAC5B;AAOA,SAASG,EAAqB,GAAuB,GAA8C;CAC/F,IAAMC,IAAgBC,EAAM,WAAW;CACvC,EAAc,kBAAkB;EAC5B,IAAMC,IAASF,EAAc;EAC7B,IAAI,CAACE,GAAQ;EACb,IAAMC,IAAQD,EAAO,OACf,EAAE,SAAM,gBAAaV,EAAaW,EAAM,SAASL,CAAiB;EAOxE,AANAI,EAAO,OAAO;GACV,GAAGC;GACH,SAASV;GACT,iBAAiB,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAIU,EAAM,mBAAmB,CAAC,GAAI,GAAGT,CAAQ,CAAC,CAAC;GAC7E,YAAYS,EAAM,cAAc;EACpC,CAAC,GACDD,EAAO,SAAS;CACpB;AACJ;AAEA,SAASE,EACL,GACA,IAAyCC,EAAoB,GACzC;CACpB,OAAO,IAAI,SAAS,GAAS,MAAW;EACpC,IAAMC,IAAU,UAAU,KAAKX,GAAMV,CAAU;EAe/C,AAdA,EAAQ,mBAAmB,MAAU;GACjC,IAAMsB,IAAKD,EAAQ;GAMnB,AALKC,EAAG,iBAAiB,SAASrB,CAAK,IAE5BsB,EAAM,aAAa,KAAKF,EAAQ,eACvCP,EAAqBO,EAAQ,YAAY,YAAYpB,CAAK,GAAGY,CAAiB,IAF9ES,EAAG,kBAAkBrB,GAAO;IAAE,SAAS;IAAM,eAAe;GAAK,CAAC,GAIjEqB,EAAG,iBAAiB,SAASpB,CAAI,KAAGoB,EAAG,kBAAkBpB,CAAI;EACtE,GACA,EAAQ,kBAAkB;GACtB,IAAMoB,IAAKD,EAAQ;GAEnB,AADA,EAAG,wBAAwBC,EAAG,MAAM,GACpCE,EAAQF,CAAE;EACd,GACA,EAAQ,gBAAgBG,EAAOJ,EAAQ,KAAK;CAChD,CAAC;AACL;AAEA,SAASK,EAAO,GAAmC;CAC/C,OAAO,IAAI,SAAS,GAAS,MAAW;EAGpC,AAFA,EAAG,mBAAmBF,EAAQ,GAC9B,EAAG,gBAAgBC,EAAOE,EAAG,KAAK,GAClC,EAAG,gBAAgBF,EAAOE,EAAG,KAAK;CACtC,CAAC;AACL;AAGA,eAAeC,EAAU,GAAc,GAAyD;CAC5F,IAAMN,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAYpB,GAAM,UAAU,GACpC2B,IAAMF,EAAG,YAAYzB,CAAI,CAAC,CAAC,IAAIC,CAAS;CAG9C,OAFA,MAAMuB,EAAOC,CAAE,GACfL,EAAG,MAAM,GACDO,EAAI,UAAiC;AACjD;AASA,eAAeC,EACX,GACA,GACA,GACA,GAC2B;CAC3B,IAAMR,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAY,CAACrB,GAAOC,CAAI,GAAG,WAAW,GAChD6B,GACEC,IAAUL,EAAG,YAAYzB,CAAI,CAAC,CAAC,IAAIC,CAAS;CAUlD,OATA,EAAQ,kBAAkB;EACtB,KAAM6B,EAAQ,UAAiC,OAAOC,GAAO;EAC7D,IAAMC,IAAMP,EAAG,YAAY1B,CAAK,CAAC,CAAC,IAAIiB,CAAK;EAC3C,EAAI,kBAAkB;GAClB,IAAKgB,EAAI;EACb;CACJ,GACA,MAAMR,EAAOC,CAAE,GACfL,EAAG,MAAM,GACFS;AACX;AAMA,eAAeI,EACX,GACA,GACA,GACA,GACa;CACb,IAAMb,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,WAAW,GACtCe,IAAQW,EAAG,YAAY1B,CAAK,GAC5B4B,IAAMb,EAAM,IAAIe,CAAE;CASxB,AARA,EAAI,kBAAkB;EAClB,IAAMb,IAAQW,EAAI;EAClB,AAAKX,MACL,EAAM,aAAakB,GACfA,MAAe,YAAS,EAAM,QAAQC,KAAS,OACnDrB,EAAM,IAAIE,CAAK;CACnB,GACA,MAAMQ,EAAOC,CAAE,GACfL,EAAG,MAAM;AACb;AAEA,eAAegB,EACX,GACA,GACwB;CACxB,IAAMhB,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAYrB,GAAO,UAAU,GACrCsC,IAAM,MAAM,IAAI,SAA0B,GAAS,MAAW;EAChE,IAAMC,IAAMb,EAAG,YAAY1B,CAAK,CAAC,CAAC,OAAO;EAEzC,AADA,EAAI,kBAAkBuB,EAAQgB,EAAI,MAAyB,GAC3D,EAAI,gBAAgBf,EAAOe,EAAI,KAAK;CACxC,CAAC;CAED,OADAlB,EAAG,MAAM,GACFiB;AACX;AAGA,eAAeE,EAAY,GAAc,GAA8B;CACnE,IAAMnB,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,UAAU,GACrCyC,IAAQf,EAAG,YAAY1B,CAAK,CAAC,CAAC,MAAM8B,CAAE;CAG5C,OAFA,MAAML,EAAOC,CAAE,GACfL,EAAG,MAAM,GACFoB,EAAM,SAAS;AAC1B;AAEA,eAAeC,EAAO,GAAc,GAA2B;CAC3D,IAAMrB,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,WAAW;CAG5C,AAFA0B,EAAG,YAAY1B,CAAK,CAAC,CAAC,OAAO8B,CAAE,GAC/B,MAAML,EAAOC,CAAE,GACfL,EAAG,MAAM;AACb;AAMA,eAAesB,EACX,GACA,GACA,GACA,GACsB;CACtB,IAAMC,IAAS,MAAMxB,EAAQ,MAAM,CAAC,CAAC,YAAY,GAC3C,EAAE,SAAM,gBAAad,EAAac,EAAQ,QAAQ,QAAQ,GAAGR,CAAiB;CACpF,OAAO;EACH,KAAKQ,EAAQ;EACb,QAAQA,EAAQ;EAChB,SAASb;EACT,MAAMqC,EAAO,aAAa,IAAIA,IAAS;EACvC;EACA,aAAaxB,EAAQ;EACrB,iBAAiBZ;EACjB;CACJ;AACJ;AAOA,SAASqC,EACL,GACA,GAC+C;CAC/C,IAAM,EAAE,SAAM,gBAAavC,EAAaW,EAAM,SAASL,CAAiB;CACxE,OAAO;EACH,SAAS,IAAI,QAAQK,EAAM,KAAK;GAC5B,QAAQA,EAAM;GACd,SAASV;GACT,MAAMU,EAAM,QAAQ,KAAA;GACpB,aAAaA,EAAM;EACvB,CAAC;EACD,iBAAiB,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAIA,EAAM,mBAAmB,CAAC,GAAI,GAAGT,CAAQ,CAAC,CAAC;CACjF;AACJ;AAgBA,eAAesC,EACX,GACA,GACA,GACiC;CACjC,IAAMC,IAAU,IAAI,eAAe,GAC7BC,IAAS,MAAM,QAAQ,KAAK,CAC9B,IAAI,SAAkB,MAAY;EAE9B,AADA,EAAQ,MAAM,aAAa,MAAwBzB,EAAQD,EAAM,IAAI,GACrE2B,EAAO,YAAY;GAAE,MAAM9C;GAAqC,GAAGiB;EAAQ,GAAG,CAC1E2B,EAAQ,KACZ,CAAC;CACL,CAAC,GACDG,EAAS,WAAW,KAAA,CAAS,CACjC,CAAC;CAED,IADAH,EAAQ,MAAM,MAAM,GACG,OAAOC,KAAW,aAArCA,KAAiD,EAAE,aAAaA,IAAS;CAC7E,IAAM,EAAE,YAAS,aAAUA,GACrBG,IAAe,WAAWH;CAChC,IAAI,OAAgB,OAAOZ,KAAU,YAAYA,MAAU,OAC3D,OAAO;EACH,SACwB,OAAOzB,KAAY,YAAvCA,IACOA,IACD;EACV;EACA,OAAOwC,IAAgBf,IAA0B;CACrD;AACJ;AAGA,SAASgB,IAAgE;CACrE,IAAIC;CAIJ,OAAO;EAAE,SAAA,IAHW,SAAe,MAAY;GAC3C,IAAQ,WAAW9B,GAASnB,CAAsB;EACtD,CACS;EAAS,cAAc,aAAaiD,CAAK;CAAE;AACxD;AAOA,eAAeC,EACX,GACA,GACuB;CACvB,IAAMC,IAAW,MAAMC,EAAG,SAAS,SAAS,EAAE,MAAM,SAAS,CAAC,KAAM,CAAC;CACrE,IAAID,EAAQ,WAAW,GAAG,OAAO,CAAC;CAClC,IAAML,IAAWE,EAAc,GACzBK,IAAU,MAAM,QAAQ,IAC1BF,EAAQ,KAAK,MAAWT,EAAUG,GAAQ7B,GAAS8B,EAAS,OAAO,CAAC,CACxE;CAEA,OADAA,EAAS,OAAO,GACTO,EAAQ,QAAQ,MAAmCT,MAAW,KAAA,CAAS;AAClF;AAQA,SAASU,EAAgB,GAA2B;CAChD,IAAMD,oBAAU,IAAI,IAAqC,GACrDE,IAAS;CACb,OAAO;EACH,IAAI,GAAS;GACT,IAAMC,IAAM,GAAGxC,EAAQ,OAAO,GAAGA,EAAQ,OACrCyC,IAAUJ,EAAQ,IAAIG,CAAG;GAS7B,OARKC,MACD,IAAUP,EAAcE,GAAI;IACxB,KAAKpC,EAAQ;IACb,QAAQA,EAAQ;IAChB,OAAO;GACX,CAAC,GACDqC,EAAQ,IAAIG,GAAKC,CAAO,IAErBA;EACX;EACA,eAAe;GACX,AAAI,MAAWC,EAAW,MAC1B,IAAS,IACT,QAAQ,KACJ,wPAIJ;EACJ;CACJ;AACJ;AAUA,SAASC,EACL,GACA,GACwB;CACxB,QAAQC,EAAQ,YAAhB;EACI,KAAK,SACD,OAAOP,EAAQ,MAAM,MAAWT,EAAO,gBAAgBA,EAAO,UAAUgB,EAAQ,KAAK;EACzF,KAAK,WACD,OAAOP,EAAQ,OAAO,MAAW,CAACT,EAAO,YAAY,IAAIS,EAAQ,KAAK,KAAA;EAC1E,KAAK,WACD,OAAOA,EAAQ,MAAM,MAAW,CAACT,EAAO,YAAY,KAAKS,EAAQ;CACzE;AACJ;AAQA,eAAeQ,EACX,GACA,GACA,GACA,GACuB;CACvB,IAAMC,IAAeF,EAAQ,gBAAgB,SAAS,GAChDG,IACFH,EAAQ,eAAe,aACtBI,MAAgB,aAAaJ,EAAQ,eAAe;CACzD,IAAI,CAACE,KAAgBC,GAAW,OAAO/C;CACvC,IAAMqC,IAAU,MAAMY,EAAI,IAAIjD,CAAO;CACrC,IAAIqC,EAAQ,WAAW,GAEnB,MADAY,EAAI,aAAa,GACP,MAAM,qCAAqC;CAEzD,IAAMC,IAASP,EAAaN,GAASO,CAAO;CAC5C,IAAI,CAACM,GAAQ,OAAO;CACpB,IAAI,CAACJ,GAAc,OAAO9C;CAC1B,IAAIkD,EAAO,YAAY,MAAM,OAAO;CACpC,IAAMC,IAAW,IAAI,IACjB,OAAO,QAAQD,EAAO,OAAO,CAAC,CAAC,KAAK,CAAC7D,GAAMC,OAAW,CAACD,EAAK,YAAY,GAAGC,CAAK,CAAC,CACrF;CACA,IAAIsD,EAAQ,gBAAgB,MAAM,MAAS,CAACO,EAAS,IAAI9D,CAAI,CAAC,GAC1D,MAAU,MAAM,gEAAgE;CAEpF,IAAME,IAAU,IAAI,QAAQS,EAAQ,OAAO;CAC3C,KAAK,IAAMX,KAAQuD,EAAQ,iBAAiB,EAAQ,IAAIvD,GAAM8D,EAAS,IAAI9D,CAAI,CAAW;CAC1F,OAAO,IAAI,QAAQW,GAAS,EAAE,WAAQ,CAAC;AAC3C;AAsBA,eAAeoD,EAAY,GAAsB,GAA4B;CACzE,IAAM,EAAE,OAAI,SAAM,mBAAgB,sBAAmB,iBAAc,mBAAgBC,GAC7EJ,IAAMX,EAAgBF,CAAE,GACxBkB,IACFC,OACE,GAAkB,MAChBV,EAAoBI,GAAKjD,GAAS4C,GAASI,CAAW,IACxDQ,IAAU,MAAMvC,EAAQ5B,GAAMG,CAAiB,GACjDiD,IAAU;CAEd,KAAK,IAAM5C,KAAS2D,GAAS;EACzB,IAAI3D,EAAM,OAAO,KAAA,GAAW;EAC5B,IAAI4D,IAAM5D,EAAM,YAAY6D,GAAgB;GACxC,MAAMpC,EAAOjC,GAAMQ,EAAM,EAAE;GAC3B;EACJ;EACA,IAAM8D,IAAQ9D,EAAM,cAAc;EAClC,IAAI8D,MAAU,aAAaF,IAAM5D,EAAM,YAAYZ,GAAsB;GACrE,KAAW;GACX;EACJ;EACA,IAAM8B,IAAuC4C,MAAU,YAAY,YAAYA;EAC/E,IAAI;GACA,IAAM,EAAE,SAASC,GAAQ,uBAAoBnC,EACzC5B,GACAL,CACJ,GACMQ,IAAU,MAAMsD,EAAQM,GAAQ;IAClC,UAAU/D,EAAM;IAChB;IACA;IACA,OAAOkB,MAAe,UAAWlB,EAAM,SAAS,OAAQ,KAAA;GAC5D,CAAC;GACD,IAAI,CAAE,MAAMuB,EAAY/B,GAAMQ,EAAM,EAAE,GAAI;GAC1C,IAAIG,MAAY,MAAM;IAClB,MAAMsB,EAAOjC,GAAMQ,EAAM,EAAE;IAC3B;GACJ;GACA,IAAMgE,IAAW,MAAM,MAAM7D,CAAO;GACpC,AAAI6D,EAAS,MAAOA,EAAS,UAAU,OAAOA,EAAS,SAAS,MAC5D,MAAMvC,EAAOjC,GAAMQ,EAAM,EAAE,IAE3B,KAAW;EAEnB,QAAQ;GACJ,KAAW;EACf;CACJ;CAEA,IAAI4C,IAAU,GAAG,MAAU,MAAM,oBAAoBA,EAAQ,0BAA0B;AAC3F;AAMA,IAAMqB,oBAAkB,IAAI,IAA2B;AAEvD,SAASC,EAAW,GAAqC;CACrD,IAAMC,IAAUF,EAAgB,IAAIT,EAAO,IAAI;CAC/C,IAAIW,GAAS,OAAOA;CACpB,IAAMC,IAAOb,EAAYC,GAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc;EACvD,EAAgB,OAAOA,EAAO,IAAI;CACtC,CAAC;CAED,OADAS,EAAgB,IAAIT,EAAO,MAAMY,CAAI,GAC9BA;AACX;AAEA,SAASC,EACL,GACA,GACA,GACO;CAEP,OADKC,IACE,OAAOA,KAAU,aAAaA,EAAMC,GAAKpE,CAAO,IAAImE,EAAM,KAAKC,EAAI,IAAI,IAD3D;AAEvB;AAOA,eAAeC,EACX,GACA,GACA,GACA,GACa;CACb,IAAMvC,IAAWE,EAAc,GACzBJ,IAAS,MAAMF,EACjB4C,GACA;EAAE,KAAKtE,EAAQ;EAAK,QAAQA,EAAQ;EAAQ,OAAO;CAAU,GAC7D8B,EAAS,OACb;CAOA,AANAA,EAAS,OAAO,GAMhB,MAAMhB,EAAWzB,GAAMqB,GALkBkB,IAEnCA,EAAO,eACL,UACA,YAHF,WAI4BA,GAAQ,KAAK;AACnD;AAsBA,SAAgB2C,EAAsB,IAAwC,CAAC,GAAS;CACpF,IAAMnC,IAAK3D,EAAW,GAChB,EACF,UACA,eAAYC,GACZ,yBAAsB,MACtB,qBAAkB,GAAG8F,EAAQ,aAAa9F,EAAmB,YAC7D,uBAAoB+F,GACpB,iBACA,iBAAc,aACdD,GACEpF,IAAWW,EAAoBP,CAAiB,GAChDkF,IAAuB;EACzB;EACA,MAAMC;EACN,gBAAgBC,IAAsB,KAAK;EAC3C,mBAAmBxF;EACnB;EACA;CACJ;CAyDA,AAvDAgD,EAAG,iBAAiB,UAAU,MAAU;EACpC,IAAMpC,IAAUE,EAAM;EACtB,IAAIF,EAAQ,WAAW,SAASA,EAAQ,WAAW,QAAQ;EAE3D,IAAMoE,IAAM,IAAI,IAAIpE,EAAQ,GAAG;EAC/B,IAAI,CAACkE,EAAQC,GAAOC,GAAKpE,CAAO,GAAG;EAEnC,IAAMY,IAAQL,EAAUoE,GAAWvF,CAAQ;EAC3C,EAAM,YAAY,KAAA,CAAS;EAC3B,IAAMyF,IAAU,MAAM7E,EAAQ,MAAM,CAAC,GAC/B8E,IAASD,EAAQ,WACb,KAAA,GACN,YAAY;GACR,IAAMP,IAASpE,EAAM,WAAW,MAAMkC,EAAG,SAAS,IAAIlC,EAAM,QAAQ,IAAI,KAAA,GAClEL,IAAQ,MAAM0B,EAChBvB,GACA,KAAK,IAAI,GACTZ,GACAkF,IAAS,YAAY,SACzB,GACM5D,IAAK,MAAMD,EAAQkE,GAAW9E,GAAO,MAAMe,GAAOxB,CAAQ;GAChE,IAAIsB,MAAO,KAAA,GACX;QAAI;KACA,MAAM0B,EAAG,aAAa,MAAM,SAASuC,CAAS;IAClD,QAAQ,CAER;IACA,OAAOL,IAAS;KAAE;KAAI;IAAO,IAAI,KAAA;GADjC;EAEJ,CACJ;EAOA,AANApE,EAAM,YACF2E,EAAQ,MAAM,OAAO,MAAmB;GAEpC,MADA,MAAMC,GACAC;EACV,CAAC,CACL,GACA7E,EAAM,UACF4E,EACK,MAAM,MACHE,IAAQX,EAAgBM,GAAWK,EAAM,IAAIA,EAAM,QAAQhF,CAAO,IAAI,KAAA,CAC1E,CAAC,CACA,YAAY,KAAA,CAAS,CAC9B;CACJ,CAAC,GAEDoC,EAAG,iBAAiB,SAAS,MAAU;EACnC,AAAIlC,EAAM,QAAQyE,KAClBzE,EAAM,UAAU6D,EAAWW,CAAM,CAAC;CACtC,CAAC,GAEDtC,EAAG,iBAAiB,iBAAiB,MAAU;EAC3C,AAAIlC,EAAM,QAAQ+E,KAClB/E,EAAM,UAAU6D,EAAWW,CAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC;CAC7D,CAAC,GAEDtC,EAAG,iBAAiB,UAAU,MAAU;EACpC,AAAIA,EAAG,aAAa,QAChBlC,EAAM,QAAQ,WAAW,SAC7BA,EAAM,UAAU6D,EAAWW,CAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC;CAC7D,CAAC;AACL;AAsBA,eAAsBQ,EAClB,IAAoBxG,GACJ;CAChB,IAAI,OAAO,YAAc,KAAa,OAAO;CAC7C,IAAMuB,IAAK,MAAMH,EAAY6E,CAAS,GAChCrE,IAAKL,EAAG,YAAY,CAACrB,GAAOC,CAAI,GAAG,WAAW;CACpD,EAAG,YAAYD,CAAK,CAAC,CAAC,MAAM;CAC5B,IAAMuG,IAAO7E,EAAG,YAAYzB,CAAI,GAC1B8B,IAAUwE,EAAK,IAAIrG,CAAS;CAMlC,OALA,EAAQ,kBAAkB;EACtB,EAAK,KAAM6B,EAAQ,UAAiC,KAAK,GAAG7B,CAAS;CACzE,GACA,MAAMuB,EAAOC,CAAE,GACfL,EAAG,MAAM,GACF;AACX;AAQA,eAAemF,EAAiB,GAA8D;CAC1F,IAAIC,KAAc,QAAmCA,MAAc,IAAI,OAAO;CAC9E,IAAMC,IAAS,MAAM,OAAO,OAAO,OAC/B,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,mBAAmBD,GAAW,CAC3D;CACA,OAAO,CAAC,GAAG,IAAI,WAAWC,CAAM,CAAC,CAAC,CAAC,KAAK,MAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChG;AAoCA,SAAgBC,EACZ,GACA,IAAmD,CAAC,GAC1C;CACV,IAAI,OAAO,YAAc,OAAe,CAAC,UAAU,eAAe,aAAa,KAAA;CAC/E,IAAMC,IAAY,UAAU,eACtB,EAAE,oBAAiBjB,GACnBkB,KAAa,MAA8B;EAC7C,IAAMC,IAAOzF,EAAM,MACb0F,IAAO1F,EAAM,MAAM;EACzB,IAAIyF,GAAM,SAAA,iCAAgD,CAACC,GAAM;EACjE,IAAM5F,IAA4C;GAC9C,KAAK,OAAO2F,EAAK,GAAG;GACpB,QAAQ,OAAOA,EAAK,MAAM;GAC1B,OAAOA,EAAK,UAAU,YAAY,YAAY;EAClD;EACA,CAAM,YAAY;GACd,IAAI;IAEA,IAAM/D,IAA4E,EAC9E,SAFY5B,EAAQ,UAAU,YAAY,OAAO,MAAM6F,EAAW7F,CAAO,EAG7E;IAEA,AADI8F,MAAc,EAAO,QAAQ,MAAMV,EAAiB,MAAMU,EAAa,CAAC,IAC5EF,EAAK,YAAYhE,CAAM;GAC3B,QAAQ;IACJ,EAAK,YAAY,EAAE,OAAO,GAAK,CAAC;GACpC;EACJ,EAAA,CAAG;CACP;CAEA,OADA6D,EAAU,iBAAiB,WAAWC,CAAS,SAClCD,EAAU,oBAAoB,WAAWC,CAAS;AACnE"}
+{"version":3,"file":"background-sync.js","names":["getSwScope","DEFAULT_QUEUE_NAME","DB_VERSION","STORE","META","EPOCH_KEY","BACKGROUND_SYNC_CREDENTIALS_MESSAGE","CREDENTIALS_TIMEOUT_MS","OWNER_STAMP_GRACE_MS","splitHeaders","kept","stripped","name","value","headers","credentialHeaders","migrateLegacyEntries","cursorRequest","store","cursor","entry","openQueueDb","credentialHeaderSet","request","db","event","resolve","reject","txDone","tx","readEpoch","get","enqueue","id","current","epoch","add","stampOwner","ownerState","owner","readAll","all","req","stillQueued","count","remove","serializeRequest","buffer","deserializeRequest","askClient","channel","answer","client","deadline","hasPrincipal","startDeadline","timer","askAllClients","clients","sw","answers","createReplayRun","outOfScope","warned","key","pending","isDevBuild","origin","url","chooseAnswer","context","defaultBeforeReplay","credentialed","unchecked","ownerPolicy","run","chosen","provided","carriesCredential","replayQueue","config","prepare","beforeReplay","entries","now","maxRetentionMs","state","stored","strippedHeaders","inCredentialScope","response","replaysInFlight","drainQueue","running","pass","matches","match","stampFromIssuer","issuer","installBackgroundSync","options","DEFAULT_CREDENTIAL_HEADERS","workerOrigin","replay","queueName","maxRetentionMinutes","isTrustedCredentialTarget","trustedOrigins","attempt","queued","error","stamp","periodicSyncTag","clearBackgroundSyncQueue","meta","ownerFingerprint","principal","digest","byte","provideBackgroundSyncCredentials","container","getPrincipal","onMessage","data","port","getHeaders"],"sources":["../../src/sw/background-sync.ts"],"sourcesContent":["/**\n * Background-sync helper: queue failed mutating requests (POST/PUT/PATCH/DELETE)\n * while offline and replay them when connectivity returns. A dependency-free\n * take on Workbox's `BackgroundSyncPlugin`, backed by a tiny IndexedDB queue.\n *\n * Import inside your `sw.ts`. Uses the Background Sync API (`registration.sync`)\n * when available, and also replays opportunistically on the next request as a\n * fallback for browsers without it (e.g. Safari).\n *\n * Credential headers (`Authorization` and the rest of\n * {@link DEFAULT_CREDENTIAL_HEADERS}) are never written to IndexedDB: the queue\n * outlives the session, and a stored bearer stayed readable after logout and was\n * replayed with the old identity (reproduced in Chromium 153, 11/10/2026). On\n * replay the worker asks the open pages for the *current* credentials — see\n * {@link provideBackgroundSyncCredentials} — or a custom `beforeReplay` hook.\n * Credentials carried in the URL or the body are out of reach and are stored\n * as sent.\n *\n * @example\n *   import { installBackgroundSync } from \"tempest-react-sdk/sw\";\n *\n *   installBackgroundSync({ match: (url) => url.pathname.startsWith(\"/api/\") });\n */\nimport { isTrustedCredentialTarget } from \"../http/credential-scope\";\nimport { isDevBuild } from \"../utils/dev-mode\";\nimport { DEFAULT_CREDENTIAL_HEADERS, credentialHeaderSet } from \"./credential-headers\";\n\ninterface SyncEventLike {\n    tag: string;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface BgFetchEventLike {\n    request: Request;\n    /** Id of the window client that issued the request, when there is one. */\n    clientId?: string;\n    respondWith(response: Response | Promise<Response>): void;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface PeriodicSyncEventLike {\n    tag: string;\n    waitUntil(promise: Promise<unknown>): void;\n}\n\n/** Minimal shape of a window client the worker can message. */\ninterface WindowClientLike {\n    postMessage(message: unknown, transfer: Transferable[]): void;\n}\n\ninterface BgSwGlobal {\n    registration: { sync?: { register(tag: string): Promise<void> } };\n    clients?: {\n        matchAll(options: { type: \"window\" }): Promise<readonly WindowClientLike[]>;\n        get(id: string): Promise<WindowClientLike | undefined>;\n    };\n    addEventListener(type: \"sync\", listener: (event: SyncEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: BgFetchEventLike) => void): void;\n    addEventListener(type: \"periodicsync\", listener: (event: PeriodicSyncEventLike) => void): void;\n}\n\nfunction getSwScope(): BgSwGlobal {\n    return globalThis as unknown as BgSwGlobal;\n}\n\n/**\n * How an entry is tied to whoever queued it:\n * - `\"bound\"`: the issuing page reported a principal (or `null` for nobody);\n *   the entry only goes out while the same one is signed in.\n * - `\"unbound\"`: the issuing page answered without `getPrincipal`.\n * - `\"unknown\"`: nobody could say — no issuing tab, no answer, an error, or an\n *   entry written before owners existed. Fails closed, with or without stripped\n *   credentials: a cookie session rides along on the replay, so an entry with no\n *   credential header is checked like any other.\n *\n * While the worker is still asking, the stored state is `\"pending\"`, which a\n * replay never sees: it waits, then reads a stamp that never came as `\"unknown\"`.\n */\nexport type BackgroundSyncOwnerState = \"bound\" | \"unbound\" | \"unknown\";\n\n/**\n * How the default `beforeReplay` treats an `\"unknown\"` owner on an entry that\n * carried no credential header:\n * - `\"strict\"` (default): it asks the open pages like any other entry — replayed\n *   only when every answer lacks a principal, dropped as soon as one answer has\n *   one, pending while nobody answers.\n * - `\"lenient\"`: it is replayed as-is, without asking (the behavior up to 0.77.0).\n *\n * An entry with stripped credentials always asks, under either policy.\n */\nexport type BackgroundSyncOwnerPolicy = \"strict\" | \"lenient\";\n\n/** A serialized request stored in the queue. */\ninterface QueuedRequest {\n    id?: number;\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body: ArrayBuffer | null;\n    timestamp: number;\n    /** The original `credentials` mode, so cookie-based APIs replay with cookies. */\n    credentials?: RequestCredentials;\n    /** Lower-cased names of the credential headers removed before persisting. */\n    strippedHeaders?: string[];\n    /** Absent on entries written before 0.77 — read as `\"unknown\"`. */\n    ownerState?: BackgroundSyncOwnerState | \"pending\";\n    /** Fingerprint of the principal under `\"bound\"`; `null` for \"nobody signed in\". */\n    owner?: string | null;\n}\n\n/** Default IndexedDB database name (and sync tag) of the background-sync queue. */\nconst DEFAULT_QUEUE_NAME = \"tempest-bg-sync\";\n\n/**\n * Schema version of the queue database. Version 2 adds the `meta` store (the\n * clear epoch) and migrates version-1 entries, scrubbing their plaintext\n * credential headers on first open.\n */\nconst DB_VERSION = 2;\nconst STORE = \"requests\";\nconst META = \"meta\";\nconst EPOCH_KEY = \"epoch\";\n\n/**\n * `type` of the message the worker posts to window clients to ask about a queued\n * request. Answered by {@link provideBackgroundSyncCredentials}.\n */\nexport const BACKGROUND_SYNC_CREDENTIALS_MESSAGE = \"tempest:bg-sync-credentials\";\n\n/** How long the worker waits for the window clients to answer, in milliseconds. */\nconst CREDENTIALS_TIMEOUT_MS = 3000;\n\n/**\n * How long a replay waits on an entry whose owner is still being stamped. Past\n * it (the worker died mid-question), the owner is read as `\"unknown\"`.\n */\nconst OWNER_STAMP_GRACE_MS = CREDENTIALS_TIMEOUT_MS * 2;\n\n/** What a queued request looked like when it was stored, passed to `beforeReplay`. */\nexport interface BackgroundSyncReplayContext {\n    /** Epoch milliseconds of the original failed attempt. */\n    queuedAt: number;\n    /** Lower-cased credential header names stripped before the entry was stored. */\n    strippedHeaders: readonly string[];\n    /** How the entry is tied to its owner. */\n    ownerState: BackgroundSyncOwnerState;\n    /** Owner fingerprint under `\"bound\"` (`null` for nobody); `undefined` otherwise. */\n    owner: string | null | undefined;\n}\n\n/** The request a window client is asked about, as sent by the worker. */\nexport interface BackgroundSyncCredentialsRequest {\n    /** Absolute URL of the queued request. */\n    url: string;\n    /** HTTP method of the queued request. */\n    method: string;\n    /**\n     * `\"enqueue\"` when the worker only wants the owner of a request that just\n     * failed; `\"replay\"` when it is about to send it and needs the credentials.\n     */\n    phase: \"enqueue\" | \"replay\";\n}\n\n/**\n * Resolve the credentials for a queued request: a header record to apply, or\n * `null` when there is no session (the entry is then dropped).\n */\nexport type BackgroundSyncCredentialsProvider = (\n    request: BackgroundSyncCredentialsRequest,\n) => Record<string, string> | null | Promise<Record<string, string> | null>;\n\n/** Options for {@link provideBackgroundSyncCredentials}. */\nexport interface ProvideBackgroundSyncCredentialsOptions {\n    /**\n     * Who is signed in right now — a stable, non-secret id such as the user id;\n     * `null`/`undefined` when nobody is. Read when a request is queued and again\n     * when it is replayed: an entry is only sent while the same principal is\n     * signed in, and dropped otherwise, so a mutation queued by one account is\n     * never sent with another account's credentials even when the app forgets\n     * `clearSessionData()` on logout. Only a SHA-256 fingerprint reaches the\n     * queue, never the value itself. A throw is answered as an explicit error,\n     * which leaves the owner unknown (fail closed).\n     */\n    getPrincipal?: () => string | null | undefined | Promise<string | null | undefined>;\n}\n\n/** Options for {@link installBackgroundSync}. */\nexport interface InstallBackgroundSyncOptions {\n    /**\n     * Which requests to queue on failure. A `RegExp` against the URL or a\n     * predicate. Only non-`GET` requests are ever considered. Default: all\n     * non-`GET` requests.\n     */\n    match?: RegExp | ((url: URL, request: Request) => boolean);\n    /** IndexedDB database name, also used as the sync tag. Default `tempest-bg-sync`. */\n    queueName?: string;\n    /** Drop queued requests older than this (minutes) on replay. Default `1440` (24h). */\n    maxRetentionMinutes?: number;\n    /**\n     * Also drain the queue on the `periodicsync` event carrying this tag,\n     * complementing the one-off `sync` replay so long-pending mutations retry\n     * even without a fresh navigation. Register the periodic sync from the main\n     * thread with {@link registerPeriodicSync}. Default `${queueName}-periodic`.\n     */\n    periodicSyncTag?: string;\n    /**\n     * Header names stripped before a request is persisted — and stripped again on\n     * replay, so entries written by an older version never go out with the\n     * credential they stored. Default {@link DEFAULT_CREDENTIAL_HEADERS}; extend it\n     * for a custom credential header (`[...DEFAULT_CREDENTIAL_HEADERS,\n     * \"x-tenant-key\"]`). Passing `[]` restores the pre-0.77 behavior of\n     * persisting and replaying every header, credentials included.\n     */\n    credentialHeaders?: readonly string[];\n    /**\n     * Origins besides the worker's own that a replayed request may carry a\n     * credential header to — typically the API host when it is not the app's\n     * origin (`[\"https://api.acme.com\"]`). Default `[]`: only the worker's origin.\n     *\n     * A credential re-applied at replay comes from the page, so it is the app's\n     * credential, whatever the request originally carried under the same header\n     * name. Before 0.81.0 the worker checked only the name, and a mutation to a\n     * third party that failed offline carrying that party's `Authorization` was\n     * replayed to it with the app's bearer (#523). Now, with the rule\n     * `isTrustedCredentialTarget` enforces on the live `ApiClient`:\n     * - an entry that carried a credential header to an origin outside this\n     *   scope is dropped before `beforeReplay` runs — re-sending it without the\n     *   credential would be a request the app never made, and with the app's\n     *   credential, a leak;\n     * - a request returned by `beforeReplay` (custom or default) that carries a\n     *   header from `credentialHeaders` to an origin outside this scope is\n     *   dropped instead of sent.\n     *\n     * Both drops warn once per origin per replay in development builds. Entries\n     * with no credential header are not affected: the browser attaches that\n     * origin's own cookies, as it did on the original attempt.\n     */\n    trustedOrigins?: readonly string[];\n    /**\n     * How an `\"unknown\"` owner is handled on an entry with no stripped\n     * credentials (see {@link BackgroundSyncOwnerPolicy}). Default `\"strict\"`.\n     *\n     * `\"lenient\"` restores the replay-as-is of 0.77.0 and earlier for an app without sign-in,\n     * where no page ever reports a principal. Do not use it with a cookie\n     * session: the browser attaches on replay the cookie of whoever is signed in\n     * at that moment, so a mutation queued by A whose owner was never stamped\n     * (issuing tab closed, empty `clientId`, stamp lost, legacy entry) goes out\n     * with B's session. Entries with stripped credentials ask the pages either\n     * way. Ignored when a custom `beforeReplay` is given.\n     */\n    ownerPolicy?: BackgroundSyncOwnerPolicy;\n    /**\n     * Prepare each queued request right before it is replayed: return the\n     * request to send (typically with the current credentials applied) or\n     * `null` to drop the entry for good. A thrown error keeps the entry pending.\n     * The context carries the entry's owner, so a custom hook can apply the\n     * same rule as the default.\n     *\n     * Default: only an `\"unbound\"` entry with no stripped credentials (and, under\n     * `ownerPolicy: \"lenient\"`, an `\"unknown\"` one) is replayed as-is, without\n     * asking. Every other entry — credentialed or not —\n     * asks every open window client in parallel (see\n     * {@link provideBackgroundSyncCredentials}) and picks the answer that fits:\n     * - `\"bound\"`: the answer whose owner matches; none among valid answers →\n     *   dropped, never sent anonymously or as somebody else;\n     * - `\"unknown\"`: only when every answer lacks a principal (an app that does\n     *   not use `getPrincipal`); a single answer with one → dropped, since a\n     *   stale tab without `getPrincipal` says nothing about who is signed in\n     *   next to it. This holds for an entry\n     *   with no credential header too, since the browser attaches the cookies of\n     *   whoever is signed in at replay time;\n     * - `\"unbound\"`: any answer, preferring one without a principal.\n     * Then `null` headers drop a credentialed entry, an answer that lacks one of\n     * the stripped headers keeps it pending, and only the stripped names are\n     * re-applied. No valid answer at all keeps it pending until\n     * `maxRetentionMinutes` (and warns once per replay in development builds) —\n     * so a page that never calls {@link provideBackgroundSyncCredentials} leaves\n     * every entry it queued `\"unknown\"`, and none of them is replayed.\n     *\n     * Whatever the hook returns is still held to `trustedOrigins`: a credential\n     * header bound for an origin outside the worker's own and `trustedOrigins` is\n     * never sent.\n     */\n    beforeReplay?: (\n        request: Request,\n        context: BackgroundSyncReplayContext,\n    ) => Request | null | Promise<Request | null>;\n}\n\n/**\n * Move credential headers out of a header list.\n *\n * @returns The remaining headers and the lower-cased names removed.\n */\nfunction splitHeaders(\n    headers: Iterable<[string, string]>,\n    credentialHeaders: ReadonlySet<string>,\n): { kept: [string, string][]; stripped: string[] } {\n    const kept: [string, string][] = [];\n    const stripped: string[] = [];\n    for (const [name, value] of headers) {\n        if (credentialHeaders.has(name.toLowerCase())) stripped.push(name.toLowerCase());\n        else kept.push([name, value]);\n    }\n    return { kept, stripped };\n}\n\n/**\n * Scrub version-1 entries during the upgrade: their credential headers were\n * stored in plaintext, so they are removed from disk on the first open, recorded\n * as stripped, and the owner is marked unknown.\n */\nfunction migrateLegacyEntries(store: IDBObjectStore, credentialHeaders: ReadonlySet<string>): void {\n    const cursorRequest = store.openCursor();\n    cursorRequest.onsuccess = () => {\n        const cursor = cursorRequest.result;\n        if (!cursor) return;\n        const entry = cursor.value as QueuedRequest;\n        const { kept, stripped } = splitHeaders(entry.headers, credentialHeaders);\n        cursor.update({\n            ...entry,\n            headers: kept,\n            strippedHeaders: [...new Set([...(entry.strippedHeaders ?? []), ...stripped])],\n            ownerState: entry.ownerState ?? \"unknown\",\n        });\n        cursor.continue();\n    };\n}\n\nfunction openQueueDb(\n    name: string,\n    credentialHeaders: ReadonlySet<string> = credentialHeaderSet(),\n): Promise<IDBDatabase> {\n    return new Promise((resolve, reject) => {\n        const request = indexedDB.open(name, DB_VERSION);\n        request.onupgradeneeded = (event) => {\n            const db = request.result;\n            if (!db.objectStoreNames.contains(STORE)) {\n                db.createObjectStore(STORE, { keyPath: \"id\", autoIncrement: true });\n            } else if (event.oldVersion < 2 && request.transaction) {\n                migrateLegacyEntries(request.transaction.objectStore(STORE), credentialHeaders);\n            }\n            if (!db.objectStoreNames.contains(META)) db.createObjectStore(META);\n        };\n        request.onsuccess = () => {\n            const db = request.result;\n            db.onversionchange = () => db.close();\n            resolve(db);\n        };\n        request.onerror = () => reject(request.error);\n    });\n}\n\nfunction txDone(tx: IDBTransaction): Promise<void> {\n    return new Promise((resolve, reject) => {\n        tx.oncomplete = () => resolve();\n        tx.onerror = () => reject(tx.error);\n        tx.onabort = () => reject(tx.error);\n    });\n}\n\n/** The current clear epoch: bumped by every {@link clearBackgroundSyncQueue}. */\nasync function readEpoch(name: string, credentialHeaders: ReadonlySet<string>): Promise<number> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction(META, \"readonly\");\n    const get = tx.objectStore(META).get(EPOCH_KEY);\n    await txDone(tx);\n    db.close();\n    return (get.result as number | undefined) ?? 0;\n}\n\n/**\n * Add an entry unless the queue was cleared since `epoch` was read — checked in\n * the same transaction as the write, so a logout that lands while the request\n * is still failing never lets it into the next session's queue.\n *\n * @returns The new entry's key, or `undefined` when the clear won.\n */\nasync function enqueue(\n    name: string,\n    entry: QueuedRequest,\n    epoch: number,\n    credentialHeaders: ReadonlySet<string>,\n): Promise<number | undefined> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction([STORE, META], \"readwrite\");\n    let id: number | undefined;\n    const current = tx.objectStore(META).get(EPOCH_KEY);\n    current.onsuccess = () => {\n        if (((current.result as number | undefined) ?? 0) !== epoch) return;\n        const add = tx.objectStore(STORE).add(entry);\n        add.onsuccess = () => {\n            id = add.result as number;\n        };\n    };\n    await txDone(tx);\n    db.close();\n    return id;\n}\n\n/**\n * Record how an entry is owned. A no-op when the entry is already gone\n * (replayed, or the queue was cleared).\n */\nasync function stampOwner(\n    name: string,\n    id: number,\n    ownerState: BackgroundSyncOwnerState,\n    owner: string | null | undefined,\n): Promise<void> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readwrite\");\n    const store = tx.objectStore(STORE);\n    const get = store.get(id);\n    get.onsuccess = () => {\n        const entry = get.result as QueuedRequest | undefined;\n        if (!entry) return;\n        entry.ownerState = ownerState;\n        if (ownerState === \"bound\") entry.owner = owner ?? null;\n        store.put(entry);\n    };\n    await txDone(tx);\n    db.close();\n}\n\nasync function readAll(\n    name: string,\n    credentialHeaders: ReadonlySet<string>,\n): Promise<QueuedRequest[]> {\n    const db = await openQueueDb(name, credentialHeaders);\n    const tx = db.transaction(STORE, \"readonly\");\n    const all = await new Promise<QueuedRequest[]>((resolve, reject) => {\n        const req = tx.objectStore(STORE).getAll();\n        req.onsuccess = () => resolve(req.result as QueuedRequest[]);\n        req.onerror = () => reject(req.error);\n    });\n    db.close();\n    return all;\n}\n\n/** Whether an entry is still in the queue — `false` once it was cleared. */\nasync function stillQueued(name: string, id: number): Promise<boolean> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readonly\");\n    const count = tx.objectStore(STORE).count(id);\n    await txDone(tx);\n    db.close();\n    return count.result > 0;\n}\n\nasync function remove(name: string, id: number): Promise<void> {\n    const db = await openQueueDb(name);\n    const tx = db.transaction(STORE, \"readwrite\");\n    tx.objectStore(STORE).delete(id);\n    await txDone(tx);\n    db.close();\n}\n\n/**\n * Serialize a request for the queue, leaving out every credential header and\n * recording which ones were present.\n */\nasync function serializeRequest(\n    request: Request,\n    timestamp: number,\n    credentialHeaders: ReadonlySet<string>,\n    ownerState: QueuedRequest[\"ownerState\"],\n): Promise<QueuedRequest> {\n    const buffer = await request.clone().arrayBuffer();\n    const { kept, stripped } = splitHeaders(request.headers.entries(), credentialHeaders);\n    return {\n        url: request.url,\n        method: request.method,\n        headers: kept,\n        body: buffer.byteLength > 0 ? buffer : null,\n        timestamp,\n        credentials: request.credentials,\n        strippedHeaders: stripped,\n        ownerState,\n    };\n}\n\n/**\n * Rebuild a stored request, stripping credential headers once more so an entry\n * that still holds one (a custom `credentialHeaders` the migration did not know)\n * never replays it.\n */\nfunction deserializeRequest(\n    entry: QueuedRequest,\n    credentialHeaders: ReadonlySet<string>,\n): { request: Request; strippedHeaders: string[] } {\n    const { kept, stripped } = splitHeaders(entry.headers, credentialHeaders);\n    return {\n        request: new Request(entry.url, {\n            method: entry.method,\n            headers: kept,\n            body: entry.body ?? undefined,\n            credentials: entry.credentials,\n        }),\n        strippedHeaders: [...new Set([...(entry.strippedHeaders ?? []), ...stripped])],\n    };\n}\n\n/** A window client's parsed answer. */\ninterface ClientAnswer {\n    headers: Record<string, string> | null;\n    /** Whether the page has `getPrincipal`. */\n    hasPrincipal: boolean;\n    owner: string | null;\n}\n\n/**\n * Ask one window client about a queued request over a `MessageChannel`.\n *\n * @returns The parsed answer, or `undefined` when the client stayed silent until\n *   `deadline`, answered `{ error: true }`, or answered something unrecognizable.\n */\nasync function askClient(\n    client: WindowClientLike,\n    request: BackgroundSyncCredentialsRequest,\n    deadline: Promise<void>,\n): Promise<ClientAnswer | undefined> {\n    const channel = new MessageChannel();\n    const answer = await Promise.race([\n        new Promise<unknown>((resolve) => {\n            channel.port1.onmessage = (event: MessageEvent) => resolve(event.data);\n            client.postMessage({ type: BACKGROUND_SYNC_CREDENTIALS_MESSAGE, ...request }, [\n                channel.port2,\n            ]);\n        }),\n        deadline.then(() => undefined),\n    ]);\n    channel.port1.close();\n    if (answer === null || typeof answer !== \"object\" || !(\"headers\" in answer)) return undefined;\n    const { headers, owner } = answer as { headers: unknown; owner?: unknown };\n    const hasPrincipal = \"owner\" in answer;\n    if (hasPrincipal && typeof owner !== \"string\" && owner !== null) return undefined;\n    return {\n        headers:\n            headers !== null && typeof headers === \"object\"\n                ? (headers as Record<string, string>)\n                : null,\n        hasPrincipal,\n        owner: hasPrincipal ? (owner as string | null) : null,\n    };\n}\n\n/** A deadline shared by every client asked in one round. */\nfunction startDeadline(): { promise: Promise<void>; cancel: () => void } {\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const promise = new Promise<void>((resolve) => {\n        timer = setTimeout(resolve, CREDENTIALS_TIMEOUT_MS);\n    });\n    return { promise, cancel: () => clearTimeout(timer) };\n}\n\n/**\n * Ask every open window client in parallel, under one shared deadline.\n *\n * @returns Every valid answer; empty when nobody answered.\n */\nasync function askAllClients(\n    sw: BgSwGlobal,\n    request: BackgroundSyncCredentialsRequest,\n): Promise<ClientAnswer[]> {\n    const clients = (await sw.clients?.matchAll({ type: \"window\" })) ?? [];\n    if (clients.length === 0) return [];\n    const deadline = startDeadline();\n    const answers = await Promise.all(\n        clients.map((client) => askClient(client, request, deadline.promise)),\n    );\n    deadline.cancel();\n    return answers.filter((answer): answer is ClientAnswer => answer !== undefined);\n}\n\n/** State of one replay pass: answers cached per URL + method, and the warning flags. */\ninterface ReplayRun {\n    ask(request: Request): Promise<ClientAnswer[]>;\n    warnNoAnswer(): void;\n    warnOutOfScope(url: string): void;\n}\n\nfunction createReplayRun(sw: BgSwGlobal): ReplayRun {\n    const answers = new Map<string, Promise<ClientAnswer[]>>();\n    const outOfScope = new Set<string>();\n    let warned = false;\n    return {\n        ask(request) {\n            const key = `${request.method} ${request.url}`;\n            let pending = answers.get(key);\n            if (!pending) {\n                pending = askAllClients(sw, {\n                    url: request.url,\n                    method: request.method,\n                    phase: \"replay\",\n                });\n                answers.set(key, pending);\n            }\n            return pending;\n        },\n        warnNoAnswer() {\n            if (warned || !isDevBuild()) return;\n            warned = true;\n            console.warn(\n                \"[tempest-react-sdk/sw] background-sync: a queued request needs an open page \" +\n                    \"to confirm who is signed in or to supply the current credentials, and no \" +\n                    \"open page answered. Call \" +\n                    \"provideBackgroundSyncCredentials() in the page; the entry stays pending.\",\n            );\n        },\n        warnOutOfScope(url) {\n            const origin = new URL(url).origin;\n            if (outOfScope.has(origin) || !isDevBuild()) return;\n            outOfScope.add(origin);\n            console.warn(\n                `[tempest-react-sdk/sw] background-sync: dropped a credentialed request to ${origin}; list it in trustedOrigins to replay it.`,\n            );\n        },\n    };\n}\n\n/**\n * Pick the answer an entry may be replayed with, per its owner state.\n *\n * An `\"unknown\"` owner replays only when every valid answer lacks a principal:\n * one tab reporting a principal (even `null`) is enough to drop it, because a\n * principal-less answer — say a tab still running a bundle from before the app\n * adopted `getPrincipal` — says nothing about whose cookie the replay carries.\n */\nfunction chooseAnswer(\n    answers: readonly ClientAnswer[],\n    context: BackgroundSyncReplayContext,\n): ClientAnswer | undefined {\n    switch (context.ownerState) {\n        case \"bound\":\n            return answers.find((answer) => answer.hasPrincipal && answer.owner === context.owner);\n        case \"unknown\":\n            return answers.every((answer) => !answer.hasPrincipal) ? answers[0] : undefined;\n        case \"unbound\":\n            return answers.find((answer) => !answer.hasPrincipal) ?? answers[0];\n    }\n}\n\n/**\n * The default `beforeReplay` (rules on {@link InstallBackgroundSyncOptions}).\n *\n * @throws {Error} When no page answered, or the chosen answer lacks a stripped\n *   header — the entry stays pending.\n */\nasync function defaultBeforeReplay(\n    run: ReplayRun,\n    request: Request,\n    context: BackgroundSyncReplayContext,\n    ownerPolicy: BackgroundSyncOwnerPolicy,\n): Promise<Request | null> {\n    const credentialed = context.strippedHeaders.length > 0;\n    const unchecked =\n        context.ownerState === \"unbound\" ||\n        (ownerPolicy === \"lenient\" && context.ownerState === \"unknown\");\n    if (!credentialed && unchecked) return request;\n    const answers = await run.ask(request);\n    if (answers.length === 0) {\n        run.warnNoAnswer();\n        throw new Error(\"background-sync: no client answered\");\n    }\n    const chosen = chooseAnswer(answers, context);\n    if (!chosen) return null;\n    if (!credentialed) return request;\n    if (chosen.headers === null) return null;\n    const provided = new Map(\n        Object.entries(chosen.headers).map(([name, value]) => [name.toLowerCase(), value]),\n    );\n    if (context.strippedHeaders.some((name) => !provided.has(name))) {\n        throw new Error(\"background-sync: the answer lacks a stripped credential header\");\n    }\n    const headers = new Headers(request.headers);\n    for (const name of context.strippedHeaders) headers.set(name, provided.get(name) as string);\n    return new Request(request, { headers });\n}\n\n/** Everything {@link replayQueue} needs besides the clock. */\ninterface ReplayConfig {\n    sw: BgSwGlobal;\n    name: string;\n    maxRetentionMs: number;\n    credentialHeaders: ReadonlySet<string>;\n    beforeReplay?: InstallBackgroundSyncOptions[\"beforeReplay\"];\n    ownerPolicy: BackgroundSyncOwnerPolicy;\n    /** Whether a request to this URL may carry a credential header. */\n    inCredentialScope: (url: string) => boolean;\n}\n\n/** Whether a request carries any of the configured credential headers. */\nfunction carriesCredential(request: Request, credentialHeaders: ReadonlySet<string>): boolean {\n    return [...request.headers.keys()].some((name) => credentialHeaders.has(name));\n}\n\n/**\n * Replay every queued request once. Entries that succeed, are stale, get a 4xx\n * (a client error that will not fix itself) or that the preparation rejects with\n * `null` are removed; entries that fail again — network error, 5xx, or a\n * preparation that throws — are kept, and so is an entry whose owner is still\n * being stamped (for up to {@link OWNER_STAMP_GRACE_MS}). Each entry is checked\n * against the store right before it is sent, so a queue cleared mid-replay stops\n * the replay. Throws if any entry is still pending, so a `sync` handler keeps\n * the sync registered.\n *\n * Credential scope (#523) is enforced here rather than in the default hook, so\n * a custom `beforeReplay` is held to it too: an entry that stripped a credential\n * header for an origin outside the scope is dropped before preparation, and a\n * prepared request carrying one to such an origin is dropped instead of sent.\n */\nasync function replayQueue(config: ReplayConfig, now: number): Promise<void> {\n    const {\n        sw,\n        name,\n        maxRetentionMs,\n        credentialHeaders,\n        beforeReplay,\n        ownerPolicy,\n        inCredentialScope,\n    } = config;\n    const run = createReplayRun(sw);\n    const prepare =\n        beforeReplay ??\n        ((request: Request, context: BackgroundSyncReplayContext) =>\n            defaultBeforeReplay(run, request, context, ownerPolicy));\n    const entries = await readAll(name, credentialHeaders);\n    let pending = 0;\n\n    for (const entry of entries) {\n        if (entry.id === undefined) continue;\n        if (now - entry.timestamp > maxRetentionMs) {\n            await remove(name, entry.id);\n            continue;\n        }\n        const state = entry.ownerState ?? \"unknown\";\n        if (state === \"pending\" && now - entry.timestamp < OWNER_STAMP_GRACE_MS) {\n            pending += 1;\n            continue;\n        }\n        const ownerState: BackgroundSyncOwnerState = state === \"pending\" ? \"unknown\" : state;\n        try {\n            const { request: stored, strippedHeaders } = deserializeRequest(\n                entry,\n                credentialHeaders,\n            );\n            if (strippedHeaders.length > 0 && !inCredentialScope(stored.url)) {\n                run.warnOutOfScope(stored.url);\n                await remove(name, entry.id);\n                continue;\n            }\n            const request = await prepare(stored, {\n                queuedAt: entry.timestamp,\n                strippedHeaders,\n                ownerState,\n                owner: ownerState === \"bound\" ? (entry.owner ?? null) : undefined,\n            });\n            if (!(await stillQueued(name, entry.id))) continue;\n            if (request === null) {\n                await remove(name, entry.id);\n                continue;\n            }\n            if (carriesCredential(request, credentialHeaders) && !inCredentialScope(request.url)) {\n                run.warnOutOfScope(request.url);\n                await remove(name, entry.id);\n                continue;\n            }\n            const response = await fetch(request);\n            if (response.ok || (response.status >= 400 && response.status < 500)) {\n                await remove(name, entry.id);\n            } else {\n                pending += 1;\n            }\n        } catch {\n            pending += 1;\n        }\n    }\n\n    if (pending > 0) throw new Error(`background-sync: ${pending} request(s) still pending`);\n}\n\n/**\n * The replay in flight per queue. `sync`, `periodicsync` and the Safari fallback\n * can fire together; sharing one pass keeps a mutation from being sent twice.\n */\nconst replaysInFlight = new Map<string, Promise<void>>();\n\nfunction drainQueue(config: ReplayConfig): Promise<void> {\n    const running = replaysInFlight.get(config.name);\n    if (running) return running;\n    const pass = replayQueue(config, Date.now()).finally(() => {\n        replaysInFlight.delete(config.name);\n    });\n    replaysInFlight.set(config.name, pass);\n    return pass;\n}\n\nfunction matches(\n    match: InstallBackgroundSyncOptions[\"match\"],\n    url: URL,\n    request: Request,\n): boolean {\n    if (!match) return true;\n    return typeof match === \"function\" ? match(url, request) : match.test(url.href);\n}\n\n/**\n * Ask the issuing page who owns a just-queued entry and record it.\n *\n * @returns Resolves once the owner is stamped; never rejects.\n */\nasync function stampFromIssuer(\n    name: string,\n    id: number,\n    issuer: WindowClientLike,\n    request: Request,\n): Promise<void> {\n    const deadline = startDeadline();\n    const answer = await askClient(\n        issuer,\n        { url: request.url, method: request.method, phase: \"enqueue\" },\n        deadline.promise,\n    );\n    deadline.cancel();\n    const state: BackgroundSyncOwnerState = !answer\n        ? \"unknown\"\n        : answer.hasPrincipal\n          ? \"bound\"\n          : \"unbound\";\n    await stampOwner(name, id, state, answer?.owner);\n}\n\n/**\n * Install the background-sync queue: on a failed mutating request, the request\n * is serialized to IndexedDB (without its credential headers) and a sync is\n * registered; the original fetch still rejects (so your app can show an offline\n * state), and the request is replayed later when the network returns.\n *\n * Right after queueing, the worker asks the page that issued the request who is\n * signed in (`getPrincipal` on {@link provideBackgroundSyncCredentials}) and\n * stamps the entry with that owner, without delaying the rejection. The work is\n * handed to `event.waitUntil` synchronously, so the worker stays alive for it\n * in every engine. Without the Background Sync API (every non-Chromium\n * browser), the queue is drained opportunistically whenever a `GET` goes\n * through the worker.\n *\n * @tempest-limits empty-catch — `registration.sync.register` is unavailable on\n * every non-Chromium browser and fails on a revoked background-sync permission.\n * The entry is already durable in IndexedDB at that point, and the queue is also\n * drained opportunistically on the next successful request, so losing the OS-level\n * wakeup degrades *when* the replay happens, not *whether* it happens.\n */\nexport function installBackgroundSync(options: InstallBackgroundSyncOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        match,\n        queueName = DEFAULT_QUEUE_NAME,\n        maxRetentionMinutes = 1440,\n        periodicSyncTag = `${options.queueName ?? DEFAULT_QUEUE_NAME}-periodic`,\n        credentialHeaders = DEFAULT_CREDENTIAL_HEADERS,\n        beforeReplay,\n        ownerPolicy = \"strict\",\n        trustedOrigins = [],\n    } = options;\n    const stripped = credentialHeaderSet(credentialHeaders);\n    const workerOrigin = globalThis.location?.href ?? \"\";\n    const replay: ReplayConfig = {\n        sw,\n        name: queueName,\n        maxRetentionMs: maxRetentionMinutes * 60 * 1000,\n        credentialHeaders: stripped,\n        beforeReplay,\n        ownerPolicy,\n        inCredentialScope: (url) => isTrustedCredentialTarget(url, workerOrigin, trustedOrigins),\n    };\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method === \"GET\" || request.method === \"HEAD\") return;\n\n        const url = new URL(request.url);\n        if (!matches(match, url, request)) return;\n\n        const epoch = readEpoch(queueName, stripped);\n        epoch.catch(() => undefined);\n        const attempt = fetch(request.clone());\n        const queued = attempt.then(\n            () => undefined,\n            async () => {\n                const issuer = event.clientId ? await sw.clients?.get(event.clientId) : undefined;\n                const entry = await serializeRequest(\n                    request,\n                    Date.now(),\n                    stripped,\n                    issuer ? \"pending\" : \"unknown\",\n                );\n                const id = await enqueue(queueName, entry, await epoch, stripped);\n                if (id === undefined) return undefined;\n                try {\n                    await sw.registration.sync?.register(queueName);\n                } catch {\n                    /* empty */\n                }\n                return issuer ? { id, issuer } : undefined;\n            },\n        );\n        event.respondWith(\n            attempt.catch(async (error: unknown) => {\n                await queued;\n                throw error;\n            }),\n        );\n        event.waitUntil(\n            queued\n                .then((stamp) =>\n                    stamp ? stampFromIssuer(queueName, stamp.id, stamp.issuer, request) : undefined,\n                )\n                .catch(() => undefined),\n        );\n    });\n\n    sw.addEventListener(\"sync\", (event) => {\n        if (event.tag !== queueName) return;\n        event.waitUntil(drainQueue(replay));\n    });\n\n    sw.addEventListener(\"periodicsync\", (event) => {\n        if (event.tag !== periodicSyncTag) return;\n        event.waitUntil(drainQueue(replay).catch(() => undefined));\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        if (sw.registration.sync) return;\n        if (event.request.method !== \"GET\") return;\n        event.waitUntil(drainQueue(replay).catch(() => undefined));\n    });\n}\n\n/**\n * Empty the background-sync queue — every request still waiting to be replayed —\n * and bump its clear epoch. Call it on logout (or use `clearSessionData()`, which\n * also clears the runtime caches) so mutations made under one session are never\n * replayed under the next.\n *\n * Works from the page and from the worker, and reaches work already in flight\n * in the worker: a replay checks each entry right before sending it, and a\n * request still failing when the queue is cleared is not written afterwards.\n *\n * @param queueName - The `queueName` given to {@link installBackgroundSync}.\n *   Default `tempest-bg-sync`.\n * @returns `true` once the queue is empty; `false` when IndexedDB is\n *   unavailable (SSR, old browsers).\n *\n * @example\n * import { clearBackgroundSyncQueue } from \"tempest-react-sdk/sw\";\n *\n * await clearBackgroundSyncQueue();\n */\nexport async function clearBackgroundSyncQueue(\n    queueName: string = DEFAULT_QUEUE_NAME,\n): Promise<boolean> {\n    if (typeof indexedDB === \"undefined\") return false;\n    const db = await openQueueDb(queueName);\n    const tx = db.transaction([STORE, META], \"readwrite\");\n    tx.objectStore(STORE).clear();\n    const meta = tx.objectStore(META);\n    const current = meta.get(EPOCH_KEY);\n    current.onsuccess = () => {\n        meta.put(((current.result as number | undefined) ?? 0) + 1, EPOCH_KEY);\n    };\n    await txDone(tx);\n    db.close();\n    return true;\n}\n\n/**\n * One-way fingerprint of a principal: hex SHA-256, so the queue can compare\n * owners without ever holding the id itself.\n *\n * @returns The fingerprint, or `null` when nobody is signed in.\n */\nasync function ownerFingerprint(principal: string | null | undefined): Promise<string | null> {\n    if (principal === null || principal === undefined || principal === \"\") return null;\n    const digest = await crypto.subtle.digest(\n        \"SHA-256\",\n        new TextEncoder().encode(`tempest-bg-sync:${principal}`),\n    );\n    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Answer the worker's questions about queued requests (see `beforeReplay` on\n * {@link installBackgroundSync}). Install it once in every page, next to your\n * auth setup; it reads the token at replay time, so the queue never has to store\n * it. Without it, a queued request that carried a credential header is never\n * replayed.\n *\n * `getHeaders` must return **every** credential header the app sends (the worker\n * keeps an entry pending when one it stripped is missing), or `null` when there\n * is no session — the worker then drops the entry instead of replaying it\n * anonymously. A throw from `getHeaders` or `getPrincipal` is answered as an\n * explicit `{ error: true }`.\n *\n * The worker applies only the header names the original request carried, and\n * only to the worker's own origin or the `trustedOrigins` given to\n * {@link installBackgroundSync}: an entry bound for any other origin is dropped\n * without asking this page. Matching the name is not enough on its own — a\n * request to a third party carries *that party's* `Authorization`, and until\n * 0.81.0 its replay received the app's bearer (#523). `getHeaders` still gets\n * the URL, for an app whose trusted origins need different credentials.\n *\n * Pass `getPrincipal` to bind each entry to whoever queued it: the worker asks\n * the issuing tab right after queueing, asks every tab again before replaying,\n * and drops the entry when no signed-in tab is its owner. Without it every\n * entry is `\"unbound\"` and replays with whichever session answers — the next\n * account's bearer included, unless `clearSessionData()` ran on logout — so a\n * development build warns once per call (#531). Treating an unbound\n * credentialed entry as `\"unknown\"` instead would change nothing: an\n * `\"unknown\"` entry replays when no answering tab reports a principal, which is\n * exactly the page that omits `getPrincipal`.\n *\n * @param getHeaders - Resolves the headers for one queued request at replay.\n * @param options - `getPrincipal` binds entries to their owner.\n * @returns A function that removes the listener. A no-op outside the browser.\n *\n * @example\n * import { provideBackgroundSyncCredentials } from \"tempest-react-sdk/sw\";\n *\n * const stop = provideBackgroundSyncCredentials(\n *     () => {\n *         const token = localStorage.getItem(\"token\");\n *         return token ? { Authorization: `Bearer ${token}` } : null;\n *     },\n *     { getPrincipal: () => localStorage.getItem(\"userId\") },\n * );\n */\nexport function provideBackgroundSyncCredentials(\n    getHeaders: BackgroundSyncCredentialsProvider,\n    options: ProvideBackgroundSyncCredentialsOptions = {},\n): () => void {\n    if (typeof navigator === \"undefined\" || !navigator.serviceWorker) return () => undefined;\n    const container = navigator.serviceWorker;\n    const { getPrincipal } = options;\n    if (!getPrincipal && isDevBuild()) {\n        console.warn(\n            \"[tempest-react-sdk/sw] provideBackgroundSyncCredentials() without `getPrincipal`: \" +\n                \"queued mutations are not bound to the account that made them and replay with \" +\n                \"whichever session answers next, unless clearSessionData() runs on logout. \" +\n                \"Pass { getPrincipal: () => currentUserId } to bind them.\",\n        );\n    }\n    const onMessage = (event: MessageEvent): void => {\n        const data = event.data as Partial<BackgroundSyncCredentialsRequest> & { type?: unknown };\n        const port = event.ports[0];\n        if (data?.type !== BACKGROUND_SYNC_CREDENTIALS_MESSAGE || !port) return;\n        const request: BackgroundSyncCredentialsRequest = {\n            url: String(data.url),\n            method: String(data.method),\n            phase: data.phase === \"enqueue\" ? \"enqueue\" : \"replay\",\n        };\n        void (async () => {\n            try {\n                const headers = request.phase === \"enqueue\" ? null : await getHeaders(request);\n                const answer: { headers: Record<string, string> | null; owner?: string | null } = {\n                    headers,\n                };\n                if (getPrincipal) answer.owner = await ownerFingerprint(await getPrincipal());\n                port.postMessage(answer);\n            } catch {\n                port.postMessage({ error: true });\n            }\n        })();\n    };\n    container.addEventListener(\"message\", onMessage);\n    return () => container.removeEventListener(\"message\", onMessage);\n}\n"],"mappings":";;;;AA6DA,SAASA,IAAyB;CAC9B,OAAO;AACX;AAgDA,IAAMC,IAAqB,mBAOrBC,IAAa,GACbC,IAAQ,YACRC,IAAO,QACPC,IAAY,SAMLC,IAAsC,+BAG7CC,IAAyB,KAMzBC,IAAuBD,IAAyB;AA8JtD,SAASE,EACL,GACA,GACgD;CAChD,IAAMC,IAA2B,CAAC,GAC5BC,IAAqB,CAAC;CAC5B,KAAK,IAAM,CAACC,GAAMC,MAAUC,GACxB,AAAIC,EAAkB,IAAIH,EAAK,YAAY,CAAC,IAAGD,EAAS,KAAKC,EAAK,YAAY,CAAC,IAC1EF,EAAK,KAAK,CAACE,GAAMC,CAAK,CAAC;CAEhC,OAAO;EAAE;EAAM;CAAS;AAC5B;AAOA,SAASG,EAAqB,GAAuB,GAA8C;CAC/F,IAAMC,IAAgBC,EAAM,WAAW;CACvC,EAAc,kBAAkB;EAC5B,IAAMC,IAASF,EAAc;EAC7B,IAAI,CAACE,GAAQ;EACb,IAAMC,IAAQD,EAAO,OACf,EAAE,SAAM,gBAAaV,EAAaW,EAAM,SAASL,CAAiB;EAOxE,AANAI,EAAO,OAAO;GACV,GAAGC;GACH,SAASV;GACT,iBAAiB,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAIU,EAAM,mBAAmB,CAAC,GAAI,GAAGT,CAAQ,CAAC,CAAC;GAC7E,YAAYS,EAAM,cAAc;EACpC,CAAC,GACDD,EAAO,SAAS;CACpB;AACJ;AAEA,SAASE,EACL,GACA,IAAyCC,EAAoB,GACzC;CACpB,OAAO,IAAI,SAAS,GAAS,MAAW;EACpC,IAAMC,IAAU,UAAU,KAAKX,GAAMV,CAAU;EAe/C,AAdA,EAAQ,mBAAmB,MAAU;GACjC,IAAMsB,IAAKD,EAAQ;GAMnB,AALKC,EAAG,iBAAiB,SAASrB,CAAK,IAE5BsB,EAAM,aAAa,KAAKF,EAAQ,eACvCP,EAAqBO,EAAQ,YAAY,YAAYpB,CAAK,GAAGY,CAAiB,IAF9ES,EAAG,kBAAkBrB,GAAO;IAAE,SAAS;IAAM,eAAe;GAAK,CAAC,GAIjEqB,EAAG,iBAAiB,SAASpB,CAAI,KAAGoB,EAAG,kBAAkBpB,CAAI;EACtE,GACA,EAAQ,kBAAkB;GACtB,IAAMoB,IAAKD,EAAQ;GAEnB,AADA,EAAG,wBAAwBC,EAAG,MAAM,GACpCE,EAAQF,CAAE;EACd,GACA,EAAQ,gBAAgBG,EAAOJ,EAAQ,KAAK;CAChD,CAAC;AACL;AAEA,SAASK,EAAO,GAAmC;CAC/C,OAAO,IAAI,SAAS,GAAS,MAAW;EAGpC,AAFA,EAAG,mBAAmBF,EAAQ,GAC9B,EAAG,gBAAgBC,EAAOE,EAAG,KAAK,GAClC,EAAG,gBAAgBF,EAAOE,EAAG,KAAK;CACtC,CAAC;AACL;AAGA,eAAeC,EAAU,GAAc,GAAyD;CAC5F,IAAMN,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAYpB,GAAM,UAAU,GACpC2B,IAAMF,EAAG,YAAYzB,CAAI,CAAC,CAAC,IAAIC,CAAS;CAG9C,OAFA,MAAMuB,EAAOC,CAAE,GACfL,EAAG,MAAM,GACDO,EAAI,UAAiC;AACjD;AASA,eAAeC,EACX,GACA,GACA,GACA,GAC2B;CAC3B,IAAMR,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAY,CAACrB,GAAOC,CAAI,GAAG,WAAW,GAChD6B,GACEC,IAAUL,EAAG,YAAYzB,CAAI,CAAC,CAAC,IAAIC,CAAS;CAUlD,OATA,EAAQ,kBAAkB;EACtB,KAAM6B,EAAQ,UAAiC,OAAOC,GAAO;EAC7D,IAAMC,IAAMP,EAAG,YAAY1B,CAAK,CAAC,CAAC,IAAIiB,CAAK;EAC3C,EAAI,kBAAkB;GAClB,IAAKgB,EAAI;EACb;CACJ,GACA,MAAMR,EAAOC,CAAE,GACfL,EAAG,MAAM,GACFS;AACX;AAMA,eAAeI,EACX,GACA,GACA,GACA,GACa;CACb,IAAMb,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,WAAW,GACtCe,IAAQW,EAAG,YAAY1B,CAAK,GAC5B4B,IAAMb,EAAM,IAAIe,CAAE;CASxB,AARA,EAAI,kBAAkB;EAClB,IAAMb,IAAQW,EAAI;EAClB,AAAKX,MACL,EAAM,aAAakB,GACfA,MAAe,YAAS,EAAM,QAAQC,KAAS,OACnDrB,EAAM,IAAIE,CAAK;CACnB,GACA,MAAMQ,EAAOC,CAAE,GACfL,EAAG,MAAM;AACb;AAEA,eAAegB,EACX,GACA,GACwB;CACxB,IAAMhB,IAAK,MAAMH,EAAYT,GAAMG,CAAiB,GAC9Cc,IAAKL,EAAG,YAAYrB,GAAO,UAAU,GACrCsC,IAAM,MAAM,IAAI,SAA0B,GAAS,MAAW;EAChE,IAAMC,IAAMb,EAAG,YAAY1B,CAAK,CAAC,CAAC,OAAO;EAEzC,AADA,EAAI,kBAAkBuB,EAAQgB,EAAI,MAAyB,GAC3D,EAAI,gBAAgBf,EAAOe,EAAI,KAAK;CACxC,CAAC;CAED,OADAlB,EAAG,MAAM,GACFiB;AACX;AAGA,eAAeE,EAAY,GAAc,GAA8B;CACnE,IAAMnB,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,UAAU,GACrCyC,IAAQf,EAAG,YAAY1B,CAAK,CAAC,CAAC,MAAM8B,CAAE;CAG5C,OAFA,MAAML,EAAOC,CAAE,GACfL,EAAG,MAAM,GACFoB,EAAM,SAAS;AAC1B;AAEA,eAAeC,EAAO,GAAc,GAA2B;CAC3D,IAAMrB,IAAK,MAAMH,EAAYT,CAAI,GAC3BiB,IAAKL,EAAG,YAAYrB,GAAO,WAAW;CAG5C,AAFA0B,EAAG,YAAY1B,CAAK,CAAC,CAAC,OAAO8B,CAAE,GAC/B,MAAML,EAAOC,CAAE,GACfL,EAAG,MAAM;AACb;AAMA,eAAesB,EACX,GACA,GACA,GACA,GACsB;CACtB,IAAMC,IAAS,MAAMxB,EAAQ,MAAM,CAAC,CAAC,YAAY,GAC3C,EAAE,SAAM,gBAAad,EAAac,EAAQ,QAAQ,QAAQ,GAAGR,CAAiB;CACpF,OAAO;EACH,KAAKQ,EAAQ;EACb,QAAQA,EAAQ;EAChB,SAASb;EACT,MAAMqC,EAAO,aAAa,IAAIA,IAAS;EACvC;EACA,aAAaxB,EAAQ;EACrB,iBAAiBZ;EACjB;CACJ;AACJ;AAOA,SAASqC,EACL,GACA,GAC+C;CAC/C,IAAM,EAAE,SAAM,gBAAavC,EAAaW,EAAM,SAASL,CAAiB;CACxE,OAAO;EACH,SAAS,IAAI,QAAQK,EAAM,KAAK;GAC5B,QAAQA,EAAM;GACd,SAASV;GACT,MAAMU,EAAM,QAAQ,KAAA;GACpB,aAAaA,EAAM;EACvB,CAAC;EACD,iBAAiB,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAIA,EAAM,mBAAmB,CAAC,GAAI,GAAGT,CAAQ,CAAC,CAAC;CACjF;AACJ;AAgBA,eAAesC,EACX,GACA,GACA,GACiC;CACjC,IAAMC,IAAU,IAAI,eAAe,GAC7BC,IAAS,MAAM,QAAQ,KAAK,CAC9B,IAAI,SAAkB,MAAY;EAE9B,AADA,EAAQ,MAAM,aAAa,MAAwBzB,EAAQD,EAAM,IAAI,GACrE2B,EAAO,YAAY;GAAE,MAAM9C;GAAqC,GAAGiB;EAAQ,GAAG,CAC1E2B,EAAQ,KACZ,CAAC;CACL,CAAC,GACDG,EAAS,WAAW,KAAA,CAAS,CACjC,CAAC;CAED,IADAH,EAAQ,MAAM,MAAM,GACG,OAAOC,KAAW,aAArCA,KAAiD,EAAE,aAAaA,IAAS;CAC7E,IAAM,EAAE,YAAS,aAAUA,GACrBG,IAAe,WAAWH;CAChC,IAAI,OAAgB,OAAOZ,KAAU,YAAYA,MAAU,OAC3D,OAAO;EACH,SACwB,OAAOzB,KAAY,YAAvCA,IACOA,IACD;EACV;EACA,OAAOwC,IAAgBf,IAA0B;CACrD;AACJ;AAGA,SAASgB,IAAgE;CACrE,IAAIC;CAIJ,OAAO;EAAE,SAAA,IAHW,SAAe,MAAY;GAC3C,IAAQ,WAAW9B,GAASnB,CAAsB;EACtD,CACS;EAAS,cAAc,aAAaiD,CAAK;CAAE;AACxD;AAOA,eAAeC,EACX,GACA,GACuB;CACvB,IAAMC,IAAW,MAAMC,EAAG,SAAS,SAAS,EAAE,MAAM,SAAS,CAAC,KAAM,CAAC;CACrE,IAAID,EAAQ,WAAW,GAAG,OAAO,CAAC;CAClC,IAAML,IAAWE,EAAc,GACzBK,IAAU,MAAM,QAAQ,IAC1BF,EAAQ,KAAK,MAAWT,EAAUG,GAAQ7B,GAAS8B,EAAS,OAAO,CAAC,CACxE;CAEA,OADAA,EAAS,OAAO,GACTO,EAAQ,QAAQ,MAAmCT,MAAW,KAAA,CAAS;AAClF;AASA,SAASU,EAAgB,GAA2B;CAChD,IAAMD,oBAAU,IAAI,IAAqC,GACnDE,oBAAa,IAAI,IAAY,GAC/BC,IAAS;CACb,OAAO;EACH,IAAI,GAAS;GACT,IAAMC,IAAM,GAAGzC,EAAQ,OAAO,GAAGA,EAAQ,OACrC0C,IAAUL,EAAQ,IAAII,CAAG;GAS7B,OARKC,MACD,IAAUR,EAAcE,GAAI;IACxB,KAAKpC,EAAQ;IACb,QAAQA,EAAQ;IAChB,OAAO;GACX,CAAC,GACDqC,EAAQ,IAAII,GAAKC,CAAO,IAErBA;EACX;EACA,eAAe;GACX,AAAI,MAAWC,EAAW,MAC1B,IAAS,IACT,QAAQ,KACJ,wPAIJ;EACJ;EACA,eAAe,GAAK;GAChB,IAAMC,IAAS,IAAI,IAAIC,CAAG,CAAC,CAAC;GAC5B,AAAI,GAAW,IAAID,CAAM,KAAMD,EAAW,MAC1CJ,EAAW,IAAIK,CAAM,GACrB,QAAQ,KACJ,6EAA6EA,EAAO,0CACxF;EACJ;CACJ;AACJ;AAUA,SAASE,EACL,GACA,GACwB;CACxB,QAAQC,EAAQ,YAAhB;EACI,KAAK,SACD,OAAOV,EAAQ,MAAM,MAAWT,EAAO,gBAAgBA,EAAO,UAAUmB,EAAQ,KAAK;EACzF,KAAK,WACD,OAAOV,EAAQ,OAAO,MAAW,CAACT,EAAO,YAAY,IAAIS,EAAQ,KAAK,KAAA;EAC1E,KAAK,WACD,OAAOA,EAAQ,MAAM,MAAW,CAACT,EAAO,YAAY,KAAKS,EAAQ;CACzE;AACJ;AAQA,eAAeW,EACX,GACA,GACA,GACA,GACuB;CACvB,IAAMC,IAAeF,EAAQ,gBAAgB,SAAS,GAChDG,IACFH,EAAQ,eAAe,aACtBI,MAAgB,aAAaJ,EAAQ,eAAe;CACzD,IAAI,CAACE,KAAgBC,GAAW,OAAOlD;CACvC,IAAMqC,IAAU,MAAMe,EAAI,IAAIpD,CAAO;CACrC,IAAIqC,EAAQ,WAAW,GAEnB,MADAe,EAAI,aAAa,GACP,MAAM,qCAAqC;CAEzD,IAAMC,IAASP,EAAaT,GAASU,CAAO;CAC5C,IAAI,CAACM,GAAQ,OAAO;CACpB,IAAI,CAACJ,GAAc,OAAOjD;CAC1B,IAAIqD,EAAO,YAAY,MAAM,OAAO;CACpC,IAAMC,IAAW,IAAI,IACjB,OAAO,QAAQD,EAAO,OAAO,CAAC,CAAC,KAAK,CAAChE,GAAMC,OAAW,CAACD,EAAK,YAAY,GAAGC,CAAK,CAAC,CACrF;CACA,IAAIyD,EAAQ,gBAAgB,MAAM,MAAS,CAACO,EAAS,IAAIjE,CAAI,CAAC,GAC1D,MAAU,MAAM,gEAAgE;CAEpF,IAAME,IAAU,IAAI,QAAQS,EAAQ,OAAO;CAC3C,KAAK,IAAMX,KAAQ0D,EAAQ,iBAAiB,EAAQ,IAAI1D,GAAMiE,EAAS,IAAIjE,CAAI,CAAW;CAC1F,OAAO,IAAI,QAAQW,GAAS,EAAE,WAAQ,CAAC;AAC3C;AAeA,SAASuD,EAAkB,GAAkB,GAAiD;CAC1F,OAAO,CAAC,GAAGvD,EAAQ,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,MAASR,EAAkB,IAAIH,CAAI,CAAC;AACjF;AAiBA,eAAemE,EAAY,GAAsB,GAA4B;CACzE,IAAM,EACF,OACA,SACA,mBACA,sBACA,iBACA,gBACA,yBACAC,GACEL,IAAMd,EAAgBF,CAAE,GACxBsB,IACFC,OACE,GAAkB,MAChBX,EAAoBI,GAAKpD,GAAS+C,GAASI,CAAW,IACxDS,IAAU,MAAM3C,EAAQ5B,GAAMG,CAAiB,GACjDkD,IAAU;CAEd,KAAK,IAAM7C,KAAS+D,GAAS;EACzB,IAAI/D,EAAM,OAAO,KAAA,GAAW;EAC5B,IAAIgE,IAAMhE,EAAM,YAAYiE,GAAgB;GACxC,MAAMxC,EAAOjC,GAAMQ,EAAM,EAAE;GAC3B;EACJ;EACA,IAAMkE,IAAQlE,EAAM,cAAc;EAClC,IAAIkE,MAAU,aAAaF,IAAMhE,EAAM,YAAYZ,GAAsB;GACrE,KAAW;GACX;EACJ;EACA,IAAM8B,IAAuCgD,MAAU,YAAY,YAAYA;EAC/E,IAAI;GACA,IAAM,EAAE,SAASC,GAAQ,uBAAoBvC,EACzC5B,GACAL,CACJ;GACA,IAAIyE,EAAgB,SAAS,KAAK,CAACC,EAAkBF,EAAO,GAAG,GAAG;IAE9D,AADAZ,EAAI,eAAeY,EAAO,GAAG,GAC7B,MAAM1C,EAAOjC,GAAMQ,EAAM,EAAE;IAC3B;GACJ;GACA,IAAMG,IAAU,MAAM0D,EAAQM,GAAQ;IAClC,UAAUnE,EAAM;IAChB;IACA;IACA,OAAOkB,MAAe,UAAWlB,EAAM,SAAS,OAAQ,KAAA;GAC5D,CAAC;GACD,IAAI,CAAE,MAAMuB,EAAY/B,GAAMQ,EAAM,EAAE,GAAI;GAC1C,IAAIG,MAAY,MAAM;IAClB,MAAMsB,EAAOjC,GAAMQ,EAAM,EAAE;IAC3B;GACJ;GACA,IAAI0D,EAAkBvD,GAASR,CAAiB,KAAK,CAAC0E,EAAkBlE,EAAQ,GAAG,GAAG;IAElF,AADAoD,EAAI,eAAepD,EAAQ,GAAG,GAC9B,MAAMsB,EAAOjC,GAAMQ,EAAM,EAAE;IAC3B;GACJ;GACA,IAAMsE,IAAW,MAAM,MAAMnE,CAAO;GACpC,AAAImE,EAAS,MAAOA,EAAS,UAAU,OAAOA,EAAS,SAAS,MAC5D,MAAM7C,EAAOjC,GAAMQ,EAAM,EAAE,IAE3B,KAAW;EAEnB,QAAQ;GACJ,KAAW;EACf;CACJ;CAEA,IAAI6C,IAAU,GAAG,MAAU,MAAM,oBAAoBA,EAAQ,0BAA0B;AAC3F;AAMA,IAAM0B,oBAAkB,IAAI,IAA2B;AAEvD,SAASC,EAAW,GAAqC;CACrD,IAAMC,IAAUF,EAAgB,IAAIX,EAAO,IAAI;CAC/C,IAAIa,GAAS,OAAOA;CACpB,IAAMC,IAAOf,EAAYC,GAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc;EACvD,EAAgB,OAAOA,EAAO,IAAI;CACtC,CAAC;CAED,OADAW,EAAgB,IAAIX,EAAO,MAAMc,CAAI,GAC9BA;AACX;AAEA,SAASC,EACL,GACA,GACA,GACO;CAEP,OADKC,IACE,OAAOA,KAAU,aAAaA,EAAM5B,GAAK7C,CAAO,IAAIyE,EAAM,KAAK5B,EAAI,IAAI,IAD3D;AAEvB;AAOA,eAAe6B,EACX,GACA,GACA,GACA,GACa;CACb,IAAM5C,IAAWE,EAAc,GACzBJ,IAAS,MAAMF,EACjBiD,GACA;EAAE,KAAK3E,EAAQ;EAAK,QAAQA,EAAQ;EAAQ,OAAO;CAAU,GAC7D8B,EAAS,OACb;CAOA,AANAA,EAAS,OAAO,GAMhB,MAAMhB,EAAWzB,GAAMqB,GALkBkB,IAEnCA,EAAO,eACL,UACA,YAHF,WAI4BA,GAAQ,KAAK;AACnD;AAsBA,SAAgBgD,EAAsB,IAAwC,CAAC,GAAS;CACpF,IAAMxC,IAAK3D,EAAW,GAChB,EACF,UACA,eAAYC,GACZ,yBAAsB,MACtB,qBAAkB,GAAGmG,EAAQ,aAAanG,EAAmB,YAC7D,uBAAoBoG,GACpB,iBACA,iBAAc,UACd,oBAAiB,CAAC,MAClBD,GACEzF,IAAWW,EAAoBP,CAAiB,GAChDuF,IAAe,WAAW,UAAU,QAAQ,IAC5CC,IAAuB;EACzB;EACA,MAAMC;EACN,gBAAgBC,IAAsB,KAAK;EAC3C,mBAAmB9F;EACnB;EACA;EACA,oBAAoB,MAAQ+F,EAA0BtC,GAAKkC,GAAcK,CAAc;CAC3F;CAyDA,AAvDAhD,EAAG,iBAAiB,UAAU,MAAU;EACpC,IAAMpC,IAAUE,EAAM;EACtB,IAAIF,EAAQ,WAAW,SAASA,EAAQ,WAAW,QAAQ;EAE3D,IAAM6C,IAAM,IAAI,IAAI7C,EAAQ,GAAG;EAC/B,IAAI,CAACwE,EAAQC,GAAO5B,GAAK7C,CAAO,GAAG;EAEnC,IAAMY,IAAQL,EAAU0E,GAAW7F,CAAQ;EAC3C,EAAM,YAAY,KAAA,CAAS;EAC3B,IAAMiG,IAAU,MAAMrF,EAAQ,MAAM,CAAC,GAC/BsF,IAASD,EAAQ,WACb,KAAA,GACN,YAAY;GACR,IAAMV,IAASzE,EAAM,WAAW,MAAMkC,EAAG,SAAS,IAAIlC,EAAM,QAAQ,IAAI,KAAA,GAClEL,IAAQ,MAAM0B,EAChBvB,GACA,KAAK,IAAI,GACTZ,GACAuF,IAAS,YAAY,SACzB,GACMjE,IAAK,MAAMD,EAAQwE,GAAWpF,GAAO,MAAMe,GAAOxB,CAAQ;GAChE,IAAIsB,MAAO,KAAA,GACX;QAAI;KACA,MAAM0B,EAAG,aAAa,MAAM,SAAS6C,CAAS;IAClD,QAAQ,CAER;IACA,OAAON,IAAS;KAAE;KAAI;IAAO,IAAI,KAAA;GADjC;EAEJ,CACJ;EAOA,AANAzE,EAAM,YACFmF,EAAQ,MAAM,OAAO,MAAmB;GAEpC,MADA,MAAMC,GACAC;EACV,CAAC,CACL,GACArF,EAAM,UACFoF,EACK,MAAM,MACHE,IAAQd,EAAgBO,GAAWO,EAAM,IAAIA,EAAM,QAAQxF,CAAO,IAAI,KAAA,CAC1E,CAAC,CACA,YAAY,KAAA,CAAS,CAC9B;CACJ,CAAC,GAEDoC,EAAG,iBAAiB,SAAS,MAAU;EACnC,AAAIlC,EAAM,QAAQ+E,KAClB/E,EAAM,UAAUmE,EAAWW,CAAM,CAAC;CACtC,CAAC,GAED5C,EAAG,iBAAiB,iBAAiB,MAAU;EAC3C,AAAIlC,EAAM,QAAQuF,KAClBvF,EAAM,UAAUmE,EAAWW,CAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC;CAC7D,CAAC,GAED5C,EAAG,iBAAiB,UAAU,MAAU;EACpC,AAAIA,EAAG,aAAa,QAChBlC,EAAM,QAAQ,WAAW,SAC7BA,EAAM,UAAUmE,EAAWW,CAAM,CAAC,CAAC,YAAY,KAAA,CAAS,CAAC;CAC7D,CAAC;AACL;AAsBA,eAAsBU,EAClB,IAAoBhH,GACJ;CAChB,IAAI,OAAO,YAAc,KAAa,OAAO;CAC7C,IAAMuB,IAAK,MAAMH,EAAYmF,CAAS,GAChC3E,IAAKL,EAAG,YAAY,CAACrB,GAAOC,CAAI,GAAG,WAAW;CACpD,EAAG,YAAYD,CAAK,CAAC,CAAC,MAAM;CAC5B,IAAM+G,IAAOrF,EAAG,YAAYzB,CAAI,GAC1B8B,IAAUgF,EAAK,IAAI7G,CAAS;CAMlC,OALA,EAAQ,kBAAkB;EACtB,EAAK,KAAM6B,EAAQ,UAAiC,KAAK,GAAG7B,CAAS;CACzE,GACA,MAAMuB,EAAOC,CAAE,GACfL,EAAG,MAAM,GACF;AACX;AAQA,eAAe2F,EAAiB,GAA8D;CAC1F,IAAIC,KAAc,QAAmCA,MAAc,IAAI,OAAO;CAC9E,IAAMC,IAAS,MAAM,OAAO,OAAO,OAC/B,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,mBAAmBD,GAAW,CAC3D;CACA,OAAO,CAAC,GAAG,IAAI,WAAWC,CAAM,CAAC,CAAC,CAAC,KAAK,MAASC,EAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AAChG;AAgDA,SAAgBC,EACZ,GACA,IAAmD,CAAC,GAC1C;CACV,IAAI,OAAO,YAAc,OAAe,CAAC,UAAU,eAAe,aAAa,KAAA;CAC/E,IAAMC,IAAY,UAAU,eACtB,EAAE,oBAAiBpB;CACzB,AAAI,CAACqB,KAAgBvD,EAAW,KAC5B,QAAQ,KACJ,mSAIJ;CAEJ,IAAMwD,KAAa,MAA8B;EAC7C,IAAMC,IAAOlG,EAAM,MACbmG,IAAOnG,EAAM,MAAM;EACzB,IAAIkG,GAAM,SAAA,iCAAgD,CAACC,GAAM;EACjE,IAAMrG,IAA4C;GAC9C,KAAK,OAAOoG,EAAK,GAAG;GACpB,QAAQ,OAAOA,EAAK,MAAM;GAC1B,OAAOA,EAAK,UAAU,YAAY,YAAY;EAClD;EACA,CAAM,YAAY;GACd,IAAI;IAEA,IAAMxE,IAA4E,EAC9E,SAFY5B,EAAQ,UAAU,YAAY,OAAO,MAAMsG,EAAWtG,CAAO,EAG7E;IAEA,AADIkG,MAAc,EAAO,QAAQ,MAAMN,EAAiB,MAAMM,EAAa,CAAC,IAC5EG,EAAK,YAAYzE,CAAM;GAC3B,QAAQ;IACJ,EAAK,YAAY,EAAE,OAAO,GAAK,CAAC;GACpC;EACJ,EAAA,CAAG;CACP;CAEA,OADAqE,EAAU,iBAAiB,WAAWE,CAAS,SAClCF,EAAU,oBAAoB,WAAWE,CAAS;AACnE"}

package/dist/sw/cache.cjs

@@ -1,2 +1,2 @@
-const e=require("./credential-headers.cjs");function t(){return globalThis}var n=``,r=new Set,i=`x-tempest-cached-at`;function a(e,t){if(!t)return!1;let n=Number(e.headers.get(i)),r=e.headers.get(`date`),a=n>0?n:r?new Date(r).getTime():NaN;return!Number.isNaN(a)&&(Date.now()-a)/1e3>t}function o(e){return(e.headers.get(`cache-control`)??``).toLowerCase().split(`,`).map(e=>e.trim().split(`=`)[0])}function s(e,t){if(!e.ok)return!1;let n=o(e);return n.includes(`no-store`)?!1:t.cacheAuthenticated===!0||!n.includes(`private`)}function c(t,n){return[...e.credentialHeaderSet(n.credentialHeaders)].filter(e=>t.headers.has(e))}async function l(e,t,n,r){if(!s(n,r))return;let a=new Headers(n.headers);if(a.set(i,String(Date.now())),r.cacheAuthenticated){let e=a.get(`vary`),n=(e??``).toLowerCase().split(`,`).map(e=>e.trim()),i=c(t,r).filter(e=>!n.includes(e));i.length>0&&!n.includes(`*`)&&a.set(`vary`,[e,...i].filter(Boolean).join(`, `))}let o=n.clone();await e.put(t,new Response(o.body,{status:o.status,statusText:o.statusText,headers:a})),await u(r.cacheName,r.maxEntries)}async function u(e,t){if(!t)return;let n=await caches.open(e),r=await n.keys();if(!(r.length<=t))for(let e of r.slice(0,r.length-t))await n.delete(e)}async function d(e,t){let n=await caches.open(t.cacheName),r=await n.match(e);if(r&&!a(r,t.maxAgeSeconds))return r;let i=await fetch(e);return await l(n,e,i,t),i}async function f(e,t,n){let r=await caches.open(t.cacheName),i=(async()=>{let n=await fetch(e);return await l(r,e,n,t),n})(),o=(t.networkTimeoutSeconds??0)*1e3;try{if(o>0){let e=new Promise((e,t)=>setTimeout(()=>{n(i.catch(()=>void 0)),t(Error(`network-timeout`))},o));return await Promise.race([i,e])}return await i}catch{let n=await r.match(e);if(n&&!a(n,t.maxAgeSeconds))return n;throw Error(`network-first: no network and no cache`)}}async function p(e,t,n){let r=await caches.open(t.cacheName),i=await r.match(e),o=fetch(e).then(async n=>(await l(r,e,n,t),n)).catch(()=>void 0),s=i&&!a(i,t.maxAgeSeconds)?i:void 0;if(s)return n(o),s;let c=await o;if(c)return c;throw Error(`stale-while-revalidate: no network and no cache`)}function m(e,t,n){switch(t.strategy){case`cache-first`:return d(e,t);case`network-first`:return f(e,t,n);case`stale-while-revalidate`:return p(e,t,n)}}function h(e,t,n){return typeof e.match==`function`?e.match(t,n):e.match.test(t.href)}async function g(e,t){let n=e.headers.get(`range`);if(!n)return t;let r=/^bytes=(\d*)-(\d*)$/.exec(n.trim());if(!r||r[1]===``&&r[2]===``)return new Response(null,{status:416,statusText:`Range Not Satisfiable`});let i=await t.clone().arrayBuffer(),a=i.byteLength,o,s;if(r[1]===``){let e=Number(r[2]);o=Math.max(0,a-e),s=a-1}else o=Number(r[1]),s=r[2]===``?a-1:Math.min(Number(r[2]),a-1);if(o>s||o>=a)return new Response(null,{status:416,statusText:`Range Not Satisfiable`,headers:{"Content-Range":`bytes */${a}`}});let c=i.slice(o,s+1),l=new Headers(t.headers);return l.set(`Content-Range`,`bytes ${o}-${s}/${a}`),l.set(`Content-Length`,String(c.byteLength)),l.set(`Accept-Ranges`,`bytes`),new Response(c,{status:206,statusText:`Partial Content`,headers:l})}function _(e){t().addEventListener(`fetch`,t=>{let n=t.request;if(n.method!==`GET`)return;let r=new URL(n.url),i=e.find(e=>h(e,r,n));if(!i||!i.cacheAuthenticated&&c(n,i).length>0)return;let a=e=>t.waitUntil(e);if(i.rangeRequests&&n.headers.has(`range`)){let e=new Request(n.url,{headers:v(n.headers),credentials:n.credentials,mode:n.mode===`navigate`?`same-origin`:n.mode});t.respondWith(m(e,i,a).then(e=>g(n,e)))}else t.respondWith(m(n,i,a))})}function v(e){let t=new Headers(e);return t.delete(`range`),t}function y(e={}){let i=t(),{manifestUrl:a=`/precache-manifest.json`,cacheName:o=`tempest-precache`,navigateFallback:s=`/index.html`,navigateFallbackDenylist:c=[],skipWaiting:l=!0,navigationPreload:u=!0}=e;i.addEventListener(`install`,e=>{e.waitUntil((async()=>{let e=await(await fetch(a,{cache:`no-cache`})).json();n=`${o}-${e.version}`,await(await caches.open(n)).addAll(e.urls);for(let t of e.urls)r.add(new URL(t,i.location.origin).pathname);l&&await i.skipWaiting()})())}),i.addEventListener(`activate`,e=>{e.waitUntil((async()=>{let e=await caches.keys();await Promise.all(e.filter(e=>e.startsWith(`${o}-`)&&e!==n).map(e=>caches.delete(e))),u&&i.registration?.navigationPreload&&await i.registration.navigationPreload.enable(),await i.clients.claim()})())}),i.addEventListener(`fetch`,e=>{let t=e.request;if(t.method!==`GET`)return;let a=new URL(t.url);if(a.origin===i.location.origin){if(t.mode===`navigate`){if(c.some(e=>e.test(a.pathname)))return;e.respondWith((async()=>{try{return await e.preloadResponse||await fetch(t)}catch{let e=await(await caches.open(n)).match(s);if(e)return e;throw Error(`offline and no cached app shell`)}})())}else r.has(a.pathname)&&e.respondWith((async()=>await(await caches.open(n)).match(t)??fetch(t))())}})}exports.createPartialResponse=g,exports.installPrecache=y,exports.installRuntimeCache=_;
+const e=require("./credential-headers.cjs");function t(){return globalThis}var n=``,r=new Set,i=`x-tempest-cached-at`;function a(e,t){if(!t)return!1;let n=Number(e.headers.get(i)),r=e.headers.get(`date`),a=n>0?n:r?new Date(r).getTime():NaN;return!Number.isNaN(a)&&(Date.now()-a)/1e3>t}function o(e){return(e.headers.get(`cache-control`)??``).toLowerCase().split(`,`).map(e=>e.trim().split(`=`)[0])}function s(e){return(e??``).toLowerCase().split(`,`).map(e=>e.trim())}function c(e,t){if(!e.ok||s(e.headers.get(`vary`)).includes(`*`))return!1;let n=o(e);return n.includes(`no-store`)?!1:t.cacheAuthenticated===!0||!n.includes(`private`)}function l(e,t){return e.mode===`cors`&&e.credentials===`include`||u(e,t).length>0}function u(t,n){return[...e.credentialHeaderSet(n.credentialHeaders)].filter(e=>t.headers.has(e))}async function d(e,t,n,r){if(!c(n,r))return;let a=new Headers(n.headers);if(a.set(i,String(Date.now())),r.cacheAuthenticated){let e=a.get(`vary`),n=s(e),i=u(t,r).filter(e=>!n.includes(e));i.length>0&&a.set(`vary`,[e,...i].filter(Boolean).join(`, `))}let o=n.clone();await e.put(t,new Response(o.body,{status:o.status,statusText:o.statusText,headers:a})),await f(r.cacheName,r.maxEntries)}async function f(e,t){if(!t)return;let n=await caches.open(e),r=await n.keys();if(!(r.length<=t))for(let e of r.slice(0,r.length-t))await n.delete(e)}async function p(e,t){let n=await caches.open(t.cacheName),r=await n.match(e);if(r&&!a(r,t.maxAgeSeconds))return r;let i=await fetch(e);return await d(n,e,i,t),i}async function m(e,t,n){let r=await caches.open(t.cacheName),i=(async()=>{let n=await fetch(e);return await d(r,e,n,t),n})(),o=(t.networkTimeoutSeconds??0)*1e3;try{if(o>0){let e=new Promise((e,t)=>setTimeout(()=>{n(i.catch(()=>void 0)),t(Error(`network-timeout`))},o));return await Promise.race([i,e])}return await i}catch{let n=await r.match(e);if(n&&!a(n,t.maxAgeSeconds))return n;throw Error(`network-first: no network and no cache`)}}async function h(e,t,n){let r=await caches.open(t.cacheName),i=await r.match(e),o=fetch(e).then(async n=>(await d(r,e,n,t),n)).catch(()=>void 0),s=i&&!a(i,t.maxAgeSeconds)?i:void 0;if(s)return n(o),s;let c=await o;if(c)return c;throw Error(`stale-while-revalidate: no network and no cache`)}function g(e,t,n){switch(t.strategy){case`cache-first`:return p(e,t);case`network-first`:return m(e,t,n);case`stale-while-revalidate`:return h(e,t,n)}}function _(e,t,n){return typeof e.match==`function`?e.match(t,n):e.match.test(t.href)}async function v(e,t){let n=e.headers.get(`range`);if(!n)return t;let r=/^bytes=(\d*)-(\d*)$/.exec(n.trim());if(!r||r[1]===``&&r[2]===``)return new Response(null,{status:416,statusText:`Range Not Satisfiable`});let i=await t.clone().arrayBuffer(),a=i.byteLength,o,s;if(r[1]===``){let e=Number(r[2]);o=Math.max(0,a-e),s=a-1}else o=Number(r[1]),s=r[2]===``?a-1:Math.min(Number(r[2]),a-1);if(o>s||o>=a)return new Response(null,{status:416,statusText:`Range Not Satisfiable`,headers:{"Content-Range":`bytes */${a}`}});let c=i.slice(o,s+1),l=new Headers(t.headers);return l.set(`Content-Range`,`bytes ${o}-${s}/${a}`),l.set(`Content-Length`,String(c.byteLength)),l.set(`Accept-Ranges`,`bytes`),new Response(c,{status:206,statusText:`Partial Content`,headers:l})}function y(e){t().addEventListener(`fetch`,t=>{let n=t.request;if(n.method!==`GET`)return;let r=new URL(n.url),i=e.find(e=>_(e,r,n));if(!i||!i.cacheAuthenticated&&l(n,i))return;let a=e=>t.waitUntil(e);if(i.rangeRequests&&n.headers.has(`range`)){let e=new Request(n.url,{headers:b(n.headers),credentials:n.credentials,mode:n.mode===`navigate`?`same-origin`:n.mode});t.respondWith(g(e,i,a).then(e=>v(n,e)))}else t.respondWith(g(n,i,a))})}function b(e){let t=new Headers(e);return t.delete(`range`),t}function x(e={}){let i=t(),{manifestUrl:a=`/precache-manifest.json`,cacheName:o=`tempest-precache`,navigateFallback:s=`/index.html`,navigateFallbackDenylist:c=[],skipWaiting:l=!0,navigationPreload:u=!0}=e;i.addEventListener(`install`,e=>{e.waitUntil((async()=>{let e=await(await fetch(a,{cache:`no-cache`})).json();n=`${o}-${e.version}`,await(await caches.open(n)).addAll(e.urls);for(let t of e.urls)r.add(new URL(t,i.location.origin).pathname);l&&await i.skipWaiting()})())}),i.addEventListener(`activate`,e=>{e.waitUntil((async()=>{let e=await caches.keys();await Promise.all(e.filter(e=>e.startsWith(`${o}-`)&&e!==n).map(e=>caches.delete(e))),u&&i.registration?.navigationPreload&&await i.registration.navigationPreload.enable(),await i.clients.claim()})())}),i.addEventListener(`fetch`,e=>{let t=e.request;if(t.method!==`GET`)return;let a=new URL(t.url);if(a.origin===i.location.origin){if(t.mode===`navigate`){if(c.some(e=>e.test(a.pathname)))return;e.respondWith((async()=>{try{return await e.preloadResponse||await fetch(t)}catch{let e=await(await caches.open(n)).match(s);if(e)return e;throw Error(`offline and no cached app shell`)}})())}else r.has(a.pathname)&&e.respondWith((async()=>await(await caches.open(n)).match(t)??fetch(t))())}})}exports.createPartialResponse=v,exports.installPrecache=x,exports.installRuntimeCache=y;
 //# sourceMappingURL=cache.cjs.map

package/dist/sw/cache.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cache.cjs","names":["credentialHeaderSet","require_credential_headers","getSwScope","precacheName","precachedPaths","CACHED_AT_HEADER","isExpired","maxAgeSeconds","stamp","response","dateHeader","storedAt","cacheControlDirectives","directive","isStorable","directives","route","credentialsOn","request","name","store","headers","vary","varies","missing","copy","cache","trimCache","maxEntries","cacheName","keys","key","cacheFirst","cached","networkFirst","network","timeoutMs","timeout","extend","reject","staleWhileRevalidate","fresh","runRoute","routeMatches","url","createPartialResponse","rangeHeader","match","buffer","total","start","end","suffix","slice","installRuntimeCache","event","routes","candidate","promise","full","stripRange","out","installPrecache","sw","options","manifest","manifestUrl","skipWaiting","navigationPreload","navigateFallbackDenylist","re","shell","navigateFallback"],"sources":["../../src/sw/cache.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — precache, runtime strategies (cache-first, network-\n * first, stale-while-revalidate), expiry and the inspect/clear helpers all address\n * the same Cache Storage namespace, and the naming scheme that keeps them from\n * evicting each other is the file's whole contract.\n */\n/**\n * Service-worker caching helpers — a small, dependency-free subset of what\n * Workbox provides: precaching of the build's app shell (so the app launches\n * offline) plus runtime caching strategies for fonts, APIs and images.\n *\n * Import these inside your own `sw.ts`. They run in the service-worker global\n * scope, not the main thread. Pair `installPrecache` with the\n * `tempestPwaManifest()` Vite plugin (from `tempest-react-sdk/vite`), which\n * emits the `precache-manifest.json` this reads at install time.\n *\n * @example\n *   /// <reference lib=\"webworker\" />\n *   import { installRuntimeCache, installPrecache } from \"tempest-react-sdk/sw\";\n *\n *   // Register specific routes FIRST so they win over the precache catch-all.\n *   installRuntimeCache([\n *     { match: /\\/api\\//, strategy: \"network-first\", cacheName: \"tempest-api\", maxAgeSeconds: 300 },\n *   ]);\n *   installPrecache();\n */\n\nimport { credentialHeaderSet } from \"./credential-headers\";\n\n/** Minimal shape of the events we touch, to avoid pulling in `lib.webworker`. */\ninterface ExtendableEventLike {\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface FetchEventLike extends ExtendableEventLike {\n    request: Request;\n    respondWith(response: Response | Promise<Response>): void;\n    /** Resolves to the navigation-preload response when it is enabled, else `undefined`. */\n    preloadResponse?: Promise<Response | undefined>;\n}\n\n/** Minimal shape of `registration.navigationPreload` (Navigation Preload API). */\ninterface NavigationPreloadManagerLike {\n    enable(): Promise<void>;\n    disable(): Promise<void>;\n}\n\ninterface CacheSwGlobal {\n    addEventListener(type: \"install\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"activate\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: FetchEventLike) => void): void;\n    clients: { claim(): Promise<void> };\n    skipWaiting(): Promise<void>;\n    location: { origin: string };\n    registration?: { navigationPreload?: NavigationPreloadManagerLike };\n}\n\nfunction getSwScope(): CacheSwGlobal {\n    return globalThis as unknown as CacheSwGlobal;\n}\n\n/** Caching strategy for a runtime route. Mirrors the common Workbox trio. */\nexport type RuntimeStrategy = \"cache-first\" | \"network-first\" | \"stale-while-revalidate\";\n\n/** A single runtime-caching rule, matched against each `GET` request. */\nexport interface RuntimeRoute {\n    /** A `RegExp` tested against the full URL, or a predicate over the parsed URL. */\n    match: RegExp | ((url: URL, request: Request) => boolean);\n    /** How to resolve a match. */\n    strategy: RuntimeStrategy;\n    /** Cache bucket name for this route. */\n    cacheName: string;\n    /** Trim the cache to at most this many entries (FIFO) after each write. */\n    maxEntries?: number;\n    /** Treat a cached response older than this (seconds) as a miss. */\n    maxAgeSeconds?: number;\n    /** For `network-first`: fall back to cache after this timeout (seconds). */\n    networkTimeoutSeconds?: number;\n    /**\n     * Serve HTTP `Range` requests (206 Partial Content) by slicing the cached\n     * full response. Enable for audio/video so seeking works offline. The full\n     * resource is cached once (the `Range` header is stripped before caching).\n     */\n    rangeRequests?: boolean;\n    /**\n     * Opt in to caching requests that carry a credential header (see\n     * `credentialHeaders`), and responses marked `Cache-Control: private`.\n     * Default `false`.\n     *\n     * Cache Storage is keyed by URL and outlives the session: without this\n     * gate, a `GET /api/me` stored for one account was served to the next\n     * account on the same browser whenever the network failed or exceeded\n     * `networkTimeoutSeconds` (reproduced in Chromium 153, 11/10/2026). With\n     * the default, credentialed requests bypass the route entirely and reach\n     * the network as if no service worker were installed.\n     *\n     * When enabled, every stored entry gets `Vary` on each credential header the\n     * request carried, so the Cache API only matches it for the same credential —\n     * another account (or no account) misses instead of reading it. A token\n     * rotated while online simply repopulates the entry. Pair it with\n     * `clearSessionData()` on logout, which removes the entries themselves.\n     * `Cache-Control: no-store` is never cached, opt-in or not.\n     *\n     * A cookie session is invisible here: the worker cannot see `Cookie`, and\n     * gating on `request.credentials` would switch off caching for every\n     * same-origin image and font. A cookie-authenticated API stays private only\n     * through `Cache-Control: private`/`no-store` on its responses and\n     * `clearSessionData()` on logout.\n     */\n    cacheAuthenticated?: boolean;\n    /**\n     * Header names that mark a request as credentialed. Default\n     * `DEFAULT_CREDENTIAL_HEADERS` (`authorization`, `x-api-key`,\n     * `x-auth-token`, …) — the same list the background-sync queue strips.\n     */\n    credentialHeaders?: readonly string[];\n}\n\n/** Options for {@link installPrecache}. */\nexport interface InstallPrecacheOptions {\n    /** URL of the manifest emitted by `tempestPwaManifest()`. Default `/precache-manifest.json`. */\n    manifestUrl?: string;\n    /** Cache name prefix; the manifest `version` is appended. Default `tempest-precache`. */\n    cacheName?: string;\n    /** App-shell document served for navigation requests offline. Default `/index.html`. */\n    navigateFallback?: string;\n    /** Navigation paths that should NOT use the fallback (e.g. `[/^\\/api\\//]`). */\n    navigateFallbackDenylist?: RegExp[];\n    /** Activate the new worker immediately after precaching. Default `true`. */\n    skipWaiting?: boolean;\n    /**\n     * Enable the Navigation Preload API on `activate`, so the browser fetches\n     * the navigation request in parallel with the worker boot and the handler\n     * serves `event.preloadResponse` — cutting first-navigation latency after\n     * the worker starts. Silently ignored where unsupported. Default `true`.\n     */\n    navigationPreload?: boolean;\n}\n\ninterface PrecacheManifest {\n    version: string;\n    urls: string[];\n}\n\nlet precacheName = \"\";\nconst precachedPaths = new Set<string>();\n\n/**\n * Header stamped on every runtime-cache entry with the epoch milliseconds of the\n * write. `Date` alone is not enough: it is not a CORS-safelisted response\n * header, so for a cross-origin API the worker reads `null` and `maxAgeSeconds`\n * would never expire anything.\n */\nconst CACHED_AT_HEADER = \"x-tempest-cached-at\";\n\n/**\n * Whether a cached response has aged past `maxAgeSeconds`. Reads the\n * {@link CACHED_AT_HEADER} stamp written by the runtime cache, and falls back to\n * `Date` for entries written before the stamp existed.\n */\nfunction isExpired(response: Response, maxAgeSeconds?: number): boolean {\n    if (!maxAgeSeconds) return false;\n    const stamp = Number(response.headers.get(CACHED_AT_HEADER));\n    const dateHeader = response.headers.get(\"date\");\n    const storedAt = stamp > 0 ? stamp : dateHeader ? new Date(dateHeader).getTime() : NaN;\n    if (Number.isNaN(storedAt)) return false;\n    return (Date.now() - storedAt) / 1000 > maxAgeSeconds;\n}\n\n/** The `Cache-Control` directives of a response, lower-cased. */\nfunction cacheControlDirectives(response: Response): string[] {\n    return (response.headers.get(\"cache-control\") ?? \"\")\n        .toLowerCase()\n        .split(\",\")\n        .map((directive) => directive.trim().split(\"=\")[0]);\n}\n\n/**\n * Whether a network response may be written to the route's cache: it must be\n * `ok`, never `no-store`, and `private` only under `cacheAuthenticated`.\n */\nfunction isStorable(response: Response, route: RuntimeRoute): boolean {\n    if (!response.ok) return false;\n    const directives = cacheControlDirectives(response);\n    if (directives.includes(\"no-store\")) return false;\n    return route.cacheAuthenticated === true || !directives.includes(\"private\");\n}\n\n/** The credential headers, lower-cased, that a request carries for its route. */\nfunction credentialsOn(request: Request, route: RuntimeRoute): string[] {\n    return [...credentialHeaderSet(route.credentialHeaders)].filter((name) =>\n        request.headers.has(name),\n    );\n}\n\n/**\n * Write a response to the route's cache with the {@link CACHED_AT_HEADER} stamp\n * and, under `cacheAuthenticated`, `Vary` on each credential header the request\n * carried, so the entry only matches the credential that produced it. Skips\n * responses that {@link isStorable} rejects, then trims the cache to\n * `maxEntries`.\n */\nasync function store(\n    cache: Cache,\n    request: Request,\n    response: Response,\n    route: RuntimeRoute,\n): Promise<void> {\n    if (!isStorable(response, route)) return;\n    const headers = new Headers(response.headers);\n    headers.set(CACHED_AT_HEADER, String(Date.now()));\n    if (route.cacheAuthenticated) {\n        const vary = headers.get(\"vary\");\n        const varies = (vary ?? \"\")\n            .toLowerCase()\n            .split(\",\")\n            .map((name) => name.trim());\n        const missing = credentialsOn(request, route).filter((name) => !varies.includes(name));\n        if (missing.length > 0 && !varies.includes(\"*\")) {\n            headers.set(\"vary\", [vary, ...missing].filter(Boolean).join(\", \"));\n        }\n    }\n    const copy = response.clone();\n    await cache.put(\n        request,\n        new Response(copy.body, { status: copy.status, statusText: copy.statusText, headers }),\n    );\n    await trimCache(route.cacheName, route.maxEntries);\n}\n\n/** Drop oldest entries until the cache holds at most `maxEntries`. */\nasync function trimCache(cacheName: string, maxEntries?: number): Promise<void> {\n    if (!maxEntries) return;\n    const cache = await caches.open(cacheName);\n    const keys = await cache.keys();\n    if (keys.length <= maxEntries) return;\n    for (const key of keys.slice(0, keys.length - maxEntries)) {\n        await cache.delete(key);\n    }\n}\n\nasync function cacheFirst(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n    if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n\n    const response = await fetch(request);\n    await store(cache, request, response, route);\n    return response;\n}\n\n/**\n * Network-first. When the timeout wins, the network request keeps running to\n * refresh the cache, and is handed to `extend` (`event.waitUntil`) so the\n * worker is not stopped mid-write.\n */\nasync function networkFirst(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n\n    const network = (async (): Promise<Response> => {\n        const response = await fetch(request);\n        await store(cache, request, response, route);\n        return response;\n    })();\n\n    const timeoutMs = (route.networkTimeoutSeconds ?? 0) * 1000;\n    try {\n        if (timeoutMs > 0) {\n            const timeout = new Promise<never>((_, reject) =>\n                setTimeout(() => {\n                    extend(network.catch(() => undefined));\n                    reject(new Error(\"network-timeout\"));\n                }, timeoutMs),\n            );\n            return await Promise.race([network, timeout]);\n        }\n        return await network;\n    } catch {\n        const cached = await cache.match(request);\n        if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n        throw new Error(\"network-first: no network and no cache\");\n    }\n}\n\n/**\n * Stale-while-revalidate. A fresh cached response is served at once, and the\n * revalidation is handed to `extend` (`event.waitUntil`): without it the\n * browser may stop the worker before the refreshed response is written.\n */\nasync function staleWhileRevalidate(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n\n    const network = fetch(request)\n        .then(async (response) => {\n            await store(cache, request, response, route);\n            return response;\n        })\n        .catch(() => undefined);\n\n    const fresh = cached && !isExpired(cached, route.maxAgeSeconds) ? cached : undefined;\n    if (fresh) {\n        extend(network);\n        return fresh;\n    }\n    const response = await network;\n    if (response) return response;\n    throw new Error(\"stale-while-revalidate: no network and no cache\");\n}\n\nfunction runRoute(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    switch (route.strategy) {\n        case \"cache-first\":\n            return cacheFirst(request, route);\n        case \"network-first\":\n            return networkFirst(request, route, extend);\n        case \"stale-while-revalidate\":\n            return staleWhileRevalidate(request, route, extend);\n    }\n}\n\nfunction routeMatches(route: RuntimeRoute, url: URL, request: Request): boolean {\n    return typeof route.match === \"function\"\n        ? route.match(url, request)\n        : route.match.test(url.href);\n}\n\n/**\n * Build a `206 Partial Content` response from a full one for an HTTP `Range`\n * request. Supports `bytes=start-end`, open-ended `bytes=start-` and suffix\n * `bytes=-suffixLength` (the last N bytes). Returns the original response when there is no usable\n * `Range` header, or a `416` when the range is unsatisfiable.\n *\n * @param request The incoming request (its `Range` header drives the slice).\n * @param response The full (200) response to slice.\n */\nexport async function createPartialResponse(\n    request: Request,\n    response: Response,\n): Promise<Response> {\n    const rangeHeader = request.headers.get(\"range\");\n    if (!rangeHeader) return response;\n\n    const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader.trim());\n    if (!match || (match[1] === \"\" && match[2] === \"\")) {\n        return new Response(null, { status: 416, statusText: \"Range Not Satisfiable\" });\n    }\n\n    const buffer = await response.clone().arrayBuffer();\n    const total = buffer.byteLength;\n\n    let start: number;\n    let end: number;\n    if (match[1] === \"\") {\n        const suffix = Number(match[2]);\n        start = Math.max(0, total - suffix);\n        end = total - 1;\n    } else {\n        start = Number(match[1]);\n        end = match[2] === \"\" ? total - 1 : Math.min(Number(match[2]), total - 1);\n    }\n\n    if (start > end || start >= total) {\n        return new Response(null, {\n            status: 416,\n            statusText: \"Range Not Satisfiable\",\n            headers: { \"Content-Range\": `bytes */${total}` },\n        });\n    }\n\n    const slice = buffer.slice(start, end + 1);\n    const headers = new Headers(response.headers);\n    headers.set(\"Content-Range\", `bytes ${start}-${end}/${total}`);\n    headers.set(\"Content-Length\", String(slice.byteLength));\n    headers.set(\"Accept-Ranges\", \"bytes\");\n\n    return new Response(slice, {\n        status: 206,\n        statusText: \"Partial Content\",\n        headers,\n    });\n}\n\n/**\n * Install a `fetch` handler that resolves matching `GET` requests with the\n * given runtime strategies. Non-matching requests are left untouched (no\n * `respondWith`), so a later {@link installPrecache} can handle them.\n *\n * A request carrying a credential header (`Authorization`, `X-Api-Key`, … — the\n * route's `credentialHeaders`) is also left untouched unless its route sets\n * `cacheAuthenticated`, and a response with `Cache-Control: no-store`\n * (or `private`, without that opt-in) is served but never stored. `maxAgeSeconds`\n * applies to every read, including the offline fallback: an expired entry is a\n * miss, never a last resort. Under `rangeRequests`, the full resource is cached\n * once (the `Range` header stripped) and each range is sliced from it.\n *\n * Register this BEFORE `installPrecache` so specific routes win over the\n * precache catch-all.\n *\n * @param routes Ordered rules; the first whose `match` passes handles the request.\n */\nexport function installRuntimeCache(routes: RuntimeRoute[]): void {\n    const sw = getSwScope();\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        const route = routes.find((candidate) => routeMatches(candidate, url, request));\n        if (!route) return;\n        if (!route.cacheAuthenticated && credentialsOn(request, route).length > 0) return;\n        const extend = (promise: Promise<unknown>): void => event.waitUntil(promise);\n\n        if (route.rangeRequests && request.headers.has(\"range\")) {\n            const full = new Request(request.url, {\n                headers: stripRange(request.headers),\n                credentials: request.credentials,\n                mode: request.mode === \"navigate\" ? \"same-origin\" : request.mode,\n            });\n            event.respondWith(\n                runRoute(full, route, extend).then((response) =>\n                    createPartialResponse(request, response),\n                ),\n            );\n            return;\n        }\n\n        event.respondWith(runRoute(request, route, extend));\n    });\n}\n\n/** Copy headers without the `Range` header (so the cached entry is the full file). */\nfunction stripRange(headers: Headers): Headers {\n    const out = new Headers(headers);\n    out.delete(\"range\");\n    return out;\n}\n\n/**\n * Precache the app shell at `install` and serve it offline:\n *  - reads `precache-manifest.json` (emitted by `tempestPwaManifest()`),\n *  - caches every listed URL under a versioned cache,\n *  - on `activate`, deletes stale precache versions and claims open clients,\n *  - on `fetch`, serves precached assets cache-first and falls back to the\n *    `navigateFallback` document for offline navigations (SPA routing).\n *\n * Same-origin only. Register this LAST, after any {@link installRuntimeCache}.\n */\nexport function installPrecache(options: InstallPrecacheOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        manifestUrl = \"/precache-manifest.json\",\n        cacheName = \"tempest-precache\",\n        navigateFallback = \"/index.html\",\n        navigateFallbackDenylist = [],\n        skipWaiting = true,\n        navigationPreload = true,\n    } = options;\n\n    sw.addEventListener(\"install\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const response = await fetch(manifestUrl, { cache: \"no-cache\" });\n                const manifest = (await response.json()) as PrecacheManifest;\n                precacheName = `${cacheName}-${manifest.version}`;\n\n                const cache = await caches.open(precacheName);\n                await cache.addAll(manifest.urls);\n                for (const url of manifest.urls) {\n                    precachedPaths.add(new URL(url, sw.location.origin).pathname);\n                }\n                if (skipWaiting) await sw.skipWaiting();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"activate\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const keys = await caches.keys();\n                await Promise.all(\n                    keys\n                        .filter((key) => key.startsWith(`${cacheName}-`) && key !== precacheName)\n                        .map((key) => caches.delete(key)),\n                );\n                if (navigationPreload && sw.registration?.navigationPreload) {\n                    await sw.registration.navigationPreload.enable();\n                }\n                await sw.clients.claim();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        if (url.origin !== sw.location.origin) return;\n\n        // SPA navigations: serve the cached app shell when offline.\n        if (request.mode === \"navigate\") {\n            if (navigateFallbackDenylist.some((re) => re.test(url.pathname))) return;\n            event.respondWith(\n                (async () => {\n                    try {\n                        const preloaded = await event.preloadResponse;\n                        if (preloaded) return preloaded;\n                        return await fetch(request);\n                    } catch {\n                        const cache = await caches.open(precacheName);\n                        const shell = await cache.match(navigateFallback);\n                        if (shell) return shell;\n                        throw new Error(\"offline and no cached app shell\");\n                    }\n                })(),\n            );\n            return;\n        }\n\n        // Precached static assets: cache-first.\n        if (precachedPaths.has(url.pathname)) {\n            event.respondWith(\n                (async () => {\n                    const cache = await caches.open(precacheName);\n                    const cached = await cache.match(request);\n                    return cached ?? fetch(request);\n                })(),\n            );\n        }\n    });\n}\n"],"mappings":"A,4CAyDA,SAASE,GAA4B,CACjC,OAAO,UACX,CAqFA,IAAIC,EAAe,GACbC,EAAiB,IAAI,IAQrBC,EAAmB,sBAOzB,SAASC,EAAU,EAAoB,EAAiC,CACpE,GAAI,CAACC,EAAe,MAAO,GAC3B,IAAMC,EAAQ,OAAOC,EAAS,QAAQ,IAAIJ,CAAgB,CAAC,EACrDK,EAAaD,EAAS,QAAQ,IAAI,MAAM,EACxCE,EAAWH,EAAQ,EAAIA,EAAQE,EAAa,IAAI,KAAKA,CAAU,CAAC,CAAC,QAAQ,EAAI,IAEnF,MADA,CAAI,OAAO,MAAMC,CAAQ,IACjB,KAAK,IAAI,EAAIA,GAAY,IAAOJ,CAC5C,CAGA,SAASK,EAAuB,EAA8B,CAC1D,OAAQH,EAAS,QAAQ,IAAI,eAAe,GAAK,GAAA,CAC5C,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,IAAK,GAAcI,EAAU,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAC1D,CAMA,SAASC,EAAW,EAAoB,EAA8B,CAClE,GAAI,CAACL,EAAS,GAAI,MAAO,GACzB,IAAMM,EAAaH,EAAuBH,CAAQ,EAElD,OADIM,EAAW,SAAS,UAAU,EAAU,GACrCC,EAAM,qBAAuB,IAAQ,CAACD,EAAW,SAAS,SAAS,CAC9E,CAGA,SAASE,EAAc,EAAkB,EAA+B,CACpE,MAAO,CAAC,GAAGjB,EAAAA,oBAAoBgB,EAAM,iBAAiB,CAAC,CAAC,CAAC,OAAQ,GAC7DE,EAAQ,QAAQ,IAAIC,CAAI,CAC5B,CACJ,CASA,eAAeC,EACX,EACA,EACA,EACA,EACa,CACb,GAAI,CAACN,EAAWL,EAAUO,CAAK,EAAG,OAClC,IAAMK,EAAU,IAAI,QAAQZ,EAAS,OAAO,EAE5C,GADAY,EAAQ,IAAIhB,EAAkB,OAAO,KAAK,IAAI,CAAC,CAAC,EAC5CW,EAAM,mBAAoB,CAC1B,IAAMM,EAAOD,EAAQ,IAAI,MAAM,EACzBE,GAAUD,GAAQ,GAAA,CACnB,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,IAAK,GAASH,EAAK,KAAK,CAAC,EACxBK,EAAUP,EAAcC,EAASF,CAAK,CAAC,CAAC,OAAQ,GAAS,CAACO,EAAO,SAASJ,CAAI,CAAC,EACjFK,EAAQ,OAAS,GAAK,CAACD,EAAO,SAAS,GAAG,GAC1CF,EAAQ,IAAI,OAAQ,CAACC,EAAM,GAAGE,CAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAEzE,CACA,IAAMC,EAAOhB,EAAS,MAAM,EAC5B,MAAMiB,EAAM,IACRR,EACA,IAAI,SAASO,EAAK,KAAM,CAAE,OAAQA,EAAK,OAAQ,WAAYA,EAAK,WAAY,SAAQ,CAAC,CACzF,EACA,MAAME,EAAUX,EAAM,UAAWA,EAAM,UAAU,CACrD,CAGA,eAAeW,EAAU,EAAmB,EAAoC,CAC5E,GAAI,CAACC,EAAY,OACjB,IAAMF,EAAQ,MAAM,OAAO,KAAKG,CAAS,EACnCC,EAAO,MAAMJ,EAAM,KAAK,EAC9B,GAAI,IAAK,QAAUE,GACnB,IAAK,IAAMG,KAAOD,EAAK,MAAM,EAAGA,EAAK,OAASF,CAAU,EACpD,MAAMF,EAAM,OAAOK,CAAG,CAE9B,CAEA,eAAeC,EAAW,EAAkB,EAAwC,CAChF,IAAMN,EAAQ,MAAM,OAAO,KAAKV,EAAM,SAAS,EACzCiB,EAAS,MAAMP,EAAM,MAAMR,CAAO,EACxC,GAAIe,GAAU,CAAC3B,EAAU2B,EAAQjB,EAAM,aAAa,EAAG,OAAOiB,EAE9D,IAAMxB,EAAW,MAAM,MAAMS,CAAO,EAEpC,OADA,MAAME,EAAMM,EAAOR,EAAST,EAAUO,CAAK,EACpCP,CACX,CAOA,eAAeyB,EACX,EACA,EACA,EACiB,CACjB,IAAMR,EAAQ,MAAM,OAAO,KAAKV,EAAM,SAAS,EAEzCmB,GAAW,SAA+B,CAC5C,IAAM1B,EAAW,MAAM,MAAMS,CAAO,EAEpC,OADA,MAAME,EAAMM,EAAOR,EAAST,EAAUO,CAAK,EACpCP,CACX,EAAA,CAAG,EAEG2B,GAAapB,EAAM,uBAAyB,GAAK,IACvD,GAAI,CACA,GAAIoB,EAAY,EAAG,CACf,IAAMC,EAAU,IAAI,SAAgB,EAAG,IACnC,eAAiB,CACbC,EAAOH,EAAQ,UAAY,IAAA,EAAS,CAAC,EACrCI,EAAW,MAAM,iBAAiB,CAAC,CACvC,EAAGH,CAAS,CAChB,EACA,OAAO,MAAM,QAAQ,KAAK,CAACD,EAASE,CAAO,CAAC,CAChD,CACA,OAAO,MAAMF,CACjB,MAAQ,CACJ,IAAMF,EAAS,MAAMP,EAAM,MAAMR,CAAO,EACxC,GAAIe,GAAU,CAAC3B,EAAU2B,EAAQjB,EAAM,aAAa,EAAG,OAAOiB,EAC9D,MAAU,MAAM,wCAAwC,CAC5D,CACJ,CAOA,eAAeO,EACX,EACA,EACA,EACiB,CACjB,IAAMd,EAAQ,MAAM,OAAO,KAAKV,EAAM,SAAS,EACzCiB,EAAS,MAAMP,EAAM,MAAMR,CAAO,EAElCiB,EAAU,MAAMjB,CAAO,CAAC,CACzB,KAAK,KAAO,KACT,MAAME,EAAMM,EAAOR,EAAST,EAAUO,CAAK,EACpCP,EACV,CAAC,CACD,UAAY,IAAA,EAAS,EAEpBgC,EAAQR,GAAU,CAAC3B,EAAU2B,EAAQjB,EAAM,aAAa,EAAIiB,EAAS,IAAA,GAC3E,GAAIQ,EAEA,OADAH,EAAOH,CAAO,EACPM,EAEX,IAAMhC,EAAW,MAAM0B,EACvB,GAAI1B,EAAU,OAAOA,EACrB,MAAU,MAAM,iDAAiD,CACrE,CAEA,SAASiC,EACL,EACA,EACA,EACiB,CACjB,OAAQ1B,EAAM,SAAd,CACI,IAAK,cACD,OAAOgB,EAAWd,EAASF,CAAK,EACpC,IAAK,gBACD,OAAOkB,EAAahB,EAASF,EAAOsB,CAAM,EAC9C,IAAK,yBACD,OAAOE,EAAqBtB,EAASF,EAAOsB,CAAM,CAC1D,CACJ,CAEA,SAASK,EAAa,EAAqB,EAAU,EAA2B,CAC5E,OAAO,OAAO3B,EAAM,OAAU,WACxBA,EAAM,MAAM4B,EAAK1B,CAAO,EACxBF,EAAM,MAAM,KAAK4B,EAAI,IAAI,CACnC,CAWA,eAAsBC,EAClB,EACA,EACiB,CACjB,IAAMC,EAAc5B,EAAQ,QAAQ,IAAI,OAAO,EAC/C,GAAI,CAAC4B,EAAa,OAAOrC,EAEzB,IAAMsC,EAAQ,sBAAsB,KAAKD,EAAY,KAAK,CAAC,EAC3D,GAAI,CAACC,GAAUA,EAAM,KAAO,IAAMA,EAAM,KAAO,GAC3C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,WAAY,uBAAwB,CAAC,EAGlF,IAAMC,EAAS,MAAMvC,EAAS,MAAM,CAAC,CAAC,YAAY,EAC5CwC,EAAQD,EAAO,WAEjBE,EACAC,EACJ,GAAIJ,EAAM,KAAO,GAAI,CACjB,IAAMK,EAAS,OAAOL,EAAM,EAAE,EAC9B,EAAQ,KAAK,IAAI,EAAGE,EAAQG,CAAM,EAClC,EAAMH,EAAQ,CAClB,KACI,GAAQ,OAAOF,EAAM,EAAE,EACvB,EAAMA,EAAM,KAAO,GAAKE,EAAQ,EAAI,KAAK,IAAI,OAAOF,EAAM,EAAE,EAAGE,EAAQ,CAAC,EAG5E,GAAIC,EAAQC,GAAOD,GAASD,EACxB,OAAO,IAAI,SAAS,KAAM,CACtB,OAAQ,IACR,WAAY,wBACZ,QAAS,CAAE,gBAAiB,WAAWA,GAAQ,CACnD,CAAC,EAGL,IAAMI,EAAQL,EAAO,MAAME,EAAOC,EAAM,CAAC,EACnC9B,EAAU,IAAI,QAAQZ,EAAS,OAAO,EAK5C,OAJAY,EAAQ,IAAI,gBAAiB,SAAS6B,EAAM,GAAGC,EAAI,GAAGF,GAAO,EAC7D5B,EAAQ,IAAI,iBAAkB,OAAOgC,EAAM,UAAU,CAAC,EACtDhC,EAAQ,IAAI,gBAAiB,OAAO,EAE7B,IAAI,SAASgC,EAAO,CACvB,OAAQ,IACR,WAAY,kBACZ,SACJ,CAAC,CACL,CAoBA,SAAgBC,EAAoB,EAA8B,CAE9DpD,EAAA,CAAA,CAAG,iBAAiB,QAAU,GAAU,CACpC,IAAMgB,EAAUqC,EAAM,QACtB,GAAIrC,EAAQ,SAAW,MAAO,OAE9B,IAAM0B,EAAM,IAAI,IAAI1B,EAAQ,GAAG,EACzBF,EAAQwC,EAAO,KAAM,GAAcb,EAAac,EAAWb,EAAK1B,CAAO,CAAC,EAE9E,GADI,CAACF,GACD,CAACA,EAAM,oBAAsBC,EAAcC,EAASF,CAAK,CAAC,CAAC,OAAS,EAAG,OAC3E,IAAMsB,EAAU,GAAoCiB,EAAM,UAAUG,CAAO,EAE3E,GAAI1C,EAAM,eAAiBE,EAAQ,QAAQ,IAAI,OAAO,EAAG,CACrD,IAAMyC,EAAO,IAAI,QAAQzC,EAAQ,IAAK,CAClC,QAAS0C,EAAW1C,EAAQ,OAAO,EACnC,YAAaA,EAAQ,YACrB,KAAMA,EAAQ,OAAS,WAAa,cAAgBA,EAAQ,IAChE,CAAC,EACDqC,EAAM,YACFb,EAASiB,EAAM3C,EAAOsB,CAAM,CAAC,CAAC,KAAM,GAChCO,EAAsB3B,EAAST,CAAQ,CAC3C,CACJ,CAEJ,MAEA8C,EAAM,YAAYb,EAASxB,EAASF,EAAOsB,CAAM,CAAC,CACtD,CAAC,CACL,CAGA,SAASsB,EAAW,EAA2B,CAC3C,IAAMC,EAAM,IAAI,QAAQxC,CAAO,EAE/B,OADAwC,EAAI,OAAO,OAAO,EACXA,CACX,CAYA,SAAgBC,EAAgB,EAAkC,CAAC,EAAS,CACxE,IAAMC,EAAK7D,EAAW,EAChB,CACF,cAAc,0BACd,YAAY,mBACZ,mBAAmB,cACnB,2BAA2B,CAAC,EAC5B,cAAc,GACd,oBAAoB,IACpB8D,EAEJD,EAAG,iBAAiB,UAAY,GAAU,CACtCR,EAAM,WACD,SAAY,CAET,IAAMU,EAAY,MAAM,MADD,MAAMC,EAAa,CAAE,MAAO,UAAW,CAAC,EAAA,CAC9B,KAAK,EACtC,EAAe,GAAGrC,EAAU,GAAGoC,EAAS,UAGxC,MAAM,MADc,OAAO,KAAK9D,CAAY,EAAA,CAChC,OAAO8D,EAAS,IAAI,EAChC,IAAK,IAAMrB,KAAOqB,EAAS,KACvB7D,EAAe,IAAI,IAAI,IAAIwC,EAAKmB,EAAG,SAAS,MAAM,CAAC,CAAC,QAAQ,EAE5DI,GAAa,MAAMJ,EAAG,YAAY,CAC1C,EAAA,CAAG,CACP,CACJ,CAAC,EAEDA,EAAG,iBAAiB,WAAa,GAAU,CACvCR,EAAM,WACD,SAAY,CACT,IAAMzB,EAAO,MAAM,OAAO,KAAK,EAC/B,MAAM,QAAQ,IACVA,EACK,OAAQ,GAAQC,EAAI,WAAW,GAAGF,EAAU,EAAE,GAAKE,IAAQ5B,CAAY,CAAC,CACxE,IAAK,GAAQ,OAAO,OAAO4B,CAAG,CAAC,CACxC,EACIqC,GAAqBL,EAAG,cAAc,mBACtC,MAAMA,EAAG,aAAa,kBAAkB,OAAO,EAEnD,MAAMA,EAAG,QAAQ,MAAM,CAC3B,EAAA,CAAG,CACP,CACJ,CAAC,EAEDA,EAAG,iBAAiB,QAAU,GAAU,CACpC,IAAM7C,EAAUqC,EAAM,QACtB,GAAIrC,EAAQ,SAAW,MAAO,OAE9B,IAAM0B,EAAM,IAAI,IAAI1B,EAAQ,GAAG,EAC/B,GAAI0B,EAAI,SAAWmB,EAAG,SAAS,OAG/B,IAAI7C,EAAQ,OAAS,WAAY,CAC7B,GAAImD,EAAyB,KAAM,GAAOC,EAAG,KAAK1B,EAAI,QAAQ,CAAC,EAAG,OAClEW,EAAM,aACD,SAAY,CACT,GAAI,CAGA,OADI,MADoBA,EAAM,iBAEvB,MAAM,MAAMrC,CAAO,CAC9B,MAAQ,CAEJ,IAAMqD,EAAQ,MAAM,MADA,OAAO,KAAKpE,CAAY,EAAA,CAClB,MAAMqE,CAAgB,EAChD,GAAID,EAAO,OAAOA,EAClB,MAAU,MAAM,iCAAiC,CACrD,CACJ,EAAA,CAAG,CACP,CAEJ,MAGInE,EAAe,IAAIwC,EAAI,QAAQ,GAC/BW,EAAM,aACD,SAGU,MADc,MADD,OAAO,KAAKpD,CAAY,EAAA,CACjB,MAAMe,CAAO,GACvB,MAAMA,CAAO,EAClC,CAAG,CACP,CAVJ,CAYJ,CAAC,CACL,C"}
+{"version":3,"file":"cache.cjs","names":["credentialHeaderSet","require_credential_headers","getSwScope","precacheName","precachedPaths","CACHED_AT_HEADER","isExpired","maxAgeSeconds","stamp","response","dateHeader","storedAt","cacheControlDirectives","directive","varyNames","vary","name","isStorable","directives","route","isCredentialed","request","credentialsOn","store","headers","varies","missing","copy","cache","trimCache","maxEntries","cacheName","keys","key","cacheFirst","cached","networkFirst","network","timeoutMs","timeout","extend","reject","staleWhileRevalidate","fresh","runRoute","routeMatches","url","createPartialResponse","rangeHeader","match","buffer","total","start","end","suffix","slice","installRuntimeCache","event","routes","candidate","promise","full","stripRange","out","installPrecache","sw","options","manifest","manifestUrl","skipWaiting","navigationPreload","navigateFallbackDenylist","re","shell","navigateFallback"],"sources":["../../src/sw/cache.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines — precache, runtime strategies (cache-first, network-\n * first, stale-while-revalidate), expiry and the inspect/clear helpers all address\n * the same Cache Storage namespace, and the naming scheme that keeps them from\n * evicting each other is the file's whole contract.\n */\n/**\n * Service-worker caching helpers — a small, dependency-free subset of what\n * Workbox provides: precaching of the build's app shell (so the app launches\n * offline) plus runtime caching strategies for fonts, APIs and images.\n *\n * Import these inside your own `sw.ts`. They run in the service-worker global\n * scope, not the main thread. Pair `installPrecache` with the\n * `tempestPwaManifest()` Vite plugin (from `tempest-react-sdk/vite`), which\n * emits the `precache-manifest.json` this reads at install time.\n *\n * @example\n *   /// <reference lib=\"webworker\" />\n *   import { installRuntimeCache, installPrecache } from \"tempest-react-sdk/sw\";\n *\n *   // Register specific routes FIRST so they win over the precache catch-all.\n *   installRuntimeCache([\n *     { match: /\\/api\\//, strategy: \"network-first\", cacheName: \"tempest-api\", maxAgeSeconds: 300 },\n *   ]);\n *   installPrecache();\n */\n\nimport { credentialHeaderSet } from \"./credential-headers\";\n\n/** Minimal shape of the events we touch, to avoid pulling in `lib.webworker`. */\ninterface ExtendableEventLike {\n    waitUntil(promise: Promise<unknown>): void;\n}\n\ninterface FetchEventLike extends ExtendableEventLike {\n    request: Request;\n    respondWith(response: Response | Promise<Response>): void;\n    /** Resolves to the navigation-preload response when it is enabled, else `undefined`. */\n    preloadResponse?: Promise<Response | undefined>;\n}\n\n/** Minimal shape of `registration.navigationPreload` (Navigation Preload API). */\ninterface NavigationPreloadManagerLike {\n    enable(): Promise<void>;\n    disable(): Promise<void>;\n}\n\ninterface CacheSwGlobal {\n    addEventListener(type: \"install\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"activate\", listener: (event: ExtendableEventLike) => void): void;\n    addEventListener(type: \"fetch\", listener: (event: FetchEventLike) => void): void;\n    clients: { claim(): Promise<void> };\n    skipWaiting(): Promise<void>;\n    location: { origin: string };\n    registration?: { navigationPreload?: NavigationPreloadManagerLike };\n}\n\nfunction getSwScope(): CacheSwGlobal {\n    return globalThis as unknown as CacheSwGlobal;\n}\n\n/** Caching strategy for a runtime route. Mirrors the common Workbox trio. */\nexport type RuntimeStrategy = \"cache-first\" | \"network-first\" | \"stale-while-revalidate\";\n\n/** A single runtime-caching rule, matched against each `GET` request. */\nexport interface RuntimeRoute {\n    /** A `RegExp` tested against the full URL, or a predicate over the parsed URL. */\n    match: RegExp | ((url: URL, request: Request) => boolean);\n    /** How to resolve a match. */\n    strategy: RuntimeStrategy;\n    /** Cache bucket name for this route. */\n    cacheName: string;\n    /** Trim the cache to at most this many entries (FIFO) after each write. */\n    maxEntries?: number;\n    /** Treat a cached response older than this (seconds) as a miss. */\n    maxAgeSeconds?: number;\n    /** For `network-first`: fall back to cache after this timeout (seconds). */\n    networkTimeoutSeconds?: number;\n    /**\n     * Serve HTTP `Range` requests (206 Partial Content) by slicing the cached\n     * full response. Enable for audio/video so seeking works offline. The full\n     * resource is cached once (the `Range` header is stripped before caching).\n     */\n    rangeRequests?: boolean;\n    /**\n     * Opt in to caching credentialed requests — those that carry a credential\n     * header (see `credentialHeaders`) or are a CORS-mode `fetch` sent with\n     * `credentials: \"include\"` — and responses marked `Cache-Control: private`.\n     * Default `false`.\n     *\n     * Cache Storage is keyed by URL and outlives the session: without this\n     * gate, a `GET /api/me` stored for one account was served to the next\n     * account on the same browser whenever the network failed or exceeded\n     * `networkTimeoutSeconds` (reproduced in Chromium 153, 11/10/2026). With\n     * the default, credentialed requests bypass the route entirely and reach\n     * the network as if no service worker were installed.\n     *\n     * When enabled, every stored entry gets `Vary` on each credential header the\n     * request carried, so the Cache API only matches it for the same credential —\n     * another account (or no account) misses instead of reading it. A token\n     * rotated while online simply repopulates the entry. Pair it with\n     * `clearSessionData()` on logout, which removes the entries themselves.\n     * `Cache-Control: no-store` is never cached, opt-in or not.\n     *\n     * A cookie session is only partly visible here: the worker cannot see\n     * `Cookie`. What it can see is a `fetch` that asked for cookies explicitly —\n     * `mode: \"cors\"` with `credentials: \"include\"`, which is what `ApiClient`\n     * sends under `withCredentials` — and since 0.82.0 that request is treated\n     * as credentialed too (#531). `<img>`, `<audio>` and `<video>` also send\n     * `credentials: \"include\"`, but in `no-cors` mode, so they keep caching. A\n     * plain same-origin `fetch` (`credentials: \"same-origin\"`, the default)\n     * carries the cookie without saying so; such an API stays private only\n     * through `Cache-Control: private`/`no-store` on its responses and\n     * `clearSessionData()` on logout. Opting a cookie request in caches it by\n     * URL — there is no credential header to vary on — so `clearSessionData()`\n     * is then its only isolation.\n     */\n    cacheAuthenticated?: boolean;\n    /**\n     * Header names that mark a request as credentialed. Default\n     * `DEFAULT_CREDENTIAL_HEADERS` (`authorization`, `x-api-key`,\n     * `x-auth-token`, …) — the same list the background-sync queue strips.\n     */\n    credentialHeaders?: readonly string[];\n}\n\n/** Options for {@link installPrecache}. */\nexport interface InstallPrecacheOptions {\n    /** URL of the manifest emitted by `tempestPwaManifest()`. Default `/precache-manifest.json`. */\n    manifestUrl?: string;\n    /** Cache name prefix; the manifest `version` is appended. Default `tempest-precache`. */\n    cacheName?: string;\n    /** App-shell document served for navigation requests offline. Default `/index.html`. */\n    navigateFallback?: string;\n    /** Navigation paths that should NOT use the fallback (e.g. `[/^\\/api\\//]`). */\n    navigateFallbackDenylist?: RegExp[];\n    /** Activate the new worker immediately after precaching. Default `true`. */\n    skipWaiting?: boolean;\n    /**\n     * Enable the Navigation Preload API on `activate`, so the browser fetches\n     * the navigation request in parallel with the worker boot and the handler\n     * serves `event.preloadResponse` — cutting first-navigation latency after\n     * the worker starts. Silently ignored where unsupported. Default `true`.\n     */\n    navigationPreload?: boolean;\n}\n\ninterface PrecacheManifest {\n    version: string;\n    urls: string[];\n}\n\nlet precacheName = \"\";\nconst precachedPaths = new Set<string>();\n\n/**\n * Header stamped on every runtime-cache entry with the epoch milliseconds of the\n * write. `Date` alone is not enough: it is not a CORS-safelisted response\n * header, so for a cross-origin API the worker reads `null` and `maxAgeSeconds`\n * would never expire anything.\n */\nconst CACHED_AT_HEADER = \"x-tempest-cached-at\";\n\n/**\n * Whether a cached response has aged past `maxAgeSeconds`. Reads the\n * {@link CACHED_AT_HEADER} stamp written by the runtime cache, and falls back to\n * `Date` for entries written before the stamp existed.\n */\nfunction isExpired(response: Response, maxAgeSeconds?: number): boolean {\n    if (!maxAgeSeconds) return false;\n    const stamp = Number(response.headers.get(CACHED_AT_HEADER));\n    const dateHeader = response.headers.get(\"date\");\n    const storedAt = stamp > 0 ? stamp : dateHeader ? new Date(dateHeader).getTime() : NaN;\n    if (Number.isNaN(storedAt)) return false;\n    return (Date.now() - storedAt) / 1000 > maxAgeSeconds;\n}\n\n/** The `Cache-Control` directives of a response, lower-cased. */\nfunction cacheControlDirectives(response: Response): string[] {\n    return (response.headers.get(\"cache-control\") ?? \"\")\n        .toLowerCase()\n        .split(\",\")\n        .map((directive) => directive.trim().split(\"=\")[0]);\n}\n\n/** The comma-separated names of a response's `Vary` header, trimmed and lower-cased. */\nfunction varyNames(vary: string | null): string[] {\n    return (vary ?? \"\")\n        .toLowerCase()\n        .split(\",\")\n        .map((name) => name.trim());\n}\n\n/**\n * Whether a network response may be written to the route's cache: it must be\n * `ok`, never `no-store`, never `Vary: *`, and `private` only under\n * `cacheAuthenticated`.\n *\n * `Vary: *` says no later request can be proven to match, and `Cache.put`\n * rejects it with a `TypeError`. Before 0.82.0 that rejection escaped the\n * strategy, so a response the network had delivered became the offline\n * fallback path (network-first), an error (cache-first) or nothing at all\n * (stale-while-revalidate) (#534).\n */\nfunction isStorable(response: Response, route: RuntimeRoute): boolean {\n    if (!response.ok) return false;\n    if (varyNames(response.headers.get(\"vary\")).includes(\"*\")) return false;\n    const directives = cacheControlDirectives(response);\n    if (directives.includes(\"no-store\")) return false;\n    return route.cacheAuthenticated === true || !directives.includes(\"private\");\n}\n\n/**\n * Whether a request is session-bound for its route: it carries a credential\n * header, or it is a CORS `fetch` that asked for cookies with\n * `credentials: \"include\"` (`ApiClient` under `withCredentials`). A `no-cors`\n * request — `<img>`, `<audio>`, `<video>` — also sends `include` by default and\n * is not counted, or every image would bypass the cache.\n */\nfunction isCredentialed(request: Request, route: RuntimeRoute): boolean {\n    if (request.mode === \"cors\" && request.credentials === \"include\") return true;\n    return credentialsOn(request, route).length > 0;\n}\n\n/** The credential headers, lower-cased, that a request carries for its route. */\nfunction credentialsOn(request: Request, route: RuntimeRoute): string[] {\n    return [...credentialHeaderSet(route.credentialHeaders)].filter((name) =>\n        request.headers.has(name),\n    );\n}\n\n/**\n * Write a response to the route's cache with the {@link CACHED_AT_HEADER} stamp\n * and, under `cacheAuthenticated`, `Vary` on each credential header the request\n * carried, so the entry only matches the credential that produced it. Skips\n * responses that {@link isStorable} rejects, then trims the cache to\n * `maxEntries`.\n */\nasync function store(\n    cache: Cache,\n    request: Request,\n    response: Response,\n    route: RuntimeRoute,\n): Promise<void> {\n    if (!isStorable(response, route)) return;\n    const headers = new Headers(response.headers);\n    headers.set(CACHED_AT_HEADER, String(Date.now()));\n    if (route.cacheAuthenticated) {\n        const vary = headers.get(\"vary\");\n        const varies = varyNames(vary);\n        const missing = credentialsOn(request, route).filter((name) => !varies.includes(name));\n        if (missing.length > 0) {\n            headers.set(\"vary\", [vary, ...missing].filter(Boolean).join(\", \"));\n        }\n    }\n    const copy = response.clone();\n    await cache.put(\n        request,\n        new Response(copy.body, { status: copy.status, statusText: copy.statusText, headers }),\n    );\n    await trimCache(route.cacheName, route.maxEntries);\n}\n\n/** Drop oldest entries until the cache holds at most `maxEntries`. */\nasync function trimCache(cacheName: string, maxEntries?: number): Promise<void> {\n    if (!maxEntries) return;\n    const cache = await caches.open(cacheName);\n    const keys = await cache.keys();\n    if (keys.length <= maxEntries) return;\n    for (const key of keys.slice(0, keys.length - maxEntries)) {\n        await cache.delete(key);\n    }\n}\n\nasync function cacheFirst(request: Request, route: RuntimeRoute): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n    if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n\n    const response = await fetch(request);\n    await store(cache, request, response, route);\n    return response;\n}\n\n/**\n * Network-first. When the timeout wins, the network request keeps running to\n * refresh the cache, and is handed to `extend` (`event.waitUntil`) so the\n * worker is not stopped mid-write.\n */\nasync function networkFirst(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n\n    const network = (async (): Promise<Response> => {\n        const response = await fetch(request);\n        await store(cache, request, response, route);\n        return response;\n    })();\n\n    const timeoutMs = (route.networkTimeoutSeconds ?? 0) * 1000;\n    try {\n        if (timeoutMs > 0) {\n            const timeout = new Promise<never>((_, reject) =>\n                setTimeout(() => {\n                    extend(network.catch(() => undefined));\n                    reject(new Error(\"network-timeout\"));\n                }, timeoutMs),\n            );\n            return await Promise.race([network, timeout]);\n        }\n        return await network;\n    } catch {\n        const cached = await cache.match(request);\n        if (cached && !isExpired(cached, route.maxAgeSeconds)) return cached;\n        throw new Error(\"network-first: no network and no cache\");\n    }\n}\n\n/**\n * Stale-while-revalidate. A fresh cached response is served at once, and the\n * revalidation is handed to `extend` (`event.waitUntil`): without it the\n * browser may stop the worker before the refreshed response is written.\n */\nasync function staleWhileRevalidate(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    const cache = await caches.open(route.cacheName);\n    const cached = await cache.match(request);\n\n    const network = fetch(request)\n        .then(async (response) => {\n            await store(cache, request, response, route);\n            return response;\n        })\n        .catch(() => undefined);\n\n    const fresh = cached && !isExpired(cached, route.maxAgeSeconds) ? cached : undefined;\n    if (fresh) {\n        extend(network);\n        return fresh;\n    }\n    const response = await network;\n    if (response) return response;\n    throw new Error(\"stale-while-revalidate: no network and no cache\");\n}\n\nfunction runRoute(\n    request: Request,\n    route: RuntimeRoute,\n    extend: (promise: Promise<unknown>) => void,\n): Promise<Response> {\n    switch (route.strategy) {\n        case \"cache-first\":\n            return cacheFirst(request, route);\n        case \"network-first\":\n            return networkFirst(request, route, extend);\n        case \"stale-while-revalidate\":\n            return staleWhileRevalidate(request, route, extend);\n    }\n}\n\nfunction routeMatches(route: RuntimeRoute, url: URL, request: Request): boolean {\n    return typeof route.match === \"function\"\n        ? route.match(url, request)\n        : route.match.test(url.href);\n}\n\n/**\n * Build a `206 Partial Content` response from a full one for an HTTP `Range`\n * request. Supports `bytes=start-end`, open-ended `bytes=start-` and suffix\n * `bytes=-suffixLength` (the last N bytes). Returns the original response when there is no usable\n * `Range` header, or a `416` when the range is unsatisfiable.\n *\n * @param request The incoming request (its `Range` header drives the slice).\n * @param response The full (200) response to slice.\n */\nexport async function createPartialResponse(\n    request: Request,\n    response: Response,\n): Promise<Response> {\n    const rangeHeader = request.headers.get(\"range\");\n    if (!rangeHeader) return response;\n\n    const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader.trim());\n    if (!match || (match[1] === \"\" && match[2] === \"\")) {\n        return new Response(null, { status: 416, statusText: \"Range Not Satisfiable\" });\n    }\n\n    const buffer = await response.clone().arrayBuffer();\n    const total = buffer.byteLength;\n\n    let start: number;\n    let end: number;\n    if (match[1] === \"\") {\n        const suffix = Number(match[2]);\n        start = Math.max(0, total - suffix);\n        end = total - 1;\n    } else {\n        start = Number(match[1]);\n        end = match[2] === \"\" ? total - 1 : Math.min(Number(match[2]), total - 1);\n    }\n\n    if (start > end || start >= total) {\n        return new Response(null, {\n            status: 416,\n            statusText: \"Range Not Satisfiable\",\n            headers: { \"Content-Range\": `bytes */${total}` },\n        });\n    }\n\n    const slice = buffer.slice(start, end + 1);\n    const headers = new Headers(response.headers);\n    headers.set(\"Content-Range\", `bytes ${start}-${end}/${total}`);\n    headers.set(\"Content-Length\", String(slice.byteLength));\n    headers.set(\"Accept-Ranges\", \"bytes\");\n\n    return new Response(slice, {\n        status: 206,\n        statusText: \"Partial Content\",\n        headers,\n    });\n}\n\n/**\n * Install a `fetch` handler that resolves matching `GET` requests with the\n * given runtime strategies. Non-matching requests are left untouched (no\n * `respondWith`), so a later {@link installPrecache} can handle them.\n *\n * A request carrying a credential header (`Authorization`, `X-Api-Key`, … — the\n * route's `credentialHeaders`), or a CORS `fetch` sent with\n * `credentials: \"include\"`, is also left untouched unless its route sets\n * `cacheAuthenticated`, and a response with `Cache-Control: no-store`\n * (or `private`, without that opt-in) or `Vary: *` is served but never stored. `maxAgeSeconds`\n * applies to every read, including the offline fallback: an expired entry is a\n * miss, never a last resort. Under `rangeRequests`, the full resource is cached\n * once (the `Range` header stripped) and each range is sliced from it.\n *\n * Register this BEFORE `installPrecache` so specific routes win over the\n * precache catch-all.\n *\n * @param routes Ordered rules; the first whose `match` passes handles the request.\n */\nexport function installRuntimeCache(routes: RuntimeRoute[]): void {\n    const sw = getSwScope();\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        const route = routes.find((candidate) => routeMatches(candidate, url, request));\n        if (!route) return;\n        if (!route.cacheAuthenticated && isCredentialed(request, route)) return;\n        const extend = (promise: Promise<unknown>): void => event.waitUntil(promise);\n\n        if (route.rangeRequests && request.headers.has(\"range\")) {\n            const full = new Request(request.url, {\n                headers: stripRange(request.headers),\n                credentials: request.credentials,\n                mode: request.mode === \"navigate\" ? \"same-origin\" : request.mode,\n            });\n            event.respondWith(\n                runRoute(full, route, extend).then((response) =>\n                    createPartialResponse(request, response),\n                ),\n            );\n            return;\n        }\n\n        event.respondWith(runRoute(request, route, extend));\n    });\n}\n\n/** Copy headers without the `Range` header (so the cached entry is the full file). */\nfunction stripRange(headers: Headers): Headers {\n    const out = new Headers(headers);\n    out.delete(\"range\");\n    return out;\n}\n\n/**\n * Precache the app shell at `install` and serve it offline:\n *  - reads `precache-manifest.json` (emitted by `tempestPwaManifest()`),\n *  - caches every listed URL under a versioned cache,\n *  - on `activate`, deletes stale precache versions and claims open clients,\n *  - on `fetch`, serves precached assets cache-first and falls back to the\n *    `navigateFallback` document for offline navigations (SPA routing).\n *\n * Same-origin only. Register this LAST, after any {@link installRuntimeCache}.\n */\nexport function installPrecache(options: InstallPrecacheOptions = {}): void {\n    const sw = getSwScope();\n    const {\n        manifestUrl = \"/precache-manifest.json\",\n        cacheName = \"tempest-precache\",\n        navigateFallback = \"/index.html\",\n        navigateFallbackDenylist = [],\n        skipWaiting = true,\n        navigationPreload = true,\n    } = options;\n\n    sw.addEventListener(\"install\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const response = await fetch(manifestUrl, { cache: \"no-cache\" });\n                const manifest = (await response.json()) as PrecacheManifest;\n                precacheName = `${cacheName}-${manifest.version}`;\n\n                const cache = await caches.open(precacheName);\n                await cache.addAll(manifest.urls);\n                for (const url of manifest.urls) {\n                    precachedPaths.add(new URL(url, sw.location.origin).pathname);\n                }\n                if (skipWaiting) await sw.skipWaiting();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"activate\", (event) => {\n        event.waitUntil(\n            (async () => {\n                const keys = await caches.keys();\n                await Promise.all(\n                    keys\n                        .filter((key) => key.startsWith(`${cacheName}-`) && key !== precacheName)\n                        .map((key) => caches.delete(key)),\n                );\n                if (navigationPreload && sw.registration?.navigationPreload) {\n                    await sw.registration.navigationPreload.enable();\n                }\n                await sw.clients.claim();\n            })(),\n        );\n    });\n\n    sw.addEventListener(\"fetch\", (event) => {\n        const request = event.request;\n        if (request.method !== \"GET\") return;\n\n        const url = new URL(request.url);\n        if (url.origin !== sw.location.origin) return;\n\n        // SPA navigations: serve the cached app shell when offline.\n        if (request.mode === \"navigate\") {\n            if (navigateFallbackDenylist.some((re) => re.test(url.pathname))) return;\n            event.respondWith(\n                (async () => {\n                    try {\n                        const preloaded = await event.preloadResponse;\n                        if (preloaded) return preloaded;\n                        return await fetch(request);\n                    } catch {\n                        const cache = await caches.open(precacheName);\n                        const shell = await cache.match(navigateFallback);\n                        if (shell) return shell;\n                        throw new Error(\"offline and no cached app shell\");\n                    }\n                })(),\n            );\n            return;\n        }\n\n        // Precached static assets: cache-first.\n        if (precachedPaths.has(url.pathname)) {\n            event.respondWith(\n                (async () => {\n                    const cache = await caches.open(precacheName);\n                    const cached = await cache.match(request);\n                    return cached ?? fetch(request);\n                })(),\n            );\n        }\n    });\n}\n"],"mappings":"A,4CAyDA,SAASE,GAA4B,CACjC,OAAO,UACX,CA6FA,IAAIC,EAAe,GACbC,EAAiB,IAAI,IAQrBC,EAAmB,sBAOzB,SAASC,EAAU,EAAoB,EAAiC,CACpE,GAAI,CAACC,EAAe,MAAO,GAC3B,IAAMC,EAAQ,OAAOC,EAAS,QAAQ,IAAIJ,CAAgB,CAAC,EACrDK,EAAaD,EAAS,QAAQ,IAAI,MAAM,EACxCE,EAAWH,EAAQ,EAAIA,EAAQE,EAAa,IAAI,KAAKA,CAAU,CAAC,CAAC,QAAQ,EAAI,IAEnF,MADA,CAAI,OAAO,MAAMC,CAAQ,IACjB,KAAK,IAAI,EAAIA,GAAY,IAAOJ,CAC5C,CAGA,SAASK,EAAuB,EAA8B,CAC1D,OAAQH,EAAS,QAAQ,IAAI,eAAe,GAAK,GAAA,CAC5C,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,IAAK,GAAcI,EAAU,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAC1D,CAGA,SAASC,EAAU,EAA+B,CAC9C,OAAQC,GAAQ,GAAA,CACX,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,IAAK,GAASC,EAAK,KAAK,CAAC,CAClC,CAaA,SAASC,EAAW,EAAoB,EAA8B,CAElE,GADI,CAACR,EAAS,IACVK,EAAUL,EAAS,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,EAAG,MAAO,GAClE,IAAMS,EAAaN,EAAuBH,CAAQ,EAElD,OADIS,EAAW,SAAS,UAAU,EAAU,GACrCC,EAAM,qBAAuB,IAAQ,CAACD,EAAW,SAAS,SAAS,CAC9E,CASA,SAASE,EAAe,EAAkB,EAA8B,CAEpE,OADIC,EAAQ,OAAS,QAAUA,EAAQ,cAAgB,WAChDC,EAAcD,EAASF,CAAK,CAAC,CAAC,OAAS,CAClD,CAGA,SAASG,EAAc,EAAkB,EAA+B,CACpE,MAAO,CAAC,GAAGtB,EAAAA,oBAAoBmB,EAAM,iBAAiB,CAAC,CAAC,CAAC,OAAQ,GAC7DE,EAAQ,QAAQ,IAAIL,CAAI,CAC5B,CACJ,CASA,eAAeO,EACX,EACA,EACA,EACA,EACa,CACb,GAAI,CAACN,EAAWR,EAAUU,CAAK,EAAG,OAClC,IAAMK,EAAU,IAAI,QAAQf,EAAS,OAAO,EAE5C,GADAe,EAAQ,IAAInB,EAAkB,OAAO,KAAK,IAAI,CAAC,CAAC,EAC5Cc,EAAM,mBAAoB,CAC1B,IAAMJ,EAAOS,EAAQ,IAAI,MAAM,EACzBC,EAASX,EAAUC,CAAI,EACvBW,EAAUJ,EAAcD,EAASF,CAAK,CAAC,CAAC,OAAQ,GAAS,CAACM,EAAO,SAAST,CAAI,CAAC,EACjFU,EAAQ,OAAS,GACjBF,EAAQ,IAAI,OAAQ,CAACT,EAAM,GAAGW,CAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAEzE,CACA,IAAMC,EAAOlB,EAAS,MAAM,EAC5B,MAAMmB,EAAM,IACRP,EACA,IAAI,SAASM,EAAK,KAAM,CAAE,OAAQA,EAAK,OAAQ,WAAYA,EAAK,WAAY,SAAQ,CAAC,CACzF,EACA,MAAME,EAAUV,EAAM,UAAWA,EAAM,UAAU,CACrD,CAGA,eAAeU,EAAU,EAAmB,EAAoC,CAC5E,GAAI,CAACC,EAAY,OACjB,IAAMF,EAAQ,MAAM,OAAO,KAAKG,CAAS,EACnCC,EAAO,MAAMJ,EAAM,KAAK,EAC9B,GAAI,IAAK,QAAUE,GACnB,IAAK,IAAMG,KAAOD,EAAK,MAAM,EAAGA,EAAK,OAASF,CAAU,EACpD,MAAMF,EAAM,OAAOK,CAAG,CAE9B,CAEA,eAAeC,EAAW,EAAkB,EAAwC,CAChF,IAAMN,EAAQ,MAAM,OAAO,KAAKT,EAAM,SAAS,EACzCgB,EAAS,MAAMP,EAAM,MAAMP,CAAO,EACxC,GAAIc,GAAU,CAAC7B,EAAU6B,EAAQhB,EAAM,aAAa,EAAG,OAAOgB,EAE9D,IAAM1B,EAAW,MAAM,MAAMY,CAAO,EAEpC,OADA,MAAME,EAAMK,EAAOP,EAASZ,EAAUU,CAAK,EACpCV,CACX,CAOA,eAAe2B,EACX,EACA,EACA,EACiB,CACjB,IAAMR,EAAQ,MAAM,OAAO,KAAKT,EAAM,SAAS,EAEzCkB,GAAW,SAA+B,CAC5C,IAAM5B,EAAW,MAAM,MAAMY,CAAO,EAEpC,OADA,MAAME,EAAMK,EAAOP,EAASZ,EAAUU,CAAK,EACpCV,CACX,EAAA,CAAG,EAEG6B,GAAanB,EAAM,uBAAyB,GAAK,IACvD,GAAI,CACA,GAAImB,EAAY,EAAG,CACf,IAAMC,EAAU,IAAI,SAAgB,EAAG,IACnC,eAAiB,CACbC,EAAOH,EAAQ,UAAY,IAAA,EAAS,CAAC,EACrCI,EAAW,MAAM,iBAAiB,CAAC,CACvC,EAAGH,CAAS,CAChB,EACA,OAAO,MAAM,QAAQ,KAAK,CAACD,EAASE,CAAO,CAAC,CAChD,CACA,OAAO,MAAMF,CACjB,MAAQ,CACJ,IAAMF,EAAS,MAAMP,EAAM,MAAMP,CAAO,EACxC,GAAIc,GAAU,CAAC7B,EAAU6B,EAAQhB,EAAM,aAAa,EAAG,OAAOgB,EAC9D,MAAU,MAAM,wCAAwC,CAC5D,CACJ,CAOA,eAAeO,EACX,EACA,EACA,EACiB,CACjB,IAAMd,EAAQ,MAAM,OAAO,KAAKT,EAAM,SAAS,EACzCgB,EAAS,MAAMP,EAAM,MAAMP,CAAO,EAElCgB,EAAU,MAAMhB,CAAO,CAAC,CACzB,KAAK,KAAO,KACT,MAAME,EAAMK,EAAOP,EAASZ,EAAUU,CAAK,EACpCV,EACV,CAAC,CACD,UAAY,IAAA,EAAS,EAEpBkC,EAAQR,GAAU,CAAC7B,EAAU6B,EAAQhB,EAAM,aAAa,EAAIgB,EAAS,IAAA,GAC3E,GAAIQ,EAEA,OADAH,EAAOH,CAAO,EACPM,EAEX,IAAMlC,EAAW,MAAM4B,EACvB,GAAI5B,EAAU,OAAOA,EACrB,MAAU,MAAM,iDAAiD,CACrE,CAEA,SAASmC,EACL,EACA,EACA,EACiB,CACjB,OAAQzB,EAAM,SAAd,CACI,IAAK,cACD,OAAOe,EAAWb,EAASF,CAAK,EACpC,IAAK,gBACD,OAAOiB,EAAaf,EAASF,EAAOqB,CAAM,EAC9C,IAAK,yBACD,OAAOE,EAAqBrB,EAASF,EAAOqB,CAAM,CAC1D,CACJ,CAEA,SAASK,EAAa,EAAqB,EAAU,EAA2B,CAC5E,OAAO,OAAO1B,EAAM,OAAU,WACxBA,EAAM,MAAM2B,EAAKzB,CAAO,EACxBF,EAAM,MAAM,KAAK2B,EAAI,IAAI,CACnC,CAWA,eAAsBC,EAClB,EACA,EACiB,CACjB,IAAMC,EAAc3B,EAAQ,QAAQ,IAAI,OAAO,EAC/C,GAAI,CAAC2B,EAAa,OAAOvC,EAEzB,IAAMwC,EAAQ,sBAAsB,KAAKD,EAAY,KAAK,CAAC,EAC3D,GAAI,CAACC,GAAUA,EAAM,KAAO,IAAMA,EAAM,KAAO,GAC3C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,WAAY,uBAAwB,CAAC,EAGlF,IAAMC,EAAS,MAAMzC,EAAS,MAAM,CAAC,CAAC,YAAY,EAC5C0C,EAAQD,EAAO,WAEjBE,EACAC,EACJ,GAAIJ,EAAM,KAAO,GAAI,CACjB,IAAMK,EAAS,OAAOL,EAAM,EAAE,EAC9B,EAAQ,KAAK,IAAI,EAAGE,EAAQG,CAAM,EAClC,EAAMH,EAAQ,CAClB,KACI,GAAQ,OAAOF,EAAM,EAAE,EACvB,EAAMA,EAAM,KAAO,GAAKE,EAAQ,EAAI,KAAK,IAAI,OAAOF,EAAM,EAAE,EAAGE,EAAQ,CAAC,EAG5E,GAAIC,EAAQC,GAAOD,GAASD,EACxB,OAAO,IAAI,SAAS,KAAM,CACtB,OAAQ,IACR,WAAY,wBACZ,QAAS,CAAE,gBAAiB,WAAWA,GAAQ,CACnD,CAAC,EAGL,IAAMI,EAAQL,EAAO,MAAME,EAAOC,EAAM,CAAC,EACnC7B,EAAU,IAAI,QAAQf,EAAS,OAAO,EAK5C,OAJAe,EAAQ,IAAI,gBAAiB,SAAS4B,EAAM,GAAGC,EAAI,GAAGF,GAAO,EAC7D3B,EAAQ,IAAI,iBAAkB,OAAO+B,EAAM,UAAU,CAAC,EACtD/B,EAAQ,IAAI,gBAAiB,OAAO,EAE7B,IAAI,SAAS+B,EAAO,CACvB,OAAQ,IACR,WAAY,kBACZ,SACJ,CAAC,CACL,CAqBA,SAAgBC,EAAoB,EAA8B,CAE9DtD,EAAA,CAAA,CAAG,iBAAiB,QAAU,GAAU,CACpC,IAAMmB,EAAUoC,EAAM,QACtB,GAAIpC,EAAQ,SAAW,MAAO,OAE9B,IAAMyB,EAAM,IAAI,IAAIzB,EAAQ,GAAG,EACzBF,EAAQuC,EAAO,KAAM,GAAcb,EAAac,EAAWb,EAAKzB,CAAO,CAAC,EAE9E,GADI,CAACF,GACD,CAACA,EAAM,oBAAsBC,EAAeC,EAASF,CAAK,EAAG,OACjE,IAAMqB,EAAU,GAAoCiB,EAAM,UAAUG,CAAO,EAE3E,GAAIzC,EAAM,eAAiBE,EAAQ,QAAQ,IAAI,OAAO,EAAG,CACrD,IAAMwC,EAAO,IAAI,QAAQxC,EAAQ,IAAK,CAClC,QAASyC,EAAWzC,EAAQ,OAAO,EACnC,YAAaA,EAAQ,YACrB,KAAMA,EAAQ,OAAS,WAAa,cAAgBA,EAAQ,IAChE,CAAC,EACDoC,EAAM,YACFb,EAASiB,EAAM1C,EAAOqB,CAAM,CAAC,CAAC,KAAM,GAChCO,EAAsB1B,EAASZ,CAAQ,CAC3C,CACJ,CAEJ,MAEAgD,EAAM,YAAYb,EAASvB,EAASF,EAAOqB,CAAM,CAAC,CACtD,CAAC,CACL,CAGA,SAASsB,EAAW,EAA2B,CAC3C,IAAMC,EAAM,IAAI,QAAQvC,CAAO,EAE/B,OADAuC,EAAI,OAAO,OAAO,EACXA,CACX,CAYA,SAAgBC,EAAgB,EAAkC,CAAC,EAAS,CACxE,IAAMC,EAAK/D,EAAW,EAChB,CACF,cAAc,0BACd,YAAY,mBACZ,mBAAmB,cACnB,2BAA2B,CAAC,EAC5B,cAAc,GACd,oBAAoB,IACpBgE,EAEJD,EAAG,iBAAiB,UAAY,GAAU,CACtCR,EAAM,WACD,SAAY,CAET,IAAMU,EAAY,MAAM,MADD,MAAMC,EAAa,CAAE,MAAO,UAAW,CAAC,EAAA,CAC9B,KAAK,EACtC,EAAe,GAAGrC,EAAU,GAAGoC,EAAS,UAGxC,MAAM,MADc,OAAO,KAAKhE,CAAY,EAAA,CAChC,OAAOgE,EAAS,IAAI,EAChC,IAAK,IAAMrB,KAAOqB,EAAS,KACvB/D,EAAe,IAAI,IAAI,IAAI0C,EAAKmB,EAAG,SAAS,MAAM,CAAC,CAAC,QAAQ,EAE5DI,GAAa,MAAMJ,EAAG,YAAY,CAC1C,EAAA,CAAG,CACP,CACJ,CAAC,EAEDA,EAAG,iBAAiB,WAAa,GAAU,CACvCR,EAAM,WACD,SAAY,CACT,IAAMzB,EAAO,MAAM,OAAO,KAAK,EAC/B,MAAM,QAAQ,IACVA,EACK,OAAQ,GAAQC,EAAI,WAAW,GAAGF,EAAU,EAAE,GAAKE,IAAQ9B,CAAY,CAAC,CACxE,IAAK,GAAQ,OAAO,OAAO8B,CAAG,CAAC,CACxC,EACIqC,GAAqBL,EAAG,cAAc,mBACtC,MAAMA,EAAG,aAAa,kBAAkB,OAAO,EAEnD,MAAMA,EAAG,QAAQ,MAAM,CAC3B,EAAA,CAAG,CACP,CACJ,CAAC,EAEDA,EAAG,iBAAiB,QAAU,GAAU,CACpC,IAAM5C,EAAUoC,EAAM,QACtB,GAAIpC,EAAQ,SAAW,MAAO,OAE9B,IAAMyB,EAAM,IAAI,IAAIzB,EAAQ,GAAG,EAC/B,GAAIyB,EAAI,SAAWmB,EAAG,SAAS,OAG/B,IAAI5C,EAAQ,OAAS,WAAY,CAC7B,GAAIkD,EAAyB,KAAM,GAAOC,EAAG,KAAK1B,EAAI,QAAQ,CAAC,EAAG,OAClEW,EAAM,aACD,SAAY,CACT,GAAI,CAGA,OADI,MADoBA,EAAM,iBAEvB,MAAM,MAAMpC,CAAO,CAC9B,MAAQ,CAEJ,IAAMoD,EAAQ,MAAM,MADA,OAAO,KAAKtE,CAAY,EAAA,CAClB,MAAMuE,CAAgB,EAChD,GAAID,EAAO,OAAOA,EAClB,MAAU,MAAM,iCAAiC,CACrD,CACJ,EAAA,CAAG,CACP,CAEJ,MAGIrE,EAAe,IAAI0C,EAAI,QAAQ,GAC/BW,EAAM,aACD,SAGU,MADc,MADD,OAAO,KAAKtD,CAAY,EAAA,CACjB,MAAMkB,CAAO,GACvB,MAAMA,CAAO,EAClC,CAAG,CACP,CAVJ,CAYJ,CAAC,CACL,C"}

package/dist/sw/cache.js

@@ -12,43 +12,49 @@ function a(e, t) {
 function o(e) {
 	return (e.headers.get("cache-control") ?? "").toLowerCase().split(",").map((e) => e.trim().split("=")[0]);
 }
-function s(e, t) {
-	if (!e.ok) return !1;
+function s(e) {
+	return (e ?? "").toLowerCase().split(",").map((e) => e.trim());
+}
+function c(e, t) {
+	if (!e.ok || s(e.headers.get("vary")).includes("*")) return !1;
 	let n = o(e);
 	return n.includes("no-store") ? !1 : t.cacheAuthenticated === !0 || !n.includes("private");
 }
-function c(t, n) {
+function l(e, t) {
+	return e.mode === "cors" && e.credentials === "include" || u(e, t).length > 0;
+}
+function u(t, n) {
 	return [...e(n.credentialHeaders)].filter((e) => t.headers.has(e));
 }
-async function l(e, t, n, r) {
-	if (!s(n, r)) return;
+async function d(e, t, n, r) {
+	if (!c(n, r)) return;
 	let a = new Headers(n.headers);
 	if (a.set(i, String(Date.now())), r.cacheAuthenticated) {
-		let e = a.get("vary"), n = (e ?? "").toLowerCase().split(",").map((e) => e.trim()), i = c(t, r).filter((e) => !n.includes(e));
-		i.length > 0 && !n.includes("*") && a.set("vary", [e, ...i].filter(Boolean).join(", "));
+		let e = a.get("vary"), n = s(e), i = u(t, r).filter((e) => !n.includes(e));
+		i.length > 0 && a.set("vary", [e, ...i].filter(Boolean).join(", "));
 	}
 	let o = n.clone();
 	await e.put(t, new Response(o.body, {
 		status: o.status,
 		statusText: o.statusText,
 		headers: a
-	})), await u(r.cacheName, r.maxEntries);
+	})), await f(r.cacheName, r.maxEntries);
 }
-async function u(e, t) {
+async function f(e, t) {
 	if (!t) return;
 	let n = await caches.open(e), r = await n.keys();
 	if (!(r.length <= t)) for (let e of r.slice(0, r.length - t)) await n.delete(e);
 }
-async function d(e, t) {
+async function p(e, t) {
 	let n = await caches.open(t.cacheName), r = await n.match(e);
 	if (r && !a(r, t.maxAgeSeconds)) return r;
 	let i = await fetch(e);
-	return await l(n, e, i, t), i;
+	return await d(n, e, i, t), i;
 }
-async function f(e, t, n) {
+async function m(e, t, n) {
 	let r = await caches.open(t.cacheName), i = (async () => {
 		let n = await fetch(e);
-		return await l(r, e, n, t), n;
+		return await d(r, e, n, t), n;
 	})(), o = (t.networkTimeoutSeconds ?? 0) * 1e3;
 	try {
 		if (o > 0) {
@@ -64,24 +70,24 @@ async function f(e, t, n) {
 		throw Error("network-first: no network and no cache");
 	}
 }
-async function p(e, t, n) {
-	let r = await caches.open(t.cacheName), i = await r.match(e), o = fetch(e).then(async (n) => (await l(r, e, n, t), n)).catch(() => void 0), s = i && !a(i, t.maxAgeSeconds) ? i : void 0;
+async function h(e, t, n) {
+	let r = await caches.open(t.cacheName), i = await r.match(e), o = fetch(e).then(async (n) => (await d(r, e, n, t), n)).catch(() => void 0), s = i && !a(i, t.maxAgeSeconds) ? i : void 0;
 	if (s) return n(o), s;
 	let c = await o;
 	if (c) return c;
 	throw Error("stale-while-revalidate: no network and no cache");
 }
-function m(e, t, n) {
+function g(e, t, n) {
 	switch (t.strategy) {
-		case "cache-first": return d(e, t);
-		case "network-first": return f(e, t, n);
-		case "stale-while-revalidate": return p(e, t, n);
+		case "cache-first": return p(e, t);
+		case "network-first": return m(e, t, n);
+		case "stale-while-revalidate": return h(e, t, n);
 	}
 }
-function h(e, t, n) {
+function _(e, t, n) {
 	return typeof e.match == "function" ? e.match(t, n) : e.match.test(t.href);
 }
-async function g(e, t) {
+async function v(e, t) {
 	let n = e.headers.get("range");
 	if (!n) return t;
 	let r = /^bytes=(\d*)-(\d*)$/.exec(n.trim());
@@ -106,28 +112,28 @@ async function g(e, t) {
 		headers: l
 	});
 }
-function _(e) {
+function y(e) {
 	t().addEventListener("fetch", (t) => {
 		let n = t.request;
 		if (n.method !== "GET") return;
-		let r = new URL(n.url), i = e.find((e) => h(e, r, n));
-		if (!i || !i.cacheAuthenticated && c(n, i).length > 0) return;
+		let r = new URL(n.url), i = e.find((e) => _(e, r, n));
+		if (!i || !i.cacheAuthenticated && l(n, i)) return;
 		let a = (e) => t.waitUntil(e);
 		if (i.rangeRequests && n.headers.has("range")) {
 			let e = new Request(n.url, {
-				headers: v(n.headers),
+				headers: b(n.headers),
 				credentials: n.credentials,
 				mode: n.mode === "navigate" ? "same-origin" : n.mode
 			});
-			t.respondWith(m(e, i, a).then((e) => g(n, e)));
-		} else t.respondWith(m(n, i, a));
+			t.respondWith(g(e, i, a).then((e) => v(n, e)));
+		} else t.respondWith(g(n, i, a));
 	});
 }
-function v(e) {
+function b(e) {
 	let t = new Headers(e);
 	return t.delete("range"), t;
 }
-function y(e = {}) {
+function x(e = {}) {
 	let i = t(), { manifestUrl: a = "/precache-manifest.json", cacheName: o = "tempest-precache", navigateFallback: s = "/index.html", navigateFallbackDenylist: c = [], skipWaiting: l = !0, navigationPreload: u = !0 } = e;
 	i.addEventListener("install", (e) => {
 		e.waitUntil((async () => {
@@ -162,6 +168,6 @@ function y(e = {}) {
 	});
 }
 //#endregion
-export { g as createPartialResponse, y as installPrecache, _ as installRuntimeCache };
+export { v as createPartialResponse, x as installPrecache, y as installRuntimeCache };
 
 //# sourceMappingURL=cache.js.map