function e(e){return(e??``).trim().replace(/^\/+|\/+$/g,``)}function t(t){let n=e(t);return n?`${n}/`:``}function n(e){let t=e.replace(/^\/+/,``);if(t.startsWith(`attachments/`))return t}function r(e){return e.slice(0,2)}function i(e){let t=e.recoveryKeyHash?.trim();if(!t)throw Error(`Recovery key hash is required for upload.`);return t}function a(e){let t=new Uint8Array(e.byteLength);return t.set(e),t.buffer}function o(e){let t=``;for(let n=0;n<e.length;n+=32768)t+=String.fromCharCode(...e.subarray(n,n+32768));return btoa(t)}function s(e){let t=atob(e||``),n=new Uint8Array(t.length);for(let e=0;e<t.length;e+=1)n[e]=t.charCodeAt(e);return n}var c=`chat-diary-db`,l=1,u=`chat-diary-attachment`,d=1,f=new TextEncoder().encode(`chat-diary-attachment-v1
`),p=4,m=25e4,h=16,g=12;async function _(e){let t=await crypto.subtle.digest(`SHA-256`,a(O(e)));return k(new Uint8Array(t))}async function v(e,t){let n=crypto.getRandomValues(new Uint8Array(h)),r=crypto.getRandomValues(new Uint8Array(g)),i=await D(t,n),s=await crypto.subtle.encrypt({name:`AES-GCM`,iv:a(r)},i,a(e)),u={type:c,version:l,algorithm:`AES-GCM`,kdf:{name:`PBKDF2-SHA-256`,iterations:m,salt:o(n)},keyHash:await _(t),iv:o(r),ciphertext:o(new Uint8Array(s))};return new TextEncoder().encode(JSON.stringify(u))}async function y(e,t,n){let r=C(e);if(!r)return e;let i=await _(t);if(n&&n!==i)throw Error(`Recovery key hash does not match local configuration.`);if(r.keyHash!==i)throw Error(`Recovery key does not match remote database.`);let o=s(r.kdf.salt),c=s(r.iv),l=s(r.ciphertext),u=await D(t,o),d=await crypto.subtle.decrypt({name:`AES-GCM`,iv:a(c)},u,a(l));return new Uint8Array(d)}async function b(e,t){let n=await x(new Uint8Array(await e.arrayBuffer()),t,crypto.getRandomValues(new Uint8Array(h)),crypto.getRandomValues(new Uint8Array(g)));return new Blob([a(n)],{type:`application/octet-stream`})}async function x(e,t,n,r){let i=await D(t,n),s=new Uint8Array(await crypto.subtle.encrypt({name:`AES-GCM`,iv:a(r)},i,a(e)));return w({type:u,version:d,algorithm:`AES-GCM`,kdf:{name:`PBKDF2-SHA-256`,iterations:m,salt:o(n)},keyHash:await _(t),iv:o(r)},s)}async function S(e,t,n,r){let i=new Uint8Array(await e.arrayBuffer()),o=T(i);if(!o)return new Blob([a(i)],{type:n});let c=await _(t);if(r&&r!==c)throw Error(`Recovery key hash does not match local configuration.`);if(o.header.keyHash!==c)throw Error(`Recovery key does not match remote attachment.`);let l=s(o.header.kdf.salt),u=s(o.header.iv),d=await D(t,l),f=await crypto.subtle.decrypt({name:`AES-GCM`,iv:a(u)},d,a(o.ciphertext));return new Blob([f],{type:n})}function C(e){let t;try{t=JSON.parse(new TextDecoder().decode(e))}catch{return}if(N(t)&&t.type===c){if(t.version!==l)throw Error(`Unsupported encrypted database version: ${String(t.version)}`);if(t.algorithm!==`AES-GCM`)throw Error(`Unsupported database encryption algorithm.`);if(!N(t.kdf)||t.kdf.name!==`PBKDF2-SHA-256`)throw Error(`Unsupported database encryption KDF.`);if(t.kdf.iterations!==m)throw Error(`Unsupported database encryption KDF iterations.`);if(typeof t.kdf.salt!=`string`||typeof t.keyHash!=`string`)throw Error(`Invalid encrypted database metadata.`);if(typeof t.iv!=`string`||typeof t.ciphertext!=`string`)throw Error(`Invalid encrypted database payload.`);return t}}function w(e,t){let n=new TextEncoder().encode(JSON.stringify(e)),r=new Uint8Array(f.byteLength+p+n.byteLength+t.byteLength);return r.set(f,0),j(r,f.byteLength,n.byteLength),r.set(n,f.byteLength+p),r.set(t,f.byteLength+p+n.byteLength),r}function T(e){if(!A(e,f))return;if(e.byteLength<f.byteLength+p)throw Error(`Invalid encrypted attachment payload.`);let t=M(e,f.byteLength),n=f.byteLength+p,r=n+t;if(e.byteLength<r)throw Error(`Invalid encrypted attachment header.`);let i;try{i=JSON.parse(new TextDecoder().decode(e.slice(n,r)))}catch{throw Error(`Invalid encrypted attachment metadata.`)}return{header:E(i),ciphertext:e.slice(r)}}function E(e){if(!N(e))throw Error(`Invalid encrypted attachment metadata.`);if(e.type!==u)throw Error(`Unsupported encrypted attachment type.`);if(e.version!==d)throw Error(`Unsupported encrypted attachment version: ${String(e.version)}`);if(e.algorithm!==`AES-GCM`)throw Error(`Unsupported attachment encryption algorithm.`);if(!N(e.kdf)||e.kdf.name!==`PBKDF2-SHA-256`)throw Error(`Unsupported attachment encryption KDF.`);if(e.kdf.iterations!==m)throw Error(`Unsupported attachment encryption KDF iterations.`);if(typeof e.kdf.salt!=`string`||typeof e.keyHash!=`string`||typeof e.iv!=`string`)throw Error(`Invalid encrypted attachment metadata.`);return e}async function D(e,t){let n=await crypto.subtle.importKey(`raw`,a(O(e)),`PBKDF2`,!1,[`deriveKey`]);return crypto.subtle.deriveKey({name:`PBKDF2`,hash:`SHA-256`,salt:a(t),iterations:m},n,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}function O(e){return new TextEncoder().encode(e.trim())}function k(e){return Array.from(e,e=>e.toString(16).padStart(2,`0`)).join(``)}function A(e,t){if(e.byteLength<t.byteLength)return!1;for(let n=0;n<t.byteLength;n+=1)if(e[n]!==t[n])return!1;return!0}function j(e,t,n){e[t]=n>>>24&255,e[t+1]=n>>>16&255,e[t+2]=n>>>8&255,e[t+3]=n&255}function M(e,t){return e[t]*16777216+((e[t+1]??0)<<16)+((e[t+2]??0)<<8)+(e[t+3]??0)}function N(e){return typeof e==`object`&&!!e}export{v as a,a as c,t as d,e as f,b as i,r as l,y as n,s as o,i as p,_ as r,o as s,S as t,n as u};
//# sourceMappingURL=attachment-encryption-DTWbJYgF.js.map