@cef-ai/widget-runtime 0.2.0

package/README.md

@@ -0,0 +1,34 @@
+# @cef-ai/widget-runtime
+
+Browser runtime for CEF widgets. It boots from `window.WidgetSandbox.manifest`,
+resolves the user's identity, exposes `window.WidgetRuntime`
+(`query` / `publish` / `connect` / `connectAgent` / `agentStatus` / `identity`),
+and renders config-driven widget kinds (record / list / dashboard / submit /
+conversation / composite) plus custom widgets. It also carries the audio
+capture/upload path. The runtime **reads** a manifest; the `@cef-ai/cli` build
+tooling **builds** one.
+
+The esbuild IIFE build emits `dist/widget-runtime.js` (the browser bundle) and
+`dist/widget.html` (the shell); `tsc` emits the library entry (`dist/index.js`)
+for consumers that import the helpers directly.
+
+## Identity (multi-source)
+
+The runtime resolves a signing identity from the best available source:
+
+1. **Embedded (host):** when iframed by the Cere Vault, it signs through the
+   host's postMessage sign-bridge.
+2. **Standalone (interactive wallet):** when there is no responding host — the
+   widget is opened top-level via a direct link — it connects an interactive
+   Cere embed-wallet built from `manifest.wallet.{appId,env}` (opens the wallet
+   UI) and signs locally.
+
+Both paths feed the same `@cef-ai/vault-sdk` client, so cubby reads, connect,
+publish, and audio uploads behave identically embedded or standalone.
+
+## Build
+
+```sh
+pnpm --filter @cef-ai/widget-runtime build   # esbuild bundle + tsc + fix-extensions
+pnpm --filter @cef-ai/widget-runtime test
+```

package/dist/audio/capture-upload.d.ts

@@ -0,0 +1,116 @@
+export interface CaptureUploadDeps {
+    decode: (blob: Blob) => Promise<Float32Array>;
+    upload: ((wav: ArrayBuffer, index: number) => Promise<string>) & {
+        finalizeUrls?: (urls: string[]) => Promise<string[]>;
+    };
+    sampleRate: number;
+}
+export interface CaptureUploadInput {
+    blob: Blob;
+    segmentSeconds?: number;
+    softCapSeconds?: number;
+    onProgress?: (done: number, total: number) => void;
+    onWarn?: (message: string) => void;
+}
+export declare function captureAndUploadAudio(input: CaptureUploadInput, deps: CaptureUploadDeps): Promise<string[]>;
+/** Minimal AwsClient surface we use — kept narrow so tests can inject a fake. */
+type AwsLike = {
+    fetch: (url: string, init: RequestInit) => Promise<Response>;
+    sign: (input: string, init?: {
+        aws?: {
+            signQuery?: boolean;
+        };
+    }) => Promise<Request>;
+};
+/** Shared config for any DDC vault-bucket client (uploader or object store). */
+export interface VaultStoreConfig {
+    /**
+     * Signer pair from the Vault host bridge (or any other source):
+     *   publicKey — raw Ed25519 public key bytes
+     *   sign      — async raw-bytes signer
+     */
+    signerPair: {
+        publicKey: Uint8Array;
+        sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+    };
+    /** Signature scheme reported by the host wallet ('ed25519' | 'sr25519'). */
+    sigType: 'ed25519' | 'sr25519';
+    /** Public gateway base URL — no trailing slash, no /auth/info suffix. */
+    gatewayUrl: string;
+    bucketId: string;
+    region: string;
+    /** Injectable fetch for tests; defaults to globalThis.fetch. */
+    fetchImpl?: typeof fetch;
+    /**
+     * Injectable AwsClient factory for tests.
+     * Defaults to: (creds) => new AwsClient({ ...creds, service: 's3' })
+     */
+    awsClientFactory?: (creds: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+        region: string;
+    }) => AwsLike;
+    /**
+     * TTL (seconds) for presigned GET URLs handed back to callers. Whisper reads
+     * the object via this URL, so it must outlive upload→fetch latency. Default
+     * 21600 (6h); SigV4's ceiling is 7d.
+     */
+    readTtlSeconds?: number;
+    /**
+     * Label stored on the gateway credential this client mints (≤64 chars).
+     * Cap recovery only reclaims rows carrying this label. Default "widget-runtime".
+     */
+    credentialLabel?: string;
+}
+export interface VaultUploaderConfig extends VaultStoreConfig {
+    /** Path prefix inside the bucket. Defaults to `widget-audio/<uuid>`. */
+    keyPrefix?: string;
+    /**
+     * Read URL mode for downstream model fetches.
+     *
+     * Default `signed` keeps Vault audio private; the URL is bound to this
+     * client's own credential (revoking that credential invalidates it).
+     * `public` writes `x-amz-acl: public-read` and returns the plain object URL;
+     * use only for controlled dev/test flows or a deliberate public asset policy.
+     */
+    readMode?: 'signed' | 'public';
+}
+export type VaultUploadFn = ((wav: ArrayBuffer, index: number) => Promise<string>) & {
+    finalizeUrls: (urls: string[]) => Promise<string[]>;
+};
+/**
+ * Creates a WAV uploader that writes to a DDC S3-compatible vault bucket using
+ * the proven in-browser flow from the spike:
+ *   1. Derive signer from embed wallet (ed25519_signRaw).
+ *   2. GET /auth/info → gateway_public_key.
+ *   3. Mint delegation token (subject = gateway_public_key).
+ *   4. POST /auth/credentials with signed headers — always mints a NEW,
+ *      labeled credential for this uploader (cap-400 → reclaim our oldest
+ *      labeled row and retry once).
+ *   5. Per segment: SHA-256 WAV bytes, PUT via SigV4-signed AwsClient.
+ *
+ * S3 credentials are memoized (shared credential core) so the signer is only
+ * invoked once per uploader instance under normal operation.
+ */
+export declare function createVaultUploader(cfg: VaultUploaderConfig): VaultUploadFn;
+/** Read/write whole objects at caller-chosen keys in a DDC vault bucket. */
+export interface VaultObjectStore {
+    /**
+     * PUT raw bytes at `key` (bucket-relative, no leading slash) with the given
+     * content-type. Returns the stored key — persist it to re-sign a GET later.
+     */
+    put(bytes: ArrayBuffer | Uint8Array, key: string, contentType: string): Promise<string>;
+    /** Re-sign a fresh presigned GET URL for a previously-stored key. */
+    signGet(key: string, ttlSeconds?: number): Promise<string>;
+}
+/**
+ * Whole-file companion to createVaultUploader: PUT an object at a STABLE,
+ * caller-chosen key and re-sign GET URLs for it on demand. Used to persist a
+ * durable interview recording (store the key, not the expiring presigned URL)
+ * and re-sign playback URLs from the candidate modal — same private bucket,
+ * same wallet, so the grant can always be re-minted. Shares the auth flow with
+ * the segment uploader via createCredCore.
+ */
+export declare function createVaultObjectStore(cfg: VaultStoreConfig): VaultObjectStore;
+export {};

package/dist/audio/capture-upload.js

@@ -0,0 +1,347 @@
+// packages/widget-runtime/src/audio/capture-upload.ts
+import { AwsClient } from 'aws4fetch';
+import { hexToU8a, u8aToHex } from '@polkadot/util';
+import { encodeWav } from './wav.js';
+import { segmentPcm } from './segment.js';
+import { mintDelegationToken } from './ddc-delegation.js';
+export async function captureAndUploadAudio(input, deps) {
+    const segSecs = input.segmentSeconds ?? 25;
+    const pcm = await deps.decode(input.blob);
+    const durationSecs = pcm.length / deps.sampleRate;
+    if (input.softCapSeconds && durationSecs > input.softCapSeconds) {
+        input.onWarn?.(`Recording is ${Math.round(durationSecs / 60)} min; long uploads may be slow.`);
+    }
+    const segments = segmentPcm(pcm, deps.sampleRate, segSecs);
+    const urls = [];
+    for (let i = 0; i < segments.length; i++) {
+        urls.push(await deps.upload(encodeWav(segments[i], deps.sampleRate), i));
+        input.onProgress?.(i + 1, segments.length);
+    }
+    return deps.upload.finalizeUrls ? await deps.upload.finalizeUrls(urls) : urls;
+}
+// ── Internal helpers ──────────────────────────────────────────────────────────
+/** Compute SHA-256 hex of bytes using the Web Crypto API (available in browsers and Node >= 15). */
+async function sha256Hex(bytes) {
+    const buf = await crypto.subtle.digest('SHA-256', bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
+    return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Build signed HTTP headers for DDC S3-gateway /auth/* calls.
+ * Replicates ddc-onboarding.ts signedHeaders exactly:
+ *   X-Public-Key: 0x-prefixed hex
+ *   X-Signature: hex WITHOUT 0x prefix
+ *   X-Signature-Type: the wallet's signature scheme (ed25519 | sr25519)
+ *   Content-Type: application/json
+ */
+async function buildSignedHeaders(sign, publicKey, sigType, body = '') {
+    const bytes = new TextEncoder().encode(body);
+    const sig = await sign(bytes);
+    return {
+        'Content-Type': 'application/json',
+        'X-Public-Key': u8aToHex(publicKey), // includes 0x prefix
+        'X-Signature': u8aToHex(sig).slice(2), // strip 0x
+        'X-Signature-Type': sigType,
+    };
+}
+// ── Gateway credential API (multi-credential contract) ───────────────────────
+//
+// Gateway contract (ddc-s3-gateway PR #20):
+//   - POST /auth/credentials ALWAYS mints a new credential (409 is gone).
+//     Optional `label` (≤64 chars) and `expires_in_seconds` in the body.
+//   - A wallet holds at most 10 live credentials; past the cap the POST fails
+//     with 400 "credential limit reached" (expired rows don't count).
+//   - GET  /auth/credentials (signed empty body) lists rows, never secrets.
+//   - DELETE /auth/credentials with a wallet-signed body {"access_key_id"}
+//     revokes one row; a bare empty-body DELETE only touches the legacy
+//     suffix-less row — never use it here.
+/** Label stamped on every credential this package mints (unless overridden). */
+const CREDENTIAL_LABEL = 'widget-runtime';
+const CAP_ERROR_RE = /credential limit reached/i;
+function isLiveRow(row, now = Date.now()) {
+    if (row.revoked)
+        return false;
+    if (row.expires_at && Date.parse(row.expires_at) <= now)
+        return false;
+    return true;
+}
+async function listCredentials(ctx) {
+    const res = await ctx.fetchImpl(`${ctx.gatewayUrl}/auth/credentials`, {
+        headers: await buildSignedHeaders(ctx.sign, ctx.publicKey, ctx.sigType),
+    });
+    if (!res.ok)
+        throw new Error(`GET ${ctx.gatewayUrl}/auth/credentials → ${res.status} ${await res.text()}`);
+    // The gateway returns a bare JSON array; tolerate an object envelope too.
+    const json = (await res.json());
+    return Array.isArray(json) ? json : (json.credentials ?? []);
+}
+/** Targeted revoke: DELETE with a wallet-signed JSON body naming the row. */
+async function revokeCredentialById(ctx, accessKeyId) {
+    const body = JSON.stringify({ access_key_id: accessKeyId });
+    const res = await ctx.fetchImpl(`${ctx.gatewayUrl}/auth/credentials`, {
+        method: 'DELETE', headers: await buildSignedHeaders(ctx.sign, ctx.publicKey, ctx.sigType, body), body,
+    });
+    if (!res.ok)
+        throw new Error(`DELETE ${ctx.gatewayUrl}/auth/credentials (${accessKeyId}) → ${res.status} ${await res.text()}`);
+}
+/**
+ * Mint S3 credentials for a delegation token under our label. On a cap-400
+ * ("credential limit reached") reclaim the OLDEST live row carrying our label
+ * (an abandoned earlier session) via targeted revoke and retry the POST once;
+ * rows minted by other tools/sessions are left alone. If nothing can be
+ * reclaimed, fail with an actionable error.
+ */
+async function registerCredentials(ctx, delegationToken, label) {
+    const body = JSON.stringify({ delegation_token: delegationToken, label });
+    const post = async () => ctx.fetchImpl(`${ctx.gatewayUrl}/auth/credentials`, {
+        method: 'POST', headers: await buildSignedHeaders(ctx.sign, ctx.publicKey, ctx.sigType, body), body,
+    });
+    let res = await post();
+    if (res.status === 400) {
+        const text = await res.text();
+        if (!CAP_ERROR_RE.test(text))
+            throw new Error(`POST ${ctx.gatewayUrl}/auth/credentials → 400 ${text}`);
+        const rows = await listCredentials(ctx);
+        const own = rows
+            .filter((r) => isLiveRow(r) && r.label === label)
+            .sort((a, b) => Date.parse(a.created_at ?? '') - Date.parse(b.created_at ?? ''));
+        const victim = own[0];
+        if (!victim) {
+            throw new Error(`POST ${ctx.gatewayUrl}/auth/credentials → 400 ${text}. The wallet is at its live-credential cap and no row is ` +
+                `labeled "${label}", so nothing can be reclaimed automatically. Revoke an unused credential ` +
+                `(GET /auth/credentials to list; DELETE with a signed {"access_key_id"} body), then retry.`);
+        }
+        console.warn(`[widget-runtime] credential cap reached — revoking oldest "${label}" credential ${victim.access_key_id} and retrying`);
+        await revokeCredentialById(ctx, victim.access_key_id);
+        res = await post();
+    }
+    if (!res.ok)
+        throw new Error(`POST ${ctx.gatewayUrl}/auth/credentials → ${res.status} ${await res.text()}`);
+    return (await res.json());
+}
+/**
+ * Acquire vault-bucket S3 credentials once and expose a memoized AwsClient.
+ * Shared by createVaultObjectStore AND createVaultUploader; the in-browser
+ * auth flow —
+ *   1. GET /auth/info → gateway_public_key.
+ *   2. Mint delegation token (subject = gateway_public_key).
+ *   3. POST /auth/credentials with signed headers — always mints a NEW,
+ *      labeled credential (cap-400 → reclaim our oldest labeled row, retry once).
+ * Credentials are minted on first use, so the signer is invoked only once per
+ * client under normal operation. Concurrent sessions each hold their own
+ * credential — the gateway supports many per wallet, so there is no
+ * revoke-each-other race anymore.
+ */
+function createCredCore(cfg) {
+    const fetchImpl = cfg.fetchImpl ?? globalThis.fetch;
+    const awsClientFactory = cfg.awsClientFactory ?? ((creds) => new AwsClient({ accessKeyId: creds.accessKeyId, secretAccessKey: creds.secretAccessKey, region: creds.region, service: 's3', ...(creds.sessionToken ? { sessionToken: creds.sessionToken } : {}) }));
+    const label = cfg.credentialLabel ?? CREDENTIAL_LABEL;
+    const ctx = {
+        fetchImpl, gatewayUrl: cfg.gatewayUrl,
+        sign: cfg.signerPair.sign, publicKey: cfg.signerPair.publicKey, sigType: cfg.sigType,
+    };
+    let credsPromise = null;
+    let awsPromise = null;
+    async function acquireCreds() {
+        const infoRes = await fetchImpl(`${cfg.gatewayUrl}/auth/info`, {
+            headers: await buildSignedHeaders(ctx.sign, ctx.publicKey, cfg.sigType),
+        });
+        if (!infoRes.ok)
+            throw new Error(`GET ${cfg.gatewayUrl}/auth/info → ${infoRes.status} ${await infoRes.text()}`);
+        const info = (await infoRes.json());
+        const token = await mintDelegationToken({
+            signerPair: { sign: ctx.sign, publicKey: ctx.publicKey }, signerType: cfg.sigType, subject: hexToU8a(info.gateway_public_key),
+        });
+        return registerCredentials(ctx, token, label);
+    }
+    function aws() {
+        if (!awsPromise) {
+            awsPromise = (async () => {
+                // reset on failure so a transient creds error doesn't permanently poison this client
+                if (!credsPromise)
+                    credsPromise = acquireCreds().catch((err) => { credsPromise = null; throw err; });
+                const creds = await credsPromise;
+                // SigV4 region: use the bucket's region (cfg.region), NOT creds.region —
+                // /auth/credentials may report a generic region (e.g. us-east-1) that
+                // mismatches the bucket's SigV4 credential scope → SignatureDoesNotMatch.
+                return awsClientFactory({
+                    accessKeyId: creds.access_key_id, secretAccessKey: creds.secret_access_key, region: cfg.region,
+                    ...(creds.session_token ? { sessionToken: creds.session_token } : {}),
+                });
+            })().catch((err) => { awsPromise = null; throw err; });
+        }
+        return awsPromise;
+    }
+    return {
+        gatewayUrl: cfg.gatewayUrl, bucketId: cfg.bucketId, region: cfg.region,
+        readTtl: cfg.readTtlSeconds ?? 21600,
+        aws,
+        async refresh() {
+            const stale = credsPromise ? await credsPromise.catch(() => null) : null;
+            credsPromise = null;
+            awsPromise = null;
+            // Mint the replacement FIRST so the wallet never goes credential-less
+            // (anonymous public reads are served via the newest live credential).
+            await aws();
+            if (stale) {
+                try {
+                    await revokeCredentialById(ctx, stale.access_key_id);
+                }
+                catch (err) {
+                    console.warn(`[widget-runtime] revoke of replaced credential failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        },
+    };
+}
+/**
+ * PUT bytes with bounded retries on 401/403. The gateway now holds MANY
+ * credentials per wallet, so a 403 no longer means "another session revoked
+ * my credential" — first retry with the SAME credential (transient gateway /
+ * propagation errors). Only if the failure persists, refresh the credential
+ * once: the underlying DDC delegation token may have expired, and minting a
+ * replacement (revoking the old row by id) is the only way to renew it.
+ */
+async function putWithRetry(core, url, body, contentType, onAttempt) {
+    const send = async () => {
+        const aws = await core.aws();
+        const sha = await sha256Hex(body);
+        onAttempt?.();
+        return aws.fetch(url, { method: 'PUT', body: body, headers: { 'Content-Type': contentType, 'X-Amz-Content-Sha256': sha } });
+    };
+    let res = await send();
+    if (res.status === 401 || res.status === 403) {
+        await res.text().catch(() => undefined); // drain the error body
+        console.warn('[widget-runtime] PUT 401/403 — retrying with the same credential');
+        res = await send();
+    }
+    if (res.status === 401 || res.status === 403) {
+        await res.text().catch(() => undefined);
+        console.warn('[widget-runtime] PUT still unauthorized — refreshing the credential and retrying once');
+        await core.refresh();
+        res = await send();
+    }
+    if (!res.ok)
+        throw new Error(`PUT ${url} → ${res.status} ${await res.text()}`);
+}
+/**
+ * Creates a WAV uploader that writes to a DDC S3-compatible vault bucket using
+ * the proven in-browser flow from the spike:
+ *   1. Derive signer from embed wallet (ed25519_signRaw).
+ *   2. GET /auth/info → gateway_public_key.
+ *   3. Mint delegation token (subject = gateway_public_key).
+ *   4. POST /auth/credentials with signed headers — always mints a NEW,
+ *      labeled credential for this uploader (cap-400 → reclaim our oldest
+ *      labeled row and retry once).
+ *   5. Per segment: SHA-256 WAV bytes, PUT via SigV4-signed AwsClient.
+ *
+ * S3 credentials are memoized (shared credential core) so the signer is only
+ * invoked once per uploader instance under normal operation.
+ */
+export function createVaultUploader(cfg) {
+    const core = createCredCore(cfg);
+    // Compute keyPrefix once per instance (not per call).
+    const keyPrefix = cfg.keyPrefix ?? `widget-audio/${crypto.randomUUID()}`;
+    const uploadedObjects = new Map();
+    // Presign (signed mode) or return the plain public URL. We deliberately do NOT
+    // read-back-verify each chunk: a credential refresh mid-batch (the PUT-retry
+    // path below) invalidates URLs presigned with the replaced credential — an
+    // intermittent SignatureDoesNotMatch on a verify GET that has no business
+    // failing the upload. `finalizeUrls` re-signs every object with the final
+    // stable credential after all chunks land, and the ASR stage retries its own
+    // reads; that is the stable path the pre-refactor uploader used (see
+    // docs/engineering/known-issues/2026-06-01-widget-audio-private-bucket-asr-403.md).
+    async function readableUrlForObject(aws, objectUrl) {
+        if (cfg.readMode === 'public')
+            return objectUrl;
+        const signed = await aws.sign(`${objectUrl}?X-Amz-Expires=${core.readTtl}`, { aws: { signQuery: true } });
+        return signed.url;
+    }
+    const uploadWav = (async function uploadWav(wav, index) {
+        const wavBytes = new Uint8Array(wav);
+        const contentSha256 = await sha256Hex(wavBytes);
+        // SigV4 region from the bucket (cfg.region), not creds.region.
+        const region = cfg.region;
+        const url = `${cfg.gatewayUrl}/${cfg.bucketId}/${keyPrefix}/${index}.wav`;
+        // Bounded 401/403 retry with backoff. Under the multi-credential gateway a
+        // 403 no longer means a concurrent session revoked our credential, so the
+        // first retry RE-USES the already-minted credential (transient gateway /
+        // propagation hiccups). If the failure persists past attempt 2, refresh the
+        // credential (the underlying DDC delegation token may have expired); the
+        // replaced row is revoked by id, so retries never leak rows toward the cap.
+        const maxAttempts = 4;
+        let lastStatus = 0;
+        let lastText = '';
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            const aws = await core.aws();
+            // NOTE: never log the RETURNED presigned url — it carries a bearer SigV4 sig.
+            console.log('[wr-up] PUT region=', region, 'bucket=', cfg.bucketId, 'index=', index, 'attempt=', attempt, 'bytes=', wavBytes.length, 'sha=', contentSha256.slice(0, 16));
+            const putRes = await aws.fetch(url, {
+                method: 'PUT',
+                // Send a Blob (an immutable, exact byte sequence) rather than the Uint8Array
+                // view: the browser transmits EXACTLY the bytes we hashed, so the gateway's
+                // recomputed SHA256(body) matches the signed X-Amz-Content-Sha256. Passing a
+                // typed-array view to fetch() can transmit its whole backing ArrayBuffer in
+                // the browser (not in Node) — that skew was the SignatureDoesNotMatch on
+                // segmented chunks. The gateway rejects UNSIGNED-PAYLOAD, so we sign the real
+                // content hash.
+                body: new Blob([wavBytes], { type: 'audio/wav' }),
+                headers: {
+                    'Content-Type': 'audio/wav',
+                    'X-Amz-Content-Sha256': contentSha256,
+                    ...(cfg.readMode === 'public' ? { 'x-amz-acl': 'public-read' } : {}),
+                },
+            });
+            if (putRes.ok) {
+                uploadedObjects.set(index, url);
+                return await readableUrlForObject(aws, url);
+            }
+            lastStatus = putRes.status;
+            lastText = await putRes.text();
+            if ((putRes.status === 403 || putRes.status === 401) && attempt < maxAttempts) {
+                if (attempt >= 2)
+                    await core.refresh();
+                await new Promise((r) => setTimeout(r, 600 * attempt));
+                continue;
+            }
+            break;
+        }
+        throw new Error(`PUT ${url} → ${lastStatus} ${lastText}`);
+    });
+    uploadWav.finalizeUrls = async (urls) => {
+        if (uploadedObjects.size === 0)
+            return urls;
+        const aws = await core.aws();
+        const entries = [...uploadedObjects.entries()].sort(([a], [b]) => a - b);
+        const signed = [];
+        for (const [, objectUrl] of entries) {
+            signed.push(await readableUrlForObject(aws, objectUrl));
+        }
+        return signed;
+    };
+    return uploadWav;
+}
+/**
+ * Whole-file companion to createVaultUploader: PUT an object at a STABLE,
+ * caller-chosen key and re-sign GET URLs for it on demand. Used to persist a
+ * durable interview recording (store the key, not the expiring presigned URL)
+ * and re-sign playback URLs from the candidate modal — same private bucket,
+ * same wallet, so the grant can always be re-minted. Shares the auth flow with
+ * the segment uploader via createCredCore.
+ */
+export function createVaultObjectStore(cfg) {
+    const core = createCredCore(cfg);
+    const objectUrl = (key) => `${core.gatewayUrl}/${core.bucketId}/${key.replace(/^\/+/, '')}`;
+    return {
+        async put(bytes, key, contentType) {
+            const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+            const url = objectUrl(key);
+            await putWithRetry(core, url, u8, contentType, () => console.log('[wr-up] PUT object region=', core.region, 'bucket=', core.bucketId, 'bytes=', u8.length, 'type=', contentType));
+            return key;
+        },
+        async signGet(key, ttlSeconds) {
+            const aws = await core.aws();
+            const signed = await aws.sign(`${objectUrl(key)}?X-Amz-Expires=${ttlSeconds ?? core.readTtl}`, { aws: { signQuery: true } });
+            return signed.url;
+        },
+    };
+}

package/dist/audio/clip-registry.d.ts

@@ -0,0 +1,20 @@
+/** A playable clip: an object URL bound to the conversation it belongs to. */
+export interface Clip {
+    conversationId: string;
+    url: string;
+}
+export interface ClipRegistry {
+    /** Record (or replace) the clip for a conversation. Replacing revokes the stale url for that id only. */
+    set(conversationId: string, url: string): void;
+    /** The clip for a conversation, or null if none is registered. */
+    get(conversationId: string): Clip | null;
+    /** The most recently registered clip, or null. */
+    last(): Clip | null;
+    /** Revoke every clip url and empty the registry (e.g. on teardown). */
+    clear(): void;
+}
+export interface ClipRegistryOptions {
+    /** Object-URL reclaimer; defaults to URL.revokeObjectURL. Injectable for tests. */
+    revoke?: (url: string) => void;
+}
+export declare function createClipRegistry(opts?: ClipRegistryOptions): ClipRegistry;

package/dist/audio/clip-registry.js

@@ -0,0 +1,47 @@
+// packages/widget-runtime/src/audio/clip-registry.ts
+//
+// Keeps every uploaded/recorded clip playable for the lifetime of the session,
+// keyed by conversation_id. The uploader previously held a SINGLE clip slot and
+// revoked the prior clip's object URL on each new upload, so only the latest
+// upload stayed playable — an older run's audio player vanished as soon as you
+// uploaded a new one. A registry lets each conversation keep its own object URL,
+// so the host can render a player per run without depending on IndexedDB
+// (which is best-effort and unavailable in some sandboxed/private contexts).
+export function createClipRegistry(opts = {}) {
+    const revoke = opts.revoke ??
+        ((url) => {
+            try {
+                URL.revokeObjectURL(url);
+            }
+            catch {
+                /* already revoked / unsupported */
+            }
+        });
+    // Insertion-ordered map; the last entry is the most recent clip.
+    const clips = new Map();
+    return {
+        set(conversationId, url) {
+            const prev = clips.get(conversationId);
+            if (prev !== undefined && prev !== url)
+                revoke(prev);
+            // Re-insert so this conversation becomes the most-recent entry.
+            clips.delete(conversationId);
+            clips.set(conversationId, url);
+        },
+        get(conversationId) {
+            const url = clips.get(conversationId);
+            return url === undefined ? null : { conversationId, url };
+        },
+        last() {
+            let lastEntry = null;
+            for (const [conversationId, url] of clips)
+                lastEntry = { conversationId, url };
+            return lastEntry;
+        },
+        clear() {
+            for (const url of clips.values())
+                revoke(url);
+            clips.clear();
+        },
+    };
+}

package/dist/audio/ddc-delegation.d.ts

@@ -0,0 +1,18 @@
+export declare const Operation: Readonly<{
+    PUT: 1;
+    GET: 2;
+    DELETE: 3;
+}>;
+export interface AsyncSignerPair {
+    sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+    publicKey: Uint8Array;
+}
+export interface MintOpts {
+    signerPair: AsyncSignerPair;
+    signerType: 'ed25519' | 'sr25519';
+    subject: Uint8Array;
+    bucketId?: bigint | number;
+    expiresIn?: number;
+    operations?: number[];
+}
+export declare function mintDelegationToken(opts: MintOpts): Promise<string>;

package/dist/audio/ddc-delegation.js

@@ -0,0 +1,64 @@
+// packages/widget-runtime/src/audio/ddc-delegation.ts
+// Async DDC delegation-token mint — ported VERBATIM from
+//   agents/dating-coach/scripts/lib/ddc-delegation-token.ts
+// The only change from the agent version: mintDelegationToken is async and
+// awaits signerPair.sign(…), matching the in-browser signing path where the
+// embed-wallet provider.request() is always Promise-based.
+import { base58Encode } from '@polkadot/util-crypto';
+function encodeVarint(value) {
+    const bytes = [];
+    let v = typeof value === 'bigint' ? value : BigInt(value);
+    if (v < 0n)
+        v &= 0xffffffffffffffffn;
+    do {
+        const b = Number(v & 0x7fn);
+        v >>= 7n;
+        bytes.push(v > 0n ? b | 0x80 : b);
+    } while (v > 0n);
+    return new Uint8Array(bytes);
+}
+function concat(...arrays) {
+    const total = arrays.reduce((n, a) => n + a.length, 0);
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const a of arrays) {
+        out.set(a, off);
+        off += a.length;
+    }
+    return out;
+}
+const fieldTag = (num, wireType) => encodeVarint(num * 8 + wireType);
+const fVarint = (num, value) => concat(fieldTag(num, 0), encodeVarint(value));
+const fBytes = (num, bytes) => concat(fieldTag(num, 2), encodeVarint(bytes.length), bytes);
+// Signature { algorithm(1), signer(2), value(3) }
+function encodeSignature(algorithm, signerBytes, sigBytes) {
+    return concat(fVarint(1, algorithm), fBytes(2, signerBytes), fBytes(3, sigBytes));
+}
+// Payload { subject(2), canDelegate(3), bucketId(4)?, operations(5), expiresAt(6) }
+function encodePayload({ subject, canDelegate, bucketId, operations, expiresAt }) {
+    const parts = [fBytes(2, subject), fVarint(3, canDelegate ? 1 : 0)];
+    if (bucketId !== undefined)
+        parts.push(fVarint(4, typeof bucketId === 'bigint' ? bucketId : BigInt(bucketId)));
+    // operations is a proto3 `repeated Operation` field, packed encoding — matches token.mjs.
+    if (operations.length > 0)
+        parts.push(fBytes(5, concat(...operations.map((op) => encodeVarint(op)))));
+    parts.push(fVarint(6, expiresAt));
+    return concat(...parts);
+}
+// AuthToken { signature(1), payload(2) }
+const encodeAuthToken = (sigMsgBytes, payloadBytes) => concat(fBytes(1, sigMsgBytes), fBytes(2, payloadBytes));
+export const Operation = Object.freeze({ PUT: 1, GET: 2, DELETE: 3 });
+const Algorithm = Object.freeze({ ED_25519: 0, SR_25519: 1 });
+export async function mintDelegationToken(opts) {
+    const { signerPair, signerType, subject, bucketId, expiresIn = 30 * 24 * 60 * 60 * 1000, operations = [Operation.PUT, Operation.GET, Operation.DELETE], } = opts;
+    const expiresAt = Date.now() + expiresIn;
+    const payloadBytes = encodePayload({
+        subject, canDelegate: true, operations, expiresAt,
+        ...(bucketId !== undefined ? { bucketId } : {}),
+    });
+    const tokenBodyForSigning = fBytes(2, payloadBytes);
+    const sigBytes = await signerPair.sign(tokenBodyForSigning);
+    const algorithm = signerType === 'ed25519' ? Algorithm.ED_25519 : Algorithm.SR_25519;
+    const sigMsg = encodeSignature(algorithm, signerPair.publicKey, sigBytes);
+    return base58Encode(encodeAuthToken(sigMsg, payloadBytes));
+}

package/dist/audio/mic.d.ts

@@ -0,0 +1 @@
+export declare function requestMicStream(): Promise<MediaStream>;