@continuonai/rcan-ts 1.2.3 → 1.3.0

package/dist/rcan-validate.js

@@ -3235,6 +3235,7 @@ function validateConfig(config) {
 }
 
 // src/crypto.ts
+var import_ml_dsa = require("@noble/post-quantum/ml-dsa.js");
 function generateUUID() {
   if (typeof globalThis.crypto !== "undefined" && typeof globalThis.crypto.randomUUID === "function") {
     return globalThis.crypto.randomUUID();

package/dist/rcan.iife.js

@@ -1,13 +1,17 @@
-"use strict";var RCAN=(()=>{var _s=Object.create;var nt=Object.defineProperty;var xs=Object.getOwnPropertyDescriptor;var bs=Object.getOwnPropertyNames;var ws=Object.getPrototypeOf,As=Object.prototype.hasOwnProperty;var de=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var ye=(t,e)=>()=>(t&&(e=t(t=0)),e);var on=(t,e)=>{for(var r in e)nt(t,r,{get:e[r],enumerable:!0})},sn=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of bs(e))!As.call(t,o)&&o!==r&&nt(t,o,{get:()=>e[o],enumerable:!(n=xs(e,o))||n.enumerable});return t};var an=(t,e,r)=>(r=t!=null?_s(ws(t)):{},sn(e||!t||!t.__esModule?nt(r,"default",{value:t,enumerable:!0}):r,t)),cn=t=>sn(nt({},"__esModule",{value:!0}),t);var d=ye(()=>{});function wr(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Ar(t,e=""){if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new Error(`${r}expected integer >= 0, got ${t}`)}}function O(t,e,r=""){let n=wr(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,a=s?` of length ${e}`:"",u=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+a+", got "+u)}return t}function Er(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function vo(t,e){O(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function No(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function Sr(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Ws(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function Qs(t){for(let e=0;e<t.length;e++)t[e]=Ws(t[e]);return t}function Tr(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];O(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function Io(t,e={}){let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function Mo(t=32){let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return e.getRandomValues(new Uint8Array(t))}var Ys,Cr,kr,Mt=ye(()=>{"use strict";d();Ys=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;Cr=Ys?t=>t:Qs;kr=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])})});function Uo(t,e=""){if(typeof t!="boolean"){let r=e&&`"${e}" `;throw new Error(r+"expected boolean, got type="+typeof t)}return t}var Po=ye(()=>{"use strict";d();});function zs(t,e=!1){return e?{h:Number(t&Ut),l:Number(t>>Lo&Ut)}:{h:Number(t>>Lo&Ut)|0,l:Number(t&Ut)|0}}function Do(t,e=!1){let r=t.length,n=new Uint32Array(r),o=new Uint32Array(r);for(let s=0;s<r;s++){let{h:i,l:a}=zs(t[s],e);[n[s],o[s]]=[i,a]}return[n,o]}var Ut,Lo,$o,Bo,jo,qo,Ho=ye(()=>{"use strict";d();Ut=BigInt(4294967295),Lo=BigInt(32);$o=(t,e,r)=>t<<r|e>>>32-r,Bo=(t,e,r)=>e<<r|t>>>32-r,jo=(t,e,r)=>e<<r-32|t>>>64-r,qo=(t,e,r)=>t<<r-32|e>>>64-r});function si(t,e=24){let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let i=0;i<10;i++)r[i]=t[i]^t[i+10]^t[i+20]^t[i+30]^t[i+40];for(let i=0;i<10;i+=2){let a=(i+8)%10,u=(i+2)%10,p=r[u],g=r[u+1],v=Fo(p,g,1)^r[a],k=Ko(p,g,1)^r[a+1];for(let w=0;w<50;w+=10)t[i+w]^=v,t[i+w+1]^=k}let o=t[2],s=t[3];for(let i=0;i<24;i++){let a=Go[i],u=Fo(o,s,a),p=Ko(o,s,a),g=Vo[i];o=t[g],s=t[g+1],t[g]=u,t[g+1]=p}for(let i=0;i<50;i+=10){for(let a=0;a<10;a++)r[a]=t[i+a];for(let a=0;a<10;a++)t[i+a]^=~r[(a+2)%10]&r[(a+4)%10]}t[0]^=ni[n],t[1]^=oi[n]}Sr(r)}var Xs,Qe,Zs,ei,ti,ri,Vo,Go,Jo,Yo,ni,oi,Fo,Ko,Or,Wo,Qo,X,vr=ye(()=>{"use strict";d();Ho();Mt();Xs=BigInt(0),Qe=BigInt(1),Zs=BigInt(2),ei=BigInt(7),ti=BigInt(256),ri=BigInt(113),Vo=[],Go=[],Jo=[];for(let t=0,e=Qe,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],Vo.push(2*(5*n+r)),Go.push((t+1)*(t+2)/2%64);let o=Xs;for(let s=0;s<7;s++)e=(e<<Qe^(e>>ei)*ri)%ti,e&Zs&&(o^=Qe<<(Qe<<BigInt(s))-Qe);Jo.push(o)}Yo=Do(Jo,!0),ni=Yo[0],oi=Yo[1],Fo=(t,e,r)=>r>32?jo(t,e,r):$o(t,e,r),Ko=(t,e,r)=>r>32?qo(t,e,r):Bo(t,e,r);Or=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;enableXOF=!1;rounds;constructor(e,r,n,o=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=o,this.rounds=s,Ar(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=No(this.state)}clone(){return this._cloneInto()}keccak(){Cr(this.state32),si(this.state32,this.rounds),Cr(this.state32),this.posOut=0,this.pos=0}update(e){Er(this),O(e);let{blockLen:r,state:n}=this,o=e.length;for(let s=0;s<o;){let i=Math.min(r-this.pos,o-s);for(let a=0;a<i;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:o}=this;e[n]^=r,(r&128)!==0&&n===o-1&&this.keccak(),e[o-1]^=128,this.keccak()}writeInto(e){Er(this,!1),O(e),this.finish();let r=this.state,{blockLen:n}=this;for(let o=0,s=e.length;o<s;){this.posOut>=n&&this.keccak();let i=Math.min(n-this.posOut,s-o);e.set(r.subarray(this.posOut,this.posOut+i),o),this.posOut+=i,o+=i}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return Ar(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(vo(e,this),this.finished)throw new Error("digest() was already called");return this.writeInto(e),this.destroy(),e}digest(){return this.digestInto(new Uint8Array(this.outputLen))}destroy(){this.destroyed=!0,Sr(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:o,rounds:s,enableXOF:i}=this;return e||=new t(r,n,o,i,s),e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=o,e.enableXOF=i,e.destroyed=this.destroyed,e}},Wo=(t,e,r,n={})=>Io((o={})=>new Or(e,t,o.dkLen===void 0?r:o.dkLen,!0),n),Qo=Wo(31,168,16,kr(11)),X=Wo(31,136,32,kr(12))});function Nr(t){if(!Number.isSafeInteger(t)||t<0||t>4294967295)throw new Error("wrong u32 integer:"+t);return t}function Xo(t){return Nr(t),(t&t-1)===0&&t!==0}function Ir(t,e){Nr(t);let r=0;for(let n=0;n<e;n++,t>>>=1)r=r<<1|t&1;return r}function Zo(t){return Nr(t),31-Math.clz32(t)}function zo(t){let e=t.length;if(e<2||!Xo(e))throw new Error("n must be a power of 2 and greater than 1. Got "+e);let r=Zo(e);for(let n=0;n<e;n++){let o=Ir(n,r);if(n<o){let s=t[n];t[n]=t[o],t[o]=s}}return t}var Mr,es=ye(()=>{"use strict";d();Mr=(t,e)=>{let{N:r,roots:n,dit:o,invertButterflies:s=!1,skipStages:i=0,brp:a=!0}=e,u=Zo(r);if(!Xo(r))throw new Error("FFT: Polynomial size should be power of two");let p=o!==s;return g=>{if(g.length!==r)throw new Error("FFT: wrong Polynomial length");o&&a&&zo(g);for(let v=0,k=1;v<u-i;v++){let w=o?v+1+i:u-v,M=1<<w,S=M>>1,L=r>>w;for(let K=0;K<r;K+=M)for(let _=0,b=k++;_<S;_++){let N=s?o?r-b:b:_*L,I=K+_,D=K+_+S,V=n[N],U=g[D],R=g[I];if(p){let P=t.mul(U,V);g[I]=t.add(R,P),g[D]=t.sub(R,P)}else s?(g[I]=t.add(U,R),g[D]=t.mul(t.sub(U,R),V)):(g[I]=t.add(R,U),g[D]=t.mul(t.sub(R,U),V))}}return!o&&a&&zo(g),g}}});function Pr(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}function Lr(t){if(typeof t!="object"||t===null||wr(t))throw new Error("expected opts to be an object")}function Pt(t){Lr(t),t.context!==void 0&&O(t.context,void 0,"opts.context")}function Lt(t){Pt(t),t.extraEntropy!==!1&&t.extraEntropy!==void 0&&O(t.extraEntropy,void 0,"opts.extraEntropy")}function ze(t,...e){let r=o=>typeof o=="number"?o:o.bytesLen,n=e.reduce((o,s)=>o+r(s),0);return{bytesLen:n,encode:o=>{let s=new Uint8Array(n);for(let i=0,a=0;i<e.length;i++){let u=e[i],p=r(u),g=typeof u=="number"?o[i]:u.encode(o[i]);O(g,p,t),s.set(g,a),typeof u!="number"&&g.fill(0),a+=p}return s},decode:o=>{O(o,n,t);let s=[];for(let i of e){let a=r(i),u=o.subarray(0,a);s.push(typeof i=="number"?u:i.decode(u)),o=o.subarray(a)}return s}}}function Ie(t,e){let r=e*t.bytesLen;return{bytesLen:r,encode:n=>{if(n.length!==e)throw new Error(`vecCoder.encode: wrong length=${n.length}. Expected: ${e}`);let o=new Uint8Array(r);for(let s=0,i=0;s<n.length;s++){let a=t.encode(n[s]);o.set(a,i),a.fill(0),i+=a.length}return o},decode:n=>{O(n,r);let o=[];for(let s=0;s<n.length;s+=t.bytesLen)o.push(t.decode(n.subarray(s,s+t.bytesLen)));return o}}}function ge(...t){for(let e of t)if(Array.isArray(e))for(let r of e)r.fill(0);else e.fill(0)}function Dr(t){return(1<<t)-1}function $r(t,e=ts){if(O(t),O(e),e.length>255)throw new Error("context should be less than 255 bytes");return Tr(new Uint8Array([0,e.length]),e,t)}function rs(t,e=0){if(!t.oid||!Pr(t.oid.subarray(0,10),ii))throw new Error("hash.oid is invalid: expected NIST hash");let r=t.outputLen*8/2;if(e>r)throw new Error("Pre-hash security strength too low: "+r+", required: "+e)}function Br(t,e,r=ts){if(O(e),O(r),r.length>255)throw new Error("context should be less than 255 bytes");let n=t(e);return Tr(new Uint8Array([1,r.length]),r,t.oid,n)}var Ur,ts,ii,jr=ye(()=>{"use strict";d();Mt();Mt();Ur=Mo;ts=Uint8Array.of();ii=Uint8Array.from([6,9,96,134,72,1,101,3,4,2])});var ns,os,Dt,$t,ss=ye(()=>{"use strict";d();es();vr();jr();ns=t=>{let{newPoly:e,N:r,Q:n,F:o,ROOT_OF_UNITY:s,brvBits:i,isKyber:a}=t,u=(_,b=n)=>{let N=_%b|0;return(N>=0?N|0:b+N|0)|0},p=(_,b=n)=>{let N=u(_,b)|0;return(N>b>>1?N-b|0:N)|0};function g(){let _=e(r);for(let b=0;b<r;b++){let N=Ir(b,i),I=BigInt(s)**BigInt(N)%BigInt(n);_[b]=Number(I)|0}return _}let v=g(),k={add:(_,b)=>u((_|0)+(b|0))|0,sub:(_,b)=>u((_|0)-(b|0))|0,mul:(_,b)=>u((_|0)*(b|0))|0,inv:_=>{throw new Error("not implemented")}},w={N:r,roots:v,invertButterflies:!0,skipStages:a?1:0,brp:!1},M=Mr(k,{dit:!1,...w}),S=Mr(k,{dit:!0,...w});return{mod:u,smod:p,nttZetas:v,NTT:{encode:_=>M(_),decode:_=>{S(_);for(let b=0;b<_.length;b++)_[b]=u(o*_[b]);return _}},bitsCoder:(_,b)=>{let N=Dr(_),I=_*(r/8);return{bytesLen:I,encode:D=>{let V=new Uint8Array(I);for(let U=0,R=0,P=0,ae=0;U<D.length;U++)for(R|=(b.encode(D[U])&N)<<P,P+=_;P>=8;P-=8,R>>=8)V[ae++]=R&Dr(P);return V},decode:D=>{let V=e(r);for(let U=0,R=0,P=0,ae=0;U<D.length;U++)for(R|=D[U]<<P,P+=8;P>=_;P-=_,R>>=_)V[ae++]=b.decode(R&N);return V}}}}},os=t=>(e,r)=>{r||(r=t.blockLen);let n=new Uint8Array(e.length+2);n.set(e);let o=e.length,s=new Uint8Array(r),i=t.create({}),a=0,u=0;return{stats:()=>({calls:a,xofs:u}),get:(p,g)=>(n[o+0]=p,n[o+1]=g,i.destroy(),i=t.create({}).update(n),a++,()=>(u++,i.xofInto(s))),clean:()=>{i.destroy(),ge(s,n)}}},Dt=os(Qo),$t=os(X)});var Kr={};on(Kr,{PARAMS:()=>qt,ml_dsa44:()=>fi,ml_dsa65:()=>li,ml_dsa87:()=>pi});function is(t){Lr(t),t.externalMu!==void 0&&Uo(t.externalMu,"opts.externalMu")}function Bt(t){let e=re(T);for(let r=0;r<T;){let n=t();if(n.length%3)throw new Error("RejNTTPoly: unaligned block");for(let o=0;r<T&&o<=n.length-3;o+=3){let s=(n[o+0]|n[o+1]<<8|n[o+2]<<16)&8388607;s<Te&&(e[r++]=s)}}return e}function Fr(t){let{K:e,L:r,GAMMA1:n,GAMMA2:o,TAU:s,ETA:i,OMEGA:a}=t,{CRH_BYTES:u,TR_BYTES:p,C_TILDE_BYTES:g,XOF128:v,XOF256:k,securityLevel:w}=t;if(![2,4].includes(i))throw new Error("Wrong ETA");if(![1<<17,1<<19].includes(n))throw new Error("Wrong GAMMA1");if(![qr,Hr].includes(o))throw new Error("Wrong GAMMA2");let M=s*i,S=f=>{let h=Me(f),l=jt(h,2*o)|0;return h-l===Te-1?{r1:0,r0:l-1|0}:{r1:Math.floor((h-l)/(2*o))|0,r0:l}},L=f=>S(f).r1,K=f=>S(f).r0,_=(f,h)=>f<=o||f>Te-o||f===Te-o&&h===0?0:1,b=(f,h)=>{let l=Math.floor((Te-1)/(2*o)),{r1:m,r0:c}=S(h);return f===1?c>0?Me(m+1,l)|0:Me(m-1,l)|0:m|0},N=f=>{let h=Me(f),l=jt(h,2**Ue)|0;return{r1:Math.floor((h-l)/2**Ue)|0,r0:l}},I={bytesLen:a+e,encode:f=>{if(f===!1)throw new Error("hint.encode: hint is false");let h=new Uint8Array(a+e);for(let l=0,m=0;l<e;l++){for(let c=0;c<T;c++)f[l][c]!==0&&(h[m++]=c);h[a+l]=m}return h},decode:f=>{let h=[],l=0;for(let m=0;m<e;m++){let c=re(T);if(f[a+m]<l||f[a+m]>a)return!1;for(let A=l;A<f[a+m];A++){if(A>l&&f[A]<=f[A-1])return!1;c[f[A]]=1}l=f[a+m],h.push(c)}for(let m=l;m<a;m++)if(f[m]!==0)return!1;return h}},D=Xe(i===2?3:4,f=>i-f,f=>{if(!(-i<=f&&f<=i))throw new Error(`malformed key s1/s3 ${f} outside of ETA range [${-i}, ${i}]`);return f}),V=Xe(13,f=>(1<<Ue-1)-f),U=Xe(10),R=Xe(n===1<<17?18:20,f=>jt(n-f)),P=Xe(o===qr?6:4),ae=Ie(P,e),ke=ze("publicKey",32,Ie(U,e)),Pe=ze("secretKey",32,32,p,Ie(D,r),Ie(D,e),Ie(V,e)),Le=ze("signature",g,Ie(R,r),I),et=i===2?f=>f<15?2-f%5:!1:f=>f<9?4-f:!1;function Qr(f){let h=re(T);for(let l=0;l<T;){let m=f();for(let c=0;l<T&&c<m.length;c+=1){let A=et(m[c]&15),G=et(m[c]>>4&15);A!==!1&&(h[l++]=A),l<T&&G!==!1&&(h[l++]=G)}}return h}let zr=f=>{let h=re(T),l=X.create({}).update(f),m=new Uint8Array(X.blockLen);l.xofInto(m);let c=m.slice(0,8);for(let A=T-s,G=8,W=0,$=0;A<T;A++){let B=A+1;for(;B>A;)B=m[G++],!(G<X.blockLen)&&(l.xofInto(m),G=0);h[A]=h[B],h[B]=1-((c[W]>>$++&1)<<1),$>=8&&(W++,$=0)}return h},Xr=f=>{let h=re(T),l=re(T);for(let m=0;m<f.length;m++){let{r0:c,r1:A}=N(f[m]);h[m]=c,l[m]=A}return{r0:h,r1:l}},hs=(f,h)=>{for(let l=0;l<T;l++)f[l]=b(h[l],f[l]);return f},ys=(f,h)=>{let l=re(T),m=0;for(let c=0;c<T;c++){let A=_(f[c],h[c]);l[c]=A,m+=A}return{v:l,cnt:m}},Zr=32,en=ze("seed",32,64,32),se={info:{type:"internal-ml-dsa"},lengths:{secretKey:Pe.bytesLen,publicKey:ke.bytesLen,seed:32,signature:Le.bytesLen,signRand:Zr},keygen:f=>{let h=new Uint8Array(34),l=f===void 0;l&&(f=Ur(32)),O(f,32,"seed"),h.set(f),l&&ge(f),h[32]=e,h[33]=r;let[m,c,A]=en.decode(X(h,{dkLen:en.bytesLen})),G=k(c),W=[];for(let y=0;y<r;y++)W.push(Qr(G.get(y&255,y>>8&255)));let $=[];for(let y=r;y<r+e;y++)$.push(Qr(G.get(y&255,y>>8&255)));let B=W.map(y=>F.encode(y.slice())),j=[],J=[],me=v(m),H=re(T);for(let y=0;y<e;y++){ge(H);for(let ee=0;ee<r;ee++){let ue=Bt(me.get(ee,y));Se(H,Ce(ue,B[ee]))}F.decode(H);let{r0:ne,r1:Z}=Xr(Se(H,$[y]));j.push(ne),J.push(Z)}let ce=ke.encode([m,J]),he=X(ce,{dkLen:p}),De=Pe.encode([m,A,he,W,$,j]);return me.clean(),G.clean(),ge(m,c,A,W,$,B,H,j,J,he,h),{publicKey:ce,secretKey:De}},getPublicKey:f=>{let[h,l,m,c,A,G]=Pe.decode(f),W=v(h),$=c.map(J=>F.encode(J.slice())),B=[],j=re(T);for(let J=0;J<e;J++){j.fill(0);for(let H=0;H<r;H++){let ce=Bt(W.get(H,J));Se(j,Ce(ce,$[H]))}F.decode(j),Se(j,A[J]);let{r1:me}=Xr(j);B.push(me)}return W.clean(),ge(j,$,G,c,A),ke.encode([h,B])},sign:(f,h,l={})=>{Lt(l),is(l);let{extraEntropy:m,externalMu:c=!1}=l,[A,G,W,$,B,j]=Pe.decode(h),J=[],me=v(A);for(let y=0;y<e;y++){let ne=[];for(let Z=0;Z<r;Z++)ne.push(Bt(me.get(Z,y)));J.push(ne)}me.clean();for(let y=0;y<r;y++)F.encode($[y]);for(let y=0;y<e;y++)F.encode(B[y]),F.encode(j[y]);let H=c?f:X.create({dkLen:u}).update(W).update(f).digest(),ce=m===!1?new Uint8Array(32):m===void 0?Ur(Zr):m;O(ce,32,"extraEntropy");let he=X.create({dkLen:u}).update(G).update(ce).update(H).digest();O(he,u);let De=k(he,R.bytesLen);e:for(let y=0;;){let ne=[];for(let C=0;C<r;C++,y++)ne.push(R.decode(De.get(y&255,y>>8)()));let Z=ne.map(C=>F.encode(C.slice())),ee=[];for(let C=0;C<e;C++){let Fe=re(T);for(let xe=0;xe<r;xe++)Se(Fe,Ce(J[C][xe],Z[xe]));F.decode(Fe),ee.push(Fe)}let ue=ee.map(C=>C.map(L)),He=X.create({dkLen:g}).update(H).update(ae.encode(ue)).digest(),tt=F.encode(zr(He)),rt=$.map(C=>Ce(C,tt));for(let C=0;C<r;C++)if(Se(F.decode(rt[C]),ne[C]),Ze(rt[C],n-M))continue e;let tn=0,Ft=[];for(let C=0;C<e;C++){let Fe=F.decode(Ce(B[C],tt)),xe=cs(ee[C],Fe).map(K);if(Ze(xe,o-M))continue e;let rn=F.decode(Ce(j[C],tt));if(Ze(rn,o))continue e;Se(xe,rn);let nn=ys(xe,ue[C]);Ft.push(nn.v),tn+=nn.cnt}if(tn>a)continue;De.clean();let Rs=Le.encode([He,rt,Ft]);return ge(He,rt,Ft,tt,ue,ee,Z,ne,he,H,$,B,j,...J),Rs}throw new Error("Unreachable code path reached, report this error")},verify:(f,h,l,m={})=>{is(m);let{externalMu:c=!1}=m,[A,G]=ke.decode(l),W=X(l,{dkLen:p});if(f.length!==Le.bytesLen)return!1;let[$,B,j]=Le.decode(f);if(j===!1)return!1;for(let y=0;y<r;y++)if(Ze(B[y],n-M))return!1;let J=c?h:X.create({dkLen:u}).update(W).update(h).digest(),me=F.encode(zr($)),H=B.map(y=>y.slice());for(let y=0;y<r;y++)F.encode(H[y]);let ce=[],he=v(A);for(let y=0;y<e;y++){let ne=Ce(F.encode(di(G[y])),me),Z=re(T);for(let ue=0;ue<r;ue++){let He=Bt(he.get(ue,y));Se(Z,Ce(He,H[ue]))}let ee=F.decode(cs(Z,ne));ce.push(hs(ee,j[y]))}he.clean();let De=X.create({dkLen:g}).update(J).update(ae.encode(ce)).digest();for(let y of j)if(!(y.reduce((Z,ee)=>Z+ee,0)<=a))return!1;for(let y of B)if(Ze(y,n-M))return!1;return Pr($,De)}};return{info:{type:"ml-dsa"},internal:se,securityLevel:w,keygen:se.keygen,lengths:se.lengths,getPublicKey:se.getPublicKey,sign:(f,h,l={})=>{Lt(l);let m=$r(f,l.context),c=se.sign(m,h,l);return ge(m),c},verify:(f,h,l,m={})=>(Pt(m),se.verify(f,$r(h,m.context),l)),prehash:f=>(rs(f,w),{info:{type:"hashml-dsa"},securityLevel:w,lengths:se.lengths,keygen:se.keygen,getPublicKey:se.getPublicKey,sign:(h,l,m={})=>{Lt(m);let c=Br(f,h,m.context),A=se.sign(c,l,m);return ge(c),A},verify:(h,l,m,c={})=>(Pt(c),se.verify(h,Br(f,l,c.context),m))})}}var T,Te,ai,ci,Ue,qr,Hr,qt,re,Me,jt,F,ui,as,Xe,Se,cs,di,Ze,Ce,fi,li,pi,Vr=ye(()=>{"use strict";d();Po();vr();ss();jr();T=256,Te=8380417,ai=1753,ci=8347681,Ue=13,qr=Math.floor((Te-1)/88)|0,Hr=Math.floor((Te-1)/32)|0,qt={2:{K:4,L:4,D:Ue,GAMMA1:2**17,GAMMA2:qr,TAU:39,ETA:2,OMEGA:80},3:{K:6,L:5,D:Ue,GAMMA1:2**19,GAMMA2:Hr,TAU:49,ETA:4,OMEGA:55},5:{K:8,L:7,D:Ue,GAMMA1:2**19,GAMMA2:Hr,TAU:60,ETA:2,OMEGA:75}},re=t=>new Int32Array(t),{mod:Me,smod:jt,NTT:F,bitsCoder:ui}=ns({N:T,Q:Te,F:ci,ROOT_OF_UNITY:ai,newPoly:re,isKyber:!1,brvBits:8}),as=t=>t,Xe=(t,e=as,r=as)=>ui(t,{encode:n=>e(r(n)),decode:n=>r(e(n))}),Se=(t,e)=>{for(let r=0;r<t.length;r++)t[r]=Me(t[r]+e[r]);return t},cs=(t,e)=>{for(let r=0;r<t.length;r++)t[r]=Me(t[r]-e[r]);return t},di=t=>{for(let e=0;e<T;e++)t[e]<<=Ue;return t},Ze=(t,e)=>{for(let r=0;r<T;r++)if(Math.abs(jt(t[r]))>=e)return!0;return!1},Ce=(t,e)=>{let r=re(T);for(let n=0;n<t.length;n++)r[n]=Me(t[n]*e[n]);return r};fi=Fr({...qt[2],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:32,XOF128:Dt,XOF256:$t,securityLevel:128}),li=Fr({...qt[3],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:48,XOF128:Dt,XOF256:$t,securityLevel:192}),pi=Fr({...qt[5],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:64,XOF128:Dt,XOF256:$t,securityLevel:256})});var xi={};on(xi,{AUTHORITY_ERROR_CODES:()=>Co,AuditChain:()=>ct,AuditError:()=>at,COMPETITION_SCOPE_LEVEL:()=>gr,CONTRIBUTE_SCOPE_LEVEL:()=>pr,ClockDriftError:()=>Ke,CommitmentRecord:()=>$e,ConfidenceGate:()=>st,DEFAULT_LOA_POLICY:()=>Hn,DataCategory:()=>zt,FIRMWARE_MANIFEST_PATH:()=>Ro,FaultCode:()=>Xt,FederationSyncType:()=>nr,FirmwareIntegrityError:()=>Nt,GateError:()=>Re,HiTLGate:()=>it,KeyStore:()=>Et,LOA_TO_SCOPES:()=>hi,LevelOfAssurance:()=>qn,M2MAuthError:()=>z,M2M_TRUSTED_ISSUER:()=>It,MLDSAKeyPair:()=>Ht,MediaEncoding:()=>ur,MessageType:()=>fe,NodeClient:()=>Rt,OfflineModeManager:()=>kt,PRODUCTION_LOA_POLICY:()=>Fn,QoSAckTimeoutError:()=>xt,QoSLevel:()=>Yt,QoSManager:()=>bt,RCANAddressError:()=>ut,RCANConfigAuthorizationError:()=>ht,RCANDelegationChainError:()=>mt,RCANError:()=>Q,RCANGateError:()=>ft,RCANMessage:()=>E,RCANMessageError:()=>oe,RCANNodeError:()=>Ne,RCANNodeNotFoundError:()=>_e,RCANNodeSyncError:()=>Y,RCANNodeTrustError:()=>Be,RCANRegistryError:()=>ve,RCANReplayAttackError:()=>gt,RCANSignatureError:()=>lt,RCANValidationError:()=>dt,RCANVersionIncompatibleError:()=>pt,RCAN_VERSION:()=>_i,ROLE_JWT_LEVEL:()=>je,RRF_REVOCATION_CACHE_TTL_MS:()=>yr,RRF_REVOCATION_URL:()=>hr,RegistryClient:()=>yt,RegistryTier:()=>rr,ReplayCache:()=>At,RevocationCache:()=>Ve,RobotURI:()=>we,RobotURIError:()=>be,Role:()=>Ae,SAFETY_MESSAGE_TYPE:()=>Wt,SCOPE_MIN_ROLE:()=>Zt,SDK_VERSION:()=>un,SPEC_VERSION:()=>q,TOOL_LOA_REQUIREMENTS:()=>ls,TransportEncoding:()=>ir,TransportError:()=>ie,TrustAnchorCache:()=>vt,VERSION:()=>Ri,addDelegationHop:()=>ln,addMediaInline:()=>lr,addMediaRef:()=>no,addPQSignature:()=>ds,assertClockSynced:()=>On,authorityAccessFromWire:()=>Eo,authorityAccessToWire:()=>Ao,canonicalManifestJson:()=>bo,checkClockSync:()=>Qt,checkRevocation:()=>Un,clientAllowsTool:()=>yi,decodeBleFrames:()=>eo,decodeCompact:()=>cr,decodeMinimal:()=>Xn,encodeBleFrames:()=>Zn,encodeCompact:()=>ar,encodeMinimal:()=>zn,extractIdentityFromJwt:()=>Vn,extractLoaFromJwt:()=>Ot,extractRoleFromJwt:()=>er,fetchCanonicalSchema:()=>_t,fetchRRFRevocations:()=>xr,isAuthorityRequestValid:()=>So,isM2mTrustedRevoked:()=>br,isPreemptedBy:()=>lo,isSafetyMessage:()=>Sn,makeCloudRelayMessage:()=>fn,makeCompetitionEnter:()=>po,makeCompetitionScore:()=>go,makeConfigUpdate:()=>vn,makeConsentDeny:()=>Tt,makeConsentGrant:()=>Ct,makeConsentRequest:()=>St,makeContributeCancel:()=>uo,makeContributeRequest:()=>ao,makeContributeResult:()=>co,makeEstopMessage:()=>wn,makeEstopWithQoS:()=>bn,makeFaultReport:()=>jn,makeFederationSync:()=>Jn,makeKeyRotationMessage:()=>In,makePersonalResearchResult:()=>ho,makeResumeMessage:()=>En,makeRevocationBroadcast:()=>Pn,makeSeasonStanding:()=>mo,makeStopMessage:()=>An,makeStreamChunk:()=>io,makeTrainingConsentDeny:()=>$n,makeTrainingConsentGrant:()=>Dn,makeTrainingConsentRequest:()=>Ln,makeTrainingDataMessage:()=>so,makeTransparencyMessage:()=>Tn,manifestFromWire:()=>xo,manifestToWire:()=>_o,parseM2mPeerToken:()=>ko,parseM2mTrustedToken:()=>Rr,roleFromJwtLevel:()=>Ge,selectTransport:()=>to,signMessage:()=>Yr,validateAuthorityAccess:()=>mr,validateCompetitionScope:()=>yo,validateConfig:()=>Rn,validateConfigAgainstSchema:()=>_n,validateConfigUpdate:()=>Nn,validateConsentMessage:()=>Mn,validateContributeScope:()=>fo,validateCrossRegistryCommand:()=>Yn,validateDelegationChain:()=>pn,validateLoaForScope:()=>Gn,validateManifest:()=>wo,validateMediaChunks:()=>oo,validateMessage:()=>yn,validateNodeAgainstSchema:()=>xn,validateReplay:()=>kn,validateRoleForScope:()=>tr,validateSafetyMessage:()=>Cn,validateTrainingDataMessage:()=>Bn,validateURI:()=>hn,validateV22DelegationChain:()=>gs,validateVersionCompat:()=>dn,verifyM2mTrustedToken:()=>Oo,verifyM2mTrustedTokenClaims:()=>_r,verifyMessage:()=>Wr,verifyPQSignature:()=>fs,verifyV22MediaChunkHash:()=>ms});d();d();var be=class extends Error{constructor(e){super(e),this.name="RobotURIError"}},we=class t{registry;manufacturer;model;version;deviceId;constructor(e){this.registry=e.registry,this.manufacturer=e.manufacturer,this.model=e.model,this.version=e.version,this.deviceId=e.deviceId}static parse(e){if(!e.startsWith("rcan://"))throw new be(`URI must start with 'rcan://' \u2014 got: ${e}`);let n=e.slice(7).split("/");if(n.length!==5)throw new be(`URI must have exactly 5 path segments (registry/manufacturer/model/version/device-id) \u2014 got ${n.length} in: ${e}`);let[o,s,i,a,u]=n;for(let[p,g]of[["registry",o],["manufacturer",s],["model",i],["version",a],["device-id",u]])if(!g||g.trim()==="")throw new be(`URI segment '${p}' must not be empty`);return new t({registry:o,manufacturer:s,model:i,version:a,deviceId:u})}static build(e){let r=e.registry??"registry.rcan.dev",{manufacturer:n,model:o,version:s,deviceId:i}=e;for(let[a,u]of[["manufacturer",n],["model",o],["version",s],["deviceId",i]])if(!u||u.trim()==="")throw new be(`'${a}' must not be empty`);return new t({registry:r,manufacturer:n,model:o,version:s,deviceId:i})}toString(){return`rcan://${this.registry}/${this.manufacturer}/${this.model}/${this.version}/${this.deviceId}`}get namespace(){return`${this.manufacturer}/${this.model}`}get registryUrl(){return`https://${this.registry}/registry/${this.manufacturer}/${this.model}/${this.version}/${this.deviceId}`}equals(e){return this.toString()===e.toString()}toJSON(){return{uri:this.toString(),registry:this.registry,manufacturer:this.manufacturer,model:this.model,version:this.version,deviceId:this.deviceId}}};d();d();var q="2.2.1",un="1.2.2";function dn(t,e=q){let r=s=>{let i=s.split("."),a=parseInt(i[0]??"0",10),u=parseInt(i[1]??"0",10);return[isNaN(a)?0:a,isNaN(u)?0:u]},[n]=r(t),[o]=r(e);return n===o}var fe=(c=>(c[c.COMMAND=1]="COMMAND",c[c.RESPONSE=2]="RESPONSE",c[c.STATUS=3]="STATUS",c[c.HEARTBEAT=4]="HEARTBEAT",c[c.CONFIG=5]="CONFIG",c[c.SAFETY=6]="SAFETY",c[c.AUTH=7]="AUTH",c[c.ERROR=8]="ERROR",c[c.DISCOVER=9]="DISCOVER",c[c.PENDING_AUTH=10]="PENDING_AUTH",c[c.INVOKE=11]="INVOKE",c[c.INVOKE_RESULT=12]="INVOKE_RESULT",c[c.INVOKE_CANCEL=13]="INVOKE_CANCEL",c[c.REGISTRY_REGISTER=14]="REGISTRY_REGISTER",c[c.REGISTRY_RESOLVE=15]="REGISTRY_RESOLVE",c[c.TRANSPARENCY=16]="TRANSPARENCY",c[c.COMMAND_ACK=17]="COMMAND_ACK",c[c.COMMAND_NACK=18]="COMMAND_NACK",c[c.ROBOT_REVOCATION=19]="ROBOT_REVOCATION",c[c.CONSENT_REQUEST=20]="CONSENT_REQUEST",c[c.CONSENT_GRANT=21]="CONSENT_GRANT",c[c.CONSENT_DENY=22]="CONSENT_DENY",c[c.FLEET_COMMAND=23]="FLEET_COMMAND",c[c.SUBSCRIBE=24]="SUBSCRIBE",c[c.UNSUBSCRIBE=25]="UNSUBSCRIBE",c[c.FAULT_REPORT=26]="FAULT_REPORT",c[c.KEY_ROTATION=27]="KEY_ROTATION",c[c.COMMAND_COMMIT=28]="COMMAND_COMMIT",c[c.SENSOR_DATA=29]="SENSOR_DATA",c[c.TRAINING_CONSENT_REQUEST=30]="TRAINING_CONSENT_REQUEST",c[c.TRAINING_CONSENT_GRANT=31]="TRAINING_CONSENT_GRANT",c[c.TRAINING_CONSENT_DENY=32]="TRAINING_CONSENT_DENY",c[c.CONTRIBUTE_REQUEST=33]="CONTRIBUTE_REQUEST",c[c.CONTRIBUTE_RESULT=34]="CONTRIBUTE_RESULT",c[c.CONTRIBUTE_CANCEL=35]="CONTRIBUTE_CANCEL",c[c.TRAINING_DATA=36]="TRAINING_DATA",c[c.COMPETITION_ENTER=37]="COMPETITION_ENTER",c[c.COMPETITION_SCORE=38]="COMPETITION_SCORE",c[c.SEASON_STANDING=39]="SEASON_STANDING",c[c.PERSONAL_RESEARCH_RESULT=40]="PERSONAL_RESEARCH_RESULT",c[c.AUTHORITY_ACCESS=41]="AUTHORITY_ACCESS",c[c.AUTHORITY_RESPONSE=42]="AUTHORITY_RESPONSE",c[c.FIRMWARE_ATTESTATION=43]="FIRMWARE_ATTESTATION",c[c.SBOM_UPDATE=44]="SBOM_UPDATE",c))(fe||{}),oe=class extends Error{constructor(e){super(e),this.name="RCANMessageError"}},E=class t{rcan;rcanVersion;cmd;target;params;confidence;modelIdentity;signature;timestamp;senderType;cloudProvider;keyId;delegationChain;groupId;qos;presenceVerified;proximityMeters;readOnly;loa;transportEncoding;mediaChunks;firmwareHash;attestationRef;pqSig;constructor(e){if(!e.cmd||e.cmd.trim()==="")throw new oe("'cmd' is required");if(!e.target)throw new oe("'target' is required");if(this.rcan=e.rcan??q,this.rcanVersion=e.rcanVersion??q,this.cmd=e.cmd,this.target=e.target instanceof we?e.target.toString():String(e.target),this.params=e.params??{},this.confidence=e.confidence,this.modelIdentity=e.modelIdentity??e.model_identity,this.signature=e.signature,this.timestamp=e.timestamp??new Date().toISOString(),this.senderType=e.senderType,this.cloudProvider=e.cloudProvider,this.keyId=e.keyId,this.delegationChain=e.delegationChain,this.groupId=e.groupId,this.qos=e.qos,this.presenceVerified=e.presenceVerified,this.proximityMeters=e.proximityMeters,this.readOnly=e.readOnly,this.loa=e.loa,this.transportEncoding=e.transportEncoding,this.mediaChunks=e.mediaChunks,this.firmwareHash=e.firmwareHash,this.attestationRef=e.attestationRef,this.pqSig=e.pqSig,this.signature!==void 0&&this.signature.sig==="pending")throw new oe("signature.sig:'pending' is not valid in RCAN v2.1. Sign the message before sending.");if(this.confidence!==void 0&&(this.confidence<0||this.confidence>1))throw new oe(`confidence must be in [0.0, 1.0] \u2014 got ${this.confidence}`)}get isSigned(){return this.signature!==void 0&&this.signature.sig!==""}get isAiDriven(){return this.confidence!==void 0}toJSON(){let e={rcan:this.rcan,rcanVersion:this.rcanVersion,cmd:this.cmd,target:this.target,timestamp:this.timestamp};return Object.keys(this.params).length>0&&(e.params=this.params),this.confidence!==void 0&&(e.confidence=this.confidence),this.modelIdentity&&(e.model_identity=this.modelIdentity),this.signature&&(e.signature=this.signature),this.senderType!==void 0&&(e.senderType=this.senderType),this.cloudProvider!==void 0&&(e.cloudProvider=this.cloudProvider),this.keyId!==void 0&&(e.keyId=this.keyId),this.delegationChain!==void 0&&(e.delegationChain=this.delegationChain),this.groupId!==void 0&&(e.groupId=this.groupId),this.qos!==void 0&&(e.qos=this.qos),this.presenceVerified!==void 0&&(e.presenceVerified=this.presenceVerified),this.proximityMeters!==void 0&&(e.proximityMeters=this.proximityMeters),this.readOnly!==void 0&&(e.readOnly=this.readOnly),this.loa!==void 0&&(e.loa=this.loa),this.transportEncoding!==void 0&&(e.transportEncoding=this.transportEncoding),this.mediaChunks!==void 0&&(e.mediaChunks=this.mediaChunks),this.firmwareHash!==void 0&&(e.firmwareHash=this.firmwareHash),this.attestationRef!==void 0&&(e.attestationRef=this.attestationRef),e}toJSONString(e){return JSON.stringify(this.toJSON(),null,e)}static fromJSON(e){let r;if(typeof e=="string")try{r=JSON.parse(e)}catch{throw new oe("Invalid JSON string")}else r=e;if(!r.cmd)throw new oe("Missing required field: 'cmd'");if(!r.target)throw new oe("Missing required field: 'target'");if(!r.rcan)throw new oe("Missing required field: 'rcan'");return new t({rcan:r.rcan,rcanVersion:r.rcanVersion,cmd:r.cmd,target:r.target,params:r.params??{},confidence:r.confidence,modelIdentity:r.model_identity??r.modelIdentity,signature:r.signature,timestamp:r.timestamp,senderType:r.senderType,cloudProvider:r.cloudProvider,keyId:r.keyId,delegationChain:r.delegationChain,groupId:r.groupId,qos:r.qos,presenceVerified:r.presenceVerified,proximityMeters:r.proximityMeters,readOnly:r.readOnly,loa:r.loa,transportEncoding:r.transportEncoding,mediaChunks:r.mediaChunks,firmwareHash:r.firmwareHash,attestationRef:r.attestationRef,pqSig:r.pqSig})}};function fn(t,e){let r=t.toJSON();return r.senderType="cloud_function",r.cloudProvider=e,new E(r)}function ln(t,e){let r=t.delegationChain?[...t.delegationChain,e]:[e],n=t.toJSON();return n.delegationChain=r,new E(n)}function pn(t){if(t.length>4)return{valid:!1,reason:"DELEGATION_CHAIN_EXCEEDED: max depth is 4 hops"};for(let e=0;e<t.length;e++){let r=t[e];if(!r)return{valid:!1,reason:`hop ${e} is undefined`};if(!r.issuerRuri)return{valid:!1,reason:`hop ${e}: missing issuerRuri`};if(!r.humanSubject)return{valid:!1,reason:`hop ${e}: missing humanSubject`};if(!r.timestamp)return{valid:!1,reason:`hop ${e}: missing timestamp`};if(!r.scope)return{valid:!1,reason:`hop ${e}: missing scope`};if(!r.signature)return{valid:!1,reason:`hop ${e}: missing signature`}}return{valid:!0,reason:"ok"}}d();d();function ot(){if(typeof globalThis.crypto<"u"&&typeof globalThis.crypto.randomUUID=="function")return globalThis.crypto.randomUUID();try{let{randomUUID:t}=de("crypto");return t()}catch{return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,t=>{let e=Math.random()*16|0;return(t==="x"?e:e&3|8).toString(16)})}}function Vt(t,e){return typeof process<"u",Ss(t,e)}function Kt(t){let e=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],r=1779033703,n=3144134277,o=1013904242,s=2773480762,i=1359893119,a=2600822924,u=528734635,p=1541459225,v=t.length*8,k=[...t];for(k.push(128);k.length%64!==56;)k.push(0);for(let S=7;S>=0;S--)k.push(v/Math.pow(2,S*8)&255);for(let S=0;S<k.length;S+=64){let L=[];for(let R=0;R<16;R++)L[R]=k[S+R*4]<<24|k[S+R*4+1]<<16|k[S+R*4+2]<<8|k[S+R*4+3];for(let R=16;R<64;R++){let P=le(L[R-15],7)^le(L[R-15],18)^L[R-15]>>>3,ae=le(L[R-2],17)^le(L[R-2],19)^L[R-2]>>>10;L[R]=L[R-16]+P+L[R-7]+ae>>>0}let[K,_,b,N,I,D,V,U]=[r,n,o,s,i,a,u,p];for(let R=0;R<64;R++){let P=le(I,6)^le(I,11)^le(I,25),ae=I&D^~I&V,ke=U+P+ae+e[R]+L[R]>>>0,Pe=le(K,2)^le(K,13)^le(K,22),Le=K&_^K&b^_&b,et=Pe+Le>>>0;[U,V,D,I,N,b,_,K]=[V,D,I,N+ke>>>0,b,_,K,ke+et>>>0]}r=r+K>>>0,n=n+_>>>0,o=o+b>>>0,s=s+N>>>0,i=i+I>>>0,a=a+D>>>0,u=u+V>>>0,p=p+U>>>0}let w=new Uint8Array(32),M=new DataView(w.buffer);return[r,n,o,s,i,a,u,p].forEach((S,L)=>M.setUint32(L*4,S)),w}function le(t,e){return t>>>e|t<<32-e}function gn(t){if(typeof TextEncoder<"u")return new TextEncoder().encode(t);let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++)e[r]=t.charCodeAt(r)&255;return e}function Es(t){return Array.from(t).map(e=>e.toString(16).padStart(2,"0")).join("")}function Ss(t,e){let n=gn(t);n.length>64&&(n=Kt(n));let o=new Uint8Array(64),s=new Uint8Array(64);for(let g=0;g<64;g++)o[g]=(n[g]??0)^54,s[g]=(n[g]??0)^92;let i=gn(e),a=new Uint8Array(64+i.length);a.set(o),a.set(i,64);let u=Kt(a),p=new Uint8Array(96);return p.set(s),p.set(u,64),Es(Kt(p))}var Re=class extends Error{constructor(e){super(e),this.name="GateError"}},st=class{threshold;constructor(e=.8){if(e<0||e>1)throw new Re(`threshold must be in [0.0, 1.0] \u2014 got ${e}`);this.threshold=e}allows(e){return e>=this.threshold}margin(e){return e-this.threshold}assert(e,r){if(!this.allows(e)){let n=r?` for action '${r}'`:"";throw new Re(`Confidence ${e}${n} is below threshold ${this.threshold}`)}}},it=class{_pending=new Map;request(e,r={}){let n=ot();return this._pending.set(n,{token:n,action:e,context:r,createdAt:new Date().toISOString(),status:"pending"}),n}approve(e){let r=this._pending.get(e);if(!r)throw new Re(`Unknown token: ${e}`);r.status="approved"}deny(e,r){let n=this._pending.get(e);if(!n)throw new Re(`Unknown token: ${e}`);n.status="denied",r&&(n.reason=r)}check(e){let r=this._pending.get(e);if(!r)throw new Re(`Unknown token: ${e}`);return r.status}get pendingApprovals(){return Array.from(this._pending.values()).filter(e=>e.status==="pending")}getApproval(e){return this._pending.get(e)}clearResolved(){for(let[e,r]of this._pending.entries())r.status!=="pending"&&this._pending.delete(e)}};d();var at=class extends Error{constructor(e){super(e),this.name="AuditError"}};function Cs(t,e,r,n,o){let s=JSON.stringify({recordId:t,action:e,robotUri:r,timestamp:n,params:o},Object.keys({recordId:t,action:e,robotUri:r,timestamp:n,params:o}).sort());return Vt("rcan-content-hash",s)}function mn(t,e){let{hmac:r,...n}=e,o=JSON.stringify(n,Object.keys(n).sort());return Vt(t,o)}var $e=class t{recordId;action;robotUri;confidence;modelIdentity;params;safetyApproved;timestamp;contentHash;previousHash;hmac;constructor(e){this.recordId=e.recordId,this.action=e.action,this.robotUri=e.robotUri,this.confidence=e.confidence,this.modelIdentity=e.modelIdentity,this.params=e.params,this.safetyApproved=e.safetyApproved,this.timestamp=e.timestamp,this.contentHash=e.contentHash,this.previousHash=e.previousHash,this.hmac=e.hmac}static create(e,r,n=null){let o=ot(),s=new Date().toISOString(),i=e.params??{},a=e.robotUri??"",u=Cs(o,e.action,a,s,i),p={recordId:o,action:e.action,robotUri:a,confidence:e.confidence,modelIdentity:e.modelIdentity,params:i,safetyApproved:e.safetyApproved??!0,timestamp:s,contentHash:u,previousHash:n,hmac:""};return p.hmac=mn(r,p),new t(p)}verify(e){return mn(e,this.toJSON())===this.hmac}toJSON(){return{recordId:this.recordId,action:this.action,robotUri:this.robotUri,confidence:this.confidence,modelIdentity:this.modelIdentity,params:this.params,safetyApproved:this.safetyApproved,timestamp:this.timestamp,contentHash:this.contentHash,previousHash:this.previousHash,hmac:this.hmac}}static fromJSON(e){return new t(e)}},ct=class t{_records=[];_secret;constructor(e){this._secret=e}get records(){return this._records}append(e){let n=this._records[this._records.length-1]?.contentHash??null,o=$e.create(e,this._secret,n);return this._records.push(o),o}verifyAll(){let e=[],r=null;for(let n of this._records)n.verify(this._secret)||e.push(`HMAC invalid for record ${n.recordId.slice(0,8)}`),r!==null&&n.previousHash!==r&&e.push(`Chain broken at ${n.recordId.slice(0,8)}: expected prev=${r.slice(0,12)}`),r=n.contentHash;return{valid:e.length===0,count:this._records.length,errors:e}}toJSONL(){return this._records.map(e=>JSON.stringify(e.toJSON())).join(`
+"use strict";var RCAN=(()=>{var aa=Object.create;var $t=Object.defineProperty;var ca=Object.getOwnPropertyDescriptor;var ua=Object.getOwnPropertyNames;var fa=Object.getPrototypeOf,da=Object.prototype.hasOwnProperty;var Ee=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var Ie=(t,e)=>()=>(t&&(e=t(t=0)),e);var co=(t,e)=>{for(var r in e)$t(t,r,{get:e[r],enumerable:!0})},uo=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of ua(e))!da.call(t,o)&&o!==r&&$t(t,o,{get:()=>e[o],enumerable:!(n=ca(e,o))||n.enumerable});return t};var fo=(t,e,r)=>(r=t!=null?aa(fa(t)):{},uo(e||!t||!t.__esModule?$t(r,"default",{value:t,enumerable:!0}):r,t)),lo=t=>uo($t({},"__esModule",{value:!0}),t);var p=Ie(()=>{});function ft(t){return t instanceof Uint8Array||ArrayBuffer.isView(t)&&t.constructor.name==="Uint8Array"}function Me(t,e=""){if(!Number.isSafeInteger(t)||t<0){let r=e&&`"${e}" `;throw new Error(`${r}expected integer >= 0, got ${t}`)}}function M(t,e,r=""){let n=ft(t),o=t?.length,s=e!==void 0;if(!n||s&&o!==e){let i=r&&`"${r}" `,a=s?` of length ${e}`:"",c=n?`length=${o}`:`type=${typeof t}`;throw new Error(i+"expected Uint8Array"+a+", got "+c)}return t}function dt(t,e=!0){if(t.destroyed)throw new Error("Hash instance has been destroyed");if(e&&t.finished)throw new Error("Hash#digest() has already been called")}function jt(t,e){M(t,void 0,"digestInto() output");let r=e.outputLen;if(t.length<r)throw new Error('"digestInto() output" expected to be of length >='+r)}function bo(t){return new Uint32Array(t.buffer,t.byteOffset,Math.floor(t.byteLength/4))}function He(...t){for(let e=0;e<t.length;e++)t[e].fill(0)}function Ft(t){return new DataView(t.buffer,t.byteOffset,t.byteLength)}function pa(t){return t<<24&4278190080|t<<8&16711680|t>>>8&65280|t>>>24&255}function ga(t){for(let e=0;e<t.length;e++)t[e]=pa(t[e]);return t}function lt(t){if(M(t),Ro)return t.toHex();let e="";for(let r=0;r<t.length;r++)e+=ha[t[r]];return e}function xo(t){if(t>=Ne._0&&t<=Ne._9)return t-Ne._0;if(t>=Ne.A&&t<=Ne.F)return t-(Ne.A-10);if(t>=Ne.a&&t<=Ne.f)return t-(Ne.a-10)}function wt(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);if(Ro)return Uint8Array.fromHex(t);let e=t.length,r=e/2;if(e%2)throw new Error("hex string expected, got unpadded hex of length "+e);let n=new Uint8Array(r);for(let o=0,s=0;o<r;o++,s+=2){let i=xo(t.charCodeAt(s)),a=xo(t.charCodeAt(s+1));if(i===void 0||a===void 0){let c=t[s]+t[s+1];throw new Error('hex string expected, got non-hex character "'+c+'" at index '+s)}n[o]=i*16+a}return n}function $e(...t){let e=0;for(let n=0;n<t.length;n++){let o=t[n];M(o),e+=o.length}let r=new Uint8Array(e);for(let n=0,o=0;n<t.length;n++){let s=t[n];r.set(s,o),o+=s.length}return r}function Kt(t,e={}){let r=(o,s)=>t(s).update(o).digest(),n=t(void 0);return r.outputLen=n.outputLen,r.blockLen=n.blockLen,r.create=o=>t(o),Object.assign(r,e),Object.freeze(r)}function Et(t=32){let e=typeof globalThis=="object"?globalThis.crypto:null;if(typeof e?.getRandomValues!="function")throw new Error("crypto.getRandomValues must be defined");return e.getRandomValues(new Uint8Array(t))}var la,Hr,Ro,ha,Ne,At,je=Ie(()=>{"use strict";p();la=new Uint8Array(new Uint32Array([287454020]).buffer)[0]===68;Hr=la?t=>t:ga,Ro=typeof Uint8Array.from([]).toHex=="function"&&typeof Uint8Array.fromHex=="function",ha=Array.from({length:256},(t,e)=>e.toString(16).padStart(2,"0"));Ne={_0:48,_9:57,A:65,F:70,a:97,f:102};At=t=>({oid:Uint8Array.from([6,9,96,134,72,1,101,3,4,2,t])})});function pt(t,e=""){if(typeof t!="boolean"){let r=e&&`"${e}" `;throw new Error(r+"expected boolean, got type="+typeof t)}return t}function ma(t){if(typeof t=="bigint"){if(!Vt(t))throw new Error("positive bigint expected, got "+t)}else Me(t);return t}function Eo(t){if(typeof t!="string")throw new Error("hex string expected, got "+typeof t);return t===""?wo:BigInt("0x"+t)}function Ao(t){return Eo(lt(t))}function gt(t){return Eo(lt(Gt(M(t)).reverse()))}function $r(t,e){Me(e),t=ma(t);let r=wt(t.toString(16).padStart(e*2,"0"));if(r.length!==e)throw new Error("number too large");return r}function So(t,e){return $r(t,e).reverse()}function Gt(t){return Uint8Array.from(t)}function ya(t,e,r){return Vt(t)&&Vt(e)&&Vt(r)&&e<=t&&t<r}function jr(t,e,r,n){if(!ya(e,r,n))throw new Error("expected valid "+t+": "+r+" <= n < "+n+", got "+e)}function St(t,e={},r={}){if(!t||typeof t!="object")throw new Error("expected valid options object");function n(s,i,a){let c=t[s];if(a&&c===void 0)return;let f=typeof c;if(f!==i||c===null)throw new Error(`param "${s}" is invalid: expected ${i}, got ${f}`)}let o=(s,i)=>Object.entries(s).forEach(([a,c])=>n(a,c,i));o(e,!1),o(r,!0)}function Fr(t){let e=new WeakMap;return(r,...n)=>{let o=e.get(r);if(o!==void 0)return o;let s=t(r,...n);return e.set(r,s),s}}var wo,_o,Vt,Co,Ct=Ie(()=>{"use strict";p();je();je();wo=BigInt(0),_o=BigInt(1);Vt=t=>typeof t=="bigint"&&wo<=t;Co=t=>(_o<<BigInt(t))-_o});function xa(t,e=!1){return e?{h:Number(t&Yt),l:Number(t>>vo&Yt)}:{h:Number(t>>vo&Yt)|0,l:Number(t&Yt)|0}}function Wt(t,e=!1){let r=t.length,n=new Uint32Array(r),o=new Uint32Array(r);for(let s=0;s<r;s++){let{h:i,l:a}=xa(t[s],e);[n[s],o[s]]=[i,a]}return[n,o]}function Se(t,e,r,n){let o=(e>>>0)+(n>>>0);return{h:t+r+(o/2**32|0)|0,l:o|0}}var Yt,vo,Kr,Vr,Xe,ze,vt,Tt,To,Oo,ko,Io,No,Mo,Uo,Bo,Do,Lo,Gr=Ie(()=>{"use strict";p();Yt=BigInt(4294967295),vo=BigInt(32);Kr=(t,e,r)=>t>>>r,Vr=(t,e,r)=>t<<32-r|e>>>r,Xe=(t,e,r)=>t>>>r|e<<32-r,ze=(t,e,r)=>t<<32-r|e>>>r,vt=(t,e,r)=>t<<64-r|e>>>r-32,Tt=(t,e,r)=>t>>>r-32|e<<64-r,To=(t,e,r)=>t<<r|e>>>32-r,Oo=(t,e,r)=>e<<r|t>>>32-r,ko=(t,e,r)=>e<<r-32|t>>>64-r,Io=(t,e,r)=>t<<r-32|e>>>64-r;No=(t,e,r)=>(t>>>0)+(e>>>0)+(r>>>0),Mo=(t,e,r,n)=>e+r+n+(t/2**32|0)|0,Uo=(t,e,r,n)=>(t>>>0)+(e>>>0)+(r>>>0)+(n>>>0),Bo=(t,e,r,n,o)=>e+r+n+o+(t/2**32|0)|0,Do=(t,e,r,n,o)=>(t>>>0)+(e>>>0)+(r>>>0)+(n>>>0)+(o>>>0),Lo=(t,e,r,n,o,s)=>e+r+n+o+s+(t/2**32|0)|0});function va(t,e=24){let r=new Uint32Array(10);for(let n=24-e;n<24;n++){for(let i=0;i<10;i++)r[i]=t[i]^t[i+10]^t[i+20]^t[i+30]^t[i+40];for(let i=0;i<10;i+=2){let a=(i+8)%10,c=(i+2)%10,f=r[c],d=r[c+1],b=Po(f,d,1)^r[a],R=qo(f,d,1)^r[a+1];for(let w=0;w<50;w+=10)t[i+w]^=b,t[i+w+1]^=R}let o=t[2],s=t[3];for(let i=0;i<24;i++){let a=$o[i],c=Po(o,s,a),f=qo(o,s,a),d=Ho[i];o=t[d],s=t[d+1],t[d]=c,t[d+1]=f}for(let i=0;i<50;i+=10){for(let a=0;a<10;a++)r[a]=t[i+a];for(let a=0;a<10;a++)t[i+a]^=~r[(a+2)%10]&r[(a+4)%10]}t[0]^=Sa[n],t[1]^=Ca[n]}He(r)}var Ra,Ot,_a,wa,Ea,Aa,Ho,$o,jo,Fo,Sa,Ca,Po,qo,Yr,Ko,Vo,ce,Wr=Ie(()=>{"use strict";p();Gr();je();Ra=BigInt(0),Ot=BigInt(1),_a=BigInt(2),wa=BigInt(7),Ea=BigInt(256),Aa=BigInt(113),Ho=[],$o=[],jo=[];for(let t=0,e=Ot,r=1,n=0;t<24;t++){[r,n]=[n,(2*r+3*n)%5],Ho.push(2*(5*n+r)),$o.push((t+1)*(t+2)/2%64);let o=Ra;for(let s=0;s<7;s++)e=(e<<Ot^(e>>wa)*Aa)%Ea,e&_a&&(o^=Ot<<(Ot<<BigInt(s))-Ot);jo.push(o)}Fo=Wt(jo,!0),Sa=Fo[0],Ca=Fo[1],Po=(t,e,r)=>r>32?ko(t,e,r):To(t,e,r),qo=(t,e,r)=>r>32?Io(t,e,r):Oo(t,e,r);Yr=class t{state;pos=0;posOut=0;finished=!1;state32;destroyed=!1;blockLen;suffix;outputLen;enableXOF=!1;rounds;constructor(e,r,n,o=!1,s=24){if(this.blockLen=e,this.suffix=r,this.outputLen=n,this.enableXOF=o,this.rounds=s,Me(n,"outputLen"),!(0<e&&e<200))throw new Error("only keccak-f1600 function is supported");this.state=new Uint8Array(200),this.state32=bo(this.state)}clone(){return this._cloneInto()}keccak(){Hr(this.state32),va(this.state32,this.rounds),Hr(this.state32),this.posOut=0,this.pos=0}update(e){dt(this),M(e);let{blockLen:r,state:n}=this,o=e.length;for(let s=0;s<o;){let i=Math.min(r-this.pos,o-s);for(let a=0;a<i;a++)n[this.pos++]^=e[s++];this.pos===r&&this.keccak()}return this}finish(){if(this.finished)return;this.finished=!0;let{state:e,suffix:r,pos:n,blockLen:o}=this;e[n]^=r,(r&128)!==0&&n===o-1&&this.keccak(),e[o-1]^=128,this.keccak()}writeInto(e){dt(this,!1),M(e),this.finish();let r=this.state,{blockLen:n}=this;for(let o=0,s=e.length;o<s;){this.posOut>=n&&this.keccak();let i=Math.min(n-this.posOut,s-o);e.set(r.subarray(this.posOut,this.posOut+i),o),this.posOut+=i,o+=i}return e}xofInto(e){if(!this.enableXOF)throw new Error("XOF is not possible for this instance");return this.writeInto(e)}xof(e){return Me(e),this.xofInto(new Uint8Array(e))}digestInto(e){if(jt(e,this),this.finished)throw new Error("digest() was already called");return this.writeInto(e),this.destroy(),e}digest(){return this.digestInto(new Uint8Array(this.outputLen))}destroy(){this.destroyed=!0,He(this.state)}_cloneInto(e){let{blockLen:r,suffix:n,outputLen:o,rounds:s,enableXOF:i}=this;return e||=new t(r,n,o,i,s),e.state32.set(this.state32),e.pos=this.pos,e.posOut=this.posOut,e.finished=this.finished,e.rounds=s,e.suffix=n,e.outputLen=o,e.enableXOF=i,e.destroyed=this.destroyed,e}},Ko=(t,e,r,n={})=>Kt((o={})=>new Yr(e,t,o.dkLen===void 0?r:o.dkLen,!0),n),Vo=Ko(31,168,16,At(11)),ce=Ko(31,136,32,At(12))});function Jr(t){if(!Number.isSafeInteger(t)||t<0||t>4294967295)throw new Error("wrong u32 integer:"+t);return t}function Yo(t){return Jr(t),(t&t-1)===0&&t!==0}function Zr(t,e){Jr(t);let r=0;for(let n=0;n<e;n++,t>>>=1)r=r<<1|t&1;return r}function Wo(t){return Jr(t),31-Math.clz32(t)}function Go(t){let e=t.length;if(e<2||!Yo(e))throw new Error("n must be a power of 2 and greater than 1. Got "+e);let r=Wo(e);for(let n=0;n<e;n++){let o=Zr(n,r);if(n<o){let s=t[n];t[n]=t[o],t[o]=s}}return t}var Xr,Jo=Ie(()=>{"use strict";p();Xr=(t,e)=>{let{N:r,roots:n,dit:o,invertButterflies:s=!1,skipStages:i=0,brp:a=!0}=e,c=Wo(r);if(!Yo(r))throw new Error("FFT: Polynomial size should be power of two");let f=o!==s;return d=>{if(d.length!==r)throw new Error("FFT: wrong Polynomial length");o&&a&&Go(d);for(let b=0,R=1;b<c-i;b++){let w=o?b+1+i:c-b,_=1<<w,O=_>>1,k=r>>w;for(let y=0;y<r;y+=_)for(let h=0,l=R++;h<O;h++){let v=s?o?r-l:l:h*k,I=y+h,U=y+h+O,D=n[v],m=d[U],g=d[I];if(f){let S=t.mul(m,D);d[I]=t.add(g,S),d[U]=t.sub(g,S)}else s?(d[I]=t.add(m,g),d[U]=t.mul(t.sub(m,g),D)):(d[I]=t.add(g,m),d[U]=t.mul(t.sub(g,m),D))}}return!o&&a&&Go(d),d}}});function Qr(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t[n]^e[n];return r===0}function en(t){if(typeof t!="object"||t===null||ft(t))throw new Error("expected opts to be an object")}function Jt(t){en(t),t.context!==void 0&&M(t.context,void 0,"opts.context")}function Zt(t){Jt(t),t.extraEntropy!==!1&&t.extraEntropy!==void 0&&M(t.extraEntropy,void 0,"opts.extraEntropy")}function kt(t,...e){let r=o=>typeof o=="number"?o:o.bytesLen,n=e.reduce((o,s)=>o+r(s),0);return{bytesLen:n,encode:o=>{let s=new Uint8Array(n);for(let i=0,a=0;i<e.length;i++){let c=e[i],f=r(c),d=typeof c=="number"?o[i]:c.encode(o[i]);M(d,f,t),s.set(d,a),typeof c!="number"&&d.fill(0),a+=f}return s},decode:o=>{M(o,n,t);let s=[];for(let i of e){let a=r(i),c=o.subarray(0,a);s.push(typeof i=="number"?c:i.decode(c)),o=o.subarray(a)}return s}}}function Qe(t,e){let r=e*t.bytesLen;return{bytesLen:r,encode:n=>{if(n.length!==e)throw new Error(`vecCoder.encode: wrong length=${n.length}. Expected: ${e}`);let o=new Uint8Array(r);for(let s=0,i=0;s<n.length;s++){let a=t.encode(n[s]);o.set(a,i),a.fill(0),i+=a.length}return o},decode:n=>{M(n,r);let o=[];for(let s=0;s<n.length;s+=t.bytesLen)o.push(t.decode(n.subarray(s,s+t.bytesLen)));return o}}}function Ce(...t){for(let e of t)if(Array.isArray(e))for(let r of e)r.fill(0);else e.fill(0)}function tn(t){return(1<<t)-1}function rn(t,e=Zo){if(M(t),M(e),e.length>255)throw new Error("context should be less than 255 bytes");return $e(new Uint8Array([0,e.length]),e,t)}function Xo(t,e=0){if(!t.oid||!Qr(t.oid.subarray(0,10),Ta))throw new Error("hash.oid is invalid: expected NIST hash");let r=t.outputLen*8/2;if(e>r)throw new Error("Pre-hash security strength too low: "+r+", required: "+e)}function nn(t,e,r=Zo){if(M(e),M(r),r.length>255)throw new Error("context should be less than 255 bytes");let n=t(e);return $e(new Uint8Array([1,r.length]),r,t.oid,n)}var zr,Zo,Ta,on=Ie(()=>{"use strict";p();je();je();zr=Et;Zo=Uint8Array.of();Ta=Uint8Array.from([6,9,96,134,72,1,101,3,4,2])});var zo,Qo,Xt,zt,es=Ie(()=>{"use strict";p();Jo();Wr();on();zo=t=>{let{newPoly:e,N:r,Q:n,F:o,ROOT_OF_UNITY:s,brvBits:i,isKyber:a}=t,c=(h,l=n)=>{let v=h%l|0;return(v>=0?v|0:l+v|0)|0},f=(h,l=n)=>{let v=c(h,l)|0;return(v>l>>1?v-l|0:v)|0};function d(){let h=e(r);for(let l=0;l<r;l++){let v=Zr(l,i),I=BigInt(s)**BigInt(v)%BigInt(n);h[l]=Number(I)|0}return h}let b=d(),R={add:(h,l)=>c((h|0)+(l|0))|0,sub:(h,l)=>c((h|0)-(l|0))|0,mul:(h,l)=>c((h|0)*(l|0))|0,inv:h=>{throw new Error("not implemented")}},w={N:r,roots:b,invertButterflies:!0,skipStages:a?1:0,brp:!1},_=Xr(R,{dit:!1,...w}),O=Xr(R,{dit:!0,...w});return{mod:c,smod:f,nttZetas:b,NTT:{encode:h=>_(h),decode:h=>{O(h);for(let l=0;l<h.length;l++)h[l]=c(o*h[l]);return h}},bitsCoder:(h,l)=>{let v=tn(h),I=h*(r/8);return{bytesLen:I,encode:U=>{let D=new Uint8Array(I);for(let m=0,g=0,S=0,B=0;m<U.length;m++)for(g|=(l.encode(U[m])&v)<<S,S+=h;S>=8;S-=8,g>>=8)D[B++]=g&tn(S);return D},decode:U=>{let D=e(r);for(let m=0,g=0,S=0,B=0;m<U.length;m++)for(g|=U[m]<<S,S+=8;S>=h;S-=h,g>>=h)D[B++]=l.decode(g&v);return D}}}}},Qo=t=>(e,r)=>{r||(r=t.blockLen);let n=new Uint8Array(e.length+2);n.set(e);let o=e.length,s=new Uint8Array(r),i=t.create({}),a=0,c=0;return{stats:()=>({calls:a,xofs:c}),get:(f,d)=>(n[o+0]=f,n[o+1]=d,i.destroy(),i=t.create({}).update(n),a++,()=>(c++,i.xofInto(s))),clean:()=>{i.destroy(),Ce(s,n)}}},Xt=Qo(Vo),zt=Qo(ce)});var un={};co(un,{PARAMS:()=>tr,ml_dsa44:()=>Ma,ml_dsa65:()=>rt,ml_dsa87:()=>Ua});function ts(t){en(t),t.externalMu!==void 0&&pt(t.externalMu,"opts.externalMu")}function Qt(t){let e=pe(F);for(let r=0;r<F;){let n=t();if(n.length%3)throw new Error("RejNTTPoly: unaligned block");for(let o=0;r<F&&o<=n.length-3;o+=3){let s=(n[o+0]|n[o+1]<<8|n[o+2]<<16)&8388607;s<Ve&&(e[r++]=s)}}return e}function cn(t){let{K:e,L:r,GAMMA1:n,GAMMA2:o,TAU:s,ETA:i,OMEGA:a}=t,{CRH_BYTES:c,TR_BYTES:f,C_TILDE_BYTES:d,XOF128:b,XOF256:R,securityLevel:w}=t;if(![2,4].includes(i))throw new Error("Wrong ETA");if(![1<<17,1<<19].includes(n))throw new Error("Wrong GAMMA1");if(![sn,an].includes(o))throw new Error("Wrong GAMMA2");let _=s*i,O=x=>{let C=et(x),E=er(C,2*o)|0;return C-E===Ve-1?{r1:0,r0:E-1|0}:{r1:Math.floor((C-E)/(2*o))|0,r0:E}},k=x=>O(x).r1,y=x=>O(x).r0,h=(x,C)=>x<=o||x>Ve-o||x===Ve-o&&C===0?0:1,l=(x,C)=>{let E=Math.floor((Ve-1)/(2*o)),{r1:A,r0:u}=O(C);return x===1?u>0?et(A+1,E)|0:et(A-1,E)|0:A|0},v=x=>{let C=et(x),E=er(C,2**tt)|0;return{r1:Math.floor((C-E)/2**tt)|0,r0:E}},I={bytesLen:a+e,encode:x=>{if(x===!1)throw new Error("hint.encode: hint is false");let C=new Uint8Array(a+e);for(let E=0,A=0;E<e;E++){for(let u=0;u<F;u++)x[E][u]!==0&&(C[A++]=u);C[a+E]=A}return C},decode:x=>{let C=[],E=0;for(let A=0;A<e;A++){let u=pe(F);if(x[a+A]<E||x[a+A]>a)return!1;for(let q=E;q<x[a+A];q++){if(q>E&&x[q]<=x[q-1])return!1;u[x[q]]=1}E=x[a+A],C.push(u)}for(let A=E;A<a;A++)if(x[A]!==0)return!1;return C}},U=It(i===2?3:4,x=>i-x,x=>{if(!(-i<=x&&x<=i))throw new Error(`malformed key s1/s3 ${x} outside of ETA range [${-i}, ${i}]`);return x}),D=It(13,x=>(1<<tt-1)-x),m=It(10),g=It(n===1<<17?18:20,x=>er(n-x)),S=It(o===sn?6:4),B=Qe(S,e),L=kt("publicKey",32,Qe(m,e)),P=kt("secretKey",32,32,f,Qe(U,r),Qe(U,e),Qe(D,e)),H=kt("signature",d,Qe(g,r),I),K=i===2?x=>x<15?2-x%5:!1:x=>x<9?4-x:!1;function se(x){let C=pe(F);for(let E=0;E<F;){let A=x();for(let u=0;E<F&&u<A.length;u+=1){let q=K(A[u]&15),ee=K(A[u]>>4&15);q!==!1&&(C[E++]=q),E<F&&ee!==!1&&(C[E++]=ee)}}return C}let he=x=>{let C=pe(F),E=ce.create({}).update(x),A=new Uint8Array(ce.blockLen);E.xofInto(A);let u=A.slice(0,8);for(let q=F-s,ee=8,ae=0,G=0;q<F;q++){let Y=q+1;for(;Y>q;)Y=A[ee++],!(ee<ce.blockLen)&&(E.xofInto(A),ee=0);C[q]=C[Y],C[Y]=1-((u[ae]>>G++&1)<<1),G>=8&&(ae++,G=0)}return C},me=x=>{let C=pe(F),E=pe(F);for(let A=0;A<x.length;A++){let{r0:u,r1:q}=v(x[A]);C[A]=u,E[A]=q}return{r0:C,r1:E}},De=(x,C)=>{for(let E=0;E<F;E++)x[E]=l(C[E],x[E]);return x},at=(x,C)=>{let E=pe(F),A=0;for(let u=0;u<F;u++){let q=h(x[u],C[u]);E[u]=q,A+=q}return{v:E,cnt:A}},ct=32,bt=kt("seed",32,64,32),ie={info:{type:"internal-ml-dsa"},lengths:{secretKey:P.bytesLen,publicKey:L.bytesLen,seed:32,signature:H.bytesLen,signRand:ct},keygen:x=>{let C=new Uint8Array(34),E=x===void 0;E&&(x=zr(32)),M(x,32,"seed"),C.set(x),E&&Ce(x),C[32]=e,C[33]=r;let[A,u,q]=bt.decode(ce(C,{dkLen:bt.bytesLen})),ee=R(u),ae=[];for(let T=0;T<r;T++)ae.push(se(ee.get(T&255,T>>8&255)));let G=[];for(let T=r;T<r+e;T++)G.push(se(ee.get(T&255,T>>8&255)));let Y=ae.map(T=>z.encode(T.slice())),W=[],te=[],Oe=b(A),X=pe(F);for(let T=0;T<e;T++){Ce(X);for(let le=0;le<r;le++){let we=Qt(Oe.get(le,T));Fe(X,Ke(we,Y[le]))}z.decode(X);let{r0:ye,r1:de}=me(Fe(X,G[T]));W.push(ye),te.push(de)}let _e=L.encode([A,te]),ke=ce(_e,{dkLen:f}),ut=P.encode([A,q,ke,ae,G,W]);return Oe.clean(),ee.clean(),Ce(A,u,q,ae,G,Y,X,W,te,ke,C),{publicKey:_e,secretKey:ut}},getPublicKey:x=>{let[C,E,A,u,q,ee]=P.decode(x),ae=b(C),G=u.map(te=>z.encode(te.slice())),Y=[],W=pe(F);for(let te=0;te<e;te++){W.fill(0);for(let X=0;X<r;X++){let _e=Qt(ae.get(X,te));Fe(W,Ke(_e,G[X]))}z.decode(W),Fe(W,q[te]);let{r1:Oe}=me(W);Y.push(Oe)}return ae.clean(),Ce(W,G,ee,u,q),L.encode([C,Y])},sign:(x,C,E={})=>{Zt(E),ts(E);let{extraEntropy:A,externalMu:u=!1}=E,[q,ee,ae,G,Y,W]=P.decode(C),te=[],Oe=b(q);for(let T=0;T<e;T++){let ye=[];for(let de=0;de<r;de++)ye.push(Qt(Oe.get(de,T)));te.push(ye)}Oe.clean();for(let T=0;T<r;T++)z.encode(G[T]);for(let T=0;T<e;T++)z.encode(Y[T]),z.encode(W[T]);let X=u?x:ce.create({dkLen:c}).update(ae).update(x).digest(),_e=A===!1?new Uint8Array(32):A===void 0?zr(ct):A;M(_e,32,"extraEntropy");let ke=ce.create({dkLen:c}).update(ee).update(_e).update(X).digest();M(ke,c);let ut=R(ke,g.bytesLen);e:for(let T=0;;){let ye=[];for(let j=0;j<r;j++,T++)ye.push(g.decode(ut.get(T&255,T>>8)()));let de=ye.map(j=>z.encode(j.slice())),le=[];for(let j=0;j<e;j++){let _t=pe(F);for(let Le=0;Le<r;Le++)Fe(_t,Ke(te[j][Le],de[Le]));z.decode(_t),le.push(_t)}let we=le.map(j=>j.map(k)),Rt=ce.create({dkLen:d}).update(X).update(B.encode(we)).digest(),qt=z.encode(he(Rt)),Ht=G.map(j=>Ke(j,qt));for(let j=0;j<r;j++)if(Fe(z.decode(Ht[j]),ye[j]),Nt(Ht[j],n-_))continue e;let so=0,qr=[];for(let j=0;j<e;j++){let _t=z.decode(Ke(Y[j],qt)),Le=ns(le[j],_t).map(y);if(Nt(Le,o-_))continue e;let io=z.decode(Ke(W[j],qt));if(Nt(io,o))continue e;Fe(Le,io);let ao=at(Le,we[j]);qr.push(ao.v),so+=ao.cnt}if(so>a)continue;ut.clean();let ia=H.encode([Rt,Ht,qr]);return Ce(Rt,Ht,qr,qt,we,le,de,ye,ke,X,G,Y,W,...te),ia}throw new Error("Unreachable code path reached, report this error")},verify:(x,C,E,A={})=>{ts(A);let{externalMu:u=!1}=A,[q,ee]=L.decode(E),ae=ce(E,{dkLen:f});if(x.length!==H.bytesLen)return!1;let[G,Y,W]=H.decode(x);if(W===!1)return!1;for(let T=0;T<r;T++)if(Nt(Y[T],n-_))return!1;let te=u?C:ce.create({dkLen:c}).update(ae).update(C).digest(),Oe=z.encode(he(G)),X=Y.map(T=>T.slice());for(let T=0;T<r;T++)z.encode(X[T]);let _e=[],ke=b(q);for(let T=0;T<e;T++){let ye=Ke(z.encode(Na(ee[T])),Oe),de=pe(F);for(let we=0;we<r;we++){let Rt=Qt(ke.get(we,T));Fe(de,Ke(Rt,X[we]))}let le=z.decode(ns(de,ye));_e.push(De(le,W[T]))}ke.clean();let ut=ce.create({dkLen:d}).update(te).update(B.encode(_e)).digest();for(let T of W)if(!(T.reduce((de,le)=>de+le,0)<=a))return!1;for(let T of Y)if(Nt(T,n-_))return!1;return Qr(G,ut)}};return{info:{type:"ml-dsa"},internal:ie,securityLevel:w,keygen:ie.keygen,lengths:ie.lengths,getPublicKey:ie.getPublicKey,sign:(x,C,E={})=>{Zt(E);let A=rn(x,E.context),u=ie.sign(A,C,E);return Ce(A),u},verify:(x,C,E,A={})=>(Jt(A),ie.verify(x,rn(C,A.context),E)),prehash:x=>(Xo(x,w),{info:{type:"hashml-dsa"},securityLevel:w,lengths:ie.lengths,keygen:ie.keygen,getPublicKey:ie.getPublicKey,sign:(C,E,A={})=>{Zt(A);let u=nn(x,C,A.context),q=ie.sign(u,E,A);return Ce(u),q},verify:(C,E,A,u={})=>(Jt(u),ie.verify(C,nn(x,E,u.context),A))})}}var F,Ve,Oa,ka,tt,sn,an,tr,pe,et,er,z,Ia,rs,It,Fe,ns,Na,Nt,Ke,Ma,rt,Ua,rr=Ie(()=>{"use strict";p();Ct();Wr();es();on();F=256,Ve=8380417,Oa=1753,ka=8347681,tt=13,sn=Math.floor((Ve-1)/88)|0,an=Math.floor((Ve-1)/32)|0,tr={2:{K:4,L:4,D:tt,GAMMA1:2**17,GAMMA2:sn,TAU:39,ETA:2,OMEGA:80},3:{K:6,L:5,D:tt,GAMMA1:2**19,GAMMA2:an,TAU:49,ETA:4,OMEGA:55},5:{K:8,L:7,D:tt,GAMMA1:2**19,GAMMA2:an,TAU:60,ETA:2,OMEGA:75}},pe=t=>new Int32Array(t),{mod:et,smod:er,NTT:z,bitsCoder:Ia}=zo({N:F,Q:Ve,F:ka,ROOT_OF_UNITY:Oa,newPoly:pe,isKyber:!1,brvBits:8}),rs=t=>t,It=(t,e=rs,r=rs)=>Ia(t,{encode:n=>e(r(n)),decode:n=>r(e(n))}),Fe=(t,e)=>{for(let r=0;r<t.length;r++)t[r]=et(t[r]+e[r]);return t},ns=(t,e)=>{for(let r=0;r<t.length;r++)t[r]=et(t[r]-e[r]);return t},Na=t=>{for(let e=0;e<F;e++)t[e]<<=tt;return t},Nt=(t,e)=>{for(let r=0;r<F;r++)if(Math.abs(er(t[r]))>=e)return!0;return!1},Ke=(t,e)=>{let r=pe(F);for(let n=0;n<t.length;n++)r[n]=et(t[n]*e[n]);return r};Ma=cn({...tr[2],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:32,XOF128:Xt,XOF256:zt,securityLevel:128}),rt=cn({...tr[3],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:48,XOF128:Xt,XOF256:zt,securityLevel:192}),Ua=cn({...tr[5],CRH_BYTES:64,TR_BYTES:64,C_TILDE_BYTES:64,XOF128:Xt,XOF256:zt,securityLevel:256})});var Nc={};co(Nc,{AUTHORITY_ERROR_CODES:()=>Ji,AuditChain:()=>pr,AuditError:()=>lr,COMPETITION_SCOPE_LEVEL:()=>Yn,CONTRIBUTE_SCOPE_LEVEL:()=>Gn,ClockDriftError:()=>Mt,CommitmentRecord:()=>ht,ConfidenceGate:()=>fr,DEFAULT_LOA_POLICY:()=>li,DataCategory:()=>kn,FIRMWARE_MANIFEST_PATH:()=>$i,FaultCode:()=>In,FederationSyncType:()=>Dn,FirmwareIntegrityError:()=>Dr,GateError:()=>Ue,HiTLGate:()=>dr,KeyStore:()=>Or,LOA_TO_SCOPES:()=>Tc,LevelOfAssurance:()=>di,M2MAuthError:()=>fe,M2M_TRUSTED_ISSUER:()=>Lr,MLDSAKeyPair:()=>Pr,MediaEncoding:()=>jn,MessageType:()=>Ae,NodeClient:()=>Er,OfflineModeManager:()=>Mr,PRODUCTION_LOA_POLICY:()=>pi,QoSAckTimeoutError:()=>Sr,QoSLevel:()=>vn,QoSManager:()=>Cr,RCANAddressError:()=>gr,RCANConfigAuthorizationError:()=>_r,RCANDelegationChainError:()=>Rr,RCANError:()=>ue,RCANGateError:()=>mr,RCANMessage:()=>$,RCANMessageError:()=>xe,RCANNodeError:()=>it,RCANNodeNotFoundError:()=>Be,RCANNodeSyncError:()=>oe,RCANNodeTrustError:()=>mt,RCANRegistryError:()=>st,RCANReplayAttackError:()=>br,RCANSignatureError:()=>yr,RCANValidationError:()=>hr,RCANVersionIncompatibleError:()=>xr,RCAN_VERSION:()=>Ic,ROLE_JWT_LEVEL:()=>yt,RRF_REVOCATION_CACHE_TTL_MS:()=>Zn,RRF_REVOCATION_URL:()=>Jn,RegistryClient:()=>wr,RegistryTier:()=>Bn,ReplayCache:()=>Tr,RevocationCache:()=>Ut,RobotURI:()=>qe,RobotURIError:()=>Pe,Role:()=>Je,SAFETY_MESSAGE_TYPE:()=>Tn,SCOPE_MIN_ROLE:()=>Nn,SDK_VERSION:()=>po,SPEC_VERSION:()=>J,TOOL_LOA_REQUIREMENTS:()=>ra,TransportEncoding:()=>qn,TransportError:()=>Re,TrustAnchorCache:()=>Br,VERSION:()=>kc,addDelegationHop:()=>mo,addMediaInline:()=>Vn,addMediaRef:()=>vi,addPQSignature:()=>ea,assertClockSynced:()=>Qs,authorityAccessFromWire:()=>Yi,authorityAccessToWire:()=>Gi,canonicalManifestJson:()=>Ki,checkClockSync:()=>On,checkRevocation:()=>oi,clientAllowsTool:()=>Oc,decodeBleFrames:()=>Ai,decodeCompact:()=>$n,decodeHybridSig:()=>Ds,decodeMinimal:()=>wi,decodeMlDsaPublicKeyJwk:()=>Ps,encodeBleFrames:()=>Ei,encodeCompact:()=>Hn,encodeHybridSig:()=>Bs,encodeMinimal:()=>_i,encodeMlDsaPublicKeyJwk:()=>Ls,extractIdentityFromJwt:()=>hi,extractLoaFromJwt:()=>Ur,extractRoleFromJwt:()=>Mn,fetchCanonicalSchema:()=>Ar,fetchRRFRevocations:()=>Qn,generateMlDsaKeypair:()=>ks,isAuthorityRequestValid:()=>Wi,isM2mTrustedRevoked:()=>eo,isPreemptedBy:()=>Bi,isSafetyMessage:()=>Js,makeCloudRelayMessage:()=>ho,makeCompetitionEnter:()=>Di,makeCompetitionScore:()=>Li,makeConfigUpdate:()=>ei,makeConsentDeny:()=>Nr,makeConsentGrant:()=>Ir,makeConsentRequest:()=>kr,makeContributeCancel:()=>Mi,makeContributeRequest:()=>Ii,makeContributeResult:()=>Ni,makeEstopMessage:()=>Gs,makeEstopWithQoS:()=>Vs,makeFaultReport:()=>fi,makeFederationSync:()=>yi,makeKeyRotationMessage:()=>ri,makePersonalResearchResult:()=>qi,makeResumeMessage:()=>Ws,makeRevocationBroadcast:()=>si,makeSeasonStanding:()=>Pi,makeStopMessage:()=>Ys,makeStreamChunk:()=>ki,makeTrainingConsentDeny:()=>ci,makeTrainingConsentGrant:()=>ai,makeTrainingConsentRequest:()=>ii,makeTrainingDataMessage:()=>Oi,makeTransparencyMessage:()=>Xs,manifestFromWire:()=>Fi,manifestToWire:()=>ji,parseM2mPeerToken:()=>Xi,parseM2mTrustedToken:()=>Xn,roleFromJwtLevel:()=>Bt,selectTransport:()=>Si,signHybrid:()=>Ms,signMessage:()=>no,signMlDsa:()=>Is,validateAuthorityAccess:()=>Wn,validateCompetitionScope:()=>Hi,validateConfig:()=>js,validateConfigAgainstSchema:()=>Fs,validateConfigUpdate:()=>ti,validateConsentMessage:()=>ni,validateContributeScope:()=>Ui,validateCrossRegistryCommand:()=>xi,validateDelegationChain:()=>yo,validateLoaForScope:()=>mi,validateManifest:()=>Vi,validateMediaChunks:()=>Ti,validateMessage:()=>$s,validateNodeAgainstSchema:()=>Ks,validateReplay:()=>zs,validateRoleForScope:()=>Un,validateSafetyMessage:()=>Zs,validateTrainingDataMessage:()=>ui,validateURI:()=>Hs,validateV22DelegationChain:()=>oa,validateVersionCompat:()=>go,verifyHybrid:()=>Us,verifyM2mTrustedToken:()=>zi,verifyM2mTrustedTokenClaims:()=>zn,verifyMessage:()=>oo,verifyMlDsa:()=>Ns,verifyPQSignature:()=>ta,verifyV22MediaChunkHash:()=>sa});p();p();var Pe=class extends Error{constructor(e){super(e),this.name="RobotURIError"}},qe=class t{registry;manufacturer;model;version;deviceId;constructor(e){this.registry=e.registry,this.manufacturer=e.manufacturer,this.model=e.model,this.version=e.version,this.deviceId=e.deviceId}static parse(e){if(!e.startsWith("rcan://"))throw new Pe(`URI must start with 'rcan://' \u2014 got: ${e}`);let n=e.slice(7).split("/");if(n.length!==5)throw new Pe(`URI must have exactly 5 path segments (registry/manufacturer/model/version/device-id) \u2014 got ${n.length} in: ${e}`);let[o,s,i,a,c]=n;for(let[f,d]of[["registry",o],["manufacturer",s],["model",i],["version",a],["device-id",c]])if(!d||d.trim()==="")throw new Pe(`URI segment '${f}' must not be empty`);return new t({registry:o,manufacturer:s,model:i,version:a,deviceId:c})}static build(e){let r=e.registry??"registry.rcan.dev",{manufacturer:n,model:o,version:s,deviceId:i}=e;for(let[a,c]of[["manufacturer",n],["model",o],["version",s],["deviceId",i]])if(!c||c.trim()==="")throw new Pe(`'${a}' must not be empty`);return new t({registry:r,manufacturer:n,model:o,version:s,deviceId:i})}toString(){return`rcan://${this.registry}/${this.manufacturer}/${this.model}/${this.version}/${this.deviceId}`}get namespace(){return`${this.manufacturer}/${this.model}`}get registryUrl(){return`https://${this.registry}/registry/${this.manufacturer}/${this.model}/${this.version}/${this.deviceId}`}equals(e){return this.toString()===e.toString()}toJSON(){return{uri:this.toString(),registry:this.registry,manufacturer:this.manufacturer,model:this.model,version:this.version,deviceId:this.deviceId}}};p();p();var J="2.2.1",po="1.2.2";function go(t,e=J){let r=s=>{let i=s.split("."),a=parseInt(i[0]??"0",10),c=parseInt(i[1]??"0",10);return[isNaN(a)?0:a,isNaN(c)?0:c]},[n]=r(t),[o]=r(e);return n===o}var Ae=(u=>(u[u.COMMAND=1]="COMMAND",u[u.RESPONSE=2]="RESPONSE",u[u.STATUS=3]="STATUS",u[u.HEARTBEAT=4]="HEARTBEAT",u[u.CONFIG=5]="CONFIG",u[u.SAFETY=6]="SAFETY",u[u.AUTH=7]="AUTH",u[u.ERROR=8]="ERROR",u[u.DISCOVER=9]="DISCOVER",u[u.PENDING_AUTH=10]="PENDING_AUTH",u[u.INVOKE=11]="INVOKE",u[u.INVOKE_RESULT=12]="INVOKE_RESULT",u[u.INVOKE_CANCEL=13]="INVOKE_CANCEL",u[u.REGISTRY_REGISTER=14]="REGISTRY_REGISTER",u[u.REGISTRY_RESOLVE=15]="REGISTRY_RESOLVE",u[u.TRANSPARENCY=16]="TRANSPARENCY",u[u.COMMAND_ACK=17]="COMMAND_ACK",u[u.COMMAND_NACK=18]="COMMAND_NACK",u[u.ROBOT_REVOCATION=19]="ROBOT_REVOCATION",u[u.CONSENT_REQUEST=20]="CONSENT_REQUEST",u[u.CONSENT_GRANT=21]="CONSENT_GRANT",u[u.CONSENT_DENY=22]="CONSENT_DENY",u[u.FLEET_COMMAND=23]="FLEET_COMMAND",u[u.SUBSCRIBE=24]="SUBSCRIBE",u[u.UNSUBSCRIBE=25]="UNSUBSCRIBE",u[u.FAULT_REPORT=26]="FAULT_REPORT",u[u.KEY_ROTATION=27]="KEY_ROTATION",u[u.COMMAND_COMMIT=28]="COMMAND_COMMIT",u[u.SENSOR_DATA=29]="SENSOR_DATA",u[u.TRAINING_CONSENT_REQUEST=30]="TRAINING_CONSENT_REQUEST",u[u.TRAINING_CONSENT_GRANT=31]="TRAINING_CONSENT_GRANT",u[u.TRAINING_CONSENT_DENY=32]="TRAINING_CONSENT_DENY",u[u.CONTRIBUTE_REQUEST=33]="CONTRIBUTE_REQUEST",u[u.CONTRIBUTE_RESULT=34]="CONTRIBUTE_RESULT",u[u.CONTRIBUTE_CANCEL=35]="CONTRIBUTE_CANCEL",u[u.TRAINING_DATA=36]="TRAINING_DATA",u[u.COMPETITION_ENTER=37]="COMPETITION_ENTER",u[u.COMPETITION_SCORE=38]="COMPETITION_SCORE",u[u.SEASON_STANDING=39]="SEASON_STANDING",u[u.PERSONAL_RESEARCH_RESULT=40]="PERSONAL_RESEARCH_RESULT",u[u.AUTHORITY_ACCESS=41]="AUTHORITY_ACCESS",u[u.AUTHORITY_RESPONSE=42]="AUTHORITY_RESPONSE",u[u.FIRMWARE_ATTESTATION=43]="FIRMWARE_ATTESTATION",u[u.SBOM_UPDATE=44]="SBOM_UPDATE",u))(Ae||{}),xe=class extends Error{constructor(e){super(e),this.name="RCANMessageError"}},$=class t{rcan;rcanVersion;cmd;target;params;confidence;modelIdentity;signature;timestamp;senderType;cloudProvider;keyId;delegationChain;groupId;qos;presenceVerified;proximityMeters;readOnly;loa;transportEncoding;mediaChunks;firmwareHash;attestationRef;pqSig;constructor(e){if(!e.cmd||e.cmd.trim()==="")throw new xe("'cmd' is required");if(!e.target)throw new xe("'target' is required");if(this.rcan=e.rcan??J,this.rcanVersion=e.rcanVersion??J,this.cmd=e.cmd,this.target=e.target instanceof qe?e.target.toString():String(e.target),this.params=e.params??{},this.confidence=e.confidence,this.modelIdentity=e.modelIdentity??e.model_identity,this.signature=e.signature,this.timestamp=e.timestamp??new Date().toISOString(),this.senderType=e.senderType,this.cloudProvider=e.cloudProvider,this.keyId=e.keyId,this.delegationChain=e.delegationChain,this.groupId=e.groupId,this.qos=e.qos,this.presenceVerified=e.presenceVerified,this.proximityMeters=e.proximityMeters,this.readOnly=e.readOnly,this.loa=e.loa,this.transportEncoding=e.transportEncoding,this.mediaChunks=e.mediaChunks,this.firmwareHash=e.firmwareHash,this.attestationRef=e.attestationRef,this.pqSig=e.pqSig,this.signature!==void 0&&this.signature.sig==="pending")throw new xe("signature.sig:'pending' is not valid in RCAN v2.1. Sign the message before sending.");if(this.confidence!==void 0&&(this.confidence<0||this.confidence>1))throw new xe(`confidence must be in [0.0, 1.0] \u2014 got ${this.confidence}`)}get isSigned(){return this.signature!==void 0&&this.signature.sig!==""}get isAiDriven(){return this.confidence!==void 0}toJSON(){let e={rcan:this.rcan,rcanVersion:this.rcanVersion,cmd:this.cmd,target:this.target,timestamp:this.timestamp};return Object.keys(this.params).length>0&&(e.params=this.params),this.confidence!==void 0&&(e.confidence=this.confidence),this.modelIdentity&&(e.model_identity=this.modelIdentity),this.signature&&(e.signature=this.signature),this.senderType!==void 0&&(e.senderType=this.senderType),this.cloudProvider!==void 0&&(e.cloudProvider=this.cloudProvider),this.keyId!==void 0&&(e.keyId=this.keyId),this.delegationChain!==void 0&&(e.delegationChain=this.delegationChain),this.groupId!==void 0&&(e.groupId=this.groupId),this.qos!==void 0&&(e.qos=this.qos),this.presenceVerified!==void 0&&(e.presenceVerified=this.presenceVerified),this.proximityMeters!==void 0&&(e.proximityMeters=this.proximityMeters),this.readOnly!==void 0&&(e.readOnly=this.readOnly),this.loa!==void 0&&(e.loa=this.loa),this.transportEncoding!==void 0&&(e.transportEncoding=this.transportEncoding),this.mediaChunks!==void 0&&(e.mediaChunks=this.mediaChunks),this.firmwareHash!==void 0&&(e.firmwareHash=this.firmwareHash),this.attestationRef!==void 0&&(e.attestationRef=this.attestationRef),e}toJSONString(e){return JSON.stringify(this.toJSON(),null,e)}static fromJSON(e){let r;if(typeof e=="string")try{r=JSON.parse(e)}catch{throw new xe("Invalid JSON string")}else r=e;if(!r.cmd)throw new xe("Missing required field: 'cmd'");if(!r.target)throw new xe("Missing required field: 'target'");if(!r.rcan)throw new xe("Missing required field: 'rcan'");return new t({rcan:r.rcan,rcanVersion:r.rcanVersion,cmd:r.cmd,target:r.target,params:r.params??{},confidence:r.confidence,modelIdentity:r.model_identity??r.modelIdentity,signature:r.signature,timestamp:r.timestamp,senderType:r.senderType,cloudProvider:r.cloudProvider,keyId:r.keyId,delegationChain:r.delegationChain,groupId:r.groupId,qos:r.qos,presenceVerified:r.presenceVerified,proximityMeters:r.proximityMeters,readOnly:r.readOnly,loa:r.loa,transportEncoding:r.transportEncoding,mediaChunks:r.mediaChunks,firmwareHash:r.firmwareHash,attestationRef:r.attestationRef,pqSig:r.pqSig})}};function ho(t,e){let r=t.toJSON();return r.senderType="cloud_function",r.cloudProvider=e,new $(r)}function mo(t,e){let r=t.delegationChain?[...t.delegationChain,e]:[e],n=t.toJSON();return n.delegationChain=r,new $(n)}function yo(t){if(t.length>4)return{valid:!1,reason:"DELEGATION_CHAIN_EXCEEDED: max depth is 4 hops"};for(let e=0;e<t.length;e++){let r=t[e];if(!r)return{valid:!1,reason:`hop ${e} is undefined`};if(!r.issuerRuri)return{valid:!1,reason:`hop ${e}: missing issuerRuri`};if(!r.humanSubject)return{valid:!1,reason:`hop ${e}: missing humanSubject`};if(!r.timestamp)return{valid:!1,reason:`hop ${e}: missing timestamp`};if(!r.scope)return{valid:!1,reason:`hop ${e}: missing scope`};if(!r.signature)return{valid:!1,reason:`hop ${e}: missing signature`}}return{valid:!0,reason:"ok"}}p();p();rr();p();p();p();je();var nr=class{blockLen;outputLen;padOffset;isLE;buffer;view;finished=!1;length=0;pos=0;destroyed=!1;constructor(e,r,n,o){this.blockLen=e,this.outputLen=r,this.padOffset=n,this.isLE=o,this.buffer=new Uint8Array(e),this.view=Ft(this.buffer)}update(e){dt(this),M(e);let{view:r,buffer:n,blockLen:o}=this,s=e.length;for(let i=0;i<s;){let a=Math.min(o-this.pos,s-i);if(a===o){let c=Ft(e);for(;o<=s-i;i+=o)this.process(c,i);continue}n.set(e.subarray(i,i+a),this.pos),this.pos+=a,i+=a,this.pos===o&&(this.process(r,0),this.pos=0)}return this.length+=e.length,this.roundClean(),this}digestInto(e){dt(this),jt(e,this),this.finished=!0;let{buffer:r,view:n,blockLen:o,isLE:s}=this,{pos:i}=this;r[i++]=128,He(this.buffer.subarray(i)),this.padOffset>o-i&&(this.process(n,0),i=0);for(let b=i;b<o;b++)r[b]=0;n.setBigUint64(o-8,BigInt(this.length*8),s),this.process(n,0);let a=Ft(e),c=this.outputLen;if(c%4)throw new Error("_sha2: outputLen must be aligned to 32bit");let f=c/4,d=this.get();if(f>d.length)throw new Error("_sha2: outputLen bigger than state");for(let b=0;b<f;b++)a.setUint32(4*b,d[b],s)}digest(){let{buffer:e,outputLen:r}=this;this.digestInto(e);let n=e.slice(0,r);return this.destroy(),n}_cloneInto(e){e||=new this.constructor,e.set(...this.get());let{blockLen:r,buffer:n,length:o,finished:s,destroyed:i,pos:a}=this;return e.destroyed=i,e.finished=s,e.length=o,e.pos=a,o%r&&e.buffer.set(n),e}clone(){return this._cloneInto()}};var Q=Uint32Array.from([1779033703,4089235720,3144134277,2227873595,1013904242,4271175723,2773480762,1595750129,1359893119,2917565137,2600822924,725511199,528734635,4215389547,1541459225,327033209]);Gr();je();var os=Wt(["0x428a2f98d728ae22","0x7137449123ef65cd","0xb5c0fbcfec4d3b2f","0xe9b5dba58189dbbc","0x3956c25bf348b538","0x59f111f1b605d019","0x923f82a4af194f9b","0xab1c5ed5da6d8118","0xd807aa98a3030242","0x12835b0145706fbe","0x243185be4ee4b28c","0x550c7dc3d5ffb4e2","0x72be5d74f27b896f","0x80deb1fe3b1696b1","0x9bdc06a725c71235","0xc19bf174cf692694","0xe49b69c19ef14ad2","0xefbe4786384f25e3","0x0fc19dc68b8cd5b5","0x240ca1cc77ac9c65","0x2de92c6f592b0275","0x4a7484aa6ea6e483","0x5cb0a9dcbd41fbd4","0x76f988da831153b5","0x983e5152ee66dfab","0xa831c66d2db43210","0xb00327c898fb213f","0xbf597fc7beef0ee4","0xc6e00bf33da88fc2","0xd5a79147930aa725","0x06ca6351e003826f","0x142929670a0e6e70","0x27b70a8546d22ffc","0x2e1b21385c26c926","0x4d2c6dfc5ac42aed","0x53380d139d95b3df","0x650a73548baf63de","0x766a0abb3c77b2a8","0x81c2c92e47edaee6","0x92722c851482353b","0xa2bfe8a14cf10364","0xa81a664bbc423001","0xc24b8b70d0f89791","0xc76c51a30654be30","0xd192e819d6ef5218","0xd69906245565a910","0xf40e35855771202a","0x106aa07032bbd1b8","0x19a4c116b8d2d0c8","0x1e376c085141ab53","0x2748774cdf8eeb99","0x34b0bcb5e19b48a8","0x391c0cb3c5c95a63","0x4ed8aa4ae3418acb","0x5b9cca4f7763e373","0x682e6ff3d6b2b8a3","0x748f82ee5defb2fc","0x78a5636f43172f60","0x84c87814a1f0ab72","0x8cc702081a6439ec","0x90befffa23631e28","0xa4506cebde82bde9","0xbef9a3f7b2c67915","0xc67178f2e372532b","0xca273eceea26619c","0xd186b8c721c0c207","0xeada7dd6cde0eb1e","0xf57d4f7fee6ed178","0x06f067aa72176fba","0x0a637dc5a2c898a6","0x113f9804bef90dae","0x1b710b35131c471b","0x28db77f523047d84","0x32caab7b40c72493","0x3c9ebe0a15c9bebc","0x431d67c49c100d4c","0x4cc5d4becb3e42b6","0x597f299cfc657e2a","0x5fcb6fab3ad6faec","0x6c44198c4a475817"].map(t=>BigInt(t))),Ba=os[0],Da=os[1],Ge=new Uint32Array(80),Ye=new Uint32Array(80),fn=class extends nr{constructor(e){super(128,e,16,!1)}get(){let{Ah:e,Al:r,Bh:n,Bl:o,Ch:s,Cl:i,Dh:a,Dl:c,Eh:f,El:d,Fh:b,Fl:R,Gh:w,Gl:_,Hh:O,Hl:k}=this;return[e,r,n,o,s,i,a,c,f,d,b,R,w,_,O,k]}set(e,r,n,o,s,i,a,c,f,d,b,R,w,_,O,k){this.Ah=e|0,this.Al=r|0,this.Bh=n|0,this.Bl=o|0,this.Ch=s|0,this.Cl=i|0,this.Dh=a|0,this.Dl=c|0,this.Eh=f|0,this.El=d|0,this.Fh=b|0,this.Fl=R|0,this.Gh=w|0,this.Gl=_|0,this.Hh=O|0,this.Hl=k|0}process(e,r){for(let l=0;l<16;l++,r+=4)Ge[l]=e.getUint32(r),Ye[l]=e.getUint32(r+=4);for(let l=16;l<80;l++){let v=Ge[l-15]|0,I=Ye[l-15]|0,U=Xe(v,I,1)^Xe(v,I,8)^Kr(v,I,7),D=ze(v,I,1)^ze(v,I,8)^Vr(v,I,7),m=Ge[l-2]|0,g=Ye[l-2]|0,S=Xe(m,g,19)^vt(m,g,61)^Kr(m,g,6),B=ze(m,g,19)^Tt(m,g,61)^Vr(m,g,6),L=Uo(D,B,Ye[l-7],Ye[l-16]),P=Bo(L,U,S,Ge[l-7],Ge[l-16]);Ge[l]=P|0,Ye[l]=L|0}let{Ah:n,Al:o,Bh:s,Bl:i,Ch:a,Cl:c,Dh:f,Dl:d,Eh:b,El:R,Fh:w,Fl:_,Gh:O,Gl:k,Hh:y,Hl:h}=this;for(let l=0;l<80;l++){let v=Xe(b,R,14)^Xe(b,R,18)^vt(b,R,41),I=ze(b,R,14)^ze(b,R,18)^Tt(b,R,41),U=b&w^~b&O,D=R&_^~R&k,m=Do(h,I,D,Da[l],Ye[l]),g=Lo(m,y,v,U,Ba[l],Ge[l]),S=m|0,B=Xe(n,o,28)^vt(n,o,34)^vt(n,o,39),L=ze(n,o,28)^Tt(n,o,34)^Tt(n,o,39),P=n&s^n&a^s&a,H=o&i^o&c^i&c;y=O|0,h=k|0,O=w|0,k=_|0,w=b|0,_=R|0,{h:b,l:R}=Se(f|0,d|0,g|0,S|0),f=a|0,d=c|0,a=s|0,c=i|0,s=n|0,i=o|0;let K=No(S,L,H);n=Mo(K,g,B,P),o=K|0}({h:n,l:o}=Se(this.Ah|0,this.Al|0,n|0,o|0)),{h:s,l:i}=Se(this.Bh|0,this.Bl|0,s|0,i|0),{h:a,l:c}=Se(this.Ch|0,this.Cl|0,a|0,c|0),{h:f,l:d}=Se(this.Dh|0,this.Dl|0,f|0,d|0),{h:b,l:R}=Se(this.Eh|0,this.El|0,b|0,R|0),{h:w,l:_}=Se(this.Fh|0,this.Fl|0,w|0,_|0),{h:O,l:k}=Se(this.Gh|0,this.Gl|0,O|0,k|0),{h:y,l:h}=Se(this.Hh|0,this.Hl|0,y|0,h|0),this.set(n,o,s,i,a,c,f,d,b,R,w,_,O,k,y,h)}roundClean(){He(Ge,Ye)}destroy(){He(this.buffer),this.set(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)}},dn=class extends fn{Ah=Q[0]|0;Al=Q[1]|0;Bh=Q[2]|0;Bl=Q[3]|0;Ch=Q[4]|0;Cl=Q[5]|0;Dh=Q[6]|0;Dl=Q[7]|0;Eh=Q[8]|0;El=Q[9]|0;Fh=Q[10]|0;Fl=Q[11]|0;Gh=Q[12]|0;Gl=Q[13]|0;Hh=Q[14]|0;Hl=Q[15]|0;constructor(){super(64)}};var ss=Kt(()=>new dn,At(3));p();Ct();p();Ct();var ne=BigInt(0),re=BigInt(1),nt=BigInt(2),cs=BigInt(3),us=BigInt(4),fs=BigInt(5),La=BigInt(7),ds=BigInt(8),Pa=BigInt(9),ls=BigInt(16);function V(t,e){let r=t%e;return r>=ne?r:e+r}function be(t,e,r){let n=t;for(;e-- >ne;)n*=n,n%=r;return n}function is(t,e){if(t===ne)throw new Error("invert: expected non-zero number");if(e<=ne)throw new Error("invert: expected positive modulus, got "+e);let r=V(t,e),n=e,o=ne,s=re,i=re,a=ne;for(;r!==ne;){let f=n/r,d=n%r,b=o-i*f,R=s-a*f;n=r,r=d,o=i,s=a,i=b,a=R}if(n!==re)throw new Error("invert: does not exist");return V(o,e)}function pn(t,e,r){if(!t.eql(t.sqr(e),r))throw new Error("Cannot find square root")}function ps(t,e){let r=(t.ORDER+re)/us,n=t.pow(e,r);return pn(t,n,e),n}function qa(t,e){let r=(t.ORDER-fs)/ds,n=t.mul(e,nt),o=t.pow(n,r),s=t.mul(e,o),i=t.mul(t.mul(s,nt),o),a=t.mul(s,t.sub(i,t.ONE));return pn(t,a,e),a}function Ha(t){let e=sr(t),r=gs(t),n=r(e,e.neg(e.ONE)),o=r(e,n),s=r(e,e.neg(n)),i=(t+La)/ls;return(a,c)=>{let f=a.pow(c,i),d=a.mul(f,n),b=a.mul(f,o),R=a.mul(f,s),w=a.eql(a.sqr(d),c),_=a.eql(a.sqr(b),c);f=a.cmov(f,d,w),d=a.cmov(R,b,_);let O=a.eql(a.sqr(d),c),k=a.cmov(f,d,O);return pn(a,k,c),k}}function gs(t){if(t<cs)throw new Error("sqrt is not defined for small field");let e=t-re,r=0;for(;e%nt===ne;)e/=nt,r++;let n=nt,o=sr(t);for(;as(o,n)===1;)if(n++>1e3)throw new Error("Cannot find square root: probably non-prime P");if(r===1)return ps;let s=o.pow(n,e),i=(e+re)/nt;return function(c,f){if(c.is0(f))return f;if(as(c,f)!==1)throw new Error("Cannot find square root");let d=r,b=c.mul(c.ONE,s),R=c.pow(f,e),w=c.pow(f,i);for(;!c.eql(R,c.ONE);){if(c.is0(R))return c.ZERO;let _=1,O=c.sqr(R);for(;!c.eql(O,c.ONE);)if(_++,O=c.sqr(O),_===d)throw new Error("Cannot find square root");let k=re<<BigInt(d-_-1),y=c.pow(b,k);d=_,b=c.sqr(y),R=c.mul(R,b),w=c.mul(w,y)}return w}}function $a(t){return t%us===cs?ps:t%ds===fs?qa:t%ls===Pa?Ha(t):gs(t)}var hs=(t,e)=>(V(t,e)&re)===re,ja=["create","isValid","is0","neg","inv","sqrt","sqr","eql","add","sub","mul","pow","div","addN","subN","mulN","sqrN"];function ms(t){let e={ORDER:"bigint",BYTES:"number",BITS:"number"},r=ja.reduce((n,o)=>(n[o]="function",n),e);return St(t,r),t}function Fa(t,e,r){if(r<ne)throw new Error("invalid exponent, negatives unsupported");if(r===ne)return t.ONE;if(r===re)return e;let n=t.ONE,o=e;for(;r>ne;)r&re&&(n=t.mul(n,o)),o=t.sqr(o),r>>=re;return n}function or(t,e,r=!1){let n=new Array(e.length).fill(r?t.ZERO:void 0),o=e.reduce((i,a,c)=>t.is0(a)?i:(n[c]=i,t.mul(i,a)),t.ONE),s=t.inv(o);return e.reduceRight((i,a,c)=>t.is0(a)?i:(n[c]=t.mul(i,n[c]),t.mul(i,a)),s),n}function as(t,e){let r=(t.ORDER-re)/nt,n=t.pow(e,r),o=t.eql(n,t.ONE),s=t.eql(n,t.ZERO),i=t.eql(n,t.neg(t.ONE));if(!o&&!s&&!i)throw new Error("invalid Legendre symbol result");return o?1:s?0:-1}function Ka(t,e){e!==void 0&&Me(e);let r=e!==void 0?e:t.toString(2).length,n=Math.ceil(r/8);return{nBitLength:r,nByteLength:n}}var ln=class{ORDER;BITS;BYTES;isLE;ZERO=ne;ONE=re;_lengths;_sqrt;_mod;constructor(e,r={}){if(e<=ne)throw new Error("invalid field: expected ORDER > 0, got "+e);let n;this.isLE=!1,r!=null&&typeof r=="object"&&(typeof r.BITS=="number"&&(n=r.BITS),typeof r.sqrt=="function"&&(this.sqrt=r.sqrt),typeof r.isLE=="boolean"&&(this.isLE=r.isLE),r.allowedLengths&&(this._lengths=r.allowedLengths?.slice()),typeof r.modFromBytes=="boolean"&&(this._mod=r.modFromBytes));let{nBitLength:o,nByteLength:s}=Ka(e,n);if(s>2048)throw new Error("invalid field: expected ORDER of <= 2048 bytes");this.ORDER=e,this.BITS=o,this.BYTES=s,this._sqrt=void 0,Object.preventExtensions(this)}create(e){return V(e,this.ORDER)}isValid(e){if(typeof e!="bigint")throw new Error("invalid field element: expected bigint, got "+typeof e);return ne<=e&&e<this.ORDER}is0(e){return e===ne}isValidNot0(e){return!this.is0(e)&&this.isValid(e)}isOdd(e){return(e&re)===re}neg(e){return V(-e,this.ORDER)}eql(e,r){return e===r}sqr(e){return V(e*e,this.ORDER)}add(e,r){return V(e+r,this.ORDER)}sub(e,r){return V(e-r,this.ORDER)}mul(e,r){return V(e*r,this.ORDER)}pow(e,r){return Fa(this,e,r)}div(e,r){return V(e*is(r,this.ORDER),this.ORDER)}sqrN(e){return e*e}addN(e,r){return e+r}subN(e,r){return e-r}mulN(e,r){return e*r}inv(e){return is(e,this.ORDER)}sqrt(e){return this._sqrt||(this._sqrt=$a(this.ORDER)),this._sqrt(this,e)}toBytes(e){return this.isLE?So(e,this.BYTES):$r(e,this.BYTES)}fromBytes(e,r=!1){M(e);let{_lengths:n,BYTES:o,isLE:s,ORDER:i,_mod:a}=this;if(n){if(!n.includes(e.length)||e.length>o)throw new Error("Field.fromBytes: expected "+n+" bytes, got "+e.length);let f=new Uint8Array(o);f.set(e,s?0:f.length-e.length),e=f}if(e.length!==o)throw new Error("Field.fromBytes: expected "+o+" bytes, got "+e.length);let c=s?gt(e):Ao(e);if(a&&(c=V(c,i)),!r&&!this.isValid(c))throw new Error("invalid field element: outside of range 0..ORDER");return c}invertBatch(e){return or(this,e)}cmov(e,r,n){return n?r:e}};function sr(t,e={}){return new ln(t,e)}var ir=BigInt(0),yn=BigInt(1);function ys(t,e){let r=e.negate();return t?r:e}function cr(t,e){let r=or(t.Fp,e.map(n=>n.Z));return e.map((n,o)=>t.fromAffine(n.toAffine(r[o])))}function _s(t,e){if(!Number.isSafeInteger(t)||t<=0||t>e)throw new Error("invalid window size, expected [1.."+e+"], got W="+t)}function gn(t,e){_s(t,e);let r=Math.ceil(e/t)+1,n=2**(t-1),o=2**t,s=Co(t),i=BigInt(t);return{windows:r,windowSize:n,mask:s,maxNumber:o,shiftBy:i}}function xs(t,e,r){let{windowSize:n,mask:o,maxNumber:s,shiftBy:i}=r,a=Number(t&o),c=t>>i;a>n&&(a-=s,c+=yn);let f=e*n,d=f+Math.abs(a)-1,b=a===0,R=a<0,w=e%2!==0;return{nextN:c,offset:d,isZero:b,isNeg:R,isNegF:w,offsetF:f}}var hn=new WeakMap,ws=new WeakMap;function mn(t){return ws.get(t)||1}function bs(t){if(t!==ir)throw new Error("invalid wNAF")}var ar=class{BASE;ZERO;Fn;bits;constructor(e,r){this.BASE=e.BASE,this.ZERO=e.ZERO,this.Fn=e.Fn,this.bits=r}_unsafeLadder(e,r,n=this.ZERO){let o=e;for(;r>ir;)r&yn&&(n=n.add(o)),o=o.double(),r>>=yn;return n}precomputeWindow(e,r){let{windows:n,windowSize:o}=gn(r,this.bits),s=[],i=e,a=i;for(let c=0;c<n;c++){a=i,s.push(a);for(let f=1;f<o;f++)a=a.add(i),s.push(a);i=a.double()}return s}wNAF(e,r,n){if(!this.Fn.isValid(n))throw new Error("invalid scalar");let o=this.ZERO,s=this.BASE,i=gn(e,this.bits);for(let a=0;a<i.windows;a++){let{nextN:c,offset:f,isZero:d,isNeg:b,isNegF:R,offsetF:w}=xs(n,a,i);n=c,d?s=s.add(ys(R,r[w])):o=o.add(ys(b,r[f]))}return bs(n),{p:o,f:s}}wNAFUnsafe(e,r,n,o=this.ZERO){let s=gn(e,this.bits);for(let i=0;i<s.windows&&n!==ir;i++){let{nextN:a,offset:c,isZero:f,isNeg:d}=xs(n,i,s);if(n=a,!f){let b=r[c];o=o.add(d?b.negate():b)}}return bs(n),o}getPrecomputes(e,r,n){let o=hn.get(r);return o||(o=this.precomputeWindow(r,e),e!==1&&(typeof n=="function"&&(o=n(o)),hn.set(r,o))),o}cached(e,r,n){let o=mn(e);return this.wNAF(o,this.getPrecomputes(o,e,n),r)}unsafe(e,r,n,o){let s=mn(e);return s===1?this._unsafeLadder(e,r,o):this.wNAFUnsafe(s,this.getPrecomputes(s,e,n),r,o)}createCache(e,r){_s(r,this.bits),ws.set(e,r),hn.delete(e)}hasCache(e){return mn(e)!==1}};function Rs(t,e,r){if(e){if(e.ORDER!==t)throw new Error("Field.ORDER must match order: Fp == p, Fn == n");return ms(e),e}else return sr(t,{isLE:r})}function Es(t,e,r={},n){if(n===void 0&&(n=t==="edwards"),!e||typeof e!="object")throw new Error(`expected valid ${t} CURVE object`);for(let c of["p","n","h"]){let f=e[c];if(!(typeof f=="bigint"&&f>ir))throw new Error(`CURVE.${c} must be positive bigint`)}let o=Rs(e.p,r.Fp,n),s=Rs(e.n,r.Fn,n),a=["Gx","Gy","a",t==="weierstrass"?"b":"d"];for(let c of a)if(!o.isValid(e[c]))throw new Error(`CURVE.${c} must be valid field element of CURVE.Fp`);return e=Object.freeze(Object.assign({},e)),{CURVE:e,Fp:o,Fn:s}}function As(t,e){return function(n){let o=t(n);return{secretKey:o,publicKey:e(o)}}}p();Ct();var We=BigInt(0),Z=BigInt(1),xn=BigInt(2),Va=BigInt(8);function Ga(t,e,r,n){let o=t.sqr(r),s=t.sqr(n),i=t.add(t.mul(e.a,o),s),a=t.add(t.ONE,t.mul(e.d,t.mul(o,s)));return t.eql(i,a)}function Ss(t,e={}){let r=Es("edwards",t,e,e.FpFnLE),{Fp:n,Fn:o}=r,s=r.CURVE,{h:i}=s;St(e,{},{uvRatio:"function"});let a=xn<<BigInt(o.BYTES*8)-Z,c=k=>n.create(k),f=e.uvRatio||((k,y)=>{try{return{isValid:!0,value:n.sqrt(n.div(k,y))}}catch{return{isValid:!1,value:We}}});if(!Ga(n,s,s.Gx,s.Gy))throw new Error("bad curve params: generator point");function d(k,y,h=!1){let l=h?Z:We;return jr("coordinate "+k,y,l,a),y}function b(k){if(!(k instanceof _))throw new Error("EdwardsPoint expected")}let R=Fr((k,y)=>{let{X:h,Y:l,Z:v}=k,I=k.is0();y==null&&(y=I?Va:n.inv(v));let U=c(h*y),D=c(l*y),m=n.mul(v,y);if(I)return{x:We,y:Z};if(m!==Z)throw new Error("invZ was invalid");return{x:U,y:D}}),w=Fr(k=>{let{a:y,d:h}=s;if(k.is0())throw new Error("bad point: ZERO");let{X:l,Y:v,Z:I,T:U}=k,D=c(l*l),m=c(v*v),g=c(I*I),S=c(g*g),B=c(D*y),L=c(g*c(B+m)),P=c(S+c(h*c(D*m)));if(L!==P)throw new Error("bad point: equation left != right (1)");let H=c(l*v),K=c(I*U);if(H!==K)throw new Error("bad point: equation left != right (2)");return!0});class _{static BASE=new _(s.Gx,s.Gy,Z,c(s.Gx*s.Gy));static ZERO=new _(We,Z,Z,We);static Fp=n;static Fn=o;X;Y;Z;T;constructor(y,h,l,v){this.X=d("x",y),this.Y=d("y",h),this.Z=d("z",l,!0),this.T=d("t",v),Object.freeze(this)}static CURVE(){return s}static fromAffine(y){if(y instanceof _)throw new Error("extended point not allowed");let{x:h,y:l}=y||{};return d("x",h),d("y",l),new _(h,l,Z,c(h*l))}static fromBytes(y,h=!1){let l=n.BYTES,{a:v,d:I}=s;y=Gt(M(y,l,"point")),pt(h,"zip215");let U=Gt(y),D=y[l-1];U[l-1]=D&-129;let m=gt(U),g=h?a:n.ORDER;jr("point.y",m,We,g);let S=c(m*m),B=c(S-Z),L=c(I*S-v),{isValid:P,value:H}=f(B,L);if(!P)throw new Error("bad point: invalid y coordinate");let K=(H&Z)===Z,se=(D&128)!==0;if(!h&&H===We&&se)throw new Error("bad point: x=0 and x_0=1");return se!==K&&(H=c(-H)),_.fromAffine({x:H,y:m})}static fromHex(y,h=!1){return _.fromBytes(wt(y),h)}get x(){return this.toAffine().x}get y(){return this.toAffine().y}precompute(y=8,h=!0){return O.createCache(this,y),h||this.multiply(xn),this}assertValidity(){w(this)}equals(y){b(y);let{X:h,Y:l,Z:v}=this,{X:I,Y:U,Z:D}=y,m=c(h*D),g=c(I*v),S=c(l*D),B=c(U*v);return m===g&&S===B}is0(){return this.equals(_.ZERO)}negate(){return new _(c(-this.X),this.Y,this.Z,c(-this.T))}double(){let{a:y}=s,{X:h,Y:l,Z:v}=this,I=c(h*h),U=c(l*l),D=c(xn*c(v*v)),m=c(y*I),g=h+l,S=c(c(g*g)-I-U),B=m+U,L=B-D,P=m-U,H=c(S*L),K=c(B*P),se=c(S*P),he=c(L*B);return new _(H,K,he,se)}add(y){b(y);let{a:h,d:l}=s,{X:v,Y:I,Z:U,T:D}=this,{X:m,Y:g,Z:S,T:B}=y,L=c(v*m),P=c(I*g),H=c(D*l*B),K=c(U*S),se=c((v+I)*(m+g)-L-P),he=K-H,me=K+H,De=c(P-h*L),at=c(se*he),ct=c(me*De),bt=c(se*De),ie=c(he*me);return new _(at,ct,ie,bt)}subtract(y){return this.add(y.negate())}multiply(y){if(!o.isValidNot0(y))throw new Error("invalid scalar: expected 1 <= sc < curve.n");let{p:h,f:l}=O.cached(this,y,v=>cr(_,v));return cr(_,[h,l])[0]}multiplyUnsafe(y,h=_.ZERO){if(!o.isValid(y))throw new Error("invalid scalar: expected 0 <= sc < curve.n");return y===We?_.ZERO:this.is0()||y===Z?this:O.unsafe(this,y,l=>cr(_,l),h)}isSmallOrder(){return this.multiplyUnsafe(i).is0()}isTorsionFree(){return O.unsafe(this,s.n).is0()}toAffine(y){return R(this,y)}clearCofactor(){return i===Z?this:this.multiplyUnsafe(i)}toBytes(){let{x:y,y:h}=this.toAffine(),l=n.toBytes(h);return l[l.length-1]|=y&Z?128:0,l}toHex(){return lt(this.toBytes())}toString(){return`<Point ${this.is0()?"ZERO":this.toHex()}>`}}let O=new ar(_,o.BITS);return _.BASE.precompute(8),_}function Cs(t,e,r={}){if(typeof e!="function")throw new Error('"hash" function param is required');St(r,{},{adjustScalarBytes:"function",randomBytes:"function",domain:"function",prehash:"function",mapToCurve:"function"});let{prehash:n}=r,{BASE:o,Fp:s,Fn:i}=t,a=r.randomBytes||Et,c=r.adjustScalarBytes||(m=>m),f=r.domain||((m,g,S)=>{if(pt(S,"phflag"),g.length||S)throw new Error("Contexts/pre-hash are not supported");return m});function d(m){return i.create(gt(m))}function b(m){let g=l.secretKey;M(m,l.secretKey,"secretKey");let S=M(e(m),2*g,"hashedSecretKey"),B=c(S.slice(0,g)),L=S.slice(g,2*g),P=d(B);return{head:B,prefix:L,scalar:P}}function R(m){let{head:g,prefix:S,scalar:B}=b(m),L=o.multiply(B),P=L.toBytes();return{head:g,prefix:S,scalar:B,point:L,pointBytes:P}}function w(m){return R(m).pointBytes}function _(m=Uint8Array.of(),...g){let S=$e(...g);return d(e(f(S,M(m,void 0,"context"),!!n)))}function O(m,g,S={}){m=M(m,void 0,"message"),n&&(m=n(m));let{prefix:B,scalar:L,pointBytes:P}=R(g),H=_(S.context,B,m),K=o.multiply(H).toBytes(),se=_(S.context,K,P,m),he=i.create(H+se*L);if(!i.isValid(he))throw new Error("sign failed: invalid s");let me=$e(K,i.toBytes(he));return M(me,l.signature,"result")}let k={zip215:!0};function y(m,g,S,B=k){let{context:L,zip215:P}=B,H=l.signature;m=M(m,H,"signature"),g=M(g,void 0,"message"),S=M(S,l.publicKey,"publicKey"),P!==void 0&&pt(P,"zip215"),n&&(g=n(g));let K=H/2,se=m.subarray(0,K),he=gt(m.subarray(K,H)),me,De,at;try{me=t.fromBytes(S,P),De=t.fromBytes(se,P),at=o.multiplyUnsafe(he)}catch{return!1}if(!P&&me.isSmallOrder())return!1;let ct=_(L,De.toBytes(),me.toBytes(),g);return De.add(me.multiplyUnsafe(ct)).subtract(at).clearCofactor().is0()}let h=s.BYTES,l={secretKey:h,publicKey:h,signature:2*h,seed:h};function v(m=a(l.seed)){return M(m,l.seed,"seed")}function I(m){return ft(m)&&m.length===i.BYTES}function U(m,g){try{return!!t.fromBytes(m,g)}catch{return!1}}let D={getExtendedPublicKey:R,randomSecretKey:v,isValidSecretKey:I,isValidPublicKey:U,toMontgomery(m){let{y:g}=t.fromBytes(m),S=l.publicKey,B=S===32;if(!B&&S!==57)throw new Error("only defined for 25519 and 448");let L=B?s.div(Z+g,Z-g):s.div(g-Z,g+Z);return s.toBytes(L)},toMontgomerySecret(m){let g=l.secretKey;M(m,g);let S=e(m.subarray(0,g));return c(S).subarray(0,g)}};return Object.freeze({keygen:As(v,w),getPublicKey:w,sign:O,verify:y,utils:D,Point:t,lengths:l})}var Ya=BigInt(1),vs=BigInt(2);var Wa=BigInt(5),Ja=BigInt(8),bn=BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed"),Za={p:bn,n:BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),h:Ja,a:BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),d:BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),Gx:BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),Gy:BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")};function Xa(t){let e=BigInt(10),r=BigInt(20),n=BigInt(40),o=BigInt(80),s=bn,a=t*t%s*t%s,c=be(a,vs,s)*a%s,f=be(c,Ya,s)*t%s,d=be(f,Wa,s)*f%s,b=be(d,e,s)*d%s,R=be(b,r,s)*b%s,w=be(R,n,s)*R%s,_=be(w,o,s)*w%s,O=be(_,o,s)*w%s,k=be(O,e,s)*d%s;return{pow_p_5_8:be(k,vs,s)*t%s,b2:a}}function za(t){return t[0]&=248,t[31]&=127,t[31]|=64,t}var Ts=BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");function Qa(t,e){let r=bn,n=V(e*e*e,r),o=V(n*n*e,r),s=Xa(t*o).pow_p_5_8,i=V(t*n*s,r),a=V(e*i*i,r),c=i,f=V(i*Ts,r),d=a===t,b=a===V(-t,r),R=a===V(-t*Ts,r);return d&&(i=c),(b||R)&&(i=f),hs(i,r)&&(i=V(-i,r)),{isValid:d||b,value:i}}var ec=Ss(Za,{uvRatio:Qa});function tc(t){return Cs(ec,ss,Object.assign({adjustScalarBytes:za},t))}var Rn=tc({});function wn(t){let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function En(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=atob(e),n=new Uint8Array(r.length);for(let o=0;o<r.length;o++)n[o]=r.charCodeAt(o);return n}function ks(){let t=rt.keygen();return{privateKey:t.secretKey,publicKey:t.publicKey}}function Is(t,e){return rt.sign(e,t)}function Ns(t,e,r){return rt.verify(r,e,t)}function Ms(t,e,r){return{profile:"pqc-hybrid-v1",ed25519Sig:Rn.sign(r,t),mlDsaSig:rt.sign(r,e)}}function Us(t,e,r,n){return n.profile!=="pqc-hybrid-v1"?!1:Rn.verify(n.ed25519Sig,r,t)&&rt.verify(n.mlDsaSig,r,e)}function Bs(t){return`pqc-hybrid-v1.${wn(t.ed25519Sig)}.${wn(t.mlDsaSig)}`}function Ds(t){let e=t.split(".");if(e.length!==3||e[0]!=="pqc-hybrid-v1")throw new Error(`Invalid hybrid signature: expected "pqc-hybrid-v1.<ed25519b64>.<mldsab64>", got "${t.slice(0,40)}..."`);return{profile:"pqc-hybrid-v1",ed25519Sig:En(e[1]),mlDsaSig:En(e[2])}}function Ls(t){return{kty:"OKP",alg:"ML-DSA-65",use:"sig",x:wn(t)}}function Ps(t){let e=t;if(e.kty!=="OKP"||e.alg!=="ML-DSA-65")throw new Error(`Invalid ML-DSA-65 JWK: expected kty="OKP" alg="ML-DSA-65", got kty="${e.kty}" alg="${e.alg}"`);let r=e.x;if(typeof r!="string"||r.length===0)throw new Error("Invalid ML-DSA-65 JWK: missing or empty x field");return En(r)}function ur(){if(typeof globalThis.crypto<"u"&&typeof globalThis.crypto.randomUUID=="function")return globalThis.crypto.randomUUID();try{let{randomUUID:t}=Ee("crypto");return t()}catch{return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,t=>{let e=Math.random()*16|0;return(t==="x"?e:e&3|8).toString(16)})}}function An(t,e){return typeof process<"u",nc(t,e)}function _n(t){let e=[1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298],r=1779033703,n=3144134277,o=1013904242,s=2773480762,i=1359893119,a=2600822924,c=528734635,f=1541459225,b=t.length*8,R=[...t];for(R.push(128);R.length%64!==56;)R.push(0);for(let O=7;O>=0;O--)R.push(b/Math.pow(2,O*8)&255);for(let O=0;O<R.length;O+=64){let k=[];for(let g=0;g<16;g++)k[g]=R[O+g*4]<<24|R[O+g*4+1]<<16|R[O+g*4+2]<<8|R[O+g*4+3];for(let g=16;g<64;g++){let S=ve(k[g-15],7)^ve(k[g-15],18)^k[g-15]>>>3,B=ve(k[g-2],17)^ve(k[g-2],19)^k[g-2]>>>10;k[g]=k[g-16]+S+k[g-7]+B>>>0}let[y,h,l,v,I,U,D,m]=[r,n,o,s,i,a,c,f];for(let g=0;g<64;g++){let S=ve(I,6)^ve(I,11)^ve(I,25),B=I&U^~I&D,L=m+S+B+e[g]+k[g]>>>0,P=ve(y,2)^ve(y,13)^ve(y,22),H=y&h^y&l^h&l,K=P+H>>>0;[m,D,U,I,v,l,h,y]=[D,U,I,v+L>>>0,l,h,y,L+K>>>0]}r=r+y>>>0,n=n+h>>>0,o=o+l>>>0,s=s+v>>>0,i=i+I>>>0,a=a+U>>>0,c=c+D>>>0,f=f+m>>>0}let w=new Uint8Array(32),_=new DataView(w.buffer);return[r,n,o,s,i,a,c,f].forEach((O,k)=>_.setUint32(k*4,O)),w}function ve(t,e){return t>>>e|t<<32-e}function Os(t){if(typeof TextEncoder<"u")return new TextEncoder().encode(t);let e=new Uint8Array(t.length);for(let r=0;r<t.length;r++)e[r]=t.charCodeAt(r)&255;return e}function rc(t){return Array.from(t).map(e=>e.toString(16).padStart(2,"0")).join("")}function nc(t,e){let n=Os(t);n.length>64&&(n=_n(n));let o=new Uint8Array(64),s=new Uint8Array(64);for(let d=0;d<64;d++)o[d]=(n[d]??0)^54,s[d]=(n[d]??0)^92;let i=Os(e),a=new Uint8Array(64+i.length);a.set(o),a.set(i,64);let c=_n(a),f=new Uint8Array(96);return f.set(s),f.set(c,64),rc(_n(f))}var Ue=class extends Error{constructor(e){super(e),this.name="GateError"}},fr=class{threshold;constructor(e=.8){if(e<0||e>1)throw new Ue(`threshold must be in [0.0, 1.0] \u2014 got ${e}`);this.threshold=e}allows(e){return e>=this.threshold}margin(e){return e-this.threshold}assert(e,r){if(!this.allows(e)){let n=r?` for action '${r}'`:"";throw new Ue(`Confidence ${e}${n} is below threshold ${this.threshold}`)}}},dr=class{_pending=new Map;request(e,r={}){let n=ur();return this._pending.set(n,{token:n,action:e,context:r,createdAt:new Date().toISOString(),status:"pending"}),n}approve(e){let r=this._pending.get(e);if(!r)throw new Ue(`Unknown token: ${e}`);r.status="approved"}deny(e,r){let n=this._pending.get(e);if(!n)throw new Ue(`Unknown token: ${e}`);n.status="denied",r&&(n.reason=r)}check(e){let r=this._pending.get(e);if(!r)throw new Ue(`Unknown token: ${e}`);return r.status}get pendingApprovals(){return Array.from(this._pending.values()).filter(e=>e.status==="pending")}getApproval(e){return this._pending.get(e)}clearResolved(){for(let[e,r]of this._pending.entries())r.status!=="pending"&&this._pending.delete(e)}};p();var lr=class extends Error{constructor(e){super(e),this.name="AuditError"}};function oc(t,e,r,n,o){let s=JSON.stringify({recordId:t,action:e,robotUri:r,timestamp:n,params:o},Object.keys({recordId:t,action:e,robotUri:r,timestamp:n,params:o}).sort());return An("rcan-content-hash",s)}function qs(t,e){let{hmac:r,...n}=e,o=JSON.stringify(n,Object.keys(n).sort());return An(t,o)}var ht=class t{recordId;action;robotUri;confidence;modelIdentity;params;safetyApproved;timestamp;contentHash;previousHash;hmac;constructor(e){this.recordId=e.recordId,this.action=e.action,this.robotUri=e.robotUri,this.confidence=e.confidence,this.modelIdentity=e.modelIdentity,this.params=e.params,this.safetyApproved=e.safetyApproved,this.timestamp=e.timestamp,this.contentHash=e.contentHash,this.previousHash=e.previousHash,this.hmac=e.hmac}static create(e,r,n=null){let o=ur(),s=new Date().toISOString(),i=e.params??{},a=e.robotUri??"",c=oc(o,e.action,a,s,i),f={recordId:o,action:e.action,robotUri:a,confidence:e.confidence,modelIdentity:e.modelIdentity,params:i,safetyApproved:e.safetyApproved??!0,timestamp:s,contentHash:c,previousHash:n,hmac:""};return f.hmac=qs(r,f),new t(f)}verify(e){return qs(e,this.toJSON())===this.hmac}toJSON(){return{recordId:this.recordId,action:this.action,robotUri:this.robotUri,confidence:this.confidence,modelIdentity:this.modelIdentity,params:this.params,safetyApproved:this.safetyApproved,timestamp:this.timestamp,contentHash:this.contentHash,previousHash:this.previousHash,hmac:this.hmac}}static fromJSON(e){return new t(e)}},pr=class t{_records=[];_secret;constructor(e){this._secret=e}get records(){return this._records}append(e){let n=this._records[this._records.length-1]?.contentHash??null,o=ht.create(e,this._secret,n);return this._records.push(o),o}verifyAll(){let e=[],r=null;for(let n of this._records)n.verify(this._secret)||e.push(`HMAC invalid for record ${n.recordId.slice(0,8)}`),r!==null&&n.previousHash!==r&&e.push(`Chain broken at ${n.recordId.slice(0,8)}: expected prev=${r.slice(0,12)}`),r=n.contentHash;return{valid:e.length===0,count:this._records.length,errors:e}}toJSONL(){return this._records.map(e=>JSON.stringify(e.toJSON())).join(`
 `)+`
 `}static fromJSONL(e,r){let n=new t(r),o=e.trim().split(`
-`).filter(s=>s.trim()!=="");for(let s of o){let i=JSON.parse(s);n._records.push($e.fromJSON(i))}return n}};d();function Gt(){return{ok:!0,issues:[],warnings:[],info:[]}}function pe(t,e){t.ok=!1,t.issues.push(e)}function Oe(t,e){t.warnings.push(e)}function te(t,e){t.info.push(e)}function hn(t){let e=Gt();try{let r=we.parse(t);te(e,"\u2705 Valid RCAN URI"),te(e,`   Registry:     ${r.registry}`),te(e,`   Manufacturer: ${r.manufacturer}`),te(e,`   Model:        ${r.model}`),te(e,`   Version:      ${r.version}`),te(e,`   Device ID:    ${r.deviceId}`)}catch(r){pe(e,`Invalid RCAN URI: ${r instanceof Error?r.message:r}`)}return e}function yn(t){let e=Gt(),r;if(typeof t=="string")try{r=JSON.parse(t)}catch{return pe(e,"Invalid JSON string"),e}else if(typeof t=="object"&&t!==null)r=t;else return pe(e,"Expected object or JSON string"),e;for(let n of["rcan","cmd","target"])(!(n in r)||!r[n])&&pe(e,`Missing required field: '${n}'`);if(!e.ok)return e;try{let n=E.fromJSON(r);te(e,`\u2705 RCAN message valid (v${n.rcan})`),te(e,`   cmd:    ${n.cmd}`),te(e,`   target: ${n.target}`),n.confidence!==void 0?te(e,`   confidence: ${n.confidence}`):Oe(e,"No confidence score \u2014 add for RCAN \xA716 AI accountability"),n.isSigned?te(e,`   signature: alg=${n.signature?.alg}, kid=${n.signature?.kid}`):Oe(e,"Message is unsigned (recommended for production)")}catch(n){pe(e,`Message validation failed: ${n instanceof Error?n.message:n}`)}return e}function Rn(t){let e=Gt(),r=t.metadata??{},n=t.agent??{},o=t.rcan_protocol??{};for(let i of["rcan_version","metadata","agent"])(!(i in t)||t[i]===void 0||t[i]===null)&&pe(e,`Missing required key: '${i}'`);let s=t.rcan_version;if(s&&(/^\d+\.\d+$/.test(s)||pe(e,`rcan_version '${s}' must match pattern N.N (e.g. '1.2')`)),r.manufacturer||pe(e,"L1: metadata.manufacturer is required (\xA72)"),r.model||pe(e,"L1: metadata.model is required (\xA72)"),!r.device_id&&!r.robot_name&&pe(e,"L1: metadata.device_id (or robot_name) is required (\xA72)"),o.jwt_auth?.enabled||Oe(e,"L2: jwt_auth not enabled (required for L2 conformance, \xA78)"),(!n.confidence_gates||n.confidence_gates.length===0)&&Oe(e,"L2: confidence_gates not configured (\xA716)"),(!n.hitl_gates||n.hitl_gates.length===0)&&Oe(e,"L3: hitl_gates not configured (\xA716)"),n.commitment_chain?.enabled||Oe(e,"L3: commitment_chain not enabled (\xA716)"),r.rrn?te(e,`\u2705 RRN registered: ${r.rrn}`):Oe(e,"Robot not registered \u2014 visit rcan.dev/registry/register"),e.ok&&e.issues.length===0){let i=!e.warnings.some(g=>g.startsWith("L1")),a=i&&!e.warnings.some(g=>g.startsWith("L2")),p=a&&!e.warnings.some(g=>g.startsWith("L3"))?"L3":a?"L2":i?"L1":"FAIL";te(e,`\u2705 Config valid \u2014 conformance level: ${p}`)}return e}d();var Q=class extends Error{constructor(e){super(e),this.name="RCANError",Object.setPrototypeOf(this,new.target.prototype)}},ut=class extends Q{constructor(e){super(e),this.name="RCANAddressError",Object.setPrototypeOf(this,new.target.prototype)}},dt=class extends Q{constructor(e){super(e),this.name="RCANValidationError",Object.setPrototypeOf(this,new.target.prototype)}},ft=class extends Q{constructor(r,n,o,s){super(r);this.gateType=n;this.value=o;this.threshold=s;this.name="RCANGateError",Object.setPrototypeOf(this,new.target.prototype)}},lt=class extends Q{constructor(e){super(e),this.name="RCANSignatureError",Object.setPrototypeOf(this,new.target.prototype)}},ve=class extends Q{constructor(e){super(e),this.name="RCANRegistryError",Object.setPrototypeOf(this,new.target.prototype)}},Ne=class t extends Q{constructor(r,n){super(r);this.nodeUrl=n;this.name="RCANNodeError",Object.setPrototypeOf(this,t.prototype)}},_e=class t extends Ne{constructor(r,n){super(`RRN not found in federation: ${r}`,n);this.rrn=r;this.name="RCANNodeNotFoundError",Object.setPrototypeOf(this,t.prototype)}},Y=class t extends Ne{constructor(r,n,o){super(r,n);this.cause=o;this.name="RCANNodeSyncError",Object.setPrototypeOf(this,t.prototype)}},Be=class t extends Ne{reason;constructor(e,r){super(`Node trust verification failed: ${e}`,r),this.name="RCANNodeTrustError",this.reason=e,Object.setPrototypeOf(this,t.prototype)}},pt=class t extends Q{constructor(e,r){super(`VERSION_INCOMPATIBLE: incoming=${e}, local=${r}`),this.name="RCANVersionIncompatibleError",Object.setPrototypeOf(this,t.prototype)}},gt=class t extends Q{constructor(e){super(`REPLAY_DETECTED: ${e}`),this.name="RCANReplayAttackError",Object.setPrototypeOf(this,t.prototype)}},mt=class t extends Q{constructor(e){super(`DELEGATION_CHAIN_ERROR: ${e}`),this.name="RCANDelegationChainError",Object.setPrototypeOf(this,t.prototype)}},ht=class t extends Q{constructor(e){super(`CONFIG_AUTH_ERROR: ${e}`),this.name="RCANConfigAuthorizationError",Object.setPrototypeOf(this,t.prototype)}};d();var Ts="https://rcan-spec.pages.dev",yt=class{baseUrl;apiKey;timeout;constructor(e){this.baseUrl=(e?.baseUrl??Ts).replace(/\/$/,""),this.apiKey=e?.apiKey,this.timeout=e?.timeout??1e4}async _fetch(e,r={}){let n=`${this.baseUrl}${e}`,o=new AbortController,s=setTimeout(()=>o.abort(),this.timeout);try{return await fetch(n,{...r,signal:o.signal,headers:{"Content-Type":"application/json",...r.headers??{}}})}finally{clearTimeout(s)}}_authHeaders(){if(!this.apiKey)throw new ve("API key required for write operations. Pass apiKey to RegistryClient.");return{Authorization:`Bearer ${this.apiKey}`}}async _checkResponse(e){if(!e.ok){let r=`Registry API error: ${e.status}`;try{let n=await e.json();n?.error&&(r=n.error)}catch{}throw new ve(r)}return await e.json()}async register(e){let r=await this._fetch("/api/v1/robots",{method:"POST",body:JSON.stringify(e)});return this._checkResponse(r)}async get(e){let r=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`);return this._checkResponse(r)}async list(e){let r=new URLSearchParams;e?.limit!==void 0&&r.set("limit",String(e.limit)),e?.offset!==void 0&&r.set("offset",String(e.offset)),e?.tier&&r.set("tier",e.tier);let n=r.toString()?`?${r}`:"",o=await this._fetch(`/api/v1/robots${n}`);return this._checkResponse(o)}async patch(e,r){let n=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`,{method:"PATCH",headers:this._authHeaders(),body:JSON.stringify(r)});return this._checkResponse(n)}async delete(e){let r=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`,{method:"DELETE",headers:this._authHeaders()});r.ok||await this._checkResponse(r)}async search(e){let r=new URLSearchParams;e.q&&r.set("q",e.q),e.manufacturer&&r.set("manufacturer",e.manufacturer),e.model&&r.set("model",e.model),e.tier&&r.set("tier",e.tier);let n=r.toString()?`?${r}`:"",o=await this._fetch(`/api/v1/robots/search${n}`);if(!o.ok){let i=await this._fetch(`/api/v1/robots${n}`),a=await this._checkResponse(i);return"robots"in a?a.robots:"results"in a&&a.results?a.results:[]}let s=await o.json();return Array.isArray(s)?s:"results"in s&&s.results?s.results:"robots"in s?s.robots:[]}};d();var ks="https://rcan.dev",Os="/.well-known/rcan-node.json",vs=new Set(["root","authoritative","resolver","cache"]);function Ns(t){let e=t.match(/^RRN-([A-Z0-9]{2,8})-(\d{8,16})$/);if(e)return{type:"delegated",prefix:e[1],serial:e[2]};let r=t.match(/^RRN-(\d{8,16})$/);return r?{type:"root",serial:r[1]}:null}var Rt=class{rootUrl;timeoutMs;constructor(e=ks,r=1e4){this.rootUrl=e.replace(/\/$/,""),this.timeoutMs=r}async _fetch(e){let r=new AbortController,n=setTimeout(()=>r.abort(),this.timeoutMs);try{return await globalThis.fetch(e,{signal:r.signal})}catch(o){throw o instanceof Error&&o.name==="AbortError"?new Y(`Request timed out: ${e}`,e,o):new Y(`Network error fetching ${e}: ${o.message}`,e,o instanceof Error?o:void 0)}finally{clearTimeout(n)}}async getNodeManifest(e){let r=`${e.replace(/\/$/,"")}${Os}`,n=await this._fetch(r);if(!n.ok)throw n.status===404?new _e(r,e):new Y(`Failed to fetch node manifest from ${e}: HTTP ${n.status}`,e);let o;try{o=await n.json()}catch(s){throw new Y(`Invalid JSON in node manifest from ${e}`,e,s instanceof Error?s:void 0)}if(!this.verifyNode(o))throw new Be("missing_pubkey",e);return o}async listNodes(e){let r=e?`?prefix=${encodeURIComponent(e)}`:"",n=`${this.rootUrl}/api/v1/nodes${r}`,o=await this._fetch(n);if(!o.ok)throw new Y(`Failed to list nodes from ${n}: HTTP ${o.status}`,n);let s;try{s=await o.json()}catch(i){throw new Y(`Invalid JSON in nodes list from ${n}`,n,i instanceof Error?i:void 0)}return Array.isArray(s)?s:s&&typeof s=="object"&&"nodes"in s?s.nodes:[]}async discover(e){let r=Ns(e);if(!r)throw new _e(e,this.rootUrl);if(r.type==="root")return this.getNodeManifest(this.rootUrl);let n=await this.listNodes(r.prefix);if(n.length===0)throw new _e(e,this.rootUrl);return n[0]}async resolve(e){let r=`${this.rootUrl}/api/v1/resolve/${encodeURIComponent(e)}`,n;try{n=await this._fetch(r)}catch(a){throw a}if(n.ok)try{return await n.json()}catch(a){throw new Y(`Invalid JSON in resolve response for ${e}`,this.rootUrl,a instanceof Error?a:void 0)}if(n.status!==404)throw new Y(`Unexpected HTTP ${n.status} resolving ${e}`,this.rootUrl);let o=await this.discover(e),s=`${o.api_base.replace(/\/$/,"")}/robots/${encodeURIComponent(e)}`,i=await this._fetch(s);if(!i.ok)throw i.status===404?new _e(e,o.api_base):new Y(`HTTP ${i.status} from authoritative node for ${e}`,o.api_base);try{return await i.json()}catch(a){throw new Y(`Invalid JSON in fallback resolve response for ${e}`,o.api_base,a instanceof Error?a:void 0)}}verifyNode(e){if(!e||typeof e!="object")return!1;let r=e;return!(typeof r.rcan_node_version!="string"||!r.rcan_node_version||typeof r.node_type!="string"||!vs.has(r.node_type)||typeof r.operator!="string"||!r.operator||typeof r.namespace_prefix!="string"||!r.namespace_prefix||typeof r.public_key!="string"||!r.public_key.startsWith("ed25519:")||typeof r.api_base!="string"||!r.api_base.startsWith("https://"))}};d();var Is="https://rcan.dev/schemas",Jt=new Map;async function _t(t){if(Jt.has(t))return Jt.get(t);try{let e=new AbortController,r=setTimeout(()=>e.abort(),5e3);r.unref?.();let n=await fetch(`${Is}/${t}`,{signal:e.signal});if(clearTimeout(r),!n.ok)return null;let o=await n.json();return Jt.set(t,o),o}catch{return null}}async function _n(t){let e=await _t("rcan-config.schema.json");if(!e)return{valid:!0,skipped:!0};let r=[];if(typeof t!="object"||t===null)return{valid:!1,errors:["Config must be an object"]};let n=t,o=e.required??[];for(let s of o)s in n||r.push(`Missing required field: ${s}`);return r.length===0?{valid:!0}:{valid:!1,errors:r}}async function xn(t){let e=await _t("rcan-node.schema.json");if(!e)return{valid:!0,skipped:!0};let r=[];if(typeof t!="object"||t===null)return{valid:!1,errors:["Manifest must be an object"]};let n=t,o=e.required??[];for(let s of o)s in n||r.push(`Missing required field: ${s}`);return r.length===0?{valid:!0}:{valid:!1,errors:r}}d();d();var Yt=(n=>(n[n.FIRE_AND_FORGET=0]="FIRE_AND_FORGET",n[n.ACKNOWLEDGED=1]="ACKNOWLEDGED",n[n.EXACTLY_ONCE=2]="EXACTLY_ONCE",n))(Yt||{}),xt=class t extends Error{constructor(e){super(`ACK timeout for message ${e} \u2014 safety halt required`),this.name="QoSAckTimeoutError",Object.setPrototypeOf(this,t.prototype)}},bt=class{_send;_waitForAck;constructor(e,r){this._send=e,this._waitForAck=r}async sendWithQoS(e,r={}){let n=r.qos??0,o=r.maxRetries??3,s=r.initialBackoffMs??100,i=r.ackTimeoutMs??500;if(n===0)return await this._send(e),{delivered:!0,attempts:1,reason:"fire-and-forget"};let a=e.message_id??e.msg_id??"unknown",u=0,p=s;for(;u<=o;){if(await this._send(e),u++,await this._waitForAck(a,i))return{delivered:!0,attempts:u,reason:n===2?"exactly-once":"acknowledged"};if(u>o)break;await Us(p),p=Math.min(p*2,5e3)}return{delivered:!1,attempts:u,reason:`ACK not received after ${o} retries`}}};function bn(t,e){return{message_type:6,ruri:t,safety_event:"ESTOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:Ms(),qos:2}}function Ms(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function Us(t){return new Promise(e=>setTimeout(e,t))}var Wt=6;function wt(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function wn(t,e){return{message_type:6,ruri:t,safety_event:"ESTOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:wt(),qos:2}}function An(t,e){return{message_type:6,ruri:t,safety_event:"STOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:wt()}}function En(t,e){return{message_type:6,ruri:t,safety_event:"RESUME",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:wt()}}function Sn(t){return typeof t=="object"&&t!==null&&t.message_type===Wt}function Cn(t){let e=[];return t.message_type!==6&&e.push("message_type must be 6"),t.ruri||e.push("ruri is required"),["ESTOP","STOP","RESUME"].includes(t.safety_event??"")||e.push("safety_event must be ESTOP, STOP, or RESUME"),(!t.reason||t.reason.length===0)&&e.push("reason is required"),t.message_id||e.push("message_id is required"),(!t.timestamp_ms||t.timestamp_ms<=0)&&e.push("timestamp_ms must be positive"),e}function Tn(t,e,r){return{message_type:11,ruri:t,disclosure:e,timestamp_ms:Date.now(),message_id:wt(),delegation_chain:r}}d();var At=class{windowSeconds;maxSize;_seen;constructor(e=30,r=1e4){this.windowSeconds=e,this.maxSize=r,this._seen=new Map}checkAndRecord(e,r,n=!1){let o=Date.now();this._evict(o);let s=n?Math.min(this.windowSeconds,10):this.windowSeconds,i=Ps(r);if(i===null)return{allowed:!1,reason:`invalid timestamp format: ${r}`};let a=o-i,u=s*1e3;if(a>u)return{allowed:!1,reason:`message too old: age=${Math.round(a/1e3)}s > window=${s}s`};if(i>o+5e3)return{allowed:!1,reason:"message timestamp is in the future"};if(this._seen.has(e))return{allowed:!1,reason:`replay detected: msg_id ${e} already seen`};if(this._seen.size>=this.maxSize){let g=this._seen.keys().next().value;this._seen.delete(g)}let p=o+u;return this._seen.set(e,p),{allowed:!0,reason:"ok"}}_evict(e){for(let[r,n]of this._seen)n<=e&&this._seen.delete(r)}get size(){return this._seen.size}};function kn(t,e){let r=t,n=r.message_id??r.msg_id;if(!n)return{valid:!1,reason:"missing message_id / msg_id"};let o;if(typeof r.timestamp_ms=="number"?o=String(r.timestamp_ms/1e3):r.timestamp!==void 0&&(o=String(r.timestamp)),!o)return{valid:!1,reason:"missing timestamp"};let s=r.message_type===6||r.message_type===6,i=e.checkAndRecord(n,o,s);return{valid:i.allowed,reason:i.reason}}function Ps(t){if(t.includes("T")||t.includes("-")){let r=new Date(t);if(!isNaN(r.getTime()))return r.getTime()}let e=parseFloat(t);return isNaN(e)?null:e>1e12?e:e*1e3}d();var Ke=class t extends Error{offsetSeconds;constructor(e,r){super(`Clock drift too large: offset=${e.toFixed(3)}s > max=${r}s`),this.name="ClockDriftError",this.offsetSeconds=e,Object.setPrototypeOf(this,t.prototype)}};async function Qt(t){let e=t??"https://worldtimeapi.org/api/ip";try{let r=Date.now(),n=await fetch(e,{method:"HEAD",signal:AbortSignal.timeout(3e3)}),o=Date.now(),s=n.headers.get("Date")??n.headers.get("date");if(!s)return{synchronized:!0,offsetSeconds:0,source:"assumed (no Date header)"};let i=new Date(s).getTime();if(isNaN(i))return{synchronized:!0,offsetSeconds:0,source:"assumed (unparseable Date header)"};let u=((r+o)/2-i)/1e3;return{synchronized:Math.abs(u)<=5,offsetSeconds:u,source:e}}catch{return{synchronized:!0,offsetSeconds:0,source:"assumed (network unavailable)"}}}async function On(t=5){let e=await Qt();if(!e.synchronized||Math.abs(e.offsetSeconds)>t)throw new Ke(e.offsetSeconds,t)}d();async function Ls(t){let e=JSON.stringify(t,Object.keys(t).sort());if(typeof crypto<"u"&&crypto.subtle){let n=new TextEncoder().encode(e),o=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(o)).map(s=>s.toString(16).padStart(2,"0")).join("")}let r=2166136261;for(let n=0;n<e.length;n++)r^=e.charCodeAt(n),r=r*16777619>>>0;return r.toString(16).padStart(8,"0")}async function vn(t,e,r,n="rcan://local/config",o=!1){let s=await Ls(t);return new E({rcan:q,cmd:"CONFIG_UPDATE",target:n,params:{message_type:5,diff:t,rollback:r,scope:e,config_hash:s,safety_overrides:o}})}function Nn(t){let e=t.params;return!e.diff||typeof e.diff!="object"?{valid:!1,reason:"missing required field: params.diff"}:!e.config_hash||typeof e.config_hash!="string"?{valid:!1,reason:"missing required field: params.config_hash"}:"rollback"in e?e.safety_overrides===!0&&e.scope!=="creator"?{valid:!1,reason:"safety_overrides=true requires scope=creator (owner is insufficient)"}:{valid:!0,reason:"ok"}:{valid:!1,reason:"missing required field: params.rollback"}}d();function Ds(){return typeof crypto<"u"&&typeof crypto.randomUUID=="function"?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`}var Et=class{_keys=[];addKey(e){this._keys.push(e)}getJWKS(){return{keys:[...this._keys]}}findKey(e){return this._keys.find(r=>r.kid===e)}isKeyValid(e,r){let n=this.findKey(e);if(!n)return!1;let o=(r??Date.now())/1e3;return!(n.revoked_at!==void 0&&n.revoked_at<=o||n.exp!==void 0&&n.exp<o)}expireKey(e,r){let n=this.findKey(e);n&&(n.exp=r??Math.floor(Date.now()/1e3))}revokeKey(e){let r=this.findKey(e);r&&(r.revoked_at=Math.floor(Date.now()/1e3))}validKeys(e){return this._keys.filter(r=>this.isKeyValid(r.kid,e))}};function In(t,e,r=120,n="rcan://local/keys"){let o=Ds().slice(0,8);return new E({rcan:q,cmd:"KEY_ROTATION",target:n,params:{message_type:5,new_public_key:t,new_kid:o,old_kid:e,overlap_seconds:r,initiated_at:new Date().toISOString()},keyId:o})}d();function $s(){return typeof crypto<"u"&&typeof crypto.randomUUID=="function"?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`}function St(t){let e=t.requestId??$s();return new E({rcan:q,cmd:"CONSENT_REQUEST",target:t.targetRuri,params:{message_type:20,requester_ruri:t.requesterRuri,requester_owner:t.requesterOwner,target_ruri:t.targetRuri,requested_scopes:t.requestedScopes,duration_hours:t.durationHours,justification:t.justification,request_id:e,consent_type:t.consentType??"cross_robot",data_categories:t.dataCategories??[]}})}function Ct(t){let e=t.expiresAt??new Date(Date.now()+864e5).toISOString();return new E({rcan:q,cmd:"CONSENT_GRANT",target:"rcan://local/consent",params:{message_type:21,request_id:t.requestId,granted_scopes:t.grantedScopes??[],expires_at:e,reason:t.reason??"approved"}})}function Tt(t){return new E({rcan:q,cmd:"CONSENT_DENY",target:"rcan://local/consent",params:{message_type:22,request_id:t.requestId,reason:t.reason??"denied"}})}function Mn(t){let e=t.cmd,r=t.params,n=r.message_type;return e==="CONSENT_REQUEST"?n!==20?{valid:!1,reason:"message_type must be CONSENT_REQUEST (20)"}:r.requester_ruri?r.target_ruri?!r.requested_scopes||!Array.isArray(r.requested_scopes)||r.requested_scopes.length===0?{valid:!1,reason:"requested_scopes must be a non-empty array"}:r.request_id?r.justification?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing justification"}:{valid:!1,reason:"missing request_id"}:{valid:!1,reason:"missing target_ruri"}:{valid:!1,reason:"missing requester_ruri"}:e==="CONSENT_GRANT"?n!==21?{valid:!1,reason:"message_type must be CONSENT_GRANT (21)"}:r.request_id?r.expires_at?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing expires_at"}:{valid:!1,reason:"missing request_id"}:e==="CONSENT_DENY"?n!==22?{valid:!1,reason:"message_type must be CONSENT_DENY (22)"}:r.request_id?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing request_id"}:{valid:!1,reason:`unknown consent command: ${e}`}}d();var Bs=3600*1e3,Ve=class{_cache=new Map;get(e,r){let n=this._cache.get(e);if(!n)return;let o=r??Date.now();if(n.cachedUntil!==void 0&&n.cachedUntil<o){this._cache.delete(e);return}return n}set(e,r){let n=r??Date.now();this._cache.set(e.rrn,{...e,cachedUntil:n+Bs})}invalidate(e){this._cache.delete(e)}get size(){return this._cache.size}};async function Un(t,e,r){let n=r??new Ve,o=n.get(t);if(o)return o;let s=`${e.replace(/\/$/,"")}/api/v1/robots/${encodeURIComponent(t)}/revocation-status`;try{let i=await fetch(s,{signal:AbortSignal.timeout(5e3)});if(!i.ok){let p={rrn:t,status:"active",reason:`registry returned ${i.status}`};return n.set(p),p}let a=await i.json(),u={rrn:t,status:a.status??"active",revokedAt:a.revokedAt,reason:a.reason,authority:a.authority};return n.set(u),u}catch{return{rrn:t,status:"active",reason:"network unavailable"}}}function Pn(t,e){return new E({rcan:q,cmd:"ROBOT_REVOCATION",target:"rcan://broadcast/revocation",params:{message_type:19,rrn:t,reason:e,revoked_at:new Date().toISOString()}})}d();var zt=(s=>(s.VIDEO="video",s.AUDIO="audio",s.LOCATION="location",s.BIOMETRIC="biometric",s.TELEMETRY="telemetry",s))(zt||{});function Ln(t){return St({requesterRuri:t.requesterRuri,requesterOwner:t.requesterOwner,targetRuri:t.targetRuri,requestedScopes:["training_data"],durationHours:t.durationHours,justification:t.justification,requestId:t.requestId,consentType:"training_data",dataCategories:t.dataCategories})}function Dn(t){return Ct(t)}function $n(t){return Tt(t)}function Bn(t){if(t.params.message_type!==36)return{valid:!1,reason:"not a TRAINING_DATA message"};let e=t.params.consent_token;return!e||typeof e!="string"||e.trim()===""?{valid:!1,reason:"TRAINING_DATA message missing consent_token (\xA717)"}:{valid:!0,reason:"ok"}}d();var kt=class{crossOwnerGraceS;keyTtlS;_cachedKeys=[];constructor(e=3600,r=86400){this.crossOwnerGraceS=e,this.keyTtlS=r}canAcceptCommand(e,r,n,o=!0,s=!1,i,a){if(e&&e.message_type===6&&e.safety_event==="ESTOP")return{allowed:!0,reason:"ESTOP always accepted (Protocol 66)"};if(!r)return{allowed:!0,reason:"online mode"};if(!n)return{allowed:!1,reason:"offline mode: cross-network commands blocked"};if(!o)return{allowed:!1,reason:"offline mode: only owner-role commands accepted from local network"};if(s&&i!==void 0){let p=((a??Date.now())-i)/1e3;if(p>this.crossOwnerGraceS)return{allowed:!1,reason:`offline mode: cross-owner grace period expired (${Math.round(p)}s > ${this.crossOwnerGraceS}s)`}}return{allowed:!0,reason:"offline mode: owner command on local network accepted"}}cacheKey(e,r){let n=r??Date.now();this._cachedKeys=this._cachedKeys.filter(o=>o.kid!==e.kid),this._cachedKeys.push({...e,cachedAtMs:n,ttlSeconds:this.keyTtlS})}getCachedKey(e,r){let n=r??Date.now(),o=this._cachedKeys.find(i=>i.kid===e);if(!o)return;if((n-o.cachedAtMs)/1e3>o.ttlSeconds){this._cachedKeys=this._cachedKeys.filter(i=>i.kid!==e);return}return o}getManifestFields(e,r){if(e===void 0)return{offline_mode:!1,offline_since_s:0};let n=r??Date.now();return{offline_mode:!0,offline_since_s:Math.round((n-e)/1e3)}}};d();var Xt=(w=>(w.SENSOR_PROXIMITY_FAILURE="SENSOR_PROXIMITY_FAILURE",w.SENSOR_CAMERA_FAILURE="SENSOR_CAMERA_FAILURE",w.SENSOR_IMU_FAILURE="SENSOR_IMU_FAILURE",w.MOTOR_OVERCURRENT="MOTOR_OVERCURRENT",w.MOTOR_OVERTEMP="MOTOR_OVERTEMP",w.MOTOR_STALL="MOTOR_STALL",w.BATTERY_CRITICAL="BATTERY_CRITICAL",w.BATTERY_LOW="BATTERY_LOW",w.NETWORK_TIMEOUT="NETWORK_TIMEOUT",w.NETWORK_REGISTRY_UNREACHABLE="NETWORK_REGISTRY_UNREACHABLE",w.SAFETY_ESTOP_STUCK="SAFETY_ESTOP_STUCK",w.SAFETY_WATCHDOG_TIMEOUT="SAFETY_WATCHDOG_TIMEOUT",w.UNKNOWN="UNKNOWN",w))(Xt||{});function jn(t){return new E({rcan:q,cmd:"FAULT_REPORT",target:t.target??"rcan://local/fault",params:{message_type:26,fault_code:t.faultCode,severity:t.severity,subsystem:t.subsystem,affects_safety:t.affectsSafety,safe_to_continue:t.safeToContinue,description:t.description??"",reported_at:new Date().toISOString()}})}d();var Ae=(a=>(a[a.GUEST=1]="GUEST",a[a.OPERATOR=2]="OPERATOR",a[a.CONTRIBUTOR=3]="CONTRIBUTOR",a[a.ADMIN=4]="ADMIN",a[a.M2M_PEER=5]="M2M_PEER",a[a.CREATOR=6]="CREATOR",a[a.M2M_TRUSTED=7]="M2M_TRUSTED",a))(Ae||{}),qn=Ae,je={1:1,2:2,3:2.5,4:3,5:4,6:5,7:6},js=new Map(Object.entries(je).map(([t,e])=>[e,Number(t)]));function Ge(t){return js.get(t)}var Zt={status:1,discover:1,chat:1,observer:1,contribute:3,control:2,teleop:2,training:4,training_data:4,config:4,authority:4,admin:6,safety:6,estop:6,"fleet.trusted":7};var Hn={minRoleForDiscover:1,minRoleForStatus:1,minRoleForChat:1,minRoleForControl:1,minRoleForSafety:1},Fn={minRoleForDiscover:1,minRoleForStatus:1,minRoleForChat:1,minRoleForControl:2,minRoleForSafety:6};function Kn(t){try{let e=t.split(".");if(e.length<2)return null;let r=(e[1]??"").replace(/-/g,"+").replace(/_/g,"/"),n=r+"=".repeat((4-r.length%4)%4);return JSON.parse(atob(n))}catch{return null}}function er(t){let e=Kn(t);if(!e)return 1;let r=e.rcan_role;if(r!=null){let o=Ge(Number(r));if(o!==void 0)return o}let n=e.loa;if(n!=null){let o=Ge(Number(n));if(o!==void 0)return o}return 1}function Ot(t){return er(t)}function Vn(t){let e=Kn(t);if(!e)return{sub:"",role:1,jwtLevel:1,scopes:[]};let r=e.rcan_role,n=e.loa,o=r!==void 0?Number(r):n!==void 0?Number(n):1,s=Ge(o)??1,i=Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[];return{sub:String(e.sub??""),role:s,jwtLevel:je[s],registryUrl:e.registry_url,scopes:i,verifiedAt:e.verified_at,peerRrn:e.peer_rrn,fleetRrns:Array.isArray(e.fleet_rrns)?e.fleet_rrns:void 0}}function tr(t,e){let r=Zt[e.toLowerCase()];return r===void 0?t>=2?{ok:!0,reason:""}:{ok:!1,reason:`Unknown scope '${e}': applying OPERATOR minimum. Caller has ${Ae[t]}.`}:t>=r?{ok:!0,reason:""}:{ok:!1,reason:`Scope '${e}' requires ${Ae[r]} (JWT level ${je[r]}), but caller has ${Ae[t]} (JWT level ${je[t]})`}}function Gn(t,e){return tr(t,e)}d();var rr=(n=>(n.ROOT="root",n.AUTHORITATIVE="authoritative",n.COMMUNITY="community",n))(rr||{}),nr=(n=>(n.CONSENT="consent",n.REVOCATION="revocation",n.KEY="key",n))(nr||{}),qs=1440*60*1e3,vt=class{store=new Map;set(e){this.store.set(e.registryUrl,{identity:e,expiresAt:Date.now()+qs})}lookup(e){let r=this.store.get(e);if(r){if(Date.now()>r.expiresAt){this.store.delete(e);return}return r.identity}}async discoverViaDns(e){let r=`_rcan-registry.${e}`,n;try{n=await de("dns").promises.resolveTxt(r)}catch{return}for(let o of n){let s=o.join("");try{let i=JSON.parse(s);if(i.registryUrl&&i.tier&&i.publicKeyPem&&i.domain){let a={registryUrl:i.registryUrl,tier:i.tier,publicKeyPem:i.publicKeyPem,domain:i.domain,verifiedAt:new Date().toISOString()};return this.set(a),a}}catch{}}}async verifyRegistryJwt(e,r){let n=this.lookup(r);if(!n)throw new Error(`REGISTRY_UNKNOWN: ${r} is not in the trust cache`);let o;try{let i=(e.split(".")[1]??"").replace(/-/g,"+").replace(/_/g,"/"),a=i+"=".repeat((4-i.length%4)%4),u;typeof atob<"u"?u=atob(a):u=Buffer.from(a,"base64").toString("utf-8");let p=JSON.parse(u);o=typeof p.iss=="string"?p.iss:void 0}catch{throw new Error("REGISTRY_JWT_MALFORMED: cannot decode token payload")}if(o!==r)throw new Error(`REGISTRY_JWT_ISS_MISMATCH: expected iss=${r}, got iss=${o??"(none)"}`);return n}};function Hs(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=(t[6]??0)&15|64,t[8]=(t[8]??0)&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function Jn(t,e,r,n){return new E({rcan:"2.1.0",rcanVersion:"2.1.0",cmd:"federation_sync",target:e,params:{msg_type:23,msg_id:Hs(),source_registry:t,target_registry:e,sync_type:r,payload:n},timestamp:new Date().toISOString()})}async function Yn(t,e,r){let n=t.params?.msg_type;if(n===6||n===6||t.cmd==="estop"||t.cmd==="ESTOP")return{valid:!0,reason:"ESTOP always permitted (P66 invariant)"};let s=t.params?.source_registry??t.params?.from_registry;if(!s||s===e)return{valid:!0,reason:"local registry; no federation check needed"};if(!r.lookup(s))return{valid:!1,reason:`REGISTRY_UNKNOWN: ${s} is not in the local trust cache`};let a=1,u=t.params?.registry_jwt;return u?a=Ot(u):typeof t.loa=="number"&&(a=t.loa),a<2?{valid:!1,reason:`LOA_INSUFFICIENT: cross-registry commands require LoA>=2 (OPERATOR), got role=${a}`}:{valid:!0,reason:"cross-registry command accepted"}}d();var ie=class t extends Error{constructor(e){super(e),this.name="TransportError",Object.setPrototypeOf(this,t.prototype)}},ir=(o=>(o.HTTP="http",o.COMPACT="compact",o.MINIMAL="minimal",o.BLE="ble",o))(ir||{}),or={msg_type:"t",msg_id:"i",timestamp:"ts",from_rrn:"f",to_rrn:"to",scope:"s",payload:"p",signature:"sig"},Wn=Object.fromEntries(Object.entries(or).map(([t,e])=>[e,t]));function ar(t){let e=t.toJSON(),r={};for(let[s,i]of Object.entries(e)){let a=or[s];r[a??s]=i}if(r.p&&typeof r.p=="object"){let s=r.p,i={};for(let[a,u]of Object.entries(s)){let p=or[a];i[p??a]=u}r.p=i}let n=JSON.stringify(r);return new TextEncoder().encode(n)}function cr(t){let r=new TextDecoder().decode(t),n=JSON.parse(r),o={};for(let[s,i]of Object.entries(n)){let a=Wn[s];o[a??s]=i}if(o.payload&&typeof o.payload=="object"){let s=o.payload,i={};for(let[a,u]of Object.entries(s)){let p=Wn[a];i[p??a]=u}o.payload=i}return new E({rcan:o.rcan??"1.6",rcanVersion:o.rcanVersion,cmd:o.cmd,target:o.target,params:o.params??o.payload??{},timestamp:o.timestamp,confidence:o.confidence,signature:o.signature})}var Ye=32,sr=6;async function Qn(t){let e=new TextEncoder().encode(t),r=new ArrayBuffer(e.byteLength);new Uint8Array(r).set(e);let o=await(globalThis.crypto?.subtle??(await import("crypto")).webcrypto.subtle).digest("SHA-256",r);return new Uint8Array(o)}async function zn(t){let e=t.params?.msg_type??0;if(e!==sr)throw new ie(`encodeMinimal only supports SAFETY (type 6) messages; got type=${e}`);let r=t.params?.from_rrn??t.target??"",n=t.params?.to_rrn??t.target??"",o=await Qn(r),s=await Qn(n),i=(t.signature?.sig??"").replace(/[^A-Za-z0-9+/=]/g,""),a;try{if(typeof atob<"u"){let M=atob(i.slice(0,16));a=new Uint8Array(M.length);for(let S=0;S<M.length;S++)a[S]=M.charCodeAt(S)}else a=Buffer.from(i.slice(0,16),"base64")}catch{a=new Uint8Array(8)}let p=(t.timestamp?Math.floor(new Date(t.timestamp).getTime()/1e3):Math.floor(Date.now()/1e3))>>>0,g=new Uint8Array(Ye),v=new DataView(g.buffer);v.setUint16(0,sr,!1),g.set(o.subarray(0,8),2),g.set(s.subarray(0,8),10),v.setUint32(18,p,!1);let k=new Uint8Array(8);k.set(a.subarray(0,Math.min(8,a.length))),g.set(k,22);let w=0;for(let M=0;M<30;M++)w^=g[M]??0;if(v.setUint16(30,w&65535,!1),g.length!==Ye)throw new ie(`encodeMinimal assertion failed: expected ${Ye} bytes, got ${g.length}`);return g}function Xn(t){if(t.length!==Ye)throw new ie(`decodeMinimal: expected ${Ye} bytes, got ${t.length}`);let e=new DataView(t.buffer,t.byteOffset,t.byteLength),r=e.getUint16(0,!1),n=t.subarray(2,10),o=t.subarray(10,18),s=e.getUint32(18,!1),i=t.subarray(22,30),a=new Date(s*1e3).toISOString(),u=p=>Array.from(p).map(g=>g.toString(16).padStart(2,"0")).join("");return{params:{msg_type:r,from_hash:u(n),to_hash:u(o),timestamp_s:s,sig_truncated:u(i)},timestamp:a}}var Fs=251,Je=3;function Zn(t,e=Fs){let r=ar(t),n=e-Je;if(n<=0)throw new ie(`MTU ${e} is too small (need at least ${Je+1})`);let o=Math.ceil(r.length/n),s=[];for(let i=0;i<o;i++){let a=r.subarray(i*n,(i+1)*n),u=new Uint8Array(Je+a.length);u[0]=i,u[1]=o,u[2]=i===o-1?1:0,u.set(a,Je),s.push(u)}return s}function eo(t){if(t.length===0)throw new ie("decodeBleFrames: no frames provided");let e=[...t].sort((a,u)=>(a[0]??0)-(u[0]??0)),r=e[0]?.[1]??e.length;if(e.length!==r)throw new ie(`decodeBleFrames: expected ${r} frames, got ${e.length}`);let n=e.map(a=>a.subarray(Je)),o=n.reduce((a,u)=>a+u.length,0),s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.length;return cr(s)}function to(t,e){let n=(e.params?.msg_type??0)===sr,o=s=>t.includes(s);if(n){if(o("minimal"))return"minimal";if(o("ble"))return"ble";if(o("compact"))return"compact";if(o("http"))return"http"}else{if(o("http"))return"http";if(o("compact"))return"compact";if(o("ble"))return"ble"}throw new ie(`No suitable transport available from: [${t.join(", ")}]`)}d();var ur=(r=>(r.BASE64="base64",r.REF="ref",r))(ur||{});function We(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=(t[6]??0)&15|64,t[8]=(t[8]??0)&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}async function dr(t){let e=globalThis.crypto?.subtle??(await import("crypto")).webcrypto.subtle,r=new ArrayBuffer(t.byteLength);new Uint8Array(r).set(t);let n=await e.digest("SHA-256",r),o=new Uint8Array(n);return Array.from(o).map(s=>s.toString(16).padStart(2,"0")).join("")}function ro(t){if(typeof Buffer<"u")return Buffer.from(t).toString("base64");let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]??0);return btoa(e)}function fr(t,e){let r={...t.toJSON(),...e};return E.fromJSON(r)}async function lr(t,e,r){let n=await dr(e),o=ro(e),s={chunkId:We(),mimeType:r,encoding:"base64",hashSha256:n,dataB64:o,sizeBytes:e.length},i=t.mediaChunks??[];return fr(t,{mediaChunks:[...i,s]})}function no(t,e,r,n,o){let s={chunkId:We(),mimeType:r,encoding:"ref",hashSha256:n,refUrl:e,sizeBytes:o},i=t.mediaChunks??[];return fr(t,{mediaChunks:[...i,s]})}async function oo(t){let e=t.mediaChunks??[];if(e.length===0)return{valid:!0,reason:"no media chunks"};for(let r=0;r<e.length;r++){let n=e[r];if(!n.chunkId)return{valid:!1,reason:`chunk[${r}]: missing chunkId`};if(!n.mimeType)return{valid:!1,reason:`chunk[${r}]: missing mimeType`};if(!n.hashSha256)return{valid:!1,reason:`chunk[${r}]: missing hashSha256`};if(n.sizeBytes<0)return{valid:!1,reason:`chunk[${r}]: sizeBytes must be >= 0`};if(n.encoding==="base64"){if(!n.dataB64)return{valid:!1,reason:`chunk[${r}]: BASE64 encoding requires dataB64`};let o;try{if(typeof Buffer<"u")o=Buffer.from(n.dataB64,"base64");else{let i=atob(n.dataB64);o=new Uint8Array(i.length);for(let a=0;a<i.length;a++)o[a]=i.charCodeAt(a)}}catch{return{valid:!1,reason:`chunk[${r}]: failed to decode base64 data`}}let s=await dr(o);if(s!==n.hashSha256)return{valid:!1,reason:`chunk[${r}]: SHA-256 mismatch (expected ${n.hashSha256}, got ${s})`}}else if(n.encoding==="ref"){if(!n.refUrl)return{valid:!1,reason:`chunk[${r}]: REF encoding requires refUrl`}}else return{valid:!1,reason:`chunk[${r}]: unknown encoding '${n.encoding}'`}}return{valid:!0,reason:"ok"}}async function so(t){let e=new E({rcan:"1.6",rcanVersion:"1.6",cmd:"training_data",target:"rcan://training/data",params:{msg_type:36,msg_id:We()},timestamp:new Date().toISOString()});for(let r of t)e=await lr(e,r.data,r.mimeType);return e}async function io(t,e,r,n,o){let s=await dr(e),i=ro(e),a={chunkId:We(),mimeType:r,encoding:"base64",hashSha256:s,dataB64:i,sizeBytes:e.length},u={streamId:t,chunkIndex:n,isFinal:o,chunk:a},p=new E({rcan:"1.6",rcanVersion:"1.6",cmd:"stream_chunk",target:"rcan://streaming/chunk",params:{msg_type:29,msg_id:We(),stream_chunk:u},timestamp:new Date().toISOString()});return p=fr(p,{mediaChunks:[a]}),p}d();var pr=2.5,Ks=0;function Vs(){return`cr-${Date.now()}-${++Ks}`}function ao(t={}){return{type:33,request_id:t.request_id??Vs(),project_id:t.project_id??"",project_name:t.project_name??"",work_unit_id:t.work_unit_id??"",resource_type:t.resource_type??"cpu",estimated_duration_s:t.estimated_duration_s??0,priority:t.priority??0,payload:t.payload??{},timestamp:t.timestamp??Date.now()/1e3}}function co(t={}){let e={type:34,request_id:t.request_id??"",work_unit_id:t.work_unit_id??"",status:t.status??"completed",resource_type:t.resource_type??"cpu",duration_s:t.duration_s??0,compute_units:t.compute_units??0,result_payload:t.result_payload??{},timestamp:t.timestamp??Date.now()/1e3};return t.error_message!==void 0&&(e.error_message=t.error_message),e}function uo(t={}){return{type:35,request_id:t.request_id??"",work_unit_id:t.work_unit_id??"",reason:t.reason??"",timestamp:t.timestamp??Date.now()/1e3}}function fo(t,e="request"){return e==="request"||e==="result"?t>=pr:e==="cancel"?t>=2:!1}function lo(t){return t>=3}d();var gr=2,Gs=0;function Js(){return`run-${Date.now()}-${++Gs}`}function po(t={}){return{type:37,competition_id:t.competition_id??"",competition_format:t.competition_format??"sprint",hardware_tier:t.hardware_tier??"",model_id:t.model_id??"",robot_rrn:t.robot_rrn??"",entered_at:t.entered_at??Date.now()/1e3}}function go(t={}){let e=t.score??0;if(e<0||e>1)throw new Error(`score must be in [0.0, 1.0], got ${e}`);return{type:38,competition_id:t.competition_id??"",candidate_id:t.candidate_id??"",score:e,hardware_tier:t.hardware_tier??"",verified:t.verified??!1,submitted_at:t.submitted_at??Date.now()/1e3}}function mo(t={}){return{type:39,season_id:t.season_id??"",class_id:t.class_id??"",standings:t.standings??[],days_remaining:t.days_remaining??0,broadcast_at:t.broadcast_at??Date.now()/1e3}}function ho(t={}){let e=t.score??0;if(e<0||e>1)throw new Error(`score must be in [0.0, 1.0], got ${e}`);return{type:40,run_id:t.run_id??Js(),run_type:t.run_type??"personal",candidate_id:t.candidate_id??"",score:e,hardware_tier:t.hardware_tier??"",model_id:t.model_id??"",owner_uid:t.owner_uid??"",metrics:t.metrics??{success_rate:0,p66_rate:0,token_efficiency:0,latency_score:0},submitted_to_community:t.submitted_to_community??!1,created_at:t.created_at??Date.now()/1e3}}function yo(t){return t>=gr}d();var Ro="/.well-known/rcan-firmware-manifest.json";function _o(t){let e={rrn:t.rrn,firmware_version:t.firmwareVersion,build_hash:t.buildHash,components:t.components,signed_at:t.signedAt};return t.signature&&(e.signature=t.signature),e}function xo(t){return{rrn:t.rrn,firmwareVersion:t.firmware_version,buildHash:t.build_hash,components:t.components??[],signedAt:t.signed_at??"",signature:t.signature}}function bo(t){let e={build_hash:t.buildHash,components:t.components.map(r=>({hash:r.hash,name:r.name,version:r.version})),firmware_version:t.firmwareVersion,rrn:t.rrn,signed_at:t.signedAt};return JSON.stringify(e)}var Nt=class extends Error{constructor(e){super(e),this.name="FirmwareIntegrityError"}};function wo(t){let e=[];t.rrn||e.push("rrn is required"),t.firmwareVersion||e.push("firmwareVersion is required"),t.buildHash||e.push("buildHash is required"),t.buildHash.startsWith("sha256:")||e.push("buildHash must start with 'sha256:'"),t.signedAt||e.push("signedAt is required"),t.signature||e.push("signature is required (manifest must be signed)");for(let[r,n]of t.components.entries())n.name||e.push(`components[${r}].name is required`),n.version||e.push(`components[${r}].version is required`),n.hash.startsWith("sha256:")||e.push(`components[${r}].hash must start with 'sha256:'`);return e}d();function Ao(t){return{request_id:t.requestId,authority_id:t.authorityId,requested_data:t.requestedData,justification:t.justification,expires_at:t.expiresAt}}function Eo(t){return{requestId:t.request_id,authorityId:t.authority_id,requestedData:t.requested_data??[],justification:t.justification??"",expiresAt:t.expires_at??0}}function mr(t){let e=[];return t.requestId||e.push("requestId is required"),t.authorityId||e.push("authorityId is required"),(!t.requestedData||t.requestedData.length===0)&&e.push("requestedData must include at least one category"),t.justification||e.push("justification is required"),(!t.expiresAt||t.expiresAt<=0)&&e.push("expiresAt must be a positive Unix timestamp"),t.expiresAt<Date.now()/1e3&&e.push("expiresAt is in the past \u2014 request has expired"),e}function So(t){return Date.now()/1e3<t.expiresAt&&mr(t).length===0}var Co={NOT_RECOGNIZED:"AUTHORITY_NOT_RECOGNIZED",REQUEST_EXPIRED:"AUTHORITY_REQUEST_EXPIRED",INVALID_TOKEN:"AUTHORITY_INVALID_TOKEN",RATE_LIMITED:"AUTHORITY_RATE_LIMITED"};d();var hr="https://api.rrf.rcan.dev/v2/revocations",It="rrf.rcan.dev",yr=55e3;var z=class extends Error{constructor(e){super(e),this.name="M2MAuthError"}};function To(t){let e=t.split(".");if(e.length<2)throw new z("Invalid JWT structure");let r=(e[1]??"").replace(/-/g,"+").replace(/_/g,"/"),n=r+"=".repeat((4-r.length%4)%4);try{return JSON.parse(atob(n))}catch(o){throw new z(`JWT payload decode failed: ${String(o)}`)}}function ko(t){let e=To(t),r=Number(e.exp??0);if(r>0&&Date.now()/1e3>r)throw new z(`M2M_PEER token expired (sub=${String(e.sub)})`);let n=String(e.peer_rrn??"");if(!n)throw new z("M2M_PEER token missing peer_rrn claim");return{sub:String(e.sub??""),peerRrn:n,scopes:Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[],exp:r,iss:String(e.iss??"")}}function Rr(t){let e=To(t),r=String(e.iss??"");if(r!==It)throw new z(`M2M_TRUSTED issuer must be '${It}', got '${r}'`);let n=Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[];if(!n.includes("fleet.trusted"))throw new z("M2M_TRUSTED token missing required 'fleet.trusted' scope");let o=Number(e.exp??0);if(o>0&&Date.now()/1e3>o)throw new z(`M2M_TRUSTED token expired (sub=${String(e.sub)})`);let s=String(e.rrf_sig??"");if(!s)throw new z("M2M_TRUSTED token missing rrf_sig claim");let i=Array.isArray(e.fleet_rrns)?e.fleet_rrns:[];return{sub:String(e.sub??""),fleetRrns:i,scopes:n,exp:o,iss:r,rrfSig:s}}function _r(t,e){let r=Rr(t);if(!r.fleetRrns.includes(e))throw new z(`M2M_TRUSTED token does not authorize commanding '${e}'. Authorized fleet: [${r.fleetRrns.join(", ")}]`);return r}var Ee=null;async function xr(t=hr){let e=Date.now();if(Ee&&e-Ee.fetchedAt<yr)return Ee;try{let n=await(await fetch(t,{signal:AbortSignal.timeout?.(5e3)})).json();Ee={revokedOrchestrators:new Set(n.revoked_orchestrators??[]),revokedJtis:new Set(n.revoked_jtis??[]),fetchedAt:e}}catch{if(Ee)return Ee;Ee={revokedOrchestrators:new Set,revokedJtis:new Set,fetchedAt:e}}return Ee}async function br(t,e){let r=await xr();return!!(r.revokedOrchestrators.has(t.sub)||e&&r.revokedJtis.has(e))}async function Oo(t,e,r){let n=_r(t,e);if(!r?.skipRevocationCheck&&await br(n))throw new z(`M2M_TRUSTED orchestrator '${n.sub}' is on the RRF revocation list`);return n}d();function gi(t){let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function mi(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=atob(e),n=new Uint8Array(r.length);for(let o=0;o<r.length;o++)n[o]=r.charCodeAt(o);return n}async function Gr(t){if(typeof crypto<"u"&&crypto.subtle){let r=await crypto.subtle.digest("SHA-256",t.buffer);return Array.from(new Uint8Array(r)).map(n=>n.toString(16).padStart(2,"0")).join("").slice(0,8)}let{createHash:e}=de("crypto");return e("sha256").update(t).digest("hex").slice(0,8)}var qe;async function Jr(){if(qe)return qe;if(typeof de<"u")try{return qe=(Vr(),cn(Kr)),qe}catch{}try{return qe=await Promise.resolve().then(()=>(Vr(),Kr)),qe}catch{throw new Error("ML-DSA-65 signing requires @noble/post-quantum. Install with: npm install @noble/post-quantum")}}var Ht=class t{keyId;publicKey;secretKey;constructor(e){this.keyId=e.keyId,this.publicKey=e.publicKey,this.secretKey=e.secretKey}static async generate(){let r=(await Jr()).ml_dsa65.keygen(),n=await Gr(r.publicKey);return new t({publicKey:r.publicKey,secretKey:r.secretKey,keyId:n})}static async fromPublicKey(e){let r=await Gr(e);return new t({publicKey:e,keyId:r})}static async fromKeyMaterial(e,r){let n=await Gr(e);return new t({publicKey:e,secretKey:r,keyId:n})}get hasPrivateKey(){return this.secretKey!==void 0}async signBytes(e){if(!this.secretKey)throw new Error("Cannot sign: MLDSAKeyPair has no private key (verify-only)");return(await Jr()).ml_dsa65.sign(e,this.secretKey)}async verifyBytes(e,r){if(!(await Jr()).ml_dsa65.verify(r,e,this.publicKey))throw new Error("ML-DSA-65 signature verification failed")}toString(){return`MLDSAKeyPair(keyId=${this.keyId}, alg=ML-DSA-65, ${this.hasPrivateKey?"private+public":"public-only"})`}};function us(t){let e={rcan:t.rcan,msg_id:t.msgId??"",timestamp:t.timestamp,cmd:t.cmd,target:t.target,params:t.params};return new TextEncoder().encode(JSON.stringify(Object.fromEntries(Object.entries(e).sort())))}async function Yr(t,e){let r=us(t),n=await e.signBytes(r);return t.signature={alg:"ml-dsa-65",kid:e.keyId,sig:gi(n)},t}async function Wr(t,e){let r=t.signature;if(!r)throw new Error("Message is unsigned \u2014 signature field missing");if(r.alg!=="ml-dsa-65")throw new Error(`Unsupported signature algorithm: ${r.alg}. RCAN v2.2 requires ml-dsa-65 (Ed25519 is deprecated).`);let n=e.find(s=>s.keyId===r.kid);if(!n)throw new Error(`No trusted ML-DSA-65 key with kid=${r.kid}. Known kids: [${e.map(s=>s.keyId).join(", ")}]`);let o;try{o=mi(r.sig)}catch(s){throw new Error(`Invalid base64url sig: ${s}`)}await n.verifyBytes(us(t),o)}var ds=Yr;async function fs(t,e,r=!0){return Wr(t,e)}d();var hi={0:["discover","status","transparency"],1:["chat","control","system"],3:["system","safety"]},ls={robot_ping:0,robot_status:0,robot_telemetry:0,fleet_list:0,rrf_lookup:0,compliance_report:0,robot_command:1,harness_get:1,research_run:1,contribute_toggle:1,components_list:1,harness_set:3,system_upgrade:3,loa_enable:3};function yi(t,e){let r=ls[e]??99;return t.loa>=r}d();function gs(t){if(t.length>3)throw new Error(`RCAN: delegation chain max depth is 3, got ${t.length}`)}var ps;function ms(t){if(!t.data)return;let e;if(ps)e=ps(t.data);else try{let r=typeof de<"u"?de:null;if(!r)return;let{createHash:n}=r("node:crypto");e="sha256:"+n("sha256").update(t.data).digest("hex")}catch{return}if(e!==t.hash_sha256)throw new Error(`MediaChunk hash mismatch: expected ${t.hash_sha256}, got ${e}`)}var Ri="0.6.0",_i="1.6";return cn(xi);})();
+`).filter(s=>s.trim()!=="");for(let s of o){let i=JSON.parse(s);n._records.push(ht.fromJSON(i))}return n}};p();function Sn(){return{ok:!0,issues:[],warnings:[],info:[]}}function Te(t,e){t.ok=!1,t.issues.push(e)}function ot(t,e){t.warnings.push(e)}function ge(t,e){t.info.push(e)}function Hs(t){let e=Sn();try{let r=qe.parse(t);ge(e,"\u2705 Valid RCAN URI"),ge(e,`   Registry:     ${r.registry}`),ge(e,`   Manufacturer: ${r.manufacturer}`),ge(e,`   Model:        ${r.model}`),ge(e,`   Version:      ${r.version}`),ge(e,`   Device ID:    ${r.deviceId}`)}catch(r){Te(e,`Invalid RCAN URI: ${r instanceof Error?r.message:r}`)}return e}function $s(t){let e=Sn(),r;if(typeof t=="string")try{r=JSON.parse(t)}catch{return Te(e,"Invalid JSON string"),e}else if(typeof t=="object"&&t!==null)r=t;else return Te(e,"Expected object or JSON string"),e;for(let n of["rcan","cmd","target"])(!(n in r)||!r[n])&&Te(e,`Missing required field: '${n}'`);if(!e.ok)return e;try{let n=$.fromJSON(r);ge(e,`\u2705 RCAN message valid (v${n.rcan})`),ge(e,`   cmd:    ${n.cmd}`),ge(e,`   target: ${n.target}`),n.confidence!==void 0?ge(e,`   confidence: ${n.confidence}`):ot(e,"No confidence score \u2014 add for RCAN \xA716 AI accountability"),n.isSigned?ge(e,`   signature: alg=${n.signature?.alg}, kid=${n.signature?.kid}`):ot(e,"Message is unsigned (recommended for production)")}catch(n){Te(e,`Message validation failed: ${n instanceof Error?n.message:n}`)}return e}function js(t){let e=Sn(),r=t.metadata??{},n=t.agent??{},o=t.rcan_protocol??{};for(let i of["rcan_version","metadata","agent"])(!(i in t)||t[i]===void 0||t[i]===null)&&Te(e,`Missing required key: '${i}'`);let s=t.rcan_version;if(s&&(/^\d+\.\d+$/.test(s)||Te(e,`rcan_version '${s}' must match pattern N.N (e.g. '1.2')`)),r.manufacturer||Te(e,"L1: metadata.manufacturer is required (\xA72)"),r.model||Te(e,"L1: metadata.model is required (\xA72)"),!r.device_id&&!r.robot_name&&Te(e,"L1: metadata.device_id (or robot_name) is required (\xA72)"),o.jwt_auth?.enabled||ot(e,"L2: jwt_auth not enabled (required for L2 conformance, \xA78)"),(!n.confidence_gates||n.confidence_gates.length===0)&&ot(e,"L2: confidence_gates not configured (\xA716)"),(!n.hitl_gates||n.hitl_gates.length===0)&&ot(e,"L3: hitl_gates not configured (\xA716)"),n.commitment_chain?.enabled||ot(e,"L3: commitment_chain not enabled (\xA716)"),r.rrn?ge(e,`\u2705 RRN registered: ${r.rrn}`):ot(e,"Robot not registered \u2014 visit rcan.dev/registry/register"),e.ok&&e.issues.length===0){let i=!e.warnings.some(d=>d.startsWith("L1")),a=i&&!e.warnings.some(d=>d.startsWith("L2")),f=a&&!e.warnings.some(d=>d.startsWith("L3"))?"L3":a?"L2":i?"L1":"FAIL";ge(e,`\u2705 Config valid \u2014 conformance level: ${f}`)}return e}p();var ue=class extends Error{constructor(e){super(e),this.name="RCANError",Object.setPrototypeOf(this,new.target.prototype)}},gr=class extends ue{constructor(e){super(e),this.name="RCANAddressError",Object.setPrototypeOf(this,new.target.prototype)}},hr=class extends ue{constructor(e){super(e),this.name="RCANValidationError",Object.setPrototypeOf(this,new.target.prototype)}},mr=class extends ue{constructor(r,n,o,s){super(r);this.gateType=n;this.value=o;this.threshold=s;this.name="RCANGateError",Object.setPrototypeOf(this,new.target.prototype)}},yr=class extends ue{constructor(e){super(e),this.name="RCANSignatureError",Object.setPrototypeOf(this,new.target.prototype)}},st=class extends ue{constructor(e){super(e),this.name="RCANRegistryError",Object.setPrototypeOf(this,new.target.prototype)}},it=class t extends ue{constructor(r,n){super(r);this.nodeUrl=n;this.name="RCANNodeError",Object.setPrototypeOf(this,t.prototype)}},Be=class t extends it{constructor(r,n){super(`RRN not found in federation: ${r}`,n);this.rrn=r;this.name="RCANNodeNotFoundError",Object.setPrototypeOf(this,t.prototype)}},oe=class t extends it{constructor(r,n,o){super(r,n);this.cause=o;this.name="RCANNodeSyncError",Object.setPrototypeOf(this,t.prototype)}},mt=class t extends it{reason;constructor(e,r){super(`Node trust verification failed: ${e}`,r),this.name="RCANNodeTrustError",this.reason=e,Object.setPrototypeOf(this,t.prototype)}},xr=class t extends ue{constructor(e,r){super(`VERSION_INCOMPATIBLE: incoming=${e}, local=${r}`),this.name="RCANVersionIncompatibleError",Object.setPrototypeOf(this,t.prototype)}},br=class t extends ue{constructor(e){super(`REPLAY_DETECTED: ${e}`),this.name="RCANReplayAttackError",Object.setPrototypeOf(this,t.prototype)}},Rr=class t extends ue{constructor(e){super(`DELEGATION_CHAIN_ERROR: ${e}`),this.name="RCANDelegationChainError",Object.setPrototypeOf(this,t.prototype)}},_r=class t extends ue{constructor(e){super(`CONFIG_AUTH_ERROR: ${e}`),this.name="RCANConfigAuthorizationError",Object.setPrototypeOf(this,t.prototype)}};p();var sc="https://rcan-spec.pages.dev",wr=class{baseUrl;apiKey;timeout;constructor(e){this.baseUrl=(e?.baseUrl??sc).replace(/\/$/,""),this.apiKey=e?.apiKey,this.timeout=e?.timeout??1e4}async _fetch(e,r={}){let n=`${this.baseUrl}${e}`,o=new AbortController,s=setTimeout(()=>o.abort(),this.timeout);try{return await fetch(n,{...r,signal:o.signal,headers:{"Content-Type":"application/json",...r.headers??{}}})}finally{clearTimeout(s)}}_authHeaders(){if(!this.apiKey)throw new st("API key required for write operations. Pass apiKey to RegistryClient.");return{Authorization:`Bearer ${this.apiKey}`}}async _checkResponse(e){if(!e.ok){let r=`Registry API error: ${e.status}`;try{let n=await e.json();n?.error&&(r=n.error)}catch{}throw new st(r)}return await e.json()}async register(e){let r=await this._fetch("/api/v1/robots",{method:"POST",body:JSON.stringify(e)});return this._checkResponse(r)}async get(e){let r=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`);return this._checkResponse(r)}async list(e){let r=new URLSearchParams;e?.limit!==void 0&&r.set("limit",String(e.limit)),e?.offset!==void 0&&r.set("offset",String(e.offset)),e?.tier&&r.set("tier",e.tier);let n=r.toString()?`?${r}`:"",o=await this._fetch(`/api/v1/robots${n}`);return this._checkResponse(o)}async patch(e,r){let n=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`,{method:"PATCH",headers:this._authHeaders(),body:JSON.stringify(r)});return this._checkResponse(n)}async delete(e){let r=await this._fetch(`/api/v1/robots/${encodeURIComponent(e)}`,{method:"DELETE",headers:this._authHeaders()});r.ok||await this._checkResponse(r)}async search(e){let r=new URLSearchParams;e.q&&r.set("q",e.q),e.manufacturer&&r.set("manufacturer",e.manufacturer),e.model&&r.set("model",e.model),e.tier&&r.set("tier",e.tier);let n=r.toString()?`?${r}`:"",o=await this._fetch(`/api/v1/robots/search${n}`);if(!o.ok){let i=await this._fetch(`/api/v1/robots${n}`),a=await this._checkResponse(i);return"robots"in a?a.robots:"results"in a&&a.results?a.results:[]}let s=await o.json();return Array.isArray(s)?s:"results"in s&&s.results?s.results:"robots"in s?s.robots:[]}};p();var ic="https://rcan.dev",ac="/.well-known/rcan-node.json",cc=new Set(["root","authoritative","resolver","cache"]);function uc(t){let e=t.match(/^RRN-([A-Z0-9]{2,8})-(\d{8,16})$/);if(e)return{type:"delegated",prefix:e[1],serial:e[2]};let r=t.match(/^RRN-(\d{8,16})$/);return r?{type:"root",serial:r[1]}:null}var Er=class{rootUrl;timeoutMs;constructor(e=ic,r=1e4){this.rootUrl=e.replace(/\/$/,""),this.timeoutMs=r}async _fetch(e){let r=new AbortController,n=setTimeout(()=>r.abort(),this.timeoutMs);try{return await globalThis.fetch(e,{signal:r.signal})}catch(o){throw o instanceof Error&&o.name==="AbortError"?new oe(`Request timed out: ${e}`,e,o):new oe(`Network error fetching ${e}: ${o.message}`,e,o instanceof Error?o:void 0)}finally{clearTimeout(n)}}async getNodeManifest(e){let r=`${e.replace(/\/$/,"")}${ac}`,n=await this._fetch(r);if(!n.ok)throw n.status===404?new Be(r,e):new oe(`Failed to fetch node manifest from ${e}: HTTP ${n.status}`,e);let o;try{o=await n.json()}catch(s){throw new oe(`Invalid JSON in node manifest from ${e}`,e,s instanceof Error?s:void 0)}if(!this.verifyNode(o))throw new mt("missing_pubkey",e);return o}async listNodes(e){let r=e?`?prefix=${encodeURIComponent(e)}`:"",n=`${this.rootUrl}/api/v1/nodes${r}`,o=await this._fetch(n);if(!o.ok)throw new oe(`Failed to list nodes from ${n}: HTTP ${o.status}`,n);let s;try{s=await o.json()}catch(i){throw new oe(`Invalid JSON in nodes list from ${n}`,n,i instanceof Error?i:void 0)}return Array.isArray(s)?s:s&&typeof s=="object"&&"nodes"in s?s.nodes:[]}async discover(e){let r=uc(e);if(!r)throw new Be(e,this.rootUrl);if(r.type==="root")return this.getNodeManifest(this.rootUrl);let n=await this.listNodes(r.prefix);if(n.length===0)throw new Be(e,this.rootUrl);return n[0]}async resolve(e){let r=`${this.rootUrl}/api/v1/resolve/${encodeURIComponent(e)}`,n;try{n=await this._fetch(r)}catch(a){throw a}if(n.ok)try{return await n.json()}catch(a){throw new oe(`Invalid JSON in resolve response for ${e}`,this.rootUrl,a instanceof Error?a:void 0)}if(n.status!==404)throw new oe(`Unexpected HTTP ${n.status} resolving ${e}`,this.rootUrl);let o=await this.discover(e),s=`${o.api_base.replace(/\/$/,"")}/robots/${encodeURIComponent(e)}`,i=await this._fetch(s);if(!i.ok)throw i.status===404?new Be(e,o.api_base):new oe(`HTTP ${i.status} from authoritative node for ${e}`,o.api_base);try{return await i.json()}catch(a){throw new oe(`Invalid JSON in fallback resolve response for ${e}`,o.api_base,a instanceof Error?a:void 0)}}verifyNode(e){if(!e||typeof e!="object")return!1;let r=e;return!(typeof r.rcan_node_version!="string"||!r.rcan_node_version||typeof r.node_type!="string"||!cc.has(r.node_type)||typeof r.operator!="string"||!r.operator||typeof r.namespace_prefix!="string"||!r.namespace_prefix||typeof r.public_key!="string"||!r.public_key.startsWith("ed25519:")||typeof r.api_base!="string"||!r.api_base.startsWith("https://"))}};p();var fc="https://rcan.dev/schemas",Cn=new Map;async function Ar(t){if(Cn.has(t))return Cn.get(t);try{let e=new AbortController,r=setTimeout(()=>e.abort(),5e3);r.unref?.();let n=await fetch(`${fc}/${t}`,{signal:e.signal});if(clearTimeout(r),!n.ok)return null;let o=await n.json();return Cn.set(t,o),o}catch{return null}}async function Fs(t){let e=await Ar("rcan-config.schema.json");if(!e)return{valid:!0,skipped:!0};let r=[];if(typeof t!="object"||t===null)return{valid:!1,errors:["Config must be an object"]};let n=t,o=e.required??[];for(let s of o)s in n||r.push(`Missing required field: ${s}`);return r.length===0?{valid:!0}:{valid:!1,errors:r}}async function Ks(t){let e=await Ar("rcan-node.schema.json");if(!e)return{valid:!0,skipped:!0};let r=[];if(typeof t!="object"||t===null)return{valid:!1,errors:["Manifest must be an object"]};let n=t,o=e.required??[];for(let s of o)s in n||r.push(`Missing required field: ${s}`);return r.length===0?{valid:!0}:{valid:!1,errors:r}}p();p();var vn=(n=>(n[n.FIRE_AND_FORGET=0]="FIRE_AND_FORGET",n[n.ACKNOWLEDGED=1]="ACKNOWLEDGED",n[n.EXACTLY_ONCE=2]="EXACTLY_ONCE",n))(vn||{}),Sr=class t extends Error{constructor(e){super(`ACK timeout for message ${e} \u2014 safety halt required`),this.name="QoSAckTimeoutError",Object.setPrototypeOf(this,t.prototype)}},Cr=class{_send;_waitForAck;constructor(e,r){this._send=e,this._waitForAck=r}async sendWithQoS(e,r={}){let n=r.qos??0,o=r.maxRetries??3,s=r.initialBackoffMs??100,i=r.ackTimeoutMs??500;if(n===0)return await this._send(e),{delivered:!0,attempts:1,reason:"fire-and-forget"};let a=e.message_id??e.msg_id??"unknown",c=0,f=s;for(;c<=o;){if(await this._send(e),c++,await this._waitForAck(a,i))return{delivered:!0,attempts:c,reason:n===2?"exactly-once":"acknowledged"};if(c>o)break;await lc(f),f=Math.min(f*2,5e3)}return{delivered:!1,attempts:c,reason:`ACK not received after ${o} retries`}}};function Vs(t,e){return{message_type:6,ruri:t,safety_event:"ESTOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:dc(),qos:2}}function dc(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function lc(t){return new Promise(e=>setTimeout(e,t))}var Tn=6;function vr(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function Gs(t,e){return{message_type:6,ruri:t,safety_event:"ESTOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:vr(),qos:2}}function Ys(t,e){return{message_type:6,ruri:t,safety_event:"STOP",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:vr()}}function Ws(t,e){return{message_type:6,ruri:t,safety_event:"RESUME",reason:e.slice(0,512),timestamp_ms:Date.now(),message_id:vr()}}function Js(t){return typeof t=="object"&&t!==null&&t.message_type===Tn}function Zs(t){let e=[];return t.message_type!==6&&e.push("message_type must be 6"),t.ruri||e.push("ruri is required"),["ESTOP","STOP","RESUME"].includes(t.safety_event??"")||e.push("safety_event must be ESTOP, STOP, or RESUME"),(!t.reason||t.reason.length===0)&&e.push("reason is required"),t.message_id||e.push("message_id is required"),(!t.timestamp_ms||t.timestamp_ms<=0)&&e.push("timestamp_ms must be positive"),e}function Xs(t,e,r){return{message_type:11,ruri:t,disclosure:e,timestamp_ms:Date.now(),message_id:vr(),delegation_chain:r}}p();var Tr=class{windowSeconds;maxSize;_seen;constructor(e=30,r=1e4){this.windowSeconds=e,this.maxSize=r,this._seen=new Map}checkAndRecord(e,r,n=!1){let o=Date.now();this._evict(o);let s=n?Math.min(this.windowSeconds,10):this.windowSeconds,i=pc(r);if(i===null)return{allowed:!1,reason:`invalid timestamp format: ${r}`};let a=o-i,c=s*1e3;if(a>c)return{allowed:!1,reason:`message too old: age=${Math.round(a/1e3)}s > window=${s}s`};if(i>o+5e3)return{allowed:!1,reason:"message timestamp is in the future"};if(this._seen.has(e))return{allowed:!1,reason:`replay detected: msg_id ${e} already seen`};if(this._seen.size>=this.maxSize){let d=this._seen.keys().next().value;this._seen.delete(d)}let f=o+c;return this._seen.set(e,f),{allowed:!0,reason:"ok"}}_evict(e){for(let[r,n]of this._seen)n<=e&&this._seen.delete(r)}get size(){return this._seen.size}};function zs(t,e){let r=t,n=r.message_id??r.msg_id;if(!n)return{valid:!1,reason:"missing message_id / msg_id"};let o;if(typeof r.timestamp_ms=="number"?o=String(r.timestamp_ms/1e3):r.timestamp!==void 0&&(o=String(r.timestamp)),!o)return{valid:!1,reason:"missing timestamp"};let s=r.message_type===6||r.message_type===6,i=e.checkAndRecord(n,o,s);return{valid:i.allowed,reason:i.reason}}function pc(t){if(t.includes("T")||t.includes("-")){let r=new Date(t);if(!isNaN(r.getTime()))return r.getTime()}let e=parseFloat(t);return isNaN(e)?null:e>1e12?e:e*1e3}p();var Mt=class t extends Error{offsetSeconds;constructor(e,r){super(`Clock drift too large: offset=${e.toFixed(3)}s > max=${r}s`),this.name="ClockDriftError",this.offsetSeconds=e,Object.setPrototypeOf(this,t.prototype)}};async function On(t){let e=t??"https://worldtimeapi.org/api/ip";try{let r=Date.now(),n=await fetch(e,{method:"HEAD",signal:AbortSignal.timeout(3e3)}),o=Date.now(),s=n.headers.get("Date")??n.headers.get("date");if(!s)return{synchronized:!0,offsetSeconds:0,source:"assumed (no Date header)"};let i=new Date(s).getTime();if(isNaN(i))return{synchronized:!0,offsetSeconds:0,source:"assumed (unparseable Date header)"};let c=((r+o)/2-i)/1e3;return{synchronized:Math.abs(c)<=5,offsetSeconds:c,source:e}}catch{return{synchronized:!0,offsetSeconds:0,source:"assumed (network unavailable)"}}}async function Qs(t=5){let e=await On();if(!e.synchronized||Math.abs(e.offsetSeconds)>t)throw new Mt(e.offsetSeconds,t)}p();async function gc(t){let e=JSON.stringify(t,Object.keys(t).sort());if(typeof crypto<"u"&&crypto.subtle){let n=new TextEncoder().encode(e),o=await crypto.subtle.digest("SHA-256",n);return Array.from(new Uint8Array(o)).map(s=>s.toString(16).padStart(2,"0")).join("")}let r=2166136261;for(let n=0;n<e.length;n++)r^=e.charCodeAt(n),r=r*16777619>>>0;return r.toString(16).padStart(8,"0")}async function ei(t,e,r,n="rcan://local/config",o=!1){let s=await gc(t);return new $({rcan:J,cmd:"CONFIG_UPDATE",target:n,params:{message_type:5,diff:t,rollback:r,scope:e,config_hash:s,safety_overrides:o}})}function ti(t){let e=t.params;return!e.diff||typeof e.diff!="object"?{valid:!1,reason:"missing required field: params.diff"}:!e.config_hash||typeof e.config_hash!="string"?{valid:!1,reason:"missing required field: params.config_hash"}:"rollback"in e?e.safety_overrides===!0&&e.scope!=="creator"?{valid:!1,reason:"safety_overrides=true requires scope=creator (owner is insufficient)"}:{valid:!0,reason:"ok"}:{valid:!1,reason:"missing required field: params.rollback"}}p();function hc(){return typeof crypto<"u"&&typeof crypto.randomUUID=="function"?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`}var Or=class{_keys=[];addKey(e){this._keys.push(e)}getJWKS(){return{keys:[...this._keys]}}findKey(e){return this._keys.find(r=>r.kid===e)}isKeyValid(e,r){let n=this.findKey(e);if(!n)return!1;let o=(r??Date.now())/1e3;return!(n.revoked_at!==void 0&&n.revoked_at<=o||n.exp!==void 0&&n.exp<o)}expireKey(e,r){let n=this.findKey(e);n&&(n.exp=r??Math.floor(Date.now()/1e3))}revokeKey(e){let r=this.findKey(e);r&&(r.revoked_at=Math.floor(Date.now()/1e3))}validKeys(e){return this._keys.filter(r=>this.isKeyValid(r.kid,e))}};function ri(t,e,r=120,n="rcan://local/keys"){let o=hc().slice(0,8);return new $({rcan:J,cmd:"KEY_ROTATION",target:n,params:{message_type:5,new_public_key:t,new_kid:o,old_kid:e,overlap_seconds:r,initiated_at:new Date().toISOString()},keyId:o})}p();function mc(){return typeof crypto<"u"&&typeof crypto.randomUUID=="function"?crypto.randomUUID():`${Date.now()}-${Math.random().toString(36).slice(2)}`}function kr(t){let e=t.requestId??mc();return new $({rcan:J,cmd:"CONSENT_REQUEST",target:t.targetRuri,params:{message_type:20,requester_ruri:t.requesterRuri,requester_owner:t.requesterOwner,target_ruri:t.targetRuri,requested_scopes:t.requestedScopes,duration_hours:t.durationHours,justification:t.justification,request_id:e,consent_type:t.consentType??"cross_robot",data_categories:t.dataCategories??[]}})}function Ir(t){let e=t.expiresAt??new Date(Date.now()+864e5).toISOString();return new $({rcan:J,cmd:"CONSENT_GRANT",target:"rcan://local/consent",params:{message_type:21,request_id:t.requestId,granted_scopes:t.grantedScopes??[],expires_at:e,reason:t.reason??"approved"}})}function Nr(t){return new $({rcan:J,cmd:"CONSENT_DENY",target:"rcan://local/consent",params:{message_type:22,request_id:t.requestId,reason:t.reason??"denied"}})}function ni(t){let e=t.cmd,r=t.params,n=r.message_type;return e==="CONSENT_REQUEST"?n!==20?{valid:!1,reason:"message_type must be CONSENT_REQUEST (20)"}:r.requester_ruri?r.target_ruri?!r.requested_scopes||!Array.isArray(r.requested_scopes)||r.requested_scopes.length===0?{valid:!1,reason:"requested_scopes must be a non-empty array"}:r.request_id?r.justification?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing justification"}:{valid:!1,reason:"missing request_id"}:{valid:!1,reason:"missing target_ruri"}:{valid:!1,reason:"missing requester_ruri"}:e==="CONSENT_GRANT"?n!==21?{valid:!1,reason:"message_type must be CONSENT_GRANT (21)"}:r.request_id?r.expires_at?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing expires_at"}:{valid:!1,reason:"missing request_id"}:e==="CONSENT_DENY"?n!==22?{valid:!1,reason:"message_type must be CONSENT_DENY (22)"}:r.request_id?{valid:!0,reason:"ok"}:{valid:!1,reason:"missing request_id"}:{valid:!1,reason:`unknown consent command: ${e}`}}p();var yc=3600*1e3,Ut=class{_cache=new Map;get(e,r){let n=this._cache.get(e);if(!n)return;let o=r??Date.now();if(n.cachedUntil!==void 0&&n.cachedUntil<o){this._cache.delete(e);return}return n}set(e,r){let n=r??Date.now();this._cache.set(e.rrn,{...e,cachedUntil:n+yc})}invalidate(e){this._cache.delete(e)}get size(){return this._cache.size}};async function oi(t,e,r){let n=r??new Ut,o=n.get(t);if(o)return o;let s=`${e.replace(/\/$/,"")}/api/v1/robots/${encodeURIComponent(t)}/revocation-status`;try{let i=await fetch(s,{signal:AbortSignal.timeout(5e3)});if(!i.ok){let f={rrn:t,status:"active",reason:`registry returned ${i.status}`};return n.set(f),f}let a=await i.json(),c={rrn:t,status:a.status??"active",revokedAt:a.revokedAt,reason:a.reason,authority:a.authority};return n.set(c),c}catch{return{rrn:t,status:"active",reason:"network unavailable"}}}function si(t,e){return new $({rcan:J,cmd:"ROBOT_REVOCATION",target:"rcan://broadcast/revocation",params:{message_type:19,rrn:t,reason:e,revoked_at:new Date().toISOString()}})}p();var kn=(s=>(s.VIDEO="video",s.AUDIO="audio",s.LOCATION="location",s.BIOMETRIC="biometric",s.TELEMETRY="telemetry",s))(kn||{});function ii(t){return kr({requesterRuri:t.requesterRuri,requesterOwner:t.requesterOwner,targetRuri:t.targetRuri,requestedScopes:["training_data"],durationHours:t.durationHours,justification:t.justification,requestId:t.requestId,consentType:"training_data",dataCategories:t.dataCategories})}function ai(t){return Ir(t)}function ci(t){return Nr(t)}function ui(t){if(t.params.message_type!==36)return{valid:!1,reason:"not a TRAINING_DATA message"};let e=t.params.consent_token;return!e||typeof e!="string"||e.trim()===""?{valid:!1,reason:"TRAINING_DATA message missing consent_token (\xA717)"}:{valid:!0,reason:"ok"}}p();var Mr=class{crossOwnerGraceS;keyTtlS;_cachedKeys=[];constructor(e=3600,r=86400){this.crossOwnerGraceS=e,this.keyTtlS=r}canAcceptCommand(e,r,n,o=!0,s=!1,i,a){if(e&&e.message_type===6&&e.safety_event==="ESTOP")return{allowed:!0,reason:"ESTOP always accepted (Protocol 66)"};if(!r)return{allowed:!0,reason:"online mode"};if(!n)return{allowed:!1,reason:"offline mode: cross-network commands blocked"};if(!o)return{allowed:!1,reason:"offline mode: only owner-role commands accepted from local network"};if(s&&i!==void 0){let f=((a??Date.now())-i)/1e3;if(f>this.crossOwnerGraceS)return{allowed:!1,reason:`offline mode: cross-owner grace period expired (${Math.round(f)}s > ${this.crossOwnerGraceS}s)`}}return{allowed:!0,reason:"offline mode: owner command on local network accepted"}}cacheKey(e,r){let n=r??Date.now();this._cachedKeys=this._cachedKeys.filter(o=>o.kid!==e.kid),this._cachedKeys.push({...e,cachedAtMs:n,ttlSeconds:this.keyTtlS})}getCachedKey(e,r){let n=r??Date.now(),o=this._cachedKeys.find(i=>i.kid===e);if(!o)return;if((n-o.cachedAtMs)/1e3>o.ttlSeconds){this._cachedKeys=this._cachedKeys.filter(i=>i.kid!==e);return}return o}getManifestFields(e,r){if(e===void 0)return{offline_mode:!1,offline_since_s:0};let n=r??Date.now();return{offline_mode:!0,offline_since_s:Math.round((n-e)/1e3)}}};p();var In=(w=>(w.SENSOR_PROXIMITY_FAILURE="SENSOR_PROXIMITY_FAILURE",w.SENSOR_CAMERA_FAILURE="SENSOR_CAMERA_FAILURE",w.SENSOR_IMU_FAILURE="SENSOR_IMU_FAILURE",w.MOTOR_OVERCURRENT="MOTOR_OVERCURRENT",w.MOTOR_OVERTEMP="MOTOR_OVERTEMP",w.MOTOR_STALL="MOTOR_STALL",w.BATTERY_CRITICAL="BATTERY_CRITICAL",w.BATTERY_LOW="BATTERY_LOW",w.NETWORK_TIMEOUT="NETWORK_TIMEOUT",w.NETWORK_REGISTRY_UNREACHABLE="NETWORK_REGISTRY_UNREACHABLE",w.SAFETY_ESTOP_STUCK="SAFETY_ESTOP_STUCK",w.SAFETY_WATCHDOG_TIMEOUT="SAFETY_WATCHDOG_TIMEOUT",w.UNKNOWN="UNKNOWN",w))(In||{});function fi(t){return new $({rcan:J,cmd:"FAULT_REPORT",target:t.target??"rcan://local/fault",params:{message_type:26,fault_code:t.faultCode,severity:t.severity,subsystem:t.subsystem,affects_safety:t.affectsSafety,safe_to_continue:t.safeToContinue,description:t.description??"",reported_at:new Date().toISOString()}})}p();var Je=(a=>(a[a.GUEST=1]="GUEST",a[a.OPERATOR=2]="OPERATOR",a[a.CONTRIBUTOR=3]="CONTRIBUTOR",a[a.ADMIN=4]="ADMIN",a[a.M2M_PEER=5]="M2M_PEER",a[a.CREATOR=6]="CREATOR",a[a.M2M_TRUSTED=7]="M2M_TRUSTED",a))(Je||{}),di=Je,yt={1:1,2:2,3:2.5,4:3,5:4,6:5,7:6},xc=new Map(Object.entries(yt).map(([t,e])=>[e,Number(t)]));function Bt(t){return xc.get(t)}var Nn={status:1,discover:1,chat:1,observer:1,contribute:3,control:2,teleop:2,training:4,training_data:4,config:4,authority:4,admin:6,safety:6,estop:6,"fleet.trusted":7};var li={minRoleForDiscover:1,minRoleForStatus:1,minRoleForChat:1,minRoleForControl:1,minRoleForSafety:1},pi={minRoleForDiscover:1,minRoleForStatus:1,minRoleForChat:1,minRoleForControl:2,minRoleForSafety:6};function gi(t){try{let e=t.split(".");if(e.length<2)return null;let r=(e[1]??"").replace(/-/g,"+").replace(/_/g,"/"),n=r+"=".repeat((4-r.length%4)%4);return JSON.parse(atob(n))}catch{return null}}function Mn(t){let e=gi(t);if(!e)return 1;let r=e.rcan_role;if(r!=null){let o=Bt(Number(r));if(o!==void 0)return o}let n=e.loa;if(n!=null){let o=Bt(Number(n));if(o!==void 0)return o}return 1}function Ur(t){return Mn(t)}function hi(t){let e=gi(t);if(!e)return{sub:"",role:1,jwtLevel:1,scopes:[]};let r=e.rcan_role,n=e.loa,o=r!==void 0?Number(r):n!==void 0?Number(n):1,s=Bt(o)??1,i=Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[];return{sub:String(e.sub??""),role:s,jwtLevel:yt[s],registryUrl:e.registry_url,scopes:i,verifiedAt:e.verified_at,peerRrn:e.peer_rrn,fleetRrns:Array.isArray(e.fleet_rrns)?e.fleet_rrns:void 0}}function Un(t,e){let r=Nn[e.toLowerCase()];return r===void 0?t>=2?{ok:!0,reason:""}:{ok:!1,reason:`Unknown scope '${e}': applying OPERATOR minimum. Caller has ${Je[t]}.`}:t>=r?{ok:!0,reason:""}:{ok:!1,reason:`Scope '${e}' requires ${Je[r]} (JWT level ${yt[r]}), but caller has ${Je[t]} (JWT level ${yt[t]})`}}function mi(t,e){return Un(t,e)}p();var Bn=(n=>(n.ROOT="root",n.AUTHORITATIVE="authoritative",n.COMMUNITY="community",n))(Bn||{}),Dn=(n=>(n.CONSENT="consent",n.REVOCATION="revocation",n.KEY="key",n))(Dn||{}),bc=1440*60*1e3,Br=class{store=new Map;set(e){this.store.set(e.registryUrl,{identity:e,expiresAt:Date.now()+bc})}lookup(e){let r=this.store.get(e);if(r){if(Date.now()>r.expiresAt){this.store.delete(e);return}return r.identity}}async discoverViaDns(e){let r=`_rcan-registry.${e}`,n;try{n=await Ee("dns").promises.resolveTxt(r)}catch{return}for(let o of n){let s=o.join("");try{let i=JSON.parse(s);if(i.registryUrl&&i.tier&&i.publicKeyPem&&i.domain){let a={registryUrl:i.registryUrl,tier:i.tier,publicKeyPem:i.publicKeyPem,domain:i.domain,verifiedAt:new Date().toISOString()};return this.set(a),a}}catch{}}}async verifyRegistryJwt(e,r){let n=this.lookup(r);if(!n)throw new Error(`REGISTRY_UNKNOWN: ${r} is not in the trust cache`);let o;try{let i=(e.split(".")[1]??"").replace(/-/g,"+").replace(/_/g,"/"),a=i+"=".repeat((4-i.length%4)%4),c;typeof atob<"u"?c=atob(a):c=Buffer.from(a,"base64").toString("utf-8");let f=JSON.parse(c);o=typeof f.iss=="string"?f.iss:void 0}catch{throw new Error("REGISTRY_JWT_MALFORMED: cannot decode token payload")}if(o!==r)throw new Error(`REGISTRY_JWT_ISS_MISMATCH: expected iss=${r}, got iss=${o??"(none)"}`);return n}};function Rc(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=(t[6]??0)&15|64,t[8]=(t[8]??0)&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}function yi(t,e,r,n){return new $({rcan:"2.1.0",rcanVersion:"2.1.0",cmd:"federation_sync",target:e,params:{msg_type:23,msg_id:Rc(),source_registry:t,target_registry:e,sync_type:r,payload:n},timestamp:new Date().toISOString()})}async function xi(t,e,r){let n=t.params?.msg_type;if(n===6||n===6||t.cmd==="estop"||t.cmd==="ESTOP")return{valid:!0,reason:"ESTOP always permitted (P66 invariant)"};let s=t.params?.source_registry??t.params?.from_registry;if(!s||s===e)return{valid:!0,reason:"local registry; no federation check needed"};if(!r.lookup(s))return{valid:!1,reason:`REGISTRY_UNKNOWN: ${s} is not in the local trust cache`};let a=1,c=t.params?.registry_jwt;return c?a=Ur(c):typeof t.loa=="number"&&(a=t.loa),a<2?{valid:!1,reason:`LOA_INSUFFICIENT: cross-registry commands require LoA>=2 (OPERATOR), got role=${a}`}:{valid:!0,reason:"cross-registry command accepted"}}p();var Re=class t extends Error{constructor(e){super(e),this.name="TransportError",Object.setPrototypeOf(this,t.prototype)}},qn=(o=>(o.HTTP="http",o.COMPACT="compact",o.MINIMAL="minimal",o.BLE="ble",o))(qn||{}),Ln={msg_type:"t",msg_id:"i",timestamp:"ts",from_rrn:"f",to_rrn:"to",scope:"s",payload:"p",signature:"sig"},bi=Object.fromEntries(Object.entries(Ln).map(([t,e])=>[e,t]));function Hn(t){let e=t.toJSON(),r={};for(let[s,i]of Object.entries(e)){let a=Ln[s];r[a??s]=i}if(r.p&&typeof r.p=="object"){let s=r.p,i={};for(let[a,c]of Object.entries(s)){let f=Ln[a];i[f??a]=c}r.p=i}let n=JSON.stringify(r);return new TextEncoder().encode(n)}function $n(t){let r=new TextDecoder().decode(t),n=JSON.parse(r),o={};for(let[s,i]of Object.entries(n)){let a=bi[s];o[a??s]=i}if(o.payload&&typeof o.payload=="object"){let s=o.payload,i={};for(let[a,c]of Object.entries(s)){let f=bi[a];i[f??a]=c}o.payload=i}return new $({rcan:o.rcan??"1.6",rcanVersion:o.rcanVersion,cmd:o.cmd,target:o.target,params:o.params??o.payload??{},timestamp:o.timestamp,confidence:o.confidence,signature:o.signature})}var Lt=32,Pn=6;async function Ri(t){let e=new TextEncoder().encode(t),r=new ArrayBuffer(e.byteLength);new Uint8Array(r).set(e);let o=await(globalThis.crypto?.subtle??(await import("crypto")).webcrypto.subtle).digest("SHA-256",r);return new Uint8Array(o)}async function _i(t){let e=t.params?.msg_type??0;if(e!==Pn)throw new Re(`encodeMinimal only supports SAFETY (type 6) messages; got type=${e}`);let r=t.params?.from_rrn??t.target??"",n=t.params?.to_rrn??t.target??"",o=await Ri(r),s=await Ri(n),i=(t.signature?.sig??"").replace(/[^A-Za-z0-9+/=]/g,""),a;try{if(typeof atob<"u"){let _=atob(i.slice(0,16));a=new Uint8Array(_.length);for(let O=0;O<_.length;O++)a[O]=_.charCodeAt(O)}else a=Buffer.from(i.slice(0,16),"base64")}catch{a=new Uint8Array(8)}let f=(t.timestamp?Math.floor(new Date(t.timestamp).getTime()/1e3):Math.floor(Date.now()/1e3))>>>0,d=new Uint8Array(Lt),b=new DataView(d.buffer);b.setUint16(0,Pn,!1),d.set(o.subarray(0,8),2),d.set(s.subarray(0,8),10),b.setUint32(18,f,!1);let R=new Uint8Array(8);R.set(a.subarray(0,Math.min(8,a.length))),d.set(R,22);let w=0;for(let _=0;_<30;_++)w^=d[_]??0;if(b.setUint16(30,w&65535,!1),d.length!==Lt)throw new Re(`encodeMinimal assertion failed: expected ${Lt} bytes, got ${d.length}`);return d}function wi(t){if(t.length!==Lt)throw new Re(`decodeMinimal: expected ${Lt} bytes, got ${t.length}`);let e=new DataView(t.buffer,t.byteOffset,t.byteLength),r=e.getUint16(0,!1),n=t.subarray(2,10),o=t.subarray(10,18),s=e.getUint32(18,!1),i=t.subarray(22,30),a=new Date(s*1e3).toISOString(),c=f=>Array.from(f).map(d=>d.toString(16).padStart(2,"0")).join("");return{params:{msg_type:r,from_hash:c(n),to_hash:c(o),timestamp_s:s,sig_truncated:c(i)},timestamp:a}}var _c=251,Dt=3;function Ei(t,e=_c){let r=Hn(t),n=e-Dt;if(n<=0)throw new Re(`MTU ${e} is too small (need at least ${Dt+1})`);let o=Math.ceil(r.length/n),s=[];for(let i=0;i<o;i++){let a=r.subarray(i*n,(i+1)*n),c=new Uint8Array(Dt+a.length);c[0]=i,c[1]=o,c[2]=i===o-1?1:0,c.set(a,Dt),s.push(c)}return s}function Ai(t){if(t.length===0)throw new Re("decodeBleFrames: no frames provided");let e=[...t].sort((a,c)=>(a[0]??0)-(c[0]??0)),r=e[0]?.[1]??e.length;if(e.length!==r)throw new Re(`decodeBleFrames: expected ${r} frames, got ${e.length}`);let n=e.map(a=>a.subarray(Dt)),o=n.reduce((a,c)=>a+c.length,0),s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.length;return $n(s)}function Si(t,e){let n=(e.params?.msg_type??0)===Pn,o=s=>t.includes(s);if(n){if(o("minimal"))return"minimal";if(o("ble"))return"ble";if(o("compact"))return"compact";if(o("http"))return"http"}else{if(o("http"))return"http";if(o("compact"))return"compact";if(o("ble"))return"ble"}throw new Re(`No suitable transport available from: [${t.join(", ")}]`)}p();var jn=(r=>(r.BASE64="base64",r.REF="ref",r))(jn||{});function Pt(){if(typeof crypto<"u"&&typeof crypto.randomUUID=="function")return crypto.randomUUID();let t=Array.from({length:16},()=>Math.floor(Math.random()*256));t[6]=(t[6]??0)&15|64,t[8]=(t[8]??0)&63|128;let e=t.map(r=>r.toString(16).padStart(2,"0"));return`${e.slice(0,4).join("")}-${e.slice(4,6).join("")}-${e.slice(6,8).join("")}-${e.slice(8,10).join("")}-${e.slice(10).join("")}`}async function Fn(t){let e=globalThis.crypto?.subtle??(await import("crypto")).webcrypto.subtle,r=new ArrayBuffer(t.byteLength);new Uint8Array(r).set(t);let n=await e.digest("SHA-256",r),o=new Uint8Array(n);return Array.from(o).map(s=>s.toString(16).padStart(2,"0")).join("")}function Ci(t){if(typeof Buffer<"u")return Buffer.from(t).toString("base64");let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]??0);return btoa(e)}function Kn(t,e){let r={...t.toJSON(),...e};return $.fromJSON(r)}async function Vn(t,e,r){let n=await Fn(e),o=Ci(e),s={chunkId:Pt(),mimeType:r,encoding:"base64",hashSha256:n,dataB64:o,sizeBytes:e.length},i=t.mediaChunks??[];return Kn(t,{mediaChunks:[...i,s]})}function vi(t,e,r,n,o){let s={chunkId:Pt(),mimeType:r,encoding:"ref",hashSha256:n,refUrl:e,sizeBytes:o},i=t.mediaChunks??[];return Kn(t,{mediaChunks:[...i,s]})}async function Ti(t){let e=t.mediaChunks??[];if(e.length===0)return{valid:!0,reason:"no media chunks"};for(let r=0;r<e.length;r++){let n=e[r];if(!n.chunkId)return{valid:!1,reason:`chunk[${r}]: missing chunkId`};if(!n.mimeType)return{valid:!1,reason:`chunk[${r}]: missing mimeType`};if(!n.hashSha256)return{valid:!1,reason:`chunk[${r}]: missing hashSha256`};if(n.sizeBytes<0)return{valid:!1,reason:`chunk[${r}]: sizeBytes must be >= 0`};if(n.encoding==="base64"){if(!n.dataB64)return{valid:!1,reason:`chunk[${r}]: BASE64 encoding requires dataB64`};let o;try{if(typeof Buffer<"u")o=Buffer.from(n.dataB64,"base64");else{let i=atob(n.dataB64);o=new Uint8Array(i.length);for(let a=0;a<i.length;a++)o[a]=i.charCodeAt(a)}}catch{return{valid:!1,reason:`chunk[${r}]: failed to decode base64 data`}}let s=await Fn(o);if(s!==n.hashSha256)return{valid:!1,reason:`chunk[${r}]: SHA-256 mismatch (expected ${n.hashSha256}, got ${s})`}}else if(n.encoding==="ref"){if(!n.refUrl)return{valid:!1,reason:`chunk[${r}]: REF encoding requires refUrl`}}else return{valid:!1,reason:`chunk[${r}]: unknown encoding '${n.encoding}'`}}return{valid:!0,reason:"ok"}}async function Oi(t){let e=new $({rcan:"1.6",rcanVersion:"1.6",cmd:"training_data",target:"rcan://training/data",params:{msg_type:36,msg_id:Pt()},timestamp:new Date().toISOString()});for(let r of t)e=await Vn(e,r.data,r.mimeType);return e}async function ki(t,e,r,n,o){let s=await Fn(e),i=Ci(e),a={chunkId:Pt(),mimeType:r,encoding:"base64",hashSha256:s,dataB64:i,sizeBytes:e.length},c={streamId:t,chunkIndex:n,isFinal:o,chunk:a},f=new $({rcan:"1.6",rcanVersion:"1.6",cmd:"stream_chunk",target:"rcan://streaming/chunk",params:{msg_type:29,msg_id:Pt(),stream_chunk:c},timestamp:new Date().toISOString()});return f=Kn(f,{mediaChunks:[a]}),f}p();var Gn=2.5,wc=0;function Ec(){return`cr-${Date.now()}-${++wc}`}function Ii(t={}){return{type:33,request_id:t.request_id??Ec(),project_id:t.project_id??"",project_name:t.project_name??"",work_unit_id:t.work_unit_id??"",resource_type:t.resource_type??"cpu",estimated_duration_s:t.estimated_duration_s??0,priority:t.priority??0,payload:t.payload??{},timestamp:t.timestamp??Date.now()/1e3}}function Ni(t={}){let e={type:34,request_id:t.request_id??"",work_unit_id:t.work_unit_id??"",status:t.status??"completed",resource_type:t.resource_type??"cpu",duration_s:t.duration_s??0,compute_units:t.compute_units??0,result_payload:t.result_payload??{},timestamp:t.timestamp??Date.now()/1e3};return t.error_message!==void 0&&(e.error_message=t.error_message),e}function Mi(t={}){return{type:35,request_id:t.request_id??"",work_unit_id:t.work_unit_id??"",reason:t.reason??"",timestamp:t.timestamp??Date.now()/1e3}}function Ui(t,e="request"){return e==="request"||e==="result"?t>=Gn:e==="cancel"?t>=2:!1}function Bi(t){return t>=3}p();var Yn=2,Ac=0;function Sc(){return`run-${Date.now()}-${++Ac}`}function Di(t={}){return{type:37,competition_id:t.competition_id??"",competition_format:t.competition_format??"sprint",hardware_tier:t.hardware_tier??"",model_id:t.model_id??"",robot_rrn:t.robot_rrn??"",entered_at:t.entered_at??Date.now()/1e3}}function Li(t={}){let e=t.score??0;if(e<0||e>1)throw new Error(`score must be in [0.0, 1.0], got ${e}`);return{type:38,competition_id:t.competition_id??"",candidate_id:t.candidate_id??"",score:e,hardware_tier:t.hardware_tier??"",verified:t.verified??!1,submitted_at:t.submitted_at??Date.now()/1e3}}function Pi(t={}){return{type:39,season_id:t.season_id??"",class_id:t.class_id??"",standings:t.standings??[],days_remaining:t.days_remaining??0,broadcast_at:t.broadcast_at??Date.now()/1e3}}function qi(t={}){let e=t.score??0;if(e<0||e>1)throw new Error(`score must be in [0.0, 1.0], got ${e}`);return{type:40,run_id:t.run_id??Sc(),run_type:t.run_type??"personal",candidate_id:t.candidate_id??"",score:e,hardware_tier:t.hardware_tier??"",model_id:t.model_id??"",owner_uid:t.owner_uid??"",metrics:t.metrics??{success_rate:0,p66_rate:0,token_efficiency:0,latency_score:0},submitted_to_community:t.submitted_to_community??!1,created_at:t.created_at??Date.now()/1e3}}function Hi(t){return t>=Yn}p();var $i="/.well-known/rcan-firmware-manifest.json";function ji(t){let e={rrn:t.rrn,firmware_version:t.firmwareVersion,build_hash:t.buildHash,components:t.components,signed_at:t.signedAt};return t.signature&&(e.signature=t.signature),e}function Fi(t){return{rrn:t.rrn,firmwareVersion:t.firmware_version,buildHash:t.build_hash,components:t.components??[],signedAt:t.signed_at??"",signature:t.signature}}function Ki(t){let e={build_hash:t.buildHash,components:t.components.map(r=>({hash:r.hash,name:r.name,version:r.version})),firmware_version:t.firmwareVersion,rrn:t.rrn,signed_at:t.signedAt};return JSON.stringify(e)}var Dr=class extends Error{constructor(e){super(e),this.name="FirmwareIntegrityError"}};function Vi(t){let e=[];t.rrn||e.push("rrn is required"),t.firmwareVersion||e.push("firmwareVersion is required"),t.buildHash||e.push("buildHash is required"),t.buildHash.startsWith("sha256:")||e.push("buildHash must start with 'sha256:'"),t.signedAt||e.push("signedAt is required"),t.signature||e.push("signature is required (manifest must be signed)");for(let[r,n]of t.components.entries())n.name||e.push(`components[${r}].name is required`),n.version||e.push(`components[${r}].version is required`),n.hash.startsWith("sha256:")||e.push(`components[${r}].hash must start with 'sha256:'`);return e}p();function Gi(t){return{request_id:t.requestId,authority_id:t.authorityId,requested_data:t.requestedData,justification:t.justification,expires_at:t.expiresAt}}function Yi(t){return{requestId:t.request_id,authorityId:t.authority_id,requestedData:t.requested_data??[],justification:t.justification??"",expiresAt:t.expires_at??0}}function Wn(t){let e=[];return t.requestId||e.push("requestId is required"),t.authorityId||e.push("authorityId is required"),(!t.requestedData||t.requestedData.length===0)&&e.push("requestedData must include at least one category"),t.justification||e.push("justification is required"),(!t.expiresAt||t.expiresAt<=0)&&e.push("expiresAt must be a positive Unix timestamp"),t.expiresAt<Date.now()/1e3&&e.push("expiresAt is in the past \u2014 request has expired"),e}function Wi(t){return Date.now()/1e3<t.expiresAt&&Wn(t).length===0}var Ji={NOT_RECOGNIZED:"AUTHORITY_NOT_RECOGNIZED",REQUEST_EXPIRED:"AUTHORITY_REQUEST_EXPIRED",INVALID_TOKEN:"AUTHORITY_INVALID_TOKEN",RATE_LIMITED:"AUTHORITY_RATE_LIMITED"};p();var Jn="https://api.rrf.rcan.dev/v2/revocations",Lr="rrf.rcan.dev",Zn=55e3;var fe=class extends Error{constructor(e){super(e),this.name="M2MAuthError"}};function Zi(t){let e=t.split(".");if(e.length<2)throw new fe("Invalid JWT structure");let r=(e[1]??"").replace(/-/g,"+").replace(/_/g,"/"),n=r+"=".repeat((4-r.length%4)%4);try{return JSON.parse(atob(n))}catch(o){throw new fe(`JWT payload decode failed: ${String(o)}`)}}function Xi(t){let e=Zi(t),r=Number(e.exp??0);if(r>0&&Date.now()/1e3>r)throw new fe(`M2M_PEER token expired (sub=${String(e.sub)})`);let n=String(e.peer_rrn??"");if(!n)throw new fe("M2M_PEER token missing peer_rrn claim");return{sub:String(e.sub??""),peerRrn:n,scopes:Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[],exp:r,iss:String(e.iss??"")}}function Xn(t){let e=Zi(t),r=String(e.iss??"");if(r!==Lr)throw new fe(`M2M_TRUSTED issuer must be '${Lr}', got '${r}'`);let n=Array.isArray(e.rcan_scopes)?e.rcan_scopes:Array.isArray(e.scopes)?e.scopes:[];if(!n.includes("fleet.trusted"))throw new fe("M2M_TRUSTED token missing required 'fleet.trusted' scope");let o=Number(e.exp??0);if(o>0&&Date.now()/1e3>o)throw new fe(`M2M_TRUSTED token expired (sub=${String(e.sub)})`);let s=String(e.rrf_sig??"");if(!s)throw new fe("M2M_TRUSTED token missing rrf_sig claim");let i=Array.isArray(e.fleet_rrns)?e.fleet_rrns:[];return{sub:String(e.sub??""),fleetRrns:i,scopes:n,exp:o,iss:r,rrfSig:s}}function zn(t,e){let r=Xn(t);if(!r.fleetRrns.includes(e))throw new fe(`M2M_TRUSTED token does not authorize commanding '${e}'. Authorized fleet: [${r.fleetRrns.join(", ")}]`);return r}var Ze=null;async function Qn(t=Jn){let e=Date.now();if(Ze&&e-Ze.fetchedAt<Zn)return Ze;try{let n=await(await fetch(t,{signal:AbortSignal.timeout?.(5e3)})).json();Ze={revokedOrchestrators:new Set(n.revoked_orchestrators??[]),revokedJtis:new Set(n.revoked_jtis??[]),fetchedAt:e}}catch{if(Ze)return Ze;Ze={revokedOrchestrators:new Set,revokedJtis:new Set,fetchedAt:e}}return Ze}async function eo(t,e){let r=await Qn();return!!(r.revokedOrchestrators.has(t.sub)||e&&r.revokedJtis.has(e))}async function zi(t,e,r){let n=zn(t,e);if(!r?.skipRevocationCheck&&await eo(n))throw new fe(`M2M_TRUSTED orchestrator '${n.sub}' is on the RRF revocation list`);return n}p();function Cc(t){let e="";for(let r=0;r<t.length;r++)e+=String.fromCharCode(t[r]);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}function vc(t){let e=t.replace(/-/g,"+").replace(/_/g,"/"),r=atob(e),n=new Uint8Array(r.length);for(let o=0;o<r.length;o++)n[o]=r.charCodeAt(o);return n}async function to(t){if(typeof crypto<"u"&&crypto.subtle){let r=await crypto.subtle.digest("SHA-256",t.buffer);return Array.from(new Uint8Array(r)).map(n=>n.toString(16).padStart(2,"0")).join("").slice(0,8)}let{createHash:e}=Ee("crypto");return e("sha256").update(t).digest("hex").slice(0,8)}var xt;async function ro(){if(xt)return xt;if(typeof Ee<"u")try{return xt=(rr(),lo(un)),xt}catch{}try{return xt=await Promise.resolve().then(()=>(rr(),un)),xt}catch{throw new Error("ML-DSA-65 signing requires @noble/post-quantum. Install with: npm install @noble/post-quantum")}}var Pr=class t{keyId;publicKey;secretKey;constructor(e){this.keyId=e.keyId,this.publicKey=e.publicKey,this.secretKey=e.secretKey}static async generate(){let r=(await ro()).ml_dsa65.keygen(),n=await to(r.publicKey);return new t({publicKey:r.publicKey,secretKey:r.secretKey,keyId:n})}static async fromPublicKey(e){let r=await to(e);return new t({publicKey:e,keyId:r})}static async fromKeyMaterial(e,r){let n=await to(e);return new t({publicKey:e,secretKey:r,keyId:n})}get hasPrivateKey(){return this.secretKey!==void 0}async signBytes(e){if(!this.secretKey)throw new Error("Cannot sign: MLDSAKeyPair has no private key (verify-only)");return(await ro()).ml_dsa65.sign(e,this.secretKey)}async verifyBytes(e,r){if(!(await ro()).ml_dsa65.verify(r,e,this.publicKey))throw new Error("ML-DSA-65 signature verification failed")}toString(){return`MLDSAKeyPair(keyId=${this.keyId}, alg=ML-DSA-65, ${this.hasPrivateKey?"private+public":"public-only"})`}};function Qi(t){let e={rcan:t.rcan,msg_id:t.msgId??"",timestamp:t.timestamp,cmd:t.cmd,target:t.target,params:t.params};return new TextEncoder().encode(JSON.stringify(Object.fromEntries(Object.entries(e).sort())))}async function no(t,e){let r=Qi(t),n=await e.signBytes(r);return t.signature={alg:"ml-dsa-65",kid:e.keyId,sig:Cc(n)},t}async function oo(t,e){let r=t.signature;if(!r)throw new Error("Message is unsigned \u2014 signature field missing");if(r.alg!=="ml-dsa-65")throw new Error(`Unsupported signature algorithm: ${r.alg}. RCAN v2.2 requires ml-dsa-65 (Ed25519 is deprecated).`);let n=e.find(s=>s.keyId===r.kid);if(!n)throw new Error(`No trusted ML-DSA-65 key with kid=${r.kid}. Known kids: [${e.map(s=>s.keyId).join(", ")}]`);let o;try{o=vc(r.sig)}catch(s){throw new Error(`Invalid base64url sig: ${s}`)}await n.verifyBytes(Qi(t),o)}var ea=no;async function ta(t,e,r=!0){return oo(t,e)}p();var Tc={0:["discover","status","transparency"],1:["chat","control","system"],3:["system","safety"]},ra={robot_ping:0,robot_status:0,robot_telemetry:0,fleet_list:0,rrf_lookup:0,compliance_report:0,robot_command:1,harness_get:1,research_run:1,contribute_toggle:1,components_list:1,harness_set:3,system_upgrade:3,loa_enable:3};function Oc(t,e){let r=ra[e]??99;return t.loa>=r}p();function oa(t){if(t.length>3)throw new Error(`RCAN: delegation chain max depth is 3, got ${t.length}`)}var na;function sa(t){if(!t.data)return;let e;if(na)e=na(t.data);else try{let r=typeof Ee<"u"?Ee:null;if(!r)return;let{createHash:n}=r("node:crypto");e="sha256:"+n("sha256").update(t.data).digest("hex")}catch{return}if(e!==t.hash_sha256)throw new Error(`MediaChunk hash mismatch: expected ${t.hash_sha256}, got ${e}`)}var kc="0.6.0",Ic="1.6";return lo(Nc);})();
 /*! Bundled license information:
 
 @noble/hashes/utils.js:
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 
 @noble/curves/utils.js:
+@noble/curves/abstract/modular.js:
+@noble/curves/abstract/curve.js:
+@noble/curves/abstract/edwards.js:
+@noble/curves/ed25519.js:
   (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 
 @noble/post-quantum/utils.js:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@continuonai/rcan-ts",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Official TypeScript SDK for the RCAN v1.6 robot communication protocol",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsup",
     "postbuild": "chmod +x bin/rcan-validate.mjs",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest",
+    "test": "node --experimental-vm-modules ./node_modules/.bin/jest",
     "typecheck": "tsc --noEmit"
   },
   "keywords": [
@@ -66,9 +66,7 @@
     },
     "globals": {},
     "injectGlobals": true,
-    "transformIgnorePatterns": [
-      "node_modules/(?!(@noble/post-quantum|@noble/hashes)/)"
-    ],
+    "transformIgnorePatterns": [],
     "setupFilesAfterEnv": [
       "<rootDir>/tests/jest.setup.ts"
     ]