@modularizer/plat 0.9.0 → 0.10.0

package/dist/client-side-server/mqtt-webrtc.js

@@ -1,11 +1,16 @@
 import mqtt from 'mqtt';
 import { createClientSideServerTransportPlugin } from '../client/css-transport-plugin.js';
 import { createRTCDataChannelAdapter } from './channel.js';
-import { buildClientSideServerIdentityChallenge, clientSideServerPublicKeysEqual, getOrCreateClientSideServerIdentityKeyPair, loadTrustedClientSideServerRecordFromMap, resolveTrustedClientSideServerFromAuthorities, loadTrustedClientSideServerRecord, trustClientSideServerFromAuthorityRecord, saveTrustedClientSideServerRecordToMap, signClientSideServerChallenge, toClientSideServerPublicIdentity, trustClientSideServerOnFirstUse, verifyClientSideServerChallenge, verifySignedClientSideServerAuthorityRecord, } from './identity.js';
-import { isClientSideServerPeerMessage, } from './protocol.js';
+import { buildClientSideServerIdentityChallenge, clientSideServerPublicKeysEqual, generateClientSideServerEncryptionKeyPair, getOrCreateClientSideServerIdentityKeyPair, isClientSideServerSignedAuthorityRecordV2, isClientSideServerTrustedServerRecordV2, loadTrustedClientSideServerRecordFromMap, resolveTrustedClientSideServerFromAuthorities, loadTrustedClientSideServerRecord, trustClientSideServerFromAuthorityRecord, saveTrustedClientSideServerRecordToMap, signClientSideServerChallenge, toClientSideServerEncryptionPublicIdentity, toClientSideServerPublicIdentity, trustClientSideServerOnFirstUse, verifyClientSideServerChallenge, verifyAnySignedClientSideServerAuthorityRecord, } from './identity.js';
+import { isClientSideServerSealedEnvelope, isClientSideServerSealedPayload, isClientSideServerPeerMessage, } from './protocol.js';
+import { choosePaddingBucket, computeSessionId, decodeBase64Url, decryptJsonAead, deriveAeadKeyFromX25519, encodeBase64Url, encryptJsonAead, generateEphemeralX25519KeyPair, importX25519PrivateKeyJwk, importX25519PublicKeyJwk, padCiphertext, randomNonce12, stableJson, unpadCiphertext, utf8, } from './secure-crypto.js';
 import { parseClientSideServerAddress, } from './signaling.js';
 export const DEFAULT_CLIENT_SIDE_SERVER_MQTT_BROKER = 'wss://broker.emqx.io:8084/mqtt';
 export const DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC = 'mrtchat/plat-css';
+export const DEFAULT_CLIENT_SIDE_SERVER_SEALED_TOPIC = 'plat';
+export const DEFAULT_CLIENT_SIDE_SERVER_MAX_SEALED_MESSAGE_BYTES = 65536;
+export const DEFAULT_CLIENT_SIDE_SERVER_REPLAY_WINDOW_MS = 5 * 60_000;
+export const DEFAULT_CLIENT_SIDE_SERVER_CLOCK_SKEW_TOLERANCE_MS = 30_000;
 export const DEFAULT_CLIENT_SIDE_SERVER_ICE_SERVERS = [
     { urls: 'stun:stun.l.google.com:19302' },
     { urls: 'stun:stun1.l.google.com:19302' },
@@ -26,8 +31,11 @@ export class ClientSideServerMQTTWebRTCServer {
     announceTimer;
     identityKeyPair;
     publicIdentity;
+    encryptionKeyPair;
+    encryptionPublicIdentity;
     clientCount = 0;
     resolvedInstanceInfo;
+    seenSealedNonces = new Map();
     constructor(options) {
         this.options = options;
         this.serverInstanceId = `${options.serverName}:${randomId('server')}`;
@@ -39,11 +47,18 @@ export class ClientSideServerMQTTWebRTCServer {
         if (this.mqtt)
             return;
         await this.ensureIdentity();
+        if (isSecureSignalingEnabled(this.options)) {
+            await this.ensureEncryptionIdentity();
+        }
         this.mqtt = await connectToBroker(this.options);
         this.mqtt.on('message', (_topic, payload) => {
             void this.onMessage(payload);
         });
-        await subscribe(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC);
+        await subscribe(this.mqtt, resolvePlaintextTopic(this.options));
+        const sealedTopic = resolveSealedTopic(this.options);
+        if (sealedTopic !== resolvePlaintextTopic(this.options)) {
+            await subscribe(this.mqtt, sealedTopic);
+        }
         // Compute and cache instance info (includes openapi hash) before first announce
         this.resolvedInstanceInfo = await this.buildResolvedInstanceInfo();
         await this.announce();
@@ -73,7 +88,7 @@ export class ClientSideServerMQTTWebRTCServer {
     async announce() {
         if (!this.mqtt)
             return;
-        await publish(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC, {
+        await publishJson(this.mqtt, resolvePlaintextTopic(this.options), {
             protocol: 'plat-css-v1',
             kind: 'announce',
             senderId: this.serverInstanceId,
@@ -86,33 +101,80 @@ export class ClientSideServerMQTTWebRTCServer {
     }
     async onMessage(payload) {
         const message = parseSignalingMessage(payload);
-        if (!message || message.senderId === this.serverInstanceId)
+        if (message) {
+            if (message.senderId === this.serverInstanceId)
+                return;
+            if (message.targetId && message.targetId !== this.options.serverName && message.targetId !== this.serverInstanceId)
+                return;
+            if (message.kind === 'discover' && message.targetId === this.options.serverName && message.challengeNonce) {
+                await this.respondToDiscover(message);
+                return;
+            }
+            if (!isSecureSignalingEnabled(this.options)) {
+                if (message.kind === 'offer'
+                    && (message.targetId === this.options.serverName || message.targetId === this.serverInstanceId)
+                    && message.connectionId
+                    && message.description) {
+                    await this.acceptOffer(message);
+                    return;
+                }
+                if (message.kind === 'ice'
+                    && (message.targetId === this.options.serverName || message.targetId === this.serverInstanceId)
+                    && message.connectionId
+                    && message.candidate) {
+                    const peer = this.peers.get(message.connectionId);
+                    if (peer?.remoteDescription) {
+                        await peer.addIceCandidate(new RTCIceCandidate(message.candidate));
+                    }
+                    else {
+                        const pending = this.pendingCandidates.get(message.connectionId) ?? [];
+                        pending.push(message.candidate);
+                        this.pendingCandidates.set(message.connectionId, pending);
+                    }
+                }
+            }
             return;
-        if (message.targetId && message.targetId !== this.options.serverName && message.targetId !== this.serverInstanceId)
+        }
+        if (!isSecureSignalingEnabled(this.options))
             return;
-        if (message.kind === 'discover' && message.targetId === this.options.serverName && message.challengeNonce) {
-            await this.respondToDiscover(message);
+        const opened = await openClientSideServerSealedEnvelopeForServer({
+            envelopePayload: payload,
+            serverEncryptionKeyPair: this.encryptionKeyPair,
+        });
+        if (!opened || envelopeIsReplayedOrStale(opened.payload, this.options))
+            return;
+        if (this.isSealedReplay(opened.envelope.senderId, opened.envelope.nonce)) {
+            debugSecure('sealed payload replayed', {
+                serverName: this.options.serverName,
+                senderId: opened.envelope.senderId,
+                nonce: opened.envelope.nonce,
+            });
             return;
         }
-        if (message.kind === 'offer'
-            && (message.targetId === this.options.serverName || message.targetId === this.serverInstanceId)
-            && message.connectionId
-            && message.description) {
-            await this.acceptOffer(message);
+        this.rememberSealedNonce(opened.envelope.senderId, opened.envelope.nonce);
+        debugSecure('sealed payload accepted', {
+            serverName: this.options.serverName,
+            senderId: opened.envelope.senderId,
+            type: opened.payload.type,
+            connectionId: opened.payload.connectionId,
+        });
+        if (opened.payload.type === 'offer') {
+            await this.acceptSealedOffer(opened.payload, {
+                senderId: opened.envelope.senderId,
+                clientEphemeralPublicKeyJwk: opened.envelope.clientEphemeralPublicKeyJwk,
+                connectionId: opened.payload.connectionId,
+            });
             return;
         }
-        if (message.kind === 'ice'
-            && (message.targetId === this.options.serverName || message.targetId === this.serverInstanceId)
-            && message.connectionId
-            && message.candidate) {
-            const peer = this.peers.get(message.connectionId);
+        if (opened.payload.type === 'ice') {
+            const peer = this.peers.get(opened.payload.connectionId);
             if (peer?.remoteDescription) {
-                await peer.addIceCandidate(new RTCIceCandidate(message.candidate));
+                await peer.addIceCandidate(new RTCIceCandidate(opened.payload.candidate));
             }
             else {
-                const pending = this.pendingCandidates.get(message.connectionId) ?? [];
-                pending.push(message.candidate);
-                this.pendingCandidates.set(message.connectionId, pending);
+                const pending = this.pendingCandidates.get(opened.payload.connectionId) ?? [];
+                pending.push(opened.payload.candidate);
+                this.pendingCandidates.set(opened.payload.connectionId, pending);
             }
         }
     }
@@ -120,19 +182,32 @@ export class ClientSideServerMQTTWebRTCServer {
         if (!this.mqtt || !message.challengeNonce)
             return;
         await this.ensureIdentity();
+        let encryptionBootstrap = {};
+        if (message.requestEncryptionIdentity && message.bootstrapClientEphemeralPublicKeyJwk) {
+            await this.ensureEncryptionIdentity();
+            encryptionBootstrap = await createPublicEncryptionBootstrapResponse({
+                serverInstanceId: this.serverInstanceId,
+                serverName: this.options.serverName,
+                serverEncryptionKeyPair: this.encryptionKeyPair,
+                serverEncryptionIdentity: this.encryptionPublicIdentity,
+                challengeNonce: message.challengeNonce,
+                clientEphemeralPublicKeyJwk: message.bootstrapClientEphemeralPublicKeyJwk,
+            });
+        }
         const challengeString = buildClientSideServerIdentityChallenge({
             serverName: this.options.serverName,
             connectionId: this.serverInstanceId,
             challengeNonce: message.challengeNonce,
         });
         const challengeSignature = await signClientSideServerChallenge(this.identityKeyPair, challengeString);
-        await publish(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC, {
+        await publishJson(this.mqtt, resolvePlaintextTopic(this.options), {
             protocol: 'plat-css-v1',
             kind: 'announce',
             senderId: this.serverInstanceId,
             serverName: this.options.serverName,
             identity: this.publicIdentity,
             authorityRecord: this.options.identity?.authorityRecord,
+            ...encryptionBootstrap,
             challengeNonce: message.challengeNonce,
             challengeSignature,
             workerInfo: this.buildWorkerInfo(),
@@ -195,7 +270,7 @@ export class ClientSideServerMQTTWebRTCServer {
             this.options.workerInfo.acceptingNewClients = false;
         }
         if (this.mqtt) {
-            await publish(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC, {
+            await publishJson(this.mqtt, resolvePlaintextTopic(this.options), {
                 protocol: 'plat-css-v1',
                 kind: 'announce',
                 senderId: this.serverInstanceId,
@@ -221,7 +296,7 @@ export class ClientSideServerMQTTWebRTCServer {
         peer.onicecandidate = (event) => {
             if (!event.candidate || !this.mqtt)
                 return;
-            void publish(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC, {
+            void publishJson(this.mqtt, resolvePlaintextTopic(this.options), {
                 protocol: 'plat-css-v1',
                 kind: 'ice',
                 senderId: this.serverInstanceId,
@@ -265,7 +340,7 @@ export class ClientSideServerMQTTWebRTCServer {
         this.pendingCandidates.delete(message.connectionId);
         const answer = await peer.createAnswer();
         await peer.setLocalDescription(answer);
-        await publish(this.mqtt, this.options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC, {
+        await publishJson(this.mqtt, resolvePlaintextTopic(this.options), {
             protocol: 'plat-css-v1',
             kind: 'answer',
             senderId: this.serverInstanceId,
@@ -286,6 +361,113 @@ export class ClientSideServerMQTTWebRTCServer {
             at: Date.now(),
         });
     }
+    async acceptSealedOffer(payload, response) {
+        if (!this.mqtt)
+            return;
+        await this.ensureIdentity();
+        await this.ensureEncryptionIdentity();
+        const authOk = await this.authorizeSealedOffer(payload, response);
+        if (!authOk)
+            return;
+        if (this.options.workerInfo?.acceptingNewClients === false) {
+            await this.publishSealedResponse(response, {
+                type: 'reject',
+                connectionId: payload.connectionId,
+                serverName: this.options.serverName,
+                reason: 'server-not-accepting',
+                at: Date.now(),
+            });
+            return;
+        }
+        const peer = new RTCPeerConnection({
+            iceServers: this.options.iceServers ?? DEFAULT_CLIENT_SIDE_SERVER_ICE_SERVERS,
+        });
+        this.peers.set(payload.connectionId, peer);
+        peer.onicecandidate = (event) => {
+            if (!event.candidate || !this.mqtt)
+                return;
+            void this.publishSealedResponse(response, {
+                type: 'ice',
+                connectionId: payload.connectionId,
+                serverName: this.options.serverName,
+                candidate: event.candidate.toJSON(),
+                at: Date.now(),
+            });
+        };
+        peer.onconnectionstatechange = () => {
+            if (peer.connectionState === 'failed' || peer.connectionState === 'closed' || peer.connectionState === 'disconnected') {
+                this.unsubscribeByConnection.get(payload.connectionId)?.();
+                this.unsubscribeByConnection.delete(payload.connectionId);
+                this.peers.delete(payload.connectionId);
+            }
+        };
+        peer.ondatachannel = (event) => {
+            const channel = createRTCDataChannelAdapter(event.channel);
+            const connId = payload.connectionId;
+            const controlUnsubscribe = channel.subscribe(async (msg) => {
+                await this.handleControlMessage(msg, channel, connId);
+            });
+            const serveUnsubscribe = this.options.server.serveChannel(channel);
+            this.channels.set(connId, channel);
+            this.clientCount++;
+            const cleanup = () => {
+                controlUnsubscribe();
+                serveUnsubscribe();
+                this.channels.delete(connId);
+                this.clientCount--;
+                this.unsubscribeByConnection.delete(connId);
+            };
+            this.unsubscribeByConnection.set(connId, cleanup);
+            event.channel.addEventListener('close', cleanup, { once: true });
+        };
+        try {
+            await peer.setRemoteDescription(new RTCSessionDescription(payload.description));
+            for (const candidate of this.pendingCandidates.get(payload.connectionId) ?? []) {
+                await peer.addIceCandidate(new RTCIceCandidate(candidate));
+            }
+            this.pendingCandidates.delete(payload.connectionId);
+            const answer = await peer.createAnswer();
+            await peer.setLocalDescription(answer);
+            await this.publishSealedResponse(response, {
+                type: 'answer',
+                connectionId: payload.connectionId,
+                serverName: this.options.serverName,
+                description: answer,
+                identity: this.publicIdentity,
+                authorityRecord: this.options.identity?.authorityRecord,
+                challengeNonce: payload.challengeNonce,
+                challengeSignature: payload.challengeNonce
+                    ? await signClientSideServerChallenge(this.identityKeyPair, buildClientSideServerIdentityChallenge({
+                        serverName: this.options.serverName,
+                        connectionId: payload.connectionId,
+                        challengeNonce: payload.challengeNonce,
+                    }))
+                    : undefined,
+                at: Date.now(),
+            });
+            debugSecure('secure answer sent', {
+                serverName: this.options.serverName,
+                connectionId: payload.connectionId,
+            });
+        }
+        catch (error) {
+            debugSecure('sealed offer processing failed', {
+                serverName: this.options.serverName,
+                connectionId: payload.connectionId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            await this.publishSealedResponse(response, {
+                type: 'reject',
+                connectionId: payload.connectionId,
+                serverName: this.options.serverName,
+                reason: 'bad-message',
+                at: Date.now(),
+            });
+            peer.close();
+            this.peers.delete(payload.connectionId);
+            this.pendingCandidates.delete(payload.connectionId);
+        }
+    }
     async ensureIdentity() {
         if (this.identityKeyPair && this.publicIdentity)
             return;
@@ -297,6 +479,105 @@ export class ClientSideServerMQTTWebRTCServer {
             });
         this.publicIdentity = await toClientSideServerPublicIdentity(this.identityKeyPair);
     }
+    async ensureEncryptionIdentity() {
+        if (this.encryptionKeyPair && this.encryptionPublicIdentity)
+            return;
+        if (this.options.serverEncryptionKeyPair) {
+            this.encryptionKeyPair = this.options.serverEncryptionKeyPair;
+        }
+        else {
+            this.encryptionKeyPair = await generateClientSideServerEncryptionKeyPair();
+        }
+        this.encryptionPublicIdentity = await toClientSideServerEncryptionPublicIdentity(this.encryptionKeyPair);
+    }
+    isSealedReplay(senderId, nonce) {
+        this.pruneSeenSealedNonces();
+        return this.seenSealedNonces.has(`${senderId}:${nonce}`);
+    }
+    rememberSealedNonce(senderId, nonce) {
+        this.pruneSeenSealedNonces();
+        this.seenSealedNonces.set(`${senderId}:${nonce}`, Date.now());
+    }
+    pruneSeenSealedNonces() {
+        const cutoff = Date.now() - (this.options.replayWindowMs ?? DEFAULT_CLIENT_SIDE_SERVER_REPLAY_WINDOW_MS);
+        for (const [key, value] of this.seenSealedNonces.entries()) {
+            if (value < cutoff) {
+                this.seenSealedNonces.delete(key);
+            }
+        }
+    }
+    async publishSealedResponse(response, payload) {
+        if (!this.mqtt)
+            return;
+        const sealed = await sealClientSideServerPayloadForServer({
+            senderId: this.serverInstanceId,
+            payload,
+            serverEncryptionKeyPair: this.encryptionKeyPair,
+            clientEphemeralPublicKeyJwk: response.clientEphemeralPublicKeyJwk,
+            maxSealedMessageBytes: this.options.maxSealedMessageBytes,
+        });
+        if (payload.type === 'reject') {
+            debugSecure('sealed reject sent', {
+                serverName: this.options.serverName,
+                connectionId: payload.connectionId,
+                reason: payload.reason,
+            });
+        }
+        await publishRaw(this.mqtt, resolveSealedTopic(this.options), serializeSealedEnvelope(sealed.envelope));
+    }
+    async authorizeSealedOffer(payload, response) {
+        const signalingAuth = this.options.signalingAuth;
+        if (!signalingAuth)
+            return true;
+        if (!payload.auth) {
+            if (signalingAuth.required !== false) {
+                await this.publishSealedResponse(response, {
+                    type: 'reject',
+                    connectionId: payload.connectionId,
+                    serverName: this.options.serverName,
+                    reason: 'auth-required',
+                    at: Date.now(),
+                });
+                return false;
+            }
+            return true;
+        }
+        if (typeof signalingAuth.verify !== 'function') {
+            if (signalingAuth.required !== false) {
+                await this.publishSealedResponse(response, {
+                    type: 'reject',
+                    connectionId: payload.connectionId,
+                    serverName: this.options.serverName,
+                    reason: 'auth-required',
+                    at: Date.now(),
+                });
+                return false;
+            }
+            return true;
+        }
+        let verified = false;
+        try {
+            verified = await signalingAuth.verify(payload.auth, {
+                serverName: this.options.serverName,
+                connectionId: payload.connectionId,
+                senderId: response.senderId,
+            });
+        }
+        catch {
+            verified = false;
+        }
+        if (!verified) {
+            await this.publishSealedResponse(response, {
+                type: 'reject',
+                connectionId: payload.connectionId,
+                serverName: this.options.serverName,
+                reason: 'auth-failed',
+                at: Date.now(),
+            });
+            return false;
+        }
+        return true;
+    }
 }
 export function createClientSideServerMQTTWebRTCTransportPlugin(options = {}) {
     if (isDefaultMQTTWebRTCOptions(options)) {
@@ -390,7 +671,7 @@ function createClientSideServerMQTTWebRTCPeerPoolInternal(options) {
 }
 export async function discoverClientSideServers(serverName, options = {}) {
     const mqttClient = await connectToBroker(options);
-    const topic = options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC;
+    const topic = resolvePlaintextTopic(options);
     const peerId = `${options.clientIdPrefix ?? 'client'}:${randomId('discover')}`;
     const challengeNonce = randomId('challenge') + '-mqtt';
     const timeoutMs = options.workerPool?.discoveryTimeoutMs ?? 3000;
@@ -416,7 +697,7 @@ export async function discoverClientSideServers(serverName, options = {}) {
             mqttChallengeVerified = await verifyClientSideServerChallenge(message.identity.publicKeyJwk, challengeString, message.challengeSignature);
         }
         if (message.authorityRecord && options.identity?.authority?.publicKeyJwk) {
-            const authorityOk = await verifySignedClientSideServerAuthorityRecord(message.authorityRecord, options.identity.authority.publicKeyJwk);
+            const authorityOk = await verifyAnySignedClientSideServerAuthorityRecord(message.authorityRecord, options.identity.authority.publicKeyJwk);
             if (!authorityOk)
                 return;
         }
@@ -502,7 +783,8 @@ export async function connectFirstDiscovery(address, options) {
 export async function createClientSideServerMQTTWebRTCPeerSession(address, options, targetInstanceId) {
     const webrtc = await resolveClientWebRTCImplementation();
     const mqtt = await connectToBroker(options);
-    const topic = options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC;
+    const plaintextTopic = resolvePlaintextTopic(options);
+    const sealedTopic = resolveSealedTopic(options);
     const peerId = `${options.clientIdPrefix ?? 'client'}:${randomId('peer')}`;
     const connectionId = randomId('conn');
     const challengeNonce = randomId('challenge');
@@ -515,11 +797,69 @@ export async function createClientSideServerMQTTWebRTCPeerSession(address, optio
     const cleanupCallbacks = [];
     const pendingCandidates = [];
     const expectedIdentity = await resolveExpectedServerIdentity(address.serverName, options.identity);
+    let secureState;
     let open = true;
     let answerApplied = false;
     let serverIdentity;
-    await subscribe(mqtt, topic);
+    await subscribe(mqtt, plaintextTopic);
+    if (sealedTopic !== plaintextTopic) {
+        await subscribe(mqtt, sealedTopic);
+    }
+    if (isSecureSignalingEnabled(options)) {
+        secureState = await createSecureClientSessionState({
+            mqtt,
+            address,
+            options,
+            peerId,
+            expectedIdentity,
+        });
+    }
     const onMessage = async (_topic, payload) => {
+        if (secureState) {
+            const opened = await openClientSideServerSealedEnvelopeForClient({
+                envelopePayload: payload,
+                secureState,
+            });
+            if (!opened || opened.envelope.senderId === peerId || opened.payload.connectionId !== connectionId)
+                return;
+            if (opened.payload.type === 'reject') {
+                ready.reject(new Error(`Client-side server ${address.serverName} rejected connection: ${opened.payload.reason}`));
+                return;
+            }
+            if (opened.payload.type === 'answer' && opened.payload.description) {
+                if (answerApplied)
+                    return;
+                answerApplied = true;
+                await verifyServerIdentityForSealedAnswer({
+                    serverName: address.serverName,
+                    connectionId,
+                    challengeNonce,
+                    message: opened.payload,
+                    optionsIdentity: options.identity,
+                    expectedIdentity,
+                });
+                serverIdentity = opened.payload.identity;
+                await peer.setRemoteDescription(webrtc.createSessionDescription(opened.payload.description));
+                await maybeTrustServerAfterAnswer(address.serverName, expectedIdentity, opened.payload, options.identity);
+                for (const candidate of pendingCandidates.splice(0, pendingCandidates.length)) {
+                    await peer.addIceCandidate(webrtc.createIceCandidate(candidate));
+                }
+                return;
+            }
+            if (opened.payload.type === 'ice') {
+                debugSecure('secure ICE received', {
+                    serverName: address.serverName,
+                    connectionId,
+                });
+                if (peer.remoteDescription) {
+                    await peer.addIceCandidate(webrtc.createIceCandidate(opened.payload.candidate));
+                }
+                else {
+                    pendingCandidates.push(opened.payload.candidate);
+                }
+            }
+            return;
+        }
         const message = parseSignalingMessage(payload);
         if (!message || message.senderId === peerId || message.targetId !== peerId || message.connectionId !== connectionId) {
             return;
@@ -538,24 +878,7 @@ export async function createClientSideServerMQTTWebRTCPeerSession(address, optio
             });
             serverIdentity = message.identity;
             await peer.setRemoteDescription(webrtc.createSessionDescription(message.description));
-            if (!expectedIdentity && message.authorityRecord && options.identity?.authority?.publicKeyJwk) {
-                const trusted = await trustClientSideServerFromAuthorityRecord(message.authorityRecord, options.identity.authority.publicKeyJwk, {
-                    storage: options.identity?.knownHostsStorage,
-                    storageKey: options.identity?.knownHostsStorageKey,
-                });
-                if (options.identity?.knownHosts) {
-                    saveTrustedClientSideServerRecordToMap(options.identity.knownHosts, trusted);
-                }
-            }
-            else if (!expectedIdentity && options.identity?.trustOnFirstUse !== false && message.identity) {
-                const trusted = await trustClientSideServerOnFirstUse(address.serverName, message.identity, {
-                    storage: options.identity?.knownHostsStorage,
-                    storageKey: options.identity?.knownHostsStorageKey,
-                });
-                if (options.identity?.knownHosts) {
-                    saveTrustedClientSideServerRecordToMap(options.identity.knownHosts, trusted);
-                }
-            }
+            await maybeTrustServerAfterAnswer(address.serverName, expectedIdentity, message, options.identity);
             for (const candidate of pendingCandidates.splice(0, pendingCandidates.length)) {
                 await peer.addIceCandidate(webrtc.createIceCandidate(candidate));
             }
@@ -573,10 +896,29 @@ export async function createClientSideServerMQTTWebRTCPeerSession(address, optio
     mqtt.on('message', onMessage);
     cleanupCallbacks.push(() => mqtt.off('message', onMessage));
     const offerTarget = targetInstanceId ?? address.serverName;
+    const addressAuth = resolveAddressAuth(address);
     peer.onicecandidate = (event) => {
         if (!event.candidate)
             return;
-        void publish(mqtt, topic, {
+        if (secureState) {
+            void publishSealedClientPayload({
+                mqtt,
+                options,
+                senderId: peerId,
+                secureState,
+                payload: {
+                    type: 'ice',
+                    connectionId,
+                    serverName: address.serverName,
+                    candidate: webrtc.serializeIceCandidate(event.candidate),
+                    at: Date.now(),
+                },
+            }).then(() => {
+                debugSecure('secure ICE sent', { serverName: address.serverName, connectionId });
+            });
+            return;
+        }
+        void publish(mqtt, plaintextTopic, {
             protocol: 'plat-css-v1',
             kind: 'ice',
             senderId: peerId,
@@ -602,22 +944,52 @@ export async function createClientSideServerMQTTWebRTCPeerSession(address, optio
     }, { once: true });
     const offer = await peer.createOffer();
     await peer.setLocalDescription(offer);
-    await publish(mqtt, topic, {
-        protocol: 'plat-css-v1',
-        kind: 'offer',
-        senderId: peerId,
-        targetId: offerTarget,
-        serverName: address.serverName,
-        connectionId,
-        description: offer,
-        challengeNonce,
-        at: Date.now(),
-    });
+    if (secureState) {
+        await publishSealedClientPayload({
+            mqtt,
+            options,
+            senderId: peerId,
+            secureState,
+            payload: {
+                type: 'offer',
+                connectionId,
+                serverName: address.serverName,
+                description: offer,
+                challengeNonce,
+                requirePrivateChallenge: options.requirePrivateChallenge,
+                auth: addressAuth,
+                at: Date.now(),
+            },
+        });
+    }
+    else {
+        await publish(mqtt, plaintextTopic, {
+            protocol: 'plat-css-v1',
+            kind: 'offer',
+            senderId: peerId,
+            targetId: offerTarget,
+            serverName: address.serverName,
+            connectionId,
+            description: offer,
+            challengeNonce,
+            at: Date.now(),
+        });
+    }
     const timer = setTimeout(() => {
         ready.reject(new Error(`Timed out connecting to client-side server ${address.serverName}`));
     }, timeoutMs);
     cleanupCallbacks.push(() => clearTimeout(timer));
-    await ready.promise;
+    try {
+        await ready.promise;
+    }
+    catch (error) {
+        open = false;
+        for (const cleanup of cleanupCallbacks)
+            cleanup();
+        peer.close();
+        await endClient(mqtt);
+        throw error;
+    }
     const channel = createRTCDataChannelAdapter(dataChannel);
     const originalClose = channel.close?.bind(channel);
     return {
@@ -659,7 +1031,7 @@ export async function createClientSideServerMQTTWebRTCPeerSession(address, optio
 async function resolveExpectedServerIdentity(serverName, options) {
     const mapped = loadTrustedClientSideServerRecordFromMap(options?.knownHosts, serverName);
     if (mapped)
-        return mapped;
+        return normalizeExpectedIdentity(mapped);
     if (options?.authorityServers?.length) {
         const trusted = await resolveTrustedClientSideServerFromAuthorities(serverName, options.authorityServers, {
             storage: options?.knownHostsStorage,
@@ -669,12 +1041,12 @@ async function resolveExpectedServerIdentity(serverName, options) {
             if (options.knownHosts) {
                 saveTrustedClientSideServerRecordToMap(options.knownHosts, trusted);
             }
-            return trusted;
+            return normalizeExpectedIdentity(trusted);
         }
     }
     const authorityResolved = options?.authorityResolver ? await options.authorityResolver(serverName) : null;
     if (authorityResolved)
-        return authorityResolved;
+        return normalizeExpectedIdentity(authorityResolved);
     const stored = loadTrustedClientSideServerRecord(serverName, {
         storage: options?.knownHostsStorage,
         storageKey: options?.knownHostsStorageKey,
@@ -682,7 +1054,7 @@ async function resolveExpectedServerIdentity(serverName, options) {
     if (stored && options?.knownHosts) {
         saveTrustedClientSideServerRecordToMap(options.knownHosts, stored);
     }
-    return stored;
+    return stored ? normalizeExpectedIdentity(stored) : null;
 }
 async function verifyServerIdentityForAnswer(input) {
     const { message, serverName, connectionId, challengeNonce, expectedIdentity } = input;
@@ -693,11 +1065,11 @@ async function verifyServerIdentityForAnswer(input) {
         return;
     }
     if (message.authorityRecord && input.optionsIdentity?.authority?.publicKeyJwk) {
-        const authorityOk = await verifySignedClientSideServerAuthorityRecord(message.authorityRecord, input.optionsIdentity.authority.publicKeyJwk);
+        const authorityOk = await verifyAnySignedClientSideServerAuthorityRecord(message.authorityRecord, input.optionsIdentity.authority.publicKeyJwk);
         if (!authorityOk) {
             throw new Error(`Server ${serverName} provided an invalid authority record`);
         }
-        if (!clientSideServerPublicKeysEqual(message.authorityRecord.publicKeyJwk, message.identity.publicKeyJwk)) {
+        if (!clientSideServerPublicKeysEqual(getAuthoritySigningPublicKey(message.authorityRecord), message.identity.publicKeyJwk)) {
             throw new Error(`Server ${serverName} authority record does not match presented identity`);
         }
     }
@@ -709,10 +1081,52 @@ async function verifyServerIdentityForAnswer(input) {
     if (!verified) {
         throw new Error(`Server ${serverName} failed identity challenge verification`);
     }
-    if (expectedIdentity && !clientSideServerPublicKeysEqual(expectedIdentity.publicKeyJwk, message.identity.publicKeyJwk)) {
+    if (expectedIdentity && !clientSideServerPublicKeysEqual(expectedIdentity.signing.publicKeyJwk, message.identity.publicKeyJwk)) {
         throw new Error(`Server ${serverName} presented an unexpected public key`);
     }
 }
+async function verifyServerIdentityForSealedAnswer(input) {
+    const message = {
+        protocol: 'plat-css-v1',
+        kind: 'answer',
+        senderId: 'sealed',
+        connectionId: input.connectionId,
+        serverName: input.serverName,
+        description: input.message.description,
+        identity: input.message.identity,
+        authorityRecord: input.message.authorityRecord,
+        challengeNonce: input.message.challengeNonce,
+        challengeSignature: input.message.challengeSignature,
+        at: input.message.at,
+    };
+    await verifyServerIdentityForAnswer({
+        ...input,
+        message,
+    });
+}
+async function maybeTrustServerAfterAnswer(serverName, expectedIdentity, message, identityOptions) {
+    if (expectedIdentity)
+        return;
+    if (message.authorityRecord && identityOptions?.authority?.publicKeyJwk) {
+        const trusted = await trustClientSideServerFromAuthorityRecord(message.authorityRecord, identityOptions.authority.publicKeyJwk, {
+            storage: identityOptions?.knownHostsStorage,
+            storageKey: identityOptions?.knownHostsStorageKey,
+        });
+        if (identityOptions?.knownHosts) {
+            saveTrustedClientSideServerRecordToMap(identityOptions.knownHosts, trusted);
+        }
+        return;
+    }
+    if (identityOptions?.trustOnFirstUse !== false && message.identity) {
+        const trusted = await trustClientSideServerOnFirstUse(serverName, message.identity, {
+            storage: identityOptions?.knownHostsStorage,
+            storageKey: identityOptions?.knownHostsStorageKey,
+        });
+        if (identityOptions?.knownHosts) {
+            saveTrustedClientSideServerRecordToMap(identityOptions.knownHosts, trusted);
+        }
+    }
+}
 export function createClientSideServerMQTTWebRTCServer(options) {
     return new ClientSideServerMQTTWebRTCServer(options);
 }
@@ -763,6 +1177,19 @@ function publish(client, topic, message) {
         });
     });
 }
+function publishJson(client, topic, message) {
+    return publish(client, topic, message);
+}
+function publishRaw(client, topic, message) {
+    return new Promise((resolve, reject) => {
+        client.publish(topic, message, (error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
 function endClient(client) {
     return new Promise((resolve) => {
         client.end(false, {}, () => resolve());
@@ -790,6 +1217,350 @@ function randomId(prefix) {
 function isDefaultMQTTWebRTCOptions(options) {
     return Object.keys(options).length === 0;
 }
+function isSecureSignalingEnabled(options) {
+    return options.secureSignaling !== false;
+}
+function resolvePlaintextTopic(options) {
+    return options.mqttTopic ?? DEFAULT_CLIENT_SIDE_SERVER_MQTT_TOPIC;
+}
+function resolveSealedTopic(options) {
+    if (isSecureSignalingEnabled(options) && options.anonymousRouting !== false) {
+        return options.sealedTopic ?? DEFAULT_CLIENT_SIDE_SERVER_SEALED_TOPIC;
+    }
+    return resolvePlaintextTopic(options);
+}
+function envelopeIsReplayedOrStale(payload, options) {
+    const replayWindowMs = options.replayWindowMs ?? DEFAULT_CLIENT_SIDE_SERVER_REPLAY_WINDOW_MS;
+    const clockSkewToleranceMs = options.clockSkewToleranceMs ?? DEFAULT_CLIENT_SIDE_SERVER_CLOCK_SKEW_TOLERANCE_MS;
+    const stale = Math.abs(Date.now() - payload.at) > (clockSkewToleranceMs + replayWindowMs);
+    if (stale) {
+        debugSecure('sealed payload stale', { type: payload.type, connectionId: payload.connectionId, at: payload.at });
+    }
+    return stale;
+}
+async function openClientSideServerSealedEnvelopeForServer(input) {
+    if (!input.serverEncryptionKeyPair)
+        return null;
+    const envelope = parseSealedEnvelope(input.envelopePayload);
+    if (!envelope)
+        return null;
+    try {
+        const privateKey = await importX25519PrivateKeyJwk(input.serverEncryptionKeyPair.privateKeyJwk);
+        const publicKey = await importX25519PublicKeyJwk(envelope.clientEphemeralPublicKeyJwk);
+        const aeadKey = await deriveAeadKeyFromX25519(privateKey, publicKey, utf8('plat-css-sealed-signaling-v1'));
+        const ciphertext = unpadCiphertext(decodeBase64Url(envelope.ciphertext));
+        const payload = await decryptJsonAead(aeadKey, ciphertext, buildSealedEnvelopeAad(envelope), decodeBase64Url(envelope.nonce));
+        if (!isClientSideServerSealedPayload(payload)) {
+            debugSecure('sealed decrypt failed', { reason: 'payload-validator' });
+            return null;
+        }
+        return { envelope, payload };
+    }
+    catch (error) {
+        debugSecure('sealed decrypt failed', { error: error instanceof Error ? error.message : String(error) });
+        return null;
+    }
+}
+async function openClientSideServerSealedEnvelopeForClient(input) {
+    const envelope = parseSealedEnvelope(input.envelopePayload);
+    if (!envelope)
+        return null;
+    try {
+        const aeadKey = await deriveAeadKeyFromX25519(input.secureState.keyPair.privateKey, input.secureState.serverEncryptionPublicKey, utf8('plat-css-sealed-signaling-v1'));
+        const payload = await decryptJsonAead(aeadKey, unpadCiphertext(decodeBase64Url(envelope.ciphertext)), buildSealedEnvelopeAad(envelope), decodeBase64Url(envelope.nonce));
+        if (!isClientSideServerSealedPayload(payload))
+            return null;
+        return { envelope, payload };
+    }
+    catch {
+        return null;
+    }
+}
+async function createSecureClientSessionState(input) {
+    const keyPair = await generateEphemeralX25519KeyPair();
+    const serverEncryptionPublicKeyJwk = input.address.encryptionPublicKeyJwk
+        ?? input.expectedIdentity?.encryption?.publicKeyJwk;
+    if (serverEncryptionPublicKeyJwk) {
+        return {
+            keyPair,
+            serverEncryptionPublicKeyJwk,
+            serverEncryptionPublicKey: await importX25519PublicKeyJwk(serverEncryptionPublicKeyJwk),
+        };
+    }
+    return bootstrapServerEncryptionIdentity({
+        ...input,
+        keyPair,
+    });
+}
+async function bootstrapServerEncryptionIdentity(input) {
+    const challengeNonce = randomId('enc-bootstrap');
+    const timeoutMs = Math.min(input.options.connectionTimeoutMs ?? 10_000, input.options.workerPool?.discoveryTimeoutMs ?? 3_000);
+    const ready = deferred();
+    const onMessage = async (_topic, payload) => {
+        const message = parseSignalingMessage(payload);
+        if (!message || message.senderId === input.peerId)
+            return;
+        if (message.kind !== 'announce')
+            return;
+        if (message.serverName !== input.address.serverName)
+            return;
+        if (message.challengeNonce !== challengeNonce)
+            return;
+        if (!message.identity || !message.challengeSignature || !message.encryptionIdentity)
+            return;
+        if (!message.encryptionChallengeCiphertext || !message.encryptionChallengeNonce)
+            return;
+        if (input.expectedIdentity
+            && !clientSideServerPublicKeysEqual(input.expectedIdentity.signing.publicKeyJwk, message.identity.publicKeyJwk)) {
+            return;
+        }
+        if (message.authorityRecord && input.options.identity?.authority?.publicKeyJwk) {
+            const authorityOk = await verifyAnySignedClientSideServerAuthorityRecord(message.authorityRecord, input.options.identity.authority.publicKeyJwk);
+            if (!authorityOk)
+                return;
+            if (isClientSideServerSignedAuthorityRecordV2(message.authorityRecord)
+                && !clientSideServerPublicKeysEqual(message.authorityRecord.encryptionPublicKeyJwk, message.encryptionIdentity.publicKeyJwk)) {
+                return;
+            }
+        }
+        const signedChallengeOk = await verifyClientSideServerChallenge(message.identity.publicKeyJwk, buildClientSideServerIdentityChallenge({
+            serverName: input.address.serverName,
+            connectionId: message.senderId,
+            challengeNonce,
+        }), message.challengeSignature);
+        if (!signedChallengeOk)
+            return;
+        try {
+            const serverEncryptionPublicKey = await importX25519PublicKeyJwk(message.encryptionIdentity.publicKeyJwk);
+            const aeadKey = await deriveAeadKeyFromX25519(input.keyPair.privateKey, serverEncryptionPublicKey, utf8('plat-css-sealed-signaling-v1'));
+            const proof = await decryptJsonAead(aeadKey, decodeBase64Url(message.encryptionChallengeCiphertext), buildBootstrapEncryptionAad({
+                senderId: message.senderId,
+                serverName: input.address.serverName,
+                challengeNonce,
+                clientEphemeralPublicKeyJwk: input.keyPair.publicKeyJwk,
+                serverEncryptionPublicKeyJwk: message.encryptionIdentity.publicKeyJwk,
+            }), decodeBase64Url(message.encryptionChallengeNonce));
+            if (proof.challengeNonce !== challengeNonce)
+                return;
+            if (proof.senderId !== message.senderId)
+                return;
+            if (proof.serverName !== input.address.serverName)
+                return;
+            ready.resolve({
+                keyPair: input.keyPair,
+                serverEncryptionPublicKeyJwk: message.encryptionIdentity.publicKeyJwk,
+                serverEncryptionPublicKey,
+            });
+        }
+        catch {
+            return;
+        }
+    };
+    input.mqtt.on('message', onMessage);
+    const timer = setTimeout(() => {
+        ready.reject(new Error(`Timed out bootstrapping encryption public key for ${input.address.serverName}`));
+    }, timeoutMs);
+    try {
+        await publish(input.mqtt, resolvePlaintextTopic(input.options), {
+            protocol: 'plat-css-v1',
+            kind: 'discover',
+            senderId: input.peerId,
+            targetId: input.address.serverName,
+            challengeNonce,
+            requestEncryptionIdentity: true,
+            bootstrapClientEphemeralPublicKeyJwk: input.keyPair.publicKeyJwk,
+            at: Date.now(),
+        });
+        const secureState = await ready.promise;
+        input.address.encryptionPublicKeyJwk = secureState.serverEncryptionPublicKeyJwk;
+        return secureState;
+    }
+    finally {
+        clearTimeout(timer);
+        input.mqtt.off('message', onMessage);
+    }
+}
+async function createPublicEncryptionBootstrapResponse(input) {
+    if (!input.serverEncryptionKeyPair || !input.serverEncryptionIdentity || !input.challengeNonce) {
+        return {};
+    }
+    const privateKey = await importX25519PrivateKeyJwk(input.serverEncryptionKeyPair.privateKeyJwk);
+    const publicKey = await importX25519PublicKeyJwk(input.clientEphemeralPublicKeyJwk);
+    const aeadKey = await deriveAeadKeyFromX25519(privateKey, publicKey, utf8('plat-css-sealed-signaling-v1'));
+    const nonce = randomNonce12();
+    const ciphertext = await encryptJsonAead(aeadKey, {
+        challengeNonce: input.challengeNonce,
+        senderId: input.serverInstanceId,
+        serverName: input.serverName,
+    }, buildBootstrapEncryptionAad({
+        senderId: input.serverInstanceId,
+        serverName: input.serverName,
+        challengeNonce: input.challengeNonce,
+        clientEphemeralPublicKeyJwk: input.clientEphemeralPublicKeyJwk,
+        serverEncryptionPublicKeyJwk: input.serverEncryptionIdentity.publicKeyJwk,
+    }), nonce);
+    return {
+        encryptionIdentity: input.serverEncryptionIdentity,
+        encryptionChallengeCiphertext: encodeBase64Url(ciphertext),
+        encryptionChallengeNonce: encodeBase64Url(nonce),
+    };
+}
+async function publishSealedClientPayload(input) {
+    const nonce = randomNonce12();
+    const envelope = await sealClientSideServerPayload({
+        senderId: input.senderId,
+        payload: input.payload,
+        privateKey: input.secureState.keyPair.privateKey,
+        peerPublicKey: input.secureState.serverEncryptionPublicKey,
+        clientEphemeralPublicKeyJwk: input.secureState.keyPair.publicKeyJwk,
+        serverEncryptionPublicKeyJwk: input.secureState.serverEncryptionPublicKeyJwk,
+        maxSealedMessageBytes: input.options.maxSealedMessageBytes,
+        nonce,
+    });
+    await publishRaw(input.mqtt, resolveSealedTopic(input.options), serializeSealedEnvelope(envelope.envelope));
+}
+async function sealClientSideServerPayloadForServer(input) {
+    if (!input.serverEncryptionKeyPair) {
+        throw new Error('Server encryption key pair is required for sealed signaling');
+    }
+    const privateKey = await importX25519PrivateKeyJwk(input.serverEncryptionKeyPair.privateKeyJwk);
+    const publicKey = await importX25519PublicKeyJwk(input.clientEphemeralPublicKeyJwk);
+    return {
+        ...(await sealClientSideServerPayload({
+            senderId: input.senderId,
+            payload: input.payload,
+            privateKey,
+            peerPublicKey: publicKey,
+            clientEphemeralPublicKeyJwk: input.clientEphemeralPublicKeyJwk,
+            serverEncryptionPublicKeyJwk: input.serverEncryptionKeyPair.publicKeyJwk,
+            maxSealedMessageBytes: input.maxSealedMessageBytes,
+        })),
+    };
+}
+async function sealClientSideServerPayload(input) {
+    const nonceBytes = input.nonce ?? randomNonce12();
+    const nonce = encodeBase64Url(nonceBytes);
+    const at = Date.now();
+    const sessionId = await computeSessionId({
+        clientEphemeralPublicKeyJwk: input.clientEphemeralPublicKeyJwk,
+        serverEncryptionPublicKeyJwk: input.serverEncryptionPublicKeyJwk,
+        nonceB64u: nonce,
+    }).catch(() => '');
+    const aeadKey = await deriveAeadKeyFromX25519(input.privateKey, input.peerPublicKey, utf8('plat-css-sealed-signaling-v1'));
+    const aadEnvelope = {
+        platcss: 'sealed',
+        version: 1,
+        senderId: input.senderId,
+        at,
+        nonce,
+        clientEphemeralPublicKeyJwk: input.clientEphemeralPublicKeyJwk,
+    };
+    const ciphertext = await encryptJsonAead(aeadKey, input.payload, utf8(stableJson(aadEnvelope)), nonceBytes);
+    const bucket = choosePaddingBucket(ciphertext.byteLength);
+    const padded = padCiphertext(ciphertext, bucket);
+    const maxBytes = input.maxSealedMessageBytes ?? DEFAULT_CLIENT_SIDE_SERVER_MAX_SEALED_MESSAGE_BYTES;
+    if (padded.byteLength > maxBytes) {
+        throw new Error(`Sealed signaling message exceeds maximum size of ${maxBytes} bytes`);
+    }
+    return {
+        sessionId,
+        envelope: {
+            ...aadEnvelope,
+            ciphertext: encodeBase64Url(padded),
+        },
+    };
+}
+function parseSealedEnvelope(payload) {
+    try {
+        const text = payload instanceof Uint8Array ? new TextDecoder().decode(payload) : String(payload);
+        const parsed = JSON.parse(text);
+        if (!isClientSideServerSealedEnvelope(parsed)) {
+            debugSecure('sealed envelope parse failed', { reason: 'validator' });
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function buildSealedEnvelopeAad(envelope) {
+    return utf8(stableJson({
+        platcss: 'sealed',
+        version: 1,
+        senderId: envelope.senderId,
+        at: envelope.at,
+        nonce: envelope.nonce,
+        clientEphemeralPublicKeyJwk: envelope.clientEphemeralPublicKeyJwk,
+    }));
+}
+function buildBootstrapEncryptionAad(input) {
+    return utf8(stableJson({
+        protocol: 'plat-css-v1',
+        kind: 'announce',
+        senderId: input.senderId,
+        serverName: input.serverName,
+        challengeNonce: input.challengeNonce,
+        bootstrapClientEphemeralPublicKeyJwk: input.clientEphemeralPublicKeyJwk,
+        encryptionPublicKeyJwk: input.serverEncryptionPublicKeyJwk,
+    }));
+}
+function serializeSealedEnvelope(envelope) {
+    return JSON.stringify({
+        platcss: envelope.platcss,
+        version: envelope.version,
+        senderId: envelope.senderId,
+        at: envelope.at,
+        nonce: envelope.nonce,
+        clientEphemeralPublicKeyJwk: envelope.clientEphemeralPublicKeyJwk,
+        ciphertext: envelope.ciphertext,
+    });
+}
+function resolveAddressAuth(address) {
+    const username = address.params.username;
+    const password = address.params.password;
+    if (!username || !password)
+        return undefined;
+    return { username, password };
+}
+function getAuthoritySigningPublicKey(record) {
+    return isClientSideServerSignedAuthorityRecordV2(record)
+        ? record.signingPublicKeyJwk
+        : record.publicKeyJwk;
+}
+function normalizeExpectedIdentity(record) {
+    if (isClientSideServerTrustedServerRecordV2(record)) {
+        return {
+            trustedRecord: record,
+            signing: {
+                algorithm: 'ECDSA-P256',
+                publicKeyJwk: record.signingPublicKeyJwk,
+                keyId: record.signingKeyId ?? 'signing-key',
+                fingerprint: record.signingFingerprint,
+            },
+            encryption: {
+                algorithm: 'X25519',
+                publicKeyJwk: record.encryptionPublicKeyJwk,
+                keyId: record.encryptionKeyId ?? 'encryption-key',
+                fingerprint: record.encryptionFingerprint,
+            },
+        };
+    }
+    return {
+        trustedRecord: record,
+        signing: {
+            algorithm: 'ECDSA-P256',
+            publicKeyJwk: record.publicKeyJwk,
+            keyId: record.keyId ?? 'signing-key',
+            fingerprint: record.fingerprint,
+        },
+    };
+}
+function debugSecure(event, details) {
+    if (!globalThis.__PLAT_CSS_DEBUG_SECURE)
+        return;
+    console.debug(`[plat-css secure] ${event}`, details ?? {});
+}
 function deferred() {
     let resolve;
     let reject;