@rynx-ai/remote-runtime-client 0.1.9

package/dist/browser-surface-client.js

@@ -0,0 +1,785 @@
+import { createHash, createPublicKey, randomBytes, sign, verify, } from "node:crypto";
+import { decodeDirectRuntimeFrame, DIRECT_RUNTIME_BROWSER_SURFACE_BINDING_PROTOCOL, DIRECT_RUNTIME_BROWSER_SURFACE_PATH, DIRECT_RUNTIME_CLOSE_CODE, DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, encodeClientAuthenticateCanonical, encodeClientAuthenticateProofPayload, encodeDirectRuntimeFrame, encodeServerAcceptedProofPayload, encodeServerHelloCanonical, encodeServerHelloProofPayload, } from "@rynx-ai/protocol/direct-runtime";
+import { parseRuntimeBrowserSurfaceClientFrame, parseRuntimeBrowserSurfaceImageFrame, parseRuntimeBrowserSurfaceServerFrame, RUNTIME_BROWSER_SURFACE_MAX_CONTROL_FRAME_BYTES, } from "@rynx-ai/protocol/runtime-browser-surface";
+import { REMOTE_RUNTIME_CORE_PROTOCOL } from "@rynx-ai/protocol/remote-runtime";
+import { createClientSurfaceE2EEChannel, DIRECT_RUNTIME_SURFACE_E2EE_MAX_BINARY_ENVELOPE_BYTES, generateClientKeyExchange, } from "@rynx-ai/remote-runtime-e2ee";
+import WebSocket from "ws";
+import { parseDirectRuntimeClientIdentity, parseDirectRuntimeCredential, } from "./credential.js";
+import { clientError, DirectRuntimeClientError, } from "./errors.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+const MIN_TIMEOUT_MS = 100;
+const MAX_TIMEOUT_MS = 120_000;
+const DEFAULT_PING_INTERVAL_MS = 10_000;
+const DEFAULT_INACTIVITY_TIMEOUT_MS = 25_000;
+const MAX_LIVENESS_INTERVAL_MS = 5 * 60_000;
+const MAX_PRE_ACTIVATION_FRAMES = 4;
+const MAX_PRE_ACTIVATION_BYTES = 128 * 1024;
+const MAX_QUEUED_EVENTS = 64;
+const MAX_QUEUED_EVENT_BYTES = 8 * 1024 * 1024;
+const MAX_PENDING_OUTBOUND_BYTES = 8 * 1024 * 1024;
+const MAX_PENDING_OUTBOUND_FRAMES = 16;
+export class DirectRuntimeBrowserSurfaceError extends DirectRuntimeClientError {
+    reason;
+    subscriptionId;
+    constructor(reason, subscriptionId, message) {
+        super(surfaceCloseErrorCode(reason), message);
+        this.reason = reason;
+        this.subscriptionId = subscriptionId;
+        this.name = "DirectRuntimeBrowserSurfaceError";
+    }
+}
+/** Authenticate a fresh V3 channel and open exactly one Browser Surface. */
+export async function openDirectRuntimeBrowserSurface(untrustedCredential, untrustedOpenFrame, options = {}) {
+    if (options.signal?.aborted) {
+        throw clientError("closed", "Browser Surface opening was cancelled");
+    }
+    const credential = parseDirectRuntimeCredential(untrustedCredential);
+    const identity = parseDirectRuntimeClientIdentity(credential, "authentication_failed");
+    const openFrame = parseRuntimeBrowserSurfaceClientFrame(untrustedOpenFrame);
+    if (openFrame.type !== "browser.surface.open") {
+        throw clientError("protocol_error", "Browser Surface connection requires an open frame");
+    }
+    const timeoutMs = parseTimeout(options.timeoutMs);
+    const liveness = parseLiveness(options.liveness);
+    const endpoint = browserSurfaceEndpoint(credential.directEndpoint);
+    const socket = new BrowserSurfaceSocket(endpoint, timeoutMs, liveness);
+    const abortOpening = () => {
+        socket.abort(clientError("closed", "Browser Surface opening was cancelled"));
+    };
+    options.signal?.addEventListener("abort", abortOpening, { once: true });
+    const deadline = Date.now() + timeoutMs;
+    try {
+        await socket.open(remaining(deadline));
+        const keyExchange = generateClientKeyExchange(credential.serverEncryptionPublicKey);
+        await socket.startAuthentication(keyExchange.channel, encodeDirectRuntimeFrame(keyExchange.clientHello));
+        const ready = decodeHandshake(await socket.readAuthenticationFrame(remaining(deadline)), "e2ee.ready");
+        if (ready.type !== "e2ee.ready") {
+            throw clientError("protocol_error", "e2ee.ready must follow e2ee.client-hello");
+        }
+        const hello = decodeHandshake(await socket.readAuthenticationFrame(remaining(deadline)), "server.hello");
+        if (hello.type !== "server.hello") {
+            throw clientError("protocol_error", "Browser Surface server.hello is missing");
+        }
+        assertSurfaceHello(hello, credential);
+        const helloFields = withoutSignature(hello);
+        const daemonPublicKey = createPublicKey({
+            key: Buffer.from(credential.identityPublicKey, "base64url"),
+            format: "der",
+            type: "spki",
+        });
+        if (!verify(null, encodeServerHelloProofPayload(keyExchange.channelBinding, helloFields), daemonPublicKey, Buffer.from(hello.signature, "base64url"))) {
+            throw clientError("authentication_failed", "Browser Surface server.hello signature is invalid");
+        }
+        const selectedCoreVersion = selectCoreProtocol(hello);
+        const authenticateFields = {
+            type: "client.authenticate",
+            mode: "connect",
+            role: "browser-surface",
+            daemonId: hello.daemonId,
+            daemonInstanceId: hello.daemonInstanceId,
+            bindingProtocolVersion: DIRECT_RUNTIME_BROWSER_SURFACE_BINDING_PROTOCOL.currentVersion,
+            coreProtocolVersion: selectedCoreVersion,
+            clientId: credential.clientId,
+            clientPublicKey: credential.clientPublicKey,
+            nonce: randomBytes(32).toString("base64url"),
+            grantId: credential.grantId,
+        };
+        const helloHash = sha256(encodeServerHelloCanonical(helloFields));
+        const authenticate = {
+            ...authenticateFields,
+            signature: sign(null, encodeClientAuthenticateProofPayload(keyExchange.channelBinding, helloHash, authenticateFields), identity.privateKey).toString("base64url"),
+        };
+        const authenticateHash = sha256(encodeClientAuthenticateCanonical(authenticateFields));
+        await socket.sendAuthenticationText(encodeDirectRuntimeFrame(authenticate));
+        const accepted = decodeHandshake(await socket.readAuthenticationFrame(remaining(deadline)), "server.accepted");
+        if (accepted.type !== "server.accepted") {
+            throw clientError("protocol_error", "Browser Surface server.accepted is missing");
+        }
+        assertSurfaceAccepted(accepted, hello, authenticate, credential);
+        const acceptedFields = withoutSignature(accepted);
+        if (!verify(null, encodeServerAcceptedProofPayload(keyExchange.channelBinding, helloHash, authenticateHash, acceptedFields), daemonPublicKey, Buffer.from(accepted.signature, "base64url"))) {
+            throw clientError("authentication_failed", "Browser Surface server.accepted signature is invalid");
+        }
+        const recordContext = {
+            channelId: accepted.channelId,
+            subscriptionId: openFrame.subscriptionId,
+        };
+        socket.activateSurface(createClientSurfaceE2EEChannel({
+            sharedSecret: keyExchange.sharedSecret,
+            serverEncryptionPublicKey: credential.serverEncryptionPublicKey,
+            clientHello: keyExchange.clientHello,
+        }), recordContext);
+        socket.markAuthenticated();
+        const connection = new BrowserSurfaceConnectionImpl(socket, openFrame, hello.daemonInstanceId);
+        await socket.sendSurfaceText(JSON.stringify(openFrame));
+        await connection.waitUntilReady(remaining(deadline));
+        if (options.signal?.aborted) {
+            throw clientError("closed", "Browser Surface opening was cancelled");
+        }
+        return connection;
+    }
+    catch (error) {
+        const normalized = normalizeError(error, "Browser Surface handshake failed");
+        socket.abort(normalized);
+        await socket.close().catch(() => undefined);
+        throw normalized;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", abortOpening);
+    }
+}
+class BrowserSurfaceConnectionImpl {
+    socket;
+    openFrame;
+    subscriptionId;
+    sessionId;
+    pageId;
+    daemonInstanceId;
+    closed;
+    readyFrame;
+    readyResolve;
+    readyReject;
+    readyPromise;
+    closedResolve;
+    items = [];
+    queuedBytes = 0;
+    waiter;
+    terminal;
+    finished = false;
+    localClose = false;
+    constructor(socket, openFrame, daemonInstanceId) {
+        this.socket = socket;
+        this.openFrame = openFrame;
+        this.subscriptionId = openFrame.subscriptionId;
+        this.sessionId = openFrame.sessionId;
+        this.pageId = openFrame.pageId;
+        this.daemonInstanceId = daemonInstanceId;
+        this.readyPromise = new Promise((resolve, reject) => {
+            this.readyResolve = resolve;
+            this.readyReject = reject;
+        });
+        this.closed = new Promise((resolve) => {
+            this.closedResolve = resolve;
+        });
+        socket.setSurfaceHandlers((record) => this.handleRecord(record), (error) => this.handleTerminal(error));
+    }
+    get ready() {
+        if (!this.readyFrame) {
+            throw clientError("protocol_error", "Browser Surface ready barrier has not completed");
+        }
+        return this.readyFrame;
+    }
+    async waitUntilReady(timeoutMs) {
+        await withTimeout(this.readyPromise, timeoutMs, () => clientError("unreachable", "Browser Surface ready barrier timed out"));
+    }
+    async send(untrustedFrame) {
+        if (this.finished)
+            throw this.terminal ?? clientError("closed", "Browser Surface is closed");
+        const frame = parseRuntimeBrowserSurfaceClientFrame(untrustedFrame);
+        if (frame.type === "browser.surface.open") {
+            throw clientError("protocol_error", "Browser Surface cannot be opened twice");
+        }
+        if (frame.subscriptionId !== this.subscriptionId) {
+            throw clientError("protocol_error", "Browser Surface control targets another subscription");
+        }
+        await this.socket.sendSurfaceText(JSON.stringify(frame));
+    }
+    async close() {
+        if (this.localClose)
+            return;
+        this.localClose = true;
+        if (!this.finished) {
+            this.finish({
+                type: "browser.surface.closed",
+                subscriptionId: this.subscriptionId,
+                reason: "cancelled",
+            });
+        }
+        await this.socket.close();
+    }
+    [Symbol.asyncIterator]() {
+        return {
+            next: () => this.nextEvent(),
+            return: async () => {
+                await this.close();
+                return { done: true, value: undefined };
+            },
+        };
+    }
+    nextEvent() {
+        const item = this.items.shift();
+        if (item) {
+            this.queuedBytes -= item.bytes;
+            return Promise.resolve({ done: false, value: item.event });
+        }
+        if (this.terminal)
+            return Promise.reject(this.terminal);
+        if (this.finished)
+            return Promise.resolve({ done: true, value: undefined });
+        if (this.waiter) {
+            return Promise.reject(clientError("protocol_error", "concurrent Surface iterator reads are not allowed"));
+        }
+        return new Promise((resolve, reject) => {
+            this.waiter = { resolve, reject };
+        });
+    }
+    handleRecord(record) {
+        try {
+            if (record.binary) {
+                const image = parseRuntimeBrowserSurfaceImageFrame(record.bytes);
+                if (image.subscriptionId !== this.subscriptionId) {
+                    throw new Error("Browser Surface server targeted another subscription");
+                }
+                if (!this.readyFrame)
+                    throw new Error("Browser Surface data preceded ready");
+                this.enqueue(image, record.bytes.byteLength);
+                return;
+            }
+            if (record.bytes.byteLength > RUNTIME_BROWSER_SURFACE_MAX_CONTROL_FRAME_BYTES) {
+                throw new Error("Browser Surface control frame is too large");
+            }
+            const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(record.bytes));
+            const event = parseRuntimeBrowserSurfaceServerFrame(value);
+            if (event.subscriptionId !== this.subscriptionId) {
+                throw new Error("Browser Surface server targeted another subscription");
+            }
+            if (event.type === "browser.surface.ready") {
+                if (this.readyFrame)
+                    throw new Error("Browser Surface sent ready twice");
+                if (event.browserGeneration !== this.openFrame.browserGeneration ||
+                    event.format !== this.openFrame.format) {
+                    throw new Error("Browser Surface ready frame does not match the open request");
+                }
+                this.readyFrame = event;
+                this.readyResolve(event);
+                return;
+            }
+            if (event.type === "browser.surface.closed") {
+                if (this.readyFrame)
+                    this.enqueue(event, record.bytes.byteLength);
+                this.finish(event);
+                return;
+            }
+            if (!this.readyFrame)
+                throw new Error("Browser Surface data preceded ready");
+            this.enqueue(event, record.bytes.byteLength);
+        }
+        catch (error) {
+            const normalized = clientError("protocol_error", "invalid Browser Surface server record", error);
+            this.socket.abort(normalized);
+            this.handleTerminal(normalized);
+        }
+    }
+    enqueue(event, bytes) {
+        if (this.finished)
+            return;
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            waiter.resolve({ done: false, value: event });
+            return;
+        }
+        if (this.items.length >= MAX_QUEUED_EVENTS ||
+            this.queuedBytes + bytes > MAX_QUEUED_EVENT_BYTES) {
+            throw new Error("Browser Surface client event queue is full");
+        }
+        this.items.push({ event, bytes });
+        this.queuedBytes += bytes;
+    }
+    finish(frame) {
+        if (this.finished)
+            return;
+        this.finished = true;
+        this.closedResolve(frame);
+        if (!this.readyFrame) {
+            this.readyReject(new DirectRuntimeBrowserSurfaceError(frame.reason, frame.subscriptionId, frame.message ?? `Browser Surface closed: ${frame.reason}`));
+        }
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            waiter.resolve({ done: true, value: undefined });
+        }
+    }
+    handleTerminal(error) {
+        if (this.finished)
+            return;
+        this.terminal = error;
+        this.readyReject(error);
+        if (!this.finished) {
+            this.finished = true;
+            this.closedResolve({
+                type: "browser.surface.closed",
+                subscriptionId: this.subscriptionId,
+                reason: error.code === "authentication_failed" ? "unauthorized" : "internal_error",
+                message: error.message.slice(0, 1_024),
+            });
+        }
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            waiter.reject(error);
+        }
+    }
+}
+class BrowserSurfaceSocket {
+    liveness;
+    websocket;
+    opened;
+    openResolve;
+    openReject;
+    authenticationChannel;
+    surfaceChannel;
+    surfaceContext;
+    awaitingPlaintextReady = false;
+    authenticationQueue = [];
+    authenticationQueuedBytes = 0;
+    authenticationWaiter;
+    recordHandler;
+    terminalHandler;
+    terminal;
+    authenticated = false;
+    localClose = false;
+    livenessTimer;
+    lastInboundActivityAt = 0;
+    pendingOutboundFrames = 0;
+    pendingOutboundBytes = 0;
+    pendingSurfaceSendFrames = 0;
+    pendingSurfaceSendBytes = 0;
+    surfaceSendOperations = Promise.resolve();
+    constructor(endpoint, timeoutMs, liveness) {
+        this.liveness = liveness;
+        this.opened = new Promise((resolve, reject) => {
+            this.openResolve = resolve;
+            this.openReject = reject;
+        });
+        this.websocket = new WebSocket(endpoint, {
+            rejectUnauthorized: true,
+            followRedirects: false,
+            handshakeTimeout: timeoutMs,
+            perMessageDeflate: false,
+            maxPayload: DIRECT_RUNTIME_SURFACE_E2EE_MAX_BINARY_ENVELOPE_BYTES,
+        });
+        this.websocket.on("open", () => {
+            this.noteActivity();
+            this.startLiveness();
+            this.openResolve();
+        });
+        this.websocket.on("message", (data, isBinary) => {
+            this.noteActivity();
+            try {
+                this.handleWireRecord(rawDataBytes(data), isBinary);
+            }
+            catch (error) {
+                this.abort(clientError("protocol_error", "invalid Browser Surface E2EE record", error));
+            }
+        });
+        this.websocket.on("ping", () => this.noteActivity());
+        this.websocket.on("pong", () => this.noteActivity());
+        this.websocket.on("unexpected-response", (_request, response) => {
+            response.resume();
+            this.abort(clientError(response.statusCode === 401 || response.statusCode === 403
+                ? "authentication_failed"
+                : response.statusCode === 429 || response.statusCode === 503
+                    ? "unreachable"
+                    : "protocol_error", `Browser Surface WebSocket upgrade failed with HTTP ${response.statusCode ?? "unknown"}`));
+        });
+        this.websocket.on("error", (error) => {
+            this.fail(this.authenticated ? closedError(error) : mapWebSocketError(error));
+        });
+        this.websocket.on("close", (code, reason) => {
+            const suffix = reason.length === 0 ? "" : `: ${reason.toString("utf8").slice(0, 256)}`;
+            this.fail(webSocketCloseError(code, suffix, this.localClose));
+        });
+    }
+    async open(timeoutMs) {
+        await withTimeout(this.opened, timeoutMs, () => clientError("unreachable", "Browser Surface WebSocket connection timed out"));
+    }
+    async startAuthentication(channel, clientHello) {
+        if (this.authenticationChannel)
+            throw clientError("protocol_error", "E2EE is already initialized");
+        this.authenticationChannel = channel;
+        this.awaitingPlaintextReady = true;
+        await this.sendWire(clientHello, false);
+    }
+    async readAuthenticationFrame(timeoutMs) {
+        if (this.authenticationWaiter) {
+            throw clientError("protocol_error", "concurrent Browser Surface handshake reads are not allowed");
+        }
+        const queued = this.authenticationQueue.shift();
+        if (queued) {
+            this.authenticationQueuedBytes -= queued.byteLength;
+            return queued;
+        }
+        if (this.terminal)
+            throw this.terminal;
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                if (this.authenticationWaiter?.timer !== timer)
+                    return;
+                this.authenticationWaiter = undefined;
+                reject(clientError("unreachable", "Browser Surface handshake timed out"));
+            }, timeoutMs);
+            timer.unref?.();
+            this.authenticationWaiter = { resolve, reject, timer };
+        });
+    }
+    async sendAuthenticationText(plaintext) {
+        const channel = this.authenticationChannel;
+        if (!channel)
+            throw clientError("protocol_error", "authentication E2EE is unavailable");
+        await this.sendWire(channel.seal(plaintext), false);
+    }
+    activateSurface(channel, context) {
+        if (this.authenticationWaiter || this.authenticationQueue.length > 0) {
+            throw clientError("protocol_error", "Browser Surface handshake has unread frames");
+        }
+        this.surfaceChannel = channel;
+        this.surfaceContext = context;
+        this.authenticationChannel = undefined;
+    }
+    markAuthenticated() {
+        this.authenticated = true;
+    }
+    setSurfaceHandlers(onRecord, onTerminal) {
+        if (this.recordHandler)
+            throw clientError("protocol_error", "Browser Surface socket is active");
+        this.recordHandler = onRecord;
+        this.terminalHandler = onTerminal;
+        if (this.terminal)
+            onTerminal(this.terminal);
+    }
+    async sendSurfaceText(plaintext) {
+        const plaintextBytes = Buffer.byteLength(plaintext, "utf8");
+        if (this.pendingSurfaceSendFrames >= MAX_PENDING_OUTBOUND_FRAMES ||
+            this.pendingSurfaceSendBytes + plaintextBytes > MAX_PENDING_OUTBOUND_BYTES) {
+            throw clientError("unreachable", "Browser Surface outbound queue is full");
+        }
+        this.pendingSurfaceSendFrames += 1;
+        this.pendingSurfaceSendBytes += plaintextBytes;
+        const send = this.surfaceSendOperations.then(async () => {
+            if (this.terminal || this.websocket.readyState !== WebSocket.OPEN) {
+                throw this.terminal ?? clientError("closed", "Browser Surface connection is not open");
+            }
+            const channel = this.surfaceChannel;
+            const context = this.surfaceContext;
+            if (!channel || !context)
+                throw clientError("protocol_error", "Surface E2EE is unavailable");
+            let sequenceConsumed = false;
+            try {
+                // Admission and serialization happen before sealing because sealing
+                // advances the strict E2EE record sequence.
+                sequenceConsumed = true;
+                const sealed = channel.sealText(plaintext, context);
+                await this.sendWire(sealed, false);
+            }
+            catch (error) {
+                const failure = normalizeError(error, "Browser Surface send failed");
+                // Once a sequence was consumed, continuing would send a permanent gap.
+                if (sequenceConsumed)
+                    this.abort(failure);
+                throw failure;
+            }
+        });
+        this.surfaceSendOperations = send.then(() => undefined, () => undefined);
+        try {
+            await send;
+        }
+        finally {
+            this.pendingSurfaceSendFrames -= 1;
+            this.pendingSurfaceSendBytes -= plaintextBytes;
+        }
+    }
+    abort(error) {
+        this.fail(error);
+        if (this.websocket.readyState !== WebSocket.CLOSED)
+            this.websocket.terminate();
+    }
+    async close() {
+        this.stopLiveness();
+        if (this.websocket.readyState === WebSocket.CLOSED)
+            return;
+        this.localClose = true;
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                if (this.websocket.readyState !== WebSocket.CLOSED)
+                    this.websocket.terminate();
+                resolve();
+            }, 1_000);
+            timer.unref?.();
+            this.websocket.once("close", () => {
+                clearTimeout(timer);
+                resolve();
+            });
+            if (this.websocket.readyState === WebSocket.CONNECTING)
+                this.websocket.terminate();
+            else
+                this.websocket.close(1000, "client closed");
+        });
+    }
+    handleWireRecord(bytes, binary) {
+        const surfaceChannel = this.surfaceChannel;
+        const context = this.surfaceContext;
+        if (surfaceChannel && context) {
+            const plaintext = binary
+                ? surfaceChannel.openBytes(bytes, context)
+                : Uint8Array.from(Buffer.from(surfaceChannel.openText(decodeText(bytes), context), "utf8"));
+            this.recordHandler?.({ bytes: plaintext, binary });
+            return;
+        }
+        if (binary)
+            throw clientError("protocol_error", "binary traffic preceded Surface activation");
+        const authenticationChannel = this.authenticationChannel;
+        if (!authenticationChannel) {
+            throw clientError("protocol_error", "server traffic preceded E2EE setup");
+        }
+        const plaintext = this.awaitingPlaintextReady
+            ? (this.awaitingPlaintextReady = false, bytes)
+            : Uint8Array.from(Buffer.from(authenticationChannel.open(decodeText(bytes)), "utf8"));
+        if (plaintext.byteLength > DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES) {
+            throw clientError("protocol_error", "Browser Surface handshake frame is too large");
+        }
+        this.deliverAuthentication(plaintext);
+    }
+    deliverAuthentication(frame) {
+        if (this.authenticationWaiter) {
+            const waiter = this.authenticationWaiter;
+            this.authenticationWaiter = undefined;
+            clearTimeout(waiter.timer);
+            waiter.resolve(frame);
+            return;
+        }
+        if (this.authenticationQueue.length >= MAX_PRE_ACTIVATION_FRAMES ||
+            this.authenticationQueuedBytes + frame.byteLength > MAX_PRE_ACTIVATION_BYTES) {
+            throw clientError("protocol_error", "too many Browser Surface handshake frames arrived");
+        }
+        this.authenticationQueue.push(frame);
+        this.authenticationQueuedBytes += frame.byteLength;
+    }
+    async sendWire(frame, binary) {
+        if (this.terminal || this.websocket.readyState !== WebSocket.OPEN) {
+            throw this.terminal ?? clientError("closed", "Browser Surface connection is not open");
+        }
+        const bytes = typeof frame === "string" ? Buffer.byteLength(frame, "utf8") : frame.byteLength;
+        if (this.pendingOutboundFrames >= MAX_PENDING_OUTBOUND_FRAMES ||
+            this.pendingOutboundBytes + bytes > MAX_PENDING_OUTBOUND_BYTES ||
+            this.websocket.bufferedAmount + bytes > MAX_PENDING_OUTBOUND_BYTES) {
+            throw clientError("unreachable", "Browser Surface outbound queue is full");
+        }
+        this.pendingOutboundFrames += 1;
+        this.pendingOutboundBytes += bytes;
+        await new Promise((resolve, reject) => {
+            const complete = (error) => {
+                this.pendingOutboundFrames -= 1;
+                this.pendingOutboundBytes -= bytes;
+                if (error)
+                    reject(this.authenticated ? closedError(error) : mapWebSocketError(error));
+                else
+                    resolve();
+            };
+            try {
+                this.websocket.send(frame, { binary, compress: false }, complete);
+            }
+            catch (error) {
+                this.pendingOutboundFrames -= 1;
+                this.pendingOutboundBytes -= bytes;
+                reject(this.authenticated ? closedError(error) : mapWebSocketError(error));
+            }
+        });
+    }
+    fail(error) {
+        if (this.terminal)
+            return;
+        this.terminal = error;
+        this.stopLiveness();
+        this.openReject(error);
+        if (this.authenticationWaiter) {
+            clearTimeout(this.authenticationWaiter.timer);
+            this.authenticationWaiter.reject(error);
+            this.authenticationWaiter = undefined;
+        }
+        this.terminalHandler?.(error);
+    }
+    noteActivity() {
+        this.lastInboundActivityAt = Date.now();
+    }
+    startLiveness() {
+        this.livenessTimer = setInterval(() => {
+            if (this.terminal)
+                return;
+            if (Date.now() - this.lastInboundActivityAt > this.liveness.inactivityTimeoutMs) {
+                this.abort(clientError(this.authenticated ? "closed" : "unreachable", "Browser Surface peer stopped responding"));
+                return;
+            }
+            if (this.websocket.readyState === WebSocket.OPEN)
+                this.websocket.ping();
+        }, this.liveness.pingIntervalMs);
+        this.livenessTimer.unref?.();
+    }
+    stopLiveness() {
+        if (this.livenessTimer)
+            clearInterval(this.livenessTimer);
+        this.livenessTimer = undefined;
+    }
+}
+function assertSurfaceHello(hello, credential) {
+    if (hello.role !== "browser-surface") {
+        throw clientError("protocol_error", "Browser Surface server.hello has the wrong role");
+    }
+    if (hello.daemonId !== credential.daemonId) {
+        throw clientError("identity_mismatch", "Browser Surface daemonId differs from the pin");
+    }
+    if (hello.identityPublicKey !== credential.identityPublicKey) {
+        throw clientError("identity_mismatch", "Browser Surface identity key differs from the pin");
+    }
+    if (hello.bindingProtocolVersion !== DIRECT_RUNTIME_BROWSER_SURFACE_BINDING_PROTOCOL.currentVersion ||
+        hello.minimumCompatibleBindingVersion !==
+            DIRECT_RUNTIME_BROWSER_SURFACE_BINDING_PROTOCOL.minimumCompatibleVersion) {
+        throw clientError("incompatible", "Browser Surface binding protocol is incompatible");
+    }
+}
+function assertSurfaceAccepted(accepted, hello, authenticate, credential) {
+    if (accepted.role !== "browser-surface" ||
+        authenticate.role !== "browser-surface" ||
+        accepted.daemonId !== hello.daemonId ||
+        accepted.daemonId !== credential.daemonId ||
+        accepted.daemonInstanceId !== hello.daemonInstanceId ||
+        accepted.bindingProtocolVersion !== authenticate.bindingProtocolVersion ||
+        accepted.coreProtocolVersion !== authenticate.coreProtocolVersion ||
+        accepted.clientId !== authenticate.clientId ||
+        accepted.grantId !== credential.grantId ||
+        accepted.authorities.length !== 1 ||
+        accepted.authorities[0] !== "daemon.full") {
+        throw clientError("authentication_failed", "Browser Surface acceptance is inconsistent");
+    }
+}
+function selectCoreProtocol(hello) {
+    if (hello.minimumCompatibleCoreVersion > REMOTE_RUNTIME_CORE_PROTOCOL.currentVersion ||
+        REMOTE_RUNTIME_CORE_PROTOCOL.minimumCompatibleVersion > hello.coreProtocolVersion) {
+        throw clientError("incompatible", "Remote Runtime Core protocol ranges do not overlap");
+    }
+    return Math.min(hello.coreProtocolVersion, REMOTE_RUNTIME_CORE_PROTOCOL.currentVersion);
+}
+function decodeHandshake(frame, expected) {
+    try {
+        return decodeDirectRuntimeFrame(frame);
+    }
+    catch (error) {
+        throw clientError("protocol_error", `invalid ${expected} frame`, error);
+    }
+}
+function browserSurfaceEndpoint(directEndpoint) {
+    const url = new URL(directEndpoint);
+    url.pathname = DIRECT_RUNTIME_BROWSER_SURFACE_PATH;
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+function withoutSignature(value) {
+    const { signature: _signature, ...fields } = value;
+    return fields;
+}
+function sha256(value) {
+    return Uint8Array.from(createHash("sha256").update(value).digest());
+}
+function parseTimeout(value) {
+    const timeout = value ?? DEFAULT_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeout) || timeout < MIN_TIMEOUT_MS || timeout > MAX_TIMEOUT_MS) {
+        throw clientError("protocol_error", `timeoutMs must be an integer between ${MIN_TIMEOUT_MS} and ${MAX_TIMEOUT_MS}`);
+    }
+    return timeout;
+}
+function parseLiveness(value) {
+    const pingIntervalMs = parseLivenessInterval(value?.pingIntervalMs, DEFAULT_PING_INTERVAL_MS, "liveness.pingIntervalMs");
+    const inactivityTimeoutMs = parseLivenessInterval(value?.inactivityTimeoutMs, DEFAULT_INACTIVITY_TIMEOUT_MS, "liveness.inactivityTimeoutMs");
+    if (inactivityTimeoutMs <= pingIntervalMs) {
+        throw clientError("protocol_error", "liveness timeout must exceed ping interval");
+    }
+    return { pingIntervalMs, inactivityTimeoutMs };
+}
+function parseLivenessInterval(value, fallback, field) {
+    const interval = value ?? fallback;
+    if (!Number.isSafeInteger(interval) || interval <= 0 || interval > MAX_LIVENESS_INTERVAL_MS) {
+        throw clientError("protocol_error", `${field} must be a bounded positive integer`);
+    }
+    return interval;
+}
+function remaining(deadline) {
+    return Math.max(1, deadline - Date.now());
+}
+function rawDataBytes(data) {
+    if (Array.isArray(data))
+        return Uint8Array.from(Buffer.concat(data));
+    if (data instanceof ArrayBuffer)
+        return new Uint8Array(data.slice(0));
+    return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+}
+function decodeText(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch (error) {
+        throw clientError("protocol_error", "Browser Surface frame must be valid UTF-8", error);
+    }
+}
+function normalizeError(error, message) {
+    return error instanceof DirectRuntimeClientError
+        ? error
+        : clientError("protocol_error", message, error);
+}
+function closedError(cause) {
+    return clientError("closed", "Browser Surface connection was interrupted", cause);
+}
+function webSocketCloseError(closeCode, reasonSuffix, localClose) {
+    if (localClose)
+        return clientError("closed", "Browser Surface connection was closed", undefined, closeCode);
+    const code = closeCode === DIRECT_RUNTIME_CLOSE_CODE.unauthorized
+        ? "authentication_failed"
+        : closeCode === DIRECT_RUNTIME_CLOSE_CODE.badProtocol
+            ? "protocol_error"
+            : closeCode === DIRECT_RUNTIME_CLOSE_CODE.authenticationTimeout ||
+                closeCode === DIRECT_RUNTIME_CLOSE_CODE.capacity
+                ? "unreachable"
+                : "closed";
+    return clientError(code, `Browser Surface connection closed (${closeCode})${reasonSuffix}`, undefined, closeCode);
+}
+function mapWebSocketError(error) {
+    const code = typeof error === "object" && error !== null && "code" in error &&
+        typeof error.code === "string" ? error.code : "";
+    if (code.startsWith("ERR_TLS_") ||
+        code.startsWith("ERR_SSL_") ||
+        code.startsWith("CERT_") ||
+        [
+            "DEPTH_ZERO_SELF_SIGNED_CERT",
+            "SELF_SIGNED_CERT_IN_CHAIN",
+            "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+            "UNABLE_TO_GET_ISSUER_CERT",
+        ].includes(code)) {
+        return clientError("tls_error", "Browser Surface TLS verification failed", error);
+    }
+    if (code === "WS_ERR_UNSUPPORTED_MESSAGE_LENGTH") {
+        return clientError("protocol_error", "Browser Surface WebSocket frame is too large", error);
+    }
+    return clientError("unreachable", "Browser Surface endpoint is unreachable", error);
+}
+function surfaceCloseErrorCode(reason) {
+    if (reason === "unauthorized")
+        return "authentication_failed";
+    if (reason === "capacity")
+        return "unreachable";
+    if (reason === "protocol_error")
+        return "protocol_error";
+    return "closed";
+}
+async function withTimeout(promise, timeoutMs, timeoutError) {
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(timeoutError()), timeoutMs);
+        timer.unref?.();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}