@rynx-ai/remote-runtime-client 0.1.9

package/dist/client.js

@@ -0,0 +1,1915 @@
+import { createHash, createPublicKey, randomBytes, sign as signPayload, verify as verifyPayload, } from "node:crypto";
+import { decodeDirectRuntimeFrame, DIRECT_RUNTIME_BINDING_PROTOCOL, DIRECT_RUNTIME_CLOSE_CODE, DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, encodeClientAuthenticateCanonical, encodeClientAuthenticateProofPayload, encodeDirectRuntimeFrame, encodeServerAcceptedProofPayload, encodeServerHelloCanonical, encodeServerHelloProofPayload, parsePairingOffer, } from "@rynx-ai/protocol/direct-runtime";
+import { assertRemoteRuntimeRpcMethodSupported, assertRemoteRuntimeSessionEventsSupported, assertRemoteRuntimeSessionTerminalSupported, encodeRemoteRuntimeSessionTerminalClientFrame, encodeRemoteRuntimeSessionEventsFrame, encodeRemoteRuntimeRpcRequest, parseRemoteRuntimeRpcResponseEnvelope, parseRemoteRuntimeRpcResponseForMethod, parseRemoteRuntimeSessionEventsFrame, parseRemoteRuntimeSessionTerminalServerFrame, REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES, REMOTE_RUNTIME_RPC_MAX_FRAME_BYTES, } from "@rynx-ai/protocol/remote-runtime-rpc";
+import { REMOTE_RUNTIME_CORE_PROTOCOL, } from "@rynx-ai/protocol/remote-runtime";
+import { encodeRuntimeEmulatorSurfaceClientFrame, parseRuntimeEmulatorSurfaceServerFrame, RUNTIME_EMULATOR_SURFACE_MAX_FRAME_BYTES, RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY, } from "@rynx-ai/protocol/runtime-emulator-surface";
+import { DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES, generateClientKeyExchange, } from "@rynx-ai/remote-runtime-e2ee";
+import WebSocket from "ws";
+import { generateDirectRuntimeClientIdentity, parseDirectRuntimeClientIdentity, parseDirectRuntimeCredential, parseDirectEndpoint, parseEd25519PublicKey, parseX25519PublicKey, } from "./credential.js";
+import { clientError, DirectRuntimeCallTransportError, DirectRuntimeClientCapacityError, DirectRuntimeClientError, DirectRuntimeRpcError, DirectRuntimeSessionEventsError, DirectRuntimeSessionTerminalError, } from "./errors.js";
+const DEFAULT_TIMEOUT_MS = 10_000;
+const MIN_TIMEOUT_MS = 100;
+const MAX_TIMEOUT_MS = 120_000;
+const DEFAULT_LIVENESS_PING_INTERVAL_MS = 10_000;
+const DEFAULT_LIVENESS_INACTIVITY_TIMEOUT_MS = 25_000;
+const MAX_LIVENESS_INTERVAL_MS = 5 * 60_000;
+const MAX_PRE_ACTIVATION_FRAMES = 4;
+const MAX_PRE_ACTIVATION_BYTES = 128 * 1024;
+// Match the server's default per-channel admission contract. These are local
+// safety ceilings even when a particular server is configured more loosely.
+const MAX_PENDING_RPCS = 32;
+const MAX_SESSION_SUBSCRIPTIONS = 16;
+const MAX_PENDING_OUTBOUND_FRAMES = 32;
+const MAX_PENDING_OUTBOUND_BYTES = 1024 * 1024;
+// Conservative upper bound for the fixed E2EE JSON fields, tag and sequence.
+const MAX_E2EE_ENVELOPE_OVERHEAD_BYTES = 256;
+const MAX_SUBSCRIPTION_QUEUED_EVENTS = 128;
+const MAX_SUBSCRIPTION_QUEUED_BYTES = 256 * 1024;
+const MAX_TERMINAL_QUEUED_OUTPUT_FRAMES = 128;
+const MAX_TERMINAL_QUEUED_OUTPUT_BYTES = 512 * 1024;
+const establishedTextDecoder = new TextDecoder("utf-8", { fatal: true });
+/** Enroll a client identity, authenticate the issued grant, and probe status. */
+export async function pairDirectRuntime(untrustedOffer, options = {}) {
+    const offer = validatedOffer(untrustedOffer, options.allowExpiredOffer);
+    const identityInput = options.identity ?? generateDirectRuntimeClientIdentity();
+    const identity = parseDirectRuntimeClientIdentity(identityInput, "authentication_failed");
+    const timeoutMs = parseTimeout(options.timeoutMs);
+    const liveness = parseClientLiveness(options.liveness);
+    const authenticated = await authenticate({
+        mode: "enroll",
+        daemonId: offer.daemonId,
+        identityPublicKey: offer.identityPublicKey,
+        serverEncryptionPublicKey: offer.serverEncryptionPublicKey,
+        directEndpoint: offer.directEndpoint,
+        claimId: offer.claimId,
+        claimSecret: offer.claimSecret,
+        identity: identity.value,
+        privateKey: identity.privateKey,
+        timeoutMs,
+        liveness,
+    });
+    const connection = new DirectRuntimeConnectionImpl(authenticated, timeoutMs);
+    const credential = {
+        version: 2,
+        daemonId: offer.daemonId,
+        identityPublicKey: offer.identityPublicKey,
+        serverEncryptionPublicKey: offer.serverEncryptionPublicKey,
+        directEndpoint: offer.directEndpoint,
+        ...identity.value,
+        grantId: authenticated.accepted.grantId,
+    };
+    try {
+        const status = await connection.status();
+        if (status.daemonId !== offer.daemonId) {
+            throw clientError("identity_mismatch", "authenticated status belongs to a different daemon");
+        }
+        return { credential, status };
+    }
+    finally {
+        await connection.close();
+    }
+}
+/** Connect once with a persisted grant. No retry or local fallback is attempted. */
+export async function connectDirectRuntime(untrustedCredential, options = {}) {
+    const credential = parseDirectRuntimeCredential(untrustedCredential);
+    const identity = parseDirectRuntimeClientIdentity(credential, "authentication_failed");
+    const timeoutMs = parseTimeout(options.timeoutMs);
+    const liveness = parseClientLiveness(options.liveness);
+    const authenticated = await authenticate({
+        mode: "connect",
+        daemonId: credential.daemonId,
+        identityPublicKey: credential.identityPublicKey,
+        serverEncryptionPublicKey: credential.serverEncryptionPublicKey,
+        directEndpoint: credential.directEndpoint,
+        grantId: credential.grantId,
+        identity: identity.value,
+        privateKey: identity.privateKey,
+        timeoutMs,
+        liveness,
+    });
+    return new DirectRuntimeConnectionImpl(authenticated, timeoutMs);
+}
+async function authenticate(input) {
+    const socket = new DirectSocket(input.directEndpoint, input.timeoutMs, input.liveness);
+    const deadline = Date.now() + input.timeoutMs;
+    try {
+        await socket.open(remaining(deadline));
+        const keyExchange = generateClientKeyExchange(input.serverEncryptionPublicKey);
+        const channelBinding = keyExchange.channelBinding;
+        await socket.startE2EE(keyExchange.channel, encodeDirectRuntimeFrame(keyExchange.clientHello));
+        const ready = parseHandshakeFrame(await socket.readFrame(DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, remaining(deadline)), "e2ee.ready");
+        if (ready.type !== "e2ee.ready") {
+            throw clientError("protocol_error", "e2ee.ready must follow e2ee.client-hello");
+        }
+        const hello = parseHandshakeFrame(await socket.readFrame(DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, remaining(deadline)), "server.hello");
+        if (hello.type !== "server.hello") {
+            throw clientError("protocol_error", "server.hello must be the first encrypted Direct frame");
+        }
+        assertHelloIdentity(hello, input);
+        const selectedBindingVersion = selectBindingProtocol(hello);
+        const selectedCoreVersion = selectCoreProtocol(hello);
+        const helloFields = withoutHelloSignature(hello);
+        const daemonKey = publicKey(input.identityPublicKey, "identity_mismatch");
+        if (!verifyPayload(null, encodeServerHelloProofPayload(channelBinding, helloFields), daemonKey, Buffer.from(hello.signature, "base64url"))) {
+            throw clientError("authentication_failed", "server.hello signature is invalid");
+        }
+        const authenticateFields = clientAuthenticateFields(input, hello, selectedBindingVersion, selectedCoreVersion);
+        const helloHash = sha256(encodeServerHelloCanonical(helloFields));
+        const authenticate = {
+            ...authenticateFields,
+            signature: signPayload(null, encodeClientAuthenticateProofPayload(channelBinding, helloHash, authenticateFields), input.privateKey).toString("base64url"),
+        };
+        const authenticateHash = sha256(encodeClientAuthenticateCanonical(authenticateFields));
+        await socket.sendText(encodeDirectRuntimeFrame(authenticate));
+        const accepted = parseHandshakeFrame(await socket.readFrame(DIRECT_RUNTIME_MAX_HANDSHAKE_FRAME_BYTES, remaining(deadline)), "server.accepted");
+        if (accepted.type !== "server.accepted") {
+            throw clientError("protocol_error", "server.accepted must follow client.authenticate");
+        }
+        assertAcceptedConsistency(accepted, hello, authenticate, input);
+        const acceptedFields = withoutAcceptedSignature(accepted);
+        if (!verifyPayload(null, encodeServerAcceptedProofPayload(channelBinding, helloHash, authenticateHash, acceptedFields), daemonKey, Buffer.from(accepted.signature, "base64url"))) {
+            throw clientError("authentication_failed", "server.accepted signature is invalid");
+        }
+        socket.markAuthenticated();
+        return { socket, hello, accepted };
+    }
+    catch (error) {
+        const normalized = normalizeHandshakeError(error);
+        socket.abort(normalized);
+        throw normalized;
+    }
+}
+class DirectRuntimeConnectionImpl {
+    channel;
+    timeoutMs;
+    pending = new Map();
+    pendingSubscriptions = new Map();
+    subscriptions = new Map();
+    subscriptionCancelTimers = new Map();
+    pendingTerminal;
+    terminal;
+    terminalCloseTimer;
+    pendingEmulatorSurface;
+    emulatorSurface;
+    statusSnapshot;
+    statusProbe;
+    closed = false;
+    constructor(channel, timeoutMs) {
+        this.channel = channel;
+        this.timeoutMs = timeoutMs;
+        channel.socket.activate((frame) => this.receive(frame), (error) => this.fail(error));
+    }
+    status() {
+        return this.call("status.get", {});
+    }
+    async call(method, params, options = {}) {
+        if (method !== "status.get") {
+            let status;
+            try {
+                status = await this.capabilityStatus(options);
+            }
+            catch (error) {
+                throw notStartedClientError(error, `Remote Runtime ${method} capability preflight failed`);
+            }
+            try {
+                assertRemoteRuntimeRpcMethodSupported(method, this.channel.accepted.coreProtocolVersion, status.semanticCapabilities);
+            }
+            catch (error) {
+                throw new DirectRuntimeClientError("incompatible", error instanceof Error ? error.message : `Remote Runtime method ${method} is unavailable`, { cause: error, outcome: "not_started" });
+            }
+        }
+        return await this.sendCall(method, params, options);
+    }
+    async sendCall(method, params, options = {}) {
+        if (this.closed) {
+            throw new DirectRuntimeClientError("closed", "Direct Runtime connection is closed", {
+                outcome: "not_started",
+            });
+        }
+        if (params === undefined && method !== "status.get") {
+            throw new DirectRuntimeClientError("protocol_error", `${method} requires an explicit params object`, { outcome: "not_started" });
+        }
+        if (this.pending.size >= MAX_PENDING_RPCS) {
+            throw new DirectRuntimeClientCapacityError("pending_rpc", MAX_PENDING_RPCS, `Direct Runtime client admits at most ${MAX_PENDING_RPCS} pending RPCs per connection`);
+        }
+        const id = `rpc_${randomBytes(18).toString("base64url")}`;
+        let frame;
+        try {
+            frame = encodeRemoteRuntimeRpcRequest({
+                type: "rpc.request",
+                id,
+                method,
+                params: params ?? {},
+            });
+        }
+        catch (error) {
+            throw new DirectRuntimeClientError("protocol_error", `invalid ${method} RPC params`, {
+                cause: error,
+                outcome: "not_started",
+            });
+        }
+        const timeoutMs = parseTimeout(options.timeoutMs ?? this.timeoutMs);
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(callTransportError(clientError("deadline_exceeded", "Direct Runtime RPC timed out"), method, id));
+            }, timeoutMs);
+            timer.unref?.();
+            this.pending.set(id, { method, resolve, reject, timer });
+            void this.channel.socket.sendText(frame).catch((error) => {
+                const pending = this.pending.get(id);
+                if (!pending)
+                    return;
+                this.pending.delete(id);
+                clearTimeout(pending.timer);
+                pending.reject(error instanceof DirectRuntimeClientCapacityError
+                    ? error
+                    : callTransportError(error, pending.method, id));
+            });
+        });
+    }
+    capabilityStatus(options = {}) {
+        if (this.statusSnapshot)
+            return Promise.resolve(this.statusSnapshot);
+        if (!this.statusProbe) {
+            this.statusProbe = this.sendCall("status.get", {}, options).finally(() => {
+                this.statusProbe = undefined;
+            });
+        }
+        return this.statusProbe;
+    }
+    async subscribeSessionEvents(sessionId, options = {}) {
+        if (this.closed) {
+            throw new DirectRuntimeClientError("closed", "Direct Runtime connection is closed", {
+                outcome: "not_started",
+            });
+        }
+        let status;
+        try {
+            status = await this.capabilityStatus(options);
+        }
+        catch (error) {
+            throw notStartedClientError(error, "Remote Runtime Session events capability preflight failed");
+        }
+        try {
+            assertRemoteRuntimeSessionEventsSupported(this.channel.accepted.coreProtocolVersion, status.semanticCapabilities);
+        }
+        catch (error) {
+            throw new DirectRuntimeClientError("incompatible", error instanceof Error ? error.message : "Remote Runtime Session events are unavailable", { cause: error, outcome: "not_started" });
+        }
+        if (this.pendingSubscriptions.size + this.subscriptions.size >=
+            MAX_SESSION_SUBSCRIPTIONS) {
+            throw new DirectRuntimeClientCapacityError("session_subscription", MAX_SESSION_SUBSCRIPTIONS, `Direct Runtime client admits at most ${MAX_SESSION_SUBSCRIPTIONS} opening or active Session subscriptions per connection`);
+        }
+        const subscriptionId = `sub_${randomBytes(18).toString("base64url")}`;
+        let frame;
+        try {
+            frame = encodeRemoteRuntimeSessionEventsFrame({
+                type: "session.events.subscribe",
+                subscriptionId,
+                sessionId,
+            });
+        }
+        catch (error) {
+            throw new DirectRuntimeClientError("protocol_error", "invalid Remote Session subscription", {
+                cause: error,
+                outcome: "not_started",
+            });
+        }
+        const timeoutMs = parseTimeout(options.timeoutMs ?? this.timeoutMs);
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                const pending = this.pendingSubscriptions.get(subscriptionId);
+                if (!pending)
+                    return;
+                this.pendingSubscriptions.delete(subscriptionId);
+                const timeout = clientError("deadline_exceeded", "Remote Session subscription acceptance timed out");
+                pending.reject(timeout);
+                this.fail(timeout);
+            }, timeoutMs);
+            timer.unref?.();
+            this.pendingSubscriptions.set(subscriptionId, {
+                sessionId,
+                timeoutMs,
+                resolve,
+                reject,
+                timer,
+            });
+            void this.channel.socket.sendText(frame).catch((error) => {
+                if (error instanceof DirectRuntimeClientCapacityError) {
+                    const pending = this.pendingSubscriptions.get(subscriptionId);
+                    if (!pending)
+                        return;
+                    this.pendingSubscriptions.delete(subscriptionId);
+                    clearTimeout(pending.timer);
+                    pending.reject(error);
+                    return;
+                }
+                this.fail(error);
+            });
+        });
+    }
+    async openSessionTerminal(sessionId, options) {
+        if (this.closed) {
+            throw new DirectRuntimeClientError("closed", "Direct Runtime connection is closed", {
+                outcome: "not_started",
+            });
+        }
+        if (this.pendingTerminal || this.terminal) {
+            throw new DirectRuntimeClientCapacityError("session_terminal", 1, "Direct Runtime V1 admits one Session terminal per connection");
+        }
+        let status;
+        try {
+            status = await this.capabilityStatus(options);
+        }
+        catch (error) {
+            throw notStartedClientError(error, "Remote Runtime Session Terminal capability preflight failed");
+        }
+        try {
+            assertRemoteRuntimeSessionTerminalSupported(this.channel.accepted.coreProtocolVersion, status.semanticCapabilities);
+        }
+        catch (error) {
+            throw new DirectRuntimeClientError("incompatible", error instanceof Error ? error.message : "Remote Runtime Session Terminal is unavailable", { cause: error, outcome: "not_started" });
+        }
+        const attachmentId = `term_${randomBytes(18).toString("base64url")}`;
+        let frame;
+        try {
+            frame = encodeRemoteRuntimeSessionTerminalClientFrame({
+                type: "session.terminal.open",
+                attachmentId,
+                sessionId,
+                role: options.role,
+                cols: options.cols,
+                rows: options.rows,
+            });
+        }
+        catch (error) {
+            throw new DirectRuntimeClientError("protocol_error", "invalid Remote Session terminal open", {
+                cause: error,
+                outcome: "not_started",
+            });
+        }
+        const timeoutMs = parseTimeout(options.timeoutMs ?? this.timeoutMs);
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                if (this.pendingTerminal?.attachmentId !== attachmentId)
+                    return;
+                this.pendingTerminal = undefined;
+                const timeout = clientError("deadline_exceeded", "Remote Session terminal acceptance timed out");
+                reject(timeout);
+                this.fail(timeout);
+            }, timeoutMs);
+            timer.unref?.();
+            this.pendingTerminal = {
+                attachmentId,
+                sessionId,
+                timeoutMs,
+                resolve,
+                reject,
+                timer,
+            };
+            void this.channel.socket.sendText(frame).catch((error) => {
+                const pending = this.pendingTerminal;
+                if (pending?.attachmentId !== attachmentId)
+                    return;
+                this.pendingTerminal = undefined;
+                clearTimeout(pending.timer);
+                pending.reject(error);
+            });
+        });
+    }
+    async openEmulatorSurface(sessionId, bindingId, options = {}) {
+        if (this.closed)
+            throw clientError("closed", "Direct Runtime connection is closed");
+        if (this.pendingEmulatorSurface || this.emulatorSurface) {
+            throw new DirectRuntimeClientCapacityError("emulator_surface", 1, "Direct Runtime client admits one Emulator Surface per connection");
+        }
+        const status = await this.capabilityStatus({ timeoutMs: options.timeoutMs });
+        if (!status.semanticCapabilities.includes(RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY)) {
+            throw new DirectRuntimeClientError("incompatible", `Remote Runtime Emulator Surface requires semantic capability ${RUNTIME_EMULATOR_SURFACE_SEMANTIC_CAPABILITY}`, { outcome: "not_started" });
+        }
+        // capabilityStatus is asynchronous. Recheck the one-slot admission after
+        // it resolves so two concurrent callers cannot both pass the preflight and
+        // overwrite the single pending Surface (which would orphan one Promise).
+        if (this.pendingEmulatorSurface || this.emulatorSurface) {
+            throw new DirectRuntimeClientCapacityError("emulator_surface", 1, "Direct Runtime client admits one Emulator Surface per connection");
+        }
+        const surfaceId = `emu_${randomBytes(18).toString("base64url")}`;
+        const maximumFrameRate = options.maximumFrameRate ?? 3;
+        let encoded;
+        try {
+            encoded = encodeRuntimeEmulatorSurfaceClientFrame({
+                type: "emulator.surface.open",
+                surfaceId,
+                sessionId,
+                bindingId,
+                maximumFrameRate,
+            });
+        }
+        catch (error) {
+            throw clientError("protocol_error", "invalid Emulator Surface open request", error);
+        }
+        const timeoutMs = parseTimeout(options.timeoutMs ?? this.timeoutMs);
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                if (this.pendingEmulatorSurface?.surfaceId !== surfaceId)
+                    return;
+                this.pendingEmulatorSurface = undefined;
+                const error = clientError("deadline_exceeded", "Emulator Surface open timed out");
+                reject(error);
+                this.fail(error);
+            }, timeoutMs);
+            timer.unref?.();
+            this.pendingEmulatorSurface = {
+                surfaceId,
+                sessionId,
+                bindingId,
+                timeoutMs,
+                timer,
+                resolve,
+                reject,
+            };
+            void this.channel.socket.sendText(encoded).catch((error) => {
+                const pending = this.pendingEmulatorSurface;
+                if (pending?.surfaceId !== surfaceId)
+                    return;
+                this.pendingEmulatorSurface = undefined;
+                clearTimeout(pending.timer);
+                pending.reject(error);
+            });
+        });
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const closed = clientError("closed", "Direct Runtime connection was closed");
+        this.rejectPending(closed);
+        this.terminateSubscriptions(closed);
+        this.terminateTerminal(closed);
+        this.terminateEmulatorSurface(closed);
+        await this.channel.socket.close();
+    }
+    receive(frame) {
+        let value;
+        try {
+            value = decodeEstablishedFrame(frame);
+        }
+        catch (error) {
+            this.fail(clientError("protocol_error", "invalid Remote Runtime frame", error));
+            return;
+        }
+        switch (value.type) {
+            case "rpc.result":
+            case "rpc.error":
+                this.receiveRpc(value);
+                return;
+            case "session.events.accepted":
+            case "session.events.event":
+            case "session.events.closed":
+                this.receiveSessionFrame(value, frame.byteLength);
+                return;
+            case "session.terminal.opened":
+            case "session.terminal.output":
+            case "session.terminal.closed":
+                this.receiveTerminalFrame(value);
+                return;
+            case "emulator.surface.ready":
+            case "emulator.surface.frame.chunk":
+            case "emulator.surface.closed":
+                this.receiveEmulatorSurfaceFrame(value);
+                return;
+            default:
+                this.fail(clientError("protocol_error", "unknown Remote Runtime frame type"));
+        }
+    }
+    receiveRpc(value) {
+        let envelope;
+        try {
+            envelope = parseRemoteRuntimeRpcResponseEnvelope(value);
+        }
+        catch (error) {
+            this.fail(clientError("protocol_error", "invalid Remote Runtime RPC response", error));
+            return;
+        }
+        const pending = this.pending.get(envelope.id);
+        if (!pending) {
+            this.fail(clientError("protocol_error", "RPC response has no pending request"));
+            return;
+        }
+        this.pending.delete(envelope.id);
+        clearTimeout(pending.timer);
+        let response;
+        try {
+            response = parseRemoteRuntimeRpcResponseForMethod(envelope, pending.method);
+        }
+        catch (error) {
+            const invalid = clientError("protocol_error", `invalid ${pending.method} Remote Runtime RPC result`, error);
+            pending.reject(callTransportError(invalid, pending.method, envelope.id));
+            this.fail(invalid);
+            return;
+        }
+        if (response.type === "rpc.error") {
+            const error = new DirectRuntimeRpcError(response.error.code, pending.method, response.id, `Remote Runtime RPC failed: ${response.error.code}: ${response.error.message}`);
+            pending.reject(error);
+            if (response.error.code === "unauthorized") {
+                this.fail(clientError("authentication_failed", "Remote Runtime revoked authorization for the active connection", error));
+            }
+            return;
+        }
+        try {
+            if (pending.method === "status.get") {
+                const status = response.result;
+                this.assertStatusConsistency(status);
+                this.statusSnapshot = {
+                    ...status,
+                    semanticCapabilities: [...status.semanticCapabilities],
+                };
+            }
+            pending.resolve(response.result);
+        }
+        catch (error) {
+            pending.reject(error);
+            this.fail(error);
+        }
+    }
+    receiveSessionFrame(value, frameBytes) {
+        let frame;
+        try {
+            const parsed = parseRemoteRuntimeSessionEventsFrame(value);
+            if (parsed.type === "session.events.subscribe" || parsed.type === "session.events.cancel") {
+                throw new Error("server sent a client-only Session events frame");
+            }
+            frame = parsed;
+        }
+        catch (error) {
+            this.fail(clientError("protocol_error", "invalid Remote Session events frame", error));
+            return;
+        }
+        switch (frame.type) {
+            case "session.events.accepted":
+                this.acceptSubscription(frame);
+                return;
+            case "session.events.event": {
+                const subscription = this.subscriptions.get(frame.subscriptionId);
+                if (!subscription) {
+                    this.fail(clientError("protocol_error", "Session event has no active subscription"));
+                    return;
+                }
+                subscription.push(frame.event, frameBytes);
+                return;
+            }
+            case "session.events.closed":
+                this.closeSubscriptionFromRemote(frame);
+        }
+    }
+    acceptSubscription(frame) {
+        const pending = this.pendingSubscriptions.get(frame.subscriptionId);
+        if (!pending) {
+            this.fail(clientError("protocol_error", "Session acceptance has no pending subscription"));
+            return;
+        }
+        if (frame.sessionId !== pending.sessionId) {
+            this.fail(clientError("protocol_error", "Session acceptance changed the requested sessionId"));
+            return;
+        }
+        if (frame.daemonInstanceId !== this.channel.hello.daemonInstanceId) {
+            this.fail(clientError("protocol_error", "Session acceptance changed daemonInstanceId"));
+            return;
+        }
+        this.pendingSubscriptions.delete(frame.subscriptionId);
+        clearTimeout(pending.timer);
+        const subscription = new SessionEventsSubscriptionImpl(frame.subscriptionId, frame.sessionId, frame.daemonInstanceId, pending.timeoutMs, () => this.cancelSubscription(frame.subscriptionId), () => {
+            void this.cancelSubscription(frame.subscriptionId, true).catch(() => undefined);
+        });
+        this.subscriptions.set(frame.subscriptionId, subscription);
+        pending.resolve(subscription);
+    }
+    closeSubscriptionFromRemote(frame) {
+        const pending = this.pendingSubscriptions.get(frame.subscriptionId);
+        if (pending) {
+            this.pendingSubscriptions.delete(frame.subscriptionId);
+            clearTimeout(pending.timer);
+            pending.reject(sessionEventsError(frame, pending.sessionId));
+            return;
+        }
+        const subscription = this.subscriptions.get(frame.subscriptionId);
+        if (!subscription) {
+            this.fail(clientError("protocol_error", "Session closure has no active subscription"));
+            return;
+        }
+        this.subscriptions.delete(frame.subscriptionId);
+        const timer = this.subscriptionCancelTimers.get(frame.subscriptionId);
+        if (timer)
+            clearTimeout(timer);
+        this.subscriptionCancelTimers.delete(frame.subscriptionId);
+        subscription.remoteClose(frame);
+    }
+    receiveTerminalFrame(value) {
+        let frame;
+        try {
+            frame = parseRemoteRuntimeSessionTerminalServerFrame(value);
+        }
+        catch (error) {
+            this.fail(clientError("protocol_error", "invalid Remote Session terminal frame", error));
+            return;
+        }
+        switch (frame.type) {
+            case "session.terminal.opened":
+                this.acceptTerminal(frame);
+                return;
+            case "session.terminal.output": {
+                const terminal = this.terminal;
+                if (!terminal || terminal.attachmentId !== frame.attachmentId) {
+                    this.fail(clientError("protocol_error", "Terminal output has no active attachment"));
+                    return;
+                }
+                terminal.push(Uint8Array.from(Buffer.from(frame.data, "base64")));
+                return;
+            }
+            case "session.terminal.closed":
+                this.closeTerminalFromRemote(frame);
+        }
+    }
+    acceptTerminal(frame) {
+        const pending = this.pendingTerminal;
+        if (!pending || pending.attachmentId !== frame.attachmentId) {
+            this.fail(clientError("protocol_error", "Terminal acceptance has no pending attachment"));
+            return;
+        }
+        if (frame.sessionId !== pending.sessionId) {
+            this.fail(clientError("protocol_error", "Terminal acceptance changed the requested sessionId"));
+            return;
+        }
+        this.pendingTerminal = undefined;
+        clearTimeout(pending.timer);
+        const terminal = new SessionTerminalImpl(frame, pending.timeoutMs, (data) => this.writeTerminal(frame.attachmentId, data), (cols, rows) => this.resizeTerminal(frame.attachmentId, cols, rows), () => this.closeTerminal(frame.attachmentId), (error) => this.fail(error));
+        this.terminal = terminal;
+        pending.resolve(terminal);
+    }
+    closeTerminalFromRemote(frame) {
+        const pending = this.pendingTerminal;
+        if (pending?.attachmentId === frame.attachmentId) {
+            this.pendingTerminal = undefined;
+            clearTimeout(pending.timer);
+            pending.reject(sessionTerminalError(frame, pending.sessionId));
+            return;
+        }
+        const terminal = this.terminal;
+        if (!terminal || terminal.attachmentId !== frame.attachmentId) {
+            this.fail(clientError("protocol_error", "Terminal closure has no active attachment"));
+            return;
+        }
+        this.terminal = undefined;
+        if (this.terminalCloseTimer)
+            clearTimeout(this.terminalCloseTimer);
+        this.terminalCloseTimer = undefined;
+        terminal.remoteClose(frame);
+    }
+    receiveEmulatorSurfaceFrame(value) {
+        let frame;
+        try {
+            frame = parseRuntimeEmulatorSurfaceServerFrame(value);
+        }
+        catch (error) {
+            this.fail(clientError("protocol_error", "invalid Emulator Surface frame", error));
+            return;
+        }
+        if (frame.type === "emulator.surface.ready") {
+            const pending = this.pendingEmulatorSurface;
+            if (!pending || pending.surfaceId !== frame.surfaceId) {
+                this.fail(clientError("protocol_error", "Emulator Surface ready has no pending open"));
+                return;
+            }
+            if (pending.sessionId !== frame.sessionId || pending.bindingId !== frame.bindingId) {
+                this.fail(clientError("protocol_error", "Emulator Surface ready changed its identity"));
+                return;
+            }
+            this.pendingEmulatorSurface = undefined;
+            clearTimeout(pending.timer);
+            const surface = new EmulatorSurfaceImpl(frame, (sequence) => this.ackEmulatorSurface(frame.surfaceId, sequence), (inputSequence, point) => this.sendEmulatorSurfaceTouch(frame.surfaceId, inputSequence, point), () => this.closeEmulatorSurface(frame.surfaceId), (error) => this.fail(error));
+            this.emulatorSurface = surface;
+            pending.resolve(surface);
+            return;
+        }
+        if (frame.type === "emulator.surface.frame.chunk") {
+            const surface = this.emulatorSurface;
+            if (!surface || surface.surfaceId !== frame.surfaceId) {
+                this.fail(clientError("protocol_error", "Emulator Surface chunk has no active Surface"));
+                return;
+            }
+            surface.push(frame);
+            return;
+        }
+        const pending = this.pendingEmulatorSurface;
+        if (pending?.surfaceId === frame.surfaceId) {
+            this.pendingEmulatorSurface = undefined;
+            clearTimeout(pending.timer);
+            pending.reject(emulatorSurfaceError(frame));
+            return;
+        }
+        const surface = this.emulatorSurface;
+        if (!surface || surface.surfaceId !== frame.surfaceId) {
+            this.fail(clientError("protocol_error", "Emulator Surface close has no active Surface"));
+            return;
+        }
+        this.emulatorSurface = undefined;
+        surface.remoteClose(frame);
+    }
+    async ackEmulatorSurface(surfaceId, frameSequence) {
+        if (this.emulatorSurface?.surfaceId !== surfaceId)
+            return;
+        await this.channel.socket.sendText(encodeRuntimeEmulatorSurfaceClientFrame({
+            type: "emulator.surface.frame.ack",
+            surfaceId,
+            frameSequence,
+        }));
+    }
+    async closeEmulatorSurface(surfaceId) {
+        const surface = this.emulatorSurface;
+        if (!surface || surface.surfaceId !== surfaceId)
+            return;
+        await this.channel.socket.sendText(encodeRuntimeEmulatorSurfaceClientFrame({
+            type: "emulator.surface.close",
+            surfaceId,
+        }));
+        await surface.closed;
+    }
+    async sendEmulatorSurfaceTouch(surfaceId, inputSequence, point) {
+        if (this.emulatorSurface?.surfaceId !== surfaceId) {
+            throw clientError("closed", "Emulator Surface is closed");
+        }
+        await this.channel.socket.sendText(encodeRuntimeEmulatorSurfaceClientFrame({
+            type: "emulator.surface.touch",
+            surfaceId,
+            inputSequence,
+            ...point,
+        }));
+    }
+    async writeTerminal(attachmentId, data) {
+        if (data.byteLength === 0)
+            return;
+        for (let offset = 0; offset < data.byteLength; offset += REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES) {
+            const chunk = data.subarray(offset, Math.min(offset + REMOTE_RUNTIME_SESSION_TERMINAL_MAX_DATA_BYTES, data.byteLength));
+            const frame = encodeRemoteRuntimeSessionTerminalClientFrame({
+                type: "session.terminal.input",
+                attachmentId,
+                data: Buffer.from(chunk).toString("base64"),
+            });
+            await this.channel.socket.sendText(frame);
+        }
+    }
+    async resizeTerminal(attachmentId, cols, rows) {
+        const frame = encodeRemoteRuntimeSessionTerminalClientFrame({
+            type: "session.terminal.resize",
+            attachmentId,
+            cols,
+            rows,
+        });
+        await this.channel.socket.sendText(frame);
+    }
+    async closeTerminal(attachmentId) {
+        const terminal = this.terminal;
+        if (!terminal || terminal.attachmentId !== attachmentId)
+            return;
+        if (terminal.beginClose()) {
+            const frame = encodeRemoteRuntimeSessionTerminalClientFrame({
+                type: "session.terminal.close",
+                attachmentId,
+            });
+            this.terminalCloseTimer = setTimeout(() => {
+                if (this.terminal?.attachmentId !== attachmentId)
+                    return;
+                this.fail(clientError("deadline_exceeded", "Remote Session terminal close acknowledgement timed out"));
+            }, terminal.timeoutMs);
+            this.terminalCloseTimer.unref?.();
+            try {
+                await this.channel.socket.sendText(frame);
+            }
+            catch (error) {
+                this.fail(error);
+            }
+        }
+        await terminal.waitClosed();
+    }
+    async cancelSubscription(subscriptionId, force = false) {
+        const subscription = this.subscriptions.get(subscriptionId);
+        if (!subscription)
+            return;
+        if (force || subscription.beginCancel()) {
+            let frame;
+            try {
+                frame = encodeRemoteRuntimeSessionEventsFrame({
+                    type: "session.events.cancel",
+                    subscriptionId,
+                });
+            }
+            catch (error) {
+                this.fail(clientError("protocol_error", "invalid Remote Session cancellation", error));
+                return await subscription.waitClosed();
+            }
+            const timer = setTimeout(() => {
+                if (!this.subscriptions.has(subscriptionId))
+                    return;
+                this.fail(clientError("deadline_exceeded", "Remote Session cancellation acknowledgement timed out"));
+            }, subscription.timeoutMs);
+            timer.unref?.();
+            this.subscriptionCancelTimers.set(subscriptionId, timer);
+            void this.channel.socket.sendText(frame).catch((error) => this.fail(error));
+        }
+        await subscription.waitClosed();
+    }
+    assertStatusConsistency(status) {
+        const { hello, accepted } = this.channel;
+        if (status.daemonId !== hello.daemonId) {
+            throw clientError("identity_mismatch", "status daemonId differs from the pinned daemon");
+        }
+        if (status.daemonInstanceId !== hello.daemonInstanceId) {
+            throw clientError("protocol_error", "status daemonInstanceId differs from the handshake");
+        }
+        if (status.coreProtocolVersion !== hello.coreProtocolVersion ||
+            status.minimumCompatibleCoreVersion !== hello.minimumCompatibleCoreVersion ||
+            accepted.coreProtocolVersion < status.minimumCompatibleCoreVersion ||
+            accepted.coreProtocolVersion > status.coreProtocolVersion) {
+            throw clientError("protocol_error", "status Core protocol range differs from the handshake");
+        }
+    }
+    fail(error) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const normalized = normalizeEstablishedError(error);
+        this.rejectPending(normalized);
+        this.terminateSubscriptions(normalized);
+        this.terminateTerminal(normalized);
+        this.terminateEmulatorSurface(normalized);
+        this.channel.socket.abort(normalized);
+    }
+    rejectPending(error) {
+        for (const [id, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(callTransportError(error, pending.method, id));
+        }
+        this.pending.clear();
+    }
+    terminateSubscriptions(error) {
+        for (const pending of this.pendingSubscriptions.values()) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.pendingSubscriptions.clear();
+        for (const timer of this.subscriptionCancelTimers.values())
+            clearTimeout(timer);
+        this.subscriptionCancelTimers.clear();
+        for (const subscription of this.subscriptions.values())
+            subscription.terminate(error);
+        this.subscriptions.clear();
+    }
+    terminateTerminal(error) {
+        const pending = this.pendingTerminal;
+        this.pendingTerminal = undefined;
+        if (pending) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        if (this.terminalCloseTimer)
+            clearTimeout(this.terminalCloseTimer);
+        this.terminalCloseTimer = undefined;
+        this.terminal?.terminate(error);
+        this.terminal = undefined;
+    }
+    terminateEmulatorSurface(error) {
+        const pending = this.pendingEmulatorSurface;
+        this.pendingEmulatorSurface = undefined;
+        if (pending) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+        }
+        this.emulatorSurface?.terminate(error);
+        this.emulatorSurface = undefined;
+    }
+}
+class EmulatorSurfaceImpl {
+    ready;
+    acknowledge;
+    sendInput;
+    requestClose;
+    reportFatal;
+    assembling;
+    queued;
+    waiter;
+    ended = false;
+    terminalError;
+    closing = false;
+    inputSequence = 0;
+    inputTail = Promise.resolve();
+    closedPromise;
+    resolveClosed;
+    rejectClosed;
+    constructor(ready, acknowledge, sendInput, requestClose, reportFatal) {
+        this.ready = ready;
+        this.acknowledge = acknowledge;
+        this.sendInput = sendInput;
+        this.requestClose = requestClose;
+        this.reportFatal = reportFatal;
+        this.closedPromise = new Promise((resolve, reject) => {
+            this.resolveClosed = resolve;
+            this.rejectClosed = reject;
+        });
+    }
+    get surfaceId() { return this.ready.surfaceId; }
+    get sessionId() { return this.ready.sessionId; }
+    get bindingId() { return this.ready.bindingId; }
+    get closed() { return this.closedPromise; }
+    [Symbol.asyncIterator]() { return this; }
+    next() {
+        const queued = this.queued;
+        if (queued) {
+            this.queued = undefined;
+            this.delivered(queued);
+            return Promise.resolve({ done: false, value: queued });
+        }
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        if (this.ended)
+            return Promise.resolve({ done: true, value: undefined });
+        if (this.waiter)
+            return Promise.reject(clientError("protocol_error", "concurrent Emulator Surface reads are not allowed"));
+        return new Promise((resolve, reject) => { this.waiter = { resolve, reject }; });
+    }
+    async return() {
+        await this.close();
+        return { done: true, value: undefined };
+    }
+    async close() {
+        if (this.ended || this.closing)
+            return;
+        this.closing = true;
+        await this.requestClose();
+    }
+    sendTouch(point) {
+        if (this.ended || this.closing)
+            return Promise.reject(clientError("closed", "Emulator Surface is closed"));
+        const inputSequence = this.inputSequence;
+        this.inputSequence += 1;
+        const sending = this.inputTail.then(() => this.sendInput(inputSequence, point));
+        this.inputTail = sending.catch(() => undefined);
+        return sending;
+    }
+    push(chunk) {
+        if (this.ended || this.closing)
+            return;
+        let assembling = this.assembling;
+        if (!assembling) {
+            if (chunk.chunkIndex !== 0)
+                return this.fatal("Emulator Surface frame did not start at chunk zero");
+            assembling = {
+                sequence: chunk.frameSequence,
+                timestampMilliseconds: chunk.timestampMilliseconds,
+                chunkCount: chunk.chunkCount,
+                nextChunkIndex: 0,
+                chunks: [],
+                bytes: 0,
+            };
+            this.assembling = assembling;
+        }
+        if (chunk.frameSequence !== assembling.sequence ||
+            chunk.timestampMilliseconds !== assembling.timestampMilliseconds ||
+            chunk.chunkCount !== assembling.chunkCount ||
+            chunk.chunkIndex !== assembling.nextChunkIndex)
+            return this.fatal("Emulator Surface chunks are out of order");
+        const bytes = Uint8Array.from(Buffer.from(chunk.data, "base64"));
+        assembling.bytes += bytes.byteLength;
+        if (assembling.bytes > RUNTIME_EMULATOR_SURFACE_MAX_FRAME_BYTES) {
+            return this.fatal("Emulator Surface frame exceeds the client bound");
+        }
+        assembling.chunks.push(bytes);
+        assembling.nextChunkIndex += 1;
+        if (assembling.nextChunkIndex !== assembling.chunkCount)
+            return;
+        const encodedBytes = new Uint8Array(assembling.bytes);
+        let offset = 0;
+        for (const part of assembling.chunks) {
+            encodedBytes.set(part, offset);
+            offset += part.byteLength;
+        }
+        const frame = {
+            surfaceId: this.surfaceId,
+            frameSequence: assembling.sequence,
+            timestampMilliseconds: assembling.timestampMilliseconds,
+            format: this.ready.format,
+            encodedBytes,
+        };
+        this.assembling = undefined;
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            this.delivered(frame);
+            waiter.resolve({ done: false, value: frame });
+            return;
+        }
+        if (this.queued)
+            return this.fatal("Emulator Surface consumer exceeded the one-frame queue");
+        this.queued = frame;
+    }
+    remoteClose(frame) {
+        if (this.ended)
+            return;
+        this.resolveClosed(frame);
+        if (frame.reason === "client_closed")
+            this.finish();
+        else
+            this.finish(emulatorSurfaceError(frame));
+    }
+    terminate(error) {
+        if (this.ended)
+            return;
+        this.rejectClosed(error);
+        this.finish(error);
+    }
+    delivered(frame) {
+        void this.acknowledge(frame.frameSequence).catch((error) => this.reportFatal(error));
+    }
+    fatal(message) {
+        const error = clientError("protocol_error", message);
+        this.finish(error);
+        this.reportFatal(error);
+    }
+    finish(error) {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.terminalError = error;
+        this.assembling = undefined;
+        this.queued = undefined;
+        const waiter = this.waiter;
+        this.waiter = undefined;
+        if (waiter) {
+            if (error)
+                waiter.reject(error);
+            else
+                waiter.resolve({ done: true, value: undefined });
+        }
+    }
+}
+class SessionEventsSubscriptionImpl {
+    subscriptionId;
+    sessionId;
+    daemonInstanceId;
+    timeoutMs;
+    requestCancel;
+    reportBackpressure;
+    queue = [];
+    queuedBytes = 0;
+    waiter;
+    terminalError;
+    ended = false;
+    cancelling = false;
+    closedPromise;
+    resolveClosed;
+    constructor(subscriptionId, sessionId, daemonInstanceId, timeoutMs, requestCancel, reportBackpressure) {
+        this.subscriptionId = subscriptionId;
+        this.sessionId = sessionId;
+        this.daemonInstanceId = daemonInstanceId;
+        this.timeoutMs = timeoutMs;
+        this.requestCancel = requestCancel;
+        this.reportBackpressure = reportBackpressure;
+        this.closedPromise = new Promise((resolve) => {
+            this.resolveClosed = resolve;
+        });
+    }
+    [Symbol.asyncIterator]() {
+        return this;
+    }
+    next() {
+        const queued = this.queue.shift();
+        if (queued) {
+            this.queuedBytes -= queued.bytes;
+            return Promise.resolve({ done: false, value: queued.event });
+        }
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        if (this.ended)
+            return Promise.resolve({ done: true, value: undefined });
+        if (this.waiter) {
+            return Promise.reject(clientError("protocol_error", "concurrent reads from one Session subscription are not allowed"));
+        }
+        return new Promise((resolve, reject) => {
+            this.waiter = { resolve, reject };
+        });
+    }
+    async return() {
+        await this.close();
+        return { done: true, value: undefined };
+    }
+    async close() {
+        if (this.ended)
+            return;
+        await this.requestCancel();
+    }
+    push(event, frameBytes) {
+        if (this.ended || this.cancelling)
+            return;
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            waiter.resolve({ done: false, value: event });
+            return;
+        }
+        if (this.queue.length >= MAX_SUBSCRIPTION_QUEUED_EVENTS ||
+            this.queuedBytes + frameBytes > MAX_SUBSCRIPTION_QUEUED_BYTES) {
+            this.cancelling = true;
+            this.finish(new DirectRuntimeSessionEventsError("backpressure", this.subscriptionId, this.sessionId, "Remote Session event queue exceeded its bounded client capacity"), true);
+            this.reportBackpressure();
+            return;
+        }
+        this.queue.push({ event, bytes: frameBytes });
+        this.queuedBytes += frameBytes;
+    }
+    beginCancel() {
+        if (this.ended || this.cancelling)
+            return false;
+        this.cancelling = true;
+        this.clearQueue();
+        return true;
+    }
+    remoteClose(frame) {
+        if (this.ended)
+            return;
+        if (frame.reason === "cancelled" || frame.reason === "session_closed") {
+            this.finish();
+            return;
+        }
+        this.finish(sessionEventsError(frame, this.sessionId));
+    }
+    terminate(error) {
+        this.finish(error, true);
+    }
+    waitClosed() {
+        return this.closedPromise;
+    }
+    finish(error, discardQueue = false) {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.terminalError = error;
+        if (discardQueue)
+            this.clearQueue();
+        const waiter = this.waiter;
+        this.waiter = undefined;
+        if (waiter) {
+            if (error === undefined)
+                waiter.resolve({ done: true, value: undefined });
+            else
+                waiter.reject(error);
+        }
+        this.resolveClosed();
+    }
+    clearQueue() {
+        this.queue.length = 0;
+        this.queuedBytes = 0;
+    }
+}
+function sessionEventsError(frame, sessionId) {
+    const suffix = frame.message === undefined ? "" : `: ${frame.message}`;
+    return new DirectRuntimeSessionEventsError(frame.reason, frame.subscriptionId, sessionId, `Remote Session events subscription closed (${frame.reason})${suffix}`);
+}
+class SessionTerminalImpl {
+    timeoutMs;
+    sendInput;
+    sendResize;
+    requestClose;
+    reportBackpressure;
+    queue = [];
+    queuedBytes = 0;
+    waiter;
+    terminalError;
+    ended = false;
+    closing = false;
+    resolveClosed;
+    rejectClosed;
+    closed;
+    attachmentId;
+    sessionId;
+    role;
+    constructor(opened, timeoutMs, sendInput, sendResize, requestClose, reportBackpressure) {
+        this.timeoutMs = timeoutMs;
+        this.sendInput = sendInput;
+        this.sendResize = sendResize;
+        this.requestClose = requestClose;
+        this.reportBackpressure = reportBackpressure;
+        this.attachmentId = opened.attachmentId;
+        this.sessionId = opened.sessionId;
+        this.role = opened.role;
+        let resolveClosed;
+        let rejectClosed;
+        this.closed = new Promise((resolve, reject) => {
+            resolveClosed = resolve;
+            rejectClosed = reject;
+        });
+        this.resolveClosed = resolveClosed;
+        this.rejectClosed = rejectClosed;
+        void this.closed.catch(() => undefined);
+    }
+    [Symbol.asyncIterator]() {
+        return this;
+    }
+    next() {
+        const queued = this.queue.shift();
+        if (queued) {
+            this.queuedBytes -= queued.bytes;
+            return Promise.resolve({ done: false, value: queued.data });
+        }
+        if (this.terminalError !== undefined)
+            return Promise.reject(this.terminalError);
+        if (this.ended)
+            return Promise.resolve({ done: true, value: undefined });
+        if (this.waiter) {
+            return Promise.reject(clientError("protocol_error", "concurrent reads from one Session terminal are not allowed"));
+        }
+        return new Promise((resolve, reject) => {
+            this.waiter = { resolve, reject };
+        });
+    }
+    async return() {
+        await this.close();
+        return { done: true, value: undefined };
+    }
+    async write(data) {
+        if (this.ended || this.closing || this.role !== "owner" || data.byteLength === 0)
+            return;
+        await this.sendInput(Uint8Array.from(data));
+    }
+    async resize(cols, rows) {
+        if (this.ended || this.closing)
+            return;
+        await this.sendResize(cols, rows);
+    }
+    async close() {
+        if (this.ended)
+            return;
+        await this.requestClose();
+    }
+    push(data) {
+        if (this.ended || this.closing || data.byteLength === 0)
+            return;
+        if (this.waiter) {
+            const waiter = this.waiter;
+            this.waiter = undefined;
+            waiter.resolve({ done: false, value: data });
+            return;
+        }
+        if (this.queue.length >= MAX_TERMINAL_QUEUED_OUTPUT_FRAMES ||
+            this.queuedBytes + data.byteLength > MAX_TERMINAL_QUEUED_OUTPUT_BYTES) {
+            this.reportBackpressure(clientError("unreachable", "Remote Session terminal output exceeded its bounded client queue"));
+            return;
+        }
+        const copy = Uint8Array.from(data);
+        this.queue.push({ data: copy, bytes: copy.byteLength });
+        this.queuedBytes += copy.byteLength;
+    }
+    beginClose() {
+        if (this.ended || this.closing)
+            return false;
+        this.closing = true;
+        this.clearQueue();
+        return true;
+    }
+    remoteClose(frame) {
+        if (this.ended)
+            return;
+        const error = frame.reason === "client_closed" || frame.reason === "terminal_exited"
+            ? undefined
+            : sessionTerminalError(frame, this.sessionId);
+        this.finish(frame, error, frame.reason !== "terminal_exited");
+    }
+    terminate(error) {
+        if (this.ended)
+            return;
+        this.finish(undefined, error, true);
+    }
+    waitClosed() {
+        return this.closed.then(() => undefined);
+    }
+    finish(frame, error, discardQueue = false) {
+        if (this.ended)
+            return;
+        this.ended = true;
+        this.terminalError = error;
+        if (discardQueue)
+            this.clearQueue();
+        const waiter = this.waiter;
+        this.waiter = undefined;
+        if (waiter) {
+            if (error === undefined)
+                waiter.resolve({ done: true, value: undefined });
+            else
+                waiter.reject(error);
+        }
+        if (frame)
+            this.resolveClosed(frame);
+        else
+            this.rejectClosed(error ?? clientError("closed", "Remote Session terminal closed"));
+    }
+    clearQueue() {
+        this.queue.length = 0;
+        this.queuedBytes = 0;
+    }
+}
+function sessionTerminalError(frame, sessionId) {
+    const suffix = frame.message === undefined ? "" : `: ${frame.message}`;
+    return new DirectRuntimeSessionTerminalError(frame.reason, frame.attachmentId, sessionId, `Remote Session terminal closed (${frame.reason})${suffix}`);
+}
+function emulatorSurfaceError(frame) {
+    const suffix = frame.message === undefined ? "" : `: ${frame.message}`;
+    const code = frame.reason === "unauthorized"
+        ? "authentication_failed"
+        : frame.reason === "unsupported"
+            ? "incompatible"
+            : frame.reason === "capacity"
+                ? "unreachable"
+                : "closed";
+    return clientError(code, `Remote Emulator Surface closed (${frame.reason})${suffix}`);
+}
+function decodeEstablishedFrame(frame) {
+    let value;
+    try {
+        value = JSON.parse(establishedTextDecoder.decode(frame));
+    }
+    catch (error) {
+        throw clientError("protocol_error", "Remote Runtime frame is not valid UTF-8 JSON", error);
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw clientError("protocol_error", "Remote Runtime frame must be a JSON object");
+    }
+    const record = value;
+    if (typeof record.type !== "string") {
+        throw clientError("protocol_error", "Remote Runtime frame type must be a string");
+    }
+    return record;
+}
+function callTransportError(error, method, requestId) {
+    if (error instanceof DirectRuntimeCallTransportError &&
+        error.method === method &&
+        error.requestId === requestId) {
+        return error;
+    }
+    const normalized = normalizeEstablishedError(error);
+    return new DirectRuntimeCallTransportError(normalized.code, method, requestId, "unknown", normalized.message, {
+        cause: normalized,
+        ...(normalized.webSocketCloseCode === undefined
+            ? {}
+            : { webSocketCloseCode: normalized.webSocketCloseCode }),
+    });
+}
+class DirectSocket {
+    liveness;
+    websocket;
+    opened;
+    openResolve;
+    openReject;
+    e2eeChannel;
+    awaitingPlaintextReady = false;
+    livenessTimer;
+    lastInboundActivityAt = 0;
+    terminal;
+    authenticated = false;
+    localClose = false;
+    queue = [];
+    queuedBytes = 0;
+    readWaiter;
+    frameHandler;
+    terminalHandler;
+    pendingOutboundFrames = 0;
+    pendingOutboundBytes = 0;
+    constructor(endpoint, timeoutMs, liveness) {
+        this.liveness = liveness;
+        this.opened = new Promise((resolve, reject) => {
+            this.openResolve = resolve;
+            this.openReject = reject;
+        });
+        try {
+            this.websocket = new WebSocket(endpoint, {
+                rejectUnauthorized: true,
+                followRedirects: false,
+                handshakeTimeout: timeoutMs,
+                perMessageDeflate: false,
+                maxPayload: DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES,
+            });
+        }
+        catch (error) {
+            throw mapWebSocketError(error);
+        }
+        this.websocket.on("open", () => {
+            this.noteInboundActivity();
+            this.startLiveness();
+            this.openResolve();
+        });
+        this.websocket.on("message", (data, isBinary) => {
+            this.noteInboundActivity();
+            if (isBinary) {
+                this.fail(clientError("protocol_error", "binary WebSocket frames are not allowed"));
+                return;
+            }
+            const wireFrame = rawDataBytes(data);
+            if (wireFrame.byteLength > DIRECT_RUNTIME_E2EE_MAX_ENVELOPE_BYTES) {
+                this.fail(clientError("protocol_error", "WebSocket frame exceeds the E2EE limit"));
+                return;
+            }
+            const channel = this.e2eeChannel;
+            if (!channel) {
+                this.fail(clientError("protocol_error", "server traffic preceded E2EE setup"));
+                return;
+            }
+            if (this.awaitingPlaintextReady) {
+                this.awaitingPlaintextReady = false;
+                this.deliver(wireFrame);
+                return;
+            }
+            try {
+                const plaintext = channel.open(decodeWireText(wireFrame));
+                const frame = Uint8Array.from(Buffer.from(plaintext, "utf8"));
+                if (frame.byteLength > REMOTE_RUNTIME_RPC_MAX_FRAME_BYTES) {
+                    throw clientError("protocol_error", "E2EE plaintext exceeds the RPC limit");
+                }
+                this.deliver(frame);
+            }
+            catch (error) {
+                this.fail(clientError("protocol_error", "invalid Direct Runtime E2EE frame", error));
+            }
+        });
+        this.websocket.on("ping", () => this.noteInboundActivity());
+        this.websocket.on("pong", () => this.noteInboundActivity());
+        this.websocket.on("unexpected-response", (_request, response) => {
+            response.resume();
+            this.fail(clientError(response.statusCode === 401 || response.statusCode === 403
+                ? "authentication_failed"
+                : response.statusCode === 429 || response.statusCode === 503
+                    ? "unreachable"
+                    : "protocol_error", `Direct Runtime WebSocket upgrade failed with HTTP ${response.statusCode ?? "unknown"}`));
+        });
+        this.websocket.on("error", (error) => {
+            this.fail(this.authenticated ? closedError(error) : mapWebSocketError(error));
+        });
+        this.websocket.on("close", (code, reason) => {
+            const suffix = reason.length === 0 ? "" : `: ${reason.toString("utf8").slice(0, 256)}`;
+            this.fail(webSocketCloseError(code, suffix, this.localClose));
+        });
+    }
+    async open(timeoutMs) {
+        return await withTimeout(this.opened, timeoutMs, () => clientError("unreachable", "Direct Runtime WebSocket connection timed out"));
+    }
+    async startE2EE(channel, clientHello) {
+        if (this.e2eeChannel) {
+            throw clientError("protocol_error", "Direct Runtime E2EE is already initialized");
+        }
+        this.e2eeChannel = channel;
+        this.awaitingPlaintextReady = true;
+        await this.sendWireText(clientHello);
+    }
+    async readFrame(maxBytes, timeoutMs) {
+        if (this.readWaiter) {
+            throw clientError("protocol_error", "concurrent handshake reads are not allowed");
+        }
+        const queued = this.shiftQueuedFrame();
+        if (queued !== undefined)
+            return boundedFrame(queued, maxBytes);
+        if (this.terminal)
+            throw this.terminal;
+        return await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                if (this.readWaiter?.timer !== timer)
+                    return;
+                this.readWaiter = undefined;
+                reject(clientError("unreachable", "Direct Runtime handshake timed out"));
+            }, timeoutMs);
+            timer.unref?.();
+            this.readWaiter = {
+                maxBytes,
+                timer,
+                resolve,
+                reject,
+            };
+        });
+    }
+    async sendText(frame) {
+        const channel = this.e2eeChannel;
+        if (!channel) {
+            throw clientError("protocol_error", "Direct Runtime E2EE is not initialized");
+        }
+        let encrypted;
+        const plaintextBytes = Buffer.byteLength(frame, "utf8");
+        this.assertOutboundCapacity(Math.ceil(plaintextBytes * 4 / 3) + MAX_E2EE_ENVELOPE_OVERHEAD_BYTES);
+        try {
+            encrypted = channel.seal(frame);
+        }
+        catch (error) {
+            throw clientError("protocol_error", "could not encrypt Direct Runtime frame", error);
+        }
+        await this.sendWireText(encrypted);
+    }
+    async sendWireText(frame) {
+        if (this.terminal || this.websocket.readyState !== WebSocket.OPEN) {
+            throw this.terminal ?? clientError("closed", "Direct Runtime connection is not open");
+        }
+        const frameBytes = Buffer.byteLength(frame, "utf8");
+        this.assertOutboundCapacity(frameBytes);
+        this.pendingOutboundFrames += 1;
+        this.pendingOutboundBytes += frameBytes;
+        await new Promise((resolve, reject) => {
+            const complete = (error) => {
+                this.pendingOutboundFrames -= 1;
+                this.pendingOutboundBytes -= frameBytes;
+                if (error)
+                    reject(this.authenticated ? closedError(error) : mapWebSocketError(error));
+                else
+                    resolve();
+            };
+            try {
+                this.websocket.send(frame, { binary: false, compress: false }, complete);
+            }
+            catch (error) {
+                this.pendingOutboundFrames -= 1;
+                this.pendingOutboundBytes -= frameBytes;
+                reject(this.authenticated ? closedError(error) : mapWebSocketError(error));
+            }
+        });
+    }
+    assertOutboundCapacity(frameBytes) {
+        if (this.pendingOutboundFrames >= MAX_PENDING_OUTBOUND_FRAMES) {
+            throw new DirectRuntimeClientCapacityError("outbound_frames", MAX_PENDING_OUTBOUND_FRAMES, `Direct Runtime client admits at most ${MAX_PENDING_OUTBOUND_FRAMES} pending WebSocket sends`);
+        }
+        if (this.pendingOutboundBytes + frameBytes > MAX_PENDING_OUTBOUND_BYTES ||
+            this.websocket.bufferedAmount + frameBytes > MAX_PENDING_OUTBOUND_BYTES) {
+            throw new DirectRuntimeClientCapacityError("outbound_bytes", MAX_PENDING_OUTBOUND_BYTES, `Direct Runtime client admits at most ${MAX_PENDING_OUTBOUND_BYTES} outbound WebSocket bytes`);
+        }
+    }
+    markAuthenticated() {
+        this.authenticated = true;
+    }
+    activate(onFrame, onTerminal) {
+        if (this.frameHandler || this.readWaiter) {
+            throw clientError("protocol_error", "Direct Runtime socket is already active");
+        }
+        this.frameHandler = onFrame;
+        this.terminalHandler = onTerminal;
+        while (this.queue.length > 0 && !this.terminal) {
+            onFrame(this.shiftQueuedFrame());
+        }
+        if (this.terminal)
+            onTerminal(this.terminal);
+    }
+    abort(error) {
+        this.fail(error);
+        if (this.websocket.readyState !== WebSocket.CLOSED)
+            this.websocket.terminate();
+    }
+    async close() {
+        this.stopLiveness();
+        if (this.websocket.readyState === WebSocket.CLOSED)
+            return;
+        this.localClose = true;
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                if (this.websocket.readyState !== WebSocket.CLOSED)
+                    this.websocket.terminate();
+                resolve();
+            }, 1_000);
+            timer.unref?.();
+            this.websocket.once("close", () => {
+                clearTimeout(timer);
+                resolve();
+            });
+            if (this.websocket.readyState === WebSocket.CONNECTING)
+                this.websocket.terminate();
+            else
+                this.websocket.close(1000, "client closed");
+        });
+    }
+    deliver(frame) {
+        if (this.terminal)
+            return;
+        if (this.frameHandler) {
+            try {
+                this.frameHandler(frame);
+            }
+            catch (error) {
+                this.fail(clientError("protocol_error", "RPC frame handler failed", error));
+            }
+            return;
+        }
+        if (this.readWaiter) {
+            const waiter = this.readWaiter;
+            this.readWaiter = undefined;
+            clearTimeout(waiter.timer);
+            try {
+                waiter.resolve(boundedFrame(frame, waiter.maxBytes));
+            }
+            catch (error) {
+                waiter.reject(error);
+            }
+            return;
+        }
+        if (this.queue.length >= MAX_PRE_ACTIVATION_FRAMES ||
+            this.queuedBytes + frame.byteLength > MAX_PRE_ACTIVATION_BYTES) {
+            this.fail(clientError("protocol_error", "too many Direct Runtime frames arrived before the client was ready"));
+            return;
+        }
+        this.queue.push(frame);
+        this.queuedBytes += frame.byteLength;
+    }
+    fail(error) {
+        if (this.terminal)
+            return;
+        this.stopLiveness();
+        this.terminal = error;
+        this.openReject(error);
+        if (this.readWaiter) {
+            clearTimeout(this.readWaiter.timer);
+            this.readWaiter.reject(error);
+            this.readWaiter = undefined;
+        }
+        this.terminalHandler?.(error);
+    }
+    noteInboundActivity() {
+        this.lastInboundActivityAt = Date.now();
+    }
+    startLiveness() {
+        if (this.livenessTimer)
+            return;
+        this.livenessTimer = setInterval(() => {
+            if (this.terminal)
+                return;
+            if (Date.now() - this.lastInboundActivityAt > this.liveness.inactivityTimeoutMs) {
+                const error = clientError(this.authenticated ? "closed" : "unreachable", "Direct Runtime stopped responding; the WebSocket was reset");
+                this.fail(error);
+                if (this.websocket.readyState !== WebSocket.CLOSED)
+                    this.websocket.terminate();
+                return;
+            }
+            if (this.websocket.readyState !== WebSocket.OPEN)
+                return;
+            try {
+                this.websocket.ping();
+            }
+            catch {
+                // A concurrent error/close event owns terminal error normalization.
+            }
+        }, this.liveness.pingIntervalMs);
+        this.livenessTimer.unref?.();
+    }
+    stopLiveness() {
+        if (!this.livenessTimer)
+            return;
+        clearInterval(this.livenessTimer);
+        this.livenessTimer = undefined;
+    }
+    shiftQueuedFrame() {
+        const frame = this.queue.shift();
+        if (frame !== undefined)
+            this.queuedBytes -= frame.byteLength;
+        return frame;
+    }
+}
+function validatedOffer(value, allowExpired) {
+    let offer;
+    try {
+        offer = parsePairingOffer(value, { allowExpired });
+    }
+    catch (error) {
+        throw clientError("invalid_offer", "Direct Runtime pairing offer is invalid", error);
+    }
+    parseEd25519PublicKey(offer.identityPublicKey, "identityPublicKey", "invalid_offer");
+    parseX25519PublicKey(offer.serverEncryptionPublicKey, "serverEncryptionPublicKey", "invalid_offer");
+    parseDirectEndpoint(offer.directEndpoint, "invalid_offer");
+    return offer;
+}
+function parseHandshakeFrame(frame, expected) {
+    try {
+        return decodeDirectRuntimeFrame(frame);
+    }
+    catch (error) {
+        throw clientError("protocol_error", `invalid ${expected} frame`, error);
+    }
+}
+function assertHelloIdentity(hello, input) {
+    if (hello.role !== "control") {
+        throw clientError("protocol_error", "server.hello role is not control");
+    }
+    if (hello.daemonId !== input.daemonId) {
+        throw clientError("identity_mismatch", "server.hello daemonId differs from the pin");
+    }
+    if (hello.identityPublicKey !== input.identityPublicKey) {
+        throw clientError("identity_mismatch", "server.hello identity key differs from the pin");
+    }
+}
+function selectBindingProtocol(hello) {
+    if (hello.minimumCompatibleBindingVersion > DIRECT_RUNTIME_BINDING_PROTOCOL.currentVersion ||
+        DIRECT_RUNTIME_BINDING_PROTOCOL.minimumCompatibleVersion > hello.bindingProtocolVersion) {
+        throw clientError("incompatible", "Direct Runtime binding protocol ranges do not overlap");
+    }
+    return Math.min(hello.bindingProtocolVersion, DIRECT_RUNTIME_BINDING_PROTOCOL.currentVersion);
+}
+function selectCoreProtocol(hello) {
+    if (hello.minimumCompatibleCoreVersion > REMOTE_RUNTIME_CORE_PROTOCOL.currentVersion ||
+        REMOTE_RUNTIME_CORE_PROTOCOL.minimumCompatibleVersion > hello.coreProtocolVersion) {
+        throw clientError("incompatible", "Remote Runtime Core protocol ranges do not overlap");
+    }
+    return Math.min(hello.coreProtocolVersion, REMOTE_RUNTIME_CORE_PROTOCOL.currentVersion);
+}
+function clientAuthenticateFields(input, hello, selectedBindingVersion, selectedCoreVersion) {
+    const base = {
+        type: "client.authenticate",
+        role: "control",
+        daemonId: hello.daemonId,
+        daemonInstanceId: hello.daemonInstanceId,
+        bindingProtocolVersion: selectedBindingVersion,
+        coreProtocolVersion: selectedCoreVersion,
+        clientId: input.identity.clientId,
+        clientPublicKey: input.identity.clientPublicKey,
+        nonce: randomBytes(32).toString("base64url"),
+    };
+    return input.mode === "enroll"
+        ? {
+            ...base,
+            mode: "enroll",
+            claimId: input.claimId,
+            claimSecret: input.claimSecret,
+        }
+        : { ...base, mode: "connect", grantId: input.grantId };
+}
+function assertAcceptedConsistency(accepted, hello, authenticate, input) {
+    if (accepted.role !== "control" || authenticate.role !== "control") {
+        throw clientError("protocol_error", "Direct Runtime control role changed during authentication");
+    }
+    if (accepted.daemonId !== hello.daemonId || accepted.daemonId !== input.daemonId) {
+        throw clientError("identity_mismatch", "server.accepted daemonId differs from the pin");
+    }
+    if (accepted.daemonInstanceId !== hello.daemonInstanceId) {
+        throw clientError("protocol_error", "daemonInstanceId changed during authentication");
+    }
+    if (accepted.bindingProtocolVersion !== authenticate.bindingProtocolVersion ||
+        accepted.coreProtocolVersion !== authenticate.coreProtocolVersion) {
+        throw clientError("incompatible", "server accepted different protocol versions");
+    }
+    if (accepted.clientId !== authenticate.clientId) {
+        throw clientError("authentication_failed", "server accepted a different client identity");
+    }
+    if (input.mode === "connect" && accepted.grantId !== input.grantId) {
+        throw clientError("authentication_failed", "server accepted a different client grant");
+    }
+    if (accepted.authorities.length !== 1 || accepted.authorities[0] !== "daemon.full") {
+        throw clientError("authentication_failed", "server did not grant daemon.full authority");
+    }
+}
+function withoutHelloSignature(hello) {
+    const { signature: _signature, ...fields } = hello;
+    return fields;
+}
+function withoutAcceptedSignature(accepted) {
+    const { signature: _signature, ...fields } = accepted;
+    return fields;
+}
+function publicKey(value, code) {
+    parseEd25519PublicKey(value, "identityPublicKey", code);
+    return createPublicKey({
+        key: Buffer.from(value, "base64url"),
+        format: "der",
+        type: "spki",
+    });
+}
+function sha256(value) {
+    return new Uint8Array(createHash("sha256").update(value).digest());
+}
+function parseTimeout(value) {
+    const timeout = value ?? DEFAULT_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeout) ||
+        timeout < MIN_TIMEOUT_MS ||
+        timeout > MAX_TIMEOUT_MS) {
+        throw clientError("protocol_error", `timeoutMs must be an integer between ${MIN_TIMEOUT_MS} and ${MAX_TIMEOUT_MS}`);
+    }
+    return timeout;
+}
+function parseClientLiveness(input) {
+    const pingIntervalMs = parseLivenessInterval(input?.pingIntervalMs, DEFAULT_LIVENESS_PING_INTERVAL_MS, "liveness.pingIntervalMs");
+    const inactivityTimeoutMs = parseLivenessInterval(input?.inactivityTimeoutMs, DEFAULT_LIVENESS_INACTIVITY_TIMEOUT_MS, "liveness.inactivityTimeoutMs");
+    if (inactivityTimeoutMs <= pingIntervalMs) {
+        throw clientError("protocol_error", "liveness.inactivityTimeoutMs must be greater than liveness.pingIntervalMs");
+    }
+    return { pingIntervalMs, inactivityTimeoutMs };
+}
+function parseLivenessInterval(value, fallback, field) {
+    const interval = value ?? fallback;
+    if (!Number.isSafeInteger(interval) ||
+        interval <= 0 ||
+        interval > MAX_LIVENESS_INTERVAL_MS) {
+        throw clientError("protocol_error", `${field} must be a positive integer no greater than ${MAX_LIVENESS_INTERVAL_MS}`);
+    }
+    return interval;
+}
+function remaining(deadline) {
+    return Math.max(1, deadline - Date.now());
+}
+function boundedFrame(frame, maxBytes) {
+    if (frame.byteLength > maxBytes) {
+        throw clientError("protocol_error", `Direct Runtime frame exceeds ${maxBytes} bytes`);
+    }
+    return frame;
+}
+function rawDataBytes(data) {
+    if (Array.isArray(data))
+        return new Uint8Array(Buffer.concat(data));
+    if (data instanceof ArrayBuffer)
+        return new Uint8Array(data.slice(0));
+    return new Uint8Array(data);
+}
+function decodeWireText(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch (error) {
+        throw clientError("protocol_error", "WebSocket frame must be valid UTF-8", error);
+    }
+}
+function normalizeHandshakeError(error) {
+    if (error instanceof DirectRuntimeClientError)
+        return error;
+    return clientError("protocol_error", "Direct Runtime handshake failed", error);
+}
+function notStartedClientError(error, fallbackMessage) {
+    if (error instanceof DirectRuntimeClientError) {
+        return new DirectRuntimeClientError(error.code, error.message, {
+            cause: error,
+            outcome: "not_started",
+            ...(error.webSocketCloseCode === undefined
+                ? {}
+                : { webSocketCloseCode: error.webSocketCloseCode }),
+        });
+    }
+    return new DirectRuntimeClientError("protocol_error", fallbackMessage, {
+        cause: error,
+        outcome: "not_started",
+    });
+}
+function normalizeEstablishedError(error) {
+    if (error instanceof DirectRuntimeClientError)
+        return error;
+    return closedError(error);
+}
+function closedError(cause) {
+    return clientError("closed", "Direct Runtime connection was interrupted", cause);
+}
+function webSocketCloseError(closeCode, reasonSuffix, localClose) {
+    if (localClose) {
+        return clientError("closed", "Direct Runtime connection was closed", undefined, closeCode);
+    }
+    const code = closeCode === DIRECT_RUNTIME_CLOSE_CODE.unauthorized
+        ? "authentication_failed"
+        : closeCode === DIRECT_RUNTIME_CLOSE_CODE.badProtocol
+            ? "protocol_error"
+            : closeCode === DIRECT_RUNTIME_CLOSE_CODE.authenticationTimeout ||
+                closeCode === DIRECT_RUNTIME_CLOSE_CODE.capacity
+                ? "unreachable"
+                : "closed";
+    return clientError(code, `Direct Runtime connection closed (${closeCode})${reasonSuffix}`, undefined, closeCode);
+}
+function mapWebSocketError(error) {
+    const code = errorCode(error);
+    if (code.startsWith("ERR_TLS_") ||
+        code.startsWith("ERR_SSL_") ||
+        code.startsWith("CERT_") ||
+        [
+            "DEPTH_ZERO_SELF_SIGNED_CERT",
+            "SELF_SIGNED_CERT_IN_CHAIN",
+            "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+            "UNABLE_TO_GET_ISSUER_CERT",
+        ].includes(code)) {
+        return clientError("tls_error", "Direct Runtime TLS verification failed", error);
+    }
+    if (code === "WS_ERR_UNSUPPORTED_MESSAGE_LENGTH") {
+        return clientError("protocol_error", "Direct Runtime WebSocket frame is too large", error);
+    }
+    return clientError("unreachable", "Direct Runtime endpoint is unreachable", error);
+}
+function errorCode(error) {
+    if (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string") {
+        return error.code;
+    }
+    return "";
+}
+async function withTimeout(promise, timeoutMs, timeoutError) {
+    return await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(timeoutError()), timeoutMs);
+        timer.unref?.();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}