@softomnitel/omnicall-kit 0.1.0-rc.0

package/LICENSE

@@ -0,0 +1,4 @@
+Copyright (c) SoftOmniTel
+
+All rights reserved until a public license is chosen for the published SDK packages.
+This placeholder exists so package tarballs include a LICENSE file during incubation.

package/README.md

@@ -0,0 +1,34 @@
+# @softomnitel/omnicall-kit
+
+Browser SDK client for OmniCall Desktop.
+
+**Status:** product namespaces through SDK-08 + official browser WebSocket transport defaults.
+Call/operator/account mutations and lifecycle are on `OmniCallClient`.
+
+Depends on `@softomnitel/omnicall-protocol` only. Must never import OmniCall Desktop Domain,
+Application, Electron, JsSIP, React, or Zustand.
+
+Public surface (highlights):
+
+- `createAuthClient` — pairing / PoP / capabilities
+- `createOmniCallClient` — product API on top of auth
+- `createBrowserWebSocketTransport` — official `TransportPort` over browser `WebSocket`
+- `createBrowserScheduler` / `createBrowserJitterSource` — production timer/jitter defaults
+- `createIndexedDbPopKeyStore` / `createMemoryPopKeyStore` — PoP persistence
+- Type helpers: `OmniCallEventOf`, snapshot/capability re-exports, typed error readers
+  (`readInteractionRequiredDetails`, …) — see `docs/guide/typescript.md`
+
+Constructor options `transportFactory`, `scheduler`, and `jitter` are **optional** in
+browsers (defaults above). Unit tests should still inject FakeTransport + fake scheduler.
+
+Internal production modules (not all exported as helpers):
+
+- explicit connection state machine
+- request correlation, timeouts, abort/disconnect cleanup
+- heartbeat and bounded jittered reconnect
+- snapshot cache, sequence-gap resync, redaction-safe diagnostics
+
+`FakeTransport` / test helpers live under `src/internal/` for unit tests only and are
+excluded from the published `dist/` tarball.
+
+See `docs/guide/transport.md` for the transport contract.

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `@softomnitel/omnicall-kit` — browser client for OmniCall Desktop local protocol.
+ *
+ * SDK-08+: OmniCallClient with namespaced product APIs + official browser WebSocket transport.
+ *
+ * @packageDocumentation
+ */
+export { createAuthClient, type AuthClient, type AuthClientOptions, type AuthSessionSnapshot, type PairingRequiredInfo } from './public/auth-client.js';
+export { OmniCallClientError, createOmniCallClient, isOmniCallClientError, isConflictError, isInteractionRequiredError, isOperationFailedError, isOriginBlockedError, PUBLIC_EVENT_TYPES, readConflictErrorDetails, readInteractionRequiredDetails, readOperationFailedDetails, type ActivateProfileMode, type ActivateProfileResult, type OmniCallAccountApi, type OmniCallCallsApi, type OmniCallClient, type OmniCallClientOptions, type OmniCallEvent, type OmniCallEventOf, type OmniCallOperatorApi, type OmniCallWindowApi, type CallMutationResult, type CapabilityId, type ConflictErrorDetails, type InteractionRequiredDetails, type LogoutResult, type OperationFailedDetails, type OperatorFinishAppealResult, type OperatorReason, type OperatorReasonsResult, type OperatorStatusChangeKind, type OperatorStatusChangeResult, type ProtocolErrorCode, type PublicEventType, type PublicOperatorStatus, type SnapshotCallSummary, type SnapshotMessage, type SnapshotSections, type WireJsonObject } from './public/omnicall-client.js';
+export { SDK_ACTIVATE_CLIENT_TIMEOUT_MS, SDK_ACTIVATE_CONSENT_TTL_MS, SDK_ACTIVATE_OCP_AUTH_BUDGET_MS, SDK_ACTIVATE_SIP_ONLY_AUTH_BUDGET_MS } from '@softomnitel/omnicall-protocol';
+export { CONNECTION_STATES, type ConnectionState } from './internal/connection-state.js';
+export { createIndexedDbPopKeyStore, createMemoryPopKeyStore, type PopKeyStore, type StoredPopIdentity } from './internal/pop-key-store.js';
+export { createBrowserWebSocketTransport, type BrowserWebSocketConstructor, type BrowserWebSocketLike, type CreateBrowserWebSocketTransportOptions } from './internal/browser-websocket-transport.js';
+export type { TransportCloseInfo, TransportErrorInfo, TransportFactory, TransportPort } from './internal/transport-port.js';
+export type { FakeScheduler, JitterSource, Scheduler, TimerHandle } from './internal/scheduler.js';
+export { createBrowserJitterSource, createBrowserScheduler, createFakeScheduler, createFixedJitterSource } from './internal/scheduler.js';
+export type { ReconnectPolicy } from './internal/reconnect-policy.js';
+export type { HeartbeatPolicy } from './internal/heartbeat-controller.js';
+export type { DiagnosticEvent, DiagnosticLevel, DiagnosticResult, DiagnosticsSink } from './internal/diagnostics.js';
+export { createRecordingDiagnosticsSink } from './internal/diagnostics.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,iBAAiB,EACjB,KAAK,eAAe,EACrB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,sCAAsC,EAC5C,MAAM,2CAA2C,CAAC;AAEnD,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,aAAa,EACd,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAE1E,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,EAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * `@softomnitel/omnicall-kit` — browser client for OmniCall Desktop local protocol.
+ *
+ * SDK-08+: OmniCallClient with namespaced product APIs + official browser WebSocket transport.
+ *
+ * @packageDocumentation
+ */
+export { createAuthClient } from './public/auth-client.js';
+export { OmniCallClientError, createOmniCallClient, isOmniCallClientError, isConflictError, isInteractionRequiredError, isOperationFailedError, isOriginBlockedError, PUBLIC_EVENT_TYPES, readConflictErrorDetails, readInteractionRequiredDetails, readOperationFailedDetails } from './public/omnicall-client.js';
+export { SDK_ACTIVATE_CLIENT_TIMEOUT_MS, SDK_ACTIVATE_CONSENT_TTL_MS, SDK_ACTIVATE_OCP_AUTH_BUDGET_MS, SDK_ACTIVATE_SIP_ONLY_AUTH_BUDGET_MS } from '@softomnitel/omnicall-protocol';
+export { CONNECTION_STATES } from './internal/connection-state.js';
+export { createIndexedDbPopKeyStore, createMemoryPopKeyStore } from './internal/pop-key-store.js';
+export { createBrowserWebSocketTransport } from './internal/browser-websocket-transport.js';
+export { createBrowserJitterSource, createBrowserScheduler, createFakeScheduler, createFixedJitterSource } from './internal/scheduler.js';
+export { createRecordingDiagnosticsSink } from './internal/diagnostics.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,gBAAgB,EAKjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,8BAA8B,EAC9B,0BAA0B,EA6B3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,+BAA+B,EAC/B,oCAAoC,EACrC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,iBAAiB,EAElB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EAGxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,+BAA+B,EAIhC,MAAM,2CAA2C,CAAC;AAenD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,yBAAyB,CAAC;AAWjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/internal/account-activate-commands.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Capability-gated saved-profile activation runner (SDK-08).
+ * Privileged `account.activate` — server-granted only; never pairing-default.
+ */
+import type { CapabilityId } from '@softomnitel/omnicall-protocol';
+import type { ConnectionSession } from './connection-session.js';
+import type { Scheduler } from './scheduler.js';
+/** Documented activate modes accepted by protocol v1 desktop. @public */
+export type ActivateProfileMode = 'sip_only' | 'ocp';
+/** Successful activate-profile. @public */
+export type ActivateProfileResult = {
+    readonly activated: true;
+    readonly mode: ActivateProfileMode;
+    readonly profileLabel?: string;
+    readonly alreadyAuthenticated?: boolean;
+    readonly revision: number;
+};
+export type AccountActivateCommandApi = {
+    readonly activateProfile: (input: {
+        readonly login: string;
+        readonly expectedRevision: number;
+        readonly mode?: ActivateProfileMode;
+    }) => Promise<ActivateProfileResult>;
+};
+export declare function createAccountActivateCommandApi(deps: {
+    readonly connection: ConnectionSession;
+    readonly scheduler: Scheduler;
+    readonly getGrantedCapabilities: () => readonly CapabilityId[];
+}): AccountActivateCommandApi;
+//# sourceMappingURL=account-activate-commands.d.ts.map

package/dist/internal/account-activate-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-activate-commands.d.ts","sourceRoot":"","sources":["../../src/internal/account-activate-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAKnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAYhD,yEAAyE;AACzE,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,KAAK,CAAC;AAErD,2CAA2C;AAC3C,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;KACrC,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtC,CAAC;AAuGF,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,SAAS,YAAY,EAAE,CAAC;CAChE,GAAG,yBAAyB,CAI5B"}

package/dist/internal/account-activate-commands.js

@@ -0,0 +1,94 @@
+/**
+ * Capability-gated saved-profile activation runner (SDK-08).
+ * Privileged `account.activate` — server-granted only; never pairing-default.
+ */
+import { SDK_ACTIVATE_CLIENT_TIMEOUT_MS } from '@softomnitel/omnicall-protocol';
+import { buildAccountActivateProfileBody } from './account-activate-wire.js';
+import { createClientError } from './client-errors.js';
+import { guardCapability, guardReady, mapReplyFailure, requireWireIdentity } from './product-commands.js';
+const SECRET_RESULT_KEYS = new Set([
+    'password',
+    'apiKey',
+    'sipPassword',
+    'token',
+    'secret',
+    'pairingSecret',
+    'privateKey'
+]);
+function isActivateProfileMode(value) {
+    return value === 'sip_only' || value === 'ocp';
+}
+function hasSecretResultKeys(result) {
+    for (const key of Object.keys(result)) {
+        if (SECRET_RESULT_KEYS.has(key)) {
+            return true;
+        }
+    }
+    return false;
+}
+function readActivateProfileResult(reply) {
+    if (hasSecretResultKeys(reply.result)) {
+        throw createClientError({ code: 'invalid_payload', retryable: false });
+    }
+    const activated = reply.result['activated'];
+    const mode = reply.result['mode'];
+    if (activated !== true ||
+        typeof mode !== 'string' ||
+        !isActivateProfileMode(mode)) {
+        throw createClientError({ code: 'invalid_payload', retryable: false });
+    }
+    const profileLabel = reply.result['profileLabel'];
+    const alreadyAuthenticated = reply.result['alreadyAuthenticated'];
+    if (profileLabel !== undefined) {
+        if (typeof profileLabel !== 'string' || profileLabel.length === 0) {
+            throw createClientError({ code: 'invalid_payload', retryable: false });
+        }
+    }
+    if (alreadyAuthenticated !== undefined &&
+        typeof alreadyAuthenticated !== 'boolean') {
+        throw createClientError({ code: 'invalid_payload', retryable: false });
+    }
+    return {
+        activated: true,
+        mode,
+        ...(profileLabel === undefined ? {} : { profileLabel }),
+        ...(alreadyAuthenticated === undefined ? {} : { alreadyAuthenticated }),
+        revision: reply.revision
+    };
+}
+async function runActivateProfile(deps, input) {
+    const notReady = guardReady(deps.connection);
+    if (notReady !== undefined) {
+        return Promise.reject(notReady);
+    }
+    const missingCap = guardCapability(deps.getGrantedCapabilities(), 'account.activate');
+    if (missingCap !== undefined) {
+        return Promise.reject(missingCap);
+    }
+    const identity = requireWireIdentity(deps.connection);
+    if ('code' in identity) {
+        return Promise.reject(identity);
+    }
+    const requestId = crypto.randomUUID();
+    const result = await deps.connection.request({
+        requestId,
+        commandType: 'account:activate-profile',
+        timeoutMs: SDK_ACTIVATE_CLIENT_TIMEOUT_MS,
+        body: buildAccountActivateProfileBody({
+            requestId,
+            serverInstanceId: identity.serverInstanceId,
+            sessionEpoch: identity.sessionEpoch,
+            occurredAtMs: deps.scheduler.now()
+        }, input)
+    });
+    if (!result.ok || !result.reply.ok) {
+        return Promise.reject(mapReplyFailure(result));
+    }
+    return readActivateProfileResult(result.reply);
+}
+export function createAccountActivateCommandApi(deps) {
+    return {
+        activateProfile: (input) => runActivateProfile(deps, input)
+    };
+}
+//# sourceMappingURL=account-activate-commands.js.map

package/dist/internal/account-activate-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-activate-commands.js","sourceRoot":"","sources":["../../src/internal/account-activate-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,UAAU;IACV,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;IACR,eAAe;IACf,YAAY;CACb,CAAC,CAAC;AAsBH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAyC;IAEzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CAAC,KAGlC;IACC,IAAI,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAC5B,CAAC;QACD,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,oBAAoB,GAAG,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,IACE,oBAAoB,KAAK,SAAS;QAClC,OAAO,oBAAoB,KAAK,SAAS,EACzC,CAAC;QACD,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI;QACJ,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;QACvE,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAIC,EACD,KAIC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAChC,IAAI,CAAC,sBAAsB,EAAE,EAC7B,kBAAkB,CACnB,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAC3C,SAAS;QACT,WAAW,EAAE,0BAA0B;QACvC,SAAS,EAAE,8BAA8B;QACzC,IAAI,EAAE,+BAA+B,CACnC;YACE,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;SACnC,EACD,KAAK,CACN;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAI/C;IACC,OAAO;QACL,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/internal/account-activate-wire.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Account activate-profile wire builder (SDK-08). Schema-aligned outbound frames.
+ */
+type WireIdentity = {
+    readonly requestId: string;
+    readonly serverInstanceId: string;
+    readonly sessionEpoch: string;
+    readonly occurredAtMs: number;
+};
+export declare function buildAccountActivateProfileBody(identity: WireIdentity, input: {
+    readonly login: string;
+    readonly expectedRevision: number;
+    readonly mode?: 'sip_only' | 'ocp';
+}): string;
+export {};
+//# sourceMappingURL=account-activate-wire.d.ts.map

package/dist/internal/account-activate-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-activate-wire.d.ts","sourceRoot":"","sources":["../../src/internal/account-activate-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,KAAK,YAAY,GAAG;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CACpC,GACA,MAAM,CAeR"}

package/dist/internal/account-activate-wire.js

@@ -0,0 +1,22 @@
+/**
+ * Account activate-profile wire builder (SDK-08). Schema-aligned outbound frames.
+ */
+import { PROTOCOL_MAJOR } from '@softomnitel/omnicall-protocol';
+import { isoNow } from './auth-wire.js';
+export function buildAccountActivateProfileBody(identity, input) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'command',
+        type: 'account:activate-profile',
+        requestId: identity.requestId,
+        serverInstanceId: identity.serverInstanceId,
+        sessionEpoch: identity.sessionEpoch,
+        occurredAt: isoNow(identity.occurredAtMs),
+        payload: {
+            login: input.login,
+            expectedRevision: input.expectedRevision,
+            ...(input.mode === undefined ? {} : { mode: input.mode })
+        }
+    });
+}
+//# sourceMappingURL=account-activate-wire.js.map

package/dist/internal/account-activate-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-activate-wire.js","sourceRoot":"","sources":["../../src/internal/account-activate-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AASxC,MAAM,UAAU,+BAA+B,CAC7C,QAAsB,EACtB,KAIC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzC,OAAO,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1D;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/account-logout-commands.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Capability-gated single-shot account logout (session.logout).
+ */
+import type { CapabilityId } from '@softomnitel/omnicall-protocol';
+import type { ConnectionSession } from './connection-session.js';
+import type { Scheduler } from './scheduler.js';
+/** Successful account:logout. @public */
+export type LogoutResult = {
+    readonly loggedOut: true;
+    readonly revision: number;
+};
+export type AccountLogoutCommandApi = {
+    readonly logout: (input: {
+        readonly reasonId?: number;
+        readonly expectedRevision: number;
+    }) => Promise<LogoutResult>;
+};
+export declare function createAccountLogoutCommandApi(deps: {
+    readonly connection: ConnectionSession;
+    readonly scheduler: Scheduler;
+    readonly getGrantedCapabilities: () => readonly CapabilityId[];
+}): AccountLogoutCommandApi;
+//# sourceMappingURL=account-logout-commands.d.ts.map

package/dist/internal/account-logout-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-logout-commands.d.ts","sourceRoot":"","sources":["../../src/internal/account-logout-commands.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,gCAAgC,CAAC;AAIhF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;KACnC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC7B,CAAC;AAgBF,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,SAAS,YAAY,EAAE,CAAC;CAChE,GAAG,uBAAuB,CAoC1B"}

package/dist/internal/account-logout-commands.js

@@ -0,0 +1,51 @@
+/**
+ * Capability-gated single-shot account logout (session.logout).
+ */
+import { buildAccountLogoutBody } from './account-logout-wire.js';
+import { createClientError } from './client-errors.js';
+import { guardCapability, guardReady, mapReplyFailure, requireWireIdentity } from './product-commands.js';
+function readLogoutResult(reply) {
+    const loggedOut = reply.result['loggedOut'];
+    if (loggedOut !== true) {
+        throw createClientError({ code: 'invalid_payload', retryable: false });
+    }
+    return {
+        loggedOut: true,
+        revision: reply.revision
+    };
+}
+export function createAccountLogoutCommandApi(deps) {
+    return {
+        logout: async (input) => {
+            const notReady = guardReady(deps.connection);
+            if (notReady !== undefined) {
+                return Promise.reject(notReady);
+            }
+            const missingCap = guardCapability(deps.getGrantedCapabilities(), 'session.logout');
+            if (missingCap !== undefined) {
+                return Promise.reject(missingCap);
+            }
+            const identity = requireWireIdentity(deps.connection);
+            if ('code' in identity) {
+                return Promise.reject(identity);
+            }
+            const requestId = crypto.randomUUID();
+            const fields = {
+                requestId,
+                serverInstanceId: identity.serverInstanceId,
+                sessionEpoch: identity.sessionEpoch,
+                occurredAtMs: deps.scheduler.now()
+            };
+            const result = await deps.connection.request({
+                requestId,
+                commandType: 'account:logout',
+                body: buildAccountLogoutBody(fields, input)
+            });
+            if (!result.ok || !result.reply.ok) {
+                return Promise.reject(mapReplyFailure(result));
+            }
+            return readLogoutResult(result.reply);
+        }
+    };
+}
+//# sourceMappingURL=account-logout-commands.js.map

package/dist/internal/account-logout-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-logout-commands.js","sourceRoot":"","sources":["../../src/internal/account-logout-commands.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAgB/B,SAAS,gBAAgB,CAAC,KAGzB;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAI7C;IACC,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,UAAU,GAAG,eAAe,CAChC,IAAI,CAAC,sBAAsB,EAAE,EAC7B,gBAAgB,CACjB,CAAC;YACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG;gBACb,SAAS;gBACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;aACnC,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC3C,SAAS;gBACT,WAAW,EAAE,gBAAsC;gBACnD,IAAI,EAAE,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACnC,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/internal/account-logout-wire.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Account logout wire builder — single-shot `account:logout`.
+ */
+type WireIdentity = {
+    readonly requestId: string;
+    readonly serverInstanceId: string;
+    readonly sessionEpoch: string;
+    readonly occurredAtMs: number;
+};
+export declare function buildAccountLogoutBody(identity: WireIdentity, input: {
+    readonly reasonId?: number;
+    readonly expectedRevision: number;
+}): string;
+export {};
+//# sourceMappingURL=account-logout-wire.d.ts.map

package/dist/internal/account-logout-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-logout-wire.d.ts","sourceRoot":"","sources":["../../src/internal/account-logout-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,KAAK,YAAY,GAAG;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAmBF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE;IACL,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC,GACA,MAAM,CAKR"}

package/dist/internal/account-logout-wire.js

@@ -0,0 +1,24 @@
+/**
+ * Account logout wire builder — single-shot `account:logout`.
+ */
+import { PROTOCOL_MAJOR } from '@softomnitel/omnicall-protocol';
+import { isoNow } from './auth-wire.js';
+function envelope(type, identity, payload) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'command',
+        type,
+        requestId: identity.requestId,
+        serverInstanceId: identity.serverInstanceId,
+        sessionEpoch: identity.sessionEpoch,
+        occurredAt: isoNow(identity.occurredAtMs),
+        payload
+    });
+}
+export function buildAccountLogoutBody(identity, input) {
+    return envelope('account:logout', identity, {
+        expectedRevision: input.expectedRevision,
+        ...(input.reasonId !== undefined ? { reasonId: input.reasonId } : {})
+    });
+}
+//# sourceMappingURL=account-logout-wire.js.map

package/dist/internal/account-logout-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-logout-wire.js","sourceRoot":"","sources":["../../src/internal/account-logout-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AASxC,SAAS,QAAQ,CACf,IAAY,EACZ,QAAsB,EACtB,OAA0C;IAE1C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QACzC,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAsB,EACtB,KAGC;IAED,OAAO,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,EAAE;QAC1C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/auth-grants.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Server-authoritative capability grant parsing (fail closed).
+ */
+import { type CapabilityId } from '@softomnitel/omnicall-protocol';
+export declare function parseGrantedCapabilities(values: readonly string[]): readonly CapabilityId[] | undefined;
+//# sourceMappingURL=auth-grants.d.ts.map

package/dist/internal/auth-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-grants.d.ts","sourceRoot":"","sources":["../../src/internal/auth-grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAEvF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,SAAS,YAAY,EAAE,GAAG,SAAS,CAUrC"}

package/dist/internal/auth-grants.js

@@ -0,0 +1,16 @@
+/**
+ * Server-authoritative capability grant parsing (fail closed).
+ */
+import { CapabilityIdSchema } from '@softomnitel/omnicall-protocol';
+export function parseGrantedCapabilities(values) {
+    const out = [];
+    for (const value of values) {
+        const parsed = CapabilityIdSchema.safeParse(value);
+        if (!parsed.success) {
+            return undefined;
+        }
+        out.push(parsed.data);
+    }
+    return out;
+}
+//# sourceMappingURL=auth-grants.js.map

package/dist/internal/auth-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-grants.js","sourceRoot":"","sources":["../../src/internal/auth-grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,kBAAkB,EAAqB,MAAM,gCAAgC,CAAC;AAEvF,MAAM,UAAU,wBAAwB,CACtC,MAAyB;IAEzB,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/internal/auth-inbound.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Parse inbound auth/handshake/pairing/control messages (unknown → schema).
+ */
+import { type AuthChallenge, type PairingApproved, type PairingDenied, type PairingPending, type ServerHello } from '@softomnitel/omnicall-protocol';
+export type InboundAuthMessage = {
+    readonly kind: 'server_hello';
+    readonly message: ServerHello;
+} | {
+    readonly kind: 'incompatible';
+} | {
+    readonly kind: 'pairing_pending';
+    readonly message: PairingPending;
+} | {
+    readonly kind: 'pairing_approved';
+    readonly message: PairingApproved;
+} | {
+    readonly kind: 'pairing_denied';
+    readonly message: PairingDenied;
+} | {
+    readonly kind: 'permission_changed';
+    readonly grantedCapabilities: readonly string[];
+} | {
+    readonly kind: 'revoked';
+    readonly reasonCode: string;
+} | {
+    readonly kind: 'origin_denied';
+} | {
+    readonly kind: 'preauth_product';
+    readonly type: string;
+} | {
+    readonly kind: 'ignored';
+};
+export declare function parseInboundAuthMessage(raw: string): InboundAuthMessage;
+export declare function challengeFromHello(hello: ServerHello): AuthChallenge | undefined;
+//# sourceMappingURL=auth-inbound.d.ts.map

package/dist/internal/auth-inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-inbound.d.ts","sourceRoot":"","sources":["../../src/internal/auth-inbound.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EASL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AAIxC,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACxE;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CA6EvE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,aAAa,GAAG,SAAS,CAEhF"}

package/dist/internal/auth-inbound.js

@@ -0,0 +1,86 @@
+/**
+ * Parse inbound auth/handshake/pairing/control messages (unknown → schema).
+ */
+import { EventMessageSchema, PairingApprovedSchema, PairingDeniedSchema, PairingPendingSchema, ReplyMessageSchema, ServerHelloSchema, SnapshotMessageSchema, validateWithSchema } from '@softomnitel/omnicall-protocol';
+import { isOriginDeniedWireDetails } from './origin-policy-errors.js';
+export function parseInboundAuthMessage(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { kind: 'ignored' };
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return { kind: 'ignored' };
+    }
+    const type = 'type' in parsed ? parsed.type : undefined;
+    const kind = 'kind' in parsed ? parsed.kind : undefined;
+    if (kind === 'reply') {
+        const reply = validateWithSchema(ReplyMessageSchema, parsed);
+        if (reply.success &&
+            !reply.data.ok &&
+            reply.data.error.code === 'forbidden' &&
+            isOriginDeniedWireDetails(reply.data.error.details)) {
+            return { kind: 'origin_denied' };
+        }
+    }
+    if (type === 'sdk:server-hello') {
+        const result = validateWithSchema(ServerHelloSchema, parsed);
+        if (result.success) {
+            return { kind: 'server_hello', message: result.data };
+        }
+        if (result.code === 'incompatible_version') {
+            return { kind: 'incompatible' };
+        }
+        return { kind: 'ignored' };
+    }
+    if (type === 'pairing:pending') {
+        const result = validateWithSchema(PairingPendingSchema, parsed);
+        return result.success
+            ? { kind: 'pairing_pending', message: result.data }
+            : { kind: 'ignored' };
+    }
+    if (type === 'pairing:approved') {
+        const result = validateWithSchema(PairingApprovedSchema, parsed);
+        return result.success
+            ? { kind: 'pairing_approved', message: result.data }
+            : { kind: 'ignored' };
+    }
+    if (type === 'pairing:denied') {
+        const result = validateWithSchema(PairingDeniedSchema, parsed);
+        return result.success
+            ? { kind: 'pairing_denied', message: result.data }
+            : { kind: 'ignored' };
+    }
+    if (type === 'sdk:permission-changed') {
+        const result = validateWithSchema(EventMessageSchema, parsed);
+        if (!result.success || result.data.type !== 'sdk:permission-changed') {
+            return { kind: 'ignored' };
+        }
+        return {
+            kind: 'permission_changed',
+            grantedCapabilities: result.data.payload.grantedCapabilities
+        };
+    }
+    if (type === 'sdk:revoked') {
+        const result = validateWithSchema(EventMessageSchema, parsed);
+        if (!result.success || result.data.type !== 'sdk:revoked') {
+            return { kind: 'ignored' };
+        }
+        return { kind: 'revoked', reasonCode: result.data.payload.reasonCode };
+    }
+    const snapshot = validateWithSchema(SnapshotMessageSchema, parsed);
+    if (snapshot.success) {
+        return { kind: 'preauth_product', type: 'snapshot' };
+    }
+    const event = validateWithSchema(EventMessageSchema, parsed);
+    if (event.success) {
+        return { kind: 'preauth_product', type: event.data.type };
+    }
+    return { kind: 'ignored' };
+}
+export function challengeFromHello(hello) {
+    return hello.authChallenge;
+}
+//# sourceMappingURL=auth-inbound.js.map

package/dist/internal/auth-inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-inbound.js","sourceRoot":"","sources":["../../src/internal/auth-inbound.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAMnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AActE,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC7D,IACE,KAAK,CAAC,OAAO;YACb,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;YACrC,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EACnD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,OAAO;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,OAAO;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YACpD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,OAAO;YACnB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;YAClD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,OAAO,KAAK,CAAC,aAAa,CAAC;AAC7B,CAAC"}

package/dist/internal/auth-orchestrator.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Pairing + PoP orchestration composed onto ConnectionSession.
+ */
+import { type ApplicationIdentity, type CapabilityId, type PairingProfile } from '@softomnitel/omnicall-protocol';
+import type { ConnectionSession } from './connection-session.js';
+import type { DiagnosticsSink } from './diagnostics.js';
+import type { PopKeyStore } from './pop-key-store.js';
+import type { SessionIdentity } from './session-identity.js';
+import type { Scheduler } from './scheduler.js';
+export type AuthOrchestratorDeps = {
+    readonly connection: ConnectionSession;
+    readonly origin: string;
+    readonly application: ApplicationIdentity;
+    readonly sdkVersion: string;
+    readonly requestedProfile: PairingProfile;
+    readonly requestedCapabilities: readonly CapabilityId[];
+    readonly keyStore: PopKeyStore;
+    readonly scheduler: Scheduler;
+    readonly diagnostics?: DiagnosticsSink;
+    readonly onPairingRequired: (info: {
+        readonly origin: string;
+        readonly requestedProfile: PairingProfile;
+        readonly clientId: string | undefined;
+    }) => void;
+};
+export type AuthOrchestrator = {
+    readonly getSession: () => SessionIdentity | undefined;
+    readonly getGrantedCapabilities: () => readonly CapabilityId[];
+    readonly preauthDropCount: () => number;
+    readonly prepareConnect: () => Promise<void>;
+    readonly onHandshaking: () => void;
+    readonly onUnhandledMessage: (raw: string) => void;
+    readonly clearSession: () => void;
+};
+export declare function createAuthOrchestrator(deps: AuthOrchestratorDeps): AuthOrchestrator;
+//# sourceMappingURL=auth-orchestrator.d.ts.map

package/dist/internal/auth-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-orchestrator.d.ts","sourceRoot":"","sources":["../../src/internal/auth-orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EAEpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,oBAAoB,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,SAAS,YAAY,EAAE,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;KACvC,KAAK,IAAI,CAAC;CACZ,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,eAAe,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,SAAS,YAAY,EAAE,CAAC;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,MAAM,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAwNnF"}