@softomnitel/omnicall-kit 0.1.0-rc.0

package/dist/internal/auth-orchestrator.js

@@ -0,0 +1,217 @@
+/**
+ * Pairing + PoP orchestration composed onto ConnectionSession.
+ */
+import { PROTOCOL_MAX, PROTOCOL_MIN } from '@softomnitel/omnicall-protocol';
+import { parseGrantedCapabilities } from './auth-grants.js';
+import { challengeFromHello, parseInboundAuthMessage } from './auth-inbound.js';
+import { completePopAuth, sendPairingRequest } from './auth-pop-flow.js';
+import { buildClientHelloBody, isoNow } from './auth-wire.js';
+import { createOriginDeniedError } from './origin-policy-errors.js';
+import { generatePopKeyPair } from './pop-crypto.js';
+import { sanitizeRequestedCapabilities } from './requested-capabilities.js';
+export function createAuthOrchestrator(deps) {
+    const usedChallengeIds = new Set();
+    let identity;
+    let session;
+    let lastServerInstanceId;
+    let identityReady = Promise.resolve();
+    let helloInFlight = false;
+    let authInFlight = false;
+    let droppedPreauthCount = 0;
+    const requestedCapabilities = sanitizeRequestedCapabilities({
+        profile: deps.requestedProfile,
+        requested: deps.requestedCapabilities
+    });
+    const prepareConnect = async () => {
+        identityReady = deps.keyStore.load().then((loaded) => {
+            identity = loaded;
+        });
+        await identityReady;
+    };
+    const sendClientHello = async () => {
+        if (helloInFlight || deps.connection.getState() !== 'handshaking') {
+            return;
+        }
+        helloInFlight = true;
+        try {
+            await identityReady;
+            deps.connection.sendRaw(buildClientHelloBody({
+                sdkVersion: deps.sdkVersion,
+                application: deps.application,
+                clientId: identity?.clientId,
+                requestedCapabilities,
+                occurredAt: isoNow(deps.scheduler.now())
+            }));
+        }
+        finally {
+            helloInFlight = false;
+        }
+    };
+    const ensureIdentityKeys = async () => {
+        await identityReady;
+        if (identity !== undefined) {
+            return identity;
+        }
+        const loaded = await deps.keyStore.load();
+        if (loaded !== undefined) {
+            identity = loaded;
+            return loaded;
+        }
+        const keys = await generatePopKeyPair();
+        const created = {
+            clientId: crypto.randomUUID(),
+            publicKeySpkiBase64Url: keys.publicKeySpkiBase64Url,
+            privateKey: keys.privateKey,
+            profile: undefined,
+            grantedCapabilities: []
+        };
+        await deps.keyStore.save(created);
+        identity = created;
+        return created;
+    };
+    const completeAuth = async (hello) => {
+        const challenge = challengeFromHello(hello);
+        if (challenge === undefined || authInFlight) {
+            if (challenge === undefined) {
+                deps.connection.signalFailed();
+            }
+            return;
+        }
+        authInFlight = true;
+        try {
+            const keys = await ensureIdentityKeys();
+            const result = await completePopAuth({
+                connection: deps.connection,
+                origin: deps.origin,
+                hello,
+                keys,
+                scheduler: deps.scheduler,
+                usedChallengeIds
+            });
+            if (!result.ok) {
+                deps.connection.signalFailed();
+                return;
+            }
+            session = result.session;
+            lastServerInstanceId = hello.serverInstanceId;
+            deps.connection.signalReady(hello.heartbeatSeconds);
+        }
+        finally {
+            authInFlight = false;
+        }
+    };
+    const handleServerHello = async (hello) => {
+        if (hello.selectedProtocolVersion < PROTOCOL_MIN ||
+            hello.selectedProtocolVersion > PROTOCOL_MAX) {
+            deps.connection.signalIncompatible();
+            return;
+        }
+        if (lastServerInstanceId !== undefined &&
+            lastServerInstanceId !== hello.serverInstanceId) {
+            usedChallengeIds.clear();
+            session = undefined;
+        }
+        if (hello.pairingRequired) {
+            const keys = await ensureIdentityKeys();
+            sendPairingRequest({
+                connection: deps.connection,
+                origin: deps.origin,
+                application: deps.application,
+                requestedProfile: deps.requestedProfile,
+                requestedCapabilities,
+                keys,
+                scheduler: deps.scheduler,
+                onPairingRequired: deps.onPairingRequired
+            });
+            return;
+        }
+        await completeAuth(hello);
+    };
+    const handleInbound = async (raw) => {
+        const message = parseInboundAuthMessage(raw);
+        const state = deps.connection.getState();
+        if (message.kind === 'preauth_product') {
+            if (state !== 'ready') {
+                droppedPreauthCount += 1;
+                deps.diagnostics?.emit({
+                    level: 'warn',
+                    code: 'auth.preauth_drop',
+                    connectionState: state
+                });
+            }
+            return;
+        }
+        if (message.kind === 'incompatible') {
+            deps.connection.signalIncompatible();
+            return;
+        }
+        if (message.kind === 'server_hello') {
+            await handleServerHello(message.message);
+            return;
+        }
+        if (message.kind === 'pairing_pending') {
+            return;
+        }
+        if (message.kind === 'pairing_approved') {
+            const keys = await ensureIdentityKeys();
+            const updated = {
+                clientId: message.message.clientId,
+                publicKeySpkiBase64Url: keys.publicKeySpkiBase64Url,
+                privateKey: keys.privateKey,
+                profile: message.message.profile,
+                grantedCapabilities: [...message.message.grantedCapabilities]
+            };
+            await deps.keyStore.save(updated);
+            identity = updated;
+            deps.connection.requestReauth();
+            return;
+        }
+        if (message.kind === 'pairing_denied') {
+            deps.connection.signalFailed();
+            return;
+        }
+        if (message.kind === 'origin_denied') {
+            deps.connection.signalOriginPolicyFailure(createOriginDeniedError());
+            return;
+        }
+        if (message.kind === 'permission_changed') {
+            if (state !== 'ready' || session === undefined || identity === undefined) {
+                return;
+            }
+            const granted = parseGrantedCapabilities(message.grantedCapabilities);
+            if (granted === undefined) {
+                return;
+            }
+            identity = { ...identity, grantedCapabilities: granted };
+            session = Object.freeze({
+                ...session,
+                grantedCapabilities: Object.freeze([...granted])
+            });
+            await deps.keyStore.save(identity);
+            return;
+        }
+        if (message.kind === 'revoked') {
+            await deps.keyStore.clear();
+            identity = undefined;
+            session = undefined;
+            usedChallengeIds.clear();
+            deps.connection.signalRevoked();
+        }
+    };
+    return {
+        getSession: () => session,
+        getGrantedCapabilities: () => session?.grantedCapabilities ?? [],
+        preauthDropCount: () => droppedPreauthCount,
+        prepareConnect,
+        onHandshaking: () => {
+            void sendClientHello();
+        },
+        onUnhandledMessage: (raw) => {
+            void handleInbound(raw);
+        },
+        clearSession: () => {
+            session = undefined;
+        }
+    };
+}
+//# sourceMappingURL=auth-orchestrator.js.map

package/dist/internal/auth-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-orchestrator.js","sourceRoot":"","sources":["../../src/internal/auth-orchestrator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,YAAY,EACZ,YAAY,EAKb,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AA+B5E,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,QAAuC,CAAC;IAC5C,IAAI,OAAoC,CAAC;IACzC,IAAI,oBAAwC,CAAC;IAC7C,IAAI,aAAa,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACrD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAE5B,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;QAC1D,OAAO,EAAE,IAAI,CAAC,gBAAgB;QAC9B,SAAS,EAAE,IAAI,CAAC,qBAAqB;KACtC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;QAC/C,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACnD,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,aAAa,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,IAAmB,EAAE;QAChD,IAAI,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,aAAa,EAAE,CAAC;YAClE,OAAO;QACT,CAAC;QACD,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,OAAO,CACrB,oBAAoB,CAAC;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,EAAE,QAAQ;gBAC5B,qBAAqB;gBACrB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;aACzC,CAAC,CACH,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,KAAK,IAAgC,EAAE;QAChE,MAAM,aAAa,CAAC;QACpB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,GAAG,MAAM,CAAC;YAClB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC;QACxC,MAAM,OAAO,GAAsB;YACjC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;YAC7B,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;YACnD,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,SAAS;YAClB,mBAAmB,EAAE,EAAE;SACxB,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,QAAQ,GAAG,OAAO,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,KAAkB,EAAiB,EAAE;QAC/D,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,YAAY,EAAE,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YACjC,CAAC;YACD,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK;gBACL,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,gBAAgB;aACjB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,oBAAoB,GAAG,KAAK,CAAC,gBAAgB,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,KAAkB,EAAiB,EAAE;QACpE,IACE,KAAK,CAAC,uBAAuB,GAAG,YAAY;YAC5C,KAAK,CAAC,uBAAuB,GAAG,YAAY,EAC5C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IACE,oBAAoB,KAAK,SAAS;YAClC,oBAAoB,KAAK,KAAK,CAAC,gBAAgB,EAC/C,CAAC;YACD,gBAAgB,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACxC,kBAAkB,CAAC;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,qBAAqB;gBACrB,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACvC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,mBAAmB,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;oBACrB,KAAK,EAAE,MAAM;oBACb,IAAI,EAAE,mBAAmB;oBACzB,eAAe,EAAE,KAAK;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAsB;gBACjC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;gBAClC,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;gBAChC,mBAAmB,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;aAC9D,CAAC;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,QAAQ,GAAG,OAAO,CAAC;YACnB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,uBAAuB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,IAAI,KAAK,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;YACzD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBACtB,GAAG,OAAO;gBACV,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;aACjD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC5B,QAAQ,GAAG,SAAS,CAAC;YACrB,OAAO,GAAG,SAAS,CAAC;YACpB,gBAAgB,CAAC,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACzB,sBAAsB,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,mBAAmB,IAAI,EAAE;QAChE,gBAAgB,EAAE,GAAG,EAAE,CAAC,mBAAmB;QAC3C,cAAc;QACd,aAAa,EAAE,GAAG,EAAE;YAClB,KAAK,eAAe,EAAE,CAAC;QACzB,CAAC;QACD,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;YAC1B,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,YAAY,EAAE,GAAG,EAAE;YACjB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/internal/auth-pop-flow.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Pairing request + PoP challenge completion helpers for AuthOrchestrator.
+ */
+import type { ApplicationIdentity, CapabilityId, PairingProfile, ServerHello } from '@softomnitel/omnicall-protocol';
+import type { ConnectionSession } from './connection-session.js';
+import type { StoredPopIdentity } from './pop-key-store.js';
+import type { SessionIdentity } from './session-identity.js';
+import type { Scheduler } from './scheduler.js';
+export declare function sendPairingRequest(input: {
+    readonly connection: ConnectionSession;
+    readonly origin: string;
+    readonly application: ApplicationIdentity;
+    readonly requestedProfile: PairingProfile;
+    readonly requestedCapabilities: readonly CapabilityId[];
+    readonly keys: StoredPopIdentity;
+    readonly scheduler: Scheduler;
+    readonly onPairingRequired: (info: {
+        readonly origin: string;
+        readonly requestedProfile: PairingProfile;
+        readonly clientId: string | undefined;
+    }) => void;
+}): void;
+export type CompletePopAuthResult = {
+    readonly ok: true;
+    readonly session: SessionIdentity;
+} | {
+    readonly ok: false;
+    readonly reason: 'no_challenge' | 'replay' | 'ping_failed';
+};
+export declare function completePopAuth(input: {
+    readonly connection: ConnectionSession;
+    readonly origin: string;
+    readonly hello: ServerHello;
+    readonly keys: StoredPopIdentity;
+    readonly scheduler: Scheduler;
+    readonly usedChallengeIds: Set<string>;
+}): Promise<CompletePopAuthResult>;
+//# sourceMappingURL=auth-pop-flow.d.ts.map

package/dist/internal/auth-pop-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-pop-flow.d.ts","sourceRoot":"","sources":["../../src/internal/auth-pop-flow.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,gCAAgC,CAAC;AASxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,SAAS,YAAY,EAAE,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;KACvC,KAAK,IAAI,CAAC;CACZ,GAAG,IAAI,CAiBP;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAA;CAAE,CAAC;AAEvF,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACxC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0DjC"}

package/dist/internal/auth-pop-flow.js

@@ -0,0 +1,80 @@
+/**
+ * Pairing request + PoP challenge completion helpers for AuthOrchestrator.
+ */
+import { buildAuthProofBody, buildPairingRequestBody, buildPingBody, isoNow } from './auth-wire.js';
+import { challengeFromHello } from './auth-inbound.js';
+import { signPopChallenge } from './pop-crypto.js';
+export function sendPairingRequest(input) {
+    input.connection.signalPairingRequired();
+    input.onPairingRequired({
+        origin: input.origin,
+        requestedProfile: input.requestedProfile,
+        clientId: input.keys.clientId
+    });
+    input.connection.sendRaw(buildPairingRequestBody({
+        clientId: input.keys.clientId,
+        publicKeySpkiBase64Url: input.keys.publicKeySpkiBase64Url,
+        application: input.application,
+        requestedProfile: input.requestedProfile,
+        requestedCapabilities: input.requestedCapabilities,
+        occurredAt: isoNow(input.scheduler.now())
+    }));
+}
+export async function completePopAuth(input) {
+    const challenge = challengeFromHello(input.hello);
+    if (challenge === undefined) {
+        return { ok: false, reason: 'no_challenge' };
+    }
+    if (input.usedChallengeIds.has(challenge.challengeId)) {
+        return { ok: false, reason: 'replay' };
+    }
+    input.usedChallengeIds.add(challenge.challengeId);
+    input.connection.signalAuthenticating();
+    const signature = await signPopChallenge({
+        privateKey: input.keys.privateKey,
+        serverInstanceId: input.hello.serverInstanceId,
+        sessionEpoch: input.hello.sessionEpoch,
+        origin: input.origin,
+        clientId: input.keys.clientId,
+        challengeId: challenge.challengeId,
+        nonce: challenge.nonce
+    });
+    input.connection.sendRaw(buildAuthProofBody({
+        challengeId: challenge.challengeId,
+        clientId: input.keys.clientId,
+        signature,
+        occurredAt: isoNow(input.scheduler.now())
+    }));
+    input.connection.setWireIdentity({
+        serverInstanceId: input.hello.serverInstanceId,
+        sessionEpoch: input.hello.sessionEpoch
+    });
+    const requestId = `auth_ping_${input.scheduler.now()}`;
+    const pingResult = await input.connection.request({
+        requestId,
+        commandType: 'sdk:ping',
+        body: buildPingBody({
+            requestId,
+            serverInstanceId: input.hello.serverInstanceId,
+            sessionEpoch: input.hello.sessionEpoch,
+            occurredAt: isoNow(input.scheduler.now())
+        })
+    });
+    if (!pingResult.ok) {
+        return { ok: false, reason: 'ping_failed' };
+    }
+    return {
+        ok: true,
+        session: Object.freeze({
+            serverInstanceId: input.hello.serverInstanceId,
+            sessionEpoch: input.hello.sessionEpoch,
+            selectedProtocolVersion: input.hello.selectedProtocolVersion,
+            clientId: input.keys.clientId,
+            profile: input.keys.profile,
+            grantedCapabilities: Object.freeze([...input.keys.grantedCapabilities]),
+            heartbeatSeconds: input.hello.heartbeatSeconds,
+            maxMessageBytes: input.hello.maxMessageBytes
+        })
+    };
+}
+//# sourceMappingURL=auth-pop-flow.js.map

package/dist/internal/auth-pop-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-pop-flow.js","sourceRoot":"","sources":["../../src/internal/auth-pop-flow.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,MAAM,EACP,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKnD,MAAM,UAAU,kBAAkB,CAAC,KAalC;IACC,KAAK,CAAC,UAAU,CAAC,qBAAqB,EAAE,CAAC;IACzC,KAAK,CAAC,iBAAiB,CAAC;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;KAC9B,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC,OAAO,CACtB,uBAAuB,CAAC;QACtB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;KAC1C,CAAC,CACH,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAOrC;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClD,KAAK,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;QAC9C,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,KAAK,CAAC,UAAU,CAAC,OAAO,CACtB,kBAAkB,CAAC;QACjB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;KAC1C,CAAC,CACH,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;QAC/B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;QAC9C,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,aAAa,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAChD,SAAS;QACT,WAAW,EAAE,UAAU;QACvB,IAAI,EAAE,aAAa,CAAC;YAClB,SAAS;YACT,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;YAC9C,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;SAC1C,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;YAC9C,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY;YACtC,uBAAuB,EAAE,KAAK,CAAC,KAAK,CAAC,uBAAuB;YAC5D,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3B,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvE,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB;YAC9C,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/internal/auth-wire.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Auth/pairing/handshake wire builders. Schemas from @softomnitel/omnicall-protocol.
+ */
+import { type ApplicationIdentity, type AuthChallenge, type CapabilityId, type PairingProfile, type ServerHello } from '@softomnitel/omnicall-protocol';
+export declare function buildClientHelloBody(input: {
+    readonly sdkVersion: string;
+    readonly application: ApplicationIdentity;
+    readonly clientId: string | undefined;
+    readonly requestedCapabilities: readonly CapabilityId[];
+    readonly occurredAt: string;
+}): string;
+export declare function buildPairingRequestBody(input: {
+    readonly clientId: string;
+    readonly publicKeySpkiBase64Url: string;
+    readonly application: ApplicationIdentity;
+    readonly requestedProfile: PairingProfile;
+    readonly requestedCapabilities: readonly CapabilityId[];
+    readonly occurredAt: string;
+}): string;
+export declare function buildAuthProofBody(input: {
+    readonly challengeId: string;
+    readonly clientId: string;
+    readonly signature: string;
+    readonly occurredAt: string;
+}): string;
+export declare function buildPingBody(input: {
+    readonly requestId: string;
+    readonly serverInstanceId: string;
+    readonly sessionEpoch: string;
+    readonly occurredAt: string;
+}): string;
+export declare function isoNow(epochMs: number): string;
+export type NegotiatedServerHello = {
+    readonly hello: ServerHello;
+    readonly challenge: AuthChallenge | undefined;
+};
+//# sourceMappingURL=auth-wire.d.ts.map

package/dist/internal/auth-wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wire.d.ts","sourceRoot":"","sources":["../../src/internal/auth-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AAKxC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,YAAY,EAAE,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAcT;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,SAAS,YAAY,EAAE,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAaT;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAUT;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAWT;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,SAAS,CAAC;CAC/C,CAAC"}

package/dist/internal/auth-wire.js

@@ -0,0 +1,62 @@
+/**
+ * Auth/pairing/handshake wire builders. Schemas from @softomnitel/omnicall-protocol.
+ */
+import { PROTOCOL_MAJOR, PROTOCOL_MAX, PROTOCOL_MIN } from '@softomnitel/omnicall-protocol';
+import { randomBase64Url } from './base64url.js';
+import { popKeyAlgorithmId } from './pop-crypto.js';
+export function buildClientHelloBody(input) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'handshake',
+        type: 'sdk:client-hello',
+        protocolMin: PROTOCOL_MIN,
+        protocolMax: PROTOCOL_MAX,
+        sdkVersion: input.sdkVersion,
+        application: input.application,
+        ...(input.clientId !== undefined ? { clientId: input.clientId } : {}),
+        requestedCapabilities: [...input.requestedCapabilities],
+        clientNonce: randomBase64Url(16),
+        occurredAt: input.occurredAt
+    });
+}
+export function buildPairingRequestBody(input) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'pairing',
+        type: 'pairing:request',
+        clientId: input.clientId,
+        clientPublicKey: input.publicKeySpkiBase64Url,
+        keyAlgorithm: popKeyAlgorithmId(),
+        application: input.application,
+        requestedProfile: input.requestedProfile,
+        requestedCapabilities: [...input.requestedCapabilities],
+        occurredAt: input.occurredAt
+    });
+}
+export function buildAuthProofBody(input) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'auth',
+        type: 'sdk:auth-proof',
+        challengeId: input.challengeId,
+        clientId: input.clientId,
+        signature: input.signature,
+        occurredAt: input.occurredAt
+    });
+}
+export function buildPingBody(input) {
+    return JSON.stringify({
+        protocolVersion: PROTOCOL_MAJOR,
+        kind: 'command',
+        type: 'sdk:ping',
+        requestId: input.requestId,
+        serverInstanceId: input.serverInstanceId,
+        sessionEpoch: input.sessionEpoch,
+        occurredAt: input.occurredAt,
+        payload: {}
+    });
+}
+export function isoNow(epochMs) {
+    return new Date(epochMs).toISOString();
+}
+//# sourceMappingURL=auth-wire.js.map

package/dist/internal/auth-wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wire.js","sourceRoot":"","sources":["../../src/internal/auth-wire.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EAMb,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,UAAU,oBAAoB,CAAC,KAMpC;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,YAAY;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,qBAAqB,EAAE,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC;QACvD,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAOvC;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,sBAAsB;QAC7C,YAAY,EAAE,iBAAiB,EAAE;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,qBAAqB,EAAE,CAAC,GAAG,KAAK,CAAC,qBAAqB,CAAC;QACvD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAKlC;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,cAAc;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,EAAE;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzC,CAAC"}

package/dist/internal/base64url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Base64url helpers for PoP wire fields (ADR-0016).
+ */
+export declare function bytesToBase64Url(bytes: ArrayBuffer | Uint8Array): string;
+export declare function base64UrlToBytes(value: string): Uint8Array;
+export declare function randomBase64Url(byteLength: number): string;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/internal/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAOxE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAU1D;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI1D"}

package/dist/internal/base64url.js

@@ -0,0 +1,28 @@
+/**
+ * Base64url helpers for PoP wire fields (ADR-0016).
+ */
+export function bytesToBase64Url(bytes) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let binary = '';
+    for (let index = 0; index < view.length; index += 1) {
+        binary += String.fromCharCode(view[index]);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/u, '');
+}
+export function base64UrlToBytes(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padLength = (4 - (padded.length % 4)) % 4;
+    const withPad = padded + '='.repeat(padLength);
+    const binary = atob(withPad);
+    const out = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        out[index] = binary.charCodeAt(index);
+    }
+    return out;
+}
+export function randomBase64Url(byteLength) {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return bytesToBase64Url(bytes);
+}
+//# sourceMappingURL=base64url.js.map

package/dist/internal/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,UAAU,gBAAgB,CAAC,KAA+B;IAC9D,MAAM,IAAI,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/internal/browser-websocket-transport.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Official browser WebSocket adapter for {@link TransportPort}.
+ * Protocol / reconnect / auth stay in the connection session — this is bytes only.
+ */
+import type { TransportPort } from './transport-port.js';
+/** Minimal WebSocket surface used by the adapter (browser or injectable test double). @public */
+export type BrowserWebSocketLike = {
+    readonly readyState: number;
+    binaryType: string;
+    onopen: ((ev: Event) => void) | null;
+    onmessage: ((ev: MessageEvent) => void) | null;
+    onerror: ((ev: Event) => void) | null;
+    onclose: ((ev: CloseEvent) => void) | null;
+    send: (data: string) => void;
+    close: (code?: number, reason?: string) => void;
+};
+/** Constructor shape compatible with `globalThis.WebSocket`. @public */
+export type BrowserWebSocketConstructor = {
+    new (url: string): BrowserWebSocketLike;
+    readonly OPEN: number;
+};
+/**
+ * Options for {@link createBrowserWebSocketTransport}.
+ * @public
+ */
+export type CreateBrowserWebSocketTransportOptions = {
+    /** Inject a WebSocket constructor (tests). Defaults to `globalThis.WebSocket`. */
+    readonly webSocket?: BrowserWebSocketConstructor;
+};
+/**
+ * Create one browser WebSocket transport instance.
+ * Call once per connect/reconnect attempt (via `transportFactory`).
+ * @public
+ */
+export declare function createBrowserWebSocketTransport(options?: CreateBrowserWebSocketTransportOptions): TransportPort;
+//# sourceMappingURL=browser-websocket-transport.d.ts.map

package/dist/internal/browser-websocket-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-websocket-transport.d.ts","sourceRoot":"","sources":["../../src/internal/browser-websocket-transport.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,qBAAqB,CAAC;AAI7B,iGAAiG;AACjG,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,CAAC;AAEF,wEAAwE;AACxE,MAAM,MAAM,2BAA2B,GAAG;IACxC,KAAK,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,sCAAsC,GAAG;IACnD,kFAAkF;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;CAClD,CAAC;AAyDF;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,CAAC,EAAE,sCAAsC,GAC/C,aAAa,CA4Ff"}