openrtc 2.5.3 → 2.6.0

package/dist/{Connection-CovQdc8E.d.ts → Connection-CQdRHqjO.d.ts}

@@ -304,6 +304,39 @@ interface ManagedSession {
     stop: () => Promise<void>;
 }
 
+/** Public protocol identifiers; provider prices and safety ceilings stay private. */
+declare const SERVICE_ERROR_CODES: {
+    readonly CREDIT_EXHAUSTED: "credit-exhausted";
+    readonly APP_BUDGET_EXHAUSTED: "app-budget-exhausted";
+    readonly APP_RATE_LIMITED: "app-rate-limited";
+    readonly PRINCIPAL_RATE_LIMITED: "principal-rate-limited";
+    readonly EDGE_RATE_LIMITED: "edge-rate-limited";
+    readonly PROVIDER_SAFETY_PAUSED: "provider-safety-paused";
+    readonly USAGE_PRICE_STALE: "usage-price-stale";
+    readonly RELAY_BUDGET_EXHAUSTED: "relay-budget-exhausted";
+    readonly ROOM_CAPACITY_EXCEEDED: "room-capacity-exceeded";
+};
+type ServiceErrorCode = (typeof SERVICE_ERROR_CODES)[keyof typeof SERVICE_ERROR_CODES];
+interface ServiceErrorMetadata {
+    scope?: 'account' | 'app' | 'principal' | 'ip' | 'avenue' | 'platform';
+    operation?: string;
+    requestId?: string;
+    retryAfterMs?: number;
+    /** UTC Unix timestamp in milliseconds. */
+    resetAt?: number;
+    documentationUrl?: string;
+}
+
+/** An observed service denial, not a peer-state or retry command. */
+interface ServiceErrorObservation extends Readonly<ServiceErrorMetadata> {
+    readonly code: ServiceErrorCode;
+    readonly retryable: boolean;
+    readonly avenue: Readonly<{
+        kind: 'user' | 'space' | 'room' | 'session';
+        id: string;
+    }>;
+}
+
 /**
  * Provider-neutral hot coordination contract.
  *
@@ -390,6 +423,8 @@ interface CoordinationSignalingStore {
     watchCoordinationRoomMembers?(roomId: string, callback: (members: RoomMember[]) => void): () => void;
 }
 interface CoordinationGatewayOptions {
+    /** Passive browser gateway denial projection. Never owns retry or peer state. */
+    onServiceError?: (error: ServiceErrorObservation) => void;
     /**
      * Provider-neutral coordination gateway endpoint.
      * Credentials are delivered in the first WebSocket frame, never this URL.
@@ -1622,4 +1657,4 @@ declare class Connection {
     private close;
 }
 
-export { type DeviceEvent as $, type RawConnection as A, type RuntimeRoomMember as B, type ChannelDescriptor$1 as C, type DeviceStatus as D, type EffectiveRoomArchitecture as E, type AuthContext as F, type GrantScope as G, type RuntimeClientOptions as H, type IncomingStream as I, type JoinRoomOptions$1 as J, type DiscoveryMode as K, type LocalDeviceInfo$1 as L, type ManagedOptions as M, type AuthMode as N, type SignalingMode as O, type PlutoIrohConfiguration as P, type ClientOptions as Q, type RoomArchitectureMode as R, type ScopedChannelOptions as S, type ExplicitFileDataSendParams as T, type ISignalingBackend as U, type RuntimeIdentity as V, type RoomMember as W, type Device as X, type DeviceStatusSnapshot as Y, type ManagedConnectionRecord as Z, type SignalingEnvelope as _, type RoomArchitectureReason as a, type SessionKind as a$, type DesiredPeerProjection as a0, type SignalingSession as a1, type SessionEvent as a2, type LocalDeviceInfo as a3, type NativeManagedSessionStartResult as a4, type BackendPeerBiStream as a5, type BackendPeerUniStream as a6, type PortableMediaPublish as a7, type PortableMediaPublicationStart as a8, type PortableMediaSample as a9, type PresenceLoopOptions as aA, type SignalingOptions as aB, type JoinRoomOptions as aC, type ChannelMetadata as aD, type RoomCreationMode as aE, type ProtocolCapabilityMap as aF, type ScanningLoopOptions as aG, type ScanningLoopHandle as aH, type RuntimeBootstrapOptions as aI, type RuntimeBootstrapResult as aJ, type ApplicationPayloadReadinessOptions as aK, type ManagedApplicationRouteOptions as aL, type PeerState as aM, type PeerScope as aN, type PeerHealth as aO, type ChannelDescriptor as aP, type JoinRequest as aQ, type AutoConnectPolicy as aR, type ChannelFraming as aS, type ConnectionStatus as aT, type DevicePresence as aU, type PayloadRouteOptions as aV, type PeerLifecycleStatus$1 as aW, type PeerSessionSnapshot$1 as aX, type PresencePolicy as aY, type RuntimeAuthContext as aZ, type RuntimePeerScope as a_, type PortableMediaChunk as aa, type PortableMediaControl as ab, type NativeConnectParams as ac, type NativeConnectResult as ad, type BackendConnectionState as ae, type NativePeerDataEvent as af, type CoordinationGatewayGrantRequest as ag, type CoordinationGatewayGrant as ah, type BrowserWasmRuntimeModule as ai, type BrowserProtocolStore as aj, type NamespaceDescriptor as ak, type IrohMutationReceipt as al, type IrohDocEntry as am, type CoordinationSignalingStore as an, type ManagedRoomMessage as ao, type CoreClientBridgeHost as ap, type RouteDescriptor as aq, type PayloadCrypto as ar, type CryptoStreams as as, type CryptoBiStream as at, type RouteFamily as au, type RouteKind as av, type RuntimeAuthIdentity as aw, type RuntimeSession as ax, type AppLimits as ay, type ConnectionTarget as az, type RoomArchitectureSnapshot as b, type SessionPlatform as b0, type RoomAuthorityAssignment as c, type PlutoRTCConfiguration as d, type PlutoMoQConfiguration as e, type RouteOptimization as f, type ProtocolName as g, type RuntimePeerState as h, type PeerConnectOptions as i, Connection as j, type PeerSessionSnapshot as k, type PeerReadiness as l, type RuntimePeerHealth as m, type ResolvedPeerIdentity as n, type PeerStreamOptions as o, type RuntimeDevice as p, type ScopedLogicalChannel as q, type ConnectionState as r, type ReadinessOptions as s, type ConnectionEvent as t, type ManagedSession as u, type DeviceConnectOptions as v, type ConnectDeviceResult as w, type ConnectDeviceHooks as x, type ConnectDeviceOptions as y, type DeviceProfile as z };
+export { type ManagedConnectionRecord as $, type DeviceProfile as A, type RawConnection as B, type ChannelDescriptor$1 as C, type DeviceStatus as D, type EffectiveRoomArchitecture as E, type RuntimeRoomMember as F, type GrantScope as G, type AuthContext as H, type IncomingStream as I, type JoinRoomOptions$1 as J, type RuntimeClientOptions as K, type LocalDeviceInfo$1 as L, type ManagedOptions as M, type ServiceErrorMetadata as N, type DiscoveryMode as O, type PlutoIrohConfiguration as P, type AuthMode as Q, type RoomArchitectureMode as R, type ServiceErrorObservation as S, type SignalingMode as T, type ClientOptions as U, type ExplicitFileDataSendParams as V, type ISignalingBackend as W, type RuntimeIdentity as X, type RoomMember as Y, type Device as Z, type DeviceStatusSnapshot as _, type RoomArchitectureReason as a, type RuntimeAuthContext as a$, type SignalingEnvelope as a0, type DeviceEvent as a1, type DesiredPeerProjection as a2, type SignalingSession as a3, type SessionEvent as a4, type LocalDeviceInfo as a5, type NativeManagedSessionStartResult as a6, type BackendPeerBiStream as a7, type BackendPeerUniStream as a8, type PortableMediaPublish as a9, type AppLimits as aA, type ConnectionTarget as aB, type PresenceLoopOptions as aC, type SignalingOptions as aD, type JoinRoomOptions as aE, type ChannelMetadata as aF, type RoomCreationMode as aG, type ProtocolCapabilityMap as aH, type ScanningLoopOptions as aI, type ScanningLoopHandle as aJ, type RuntimeBootstrapOptions as aK, type RuntimeBootstrapResult as aL, type ApplicationPayloadReadinessOptions as aM, type ManagedApplicationRouteOptions as aN, type PeerState as aO, type PeerScope as aP, type PeerHealth as aQ, type ChannelDescriptor as aR, type JoinRequest as aS, type AutoConnectPolicy as aT, type ChannelFraming as aU, type ConnectionStatus as aV, type DevicePresence as aW, type PayloadRouteOptions as aX, type PeerLifecycleStatus$1 as aY, type PeerSessionSnapshot$1 as aZ, type PresencePolicy as a_, type PortableMediaPublicationStart as aa, type PortableMediaSample as ab, type PortableMediaChunk as ac, type PortableMediaControl as ad, type NativeConnectParams as ae, type NativeConnectResult as af, type BackendConnectionState as ag, type NativePeerDataEvent as ah, type CoordinationGatewayGrantRequest as ai, type CoordinationGatewayGrant as aj, type BrowserWasmRuntimeModule as ak, type BrowserProtocolStore as al, type NamespaceDescriptor as am, type IrohMutationReceipt as an, type IrohDocEntry as ao, type CoordinationSignalingStore as ap, type ManagedRoomMessage as aq, type CoreClientBridgeHost as ar, type RouteDescriptor as as, type PayloadCrypto as at, type CryptoStreams as au, type CryptoBiStream as av, type RouteFamily as aw, type RouteKind as ax, type RuntimeAuthIdentity as ay, type RuntimeSession as az, type RoomArchitectureSnapshot as b, type RuntimePeerScope as b0, type SessionKind as b1, type SessionPlatform as b2, type RoomAuthorityAssignment as c, type PlutoRTCConfiguration as d, type PlutoMoQConfiguration as e, type RouteOptimization as f, type ProtocolName as g, type RuntimePeerState as h, type PeerConnectOptions as i, Connection as j, type PeerSessionSnapshot as k, type PeerReadiness as l, type RuntimePeerHealth as m, type ResolvedPeerIdentity as n, type PeerStreamOptions as o, type ScopedChannelOptions as p, type RuntimeDevice as q, type ScopedLogicalChannel as r, type ConnectionState as s, type ReadinessOptions as t, type ConnectionEvent as u, type ManagedSession as v, type DeviceConnectOptions as w, type ConnectDeviceResult as x, type ConnectDeviceHooks as y, type ConnectDeviceOptions as z };

package/dist/{DelegatingRuntimeAdapter-3ykiNvyh.d.ts → DelegatingRuntimeAdapter-B8ubDv86.d.ts}

@@ -1,5 +1,5 @@
-import { K as DiscoveryMode, N as AuthMode, O as SignalingMode, Q as ClientOptions, T as ExplicitFileDataSendParams, U as ISignalingBackend, V as RuntimeIdentity, F as AuthContext, W as RoomMember, X as Device, Y as DeviceStatusSnapshot, k as PeerSessionSnapshot, n as ResolvedPeerIdentity, Z as ManagedConnectionRecord, _ as SignalingEnvelope, $ as DeviceEvent, a0 as DesiredPeerProjection, a1 as SignalingSession, a2 as SessionEvent, a3 as LocalDeviceInfo, a4 as NativeManagedSessionStartResult, g as ProtocolName, G as GrantScope, a5 as BackendPeerBiStream, a6 as BackendPeerUniStream, a7 as PortableMediaPublish, a8 as PortableMediaPublicationStart, a9 as PortableMediaSample, aa as PortableMediaChunk, ab as PortableMediaControl, ac as NativeConnectParams, ad as NativeConnectResult, ae as BackendConnectionState, af as NativePeerDataEvent } from './Connection-CovQdc8E.js';
-import { R as RuntimeCapabilities } from './capabilities-CdZpAKvE.js';
+import { O as DiscoveryMode, Q as AuthMode, T as SignalingMode, U as ClientOptions, V as ExplicitFileDataSendParams, W as ISignalingBackend, X as RuntimeIdentity, H as AuthContext, Y as RoomMember, Z as Device, _ as DeviceStatusSnapshot, k as PeerSessionSnapshot, n as ResolvedPeerIdentity, $ as ManagedConnectionRecord, a0 as SignalingEnvelope, a1 as DeviceEvent, a2 as DesiredPeerProjection, a3 as SignalingSession, a4 as SessionEvent, a5 as LocalDeviceInfo, a6 as NativeManagedSessionStartResult, g as ProtocolName, G as GrantScope, a7 as BackendPeerBiStream, a8 as BackendPeerUniStream, a9 as PortableMediaPublish, aa as PortableMediaPublicationStart, ab as PortableMediaSample, ac as PortableMediaChunk, ad as PortableMediaControl, ae as NativeConnectParams, af as NativeConnectResult, ag as BackendConnectionState, ah as NativePeerDataEvent } from './Connection-CQdRHqjO.js';
+import { R as RuntimeCapabilities } from './capabilities-BgxJVk9q.js';
 
 /** Host-neutral configuration shared by browser/WASM and native/IPC adapters. */
 interface RuntimeBridgeOptions {

package/dist/{IpcRuntimeAdapter-BkM_1HyL.d.ts → IpcRuntimeAdapter-D4vIpOre.d.ts}

@@ -1,10 +1,6 @@
-import { R as RuntimeBridgeOptions, D as DelegatingRuntimeAdapter } from './DelegatingRuntimeAdapter-3ykiNvyh.js';
+import { R as RuntimeBridgeOptions, D as DelegatingRuntimeAdapter } from './DelegatingRuntimeAdapter-B8ubDv86.js';
 import { P as PlutoIpcBridge } from './ipc-DgzKqHH3.js';
-import { ae as BackendConnectionState, af as NativePeerDataEvent, X as Device } from './Connection-CovQdc8E.js';
-
-interface NativeIpcBridgeOptions extends RuntimeBridgeOptions {
-    ipcBridge?: PlutoIpcBridge;
-}
+import { S as ServiceErrorObservation, ag as BackendConnectionState, ah as NativePeerDataEvent, Z as Device } from './Connection-CQdRHqjO.js';
 
 /**
  * Root-client owner for the one native WebView projection.
@@ -35,9 +31,18 @@ interface NativeProjectedStreamSource {
     onStateChange(callback: (state: BackendConnectionState) => void): () => void;
     onPeerMessage(callback: (event: NativePeerDataEvent) => void): () => void;
     onDevices(callback: (devices: Device[]) => void): () => void;
+    onServiceError(callback: (error: ServiceErrorObservation) => void): () => void;
     isCurrentTransport(endpointId: string, transportStableId: bigint): Promise<boolean>;
 }
 type NativeRootProjectionEvent = {
+    kind: 'service-error';
+    capabilityKeys: readonly string[];
+    payload: {
+        avenue: ServiceErrorObservation['avenue'];
+        runtimeInstanceId: string;
+        serviceError: unknown;
+    };
+} | {
     kind: 'connection-state';
     capabilityKeys: readonly string[];
     payload: BackendConnectionState;
@@ -69,6 +74,7 @@ declare class NativeProjectionBroker {
     private subscribeState;
     private subscribePeerData;
     private subscribeDevices;
+    private subscribeServiceError;
     private requireConsumer;
     private currentHost;
     private incomingStreams;
@@ -80,6 +86,10 @@ declare class NativeProjectionBroker {
     close(): Promise<void>;
 }
 
+interface NativeIpcBridgeOptions extends RuntimeBridgeOptions {
+    ipcBridge?: PlutoIpcBridge;
+}
+
 interface IpcAdapterOptions extends NativeIpcBridgeOptions {
     bridge: PlutoIpcBridge;
     projectionBroker: NativeProjectionBroker;

package/dist/WasmBridge-W3GRBTTZ.js

@@ -0,0 +1 @@
+export{b as WasmBridge,a as loadBrowserWasmRuntimeModule}from'./chunk-V7E4OUN5.js';import'./chunk-AYHD4X2R.js';import'./chunk-GQWHEDGU.js';import'./chunk-XMYBBLYK.js';import'./chunk-OT7IPLZE.js';import'./chunk-OWKAJPOI.js';import'./chunk-ISTROQQJ.js';import'./chunk-CNAW5BZ3.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';

package/dist/{assembly-C235UKSS.d.ts → assembly-D9vP5Q6M.d.ts}

@@ -1,5 +1,5 @@
-import { h as RuntimePeerState, r as ConnectionState, l as PeerReadiness, i as PeerConnectOptions, j as Connection, I as IncomingStream, G as GrantScope, H as RuntimeClientOptions, U as ISignalingBackend, aw as RuntimeAuthIdentity, F as AuthContext, g as ProtocolName, L as LocalDeviceInfo, z as DeviceProfile, aj as BrowserProtocolStore, ak as NamespaceDescriptor, al as IrohMutationReceipt, am as IrohDocEntry, p as RuntimeDevice, M as ManagedOptions, u as ManagedSession, D as DeviceStatus, x as ConnectDeviceHooks, y as ConnectDeviceOptions, w as ConnectDeviceResult, v as DeviceConnectOptions, Z as ManagedConnectionRecord, k as PeerSessionSnapshot, n as ResolvedPeerIdentity, ax as RuntimeSession, ay as AppLimits, J as JoinRoomOptions, B as RuntimeRoomMember, az as ConnectionTarget, S as ScopedChannelOptions, q as ScopedLogicalChannel, o as PeerStreamOptions, ac as NativeConnectParams, ad as NativeConnectResult, A as RawConnection, C as ChannelDescriptor, T as ExplicitFileDataSendParams, aA as PresenceLoopOptions, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, m as RuntimePeerHealth, s as ReadinessOptions, t as ConnectionEvent } from './Connection-CovQdc8E.js';
-import { R as RuntimeCapabilities, C as CapabilityProfile } from './capabilities-CdZpAKvE.js';
+import { h as RuntimePeerState, s as ConnectionState, l as PeerReadiness, i as PeerConnectOptions, j as Connection, I as IncomingStream, G as GrantScope, K as RuntimeClientOptions, W as ISignalingBackend, ay as RuntimeAuthIdentity, H as AuthContext, g as ProtocolName, L as LocalDeviceInfo, A as DeviceProfile, al as BrowserProtocolStore, am as NamespaceDescriptor, an as IrohMutationReceipt, ao as IrohDocEntry, q as RuntimeDevice, M as ManagedOptions, v as ManagedSession, D as DeviceStatus, y as ConnectDeviceHooks, z as ConnectDeviceOptions, x as ConnectDeviceResult, w as DeviceConnectOptions, $ as ManagedConnectionRecord, k as PeerSessionSnapshot, n as ResolvedPeerIdentity, az as RuntimeSession, aA as AppLimits, J as JoinRoomOptions, F as RuntimeRoomMember, aB as ConnectionTarget, p as ScopedChannelOptions, r as ScopedLogicalChannel, o as PeerStreamOptions, ae as NativeConnectParams, af as NativeConnectResult, B as RawConnection, C as ChannelDescriptor, V as ExplicitFileDataSendParams, aC as PresenceLoopOptions, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, m as RuntimePeerHealth, t as ReadinessOptions, u as ConnectionEvent } from './Connection-CQdRHqjO.js';
+import { R as RuntimeCapabilities, C as CapabilityProfile } from './capabilities-BgxJVk9q.js';
 
 /**
  * Coalesced peer reconciliation scheduler and full reconcile orchestration.

package/dist/{capabilities-CdZpAKvE.d.ts → capabilities-BgxJVk9q.d.ts}

@@ -1,4 +1,4 @@
-import { g as ProtocolName, f as RouteOptimization } from './Connection-CovQdc8E.js';
+import { g as ProtocolName, f as RouteOptimization } from './Connection-CQdRHqjO.js';
 
 type RuntimeAdapterKind = 'browser-wasm' | 'native-ipc' | 'tauri-ipc' | 'unknown';
 type CapabilityMaturity = 'stable' | 'preview' | 'support-only' | 'unavailable';

package/dist/chunk-4R5BLX2U.js

@@ -0,0 +1,2 @@
+var E={CREDIT_EXHAUSTED:"credit-exhausted",APP_BUDGET_EXHAUSTED:"app-budget-exhausted",APP_RATE_LIMITED:"app-rate-limited",PRINCIPAL_RATE_LIMITED:"principal-rate-limited",EDGE_RATE_LIMITED:"edge-rate-limited",PROVIDER_SAFETY_PAUSED:"provider-safety-paused",USAGE_PRICE_STALE:"usage-price-stale",RELAY_BUDGET_EXHAUSTED:"relay-budget-exhausted",ROOM_CAPACITY_EXCEEDED:"room-capacity-exceeded"},I={"edge-rate-exceeded":{code:E.EDGE_RATE_LIMITED,scope:"ip"},"route-rate-exceeded":{code:E.EDGE_RATE_LIMITED,scope:"avenue"}};function D(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return Object.prototype.hasOwnProperty.call(I,t)?I[t]:void 0}function f(e){return u(e)?{code:e}:D(e)}var g=new Set(Object.values(E));function u(e){return typeof e=="string"&&g.has(e)}var S="https://openrtc-docs.web.app/openrtc/api/errors";function s(e){let t=e,r={documentationUrl:S};typeof t.scope=="string"&&["account","app","principal","ip","avenue","platform"].includes(t.scope)&&(r.scope=t.scope),typeof t.operation=="string"&&/^[a-z0-9.-]{1,100}$/.test(t.operation)&&(r.operation=t.operation),typeof t.requestId=="string"&&/^[A-Za-z0-9_.:-]{1,160}$/.test(t.requestId)&&(r.requestId=t.requestId);for(let n of ["retryAfterMs","resetAt"])Number.isSafeInteger(t[n])&&Number(t[n])>=0&&(r[n]=Number(t[n]));return r}var o={...E,AUTH_NOT_READY:"auth/not-ready",AUTH_DENIED:"auth/denied",AUTH_EXPIRED:"auth/expired",AUTH_DEVICE_REENROLLMENT_REQUIRED:"auth/device-reenrollment-required",ADMISSION_DENIED:"admission/denied",ADMISSION_SCOPE_MISMATCH:"admission/scope-mismatch",ROOM_ARCHITECTURE_UNAVAILABLE:"room-architecture-unavailable",BUDGET_EXCEEDED:"budget/exceeded",BUDGET_STALE:"budget/stale",BUDGET_RENEWAL_REQUIRED:"budget/renewal-required",COORDINATION_DISCONNECTED:"coordination/disconnected",COORDINATION_PROTOCOL:"coordination/protocol",COORDINATION_RATE_LIMITED:"coordination/rate-limited",COORDINATION_SERVICE_UNAVAILABLE:"coordination/service-unavailable",TRANSPORT_DIAL_EXHAUSTED:"transport/dial-exhausted",TRANSPORT_UNAVAILABLE:"transport/unavailable",TRANSPORT_TICKET_MISSING:"transport/ticket-missing",DELIVERY_NOT_READY:"delivery/not-ready",INTERNAL:"internal/error"},a=class e extends Error{constructor(r){super(r.message);this.name="RTCError";r.cause!==void 0&&(this.cause=r.cause),this.code=r.code,this.retryable=r.retryable,this.plane=r.plane,this.generation=r.generation,this.transportGeneration=r.transportGeneration,this.routeGeneration=r.routeGeneration,this.revision=r.revision,u(r.code)&&Object.assign(this,s(r));}static is(r){return r instanceof e||typeof r=="object"&&r!==null&&r.name==="RTCError"&&typeof r.code=="string"&&typeof r.retryable=="boolean"&&typeof r.plane=="string"}static shouldAppRetry(r){let n=b(r);return n.retryable?n.plane==="coordination"||n.plane==="transport"||n.plane==="auth":false}toJSON(){return {name:this.name,code:this.code,message:this.message,retryable:this.retryable,plane:this.plane,generation:this.generation??null,transportGeneration:this.transportGeneration??null,routeGeneration:this.routeGeneration??null,revision:this.revision??null,...u(this.code)?s(this):{}}}};function v(e){let t=b(e);return {errorCode:t.code,retryable:t.retryable,errorPlane:t.plane,...u(t.code)?s(t):{}}}function d(e,t,r){let n=T(e);return new a({code:e,message:t,retryable:r.retryable??n.retryable,plane:r.plane??n.plane,cause:r.cause,generation:r.generation,transportGeneration:r.transportGeneration,routeGeneration:r.routeGeneration,revision:r.revision,...s(r)})}function T(e){if(String(e).endsWith("-rate-limited"))return {retryable:true,plane:"coordination"};if(e===o.ROOM_CAPACITY_EXCEEDED||e===o.ROOM_ARCHITECTURE_UNAVAILABLE)return {retryable:false,plane:"admission"};let t=String(e).split("/",1)[0],r=u(e)?"budget":["auth","admission","budget","coordination","transport","delivery"].includes(t)?t:"internal";return {retryable:r==="transport"||r==="delivery"||r==="auth"&&e!==o.AUTH_DENIED||r==="coordination"&&e!==o.COORDINATION_PROTOCOL||r==="budget"&&[o.USAGE_PRICE_STALE,o.BUDGET_STALE,o.BUDGET_RENEWAL_REQUIRED].includes(e),plane:r}}function i(e,t,r){return new a({code:e,message:t,...T(e),cause:r})}function b(e){if(a.is(e))return e instanceof a?e:new a({code:e.code,message:e.message||String(e),retryable:e.retryable,plane:e.plane,cause:e,generation:e.generation,transportGeneration:e.transportGeneration,routeGeneration:e.routeGeneration,revision:e.revision,...s(e)});if(typeof e=="object"&&e!==null){let r=e,n=typeof r.code=="string"?r.code:"",l=typeof r.message=="string"?r.message:typeof r.error=="string"?r.error:e instanceof Error?e.message:String(e),R=typeof r.retryable=="boolean"?r.retryable:void 0,y=r.details&&typeof r.details=="object"&&!Array.isArray(r.details)?r.details:null,A=y&&f(y.code),C=f(n),p=A?y:C?e:null,c=A||C;if(p&&c)return new a({...T(c.code),code:c.code,message:l,cause:e,retryable:typeof p.retryable=="boolean"?p.retryable:!!c.scope,...s(p),...c.scope?{scope:c.scope}:{}});if(n){let _=h(n,l,R);if(_)return _}if(typeof r.name=="string"&&r.name==="CoordinationConnectError")return d(o.COORDINATION_DISCONNECTED,l,{retryable:R??true,plane:"coordination",cause:e});if(typeof r.name=="string"&&r.name==="CoordinationGatewayProtocolError")return d(n||o.COORDINATION_PROTOCOL,l,{retryable:R??false,plane:O(n),cause:e})}let t=e instanceof Error?e.message:String(e??"unknown error");return m(t,e)}function h(e,t,r){let n=e.trim().toLowerCase();return n===o.ROOM_ARCHITECTURE_UNAVAILABLE?i(o.ROOM_ARCHITECTURE_UNAVAILABLE,t):n==="unauthenticated"||n==="functions/unauthenticated"||n==="auth/unauthorized"||n.includes("permission-denied")?i(o.AUTH_DENIED,t):n==="budget-renewal-required"||n==="budget/renewal-required"?d(o.BUDGET_RENEWAL_REQUIRED,t,{retryable:r??true,plane:"budget"}):n.includes("resource-exhausted")||n.includes("budget")||n==="budget-exceeded"||n==="insufficient-budget"?n.includes("stale")||/stale-budget/i.test(t)?d(o.BUDGET_STALE,t,{retryable:r??true,plane:"budget"}):i(o.BUDGET_EXCEEDED,t):n.includes("rate-limit")||n==="rate_limited"||n==="too-many-requests"?d(o.COORDINATION_RATE_LIMITED,t,{retryable:r??true,plane:"coordination"}):n.includes("admission")||n==="permission-denied"||n==="session-token-denied"?i(o.ADMISSION_DENIED,t):n.includes("scope")?i(o.ADMISSION_SCOPE_MISMATCH,t):n.includes("disconnect")||n.includes("unavailable")||n==="aborted"?d(o.COORDINATION_DISCONNECTED,t,{retryable:r??true,plane:"coordination"}):n.startsWith("coordination/")||n.includes("protocol")?d(e,t,{retryable:r??false,plane:O(e)}):null}function O(e){let t=e.trim().toLowerCase();return t.includes("budget")?"budget":t.includes("auth")?"auth":t.includes("admission")||t.includes("scope")?"admission":"coordination"}function m(e,t){return /auth(?:entication)?\s*(?:not ready|pending|missing)/i.test(e)||/token\s*(?:not ready|pending|missing)/i.test(e)||/awaiting[- ]auth/i.test(e)?i(o.AUTH_NOT_READY,e,t):/missing endpoint ticket|ticket missing/i.test(e)?i(o.TRANSPORT_TICKET_MISSING,e,t):/dial.*(exhaust|budget)|retry budget|connection.*did not become application-routable/i.test(e)?i(o.TRANSPORT_DIAL_EXHAUSTED,e,t):/stale[- ]budget/i.test(e)?i(o.BUDGET_STALE,e,t):/budget|credit|quota|limit\s*exceeded/i.test(e)?i(o.BUDGET_EXCEEDED,e,t):/admission|session[- ]token.*(deny|reject)|permission[- ]denied/i.test(e)?i(o.ADMISSION_DENIED,e,t):/not\s+application-routable|not[- ]ready|settledReady/i.test(e)?i(o.DELIVERY_NOT_READY,e,t):/gateway|coordination|websocket|signaling/i.test(e)?i(o.COORDINATION_DISCONNECTED,e,t):i(o.INTERNAL,e,t)}
+export{D as a,f as b,u as c,s as d,o as e,a as f,v as g,d as h,b as i};

package/dist/{chunk-WMA4OMJL.js → chunk-5KN6YOM6.js}

@@ -1 +1 @@
-import {r}from'./chunk-VC7TGJFS.js';import {a}from'./chunk-25CN4MLA.js';function v(i,d){let t=new r(i,d),a$1=i.spaceKey??i.space,l=(i.discoveryMode===void 0||i.discoveryMode==="space")&&typeof i.apiKey=="string"&&i.apiKey.trim().length>0&&typeof a$1=="string"&&a$1.trim().length>0,o={runtime:t,async setAuthContext(e){await t.setAuthContext(e);},async syncPlutoAuth(e){if(l)return;let n=a(),c=n.getCurrentUser(),r=(typeof e?.userId=="string"?e.userId.trim():"")||c?.uid||null;if(!r){await o.setAuthContext(null);return}let m=await n.getIdToken({forceRefresh:e?.forceRefresh??false}).catch(()=>null),g=n.getCurrentUser()?.refreshToken??null,h=n.getCurrentUser()?.stsTokenManager?.expirationTime??null;await o.setAuthContext({userId:r,token:m,refreshToken:g,tokenProvider:async y=>n.getIdToken({forceRefresh:y??false}),expiresAtMs:h});},bindPlutoAuthHost(){let e=a();return o.syncPlutoAuth({userId:e.getCurrentUser()?.uid??null,forceRefresh:false}),e.onIdTokenChanged(n=>{o.syncPlutoAuth({userId:n?.uid??null,forceRefresh:false});})},signInWithPluto:()=>t.signInWithPluto(),signOut:()=>t.signOut(),stopManagedSession:()=>t.stopManagedSession(),startManagedSession:e=>t.startManagedSession(e),onAuthChange:e=>t.onIdentityChange(e),getManagedNodeId:e=>t.getManagedNodeId(e),getRuntimeStatus:()=>t.getRuntimeStatus(),listDeviceStatus:()=>t.listDeviceStatus(),watchDeviceStatus:e=>t.watchDeviceStatus(e),connectDevice:(e,n)=>t.connectDevice(e,n),excludeAutoConnect:(e,n)=>t.excludeAutoConnect(e,n)};return Object.defineProperty(o,"identity",{get:()=>t.identity,enumerable:true}),o}export{v as a};
+import {r}from'./chunk-C7UBBRYW.js';import {a}from'./chunk-GQWHEDGU.js';function v(i,d){let t=new r(i,d),a$1=i.spaceKey??i.space,l=(i.discoveryMode===void 0||i.discoveryMode==="space")&&typeof i.apiKey=="string"&&i.apiKey.trim().length>0&&typeof a$1=="string"&&a$1.trim().length>0,o={runtime:t,async setAuthContext(e){await t.setAuthContext(e);},async syncPlutoAuth(e){if(l)return;let n=a(),c=n.getCurrentUser(),r=(typeof e?.userId=="string"?e.userId.trim():"")||c?.uid||null;if(!r){await o.setAuthContext(null);return}let m=await n.getIdToken({forceRefresh:e?.forceRefresh??false}).catch(()=>null),g=n.getCurrentUser()?.refreshToken??null,h=n.getCurrentUser()?.stsTokenManager?.expirationTime??null;await o.setAuthContext({userId:r,token:m,refreshToken:g,tokenProvider:async y=>n.getIdToken({forceRefresh:y??false}),expiresAtMs:h});},bindPlutoAuthHost(){let e=a();return o.syncPlutoAuth({userId:e.getCurrentUser()?.uid??null,forceRefresh:false}),e.onIdTokenChanged(n=>{o.syncPlutoAuth({userId:n?.uid??null,forceRefresh:false});})},signInWithPluto:()=>t.signInWithPluto(),signOut:()=>t.signOut(),stopManagedSession:()=>t.stopManagedSession(),startManagedSession:e=>t.startManagedSession(e),onAuthChange:e=>t.onIdentityChange(e),getManagedNodeId:e=>t.getManagedNodeId(e),getRuntimeStatus:()=>t.getRuntimeStatus(),listDeviceStatus:()=>t.listDeviceStatus(),watchDeviceStatus:e=>t.watchDeviceStatus(e),connectDevice:(e,n)=>t.connectDevice(e,n),excludeAutoConnect:(e,n)=>t.excludeAutoConnect(e,n)};return Object.defineProperty(o,"identity",{get:()=>t.identity,enumerable:true}),o}export{v as a};

package/dist/chunk-BEYBIRAN.js

@@ -0,0 +1,2 @@
+import {b as b$1}from'./chunk-ZA44REGI.js';import {c,a,i,d}from'./chunk-4R5BLX2U.js';function b(s){return {irohRelay:s.irohRelay===true||s.irohRelay===void 0&&s.relay!==false,managedTurn:s.managedTurn===true}}var M=1440*6e4,w=class extends Error{constructor(i,n,a){super(i);this.status=n;this.reason=a;this.name="RTCError";let t=[502,503,504].includes(n),o=a==="device-reenrollment-auth-required";this.code=o?"auth/device-reenrollment-required":t?"coordination/service-unavailable":n===429?"coordination/rate-limited":n===401?"auth/expired":n===403?"admission/denied":"internal/error",this.retryable=o||t,this.plane=o||n===401?"auth":t||n===429?"coordination":n===403?"admission":"internal";}};function T(s){return !(s instanceof w)||s.status!==403?false:s.reason==="device-certificate-stale"||s.reason==="device-certificate-revoked"?true:!s.reason&&s.message==="Device certificate is revoked or stale."}function C(s,e,i){return `openrtc:v2:device-certificate:${s}:${e}:${i}`}function P(s,e){return `openrtc:v2:device-session:${s}:${e}`}async function G(s,e,i){let n=new TextEncoder().encode(`openrtc:v2:session\0${s}\0${e}\0${i}`),a=new Uint8Array(await crypto.subtle.digest("SHA-256",n)),t="";for(let o of a)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function k(s){let e=s.replace(/-/g,"+").replace(/_/g,"/"),i=e.padEnd(Math.ceil(e.length/4)*4,"="),n=atob(i);return Uint8Array.from(n,a=>a.charCodeAt(0))}function f(s){let e="";for(let i of s)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}async function B(s,e,i,n,a){if(typeof s.token!="string"||typeof s.expiresAtMs!="number"||s.expiresAtMs<=Date.now()+M||!s.signingPublicJwk||s.signingPublicJwk.kty!=="OKP"||s.signingPublicJwk.crv!=="Ed25519"||typeof s.signingPublicJwk.x!="string")return null;let t=s.token.split(".");if(t.length!==3)return null;let o,r;try{o=JSON.parse(new TextDecoder().decode(k(t[0]))),r=b$1(s.token);}catch{return null}if(o.alg!=="EdDSA"||s.signingPublicJwk.kid&&o.kid!==s.signingPublicJwk.kid)return null;try{let y=await crypto.subtle.importKey("jwk",s.signingPublicJwk,{name:"Ed25519"},!1,["verify"]);if(!await crypto.subtle.verify({name:"Ed25519"},y,k(t[2]),new TextEncoder().encode(`${t[0]}.${t[1]}`)))return null}catch{return null}let c=typeof r.principalId=="string"?r.principalId:"",l=Number(r.iat),u=Number(r.exp);if(r.iss!=="openrtc"||r.aud!=="openrtc:v2:gateway-grant"||r.typ!=="device-certificate"||r.appTag!==e||!c||a!==void 0&&c!==a||typeof r.principalKey!="string"||r.principalKey.length===0||r.deviceId!==i||r.deviceKeyThumbprint!==n||typeof r.jti!="string"||r.jti.length===0||!Number.isSafeInteger(l)||!Number.isSafeInteger(u)||l>=u||u*1e3!==s.expiresAtMs)return null;let d=b(r);return {token:s.token,expiresAtMs:s.expiresAtMs,principalId:c,signingPublicJwk:s.signingPublicJwk,enrolled:false,...d}}async function J(s,e,i,n,a){try{let t=C(e,i,n),o=s.readSecureRecord?await s.readSecureRecord(e,t):globalThis.localStorage?.getItem(t);if(!o)return null;let r=JSON.parse(o),c=await B(r,e,n,a,i);return c?{token:c.token,expiresAtMs:c.expiresAtMs,principalId:i,signingPublicJwk:c.signingPublicJwk}:null}catch(t){if(s.readSecureRecord)throw t;return null}}async function _(s,e,i,n,a){try{let t=P(e,n),o=s.readSecureRecord?await s.readSecureRecord(i,t):globalThis.localStorage?.getItem(t);return o?await B(JSON.parse(o),i,n,a):null}catch(t){if(s.readSecureRecord)throw t;return null}}async function O(s,e,i,n,a){try{let t=C(e,i,n),o=JSON.stringify(a);s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function $(s,e,i,n,a){try{let t=P(i,n),o=JSON.stringify({token:a.token,expiresAtMs:a.expiresAtMs,principalId:a.principalId,signingPublicJwk:a.signingPublicJwk});s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function A(s,e,i,n,a){try{let t=C(e,i,n);if(s.deleteSecureRecord?await s.deleteSecureRecord(e,t):globalThis.localStorage?.removeItem(t),a){let o=P(a,n);s.deleteSecureRecord?await s.deleteSecureRecord(e,o):globalThis.localStorage?.removeItem(o);}}catch(t){if(s.deleteSecureRecord)throw t}}function K(s){return `${s}_${crypto.randomUUID()}`}function U(s){if(s instanceof TypeError)return  true;if(!s||typeof s!="object")return  false;let e=Reflect.get(s,"name");return e==="TimeoutError"||e==="AbortError"}async function j(s,e){let i=new TextEncoder().encode(`${s}:${e}`);return [...new Uint8Array(await crypto.subtle.digest("SHA-256",i))].map(a=>a.toString(16).padStart(2,"0")).join("")}var x=class{constructor(e,i,n,a,t={},o){this.apiKey=e;this.endpoints=i;this.keyProvider=n;this.attestation=a;this.events=t;this.botVerification=o;this.keyPromise=null;this.authEpochs=new Map;this.appTag=`app_${e.slice(-16)}`;}record(e){this.events.onLogicalOperation?.(e);}before(e){this.events.beforeLogicalOperation?.(e);}authEpoch(e){let i=this.authEpochs.get(e);if(i)return i;let n={generation:0,devices:new Map};return this.authEpochs.set(e,n),e.subscribe&&(n.unsubscribe=e.subscribe(a=>{a?.type==="principal-changed"&&(n.generation+=1,n.devices.clear(),n.sessionKeyHash=void 0,this.events.onAuthEpochChanged?.(e));})),n}dispose(){for(let e of this.authEpochs.values())e.unsubscribe?.();this.authEpochs.clear();}key(){return this.keyPromise??(this.keyPromise=this.keyProvider.getOrCreate(this.appTag))}async deviceSigningPublicKey(){return (await this.key()).publicKeyJwk}async signDeviceBytes(e){return (await this.key()).sign(e)}async resolveBroadcastAccess(e,i){if(!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(e)||e.length>32768)throw new Error("Broadcast grant is invalid.");if(i&&i.byteLength!==32)throw new Error("Broadcast publisher verification key is invalid.");let n=await this.key(),a=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e)))),t=i?f(i):"",o=await n.proof((u,d)=>["openrtc:v2:broadcast-access",this.apiKey,a,t,u,d].join(":")),r=await this.post("/v2/broadcasts",{action:"access",grant:e,...t?{publicationVerifyingKey:t}:{},deviceProof:o});if(r.grant!==e)throw new Error("Broadcast access grant mismatch.");let c=k(r.issuerPublicKey);if(c.byteLength!==32)throw new Error("Broadcast issuer key is invalid.");let l=new URL(r.relay?.relayUrl);if(l.protocol!=="https:"||l.username||l.password)throw new Error("Broadcast relay URL is invalid.");if(typeof r.relay.token!="string"||!/^[A-Za-z0-9._-]{16,16384}$/.test(r.relay.token)||typeof r.relay.namespace!="string"||!/^[A-Za-z0-9._/-]{1,512}$/.test(r.relay.namespace))throw new Error("Broadcast relay allocation is invalid.");return {token:e,issuerPublicKey:c,signBindingChallenge:async u=>{if(!(u instanceof Uint8Array)||u.byteLength>2048)throw new Error("Broadcast binding challenge is invalid.");return k(await n.sign(u))},relay:{relayUrl:l.toString(),token:r.relay.token,namespace:r.relay.namespace}}}async manageBroadcast(e){let i=await this.deviceCertificate(e.auth,e.deviceId),n=e.grant??"",a=e.invite??"",t=e.create,o=e.invitation,r=t?f(t.publisher.verificationKey):o?.publicationVerificationKey?f(o.publicationVerificationKey):"",c=t?{maxPublishers:t.maxPublishers,maxSubscribers:t.maxSubscribers,maxBitrateBps:t.maxBitrateBps,maxDurationSeconds:t.maxDurationSeconds,maxEgressBytes:t.maxEgressBytes}:void 0,l=t?{bitrateBps:t.publisherBitrateBps,durationSeconds:t.maxDurationSeconds,reservedEgressBytes:t.reservedEgressBytes}:o?{role:o.role,sourceSlot:o.sourceSlot??"",bitrateBps:o.bitrateBps,durationSeconds:o.durationSeconds,reservedEgressBytes:o.reservedEgressBytes}:void 0,u=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(JSON.stringify({action:e.action,grant:n,invite:a,publicationKey:r,sourceSlot:t?.sourceSlot??o?.sourceSlot??"host-a",limits:c,reservation:l}))))),y=await(await this.key()).proof((g,v)=>["openrtc:v2:broadcast-manage",i.source.token,e.action,u,g,v].join(":")),p=await this.post("/v2/broadcasts",{action:e.action,deviceId:e.deviceId,deviceCertificate:i.source.token,deviceProof:y,...n?{grant:n}:{},...a?{invite:a}:{},...r?{publicationVerifyingKey:r}:{},...t?{sourceSlot:t.sourceSlot??"host-a",limits:c,reservation:l}:{},...o?{invitation:{...l,publicationVerifyingKey:r}}:{}});if(e.action==="create"||e.action==="renew"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast grant is invalid.");return p.grant}if(e.action==="invite"){if(typeof p.invite!="string"||!/^obi1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.invite))throw new Error("Managed broadcast invitation is invalid.");return p.invite}if(e.action==="accept"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast accepted grant is invalid.");return p.grant}}async post(e,i$1){let n=K("request"),a$1=JSON.stringify({apiKey:this.apiKey,...i$1}),t=null;for(let o=0;o<2;o+=1)try{let r=await fetch(`${this.endpoints.controlPlane}${e}`,{method:"POST",headers:{"Content-Type":"application/json","X-OpenRTC-Idempotency-Key":n},body:a$1,signal:AbortSignal.timeout(15e3)});if(r.ok)return r.json();let c$1=`OpenRTC request failed (${r.status}).`,l,u;try{let y=await r.json();typeof y.error=="string"&&(c$1=y.error.slice(0,256)),typeof y.reason=="string"&&/^[a-z0-9-]{1,80}$/.test(y.reason)&&(l=y.reason),(c(y.code)||a(y.code))&&(u=i({...d(y),code:y.code,message:c$1,retryable:y.retryable}));}catch{}let d$1=u?Object.assign(u,{status:r.status,reason:l}):new w(c$1,r.status,l);if(t=d$1,!u&&o===0&&[502,503,504].includes(r.status))continue;throw d$1}catch(r){if(t=r,o===0&&U(r))continue;throw r}throw t instanceof Error?t:new Error("OpenRTC request failed.")}async capability(e,i,n,a=false,t,o){this.before("capability.issue");let r=e==="space"?await j(this.apiKey,i):i,l=await(await this.key()).proof((p,g)=>["openrtc:v2:capability",this.apiKey,e,r,p,g].join(":")),u=this.botVerification?await this.botVerification.getToken({action:"openrtc_capability",apiKey:this.apiKey}):void 0,d=await this.post("/v2/capabilities",{avenue:{kind:e,id:r},deviceProof:l,...n?{maxPeers:n}:{},...a?{advancedFanout:true}:{},...e==="room"&&t?{architecture:t}:{},...e==="room"&&o?{roomDelivery:o}:{},...u?{turnstileToken:u}:{}});this.record("capability.issue");let y={type:"capability",token:d.capability,avenue:e==="ticket"?{kind:"session",id:r}:d.avenue,expiresAtMs:d.expiresAt*1e3,...b(d)};return y.renew=()=>this.capability(e,i,n,a,t,o),y}async deviceCertificate(e,i,n,a,t){let o=this.authEpoch(e),r=o.devices.get(i)??{};if(o.devices.set(i,r),t&&r.current&&r.current.token!==t.token)return this.deviceCertificateResult(e,i,n,a,{...r.current,enrolled:false});if(!t&&r.current&&r.current.expiresAtMs>Date.now()+M)return this.deviceCertificateResult(e,i,n,a,{...r.current,enrolled:false});if(!r.inFlight){let l=o.generation;t&&(r.current=void 0,r.recoverRevokedEnrollment=true);let u=t?A(this.keyProvider,this.appTag,t.principalId,i,o.sessionKeyHash).then(()=>this.enrollAuthenticatedDevice(e,i,o.sessionKeyHash,a,true)):this.resolveAuthenticatedDevice(e,i,o,a,r.recoverRevokedEnrollment===true);r.inFlight=u.then(d=>{if(o.generation!==l)throw new Error("The OpenRTC authentication identity changed during enrollment.");return r.recoverRevokedEnrollment=false,r.current=d,d}).finally(()=>{r.inFlight=void 0;});}let c=await r.inFlight;return this.deviceCertificateResult(e,i,n,a,c)}async resolveAuthenticatedDevice(e,i,n,a,t=false){let o=await this.key();if(e.getSessionKey){let r=await e.getSessionKey();if(!r)throw new Error("The OpenRTC auth provider has no active principal.");let c=await G(this.appTag,o.thumbprint,r);n.sessionKeyHash=c;let l=await _(this.keyProvider,c,this.appTag,i,o.thumbprint);if(l)return l}return this.enrollAuthenticatedDevice(e,i,n.sessionKeyHash,a,t)}deviceCertificateResult(e,i,n,a,t){let o={type:"device-certificate",token:t.token,avenue:n??{kind:"user",id:t.principalId},expiresAtMs:t.expiresAtMs,irohRelay:t.irohRelay,managedTurn:t.managedTurn};return o.renew=async()=>(await this.deviceCertificate(e,i,n,a)).source,o.recoverRejectedCertificate=async()=>(await this.deviceCertificate(e,i,n,a,t)).source,{principalId:t.principalId,source:o,enrolled:t.enrolled}}async enrollAuthenticatedDevice(e,i,n,a,t=false){this.before("identity.assertion.exchange"),this.before("identity.monthly-active-principal");let o=async(g,v)=>{let m=await e.getAssertion({audience:"https://api.openrtc.app/v2/assertions/exchange",forceRefresh:g,deviceId:i,...{}});if(!m)throw new Error("The OpenRTC auth provider returned no assertion.");return this.post("/v2/assertions/exchange",{assertion:m,deviceId:i,...e.providerId?{providerId:e.providerId}:{}})},r;try{r=await o(!1);}catch(g){if(!(g instanceof w)||g.status!==401)throw g;r=await o(true);}this.record("identity.assertion.exchange"),this.record("identity.monthly-active-principal");let c=await this.key(),l=await J(this.keyProvider,this.appTag,r.principalId,i,c.thumbprint);if(l)return {...l,principalId:r.principalId,enrolled:false,...b(r)};this.before("device.enroll"),this.attestation&&this.before("security.attestation.verify");let{enrollDevice:u}=await import('./deviceEnrollment-2UW67OPP.js'),d=await u({apiKey:this.apiKey,appTag:this.appTag,auth:e,attestation:this.attestation,deviceId:i,identity:r,key:c,profile:a,recoverRevokedEnrollment:t||r.deviceRecoveryAuthorized===true,post:(g,v)=>this.post(g,v),recordAssertionExchange:()=>this.record("identity.assertion.exchange")});r=d.identity;let y=d.enrollment;this.record("device.enroll"),this.attestation&&this.record("security.attestation.verify");let p={principalId:r.principalId,token:y.deviceCertificate,expiresAtMs:y.expiresAt*1e3,signingPublicJwk:y.signingPublicJwk,enrolled:true,...b(r)};return await O(this.keyProvider,this.appTag,r.principalId,i,{token:p.token,expiresAtMs:p.expiresAtMs,signingPublicJwk:p.signingPublicJwk}),n&&await $(this.keyProvider,this.appTag,n,i,p),p}async listEnrolledDevices(e,i){let n=await this.deviceCertificate(e,i);return (await this.deviceManagement(n.source,i,"list")).devices??[]}async revokeDevice(e,i,n){let a=await this.deviceCertificate(e,i);if(await this.deviceManagement(a.source,i,"revoke",n),n===i){let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,i,t.sessionKeyHash),t.devices.delete(i),await this.deleteDeviceKey();}}async revokeAllDevices(e,i,n){let a=await this.deviceCertificate(e,i);await this.deviceManagement(a.source,i,"revoke-all",void 0,n);let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,i,t.sessionKeyHash),t.devices.delete(i),n?await this.deviceCertificate(e,i):(t.devices.clear(),await this.deleteDeviceKey());}async deleteDeviceKey(){this.keyPromise=null,await this.keyProvider.delete?.(this.appTag);}async deviceManagement(e,i,n,a,t=false){let o=n==="revoke"?"device.revoke":n==="revoke-all"?"identity.revoke-all":null;o&&this.before(o);let{manageDevice:r}=await import('./deviceManagement-SUMBRXXC.js'),c=await r({source:e,currentDeviceId:i,action:n,targetDeviceId:a,exceptCurrent:t,key:()=>this.key(),post:l=>this.post("/v2/devices/manage",l),isStale:T});return o&&this.record(o),c}async durableRoomMembership(e,i,n){if(e.type!=="device-certificate")throw new Error("Durable rooms require a device certificate.");this.before(n==="join"?"room.join":"room.leave");let a=b$1(e.token),t=String(a.jti??""),r=await(await this.key()).proof((c,l)=>["openrtc:v2:room-membership",t,n,i,c,l].join(":"));await this.post("/v2/rooms/memberships",{action:n,roomId:i,deviceCertificate:e.token,deviceProof:r}),this.record(n==="join"?"room.join":"room.leave");}grantProvider(e,i={}){let n=Promise.resolve(),a=e;return t=>{let o=n.then(async()=>{let r=false;a.expiresAtMs<=Date.now()+3e5&&a.renew&&(a=await a.renew(),r=true);let c=t.refreshGrant?"gateway.grant.refresh":"gateway.grant.issue";this.before(c),t.refreshGrant&&this.before("coordination.credential.refresh");let l=async d=>{let y=b$1(d.token),p=String(y.jti??""),v=await(await this.key()).proof((m,I)=>["openrtc:v2:gateway-grant",p,t.avenue.kind,t.avenue.id,t.runtimeInstanceId,m,I].join(":"));return this.post("/v2/gateway/grants",{credentialType:d.type,credential:d.token,avenue:t.avenue,runtimeInstanceId:t.runtimeInstanceId,ticketFingerprint:t.ticketFingerprint,deviceProof:v,...t.refreshGrant?{refreshGrant:t.refreshGrant}:{},...i.maxPeers?{maxPeers:i.maxPeers}:{},...i.features?{features:i.features}:{},...t.avenue.kind==="room"&&i.architecture?{architecture:i.architecture}:{},...t.avenue.kind==="room"&&i.roomDelivery?{roomDelivery:i.roomDelivery}:{},...d.type==="device-certificate"&&i.deviceProfile?{deviceProfile:i.deviceProfile}:{}})},u;try{u=await l(a);}catch(d){if(!T(d))throw d;let y=await a.recoverRejectedCertificate?.();if(!y)throw d;a=y,r=true,u=await l(a);}return this.record(c),t.refreshGrant&&this.record("coordination.credential.refresh"),r&&await i.onSourceRenewed?.({token:a.token,expiresAtMs:a.expiresAtMs}),u});return n=o.then(()=>{},()=>{}),o}}turnProvider(e){let i=K("relay"),n=null,a=null;return async()=>{if(n&&n.expiresAtMs>Date.now()+5*6e4)return n;if(a)return a;let t=(async()=>{let o=e(),r=b$1(o.token),c=String(r.jti??""),u=await(await this.key()).proof((y,p)=>["openrtc:v2:relay-turn",c,i,y,p].join(":")),d=await this.post("/v2/relay/turn",{credentialType:o.type,credential:o.token,sessionId:i,deviceProof:u});return n=d,d})();a=t;try{return await t}finally{a===t&&(a=null);}}}};
+export{x as a};