openrtc 2.6.0 → 2.7.0

package/dist/runtime/device-status.d.ts

@@ -1,4 +1,4 @@
-import { q as RuntimeDevice, D as DeviceStatus } from '../Connection-CQdRHqjO.js';
+import { q as RuntimeDevice, D as DeviceStatus } from '../Connection-DnZeUt3p.js';
 
 interface DeviceActiveOptions {
     now?: number;

package/dist/runtime/factories.d.ts

@@ -1,8 +1,8 @@
-import { c as RuntimeFactoryOptions, b as PlutoRuntimeAssembly } from '../assembly-D9vP5Q6M.js';
-import { N as NativeProjectionBroker, I as IpcRuntimeAdapter } from '../IpcRuntimeAdapter-D4vIpOre.js';
-import { Z as Device, W as ISignalingBackend, O as DiscoveryMode, Q as AuthMode, T as SignalingMode, U as ClientOptions, V as ExplicitFileDataSendParams, ak as BrowserWasmRuntimeModule, a5 as LocalDeviceInfo, Y as RoomMember, al as BrowserProtocolStore, am as NamespaceDescriptor, an as IrohMutationReceipt, ao as IrohDocEntry, X as RuntimeIdentity, a0 as SignalingEnvelope, _ as DeviceStatusSnapshot, k as PeerSessionSnapshot, a7 as BackendPeerBiStream, a8 as BackendPeerUniStream, a9 as PortableMediaPublish, aa as PortableMediaPublicationStart, ab as PortableMediaSample, ac as PortableMediaChunk, ad as PortableMediaControl, $ as ManagedConnectionRecord, n as ResolvedPeerIdentity, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, ap as CoordinationSignalingStore, aq as ManagedRoomMessage, a1 as DeviceEvent, a2 as DesiredPeerProjection, ar as CoreClientBridgeHost, ae as NativeConnectParams, af as NativeConnectResult, a3 as SignalingSession, a4 as SessionEvent, ag as BackendConnectionState } from '../Connection-CQdRHqjO.js';
-import { R as RuntimeCapabilities } from '../capabilities-BgxJVk9q.js';
-import { R as RuntimeBridgeOptions } from '../DelegatingRuntimeAdapter-B8ubDv86.js';
+import { c as RuntimeFactoryOptions, b as PlutoRuntimeAssembly } from '../assembly-CKGAvY3a.js';
+import { N as NativeProjectionBroker, I as IpcRuntimeAdapter } from '../IpcRuntimeAdapter-BSartqkw.js';
+import { Z as Device, W as ISignalingBackend, O as DiscoveryMode, Q as AuthMode, T as SignalingMode, U as ClientOptions, V as ExplicitFileDataSendParams, ak as BrowserWasmRuntimeModule, a5 as LocalDeviceInfo, Y as RoomMember, al as BrowserProtocolStore, am as NamespaceDescriptor, an as IrohMutationReceipt, ao as IrohDocEntry, X as RuntimeIdentity, a0 as SignalingEnvelope, _ as DeviceStatusSnapshot, k as PeerSessionSnapshot, a7 as BackendPeerBiStream, a8 as BackendPeerUniStream, a9 as PortableMediaPublish, aa as PortableMediaPublicationStart, ab as PortableMediaSample, ac as PortableMediaChunk, ad as PortableMediaControl, $ as ManagedConnectionRecord, n as ResolvedPeerIdentity, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, ap as CoordinationSignalingStore, aq as ManagedRoomMessage, a1 as DeviceEvent, a2 as DesiredPeerProjection, ar as CoreClientBridgeHost, ae as NativeConnectParams, af as NativeConnectResult, a3 as SignalingSession, a4 as SessionEvent, ag as BackendConnectionState } from '../Connection-DnZeUt3p.js';
+import { R as RuntimeCapabilities } from '../capabilities-CsnXfI4b.js';
+import { R as RuntimeBridgeOptions } from '../DelegatingRuntimeAdapter-DtNdkP9H.js';
 import { P as PlutoIpcBridge } from '../ipc-DgzKqHH3.js';
 
 interface NativeTrustToken {

package/dist/runtime/factories.js

@@ -1 +1 @@
-import {a as a$2}from'../chunk-5KN6YOM6.js';import {s}from'../chunk-C7UBBRYW.js';import'../chunk-BGWJHPBC.js';import'../chunk-FQB3VTOC.js';import'../chunk-GQWHEDGU.js';import {a as a$1}from'../chunk-XMYBBLYK.js';import'../chunk-TYZS5LXQ.js';import'../chunk-OT7IPLZE.js';import'../chunk-OWKAJPOI.js';import {a}from'../chunk-NHIANLEM.js';import'../chunk-72NEEJQG.js';import'../chunk-ISTROQQJ.js';import'../chunk-CNAW5BZ3.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';async function l(e){let t=a$1(e),{WasmBridge:o}=await import('../WasmBridge-W3GRBTTZ.js');return a$2(t,new o(t))}function y(e,t,o=new a){let m=a$1(e);return a$2(m,new s({...m,bridge:t,projectionBroker:o}))}export{y as createIpcClient,l as createWasmClient};
+import {a as a$2}from'../chunk-SVYYKXZY.js';import {s}from'../chunk-PTWWXKDO.js';import'../chunk-BGWJHPBC.js';import'../chunk-VGG7KR7S.js';import'../chunk-UPWTSOR7.js';import {a as a$1}from'../chunk-XMYBBLYK.js';import'../chunk-TYZS5LXQ.js';import'../chunk-OT7IPLZE.js';import'../chunk-OWKAJPOI.js';import {a}from'../chunk-NHIANLEM.js';import'../chunk-72NEEJQG.js';import'../chunk-ISTROQQJ.js';import'../chunk-CNAW5BZ3.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';async function l(e){let t=a$1(e),{WasmBridge:o}=await import('../WasmBridge-25IVIBX2.js');return a$2(t,new o(t))}function y(e,t,o=new a){let m=a$1(e);return a$2(m,new s({...m,bridge:t,projectionBroker:o}))}export{y as createIpcClient,l as createWasmClient};

package/dist/runtime/index.d.ts

@@ -1,15 +1,15 @@
-import { a as PeerReconciliationStats } from '../assembly-D9vP5Q6M.js';
-export { D as ConnectionActor, d as ConnectionActorError, e as ConnectionActorErrorKind, f as ConnectionActorKey, g as ConnectionActorOptions, h as ConnectionActorState, i as ConnectionActors, j as ConnectionClose, k as ConnectionDial, l as LogicalChannel, P as PolicySnapshot, m as PreferredTransport, n as RUNTIME_POLICY, R as RuntimeClient, o as connectionActorKey, p as connectionActorKeyString, q as getRuntimePolicy } from '../assembly-D9vP5Q6M.js';
+import { a as PeerReconciliationStats } from '../assembly-CKGAvY3a.js';
+export { D as ConnectionActor, d as ConnectionActorError, e as ConnectionActorErrorKind, f as ConnectionActorKey, g as ConnectionActorOptions, h as ConnectionActorState, i as ConnectionActors, j as ConnectionClose, k as ConnectionDial, l as LogicalChannel, P as PolicySnapshot, m as PreferredTransport, n as RUNTIME_POLICY, R as RuntimeClient, o as connectionActorKey, p as connectionActorKeyString, q as getRuntimePolicy } from '../assembly-CKGAvY3a.js';
 import { Client as Client$1 } from '../coreClient.js';
-import { c as Avenue } from '../types-jxyrOzCw.js';
-import { aD as SignalingOptions, W as ISignalingBackend, X as RuntimeIdentity, Y as RoomMember, a0 as SignalingEnvelope, a3 as SignalingSession, Z as Device, a2 as DesiredPeerProjection, ag as BackendConnectionState, aA as AppLimits, G as GrantScope, j as Connection, aE as JoinRoomOptions, aF as ChannelMetadata, au as CryptoStreams, aG as RoomCreationMode, U as ClientOptions, at as PayloadCrypto, O as DiscoveryMode, aH as ProtocolCapabilityMap, aI as ScanningLoopOptions, aJ as ScanningLoopHandle, aK as RuntimeBootstrapOptions, aL as RuntimeBootstrapResult, aM as ApplicationPayloadReadinessOptions, aN as ManagedApplicationRouteOptions, aO as PeerState, aP as PeerScope, aQ as PeerHealth, aR as ChannelDescriptor, aS as JoinRequest, ae as NativeConnectParams, af as NativeConnectResult, aB as ConnectionTarget, B as RawConnection } from '../Connection-CQdRHqjO.js';
-export { aT as AutoConnectPolicy, al as BrowserProtocolStore, C as ChannelDescriptor, aU as ChannelFraming, u as ConnectionEvent, s as ConnectionState, aV as ConnectionStatus, w as DeviceConnectOptions, aW as DevicePresence, A as DeviceProfile, D as DeviceStatus, I as IncomingStream, ao as IrohDocEntry, an as IrohMutationReceipt, J as JoinRoomOptions, L as LocalDeviceInfo, M as ManagedOptions, v as ManagedSession, am as NamespaceDescriptor, aX as PayloadRouteOptions, i as PeerConnectOptions, aY as PeerLifecycleStatus, l as PeerReadiness, aZ as PeerSessionSnapshot, o as PeerStreamOptions, ac as PortableMediaChunk, ad as PortableMediaControl, aa as PortableMediaPublicationStart, a9 as PortableMediaPublish, ab as PortableMediaSample, aC as PresenceLoopOptions, a_ as PresencePolicy, t as ReadinessOptions, a$ as RuntimeAuthContext, ay as RuntimeAuthIdentity, K as RuntimeClientOptions, q as RuntimeDevice, m as RuntimePeerHealth, b0 as RuntimePeerScope, h as RuntimePeerState, F as RuntimeRoomMember, az as RuntimeSession, p as ScopedChannelOptions, r as ScopedLogicalChannel, b1 as SessionKind, b2 as SessionPlatform } from '../Connection-CQdRHqjO.js';
-import { R as RuntimeCapabilities } from '../capabilities-BgxJVk9q.js';
-export { B as BROWSER_CAPABILITIES, a as CapabilityHost, b as CapabilityMaturity, C as CapabilityProfile, N as NATIVE_CAPABILITIES, c as NativeRuntimeStatus, P as ProductCapabilityMaturity, d as RuntimeAdapterKind, T as TransportStatus, e as browserCapabilities, f as capabilityProfile, g as cloneCapabilities, s as statusCapabilities } from '../capabilities-BgxJVk9q.js';
+import { c as Avenue } from '../types-CJ5FGAyJ.js';
+import { aD as SignalingOptions, W as ISignalingBackend, X as RuntimeIdentity, Y as RoomMember, a0 as SignalingEnvelope, a3 as SignalingSession, Z as Device, a2 as DesiredPeerProjection, ag as BackendConnectionState, aA as AppLimits, G as GrantScope, j as Connection, aE as JoinRoomOptions, aF as ChannelMetadata, au as CryptoStreams, aG as RoomCreationMode, U as ClientOptions, at as PayloadCrypto, O as DiscoveryMode, aH as ProtocolCapabilityMap, aI as ScanningLoopOptions, aJ as ScanningLoopHandle, aK as RuntimeBootstrapOptions, aL as RuntimeBootstrapResult, aM as ApplicationPayloadReadinessOptions, aN as ManagedApplicationRouteOptions, aO as PeerState, aP as PeerScope, aQ as PeerHealth, aR as ChannelDescriptor, aS as JoinRequest, ae as NativeConnectParams, af as NativeConnectResult, aB as ConnectionTarget, B as RawConnection } from '../Connection-DnZeUt3p.js';
+export { aT as AutoConnectPolicy, al as BrowserProtocolStore, C as ChannelDescriptor, aU as ChannelFraming, u as ConnectionEvent, s as ConnectionState, aV as ConnectionStatus, w as DeviceConnectOptions, aW as DevicePresence, A as DeviceProfile, D as DeviceStatus, I as IncomingStream, ao as IrohDocEntry, an as IrohMutationReceipt, J as JoinRoomOptions, L as LocalDeviceInfo, M as ManagedOptions, v as ManagedSession, am as NamespaceDescriptor, aX as PayloadRouteOptions, i as PeerConnectOptions, aY as PeerLifecycleStatus, l as PeerReadiness, aZ as PeerSessionSnapshot, o as PeerStreamOptions, ac as PortableMediaChunk, ad as PortableMediaControl, aa as PortableMediaPublicationStart, a9 as PortableMediaPublish, ab as PortableMediaSample, aC as PresenceLoopOptions, a_ as PresencePolicy, t as ReadinessOptions, a$ as RuntimeAuthContext, ay as RuntimeAuthIdentity, K as RuntimeClientOptions, q as RuntimeDevice, m as RuntimePeerHealth, b0 as RuntimePeerScope, h as RuntimePeerState, F as RuntimeRoomMember, az as RuntimeSession, p as ScopedChannelOptions, r as ScopedLogicalChannel, b1 as SessionKind, b2 as SessionPlatform } from '../Connection-DnZeUt3p.js';
+import { R as RuntimeCapabilities } from '../capabilities-CsnXfI4b.js';
+export { B as BROWSER_CAPABILITIES, a as CapabilityHost, b as CapabilityMaturity, C as CapabilityProfile, N as NATIVE_CAPABILITIES, c as NativeRuntimeStatus, P as ProductCapabilityMaturity, d as RuntimeAdapterKind, T as TransportStatus, e as browserCapabilities, f as capabilityProfile, g as cloneCapabilities, s as statusCapabilities } from '../capabilities-CsnXfI4b.js';
 export { DeviceActiveOptions, isDeviceActive, isDeviceConnectable, isDeviceRoutable } from './device-status.js';
-export { a as IpcAdapterOptions, I as IpcRuntimeAdapter } from '../IpcRuntimeAdapter-D4vIpOre.js';
+export { a as IpcAdapterOptions, I as IpcRuntimeAdapter } from '../IpcRuntimeAdapter-BSartqkw.js';
 export { P as NativeBridge, N as NativeIpcFailureKind, P as PlutoIpcBridge, a as PlutoIpcUnlisten, c as classifyIpcFailure, i as isIpcUnavailable } from '../ipc-DgzKqHH3.js';
-import '../DelegatingRuntimeAdapter-B8ubDv86.js';
+import '../DelegatingRuntimeAdapter-DtNdkP9H.js';
 
 declare class Signaling {
     private readonly appTag;

package/dist/runtime/index.js

@@ -1 +1 @@
-export{a as isDeviceActive,c as isDeviceConnectable,b as isDeviceRoutable}from'../chunk-CK6WQV7J.js';export{h as ConnectionActor,e as ConnectionActorError,i as ConnectionActors,a as ConnectionController,s as IpcRuntimeAdapter,r as RuntimeClient,d as clog,p as concatRuntimeBytes,f as connectionActorKey,g as connectionActorKeyString,o as createJsonDecoder,k as createU32Decoder,m as decodeJsonPayload,n as encodeJsonFrame,l as encodeJsonPayload,j as encodeU32Frame,c as grantCorrelation,q as readRuntimeU32BE,b as renderCorrelation}from'../chunk-C7UBBRYW.js';import'../chunk-BGWJHPBC.js';import'../chunk-FQB3VTOC.js';export{q as BROWSER_CAPABILITIES,r as NATIVE_CAPABILITIES,o as RUNTIME_POLICY,t as browserCapabilities,v as capabilityProfile,s as cloneCapabilities,p as getRuntimePolicy,h as logTeardownTrace,d as openRtcDebug,c as openRtcDebugEnabled,e as openRtcDebugInfo,f as openRtcDebugLog,u as statusCapabilities}from'../chunk-GQWHEDGU.js';import'../chunk-XMYBBLYK.js';import'../chunk-TYZS5LXQ.js';import'../chunk-OT7IPLZE.js';import'../chunk-OWKAJPOI.js';export{a as classifyIpcFailure,b as isIpcUnavailable}from'../chunk-72NEEJQG.js';import'../chunk-ISTROQQJ.js';import'../chunk-CNAW5BZ3.js';export{c as runtimeFromCapability}from'../chunk-HQ6ANBIU.js';import'../chunk-ZA44REGI.js';import'../chunk-LLZT3MR6.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';
+export{a as isDeviceActive,c as isDeviceConnectable,b as isDeviceRoutable}from'../chunk-CK6WQV7J.js';export{h as ConnectionActor,e as ConnectionActorError,i as ConnectionActors,a as ConnectionController,s as IpcRuntimeAdapter,r as RuntimeClient,d as clog,p as concatRuntimeBytes,f as connectionActorKey,g as connectionActorKeyString,o as createJsonDecoder,k as createU32Decoder,m as decodeJsonPayload,n as encodeJsonFrame,l as encodeJsonPayload,j as encodeU32Frame,c as grantCorrelation,q as readRuntimeU32BE,b as renderCorrelation}from'../chunk-PTWWXKDO.js';import'../chunk-BGWJHPBC.js';import'../chunk-VGG7KR7S.js';export{q as BROWSER_CAPABILITIES,r as NATIVE_CAPABILITIES,o as RUNTIME_POLICY,t as browserCapabilities,v as capabilityProfile,s as cloneCapabilities,p as getRuntimePolicy,h as logTeardownTrace,d as openRtcDebug,c as openRtcDebugEnabled,e as openRtcDebugInfo,f as openRtcDebugLog,u as statusCapabilities}from'../chunk-UPWTSOR7.js';import'../chunk-XMYBBLYK.js';import'../chunk-TYZS5LXQ.js';import'../chunk-OT7IPLZE.js';import'../chunk-OWKAJPOI.js';export{a as classifyIpcFailure,b as isIpcUnavailable}from'../chunk-72NEEJQG.js';import'../chunk-ISTROQQJ.js';import'../chunk-CNAW5BZ3.js';export{c as runtimeFromCapability}from'../chunk-JQBYZHKY.js';import'../chunk-ZA44REGI.js';import'../chunk-LLZT3MR6.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';

package/dist/server-browser.d.ts

@@ -1,9 +1,9 @@
 export { AuthorityAssignmentInput, AuthorityInterestAssignment, AuthorityServiceGrant, AuthorityServiceGrantRequest, Ed25519Signer } from './service-node.js';
-import './types-jxyrOzCw.js';
+import './types-CJ5FGAyJ.js';
 import './coreClient.js';
-import './assembly-D9vP5Q6M.js';
-import './Connection-CQdRHqjO.js';
-import './capabilities-BgxJVk9q.js';
+import './assembly-CKGAvY3a.js';
+import './Connection-DnZeUt3p.js';
+import './capabilities-CsnXfI4b.js';
 
 /** Browser export for `openrtc/server`; secret-bearing helpers are unavailable. */
 

package/dist/server.d.ts

@@ -1,9 +1,9 @@
 import { Ed25519Signer, AuthorityServiceGrantRequest, AuthorityServiceGrant, AuthorityAssignmentInput, AuthorityInterestAssignment, DelegatedAuthorityGrantRequest } from './service-node.js';
-import './types-jxyrOzCw.js';
+import './types-CJ5FGAyJ.js';
 import './coreClient.js';
-import './assembly-D9vP5Q6M.js';
-import './Connection-CQdRHqjO.js';
-import './capabilities-BgxJVk9q.js';
+import './assembly-CKGAvY3a.js';
+import './Connection-DnZeUt3p.js';
+import './capabilities-CsnXfI4b.js';
 
 /** Secret-bearing Node/server helpers. Do not import this entrypoint in browsers. */
 

package/dist/server.js

@@ -1,2 +1,2 @@
-import {a}from'./chunk-DOI7F3VQ.js';import'./chunk-HQ6ANBIU.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';function y(n){let e=new URL(n??"https://api.openrtc.app"),t=e.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(e.hostname.toLowerCase());if(e.protocol!=="https:"&&!t||e.username||e.password||e.search||e.hash)throw new TypeError("[OpenRTC] authority control-plane endpoint is invalid.");return e.toString().replace(/\/$/,"")}function h(){if(typeof document<"u"||typeof window<"u")throw new Error("[OpenRTC] openrtc/server is unavailable in browsers; use openrtc/service-node with a delegated grant.")}var c=class{constructor(e){h();let t=e.secretKey?.trim()??"";if(!/^sk_(?:live|test)_[A-Za-z0-9_-]+$/.test(t))throw new TypeError("[OpenRTC] secretKey is invalid.");let i=e.fetch??globalThis.fetch;if(typeof i!="function")throw new TypeError("[OpenRTC] a Fetch-compatible implementation is required.");let u=y(e.endpoint);this.authority=new a({apiKey:e.apiKey,serviceId:e.serviceId,generation:e.generation,shardIds:e.shardIds,deviceId:e.deviceId,deviceSigner:e.deviceSigner,assignmentSigner:e.assignmentSigner,grantIssuer:async s=>{let r=await i(`${u}/v2/developer/authority/grants`,{method:"POST",headers:{authorization:`Bearer ${t}`,"content-type":"application/json","x-openrtc-idempotency-key":s.idempotencyKey},body:JSON.stringify(s.body)});if(!r.ok){let o=await r.json().catch(()=>null),d=typeof o?.error=="string"?o.error.slice(0,256):`HTTP ${r.status}`;throw new Error(`[OpenRTC] authority service grant failed: ${d}`)}return r.json()}});}requestGrant(e){return this.authority.requestGrant(e)}signAssignment(e){return this.authority.signAssignment(e)}devicePublicKey(){return this.authority.devicePublicKey()}signDeviceBytes(e){return this.authority.signDeviceBytes(e)}grantIssuer(){return async e=>{let t=e.body;return this.requestGrant({roomId:String(t.avenue?.id??""),runtimeInstanceId:String(t.runtimeInstanceId??""),ticketFingerprint:String(t.ticketFingerprint??""),maxPeers:typeof t.maxPeers=="number"?t.maxPeers:void 0,refreshGrant:typeof t.refreshGrant=="string"?t.refreshGrant:void 0,features:typeof t.features=="object"&&t.features?t.features:void 0})}}};
+import {a}from'./chunk-4KY4I6W5.js';import'./chunk-JQBYZHKY.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';function y(n){let e=new URL(n??"https://api.openrtc.app"),t=e.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(e.hostname.toLowerCase());if(e.protocol!=="https:"&&!t||e.username||e.password||e.search||e.hash)throw new TypeError("[OpenRTC] authority control-plane endpoint is invalid.");return e.toString().replace(/\/$/,"")}function h(){if(typeof document<"u"||typeof window<"u")throw new Error("[OpenRTC] openrtc/server is unavailable in browsers; use openrtc/service-node with a delegated grant.")}var c=class{constructor(e){h();let t=e.secretKey?.trim()??"";if(!/^sk_(?:live|test)_[A-Za-z0-9_-]+$/.test(t))throw new TypeError("[OpenRTC] secretKey is invalid.");let i=e.fetch??globalThis.fetch;if(typeof i!="function")throw new TypeError("[OpenRTC] a Fetch-compatible implementation is required.");let u=y(e.endpoint);this.authority=new a({apiKey:e.apiKey,serviceId:e.serviceId,generation:e.generation,shardIds:e.shardIds,deviceId:e.deviceId,deviceSigner:e.deviceSigner,assignmentSigner:e.assignmentSigner,grantIssuer:async s=>{let r=await i(`${u}/v2/developer/authority/grants`,{method:"POST",headers:{authorization:`Bearer ${t}`,"content-type":"application/json","x-openrtc-idempotency-key":s.idempotencyKey},body:JSON.stringify(s.body)});if(!r.ok){let o=await r.json().catch(()=>null),d=typeof o?.error=="string"?o.error.slice(0,256):`HTTP ${r.status}`;throw new Error(`[OpenRTC] authority service grant failed: ${d}`)}return r.json()}});}requestGrant(e){return this.authority.requestGrant(e)}signAssignment(e){return this.authority.signAssignment(e)}devicePublicKey(){return this.authority.devicePublicKey()}signDeviceBytes(e){return this.authority.signDeviceBytes(e)}grantIssuer(){return async e=>{let t=e.body;return this.requestGrant({roomId:String(t.avenue?.id??""),runtimeInstanceId:String(t.runtimeInstanceId??""),ticketFingerprint:String(t.ticketFingerprint??""),maxPeers:typeof t.maxPeers=="number"?t.maxPeers:void 0,refreshGrant:typeof t.refreshGrant=="string"?t.refreshGrant:void 0,features:typeof t.features=="object"&&t.features?t.features:void 0})}}};
 export{c as AuthorityServiceControlPlane};

package/dist/service-node.d.ts

@@ -1,8 +1,8 @@
-import { C as Client, X as Room, r as Connection } from './types-jxyrOzCw.js';
+import { C as Client, X as Room, r as Connection } from './types-CJ5FGAyJ.js';
 import './coreClient.js';
-import './assembly-D9vP5Q6M.js';
-import './Connection-CQdRHqjO.js';
-import './capabilities-BgxJVk9q.js';
+import './assembly-CKGAvY3a.js';
+import './Connection-DnZeUt3p.js';
+import './capabilities-CsnXfI4b.js';
 
 /** Browser-safe and Node-host-neutral developer service-node facade. */
 

package/dist/service-node.js

@@ -1 +1 @@
-export{a as DelegatedAuthorityService,b as ServiceNode}from'./chunk-DOI7F3VQ.js';import'./chunk-HQ6ANBIU.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';
+export{a as DelegatedAuthorityService,b as ServiceNode}from'./chunk-4KY4I6W5.js';import'./chunk-JQBYZHKY.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';

package/dist/testing/native.d.ts

@@ -1,10 +1,10 @@
-import { O as Options, C as Client } from '../types-jxyrOzCw.js';
+import { O as Options, C as Client } from '../types-CJ5FGAyJ.js';
 import { E as Endpoints } from '../protocol-BSBjMb7p.js';
 import { P as PlutoIpcBridge } from '../ipc-DgzKqHH3.js';
 import '../coreClient.js';
-import '../assembly-D9vP5Q6M.js';
-import '../Connection-CQdRHqjO.js';
-import '../capabilities-BgxJVk9q.js';
+import '../assembly-CKGAvY3a.js';
+import '../Connection-DnZeUt3p.js';
+import '../capabilities-CsnXfI4b.js';
 
 declare function OpenRTC(options: Options, endpoints: Endpoints, bridge: PlutoIpcBridge): Client;
 

package/dist/testing/native.js

@@ -1 +1 @@
-import {a as a$1}from'../chunk-VFDCIEP6.js';import {a}from'../chunk-NHIANLEM.js';import'../chunk-ISTROQQJ.js';import'../chunk-NDR2ANQB.js';import {i}from'../chunk-HQ6ANBIU.js';import'../chunk-ZA44REGI.js';import'../chunk-LLZT3MR6.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';function v(c,p,e){let o=new a;return i(c,{endpoints:p,testingAllowInsecureLoopback:true,platform:"native",close:()=>o.close(),deviceKeyProvider:a$1(e),deviceIdProvider:async()=>{let t=await e.invoke("get_rtc_local_device_info");return String(t?.deviceId??"")},runtimeFactory:async t=>{let{createIpcClient:a}=await import('../ipcFactory-ZEHQMCEM.js');return a(t,e,o)}})}export{v as OpenRTC};
+import {a as a$1}from'../chunk-UBLYBL3O.js';import {a}from'../chunk-NHIANLEM.js';import'../chunk-ISTROQQJ.js';import'../chunk-AUICRD2W.js';import {i}from'../chunk-JQBYZHKY.js';import'../chunk-ZA44REGI.js';import'../chunk-LLZT3MR6.js';import'../chunk-DUY34MGT.js';import'../chunk-CCCYE3XN.js';import'../chunk-4R5BLX2U.js';import'../chunk-JPBW67B3.js';import'../chunk-2GX6GB6L.js';function v(c,p,e){let o=new a;return i(c,{endpoints:p,testingAllowInsecureLoopback:true,platform:"native",close:()=>o.close(),deviceKeyProvider:a$1(e),deviceIdProvider:async()=>{let t=await e.invoke("get_rtc_local_device_info");return String(t?.deviceId??"")},runtimeFactory:async t=>{let{createIpcClient:a}=await import('../ipcFactory-MNJ4QUS6.js');return a(t,e,o)}})}export{v as OpenRTC};

package/dist/testing.d.ts

@@ -1,9 +1,9 @@
-import { R as RoomArchitectureMode, ai as CoordinationGatewayGrantRequest, aj as CoordinationGatewayGrant } from './Connection-CQdRHqjO.js';
-import { a as AttestationProvider, b as AuthProvider, B as BotVerificationProvider, e as BroadcastGrant, d as BroadcastCreateOptions, f as BroadcastInvite, g as BroadcastInviteOptions, D as Delivery, t as DeviceProfile, O as Options, C as Client } from './types-jxyrOzCw.js';
+import { R as RoomArchitectureMode, ai as CoordinationGatewayGrantRequest, aj as CoordinationGatewayGrant } from './Connection-DnZeUt3p.js';
+import { a as AttestationProvider, b as AuthProvider, B as BotVerificationProvider, e as BroadcastGrant, d as BroadcastCreateOptions, f as BroadcastInvite, g as BroadcastInviteOptions, D as Delivery, t as DeviceProfile, O as Options, C as Client } from './types-CJ5FGAyJ.js';
 import { E as Endpoints } from './protocol-BSBjMb7p.js';
 import './coreClient.js';
-import './assembly-D9vP5Q6M.js';
-import './capabilities-BgxJVk9q.js';
+import './assembly-CKGAvY3a.js';
+import './capabilities-CsnXfI4b.js';
 
 interface DeviceProof {
     publicKeyJwk: JsonWebKey;
@@ -19,6 +19,9 @@ interface DeviceKey {
     proof(challenge: (nonce: string, issuedAt: number) => string): Promise<DeviceProof>;
 }
 interface DeviceKeyProvider {
+    /** Session-only providers cannot enroll retained devices. Host providers
+     * may omit this; the host owns their durable identity contract. */
+    persistence?: 'session' | 'persistent';
     getOrCreate(appTag: string): Promise<DeviceKey>;
     delete?(appTag: string): Promise<void>;
     /**

package/dist/testing.js

@@ -1 +1 @@
-import {a}from'./chunk-BEYBIRAN.js';import {a as a$1,d,c}from'./chunk-CNAW5BZ3.js';import {c as c$1}from'./chunk-NDR2ANQB.js';import {i}from'./chunk-HQ6ANBIU.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';function v(o){let t=e=>`${e}:${o}`;return {getOrCreate:e=>c$1.getOrCreate(t(e)),delete:async e=>{await c$1.delete?.(t(e));},readSecureRecord:(e,i)=>c$1.readSecureRecord?.(t(e),i)??Promise.resolve(null),writeSecureRecord:(e,i,c)=>c$1.writeSecureRecord?.(t(e),i,c)??Promise.resolve(),deleteSecureRecord:(e,i)=>c$1.deleteSecureRecord?.(t(e),i)??Promise.resolve()}}function b(o,t,e){return new a(o,t,v(e))}function g(o,t,e={}){if(e.initialTicketLifetimeMs!==void 0){let i=(c,s)=>{let r=new URL(c);return r.protocol===s&&["127.0.0.1","[::1]"].includes(r.hostname)&&Number(r.port)>0&&r.pathname==="/"&&!r.username&&!r.password&&!r.search&&!r.hash};if(e.initialTicketLifetimeMs!==9e4||o.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!i(t.controlPlane,"http:")||!i(t.gateway,"http:")||!e.irohTestRelayUrl||!i(e.irohTestRelayUrl,"https:"))throw new Error("Short initial tickets require the disposable local service lane")}return i(o,{endpoints:t,testingAllowInsecureLoopback:true,platform:"web",...e.deviceId?{deviceIdProvider:async()=>e.deviceId}:{},...e.irohTestRelayUrl?{irohTestRelayUrl:e.irohTestRelayUrl}:{},runtimeFactory:async i=>{let{createWasmClient:c$1}=await import('./runtime/factories.js'),s=await c$1(i);if(e.initialTicketLifetimeMs!==void 0){let r=s.runtime,p=r.getTicketWithToken.bind(r);r.getTicketWithToken=async(l,d$1=0)=>{if(r.getTicketWithToken=p,!l.startsWith("v2:room:"))throw new Error("Short initial ticket requires room scope");let{irohTicket:u,tokenSuffix:m}=a$1(await p(l,d$1)),n=m&&d(u,m);if(!n||!n.t||n.s!==l||n.m!==d$1)throw new Error("Invalid initial service ticket");let h=Date.now()+9e4;return await r.registerToken({token:n.t,scope:l,maxConnections:d$1,expiresAtMs:h}),c(u,n.t,l,d$1,h)};}return s}})}export{g as OpenRTC,b as controlPlane};
+import {a}from'./chunk-HDGSSJGQ.js';import {a as a$1,d,c}from'./chunk-CNAW5BZ3.js';import {c as c$1}from'./chunk-AUICRD2W.js';import {i}from'./chunk-JQBYZHKY.js';import'./chunk-ZA44REGI.js';import'./chunk-LLZT3MR6.js';import'./chunk-DUY34MGT.js';import'./chunk-CCCYE3XN.js';import'./chunk-4R5BLX2U.js';import'./chunk-JPBW67B3.js';import'./chunk-2GX6GB6L.js';function v(o){let t=e=>`${e}:${o}`;return {getOrCreate:e=>c$1.getOrCreate(t(e)),delete:async e=>{await c$1.delete?.(t(e));},readSecureRecord:(e,i)=>c$1.readSecureRecord?.(t(e),i)??Promise.resolve(null),writeSecureRecord:(e,i,c)=>c$1.writeSecureRecord?.(t(e),i,c)??Promise.resolve(),deleteSecureRecord:(e,i)=>c$1.deleteSecureRecord?.(t(e),i)??Promise.resolve()}}function b(o,t,e){return new a(o,t,v(e))}function g(o,t,e={}){if(e.initialTicketLifetimeMs!==void 0){let i=(c,s)=>{let r=new URL(c);return r.protocol===s&&["127.0.0.1","[::1]"].includes(r.hostname)&&Number(r.port)>0&&r.pathname==="/"&&!r.username&&!r.password&&!r.search&&!r.hash};if(e.initialTicketLifetimeMs!==9e4||o.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!i(t.controlPlane,"http:")||!i(t.gateway,"http:")||!e.irohTestRelayUrl||!i(e.irohTestRelayUrl,"https:"))throw new Error("Short initial tickets require the disposable local service lane")}return i(o,{endpoints:t,testingAllowInsecureLoopback:true,platform:"web",...e.deviceId?{deviceIdProvider:async()=>e.deviceId}:{},...e.irohTestRelayUrl?{irohTestRelayUrl:e.irohTestRelayUrl}:{},runtimeFactory:async i=>{let{createWasmClient:c$1}=await import('./runtime/factories.js'),s=await c$1(i);if(e.initialTicketLifetimeMs!==void 0){let r=s.runtime,p=r.getTicketWithToken.bind(r);r.getTicketWithToken=async(l,d$1=0)=>{if(r.getTicketWithToken=p,!l.startsWith("v2:room:"))throw new Error("Short initial ticket requires room scope");let{irohTicket:u,tokenSuffix:m}=a$1(await p(l,d$1)),n=m&&d(u,m);if(!n||!n.t||n.s!==l||n.m!==d$1)throw new Error("Invalid initial service ticket");let h=Date.now()+9e4;return await r.registerToken({token:n.t,scope:l,maxConnections:d$1,expiresAtMs:h}),c(u,n.t,l,d$1,h)};}return s}})}export{g as OpenRTC,b as controlPlane};

package/dist/transport/index.d.ts

@@ -1,5 +1,5 @@
-import { g as ProtocolName, as as RouteDescriptor, at as PayloadCrypto, au as CryptoStreams } from '../Connection-CQdRHqjO.js';
-export { av as CryptoBiStream, aw as RouteFamily, ax as RouteKind } from '../Connection-CQdRHqjO.js';
+import { g as ProtocolName, as as RouteDescriptor, at as PayloadCrypto, au as CryptoStreams } from '../Connection-DnZeUt3p.js';
+export { av as CryptoBiStream, aw as RouteFamily, ax as RouteKind } from '../Connection-DnZeUt3p.js';
 
 declare const TRANSPORT_LABELS: readonly ProtocolName[];
 declare function normalizeTransport(value: unknown): ProtocolName | undefined;

package/dist/{types-jxyrOzCw.d.ts → types-CJ5FGAyJ.d.ts}

@@ -1,5 +1,5 @@
 import { PeerNamespace, ChannelNamespace, DiagnosticsNamespace, DeviceNamespace } from './coreClient.js';
-import { R as RoomArchitectureMode, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, C as ChannelDescriptor, S as ServiceErrorObservation, P as PlutoIrohConfiguration, d as PlutoRTCConfiguration, e as PlutoMoQConfiguration, f as RouteOptimization, g as ProtocolName } from './Connection-CQdRHqjO.js';
+import { R as RoomArchitectureMode, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, C as ChannelDescriptor, S as ServiceErrorObservation, P as PlutoIrohConfiguration, d as PlutoRTCConfiguration, e as PlutoMoQConfiguration, f as RouteOptimization, g as ProtocolName } from './Connection-DnZeUt3p.js';
 
 interface AuthProvider {
     /** Registered provider ID from the developer app capability manifest. */
@@ -133,6 +133,10 @@ interface Options {
     onServiceError?: (error: ServiceErrorObservation) => void;
     auth?: AuthProvider;
     trust?: {
+        /** Browser identity lifetime. Defaults to session memory without OS
+         * credential-store access. Persistent mode may invoke browser/OS key
+         * protection UI. Native host storage is unaffected. Set before use. */
+        browserPersistence?: 'session' | 'persistent';
         attestation?: AttestationProvider;
         botVerification?: BotVerificationProvider;
     };

package/native/darwin-arm64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "darwin",
   "arch": "arm64",
   "rustTarget": "aarch64-apple-darwin",
-  "sourceCommit": "b5fb2711452847ff3387a78e70de0bc9b60f89a7",
-  "sourceDigest": "46419511a1ea6e364796d8c44a73ccdc0dc23b8d6b2f945ef3d86bd64ddb44a0",
-  "binarySha256": "c40a5816e6ce40af73f22f9181a8c6b8bbaba7dc87f736c24b20793cba0fe582",
+  "sourceCommit": "1111199a428f67ca2f06966b4a51fad81e1edfce",
+  "sourceDigest": "0dd5365daeba6ddd0bb212c9a5980da829e755eb6577f9c52b1e1ae8d4f163db",
+  "binarySha256": "d8d6fd9f6bf1a80e13b396c2834e0c8cefe3a91aae6ded72e286016d39ee81a8",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "p6rz9wLWpNmhvb1dq4H02LlBkQB3nYYlJVoLwGAiy4GAJkC0A+iZQHdXzVecKGAbSVnTkC0HtIZoeEilGwxOCw=="
+  "signature": "Nav3GDRnMONv7g9ceC2RoLN5eUGxCvJ/YPLydpu3Ad6wxRtYhNOwaucNDSb6PnTTHMoiVHyEFbSv+20lxn4NDg=="
 }

package/native/darwin-x64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "darwin",
   "arch": "x64",
   "rustTarget": "x86_64-apple-darwin",
-  "sourceCommit": "b5fb2711452847ff3387a78e70de0bc9b60f89a7",
-  "sourceDigest": "46419511a1ea6e364796d8c44a73ccdc0dc23b8d6b2f945ef3d86bd64ddb44a0",
-  "binarySha256": "0d36503a895e231a2705029dcd40a9051f5940e6594454443f561d9b46bc0b94",
+  "sourceCommit": "1111199a428f67ca2f06966b4a51fad81e1edfce",
+  "sourceDigest": "0dd5365daeba6ddd0bb212c9a5980da829e755eb6577f9c52b1e1ae8d4f163db",
+  "binarySha256": "c4267d339c37ff9ed036f6c93da53dfb6cf796e6508de487829663060a05377d",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "GV8tMb0ED/I6r3R3VOg+5tiBd7f2X8vJpUlt93BW4Ktp6X3OWuSqQGO9FriKC0/IzVYeVrN99VKucW6uraDPCw=="
+  "signature": "nYbemItDD+s9ohFYdoeYSA856rzeKOrntUJL+1rZFjuyos6AlL699FJOHVMZ/LGSe0wf3NmLH84MwiaiPx99Dg=="
 }

package/native/linux-x64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "linux",
   "arch": "x64",
   "rustTarget": "x86_64-unknown-linux-gnu",
-  "sourceCommit": "5e4e04d72cd261b627842d3dd2f90ecea3cb25df",
-  "sourceDigest": "46419511a1ea6e364796d8c44a73ccdc0dc23b8d6b2f945ef3d86bd64ddb44a0",
-  "binarySha256": "8896d1725be0056a711c39c9fca386aa1cbcaf17f92520b516dd53307de75a29",
+  "sourceCommit": "861eec445da50aeb587032e222e942ef548137b7",
+  "sourceDigest": "0dd5365daeba6ddd0bb212c9a5980da829e755eb6577f9c52b1e1ae8d4f163db",
+  "binarySha256": "0b58873713542c0567b2eca64cfe9c682cbf91c57af0bd7fa6c25a56313e4400",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "PqjXkZ4FRR7nlhoFAwtDMXp6uoyCpHvWVwaOKz7GiazJgSMLlF8yftjs1QDyYMDipyKP6AsNQuDDNulCgs7jDA=="
+  "signature": "NDN50Ly4AbuHDANtO/Wm4PeWoUOgmFwKD7rRQzhOSWtGvj786/ynQ04UC6VxyDEETSfXRVvFa/nEezmEMWJIBg=="
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrtc",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "private": false,
   "type": "module",
   "sideEffects": false,
@@ -99,6 +99,7 @@
     "build:wasm": "node ../../scripts/build-openrtc-wasm-artifact.mjs",
     "test": "pnpm run test:deterministic && pnpm run test:emulator",
     "test:deterministic": "OPENRTC_DETERMINISTIC_TESTS=1 vitest run tests/unit tests/contract",
+    "test:browser-storage": "node --test tests/browser/device-key-storage.node.mjs",
     "test:emulator": "node ../../tests/emulator/run-emulator-suite.mjs",
     "test:emulator:running": "vitest run tests/emulator --no-file-parallelism --maxWorkers=1 --maxConcurrency=1",
     "test:acceptance:native:running": "vitest run tests/emulator/RealOpenRtcAcceptance.native-wasm.emulator.test.ts --no-file-parallelism --maxWorkers=1 --maxConcurrency=1",

package/dist/chunk-BEYBIRAN.js

@@ -1,2 +0,0 @@
-import {b as b$1}from'./chunk-ZA44REGI.js';import {c,a,i,d}from'./chunk-4R5BLX2U.js';function b(s){return {irohRelay:s.irohRelay===true||s.irohRelay===void 0&&s.relay!==false,managedTurn:s.managedTurn===true}}var M=1440*6e4,w=class extends Error{constructor(i,n,a){super(i);this.status=n;this.reason=a;this.name="RTCError";let t=[502,503,504].includes(n),o=a==="device-reenrollment-auth-required";this.code=o?"auth/device-reenrollment-required":t?"coordination/service-unavailable":n===429?"coordination/rate-limited":n===401?"auth/expired":n===403?"admission/denied":"internal/error",this.retryable=o||t,this.plane=o||n===401?"auth":t||n===429?"coordination":n===403?"admission":"internal";}};function T(s){return !(s instanceof w)||s.status!==403?false:s.reason==="device-certificate-stale"||s.reason==="device-certificate-revoked"?true:!s.reason&&s.message==="Device certificate is revoked or stale."}function C(s,e,i){return `openrtc:v2:device-certificate:${s}:${e}:${i}`}function P(s,e){return `openrtc:v2:device-session:${s}:${e}`}async function G(s,e,i){let n=new TextEncoder().encode(`openrtc:v2:session\0${s}\0${e}\0${i}`),a=new Uint8Array(await crypto.subtle.digest("SHA-256",n)),t="";for(let o of a)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function k(s){let e=s.replace(/-/g,"+").replace(/_/g,"/"),i=e.padEnd(Math.ceil(e.length/4)*4,"="),n=atob(i);return Uint8Array.from(n,a=>a.charCodeAt(0))}function f(s){let e="";for(let i of s)e+=String.fromCharCode(i);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}async function B(s,e,i,n,a){if(typeof s.token!="string"||typeof s.expiresAtMs!="number"||s.expiresAtMs<=Date.now()+M||!s.signingPublicJwk||s.signingPublicJwk.kty!=="OKP"||s.signingPublicJwk.crv!=="Ed25519"||typeof s.signingPublicJwk.x!="string")return null;let t=s.token.split(".");if(t.length!==3)return null;let o,r;try{o=JSON.parse(new TextDecoder().decode(k(t[0]))),r=b$1(s.token);}catch{return null}if(o.alg!=="EdDSA"||s.signingPublicJwk.kid&&o.kid!==s.signingPublicJwk.kid)return null;try{let y=await crypto.subtle.importKey("jwk",s.signingPublicJwk,{name:"Ed25519"},!1,["verify"]);if(!await crypto.subtle.verify({name:"Ed25519"},y,k(t[2]),new TextEncoder().encode(`${t[0]}.${t[1]}`)))return null}catch{return null}let c=typeof r.principalId=="string"?r.principalId:"",l=Number(r.iat),u=Number(r.exp);if(r.iss!=="openrtc"||r.aud!=="openrtc:v2:gateway-grant"||r.typ!=="device-certificate"||r.appTag!==e||!c||a!==void 0&&c!==a||typeof r.principalKey!="string"||r.principalKey.length===0||r.deviceId!==i||r.deviceKeyThumbprint!==n||typeof r.jti!="string"||r.jti.length===0||!Number.isSafeInteger(l)||!Number.isSafeInteger(u)||l>=u||u*1e3!==s.expiresAtMs)return null;let d=b(r);return {token:s.token,expiresAtMs:s.expiresAtMs,principalId:c,signingPublicJwk:s.signingPublicJwk,enrolled:false,...d}}async function J(s,e,i,n,a){try{let t=C(e,i,n),o=s.readSecureRecord?await s.readSecureRecord(e,t):globalThis.localStorage?.getItem(t);if(!o)return null;let r=JSON.parse(o),c=await B(r,e,n,a,i);return c?{token:c.token,expiresAtMs:c.expiresAtMs,principalId:i,signingPublicJwk:c.signingPublicJwk}:null}catch(t){if(s.readSecureRecord)throw t;return null}}async function _(s,e,i,n,a){try{let t=P(e,n),o=s.readSecureRecord?await s.readSecureRecord(i,t):globalThis.localStorage?.getItem(t);return o?await B(JSON.parse(o),i,n,a):null}catch(t){if(s.readSecureRecord)throw t;return null}}async function O(s,e,i,n,a){try{let t=C(e,i,n),o=JSON.stringify(a);s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function $(s,e,i,n,a){try{let t=P(i,n),o=JSON.stringify({token:a.token,expiresAtMs:a.expiresAtMs,principalId:a.principalId,signingPublicJwk:a.signingPublicJwk});s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function A(s,e,i,n,a){try{let t=C(e,i,n);if(s.deleteSecureRecord?await s.deleteSecureRecord(e,t):globalThis.localStorage?.removeItem(t),a){let o=P(a,n);s.deleteSecureRecord?await s.deleteSecureRecord(e,o):globalThis.localStorage?.removeItem(o);}}catch(t){if(s.deleteSecureRecord)throw t}}function K(s){return `${s}_${crypto.randomUUID()}`}function U(s){if(s instanceof TypeError)return  true;if(!s||typeof s!="object")return  false;let e=Reflect.get(s,"name");return e==="TimeoutError"||e==="AbortError"}async function j(s,e){let i=new TextEncoder().encode(`${s}:${e}`);return [...new Uint8Array(await crypto.subtle.digest("SHA-256",i))].map(a=>a.toString(16).padStart(2,"0")).join("")}var x=class{constructor(e,i,n,a,t={},o){this.apiKey=e;this.endpoints=i;this.keyProvider=n;this.attestation=a;this.events=t;this.botVerification=o;this.keyPromise=null;this.authEpochs=new Map;this.appTag=`app_${e.slice(-16)}`;}record(e){this.events.onLogicalOperation?.(e);}before(e){this.events.beforeLogicalOperation?.(e);}authEpoch(e){let i=this.authEpochs.get(e);if(i)return i;let n={generation:0,devices:new Map};return this.authEpochs.set(e,n),e.subscribe&&(n.unsubscribe=e.subscribe(a=>{a?.type==="principal-changed"&&(n.generation+=1,n.devices.clear(),n.sessionKeyHash=void 0,this.events.onAuthEpochChanged?.(e));})),n}dispose(){for(let e of this.authEpochs.values())e.unsubscribe?.();this.authEpochs.clear();}key(){return this.keyPromise??(this.keyPromise=this.keyProvider.getOrCreate(this.appTag))}async deviceSigningPublicKey(){return (await this.key()).publicKeyJwk}async signDeviceBytes(e){return (await this.key()).sign(e)}async resolveBroadcastAccess(e,i){if(!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(e)||e.length>32768)throw new Error("Broadcast grant is invalid.");if(i&&i.byteLength!==32)throw new Error("Broadcast publisher verification key is invalid.");let n=await this.key(),a=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e)))),t=i?f(i):"",o=await n.proof((u,d)=>["openrtc:v2:broadcast-access",this.apiKey,a,t,u,d].join(":")),r=await this.post("/v2/broadcasts",{action:"access",grant:e,...t?{publicationVerifyingKey:t}:{},deviceProof:o});if(r.grant!==e)throw new Error("Broadcast access grant mismatch.");let c=k(r.issuerPublicKey);if(c.byteLength!==32)throw new Error("Broadcast issuer key is invalid.");let l=new URL(r.relay?.relayUrl);if(l.protocol!=="https:"||l.username||l.password)throw new Error("Broadcast relay URL is invalid.");if(typeof r.relay.token!="string"||!/^[A-Za-z0-9._-]{16,16384}$/.test(r.relay.token)||typeof r.relay.namespace!="string"||!/^[A-Za-z0-9._/-]{1,512}$/.test(r.relay.namespace))throw new Error("Broadcast relay allocation is invalid.");return {token:e,issuerPublicKey:c,signBindingChallenge:async u=>{if(!(u instanceof Uint8Array)||u.byteLength>2048)throw new Error("Broadcast binding challenge is invalid.");return k(await n.sign(u))},relay:{relayUrl:l.toString(),token:r.relay.token,namespace:r.relay.namespace}}}async manageBroadcast(e){let i=await this.deviceCertificate(e.auth,e.deviceId),n=e.grant??"",a=e.invite??"",t=e.create,o=e.invitation,r=t?f(t.publisher.verificationKey):o?.publicationVerificationKey?f(o.publicationVerificationKey):"",c=t?{maxPublishers:t.maxPublishers,maxSubscribers:t.maxSubscribers,maxBitrateBps:t.maxBitrateBps,maxDurationSeconds:t.maxDurationSeconds,maxEgressBytes:t.maxEgressBytes}:void 0,l=t?{bitrateBps:t.publisherBitrateBps,durationSeconds:t.maxDurationSeconds,reservedEgressBytes:t.reservedEgressBytes}:o?{role:o.role,sourceSlot:o.sourceSlot??"",bitrateBps:o.bitrateBps,durationSeconds:o.durationSeconds,reservedEgressBytes:o.reservedEgressBytes}:void 0,u=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(JSON.stringify({action:e.action,grant:n,invite:a,publicationKey:r,sourceSlot:t?.sourceSlot??o?.sourceSlot??"host-a",limits:c,reservation:l}))))),y=await(await this.key()).proof((g,v)=>["openrtc:v2:broadcast-manage",i.source.token,e.action,u,g,v].join(":")),p=await this.post("/v2/broadcasts",{action:e.action,deviceId:e.deviceId,deviceCertificate:i.source.token,deviceProof:y,...n?{grant:n}:{},...a?{invite:a}:{},...r?{publicationVerifyingKey:r}:{},...t?{sourceSlot:t.sourceSlot??"host-a",limits:c,reservation:l}:{},...o?{invitation:{...l,publicationVerifyingKey:r}}:{}});if(e.action==="create"||e.action==="renew"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast grant is invalid.");return p.grant}if(e.action==="invite"){if(typeof p.invite!="string"||!/^obi1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.invite))throw new Error("Managed broadcast invitation is invalid.");return p.invite}if(e.action==="accept"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast accepted grant is invalid.");return p.grant}}async post(e,i$1){let n=K("request"),a$1=JSON.stringify({apiKey:this.apiKey,...i$1}),t=null;for(let o=0;o<2;o+=1)try{let r=await fetch(`${this.endpoints.controlPlane}${e}`,{method:"POST",headers:{"Content-Type":"application/json","X-OpenRTC-Idempotency-Key":n},body:a$1,signal:AbortSignal.timeout(15e3)});if(r.ok)return r.json();let c$1=`OpenRTC request failed (${r.status}).`,l,u;try{let y=await r.json();typeof y.error=="string"&&(c$1=y.error.slice(0,256)),typeof y.reason=="string"&&/^[a-z0-9-]{1,80}$/.test(y.reason)&&(l=y.reason),(c(y.code)||a(y.code))&&(u=i({...d(y),code:y.code,message:c$1,retryable:y.retryable}));}catch{}let d$1=u?Object.assign(u,{status:r.status,reason:l}):new w(c$1,r.status,l);if(t=d$1,!u&&o===0&&[502,503,504].includes(r.status))continue;throw d$1}catch(r){if(t=r,o===0&&U(r))continue;throw r}throw t instanceof Error?t:new Error("OpenRTC request failed.")}async capability(e,i,n,a=false,t,o){this.before("capability.issue");let r=e==="space"?await j(this.apiKey,i):i,l=await(await this.key()).proof((p,g)=>["openrtc:v2:capability",this.apiKey,e,r,p,g].join(":")),u=this.botVerification?await this.botVerification.getToken({action:"openrtc_capability",apiKey:this.apiKey}):void 0,d=await this.post("/v2/capabilities",{avenue:{kind:e,id:r},deviceProof:l,...n?{maxPeers:n}:{},...a?{advancedFanout:true}:{},...e==="room"&&t?{architecture:t}:{},...e==="room"&&o?{roomDelivery:o}:{},...u?{turnstileToken:u}:{}});this.record("capability.issue");let y={type:"capability",token:d.capability,avenue:e==="ticket"?{kind:"session",id:r}:d.avenue,expiresAtMs:d.expiresAt*1e3,...b(d)};return y.renew=()=>this.capability(e,i,n,a,t,o),y}async deviceCertificate(e,i,n,a,t){let o=this.authEpoch(e),r=o.devices.get(i)??{};if(o.devices.set(i,r),t&&r.current&&r.current.token!==t.token)return this.deviceCertificateResult(e,i,n,a,{...r.current,enrolled:false});if(!t&&r.current&&r.current.expiresAtMs>Date.now()+M)return this.deviceCertificateResult(e,i,n,a,{...r.current,enrolled:false});if(!r.inFlight){let l=o.generation;t&&(r.current=void 0,r.recoverRevokedEnrollment=true);let u=t?A(this.keyProvider,this.appTag,t.principalId,i,o.sessionKeyHash).then(()=>this.enrollAuthenticatedDevice(e,i,o.sessionKeyHash,a,true)):this.resolveAuthenticatedDevice(e,i,o,a,r.recoverRevokedEnrollment===true);r.inFlight=u.then(d=>{if(o.generation!==l)throw new Error("The OpenRTC authentication identity changed during enrollment.");return r.recoverRevokedEnrollment=false,r.current=d,d}).finally(()=>{r.inFlight=void 0;});}let c=await r.inFlight;return this.deviceCertificateResult(e,i,n,a,c)}async resolveAuthenticatedDevice(e,i,n,a,t=false){let o=await this.key();if(e.getSessionKey){let r=await e.getSessionKey();if(!r)throw new Error("The OpenRTC auth provider has no active principal.");let c=await G(this.appTag,o.thumbprint,r);n.sessionKeyHash=c;let l=await _(this.keyProvider,c,this.appTag,i,o.thumbprint);if(l)return l}return this.enrollAuthenticatedDevice(e,i,n.sessionKeyHash,a,t)}deviceCertificateResult(e,i,n,a,t){let o={type:"device-certificate",token:t.token,avenue:n??{kind:"user",id:t.principalId},expiresAtMs:t.expiresAtMs,irohRelay:t.irohRelay,managedTurn:t.managedTurn};return o.renew=async()=>(await this.deviceCertificate(e,i,n,a)).source,o.recoverRejectedCertificate=async()=>(await this.deviceCertificate(e,i,n,a,t)).source,{principalId:t.principalId,source:o,enrolled:t.enrolled}}async enrollAuthenticatedDevice(e,i,n,a,t=false){this.before("identity.assertion.exchange"),this.before("identity.monthly-active-principal");let o=async(g,v)=>{let m=await e.getAssertion({audience:"https://api.openrtc.app/v2/assertions/exchange",forceRefresh:g,deviceId:i,...{}});if(!m)throw new Error("The OpenRTC auth provider returned no assertion.");return this.post("/v2/assertions/exchange",{assertion:m,deviceId:i,...e.providerId?{providerId:e.providerId}:{}})},r;try{r=await o(!1);}catch(g){if(!(g instanceof w)||g.status!==401)throw g;r=await o(true);}this.record("identity.assertion.exchange"),this.record("identity.monthly-active-principal");let c=await this.key(),l=await J(this.keyProvider,this.appTag,r.principalId,i,c.thumbprint);if(l)return {...l,principalId:r.principalId,enrolled:false,...b(r)};this.before("device.enroll"),this.attestation&&this.before("security.attestation.verify");let{enrollDevice:u}=await import('./deviceEnrollment-2UW67OPP.js'),d=await u({apiKey:this.apiKey,appTag:this.appTag,auth:e,attestation:this.attestation,deviceId:i,identity:r,key:c,profile:a,recoverRevokedEnrollment:t||r.deviceRecoveryAuthorized===true,post:(g,v)=>this.post(g,v),recordAssertionExchange:()=>this.record("identity.assertion.exchange")});r=d.identity;let y=d.enrollment;this.record("device.enroll"),this.attestation&&this.record("security.attestation.verify");let p={principalId:r.principalId,token:y.deviceCertificate,expiresAtMs:y.expiresAt*1e3,signingPublicJwk:y.signingPublicJwk,enrolled:true,...b(r)};return await O(this.keyProvider,this.appTag,r.principalId,i,{token:p.token,expiresAtMs:p.expiresAtMs,signingPublicJwk:p.signingPublicJwk}),n&&await $(this.keyProvider,this.appTag,n,i,p),p}async listEnrolledDevices(e,i){let n=await this.deviceCertificate(e,i);return (await this.deviceManagement(n.source,i,"list")).devices??[]}async revokeDevice(e,i,n){let a=await this.deviceCertificate(e,i);if(await this.deviceManagement(a.source,i,"revoke",n),n===i){let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,i,t.sessionKeyHash),t.devices.delete(i),await this.deleteDeviceKey();}}async revokeAllDevices(e,i,n){let a=await this.deviceCertificate(e,i);await this.deviceManagement(a.source,i,"revoke-all",void 0,n);let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,i,t.sessionKeyHash),t.devices.delete(i),n?await this.deviceCertificate(e,i):(t.devices.clear(),await this.deleteDeviceKey());}async deleteDeviceKey(){this.keyPromise=null,await this.keyProvider.delete?.(this.appTag);}async deviceManagement(e,i,n,a,t=false){let o=n==="revoke"?"device.revoke":n==="revoke-all"?"identity.revoke-all":null;o&&this.before(o);let{manageDevice:r}=await import('./deviceManagement-SUMBRXXC.js'),c=await r({source:e,currentDeviceId:i,action:n,targetDeviceId:a,exceptCurrent:t,key:()=>this.key(),post:l=>this.post("/v2/devices/manage",l),isStale:T});return o&&this.record(o),c}async durableRoomMembership(e,i,n){if(e.type!=="device-certificate")throw new Error("Durable rooms require a device certificate.");this.before(n==="join"?"room.join":"room.leave");let a=b$1(e.token),t=String(a.jti??""),r=await(await this.key()).proof((c,l)=>["openrtc:v2:room-membership",t,n,i,c,l].join(":"));await this.post("/v2/rooms/memberships",{action:n,roomId:i,deviceCertificate:e.token,deviceProof:r}),this.record(n==="join"?"room.join":"room.leave");}grantProvider(e,i={}){let n=Promise.resolve(),a=e;return t=>{let o=n.then(async()=>{let r=false;a.expiresAtMs<=Date.now()+3e5&&a.renew&&(a=await a.renew(),r=true);let c=t.refreshGrant?"gateway.grant.refresh":"gateway.grant.issue";this.before(c),t.refreshGrant&&this.before("coordination.credential.refresh");let l=async d=>{let y=b$1(d.token),p=String(y.jti??""),v=await(await this.key()).proof((m,I)=>["openrtc:v2:gateway-grant",p,t.avenue.kind,t.avenue.id,t.runtimeInstanceId,m,I].join(":"));return this.post("/v2/gateway/grants",{credentialType:d.type,credential:d.token,avenue:t.avenue,runtimeInstanceId:t.runtimeInstanceId,ticketFingerprint:t.ticketFingerprint,deviceProof:v,...t.refreshGrant?{refreshGrant:t.refreshGrant}:{},...i.maxPeers?{maxPeers:i.maxPeers}:{},...i.features?{features:i.features}:{},...t.avenue.kind==="room"&&i.architecture?{architecture:i.architecture}:{},...t.avenue.kind==="room"&&i.roomDelivery?{roomDelivery:i.roomDelivery}:{},...d.type==="device-certificate"&&i.deviceProfile?{deviceProfile:i.deviceProfile}:{}})},u;try{u=await l(a);}catch(d){if(!T(d))throw d;let y=await a.recoverRejectedCertificate?.();if(!y)throw d;a=y,r=true,u=await l(a);}return this.record(c),t.refreshGrant&&this.record("coordination.credential.refresh"),r&&await i.onSourceRenewed?.({token:a.token,expiresAtMs:a.expiresAtMs}),u});return n=o.then(()=>{},()=>{}),o}}turnProvider(e){let i=K("relay"),n=null,a=null;return async()=>{if(n&&n.expiresAtMs>Date.now()+5*6e4)return n;if(a)return a;let t=(async()=>{let o=e(),r=b$1(o.token),c=String(r.jti??""),u=await(await this.key()).proof((y,p)=>["openrtc:v2:relay-turn",c,i,y,p].join(":")),d=await this.post("/v2/relay/turn",{credentialType:o.type,credential:o.token,sessionId:i,deviceProof:u});return n=d,d})();a=t;try{return await t}finally{a===t&&(a=null);}}}};
-export{x as a};