openrtc 3.1.0 → 3.1.2

package/dist/{Connection-BGVBMbWg.d.ts → Connection-U3fEt8_4.d.ts}

@@ -325,6 +325,38 @@ interface MoQObjectQuantities {
     completedReceivedBytes: number;
 }
 
+interface DeviceProof {
+    publicKeyJwk: JsonWebKey;
+    signature: string;
+    nonce: string;
+    issuedAt: number;
+}
+interface DeviceKey {
+    readonly publicKeyJwk: JsonWebKey;
+    readonly thumbprint: string;
+    /** Signs Rust-canonical protocol bytes without exporting private key material. */
+    sign(message: Uint8Array): Promise<string>;
+    proof(challenge: (nonce: string, issuedAt: number) => string): Promise<DeviceProof>;
+}
+interface DeviceKeyProvider {
+    /** Host-owned ephemeral root signer, distinct from the enrollment key. */
+    getRootClientKey?(appTag: string): Promise<DeviceKey>;
+    /** Session-only providers cannot enroll retained devices. Host providers
+     * may omit this; the host owns their durable identity contract. */
+    persistence?: 'session' | 'persistent';
+    getOrCreate(appTag: string): Promise<DeviceKey>;
+    delete?(appTag: string): Promise<void>;
+    /**
+     * Optional host-private record storage. Native hosts use this for the
+     * device certificate bound to their non-exported signing key; the host
+     * chooses a prompt-free implementation. Browsers retain their same-origin
+     * storage implementation.
+     */
+    readSecureRecord?(appTag: string, key: string): Promise<string | null>;
+    writeSecureRecord?(appTag: string, key: string, value: string): Promise<void>;
+    deleteSecureRecord?(appTag: string, key: string): Promise<void>;
+}
+
 /** Public protocol identifiers; provider prices and safety ceilings stay private. */
 declare const SERVICE_ERROR_CODES: {
     readonly CREDIT_EXHAUSTED: "credit-exhausted";
@@ -488,6 +520,8 @@ interface CoordinationGatewayGrantRequest {
     ticketFingerprint: string;
     purpose: 'presence' | 'device-control';
     refreshGrant?: string;
+    /** Internal root possession proof for delegated authority issuance. */
+    rootProof?: DeviceProof;
 }
 interface CoordinationGatewayGrant {
     protocolVersion: 1 | 2;
@@ -1710,4 +1744,4 @@ declare class Connection {
     private close;
 }
 
-export { type RoomMember as $, type ConnectDeviceResult as A, type ConnectDeviceHooks as B, type ChannelDescriptor$1 as C, type DeviceStatus as D, type EffectiveRoomArchitecture as E, type ConnectDeviceOptions as F, type DeviceProfile as G, type RawConnection as H, type IncomingStream as I, type JoinRoomOptions$1 as J, type RuntimeRoomMember as K, type LocalDeviceInfo$1 as L, type ManagedOptions as M, type GrantScope as N, type AuthContext as O, type PlutoIrohConfiguration as P, type RuntimeClientOptions as Q, type RoomArchitectureMode as R, type ServiceErrorObservation as S, type TransferPeerDemandPurpose as T, type DiscoveryMode as U, type AuthMode as V, type SignalingMode as W, type ClientOptions as X, type ExplicitFileDataSendParams as Y, type ISignalingBackend as Z, type RuntimeIdentity as _, type RoomArchitectureReason as a, type DevicePresence as a$, type Device as a0, type DeviceStatusSnapshot as a1, type ManagedConnectionRecord as a2, type SignalingEnvelope as a3, type DeviceEvent as a4, type DesiredPeerProjection as a5, type SignalingSession as a6, type SessionEvent as a7, type LocalDeviceInfo as a8, type NativeManagedSessionStartResult as a9, type CryptoBiStream as aA, type RouteFamily as aB, type RouteKind as aC, type RuntimeAuthIdentity as aD, type RuntimeSession as aE, type AppLimits as aF, type ConnectionTarget as aG, type PresenceLoopOptions as aH, type SignalingOptions as aI, type JoinRoomOptions as aJ, type ChannelMetadata as aK, type RoomCreationMode as aL, type ProtocolCapabilityMap as aM, type ScanningLoopOptions as aN, type ScanningLoopHandle as aO, type RuntimeBootstrapOptions as aP, type RuntimeBootstrapResult as aQ, type ApplicationPayloadReadinessOptions as aR, type ManagedApplicationRouteOptions as aS, type PeerState as aT, type PeerScope as aU, type PeerHealth as aV, type ChannelDescriptor as aW, type JoinRequest as aX, type AutoConnectPolicy as aY, type ChannelFraming as aZ, type ConnectionStatus as a_, type TicketMeshPeerReadiness as aa, type BackendPeerBiStream as ab, type BackendPeerUniStream as ac, type PortableMediaPublish as ad, type PortableMediaPublicationStart as ae, type PortableMediaSample as af, type PortableMediaChunk as ag, type PortableMediaControl as ah, type NativeConnectParams as ai, type NativeConnectResult as aj, type BackendConnectionState as ak, type NativePeerDataEvent as al, type ServiceErrorMetadata as am, type CoordinationGatewayGrantRequest as an, type CoordinationGatewayGrant as ao, type BrowserWasmRuntimeModule as ap, type BrowserProtocolStore as aq, type NamespaceDescriptor as ar, type IrohMutationReceipt as as, type IrohDocEntry as at, type CoordinationSignalingStore as au, type ManagedRoomMessage as av, type CoreClientBridgeHost as aw, type RouteDescriptor as ax, type PayloadCrypto as ay, type CryptoStreams as az, type RoomArchitectureSnapshot as b, type PayloadRouteOptions as b0, type PeerLifecycleStatus$1 as b1, type PeerSessionSnapshot$1 as b2, type PresencePolicy as b3, type RuntimeAuthContext as b4, type RuntimePeerScope as b5, type SessionKind as b6, type SessionPlatform as b7, type RoomAuthorityAssignment as c, type TransferPeerDemandRequest as d, type TransferPeerDemandState as e, type TransferPeerDemandStatus as f, type PlutoRTCConfiguration as g, type PlutoMoQConfiguration as h, type RouteOptimization as i, type ProtocolName as j, type RuntimePeerState as k, type PeerConnectOptions as l, Connection as m, type PeerSessionSnapshot as n, type PeerReadiness as o, type RuntimePeerHealth as p, type ResolvedPeerIdentity as q, type PeerStreamOptions as r, type ScopedChannelOptions as s, type RuntimeDevice as t, type ScopedLogicalChannel as u, type ConnectionState as v, type ReadinessOptions as w, type ConnectionEvent as x, type ManagedSession as y, type DeviceConnectOptions as z };
+export { type SignalingMode as $, type ReadinessOptions as A, type ConnectionEvent as B, type ChannelDescriptor$1 as C, type DeviceProof as D, type EffectiveRoomArchitecture as E, type ManagedSession as F, type DeviceStatus as G, type DeviceConnectOptions as H, type IncomingStream as I, type ConnectDeviceResult as J, type ConnectDeviceHooks as K, type ConnectDeviceOptions as L, type ManagedOptions as M, type LocalDeviceInfo$1 as N, type DeviceProfile as O, type PlutoIrohConfiguration as P, type RawConnection as Q, type RoomArchitectureMode as R, type ServiceErrorObservation as S, type TransferPeerDemandPurpose as T, type JoinRoomOptions$1 as U, type RuntimeRoomMember as V, type GrantScope as W, type AuthContext as X, type RuntimeClientOptions as Y, type DiscoveryMode as Z, type AuthMode as _, type RoomArchitectureReason as a, type AutoConnectPolicy as a$, type ClientOptions as a0, type ExplicitFileDataSendParams as a1, type ISignalingBackend as a2, type RuntimeIdentity as a3, type RoomMember as a4, type Device as a5, type DeviceStatusSnapshot as a6, type ManagedConnectionRecord as a7, type SignalingEnvelope as a8, type DeviceEvent as a9, type RouteDescriptor as aA, type PayloadCrypto as aB, type CryptoStreams as aC, type CryptoBiStream as aD, type RouteFamily as aE, type RouteKind as aF, type RuntimeAuthIdentity as aG, type RuntimeSession as aH, type AppLimits as aI, type ConnectionTarget as aJ, type PresenceLoopOptions as aK, type SignalingOptions as aL, type JoinRoomOptions as aM, type ChannelMetadata as aN, type RoomCreationMode as aO, type ProtocolCapabilityMap as aP, type ScanningLoopOptions as aQ, type ScanningLoopHandle as aR, type RuntimeBootstrapOptions as aS, type RuntimeBootstrapResult as aT, type ApplicationPayloadReadinessOptions as aU, type ManagedApplicationRouteOptions as aV, type PeerState as aW, type PeerScope as aX, type PeerHealth as aY, type ChannelDescriptor as aZ, type JoinRequest as a_, type DesiredPeerProjection as aa, type SignalingSession as ab, type SessionEvent as ac, type LocalDeviceInfo as ad, type NativeManagedSessionStartResult as ae, type TicketMeshPeerReadiness as af, type BackendPeerBiStream as ag, type BackendPeerUniStream as ah, type PortableMediaPublish as ai, type PortableMediaPublicationStart as aj, type PortableMediaSample as ak, type PortableMediaChunk as al, type PortableMediaControl as am, type NativeConnectParams as an, type NativeConnectResult as ao, type BackendConnectionState as ap, type NativePeerDataEvent as aq, type ServiceErrorMetadata as ar, type BrowserWasmRuntimeModule as as, type BrowserProtocolStore as at, type NamespaceDescriptor as au, type IrohMutationReceipt as av, type IrohDocEntry as aw, type CoordinationSignalingStore as ax, type ManagedRoomMessage as ay, type CoreClientBridgeHost as az, type RoomArchitectureSnapshot as b, type ChannelFraming as b0, type ConnectionStatus as b1, type DevicePresence as b2, type PayloadRouteOptions as b3, type PeerLifecycleStatus$1 as b4, type PeerSessionSnapshot$1 as b5, type PresencePolicy as b6, type RuntimeAuthContext as b7, type RuntimePeerScope as b8, type SessionKind as b9, type SessionPlatform as ba, type RoomAuthorityAssignment as c, type TransferPeerDemandRequest as d, type TransferPeerDemandState as e, type TransferPeerDemandStatus as f, type PlutoRTCConfiguration as g, type PlutoMoQConfiguration as h, type RouteOptimization as i, type ProtocolName as j, type DeviceKeyProvider as k, type DeviceKey as l, type CoordinationGatewayGrantRequest as m, type CoordinationGatewayGrant as n, type RuntimePeerState as o, type PeerConnectOptions as p, Connection as q, type PeerSessionSnapshot as r, type PeerReadiness as s, type RuntimePeerHealth as t, type ResolvedPeerIdentity as u, type PeerStreamOptions as v, type ScopedChannelOptions as w, type RuntimeDevice as x, type ScopedLogicalChannel as y, type ConnectionState as z };

package/dist/{DelegatingRuntimeAdapter-JmhmwKTC.d.ts → DelegatingRuntimeAdapter-Coo5BVM2.d.ts}

@@ -1,5 +1,5 @@
-import { U as DiscoveryMode, V as AuthMode, W as SignalingMode, X as ClientOptions, Y as ExplicitFileDataSendParams, Z as ISignalingBackend, _ as RuntimeIdentity, O as AuthContext, $ as RoomMember, a0 as Device, a1 as DeviceStatusSnapshot, n as PeerSessionSnapshot, q as ResolvedPeerIdentity, a2 as ManagedConnectionRecord, a3 as SignalingEnvelope, a4 as DeviceEvent, d as TransferPeerDemandRequest, f as TransferPeerDemandStatus, a5 as DesiredPeerProjection, a6 as SignalingSession, a7 as SessionEvent, a8 as LocalDeviceInfo, a9 as NativeManagedSessionStartResult, j as ProtocolName, N as GrantScope, aa as TicketMeshPeerReadiness, ab as BackendPeerBiStream, ac as BackendPeerUniStream, ad as PortableMediaPublish, ae as PortableMediaPublicationStart, af as PortableMediaSample, ag as PortableMediaChunk, ah as PortableMediaControl, ai as NativeConnectParams, aj as NativeConnectResult, ak as BackendConnectionState, al as NativePeerDataEvent } from './Connection-BGVBMbWg.js';
-import { R as RuntimeCapabilities } from './capabilities-DsKud7Sw.js';
+import { Z as DiscoveryMode, _ as AuthMode, $ as SignalingMode, a0 as ClientOptions, a1 as ExplicitFileDataSendParams, a2 as ISignalingBackend, a3 as RuntimeIdentity, X as AuthContext, a4 as RoomMember, a5 as Device, a6 as DeviceStatusSnapshot, r as PeerSessionSnapshot, u as ResolvedPeerIdentity, a7 as ManagedConnectionRecord, a8 as SignalingEnvelope, a9 as DeviceEvent, d as TransferPeerDemandRequest, f as TransferPeerDemandStatus, aa as DesiredPeerProjection, ab as SignalingSession, ac as SessionEvent, ad as LocalDeviceInfo, ae as NativeManagedSessionStartResult, j as ProtocolName, W as GrantScope, af as TicketMeshPeerReadiness, ag as BackendPeerBiStream, ah as BackendPeerUniStream, ai as PortableMediaPublish, aj as PortableMediaPublicationStart, ak as PortableMediaSample, al as PortableMediaChunk, am as PortableMediaControl, an as NativeConnectParams, ao as NativeConnectResult, ap as BackendConnectionState, aq as NativePeerDataEvent } from './Connection-U3fEt8_4.js';
+import { R as RuntimeCapabilities } from './capabilities-Dxb0XOti.js';
 
 /** Host-neutral configuration shared by browser/WASM and native/IPC adapters. */
 interface RuntimeBridgeOptions {

package/dist/{IpcRuntimeAdapter-DMQoN2XL.d.ts → IpcRuntimeAdapter-D188hRAr.d.ts}

@@ -1,6 +1,6 @@
-import { R as RuntimeBridgeOptions, D as DelegatingRuntimeAdapter } from './DelegatingRuntimeAdapter-JmhmwKTC.js';
+import { R as RuntimeBridgeOptions, D as DelegatingRuntimeAdapter } from './DelegatingRuntimeAdapter-Coo5BVM2.js';
 import { P as PlutoIpcBridge } from './ipc-DgzKqHH3.js';
-import { S as ServiceErrorObservation, ak as BackendConnectionState, al as NativePeerDataEvent, a0 as Device } from './Connection-BGVBMbWg.js';
+import { S as ServiceErrorObservation, ap as BackendConnectionState, aq as NativePeerDataEvent, a5 as Device } from './Connection-U3fEt8_4.js';
 
 /**
  * Root-client owner for the one native WebView projection.

package/dist/{WasmBridge-CJNESUGJ.js → WasmBridge-3HYLCY5Y.js}

@@ -1 +1 @@
-export{b as WasmBridge,a as loadBrowserWasmRuntimeModule}from'./chunk-5LO6PLWZ.js';import'./chunk-AYHD4X2R.js';import'./chunk-LCJQ7RSR.js';import'./chunk-FPJAUAEU.js';import'./chunk-L4HWDDXL.js';import'./chunk-FNCEVW7G.js';import'./chunk-LB27VQRL.js';import'./chunk-OWKAJPOI.js';import'./chunk-TPF643LU.js';import'./chunk-L2ZZXECX.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';
+export{b as WasmBridge,a as loadBrowserWasmRuntimeModule}from'./chunk-PA4WT4QM.js';import'./chunk-AYHD4X2R.js';import'./chunk-LCJQ7RSR.js';import'./chunk-FPJAUAEU.js';import'./chunk-WTOA6B2A.js';import'./chunk-FNCEVW7G.js';import'./chunk-LB27VQRL.js';import'./chunk-OWKAJPOI.js';import'./chunk-TPF643LU.js';import'./chunk-L2ZZXECX.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';

package/dist/{assembly-DGrOqsLW.d.ts → assembly-CtrHmP4j.d.ts}

@@ -1,5 +1,5 @@
-import { k as RuntimePeerState, v as ConnectionState, o as PeerReadiness, l as PeerConnectOptions, m as Connection, I as IncomingStream, N as GrantScope, Q as RuntimeClientOptions, Z as ISignalingBackend, aD as RuntimeAuthIdentity, O as AuthContext, j as ProtocolName, L as LocalDeviceInfo, G as DeviceProfile, aq as BrowserProtocolStore, ar as NamespaceDescriptor, as as IrohMutationReceipt, at as IrohDocEntry, aj as NativeConnectResult, t as RuntimeDevice, M as ManagedOptions, y as ManagedSession, D as DeviceStatus, B as ConnectDeviceHooks, F as ConnectDeviceOptions, A as ConnectDeviceResult, z as DeviceConnectOptions, a2 as ManagedConnectionRecord, n as PeerSessionSnapshot, q as ResolvedPeerIdentity, aE as RuntimeSession, aF as AppLimits, J as JoinRoomOptions, K as RuntimeRoomMember, aG as ConnectionTarget, s as ScopedChannelOptions, u as ScopedLogicalChannel, r as PeerStreamOptions, ai as NativeConnectParams, H as RawConnection, C as ChannelDescriptor, Y as ExplicitFileDataSendParams, aH as PresenceLoopOptions, d as TransferPeerDemandRequest, f as TransferPeerDemandStatus, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, p as RuntimePeerHealth, w as ReadinessOptions, x as ConnectionEvent } from './Connection-BGVBMbWg.js';
-import { R as RuntimeCapabilities, C as CapabilityProfile } from './capabilities-DsKud7Sw.js';
+import { o as RuntimePeerState, z as ConnectionState, s as PeerReadiness, p as PeerConnectOptions, q as Connection, I as IncomingStream, W as GrantScope, Y as RuntimeClientOptions, a2 as ISignalingBackend, aG as RuntimeAuthIdentity, X as AuthContext, j as ProtocolName, N as LocalDeviceInfo, O as DeviceProfile, at as BrowserProtocolStore, au as NamespaceDescriptor, av as IrohMutationReceipt, aw as IrohDocEntry, ao as NativeConnectResult, x as RuntimeDevice, M as ManagedOptions, F as ManagedSession, G as DeviceStatus, K as ConnectDeviceHooks, L as ConnectDeviceOptions, J as ConnectDeviceResult, H as DeviceConnectOptions, a7 as ManagedConnectionRecord, r as PeerSessionSnapshot, u as ResolvedPeerIdentity, aH as RuntimeSession, aI as AppLimits, U as JoinRoomOptions, V as RuntimeRoomMember, aJ as ConnectionTarget, w as ScopedChannelOptions, y as ScopedLogicalChannel, v as PeerStreamOptions, an as NativeConnectParams, Q as RawConnection, C as ChannelDescriptor, a1 as ExplicitFileDataSendParams, aK as PresenceLoopOptions, d as TransferPeerDemandRequest, f as TransferPeerDemandStatus, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, t as RuntimePeerHealth, A as ReadinessOptions, B as ConnectionEvent } from './Connection-U3fEt8_4.js';
+import { R as RuntimeCapabilities, C as CapabilityProfile } from './capabilities-Dxb0XOti.js';
 
 /**
  * Coalesced peer reconciliation scheduler and full reconcile orchestration.

package/dist/{capabilities-DsKud7Sw.d.ts → capabilities-Dxb0XOti.d.ts}

@@ -1,4 +1,4 @@
-import { j as ProtocolName, i as RouteOptimization } from './Connection-BGVBMbWg.js';
+import { j as ProtocolName, i as RouteOptimization } from './Connection-U3fEt8_4.js';
 
 type RuntimeAdapterKind = 'browser-wasm' | 'native-ipc' | 'tauri-ipc' | 'unknown';
 type CapabilityMaturity = 'stable' | 'preview' | 'support-only' | 'unavailable';

package/dist/chunk-5336XOTL.js

@@ -0,0 +1,2 @@
+function u(){let r=crypto.getRandomValues(new Uint8Array(24)),e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function v(r){if(!r||typeof r!="object")throw new Error("[OpenRTC] Native host returned no device public key.");let e=r;if(e.kty!=="OKP"||e.crv!=="Ed25519"||typeof e.x!="string"||!/^[A-Za-z0-9_-]{43}$/.test(e.x)||e.d!==void 0)throw new Error("[OpenRTC] Native host returned an invalid Ed25519 public key.");return {kty:"OKP",crv:"Ed25519",x:e.x}}function l(r,e){return {getRootClientKey:e?void 0:t=>l(r,"root-client").getOrCreate(t),async readSecureRecord(t,n){return r.invoke("openrtc_read_secure_record",{appTag:t,key:n})},async writeSecureRecord(t,n,c){await r.invoke("openrtc_write_secure_record",{appTag:t,key:n,value:c});},async deleteSecureRecord(t,n){await r.invoke("openrtc_delete_secure_record",{appTag:t,key:n});},async delete(t){await r.invoke("openrtc_delete_device_key",{appTag:t});},async getOrCreate(t){let n=v(await r.invoke("openrtc_device_public_key",{appTag:t,...e?{keyScope:e}:{}})),{deviceKeyThumbprint:c}=await import('./deviceKey-4DLS246L.js'),d=await c(n);return {publicKeyJwk:n,thumbprint:d,async sign(a){let i=new TextDecoder("utf-8",{fatal:true}).decode(a),o=await r.invoke("openrtc_sign_device_proof",{appTag:t,challenge:i,...e?{keyScope:e}:{}});if(!/^[A-Za-z0-9_-]{80,128}$/.test(o))throw new Error("[OpenRTC] Native host returned an invalid device signature.");return o},async proof(a){let i=u(),o=Math.floor(Date.now()/1e3),s=await r.invoke("openrtc_sign_device_proof",{appTag:t,challenge:a(i,o),...e?{keyScope:e}:{}});if(!/^[A-Za-z0-9_-]{80,128}$/.test(s))throw new Error("[OpenRTC] Native host returned an invalid device proof.");return {publicKeyJwk:n,signature:s,nonce:i,issuedAt:o}}}}}}
+export{l as a};

package/dist/chunk-KI7XXVXH.js

@@ -0,0 +1 @@
+import {f}from'./chunk-XNJI6KCI.js';function s(t){let o=e=>`${e}:${t}`;return {getOrCreate:e=>f.getOrCreate(o(e)),delete:async e=>{await f.delete?.(o(e));},readSecureRecord:(e,c)=>f.readSecureRecord?.(o(e),c)??Promise.resolve(null),writeSecureRecord:(e,c,d)=>f.writeSecureRecord?.(o(e),c,d)??Promise.resolve(),deleteSecureRecord:(e,c)=>f.deleteSecureRecord?.(o(e),c)??Promise.resolve()}}export{s as a};

package/dist/chunk-M2QMGAL2.js

@@ -0,0 +1,2 @@
+import {b as b$3,c}from'./chunk-XNJI6KCI.js';import {b as b$2}from'./chunk-ZA44REGI.js';import {e,a}from'./chunk-L7N4T2PX.js';import {d,b as b$1,e as e$1}from'./chunk-72MN7BNQ.js';function b(s){return {irohRelay:s.irohRelay===true||s.irohRelay===void 0&&s.relay!==false,managedTurn:s.managedTurn===true}}var G=1440*6e4,m=class extends Error{constructor(r,n,a$1){super(r);this.status=n;this.reason=a$1;this.name="RTCError";let e=[502,503,504].includes(n),o=a$1==="device-reenrollment-auth-required",i=n===412&&a$1==="device-key-recovery-required";this.code=i?a.AUTH_DEVICE_KEY_RECOVERY_REQUIRED:o?"auth/device-reenrollment-required":e?"coordination/service-unavailable":n===429?"coordination/rate-limited":n===401?"auth/expired":n===403?"admission/denied":"internal/error",this.retryable=o||e,this.plane=i||o||n===401?"auth":e||n===429?"coordination":n===403?"admission":"internal";}};function I(s){return !(s instanceof m)||s.status!==403?false:s.reason==="device-certificate-stale"||s.reason==="device-certificate-revoked"?true:!s.reason&&s.message==="Device certificate is revoked or stale."}function P(s,t,r){return `openrtc:v2:device-certificate:${s}:${t}:${r}`}function A(s,t){return `openrtc:v2:device-session:${s}:${t}`}async function $(s,t,r){let n=new TextEncoder().encode(`openrtc:v2:session\0${s}\0${t}\0${r}`),a=new Uint8Array(await crypto.subtle.digest("SHA-256",n)),e="";for(let o of a)e+=String.fromCharCode(o);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function k(s){let t=s.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"="),n=atob(r);return Uint8Array.from(n,a=>a.charCodeAt(0))}function w(s){let t="";for(let r of s)t+=String.fromCharCode(r);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}async function O(s,t,r,n,a){if(typeof s.token!="string"||typeof s.expiresAtMs!="number"||s.expiresAtMs<=Date.now()+G||!s.signingPublicJwk||s.signingPublicJwk.kty!=="OKP"||s.signingPublicJwk.crv!=="Ed25519"||typeof s.signingPublicJwk.x!="string")return null;let e=s.token.split(".");if(e.length!==3)return null;let o,i;try{o=JSON.parse(new TextDecoder().decode(k(e[0]))),i=b$2(s.token);}catch{return null}if(o.alg!=="EdDSA"||s.signingPublicJwk.kid&&o.kid!==s.signingPublicJwk.kid)return null;try{let y=await crypto.subtle.importKey("jwk",s.signingPublicJwk,{name:"Ed25519"},!1,["verify"]);if(!await crypto.subtle.verify({name:"Ed25519"},y,k(e[2]),new TextEncoder().encode(`${e[0]}.${e[1]}`)))return null}catch{return null}let c=typeof i.principalId=="string"?i.principalId:"",d=Number(i.iat),l=Number(i.exp);if(i.iss!=="openrtc"||i.aud!=="openrtc:v2:gateway-grant"||i.typ!=="device-certificate"||i.appTag!==t||!c||a!==void 0&&c!==a||typeof i.principalKey!="string"||i.principalKey.length===0||i.deviceId!==r||i.deviceKeyThumbprint!==n||typeof i.jti!="string"||i.jti.length===0||!Number.isSafeInteger(d)||!Number.isSafeInteger(l)||d>=l||l*1e3!==s.expiresAtMs)return null;let u=b(i);return {token:s.token,expiresAtMs:s.expiresAtMs,principalId:c,signingPublicJwk:s.signingPublicJwk,enrolled:false,...u}}async function j(s,t,r,n,a){try{let e=P(t,r,n),o=s.readSecureRecord?await s.readSecureRecord(t,e):globalThis.localStorage?.getItem(e);if(!o)return null;let i=JSON.parse(o),c=await O(i,t,n,a,r);return c?{token:c.token,expiresAtMs:c.expiresAtMs,principalId:r,signingPublicJwk:c.signingPublicJwk}:null}catch(e){if(s.readSecureRecord)throw e;return null}}async function N(s,t,r,n,a){try{let e=A(t,n),o=s.readSecureRecord?await s.readSecureRecord(r,e):globalThis.localStorage?.getItem(e);return o?await O(JSON.parse(o),r,n,a):null}catch(e){if(s.readSecureRecord)throw e;return null}}async function z(s,t,r,n,a){try{let e=P(t,r,n),o=JSON.stringify(a);s.writeSecureRecord?await s.writeSecureRecord(t,e,o):globalThis.localStorage?.setItem(e,o);}catch(e){if(s.writeSecureRecord)throw e}}async function H(s,t,r,n,a){try{let e=A(r,n),o=JSON.stringify({token:a.token,expiresAtMs:a.expiresAtMs,principalId:a.principalId,signingPublicJwk:a.signingPublicJwk});s.writeSecureRecord?await s.writeSecureRecord(t,e,o):globalThis.localStorage?.setItem(e,o);}catch(e){if(s.writeSecureRecord)throw e}}async function C(s,t,r,n,a){try{let e=P(t,r,n);if(s.deleteSecureRecord?await s.deleteSecureRecord(t,e):globalThis.localStorage?.removeItem(e),a){let o=A(a,n);s.deleteSecureRecord?await s.deleteSecureRecord(t,o):globalThis.localStorage?.removeItem(o);}}catch(e){if(s.deleteSecureRecord)throw e}}function _(s){return `${s}_${crypto.randomUUID()}`}function F(s){if(s instanceof TypeError)return  true;if(!s||typeof s!="object")return  false;let t=Reflect.get(s,"name");return t==="TimeoutError"||t==="AbortError"}async function V(s,t){let r=new TextEncoder().encode(`${s}:${t}`);return [...new Uint8Array(await crypto.subtle.digest("SHA-256",r))].map(a=>a.toString(16).padStart(2,"0")).join("")}var J=class{constructor(t,r,n,a,e={},o,i){this.apiKey=t;this.endpoints=r;this.keyProvider=n;this.attestation=a;this.events=e;this.botVerification=o;this.rootClientKey=i;this.keyPromise=null;this.authEpochs=new Map;this.appTag=`app_${t.slice(-16)}`;}authEpoch(t){let r=this.authEpochs.get(t);if(r)return r;let n={generation:0,devices:new Map};return this.authEpochs.set(t,n),t.subscribe&&(n.unsubscribe=t.subscribe(a=>{a?.type==="principal-changed"&&(n.generation+=1,n.devices.clear(),n.sessionKeyHash=void 0,this.events.onAuthEpochChanged?.(t));})),n}dispose(){for(let t of this.authEpochs.values())t.unsubscribe?.();this.authEpochs.clear();}key(){return this.keyPromise??(this.keyPromise=this.keyProvider.getOrCreate(this.appTag))}async deviceSigningPublicKey(){return (await this.key()).publicKeyJwk}async signDeviceBytes(t){return (await this.key()).sign(t)}async resolveBroadcastAccess(t,r){if(!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)||t.length>32768)throw new Error("Broadcast grant is invalid.");if(r&&r.byteLength!==32)throw new Error("Broadcast publisher verification key is invalid.");let n=await this.key(),a=w(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(t)))),e=r?w(r):"",o=await n.proof((l,u)=>["openrtc:v2:broadcast-access",this.apiKey,a,e,l,u].join(":")),i=await this.post("/v2/broadcasts",{action:"access",grant:t,...e?{publicationVerifyingKey:e}:{},deviceProof:o});if(i.grant!==t)throw new Error("Broadcast access grant mismatch.");let c=k(i.issuerPublicKey);if(c.byteLength!==32)throw new Error("Broadcast issuer key is invalid.");let d=new URL(i.relay?.relayUrl);if(d.protocol!=="https:"||d.username||d.password)throw new Error("Broadcast relay URL is invalid.");if(typeof i.relay.token!="string"||!/^[A-Za-z0-9._-]{16,16384}$/.test(i.relay.token)||typeof i.relay.namespace!="string"||!/^[A-Za-z0-9._/-]{1,512}$/.test(i.relay.namespace))throw new Error("Broadcast relay allocation is invalid.");return {token:t,issuerPublicKey:c,signBindingChallenge:async l=>{if(!(l instanceof Uint8Array)||l.byteLength>2048)throw new Error("Broadcast binding challenge is invalid.");return k(await n.sign(l))},relay:{relayUrl:d.toString(),token:i.relay.token,namespace:i.relay.namespace}}}async manageBroadcast(t){let r=await this.deviceCertificate(t.auth,t.deviceId),n=t.grant??"",a=t.invite??"",e=t.create,o=t.invitation,i=e?w(e.publisher.verificationKey):o?.publicationVerificationKey?w(o.publicationVerificationKey):"",c=e?{maxPublishers:e.maxPublishers,maxSubscribers:e.maxSubscribers,maxBitrateBps:e.maxBitrateBps,maxDurationSeconds:e.maxDurationSeconds,maxEgressBytes:e.maxEgressBytes}:void 0,d=e?{bitrateBps:e.publisherBitrateBps,durationSeconds:e.maxDurationSeconds,reservedEgressBytes:e.reservedEgressBytes}:o?{role:o.role,sourceSlot:o.sourceSlot??"",bitrateBps:o.bitrateBps,durationSeconds:o.durationSeconds,reservedEgressBytes:o.reservedEgressBytes}:void 0,l=w(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(JSON.stringify({action:t.action,grant:n,invite:a,publicationKey:i,sourceSlot:e?.sourceSlot??o?.sourceSlot??"host-a",limits:c,reservation:d}))))),y=await(await this.key()).proof((g,v)=>["openrtc:v2:broadcast-manage",r.source.token,t.action,l,g,v].join(":")),p=await this.post("/v2/broadcasts",{action:t.action,deviceId:t.deviceId,deviceCertificate:r.source.token,deviceProof:y,...n?{grant:n}:{},...a?{invite:a}:{},...i?{publicationVerifyingKey:i}:{},...e?{sourceSlot:e.sourceSlot??"host-a",limits:c,reservation:d}:{},...o?{invitation:{...d,publicationVerifyingKey:i}}:{}});if(t.action==="create"||t.action==="renew"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast grant is invalid.");return p.grant}if(t.action==="invite"){if(typeof p.invite!="string"||!/^obi1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.invite))throw new Error("Managed broadcast invitation is invalid.");return p.invite}if(t.action==="accept"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast accepted grant is invalid.");return p.grant}}async post(t,r){let n=_("request"),a=JSON.stringify({apiKey:this.apiKey,...r}),e$2=null;for(let o=0;o<2;o+=1)try{let i=await fetch(`${this.endpoints.controlPlane}${t}`,{method:"POST",headers:{"Content-Type":"application/json","X-OpenRTC-Idempotency-Key":n},body:a,signal:AbortSignal.timeout(15e3)});if(i.ok)return i.json();let c=`OpenRTC request failed (${i.status}).`,d$1,l;try{let y=await i.json();typeof y.error=="string"&&(c=y.error.slice(0,256)),typeof y.reason=="string"&&/^[a-z0-9-]{1,80}$/.test(y.reason)&&(d$1=y.reason),(d(y.code)||b$1(y.code))&&(l=e({...e$1(y),code:y.code,message:c,retryable:y.retryable}));}catch{}let u=l?Object.assign(l,{status:i.status,reason:d$1}):new m(c,i.status,d$1);if(e$2=u,!l&&o===0&&[502,503,504].includes(i.status))continue;throw u}catch(i){if(e$2=i,o===0&&F(i))continue;throw i}throw e$2 instanceof Error?e$2:new Error("OpenRTC request failed.")}async capability(t,r,n,a=false,e,o){let i=t==="space"?await V(this.apiKey,r):r,d=await(await this.key()).proof((p,g)=>["openrtc:v2:capability",this.apiKey,t,i,p,g].join(":")),l=this.botVerification?await this.botVerification.getToken({action:"openrtc_capability",apiKey:this.apiKey}):void 0,u=await this.post("/v2/capabilities",{avenue:{kind:t,id:i},deviceProof:d,...n?{maxPeers:n}:{},...a?{advancedFanout:true}:{},...t==="room"&&e?{architecture:e}:{},...t==="room"&&o?{roomDelivery:o}:{},...l?{turnstileToken:l}:{}}),y={type:"capability",token:u.capability,avenue:t==="ticket"?{kind:"session",id:i}:u.avenue,expiresAtMs:u.expiresAt*1e3,...b(u)};return y.renew=()=>this.capability(t,r,n,a,e,o),y}async deviceCertificate(t,r,n,a,e){if(this.keyProvider.persistence==="session")throw new Error("[OpenRTC] Durable browser device enrollment requires trust.browserPersistence: persistent. Select it explicitly before creating the client; session keys cannot enroll retained devices.");let o=this.authEpoch(t),i=o.devices.get(r)??{};if(o.devices.set(r,i),e&&i.current&&i.current.token!==e.token)return this.deviceCertificateResult(t,r,n,a,{...i.current,enrolled:false});if(!e&&i.current&&i.current.expiresAtMs>Date.now()+G)return this.deviceCertificateResult(t,r,n,a,{...i.current,enrolled:false});if(!i.inFlight){let d=o.generation;e&&(i.current=void 0,i.recoverRevokedEnrollment=true);let l=e?C(this.keyProvider,this.appTag,e.principalId,r,o.sessionKeyHash).then(()=>this.enrollAuthenticatedDevice(t,r,o.sessionKeyHash,a,true)):this.resolveAuthenticatedDevice(t,r,o,a,i.recoverRevokedEnrollment===true);i.inFlight=l.then(u=>{if(o.generation!==d)throw new Error("The OpenRTC authentication identity changed during enrollment.");return i.recoverRevokedEnrollment=false,i.current=u,u}).finally(()=>{i.inFlight=void 0;});}let c=await i.inFlight;return this.deviceCertificateResult(t,r,n,a,c)}async resolveAuthenticatedDevice(t,r,n,a,e=false){let o=await this.key();if(t.getSessionKey){let i=await t.getSessionKey();if(!i)throw new Error("The OpenRTC auth provider has no active principal.");let c=await $(this.appTag,o.thumbprint,i);n.sessionKeyHash=c;let d=await N(this.keyProvider,c,this.appTag,r,o.thumbprint);if(d)return d}return this.enrollAuthenticatedDevice(t,r,n.sessionKeyHash,a,e)}deviceCertificateResult(t,r,n,a,e){let o={type:"device-certificate",token:e.token,avenue:n??{kind:"user",id:e.principalId},expiresAtMs:e.expiresAtMs,irohRelay:e.irohRelay,managedTurn:e.managedTurn};return o.renew=async()=>(await this.deviceCertificate(t,r,n,a)).source,o.recoverRejectedCertificate=async()=>(await this.deviceCertificate(t,r,n,a,e)).source,{principalId:e.principalId,source:o,enrolled:e.enrolled}}async enrollAuthenticatedDevice(t,r,n,a,e=false){let o=async(g,v)=>{let f=await t.getAssertion({audience:"https://api.openrtc.app/v2/assertions/exchange",forceRefresh:g,deviceId:r,...{}});if(!f)throw new Error("The OpenRTC auth provider returned no assertion.");return this.post("/v2/assertions/exchange",{assertion:f,deviceId:r,...t.providerId?{providerId:t.providerId}:{}})},i;try{i=await o(!1);}catch(g){if(!(g instanceof m)||g.status!==401)throw g;i=await o(true);}let c=await this.key(),d=await j(this.keyProvider,this.appTag,i.principalId,r,c.thumbprint);if(d)return {...d,principalId:i.principalId,enrolled:false,...b(i)};let{enrollDevice:l}=await import('./deviceEnrollment-OFC6DSZP.js'),u=await l({apiKey:this.apiKey,appTag:this.appTag,auth:t,attestation:this.attestation,deviceId:r,identity:i,key:c,profile:a,recoverRevokedEnrollment:e||i.deviceRecoveryAuthorized===true,post:(g,v)=>this.post(g,v)});i=u.identity;let y=u.enrollment,p={principalId:i.principalId,token:y.deviceCertificate,expiresAtMs:y.expiresAt*1e3,signingPublicJwk:y.signingPublicJwk,enrolled:true,...b(i)};return await z(this.keyProvider,this.appTag,i.principalId,r,{token:p.token,expiresAtMs:p.expiresAtMs,signingPublicJwk:p.signingPublicJwk}),n&&await H(this.keyProvider,this.appTag,n,r,p),p}async listEnrolledDevices(t,r){let n=await this.deviceCertificate(t,r);return (await this.deviceManagement(n.source,r,"list")).devices??[]}async revokeDevice(t,r,n){let a=await this.deviceCertificate(t,r);if(await this.deviceManagement(a.source,r,"revoke",n),n===r){let e=this.authEpoch(t);await C(this.keyProvider,this.appTag,a.principalId,r,e.sessionKeyHash),e.devices.delete(r),await this.deleteDeviceKey();}}async revokeAllDevices(t,r,n){let a=await this.deviceCertificate(t,r);await this.deviceManagement(a.source,r,"revoke-all",void 0,n);let e=this.authEpoch(t);await C(this.keyProvider,this.appTag,a.principalId,r,e.sessionKeyHash),e.devices.delete(r),n?await this.deviceCertificate(t,r):(e.devices.clear(),await this.deleteDeviceKey());}async deleteDeviceKey(){this.keyPromise=null,await this.keyProvider.delete?.(this.appTag);}async deviceManagement(t,r,n,a,e=false){let{manageDevice:o}=await import('./deviceManagement-SUMBRXXC.js');return await o({source:t,currentDeviceId:r,action:n,targetDeviceId:a,exceptCurrent:e,key:()=>this.key(),post:c=>this.post("/v2/devices/manage",c),isStale:I})}async durableRoomMembership(t,r,n){if(t.type!=="device-certificate")throw new Error("Durable rooms require a device certificate.");let a=b$2(t.token),e=String(a.jti??""),i=await(await this.key()).proof((c,d)=>["openrtc:v2:room-membership",e,n,r,c,d].join(":"));await this.post("/v2/rooms/memberships",{action:n,roomId:r,deviceCertificate:t.token,deviceProof:i});}grantProvider(t,r={}){let n=Promise.resolve(),a=t;return e=>{let o=n.then(async()=>{let i=false;a.expiresAtMs<=Date.now()+3e5&&a.renew&&(a=await a.renew(),i=true);let c$1=async l=>{let u=b$2(l.token),y=String(u.jti??""),p=await this.key(),g=await this.rootClientKey,v=["gateway-grant",this.appTag,y,e.avenue.kind,e.avenue.id,e.runtimeInstanceId,e.ticketFingerprint],f=g?await b$3(g,v):void 0,U=await p.proof((S,E)=>g?c(v,g.thumbprint,S,E):["openrtc:v2:gateway-grant",y,e.avenue.kind,e.avenue.id,e.runtimeInstanceId,S,E].join(":"));return this.post("/v2/gateway/grants",{credentialType:l.type,credential:l.token,avenue:e.avenue,runtimeInstanceId:e.runtimeInstanceId,ticketFingerprint:e.ticketFingerprint,deviceProof:U,...f?{rootProof:f}:{},...e.refreshGrant?{refreshGrant:e.refreshGrant}:{},...r.maxPeers?{maxPeers:r.maxPeers}:{},...r.features?{features:r.features}:{},...e.avenue.kind==="room"&&r.architecture?{architecture:r.architecture}:{},...e.avenue.kind==="room"&&r.roomDelivery?{roomDelivery:r.roomDelivery}:{},...l.type==="device-certificate"&&r.deviceProfile?{deviceProfile:r.deviceProfile}:{}})},d;try{d=await c$1(a);}catch(l){if(!I(l))throw l;let u=await a.recoverRejectedCertificate?.();if(!u)throw l;a=u,i=true,d=await c$1(a);}return i&&await r.onSourceRenewed?.({token:a.token,expiresAtMs:a.expiresAtMs}),d});return n=o.then(()=>{},()=>{}),o}}turnProvider(t){let r=_("relay"),n=null,a=null;return async()=>{if(n&&n.expiresAtMs>Date.now()+5*6e4)return n;if(a)return a;let e=(async()=>{let o=t(),i=b$2(o.token),c=String(i.jti??""),l=await(await this.key()).proof((y,p)=>["openrtc:v2:relay-turn",c,r,y,p].join(":")),u=await this.post("/v2/relay/turn",{credentialType:o.type,credential:o.token,sessionId:r,deviceProof:l});return n=u,u})();a=e;try{return await e}finally{a===e&&(a=null);}}}};
+export{J as a};