openrtc 3.1.0 → 3.1.2

package/dist/runtime/index.js

@@ -1 +1 @@
-export{a as isDeviceActive,c as isDeviceConnectable,b as isDeviceRoutable}from'../chunk-CK6WQV7J.js';export{h as ConnectionActor,e as ConnectionActorError,i as ConnectionActors,a as ConnectionController,k as DEFAULT_MAX_FRAME_BYTES,t as IpcRuntimeAdapter,s as RuntimeClient,d as clog,q as concatRuntimeBytes,f as connectionActorKey,g as connectionActorKeyString,p as createJsonDecoder,l as createU32Decoder,n as decodeJsonPayload,o as encodeJsonFrame,m as encodeJsonPayload,j as encodeU32Frame,c as grantCorrelation,r as readRuntimeU32BE,b as renderCorrelation}from'../chunk-SADNIMUO.js';import'../chunk-IXQ4KWGP.js';import'../chunk-CQHLD52E.js';export{u as BROWSER_CAPABILITIES,v as NATIVE_CAPABILITIES,s as RUNTIME_POLICY,x as browserCapabilities,z as capabilityProfile,w as cloneCapabilities,t as getRuntimePolicy,l as logTeardownTrace,h as openRtcDebug,g as openRtcDebugEnabled,i as openRtcDebugInfo,j as openRtcDebugLog,y as statusCapabilities}from'../chunk-LCJQ7RSR.js';import'../chunk-FPJAUAEU.js';import'../chunk-L4HWDDXL.js';import'../chunk-2AAZFBRZ.js';import'../chunk-FNCEVW7G.js';import'../chunk-LB27VQRL.js';import'../chunk-OWKAJPOI.js';import'../chunk-TPF643LU.js';export{a as classifyIpcFailure,b as isIpcUnavailable}from'../chunk-72NEEJQG.js';import'../chunk-L2ZZXECX.js';export{c as runtimeFromCapability}from'../chunk-5LNRJE6L.js';import'../chunk-FKAQDDUM.js';import'../chunk-RLPWFHOY.js';import'../chunk-IUU6JCLK.js';import'../chunk-CCCYE3XN.js';import'../chunk-JPBW67B3.js';import'../chunk-ZA44REGI.js';import'../chunk-L7N4T2PX.js';import'../chunk-72MN7BNQ.js';import'../chunk-2GX6GB6L.js';
+export{a as isDeviceActive,c as isDeviceConnectable,b as isDeviceRoutable}from'../chunk-CK6WQV7J.js';export{h as ConnectionActor,e as ConnectionActorError,i as ConnectionActors,a as ConnectionController,k as DEFAULT_MAX_FRAME_BYTES,t as IpcRuntimeAdapter,s as RuntimeClient,d as clog,q as concatRuntimeBytes,f as connectionActorKey,g as connectionActorKeyString,p as createJsonDecoder,l as createU32Decoder,n as decodeJsonPayload,o as encodeJsonFrame,m as encodeJsonPayload,j as encodeU32Frame,c as grantCorrelation,r as readRuntimeU32BE,b as renderCorrelation}from'../chunk-M4KL5XZU.js';import'../chunk-IXQ4KWGP.js';import'../chunk-CQHLD52E.js';export{u as BROWSER_CAPABILITIES,v as NATIVE_CAPABILITIES,s as RUNTIME_POLICY,x as browserCapabilities,z as capabilityProfile,w as cloneCapabilities,t as getRuntimePolicy,l as logTeardownTrace,h as openRtcDebug,g as openRtcDebugEnabled,i as openRtcDebugInfo,j as openRtcDebugLog,y as statusCapabilities}from'../chunk-LCJQ7RSR.js';import'../chunk-FPJAUAEU.js';import'../chunk-WTOA6B2A.js';import'../chunk-2AAZFBRZ.js';import'../chunk-FNCEVW7G.js';import'../chunk-LB27VQRL.js';import'../chunk-OWKAJPOI.js';import'../chunk-TPF643LU.js';export{a as classifyIpcFailure,b as isIpcUnavailable}from'../chunk-72NEEJQG.js';import'../chunk-L2ZZXECX.js';export{c as runtimeFromCapability}from'../chunk-RUOVYQ2P.js';import'../chunk-FKAQDDUM.js';import'../chunk-SSBR3IHA.js';import'../chunk-IUU6JCLK.js';import'../chunk-CCCYE3XN.js';import'../chunk-JPBW67B3.js';import'../chunk-ZA44REGI.js';import'../chunk-L7N4T2PX.js';import'../chunk-72MN7BNQ.js';import'../chunk-2GX6GB6L.js';

package/dist/server-browser.d.ts

@@ -1,9 +1,9 @@
 export { AuthorityAssignmentInput, AuthorityInterestAssignment, AuthorityServiceGrant, AuthorityServiceGrantRequest, Ed25519Signer } from './service-node.js';
-import './types-Cruu-MsF.js';
-import './coreClient-ByXs38IP.js';
-import './assembly-DGrOqsLW.js';
-import './Connection-BGVBMbWg.js';
-import './capabilities-DsKud7Sw.js';
+import './Connection-U3fEt8_4.js';
+import './types-DvZvz4EL.js';
+import './coreClient-AVGEwlhT.js';
+import './assembly-CtrHmP4j.js';
+import './capabilities-Dxb0XOti.js';
 
 /** Browser export for `openrtc/server`; secret-bearing helpers are unavailable. */
 

package/dist/server.d.ts

@@ -1,9 +1,9 @@
 import { Ed25519Signer, AuthorityServiceGrantRequest, AuthorityServiceGrant, AuthorityAssignmentInput, AuthorityInterestAssignment, DelegatedAuthorityGrantRequest } from './service-node.js';
-import './types-Cruu-MsF.js';
-import './coreClient-ByXs38IP.js';
-import './assembly-DGrOqsLW.js';
-import './Connection-BGVBMbWg.js';
-import './capabilities-DsKud7Sw.js';
+import './Connection-U3fEt8_4.js';
+import './types-DvZvz4EL.js';
+import './coreClient-AVGEwlhT.js';
+import './assembly-CtrHmP4j.js';
+import './capabilities-Dxb0XOti.js';
 
 /** Secret-bearing Node/server helpers. Do not import this entrypoint in browsers. */
 

package/dist/server.js

@@ -1,2 +1,2 @@
-import {a}from'./chunk-LVLU4YQY.js';import'./chunk-5LNRJE6L.js';import'./chunk-FKAQDDUM.js';import'./chunk-RLPWFHOY.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';function y(n){let e=new URL(n??"https://api.openrtc.app"),t=e.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(e.hostname.toLowerCase());if(e.protocol!=="https:"&&!t||e.username||e.password||e.search||e.hash)throw new TypeError("[OpenRTC] authority control-plane endpoint is invalid.");return e.toString().replace(/\/$/,"")}function h(){if(typeof document<"u"||typeof window<"u")throw new Error("[OpenRTC] openrtc/server is unavailable in browsers; use openrtc/service-node with a delegated grant.")}var c=class{constructor(e){h();let t=e.secretKey?.trim()??"";if(!/^sk_(?:live|test)_[A-Za-z0-9_-]+$/.test(t))throw new TypeError("[OpenRTC] secretKey is invalid.");let i=e.fetch??globalThis.fetch;if(typeof i!="function")throw new TypeError("[OpenRTC] a Fetch-compatible implementation is required.");let u=y(e.endpoint);this.authority=new a({apiKey:e.apiKey,serviceId:e.serviceId,generation:e.generation,shardIds:e.shardIds,deviceId:e.deviceId,deviceSigner:e.deviceSigner,assignmentSigner:e.assignmentSigner,grantIssuer:async s=>{let r=await i(`${u}/v2/developer/authority/grants`,{method:"POST",headers:{authorization:`Bearer ${t}`,"content-type":"application/json","x-openrtc-idempotency-key":s.idempotencyKey},body:JSON.stringify(s.body)});if(!r.ok){let o=await r.json().catch(()=>null),d=typeof o?.error=="string"?o.error.slice(0,256):`HTTP ${r.status}`;throw new Error(`[OpenRTC] authority service grant failed: ${d}`)}return r.json()}});}requestGrant(e){return this.authority.requestGrant(e)}signAssignment(e){return this.authority.signAssignment(e)}devicePublicKey(){return this.authority.devicePublicKey()}signDeviceBytes(e){return this.authority.signDeviceBytes(e)}grantIssuer(){return async e=>{let t=e.body;return this.requestGrant({roomId:String(t.avenue?.id??""),runtimeInstanceId:String(t.runtimeInstanceId??""),ticketFingerprint:String(t.ticketFingerprint??""),maxPeers:typeof t.maxPeers=="number"?t.maxPeers:void 0,refreshGrant:typeof t.refreshGrant=="string"?t.refreshGrant:void 0,features:typeof t.features=="object"&&t.features?t.features:void 0})}}};
+import {a}from'./chunk-V57WKJSB.js';import'./chunk-XNJI6KCI.js';import'./chunk-RUOVYQ2P.js';import'./chunk-FKAQDDUM.js';import'./chunk-SSBR3IHA.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';function y(n){let e=new URL(n??"https://api.openrtc.app"),t=e.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(e.hostname.toLowerCase());if(e.protocol!=="https:"&&!t||e.username||e.password||e.search||e.hash)throw new TypeError("[OpenRTC] authority control-plane endpoint is invalid.");return e.toString().replace(/\/$/,"")}function h(){if(typeof document<"u"||typeof window<"u")throw new Error("[OpenRTC] openrtc/server is unavailable in browsers; use openrtc/service-node with a delegated grant.")}var c=class{constructor(e){h();let t=e.secretKey?.trim()??"";if(!/^sk_(?:live|test)_[A-Za-z0-9_-]+$/.test(t))throw new TypeError("[OpenRTC] secretKey is invalid.");let i=e.fetch??globalThis.fetch;if(typeof i!="function")throw new TypeError("[OpenRTC] a Fetch-compatible implementation is required.");let u=y(e.endpoint);this.authority=new a({apiKey:e.apiKey,serviceId:e.serviceId,generation:e.generation,shardIds:e.shardIds,deviceId:e.deviceId,deviceSigner:e.deviceSigner,assignmentSigner:e.assignmentSigner,grantIssuer:async s=>{let r=await i(`${u}/v2/developer/authority/grants`,{method:"POST",headers:{authorization:`Bearer ${t}`,"content-type":"application/json","x-openrtc-idempotency-key":s.idempotencyKey},body:JSON.stringify(s.body)});if(!r.ok){let o=await r.json().catch(()=>null),d=typeof o?.error=="string"?o.error.slice(0,256):`HTTP ${r.status}`;throw new Error(`[OpenRTC] authority service grant failed: ${d}`)}return r.json()}});}requestGrant(e){return this.authority.requestGrant(e)}signAssignment(e){return this.authority.signAssignment(e)}devicePublicKey(){return this.authority.devicePublicKey()}signDeviceBytes(e){return this.authority.signDeviceBytes(e)}grantIssuer(){return async e=>{let t=e.body;return this.requestGrant({rootProof:t.rootProof??null,roomId:String(t.avenue?.id??""),runtimeInstanceId:String(t.runtimeInstanceId??""),ticketFingerprint:String(t.ticketFingerprint??""),maxPeers:typeof t.maxPeers=="number"?t.maxPeers:void 0,refreshGrant:typeof t.refreshGrant=="string"?t.refreshGrant:void 0,features:typeof t.features=="object"&&t.features?t.features:void 0})}}};
 export{c as AuthorityServiceControlPlane};

package/dist/service-node.d.ts

@@ -1,10 +1,8 @@
-import { C as Client, a0 as Room, r as Connection } from './types-Cruu-MsF.js';
-import './coreClient-ByXs38IP.js';
-import './assembly-DGrOqsLW.js';
-import './Connection-BGVBMbWg.js';
-import './capabilities-DsKud7Sw.js';
-
-/** Browser-safe and Node-host-neutral developer service-node facade. */
+import { D as DeviceProof } from './Connection-U3fEt8_4.js';
+import { C as Client, a0 as Room, r as Connection } from './types-DvZvz4EL.js';
+import './coreClient-AVGEwlhT.js';
+import './assembly-CtrHmP4j.js';
+import './capabilities-Dxb0XOti.js';
 
 interface Ed25519Signer {
     publicJwk(): JsonWebKey | Promise<JsonWebKey>;
@@ -31,6 +29,8 @@ interface DelegatedAuthorityGrantRequest {
 }
 type AuthorityGrantIssuer = (request: DelegatedAuthorityGrantRequest) => Promise<unknown>;
 interface AuthorityServiceGrantRequest {
+    /** Internal native-root proof; null preserves a legacy delegated request. */
+    rootProof?: DeviceProof | null;
     roomId: string;
     runtimeInstanceId: string;
     ticketFingerprint: string;
@@ -107,6 +107,7 @@ interface ServiceNodeRoom extends Room {
 declare class DelegatedAuthorityService {
     private readonly apiKey;
     private readonly applicationTag;
+    private readonly rootClientKey;
     private readonly grantIssuer;
     private readonly serviceId;
     private readonly generation;

package/dist/service-node.js

@@ -1 +1 @@
-export{a as DelegatedAuthorityService,b as ServiceNode}from'./chunk-LVLU4YQY.js';import'./chunk-5LNRJE6L.js';import'./chunk-FKAQDDUM.js';import'./chunk-RLPWFHOY.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';
+export{a as DelegatedAuthorityService,b as ServiceNode}from'./chunk-V57WKJSB.js';import'./chunk-XNJI6KCI.js';import'./chunk-RUOVYQ2P.js';import'./chunk-FKAQDDUM.js';import'./chunk-SSBR3IHA.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';

package/dist/testing/native.d.ts

@@ -1,10 +1,10 @@
-import { O as Options, C as Client } from '../types-Cruu-MsF.js';
+import { O as Options, C as Client } from '../types-DvZvz4EL.js';
 import { E as Endpoints } from '../protocol-BSBjMb7p.js';
 import { P as PlutoIpcBridge } from '../ipc-DgzKqHH3.js';
-import '../coreClient-ByXs38IP.js';
-import '../assembly-DGrOqsLW.js';
-import '../Connection-BGVBMbWg.js';
-import '../capabilities-DsKud7Sw.js';
+import '../coreClient-AVGEwlhT.js';
+import '../assembly-CtrHmP4j.js';
+import '../Connection-U3fEt8_4.js';
+import '../capabilities-Dxb0XOti.js';
 
 declare function OpenRTC(options: Options, endpoints: Endpoints, bridge: PlutoIpcBridge): Client;
 

package/dist/testing/native.js

@@ -1 +1 @@
-import {a}from'../chunk-XXZEDZUU.js';import'../chunk-TPF643LU.js';import {a as a$1}from'../chunk-NS32P65Z.js';import'../chunk-GMPEZXPD.js';import {i}from'../chunk-5LNRJE6L.js';import'../chunk-FKAQDDUM.js';import'../chunk-RLPWFHOY.js';import'../chunk-IUU6JCLK.js';import'../chunk-CCCYE3XN.js';import'../chunk-JPBW67B3.js';import'../chunk-ZA44REGI.js';import'../chunk-L7N4T2PX.js';import'../chunk-72MN7BNQ.js';import'../chunk-2GX6GB6L.js';function v(c,p,e){let o=new a;return i(c,{endpoints:p,testingAllowInsecureLoopback:true,platform:"native",close:()=>o.close(),deviceKeyProvider:a$1(e),deviceIdProvider:async()=>{let t=await e.invoke("get_rtc_local_device_info");return String(t?.deviceId??"")},runtimeFactory:async t=>{let{createIpcClient:a}=await import('../ipcFactory-F75IXEIE.js');return a(t,e,o)}})}export{v as OpenRTC};
+import {a}from'../chunk-XXZEDZUU.js';import'../chunk-TPF643LU.js';import {a as a$1}from'../chunk-5336XOTL.js';import {i}from'../chunk-RUOVYQ2P.js';import'../chunk-FKAQDDUM.js';import'../chunk-SSBR3IHA.js';import'../chunk-IUU6JCLK.js';import'../chunk-CCCYE3XN.js';import'../chunk-JPBW67B3.js';import'../chunk-ZA44REGI.js';import'../chunk-L7N4T2PX.js';import'../chunk-72MN7BNQ.js';import'../chunk-2GX6GB6L.js';function v(c,p,e){let o=new a;return i(c,{endpoints:p,testingAllowInsecureLoopback:true,platform:"native",close:()=>o.close(),deviceKeyProvider:a$1(e),deviceIdProvider:async()=>{let t=await e.invoke("get_rtc_local_device_info");return String(t?.deviceId??"")},runtimeFactory:async t=>{let{createIpcClient:a}=await import('../ipcFactory-6XD3J2UU.js');return a(t,e,o)}})}export{v as OpenRTC};

package/dist/testing.d.ts

@@ -1,39 +1,9 @@
-import { R as RoomArchitectureMode, an as CoordinationGatewayGrantRequest, ao as CoordinationGatewayGrant } from './Connection-BGVBMbWg.js';
-import { a as AttestationProvider, b as AuthProvider, B as BotVerificationProvider, e as BroadcastGrant, d as BroadcastCreateOptions, f as BroadcastInvite, g as BroadcastInviteOptions, D as Delivery, t as DeviceProfile, O as Options, C as Client } from './types-Cruu-MsF.js';
+import { k as DeviceKeyProvider, l as DeviceKey, R as RoomArchitectureMode, m as CoordinationGatewayGrantRequest, n as CoordinationGatewayGrant } from './Connection-U3fEt8_4.js';
+import { a as AttestationProvider, b as AuthProvider, B as BotVerificationProvider, e as BroadcastGrant, d as BroadcastCreateOptions, f as BroadcastInvite, g as BroadcastInviteOptions, D as Delivery, t as DeviceProfile, O as Options, C as Client } from './types-DvZvz4EL.js';
 import { E as Endpoints } from './protocol-BSBjMb7p.js';
-import './coreClient-ByXs38IP.js';
-import './assembly-DGrOqsLW.js';
-import './capabilities-DsKud7Sw.js';
-
-interface DeviceProof {
-    publicKeyJwk: JsonWebKey;
-    signature: string;
-    nonce: string;
-    issuedAt: number;
-}
-interface DeviceKey {
-    readonly publicKeyJwk: JsonWebKey;
-    readonly thumbprint: string;
-    /** Signs Rust-canonical protocol bytes without exporting private key material. */
-    sign(message: Uint8Array): Promise<string>;
-    proof(challenge: (nonce: string, issuedAt: number) => string): Promise<DeviceProof>;
-}
-interface DeviceKeyProvider {
-    /** Session-only providers cannot enroll retained devices. Host providers
-     * may omit this; the host owns their durable identity contract. */
-    persistence?: 'session' | 'persistent';
-    getOrCreate(appTag: string): Promise<DeviceKey>;
-    delete?(appTag: string): Promise<void>;
-    /**
-     * Optional host-private record storage. Native hosts use this for the
-     * device certificate bound to their non-exported signing key; the host
-     * chooses a prompt-free implementation. Browsers retain their same-origin
-     * storage implementation.
-     */
-    readSecureRecord?(appTag: string, key: string): Promise<string | null>;
-    writeSecureRecord?(appTag: string, key: string, value: string): Promise<void>;
-    deleteSecureRecord?(appTag: string, key: string): Promise<void>;
-}
+import './coreClient-AVGEwlhT.js';
+import './assembly-CtrHmP4j.js';
+import './capabilities-Dxb0XOti.js';
 
 interface CredentialSource {
     type: 'capability' | 'device-certificate';
@@ -74,10 +44,11 @@ declare class ControlPlane {
     private readonly attestation?;
     private readonly events;
     private readonly botVerification?;
+    private readonly rootClientKey?;
     readonly appTag: string;
     private keyPromise;
     private readonly authEpochs;
-    constructor(apiKey: string, endpoints: Endpoints, keyProvider: DeviceKeyProvider, attestation?: AttestationProvider | undefined, events?: ControlPlaneEvents, botVerification?: BotVerificationProvider | undefined);
+    constructor(apiKey: string, endpoints: Endpoints, keyProvider: DeviceKeyProvider, attestation?: AttestationProvider | undefined, events?: ControlPlaneEvents, botVerification?: BotVerificationProvider | undefined, rootClientKey?: Promise<DeviceKey> | undefined);
     private authEpoch;
     dispose(): void;
     private key;

package/dist/testing.js

@@ -1 +1 @@
-import {a}from'./chunk-2Q75GXGE.js';import {a as a$1}from'./chunk-IAYQJZQQ.js';import {a as a$2,d,c}from'./chunk-L2ZZXECX.js';import'./chunk-GMPEZXPD.js';import {i}from'./chunk-5LNRJE6L.js';import'./chunk-FKAQDDUM.js';import'./chunk-RLPWFHOY.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';function v(i,o,e){let n=s=>{let t=new URL(s);return t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)&&Number(t.port)>0&&t.pathname==="/"&&!t.username&&!t.password&&!t.search&&!t.hash};if(i.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!n(o.controlPlane)||!n(o.gateway)||!/^[A-Za-z0-9_-]{1,64}$/.test(e.keyNamespace))throw new Error("Local broadcast testing requires the disposable loopback service lane")}function b(i){let o=i.replace(/-/g,"+").replace(/_/g,"/").padEnd(Math.ceil(i.length/4)*4,"=");return Uint8Array.from(atob(o),e=>e.charCodeAt(0))}function A(i,o,e){return new a(i,o,a$1(e))}function R(i$1,o,e={}){if(e.localBroadcast&&v(i$1,o,e.localBroadcast),e.initialTicketLifetimeMs!==void 0){let t=(p,c)=>{let a=new URL(p);return a.protocol===c&&["127.0.0.1","[::1]"].includes(a.hostname)&&Number(a.port)>0&&a.pathname==="/"&&!a.username&&!a.password&&!a.search&&!a.hash};if(e.initialTicketLifetimeMs!==9e4||i$1.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!t(o.controlPlane,"http:")||!t(o.gateway,"http:")||!e.irohTestRelayUrl||!t(e.irohTestRelayUrl,"https:"))throw new Error("Short initial tickets require the disposable local service lane")}let n=e.localBroadcast,s=n?a$1(n.keyNamespace):void 0;return i(i$1,{endpoints:o,testingAllowInsecureLoopback:true,platform:"web",...s?{deviceKeyProvider:s}:{},...n&&s?{broadcastHostFactory:async t=>{let[{BrowserManagedBroadcastHost:p},{loadBrowserWasmRuntimeModule:c}]=await Promise.all([import('./BrowserManagedBroadcastHost-6VGHQQMF.js'),import('./WasmBridge-CJNESUGJ.js')]),a=c().then(async r=>(await r.initWasm(),r.start(),new r.WasmClient(t.apiKey))),y=await s.getOrCreate(`app_${t.apiKey.slice(-16)}`);return new p({resolve:async(r,l)=>({token:r,...await n.resolve(r,l),signBindingChallenge:async m=>b(await y.sign(m))}),loadWasm:()=>a})}}:{},...e.deviceId?{deviceIdProvider:async()=>e.deviceId}:{},...e.irohTestRelayUrl?{irohTestRelayUrl:e.irohTestRelayUrl}:{},runtimeFactory:async t=>{let{createWasmClient:p}=await import('./runtime/factories.js'),c$1=await p(t);if(e.initialTicketLifetimeMs!==void 0){let a=c$1.runtime,y=a.getTicketWithToken.bind(a);a.getTicketWithToken=async(r,l=0)=>{if(a.getTicketWithToken=y,!r.startsWith("v2:room:"))throw new Error("Short initial ticket requires room scope");let{irohTicket:m,tokenSuffix:u}=a$2(await y(r,l)),d$1=u&&d(m,u);if(!d$1||!d$1.t||d$1.s!==r||d$1.m!==l)throw new Error("Invalid initial service ticket");let f=Date.now()+9e4;return await a.registerToken({token:d$1.t,scope:r,maxConnections:l,expiresAtMs:f}),c(m,d$1.t,r,l,f)};}return c$1}})}export{R as OpenRTC,A as controlPlane};
+import {a}from'./chunk-M2QMGAL2.js';import {a as a$1}from'./chunk-KI7XXVXH.js';import {a as a$2,d,c}from'./chunk-L2ZZXECX.js';import'./chunk-XNJI6KCI.js';import {i}from'./chunk-RUOVYQ2P.js';import'./chunk-FKAQDDUM.js';import'./chunk-SSBR3IHA.js';import'./chunk-IUU6JCLK.js';import'./chunk-CCCYE3XN.js';import'./chunk-JPBW67B3.js';import'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';import'./chunk-2GX6GB6L.js';function v(i,o,e){let n=s=>{let t=new URL(s);return t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)&&Number(t.port)>0&&t.pathname==="/"&&!t.username&&!t.password&&!t.search&&!t.hash};if(i.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!n(o.controlPlane)||!n(o.gateway)||!/^[A-Za-z0-9_-]{1,64}$/.test(e.keyNamespace))throw new Error("Local broadcast testing requires the disposable loopback service lane")}function b(i){let o=i.replace(/-/g,"+").replace(/_/g,"/").padEnd(Math.ceil(i.length/4)*4,"=");return Uint8Array.from(atob(o),e=>e.charCodeAt(0))}function A(i,o,e){return new a(i,o,a$1(e))}function R(i$1,o,e={}){if(e.localBroadcast&&v(i$1,o,e.localBroadcast),e.initialTicketLifetimeMs!==void 0){let t=(p,c)=>{let a=new URL(p);return a.protocol===c&&["127.0.0.1","[::1]"].includes(a.hostname)&&Number(a.port)>0&&a.pathname==="/"&&!a.username&&!a.password&&!a.search&&!a.hash};if(e.initialTicketLifetimeMs!==9e4||i$1.apiKey!=="pk_test_0000000000000000000000000000000000000000"||!t(o.controlPlane,"http:")||!t(o.gateway,"http:")||!e.irohTestRelayUrl||!t(e.irohTestRelayUrl,"https:"))throw new Error("Short initial tickets require the disposable local service lane")}let n=e.localBroadcast,s=n?a$1(n.keyNamespace):void 0;return i(i$1,{endpoints:o,testingAllowInsecureLoopback:true,platform:"web",...s?{deviceKeyProvider:s}:{},...n&&s?{broadcastHostFactory:async t=>{let[{BrowserManagedBroadcastHost:p},{loadBrowserWasmRuntimeModule:c}]=await Promise.all([import('./BrowserManagedBroadcastHost-6VGHQQMF.js'),import('./WasmBridge-3HYLCY5Y.js')]),a=c().then(async r=>(await r.initWasm(),r.start(),new r.WasmClient(t.apiKey))),y=await s.getOrCreate(`app_${t.apiKey.slice(-16)}`);return new p({resolve:async(r,l)=>({token:r,...await n.resolve(r,l),signBindingChallenge:async m=>b(await y.sign(m))}),loadWasm:()=>a})}}:{},...e.deviceId?{deviceIdProvider:async()=>e.deviceId}:{},...e.irohTestRelayUrl?{irohTestRelayUrl:e.irohTestRelayUrl}:{},runtimeFactory:async t=>{let{createWasmClient:p}=await import('./runtime/factories.js'),c$1=await p(t);if(e.initialTicketLifetimeMs!==void 0){let a=c$1.runtime,y=a.getTicketWithToken.bind(a);a.getTicketWithToken=async(r,l=0)=>{if(a.getTicketWithToken=y,!r.startsWith("v2:room:"))throw new Error("Short initial ticket requires room scope");let{irohTicket:m,tokenSuffix:u}=a$2(await y(r,l)),d$1=u&&d(m,u);if(!d$1||!d$1.t||d$1.s!==r||d$1.m!==l)throw new Error("Invalid initial service ticket");let f=Date.now()+9e4;return await a.registerToken({token:d$1.t,scope:r,maxConnections:l,expiresAtMs:f}),c(m,d$1.t,r,l,f)};}return c$1}})}export{R as OpenRTC,A as controlPlane};

package/dist/transport/index.d.ts

@@ -1,5 +1,5 @@
-import { j as ProtocolName, ax as RouteDescriptor, ay as PayloadCrypto, az as CryptoStreams } from '../Connection-BGVBMbWg.js';
-export { aA as CryptoBiStream, aB as RouteFamily, aC as RouteKind } from '../Connection-BGVBMbWg.js';
+import { j as ProtocolName, aA as RouteDescriptor, aB as PayloadCrypto, aC as CryptoStreams } from '../Connection-U3fEt8_4.js';
+export { aD as CryptoBiStream, aE as RouteFamily, aF as RouteKind } from '../Connection-U3fEt8_4.js';
 
 declare const TRANSPORT_LABELS: readonly ProtocolName[];
 declare function normalizeTransport(value: unknown): ProtocolName | undefined;

package/dist/{types-Cruu-MsF.d.ts → types-DvZvz4EL.d.ts}

@@ -1,5 +1,5 @@
-import { P as PeerNamespace, C as ChannelNamespace, D as DiagnosticsNamespace, a as DeviceNamespace, b as DiagnosticOperationEvent } from './coreClient-ByXs38IP.js';
-import { R as RoomArchitectureMode, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, C as ChannelDescriptor, S as ServiceErrorObservation, P as PlutoIrohConfiguration, g as PlutoRTCConfiguration, h as PlutoMoQConfiguration, i as RouteOptimization, j as ProtocolName } from './Connection-BGVBMbWg.js';
+import { P as PeerNamespace, C as ChannelNamespace, D as DiagnosticsNamespace, a as DeviceNamespace, b as DiagnosticOperationEvent } from './coreClient-AVGEwlhT.js';
+import { R as RoomArchitectureMode, b as RoomArchitectureSnapshot, c as RoomAuthorityAssignment, C as ChannelDescriptor, S as ServiceErrorObservation, P as PlutoIrohConfiguration, g as PlutoRTCConfiguration, h as PlutoMoQConfiguration, i as RouteOptimization, j as ProtocolName } from './Connection-U3fEt8_4.js';
 
 interface AuthProvider {
     /** Registered provider ID from the developer app capability manifest. */

package/native/darwin-arm64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "darwin",
   "arch": "arm64",
   "rustTarget": "aarch64-apple-darwin",
-  "sourceCommit": "a42eb60b973b88d09047fa9db8bb9d9f1ff29e80",
-  "sourceDigest": "2a289da0f6e7006211566a8ad9a6e794803785c599a323df04944972bc7e3517",
-  "binarySha256": "257acbe1b74c8801ebbb9301d31e2099f5b871ebbc11273c26a563aa3a617b32",
+  "sourceCommit": "6c0166a67198e24ecfe66fd073db316737b2beee",
+  "sourceDigest": "8c372e602fb32a1d0eb4b848b18a53d96ee251610b372abaf5669e00d7493af7",
+  "binarySha256": "39fb169f9bc2ff6e7aa5eb38493343c93601b8c7cd8dbcd4f493c36d9c736074",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "RcxuYiXYql3LBp2xciQr6I5HOrR3rii573zUi+uaiWBGaoALX+IvUEOEXSGE2bdBiTvur8Itqq4b7JKns299Bw=="
+  "signature": "wgk6OpLzNZqBuecu9p9aMIE3YV7F6wqMvX1Xr6HjBnQG1+/zWDkcQoOMCHLuh2PX40nw/AKhSQxtMYxzCaEkAw=="
 }

package/native/darwin-x64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "darwin",
   "arch": "x64",
   "rustTarget": "x86_64-apple-darwin",
-  "sourceCommit": "a42eb60b973b88d09047fa9db8bb9d9f1ff29e80",
-  "sourceDigest": "2a289da0f6e7006211566a8ad9a6e794803785c599a323df04944972bc7e3517",
-  "binarySha256": "d266b862aab35e3cbaacc61695f9c6d5d6a6226eb5d28c3de616bc69f5e7deea",
+  "sourceCommit": "6c0166a67198e24ecfe66fd073db316737b2beee",
+  "sourceDigest": "8c372e602fb32a1d0eb4b848b18a53d96ee251610b372abaf5669e00d7493af7",
+  "binarySha256": "45ff602853ae60c842330b46dad962f3dfacefa6e4d469ec02751bca6869cc6d",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "dPA0+L/NYYwKqoJ9it+M7+PF09NeulyhnOoxM7GfDsHfc+pGFU8s1lNy/3iVBsG/8xCWhyRolcD97fPkswV3DQ=="
+  "signature": "8TM3UoEke+fMY0t2RgaRQ1WX0oiJ2eXnyBN+nRuo30oIReN3z/iBRO5OCC2JIGlEQGLAkaCCcLv8InIy2MvZDg=="
 }

package/native/linux-x64/openrtc-node-host.manifest.json

@@ -4,9 +4,9 @@
   "platform": "linux",
   "arch": "x64",
   "rustTarget": "x86_64-unknown-linux-gnu",
-  "sourceCommit": "f10adfa753e025c1470bee60b361599820e0e46f",
-  "sourceDigest": "2a289da0f6e7006211566a8ad9a6e794803785c599a323df04944972bc7e3517",
-  "binarySha256": "54f777ba94fd78ee57182eca0d7164601ee58d96f66c5ea4c676f32da8f515cd",
+  "sourceCommit": "6c4afe9eb1f0f4181c95f2190d370fa7c29ccdb0",
+  "sourceDigest": "8c372e602fb32a1d0eb4b848b18a53d96ee251610b372abaf5669e00d7493af7",
+  "binarySha256": "11f2fbd128d6038ffb3a1ccb59b45bde3763890a65c09f0213b14d463cab191f",
   "protocol": {
     "lifecycleOwner": "rust-peer-session",
     "maxApplicationPayloadBytes": 65536,
@@ -16,5 +16,5 @@
   },
   "signingKeySha256": "0391c617f3df12611b419e129cace36fa792e73da03271649cbed9e9f9f155ef",
   "signatureAlgorithm": "ed25519",
-  "signature": "JAEy6pMmQKzCKy1qtKVsxFQZbk/VPh+KaHugSz96p+vNQriLcLXgkJ5S9Sepci2zR+2g3ceA7AdsvQnTgRQeCQ=="
+  "signature": "nsWY2smSGOD6I0oKN3eilemrCqQc3+g2BDYjUTIFNg3YYNI6u9yb91jcfO2FsAKFZxPxDbg9LUbvA9UZvHkQDg=="
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrtc",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "private": false,
   "type": "module",
   "sideEffects": false,

package/dist/chunk-2Q75GXGE.js

@@ -1,2 +0,0 @@
-import {b as b$2}from'./chunk-ZA44REGI.js';import {e,a}from'./chunk-L7N4T2PX.js';import {d,b as b$1,e as e$1}from'./chunk-72MN7BNQ.js';function b(s){return {irohRelay:s.irohRelay===true||s.irohRelay===void 0&&s.relay!==false,managedTurn:s.managedTurn===true}}var B=1440*6e4,w=class extends Error{constructor(r,n,a$1){super(r);this.status=n;this.reason=a$1;this.name="RTCError";let t=[502,503,504].includes(n),o=a$1==="device-reenrollment-auth-required",i=n===412&&a$1==="device-key-recovery-required";this.code=i?a.AUTH_DEVICE_KEY_RECOVERY_REQUIRED:o?"auth/device-reenrollment-required":t?"coordination/service-unavailable":n===429?"coordination/rate-limited":n===401?"auth/expired":n===403?"admission/denied":"internal/error",this.retryable=o||t,this.plane=i||o||n===401?"auth":t||n===429?"coordination":n===403?"admission":"internal";}};function K(s){return !(s instanceof w)||s.status!==403?false:s.reason==="device-certificate-stale"||s.reason==="device-certificate-revoked"?true:!s.reason&&s.message==="Device certificate is revoked or stale."}function C(s,e,r){return `openrtc:v2:device-certificate:${s}:${e}:${r}`}function P(s,e){return `openrtc:v2:device-session:${s}:${e}`}async function _(s,e,r){let n=new TextEncoder().encode(`openrtc:v2:session\0${s}\0${e}\0${r}`),a=new Uint8Array(await crypto.subtle.digest("SHA-256",n)),t="";for(let o of a)t+=String.fromCharCode(o);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function k(s){let e=s.replace(/-/g,"+").replace(/_/g,"/"),r=e.padEnd(Math.ceil(e.length/4)*4,"="),n=atob(r);return Uint8Array.from(n,a=>a.charCodeAt(0))}function f(s){let e="";for(let r of s)e+=String.fromCharCode(r);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}async function I(s,e,r,n,a){if(typeof s.token!="string"||typeof s.expiresAtMs!="number"||s.expiresAtMs<=Date.now()+B||!s.signingPublicJwk||s.signingPublicJwk.kty!=="OKP"||s.signingPublicJwk.crv!=="Ed25519"||typeof s.signingPublicJwk.x!="string")return null;let t=s.token.split(".");if(t.length!==3)return null;let o,i;try{o=JSON.parse(new TextDecoder().decode(k(t[0]))),i=b$2(s.token);}catch{return null}if(o.alg!=="EdDSA"||s.signingPublicJwk.kid&&o.kid!==s.signingPublicJwk.kid)return null;try{let y=await crypto.subtle.importKey("jwk",s.signingPublicJwk,{name:"Ed25519"},!1,["verify"]);if(!await crypto.subtle.verify({name:"Ed25519"},y,k(t[2]),new TextEncoder().encode(`${t[0]}.${t[1]}`)))return null}catch{return null}let c=typeof i.principalId=="string"?i.principalId:"",d=Number(i.iat),l=Number(i.exp);if(i.iss!=="openrtc"||i.aud!=="openrtc:v2:gateway-grant"||i.typ!=="device-certificate"||i.appTag!==e||!c||a!==void 0&&c!==a||typeof i.principalKey!="string"||i.principalKey.length===0||i.deviceId!==r||i.deviceKeyThumbprint!==n||typeof i.jti!="string"||i.jti.length===0||!Number.isSafeInteger(d)||!Number.isSafeInteger(l)||d>=l||l*1e3!==s.expiresAtMs)return null;let u=b(i);return {token:s.token,expiresAtMs:s.expiresAtMs,principalId:c,signingPublicJwk:s.signingPublicJwk,enrolled:false,...u}}async function J(s,e,r,n,a){try{let t=C(e,r,n),o=s.readSecureRecord?await s.readSecureRecord(e,t):globalThis.localStorage?.getItem(t);if(!o)return null;let i=JSON.parse(o),c=await I(i,e,n,a,r);return c?{token:c.token,expiresAtMs:c.expiresAtMs,principalId:r,signingPublicJwk:c.signingPublicJwk}:null}catch(t){if(s.readSecureRecord)throw t;return null}}async function G(s,e,r,n,a){try{let t=P(e,n),o=s.readSecureRecord?await s.readSecureRecord(r,t):globalThis.localStorage?.getItem(t);return o?await I(JSON.parse(o),r,n,a):null}catch(t){if(s.readSecureRecord)throw t;return null}}async function O(s,e,r,n,a){try{let t=C(e,r,n),o=JSON.stringify(a);s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function U(s,e,r,n,a){try{let t=P(r,n),o=JSON.stringify({token:a.token,expiresAtMs:a.expiresAtMs,principalId:a.principalId,signingPublicJwk:a.signingPublicJwk});s.writeSecureRecord?await s.writeSecureRecord(e,t,o):globalThis.localStorage?.setItem(t,o);}catch(t){if(s.writeSecureRecord)throw t}}async function A(s,e,r,n,a){try{let t=C(e,r,n);if(s.deleteSecureRecord?await s.deleteSecureRecord(e,t):globalThis.localStorage?.removeItem(t),a){let o=P(a,n);s.deleteSecureRecord?await s.deleteSecureRecord(e,o):globalThis.localStorage?.removeItem(o);}}catch(t){if(s.deleteSecureRecord)throw t}}function x(s){return `${s}_${crypto.randomUUID()}`}function $(s){if(s instanceof TypeError)return  true;if(!s||typeof s!="object")return  false;let e=Reflect.get(s,"name");return e==="TimeoutError"||e==="AbortError"}async function j(s,e){let r=new TextEncoder().encode(`${s}:${e}`);return [...new Uint8Array(await crypto.subtle.digest("SHA-256",r))].map(a=>a.toString(16).padStart(2,"0")).join("")}var M=class{constructor(e,r,n,a,t={},o){this.apiKey=e;this.endpoints=r;this.keyProvider=n;this.attestation=a;this.events=t;this.botVerification=o;this.keyPromise=null;this.authEpochs=new Map;this.appTag=`app_${e.slice(-16)}`;}authEpoch(e){let r=this.authEpochs.get(e);if(r)return r;let n={generation:0,devices:new Map};return this.authEpochs.set(e,n),e.subscribe&&(n.unsubscribe=e.subscribe(a=>{a?.type==="principal-changed"&&(n.generation+=1,n.devices.clear(),n.sessionKeyHash=void 0,this.events.onAuthEpochChanged?.(e));})),n}dispose(){for(let e of this.authEpochs.values())e.unsubscribe?.();this.authEpochs.clear();}key(){return this.keyPromise??(this.keyPromise=this.keyProvider.getOrCreate(this.appTag))}async deviceSigningPublicKey(){return (await this.key()).publicKeyJwk}async signDeviceBytes(e){return (await this.key()).sign(e)}async resolveBroadcastAccess(e,r){if(!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(e)||e.length>32768)throw new Error("Broadcast grant is invalid.");if(r&&r.byteLength!==32)throw new Error("Broadcast publisher verification key is invalid.");let n=await this.key(),a=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e)))),t=r?f(r):"",o=await n.proof((l,u)=>["openrtc:v2:broadcast-access",this.apiKey,a,t,l,u].join(":")),i=await this.post("/v2/broadcasts",{action:"access",grant:e,...t?{publicationVerifyingKey:t}:{},deviceProof:o});if(i.grant!==e)throw new Error("Broadcast access grant mismatch.");let c=k(i.issuerPublicKey);if(c.byteLength!==32)throw new Error("Broadcast issuer key is invalid.");let d=new URL(i.relay?.relayUrl);if(d.protocol!=="https:"||d.username||d.password)throw new Error("Broadcast relay URL is invalid.");if(typeof i.relay.token!="string"||!/^[A-Za-z0-9._-]{16,16384}$/.test(i.relay.token)||typeof i.relay.namespace!="string"||!/^[A-Za-z0-9._/-]{1,512}$/.test(i.relay.namespace))throw new Error("Broadcast relay allocation is invalid.");return {token:e,issuerPublicKey:c,signBindingChallenge:async l=>{if(!(l instanceof Uint8Array)||l.byteLength>2048)throw new Error("Broadcast binding challenge is invalid.");return k(await n.sign(l))},relay:{relayUrl:d.toString(),token:i.relay.token,namespace:i.relay.namespace}}}async manageBroadcast(e){let r=await this.deviceCertificate(e.auth,e.deviceId),n=e.grant??"",a=e.invite??"",t=e.create,o=e.invitation,i=t?f(t.publisher.verificationKey):o?.publicationVerificationKey?f(o.publicationVerificationKey):"",c=t?{maxPublishers:t.maxPublishers,maxSubscribers:t.maxSubscribers,maxBitrateBps:t.maxBitrateBps,maxDurationSeconds:t.maxDurationSeconds,maxEgressBytes:t.maxEgressBytes}:void 0,d=t?{bitrateBps:t.publisherBitrateBps,durationSeconds:t.maxDurationSeconds,reservedEgressBytes:t.reservedEgressBytes}:o?{role:o.role,sourceSlot:o.sourceSlot??"",bitrateBps:o.bitrateBps,durationSeconds:o.durationSeconds,reservedEgressBytes:o.reservedEgressBytes}:void 0,l=f(new Uint8Array(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(JSON.stringify({action:e.action,grant:n,invite:a,publicationKey:i,sourceSlot:t?.sourceSlot??o?.sourceSlot??"host-a",limits:c,reservation:d}))))),y=await(await this.key()).proof((g,v)=>["openrtc:v2:broadcast-manage",r.source.token,e.action,l,g,v].join(":")),p=await this.post("/v2/broadcasts",{action:e.action,deviceId:e.deviceId,deviceCertificate:r.source.token,deviceProof:y,...n?{grant:n}:{},...a?{invite:a}:{},...i?{publicationVerifyingKey:i}:{},...t?{sourceSlot:t.sourceSlot??"host-a",limits:c,reservation:d}:{},...o?{invitation:{...d,publicationVerifyingKey:i}}:{}});if(e.action==="create"||e.action==="renew"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast grant is invalid.");return p.grant}if(e.action==="invite"){if(typeof p.invite!="string"||!/^obi1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.invite))throw new Error("Managed broadcast invitation is invalid.");return p.invite}if(e.action==="accept"){if(typeof p.grant!="string"||!/^orb1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(p.grant))throw new Error("Managed broadcast accepted grant is invalid.");return p.grant}}async post(e$2,r){let n=x("request"),a=JSON.stringify({apiKey:this.apiKey,...r}),t=null;for(let o=0;o<2;o+=1)try{let i=await fetch(`${this.endpoints.controlPlane}${e$2}`,{method:"POST",headers:{"Content-Type":"application/json","X-OpenRTC-Idempotency-Key":n},body:a,signal:AbortSignal.timeout(15e3)});if(i.ok)return i.json();let c=`OpenRTC request failed (${i.status}).`,d$1,l;try{let y=await i.json();typeof y.error=="string"&&(c=y.error.slice(0,256)),typeof y.reason=="string"&&/^[a-z0-9-]{1,80}$/.test(y.reason)&&(d$1=y.reason),(d(y.code)||b$1(y.code))&&(l=e({...e$1(y),code:y.code,message:c,retryable:y.retryable}));}catch{}let u=l?Object.assign(l,{status:i.status,reason:d$1}):new w(c,i.status,d$1);if(t=u,!l&&o===0&&[502,503,504].includes(i.status))continue;throw u}catch(i){if(t=i,o===0&&$(i))continue;throw i}throw t instanceof Error?t:new Error("OpenRTC request failed.")}async capability(e,r,n,a=false,t,o){let i=e==="space"?await j(this.apiKey,r):r,d=await(await this.key()).proof((p,g)=>["openrtc:v2:capability",this.apiKey,e,i,p,g].join(":")),l=this.botVerification?await this.botVerification.getToken({action:"openrtc_capability",apiKey:this.apiKey}):void 0,u=await this.post("/v2/capabilities",{avenue:{kind:e,id:i},deviceProof:d,...n?{maxPeers:n}:{},...a?{advancedFanout:true}:{},...e==="room"&&t?{architecture:t}:{},...e==="room"&&o?{roomDelivery:o}:{},...l?{turnstileToken:l}:{}}),y={type:"capability",token:u.capability,avenue:e==="ticket"?{kind:"session",id:i}:u.avenue,expiresAtMs:u.expiresAt*1e3,...b(u)};return y.renew=()=>this.capability(e,r,n,a,t,o),y}async deviceCertificate(e,r,n,a,t){if(this.keyProvider.persistence==="session")throw new Error("[OpenRTC] Durable browser device enrollment requires trust.browserPersistence: persistent. Select it explicitly before creating the client; session keys cannot enroll retained devices.");let o=this.authEpoch(e),i=o.devices.get(r)??{};if(o.devices.set(r,i),t&&i.current&&i.current.token!==t.token)return this.deviceCertificateResult(e,r,n,a,{...i.current,enrolled:false});if(!t&&i.current&&i.current.expiresAtMs>Date.now()+B)return this.deviceCertificateResult(e,r,n,a,{...i.current,enrolled:false});if(!i.inFlight){let d=o.generation;t&&(i.current=void 0,i.recoverRevokedEnrollment=true);let l=t?A(this.keyProvider,this.appTag,t.principalId,r,o.sessionKeyHash).then(()=>this.enrollAuthenticatedDevice(e,r,o.sessionKeyHash,a,true)):this.resolveAuthenticatedDevice(e,r,o,a,i.recoverRevokedEnrollment===true);i.inFlight=l.then(u=>{if(o.generation!==d)throw new Error("The OpenRTC authentication identity changed during enrollment.");return i.recoverRevokedEnrollment=false,i.current=u,u}).finally(()=>{i.inFlight=void 0;});}let c=await i.inFlight;return this.deviceCertificateResult(e,r,n,a,c)}async resolveAuthenticatedDevice(e,r,n,a,t=false){let o=await this.key();if(e.getSessionKey){let i=await e.getSessionKey();if(!i)throw new Error("The OpenRTC auth provider has no active principal.");let c=await _(this.appTag,o.thumbprint,i);n.sessionKeyHash=c;let d=await G(this.keyProvider,c,this.appTag,r,o.thumbprint);if(d)return d}return this.enrollAuthenticatedDevice(e,r,n.sessionKeyHash,a,t)}deviceCertificateResult(e,r,n,a,t){let o={type:"device-certificate",token:t.token,avenue:n??{kind:"user",id:t.principalId},expiresAtMs:t.expiresAtMs,irohRelay:t.irohRelay,managedTurn:t.managedTurn};return o.renew=async()=>(await this.deviceCertificate(e,r,n,a)).source,o.recoverRejectedCertificate=async()=>(await this.deviceCertificate(e,r,n,a,t)).source,{principalId:t.principalId,source:o,enrolled:t.enrolled}}async enrollAuthenticatedDevice(e,r,n,a,t=false){let o=async(g,v)=>{let m=await e.getAssertion({audience:"https://api.openrtc.app/v2/assertions/exchange",forceRefresh:g,deviceId:r,...{}});if(!m)throw new Error("The OpenRTC auth provider returned no assertion.");return this.post("/v2/assertions/exchange",{assertion:m,deviceId:r,...e.providerId?{providerId:e.providerId}:{}})},i;try{i=await o(!1);}catch(g){if(!(g instanceof w)||g.status!==401)throw g;i=await o(true);}let c=await this.key(),d=await J(this.keyProvider,this.appTag,i.principalId,r,c.thumbprint);if(d)return {...d,principalId:i.principalId,enrolled:false,...b(i)};let{enrollDevice:l}=await import('./deviceEnrollment-OFC6DSZP.js'),u=await l({apiKey:this.apiKey,appTag:this.appTag,auth:e,attestation:this.attestation,deviceId:r,identity:i,key:c,profile:a,recoverRevokedEnrollment:t||i.deviceRecoveryAuthorized===true,post:(g,v)=>this.post(g,v)});i=u.identity;let y=u.enrollment,p={principalId:i.principalId,token:y.deviceCertificate,expiresAtMs:y.expiresAt*1e3,signingPublicJwk:y.signingPublicJwk,enrolled:true,...b(i)};return await O(this.keyProvider,this.appTag,i.principalId,r,{token:p.token,expiresAtMs:p.expiresAtMs,signingPublicJwk:p.signingPublicJwk}),n&&await U(this.keyProvider,this.appTag,n,r,p),p}async listEnrolledDevices(e,r){let n=await this.deviceCertificate(e,r);return (await this.deviceManagement(n.source,r,"list")).devices??[]}async revokeDevice(e,r,n){let a=await this.deviceCertificate(e,r);if(await this.deviceManagement(a.source,r,"revoke",n),n===r){let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,r,t.sessionKeyHash),t.devices.delete(r),await this.deleteDeviceKey();}}async revokeAllDevices(e,r,n){let a=await this.deviceCertificate(e,r);await this.deviceManagement(a.source,r,"revoke-all",void 0,n);let t=this.authEpoch(e);await A(this.keyProvider,this.appTag,a.principalId,r,t.sessionKeyHash),t.devices.delete(r),n?await this.deviceCertificate(e,r):(t.devices.clear(),await this.deleteDeviceKey());}async deleteDeviceKey(){this.keyPromise=null,await this.keyProvider.delete?.(this.appTag);}async deviceManagement(e,r,n,a,t=false){let{manageDevice:o}=await import('./deviceManagement-SUMBRXXC.js');return await o({source:e,currentDeviceId:r,action:n,targetDeviceId:a,exceptCurrent:t,key:()=>this.key(),post:c=>this.post("/v2/devices/manage",c),isStale:K})}async durableRoomMembership(e,r,n){if(e.type!=="device-certificate")throw new Error("Durable rooms require a device certificate.");let a=b$2(e.token),t=String(a.jti??""),i=await(await this.key()).proof((c,d)=>["openrtc:v2:room-membership",t,n,r,c,d].join(":"));await this.post("/v2/rooms/memberships",{action:n,roomId:r,deviceCertificate:e.token,deviceProof:i});}grantProvider(e,r={}){let n=Promise.resolve(),a=e;return t=>{let o=n.then(async()=>{let i=false;a.expiresAtMs<=Date.now()+3e5&&a.renew&&(a=await a.renew(),i=true);let c=async l=>{let u=b$2(l.token),y=String(u.jti??""),g=await(await this.key()).proof((v,m)=>["openrtc:v2:gateway-grant",y,t.avenue.kind,t.avenue.id,t.runtimeInstanceId,v,m].join(":"));return this.post("/v2/gateway/grants",{credentialType:l.type,credential:l.token,avenue:t.avenue,runtimeInstanceId:t.runtimeInstanceId,ticketFingerprint:t.ticketFingerprint,deviceProof:g,...t.refreshGrant?{refreshGrant:t.refreshGrant}:{},...r.maxPeers?{maxPeers:r.maxPeers}:{},...r.features?{features:r.features}:{},...t.avenue.kind==="room"&&r.architecture?{architecture:r.architecture}:{},...t.avenue.kind==="room"&&r.roomDelivery?{roomDelivery:r.roomDelivery}:{},...l.type==="device-certificate"&&r.deviceProfile?{deviceProfile:r.deviceProfile}:{}})},d;try{d=await c(a);}catch(l){if(!K(l))throw l;let u=await a.recoverRejectedCertificate?.();if(!u)throw l;a=u,i=true,d=await c(a);}return i&&await r.onSourceRenewed?.({token:a.token,expiresAtMs:a.expiresAtMs}),d});return n=o.then(()=>{},()=>{}),o}}turnProvider(e){let r=x("relay"),n=null,a=null;return async()=>{if(n&&n.expiresAtMs>Date.now()+5*6e4)return n;if(a)return a;let t=(async()=>{let o=e(),i=b$2(o.token),c=String(i.jti??""),l=await(await this.key()).proof((y,p)=>["openrtc:v2:relay-turn",c,r,y,p].join(":")),u=await this.post("/v2/relay/turn",{credentialType:o.type,credential:o.token,sessionId:r,deviceProof:l});return n=u,u})();a=t;try{return await t}finally{a===t&&(a=null);}}}};
-export{M as a};

package/dist/chunk-GMPEZXPD.js

@@ -1,2 +0,0 @@
-import d from'tweetnacl';function c(t){let r=t instanceof Uint8Array?t:new Uint8Array(t),e="";for(let n of r)e+=String.fromCharCode(n);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function g(t){let r=JSON.stringify({crv:t.crv,kty:t.kty,x:t.x});return c(await crypto.subtle.digest("SHA-256",new TextEncoder().encode(r)))}function p(){return c(crypto.getRandomValues(new Uint8Array(24)).buffer)}async function y(){return typeof indexedDB>"u"?null:new Promise((t,r)=>{let e=indexedDB.open("openrtc-v2-device-keys",1);e.onupgradeneeded=()=>{e.result.objectStoreNames.contains("keys")||e.result.createObjectStore("keys");},e.onsuccess=()=>t(e.result),e.onerror=()=>r(e.error);})}async function w(t){let r=await y().catch(()=>null);if(!r)throw new Error("[OpenRTC] Persistent browser identity storage is unavailable.");try{return await new Promise((e,n)=>{let s=r.transaction("keys","readonly").objectStore("keys").get(t);s.onsuccess=()=>e(s.result??null),s.onerror=()=>n(s.error);})}finally{r.close();}}async function K(t,r){let e=await y().catch(()=>null);if(!e)throw new Error("[OpenRTC] Persistent browser identity storage is unavailable.");try{return await new Promise((n,s)=>{let o=e.transaction("keys","readwrite"),i=r;o.oncomplete=()=>n(i),o.onabort=()=>s(o.error??new Error("[OpenRTC] Persistent browser identity storage transaction aborted."));let u=o.objectStore("keys"),a=u.get(t);a.onerror=()=>s(a.error),a.onsuccess=()=>{if(a.result!==void 0&&a.result!==null){i=a.result;return}let l=u.put(r,t);l.onerror=()=>s(l.error);};})}finally{e.close();}}async function P(t){let r=await y().catch(()=>null);if(r)try{await new Promise((e,n)=>{let s=r.transaction("keys","readwrite").objectStore("keys").delete(t);s.onsuccess=()=>e(),s.onerror=()=>n(s.error);});}finally{r.close();}}async function b(t){let r=await w(t);if(r)return r;let e=await crypto.subtle.generateKey({name:"Ed25519"},false,["sign","verify"]);return K(t,e)}async function f(t){let r=await crypto.subtle.exportKey("jwk",t.publicKey),e=await g(r);return {publicKeyJwk:r,thumbprint:e,async sign(n){return c(await crypto.subtle.sign({name:"Ed25519"},t.privateKey,n))},async proof(n){let s=p(),o=Math.floor(Date.now()/1e3),i=await crypto.subtle.sign({name:"Ed25519"},t.privateKey,new TextEncoder().encode(n(s,o)));return {publicKeyJwk:r,signature:c(i),nonce:s,issuedAt:o}}}}async function m(){return f(await crypto.subtle.generateKey({name:"Ed25519"},false,["sign","verify"]))}async function v(){try{return await m()}catch(s){if(!(s instanceof Error)||s.name!=="NotSupportedError")throw s}let t=d.sign.keyPair(),r={kty:"OKP",crv:"Ed25519",x:c(t.publicKey)},e=await g(r),n=async s=>c(d.sign.detached(s,t.secretKey));return {publicKeyJwk:r,thumbprint:e,sign:n,async proof(s){let o=p(),i=Math.floor(Date.now()/1e3);return {publicKeyJwk:r,signature:await n(new TextEncoder().encode(s(o,i))),nonce:o,issuedAt:i}}}}var k={persistence:"persistent",async getOrCreate(t){return f(await b(t))},delete:P};function x(){let t=new Map,r=new Map;return {persistence:"session",getOrCreate(e){let n=t.get(e);return n||(n=v(),t.set(e,n)),n},async delete(e){t.delete(e),r.delete(e);},async readSecureRecord(e,n){return r.get(e)?.get(n)??null},async writeSecureRecord(e,n,s){let o=r.get(e);o||(o=new Map,r.set(e,o)),o.set(n,s);},async deleteSecureRecord(e,n){r.get(e)?.delete(n);}}}
-export{g as a,m as b,k as c,x as d};

package/dist/chunk-IAYQJZQQ.js

@@ -1 +0,0 @@
-import {c}from'./chunk-GMPEZXPD.js';function s(t){let o=e=>`${e}:${t}`;return {getOrCreate:e=>c.getOrCreate(o(e)),delete:async e=>{await c.delete?.(o(e));},readSecureRecord:(e,c$1)=>c.readSecureRecord?.(o(e),c$1)??Promise.resolve(null),writeSecureRecord:(e,c$1,d)=>c.writeSecureRecord?.(o(e),c$1,d)??Promise.resolve(),deleteSecureRecord:(e,c$1)=>c.deleteSecureRecord?.(o(e),c$1)??Promise.resolve()}}export{s as a};

package/dist/chunk-L4HWDDXL.js

@@ -1,2 +0,0 @@
-import {d}from'./chunk-OWKAJPOI.js';import {a as a$1,d as d$1,c}from'./chunk-2GX6GB6L.js';var P=new Set;function p(e,t){P.has(e)||(P.add(e),console.warn(t));}function T(e){return /^pk_(live|test)_[0-9a-f]{40}$/.test(e)}async function F(e,t){let r=`${e}:${t}`,o=new TextEncoder().encode(r),s=await crypto.subtle.digest("SHA-256",o);return Array.from(new Uint8Array(s)).map(R=>R.toString(16).padStart(2,"0")).join("")}function u(e){let t=typeof e.apiKey=="string"?e.apiKey.trim():"";if(t)return T(t)||p(`invalid-api-key:${t.slice(0,10)}`,"[pluto-rtc] The provided `apiKey` does not match the expected format (pk_live_... or pk_test_...). Create an app at https://api.openrtc.app/developer."),`app_${t.slice(-16)}`;throw new Error("[openrtc] `apiKey` is required. Create an app at https://api.openrtc.app/developer.")}function a(e){return e.authMode?e.authMode:("apiKey"in e&&typeof e.apiKey=="string"&&e.apiKey.trim().length>0&&typeof(e.spaceKey??e.space)=="string"&&(e.spaceKey??e.space).trim().length>0||p("default-auth-mode","[pluto-rtc] `authMode` is not set; defaulting to `anonymous` for compatibility."),"anonymous")}function K(e){let t=typeof e.projectId=="string"?e.projectId.trim():"";return t||(p("default-project-id","[pluto-rtc] `projectId` is not set; defaulting to the built-in PlutoRTC Firebase project."),i)}function v(e){return e.trim().replace(/[^a-zA-Z0-9._-]+/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,"")}function j(e){let t="storagePrefix"in e&&typeof e.storagePrefix=="string"?v(e.storagePrefix):"";return t||v(u(e))||"default"}var x={devicesPerUser:100,maxRooms:1e4,maxMembersPerRoom:50,maxPersonalDevices:25e3},G=x;var M=[{urls:"stun:stun.l.google.com:19302"},{urls:"stun:stun.cloudflare.com:3478"}],f={iceServers:M};var A=/^[A-Za-z0-9._-]+$/,D="[redacted]";function I(e){let t;try{t=new URL(e);}catch{throw new Error("[OpenRTC] transports.moq.relayUrl must be a valid HTTPS URL.")}if(t.protocol!=="https:")throw new Error("[OpenRTC] transports.moq.relayUrl must use HTTPS/WebTransport.");if(t.hash)throw new Error("[OpenRTC] transports.moq.relayUrl must not contain a fragment.");if(t.searchParams.has("jwt"))throw new Error("[OpenRTC] transports.moq.relayUrl must not contain a jwt query parameter; use transports.moq.accessToken.");return t}function m(e){return I(e.trim()).toString()}function Q(e,t){let r=I(e.trim());if(t!==void 0){let n=t.trim();if(!n)throw new Error("[OpenRTC] transports.moq.accessToken must not be empty when provided.");if(new TextEncoder().encode(n).byteLength>16384)throw new Error("[OpenRTC] transports.moq.accessToken exceeds the maximum supported size.");if(!A.test(n))throw new Error("[OpenRTC] transports.moq.accessToken must be a URL-safe JWT.");r.searchParams.append("jwt",n);}return r.toString()}function z(e,t){let r=e instanceof Error?`${e.name}: ${e.message}`:String(e),n=t?.trim();return n?r.split(n).join(D):r}var h=[...d];function g(e){let t=e.spaceKey??e.space;return {...e,...t!==void 0?{spaceKey:t}:{}}}function S(e){return {...e,iceServers:e.iceServers?e.iceServers.map(t=>({...t})):e.iceServers}}function O(e){return {...e}}function w(e){return {...e}}function k(e){if(e)return {iroh:typeof e.iroh=="object"?w(e.iroh):e.iroh,webrtc:typeof e.webrtc=="object"?S(e.webrtc):e.webrtc,ble:typeof e.ble=="object"?{...e.ble}:e.ble,moq:typeof e.moq=="object"?O(e.moq):e.moq,privacy:e.privacy,optimizeFor:e.optimizeFor,priority:a$1(e.priority)}}function N(e){if(e.strictMode&&!e.transports&&(e.transports={iroh:{relayOnly:true}}),!!e.transports){if(e.transports.webrtc===true?e.transports.webrtc=S(f):e.transports.webrtc===false&&(e.transports.webrtc=void 0),e.transports.moq===true)throw new Error("[OpenRTC] transports.moq=true is ambiguous because no anonymous MoQ relay is available; provide transports.moq.relayUrl explicitly.");if(e.transports.moq===false)e.transports.moq=void 0;else if(e.transports.moq&&typeof e.transports.moq=="object"){let t=e.transports.moq,r=t.relayUrl?.trim(),n=t.accessToken;if(n!==void 0&&!n.trim())throw new Error("[OpenRTC] transports.moq.accessToken must not be empty when provided.");e.transports.moq={...t,...r?{relayUrl:m(r)}:{},...n!==void 0?{accessToken:n.trim()}:{}};}if(e.transports.iroh===true?e.transports.iroh={}:e.transports.iroh===false&&(e.transports.iroh=void 0),e.transports.privacy==="relay-only"){let t=e.transports.iroh&&typeof e.transports.iroh=="object"?e.transports.iroh:{};e.transports.iroh={...t,relayOnly:true,localDiscovery:false,localDiscoveryMode:void 0},e.transports.ble=void 0;let r=e.transports.webrtc;r&&typeof r=="object"&&(e.transports.webrtc={...r,privacyMode:true,lanMode:false,iceServers:c(r.iceServers)??[],iceTransportPolicy:"relay"}),e.transports.priority=d$1(e.transports.priority,!!e.transports.webrtc);}}}function E(e){if(!e.strictMode||!e.transports)return;let t=e.transports.iroh&&typeof e.transports.iroh=="object"?e.transports.iroh:{};e.transports.iroh={...t,relayOnly:true,relayTransportPolicy:t.relayTransportPolicy??"websocketRequired",localDiscovery:false,localDiscoveryMode:void 0},e.transports.privacy="relay-only",e.transports.ble=void 0;let r=e.transports.webrtc;r&&typeof r=="object"&&(e.transports.webrtc={...r,privacyMode:true,lanMode:false,iceServers:c(r.iceServers)??[],iceTransportPolicy:"relay"});let n=e.transports.moq;if(n&&typeof n=="object"){let o=n.relayUrl?.trim();if(!o)throw new Error("[OpenRTC] strictMode requires an explicit transports.moq.relayUrl.");e.transports.moq={...n,relayUrl:m(o)};}}function Z(e){let t=g(e),r=u(t),n=a(t),o={strictMode:false,disableIrohFallback:false,transportPriority:[...h],...t,authMode:n,transports:k(t.transports)};N(o),E(o),o.transportPriority=a$1(t.transportPriority??o.transports?.priority)??[...h],(o.strictMode||o.transports?.privacy==="relay-only")&&(o.transportPriority=d$1(t.transportPriority??o.transports?.priority,!!o.transports?.webrtc));let s=C(o),y=(o.discoveryMode??"space")==="space"?"client-open":"client-auth";return {appTag:r,authMode:n,configuredPersistenceMode:s,options:o,roomCreationMode:y}}function C(e){let t=e.transports?.iroh;return e.endpointIdPersistence??e.nodeIdPersistence??(typeof t=="object"?t.persistenceMode:void 0)??"ephemeral"}function ee(e){return "options"in e&&"configuredPersistenceMode"in e?{apiKey:e.options.apiKey,authMode:a(e.options),projectId:e.options.projectId,storagePrefix:e.options.storagePrefix,nodeIdPersistence:e.configuredPersistenceMode}:{apiKey:e.apiKey,authMode:a(e),projectId:e.projectId,storagePrefix:e.storagePrefix,nodeIdPersistence:C(e)}}function te(e,t){t&&(e.transports={...e.transports||{},...t});}var i="pluto-rtc-prod",U="https://api.openrtc.app",_="https://gateway.openrtc.app";function oe(e){let t=g(e),n=(typeof t.projectId=="string"&&t.projectId.trim()?t.projectId.trim():void 0)??i,o=n===i;return {...t,projectId:n,coordinationGateway:t.coordinationGateway??(o?{endpoint:_,controlPlaneEndpoint:U,environment:"production"}:void 0)}}
-export{oe as a,F as b,u as c,a as d,K as e,j as f,G as g,M as h,f as i,Q as j,z as k,g as l,Z as m,ee as n,te as o};

package/dist/chunk-LVLU4YQY.js

@@ -1,2 +0,0 @@
-import {j,d as d$1,c}from'./chunk-5LNRJE6L.js';var E=/^[A-Za-z0-9_.:@-]+$/,P=/^[A-Za-z0-9_-]{43}$/,C=/^[A-Za-z0-9_.:@-]+$/,k=/^[A-Za-z0-9._-]+$/,x=120*6e4,A=new TextEncoder;function d(r,e,t=160){let n=r.trim();if(!n||n.length>t||!E.test(n))throw new TypeError(`[OpenRTC] ${e} is invalid.`);return n}function h(r,e,t=Number.MAX_SAFE_INTEGER){if(!Number.isSafeInteger(r)||r<1||r>t)throw new RangeError(`[OpenRTC] ${e} must be a positive safe integer.`);return r}function K(r){let e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}async function g(r,e){let t=await r.publicJwk();if(t.kty!=="OKP"||t.crv!=="Ed25519"||typeof t.x!="string"||!P.test(t.x)||t.d!==void 0)throw new TypeError(`[OpenRTC] ${e} must return an Ed25519 public JWK.`);return {kty:"OKP",crv:"Ed25519",x:t.x}}async function y(r,e,t){let n=await r.sign(e);if(!(n instanceof Uint8Array)||n.byteLength!==64)throw new TypeError(`[OpenRTC] ${t} returned an invalid Ed25519 signature.`);return K(n)}function T(r){if(!/^pk_(?:live|test)_[A-Za-z0-9]+$/.test(r))throw new TypeError("[OpenRTC] apiKey is invalid.");return `app_${r.slice(-16)}`}function u(r){return r!==null&&typeof r=="object"&&!Array.isArray(r)?r:null}function v(r,e,t,n){if(typeof r!="string"||r.length<1||r.length>t||r!==r.trim()||n&&!n.test(r))throw new Error(`[OpenRTC] authority service grant ${e} is invalid.`);return r}function O(r){let e=v(r,"gatewayUrl",2048),t;try{t=new URL(e);}catch{throw new Error("[OpenRTC] authority service grant gatewayUrl is invalid.")}let n=t.protocol==="http:"&&["127.0.0.1","localhost","::1"].includes(t.hostname.toLowerCase());if(t.protocol!=="https:"&&!n||t.username||t.password||t.search||t.hash)throw new Error("[OpenRTC] authority service grant gatewayUrl is invalid.");return e}function N(r,e){let t=u(r),n=u(t?.avenue),i=u(t?.roomAuthority),a=u(i?.assignmentPublicKeyJwk),c=Date.now(),o=t?.expiresAtMs,s=t?.maxPeers;if(!t||t.protocolVersion!==2||t.architecture!=="authority"||n?.kind!=="room"||n.id!==e.roomId||i?.serviceId!==e.serviceId||i.generation!==e.generation||!Array.isArray(i.shardIds)||i.shardIds.length!==e.shardIds.length||i.shardIds.some((m,l)=>m!==e.shardIds[l])||a?.kty!=="OKP"||a.crv!=="Ed25519"||a.x!==e.assignmentPublicKeyX||!Number.isSafeInteger(o)||o<=c||o>c+x||!Number.isSafeInteger(s)||s<1||s>e.maxPeers)throw new Error("[OpenRTC] authority service grant response is inconsistent.");return {protocolVersion:2,gatewayUrl:O(t.gatewayUrl),routeKey:v(t.routeKey,"routeKey",256,C),token:v(t.token,"token",24e3,k),expiresAtMs:o,avenue:{kind:"room",id:e.roomId},maxPeers:s,architecture:"authority",roomAuthority:{serviceId:e.serviceId,generation:e.generation,shardIds:[...e.shardIds],assignmentPublicKeyJwk:{kty:"OKP",crv:"Ed25519",x:e.assignmentPublicKeyX}}}}var p=class{constructor(e){if(this.apiKey=e.apiKey,this.applicationTag=T(e.apiKey),typeof e.grantIssuer!="function")throw new TypeError("[OpenRTC] ServiceNode requires a browser-safe grantIssuer.");if(this.grantIssuer=e.grantIssuer,this.serviceId=d(e.serviceId,"serviceId",80),this.generation=h(e.generation,"generation"),this.shardIds=[...new Set(e.shardIds.map(t=>d(t,"shardId",80)))].sort(),this.shardIds.length<1||this.shardIds.length>64||this.shardIds.length!==e.shardIds.length)throw new RangeError("[OpenRTC] shardIds must contain 1..64 unique identifiers.");this.deviceId=d(e.deviceId,"deviceId"),this.deviceSigner=e.deviceSigner,this.assignmentSigner=e.assignmentSigner;}async requestGrant(e){let t=d(e.roomId,"roomId"),n=d(e.runtimeInstanceId,"runtimeInstanceId");if(!P.test(e.ticketFingerprint))throw new TypeError("[OpenRTC] ticketFingerprint is invalid.");e.maxPeers!==void 0&&h(e.maxPeers,"maxPeers",50);let i=await g(this.assignmentSigner,"assignmentSigner.publicJwk()"),a=await g(this.deviceSigner,"deviceSigner.publicJwk()"),c=crypto.randomUUID().replace(/-/g,""),o=Math.floor(Date.now()/1e3),s=["openrtc:v2:authority-service-grant",this.applicationTag,t,this.serviceId,String(this.generation),this.shardIds.join(","),i.x,n,c,o].join(":"),m={avenue:{kind:"room",id:t},serviceId:this.serviceId,generation:this.generation,shardIds:this.shardIds,assignmentPublicKeyJwk:i,deviceId:this.deviceId,runtimeInstanceId:n,ticketFingerprint:e.ticketFingerprint,deviceProof:{publicKeyJwk:a,nonce:c,issuedAt:o,signature:await y(this.deviceSigner,A.encode(s),"deviceSigner.sign()")},...e.maxPeers===void 0?{}:{maxPeers:e.maxPeers},...e.refreshGrant?{refreshGrant:e.refreshGrant}:{},features:e.features??{}},l=`authority_${crypto.randomUUID().replace(/-/g,"")}`,R=await this.grantIssuer({apiKey:this.apiKey,idempotencyKey:l,body:m});return N(R,{roomId:t,serviceId:this.serviceId,generation:this.generation,shardIds:this.shardIds,assignmentPublicKeyX:i.x,maxPeers:e.maxPeers??50})}async devicePublicKey(){return g(this.deviceSigner,"deviceSigner.publicJwk()")}async assignmentPublicKey(){return g(this.assignmentSigner,"assignmentSigner.publicJwk()")}async signDeviceBytes(e){return y(this.deviceSigner,e,"deviceSigner.sign()")}async signAssignment(e){let t=e.ttlMs??6e4;h(t,"ttlMs",2*6e4);let n=d(e.shardId,"shardId",80);if(!this.shardIds.includes(n))throw new RangeError("[OpenRTC] assignment shard is not owned by this service.");let i=e.priorityDeviceIds??[],a=e.relevantEntityIds??[];if(i.length>8||a.length>32)throw new RangeError("[OpenRTC] assignment exceeds the 8-edge or 32-entity bound.");let c=Date.now(),o={policyVersion:"room-authority-assignment-v1",serviceId:this.serviceId,generation:this.generation,revision:h(e.revision,"revision"),subjectDeviceId:d(e.subjectDeviceId,"subjectDeviceId"),shardId:n,priorityDeviceIds:i.map(s=>d(s,"priorityDeviceId")),relevantEntityIds:a.map(s=>d(s,"relevantEntityId")),issuedAtMs:c,expiresAtMs:c+t};if(new Set(o.priorityDeviceIds).size!==o.priorityDeviceIds.length||new Set(o.relevantEntityIds).size!==o.relevantEntityIds.length)throw new RangeError("[OpenRTC] assignment identifiers must be unique.");return {assignment:o,signature:await y(this.assignmentSigner,A.encode(JSON.stringify(o)),"assignmentSigner.sign()")}}},I=class{constructor(e,t,n){this.room=e;this.authority=t;this.onClosed=n;this.releaseRuntimeAlias=d$1(this,e);}get kind(){return this.room.kind}get id(){return this.room.id}get peers(){return this.room.peers}get channels(){return this.room.channels}get diagnostics(){return this.room.diagnostics}get closed(){return this.room.closed}get membership(){return this.room.membership}get members(){return this.room.members}state(e){return this.room.state(e)}channel(e){return this.room.channel(e)}onConnection(e){return this.room.onConnection(e)}architecture(){return this.room.architecture()}onArchitectureChanged(e){return this.room.onArchitectureChanged(e)}authorityAssignment(){return this.room.authorityAssignment()}onAuthorityAssignmentChanged(e){return this.room.onAuthorityAssignmentChanged(e)}leave(){return this.retire(()=>this.room.leave())}close(){return this.retire(()=>this.room.close())}async publishAssignment(e){let t=await this.authority.signAssignment(e);return await c(this.room).advanced.runtime.publishAuthorityAssignment(t),t.assignment}retire(e){return this.retirement??(this.retirement=e().finally(()=>{this.releaseRuntimeAlias(),this.onClosed();}))}},S=class{constructor(e){this.options=e;this.rooms=new Map;this.connectionListeners=new Set;this.connectionCleanups=new Map;this.closed=false;if("secretKey"in e)throw new TypeError("[OpenRTC] ServiceNode never accepts secretKey; delegate short-lived grants.");this.authority=new p(e);}listen(e){if(this.closed)throw new Error("[OpenRTC] ServiceNode is closed.");let t=d(e,"roomId"),n=this.rooms.get(t);if(n)return n.promise;let i={};return i.promise=this.openRoom(t,()=>this.evictRoom(t,i)).catch(a=>{throw this.evictRoom(t,i),a}),this.rooms.set(t,i),i.promise}onConnection(e){if(this.connectionListeners.add(e),this.connectionListeners.size===1)for(let[t,n]of this.rooms)n.promise.then(i=>this.attachConnectionListener(t,i),()=>{});return ()=>{if(this.connectionListeners.delete(e),this.connectionListeners.size===0){for(let t of this.connectionCleanups.values())t();this.connectionCleanups.clear();}}}async close(){if(this.closed)return;this.closed=true;for(let t of this.connectionCleanups.values())t();this.connectionCleanups.clear();let e=await Promise.allSettled([...this.rooms.values()].map(t=>t.promise));await Promise.all(e.flatMap(t=>t.status==="fulfilled"?[t.value.close()]:[])),this.rooms.clear(),this.connectionListeners.clear();}async openRoom(e,t){let n=await this.options.client.devices.localId();if(n!==this.options.deviceId)throw new Error("[OpenRTC] ServiceNode deviceId must match the client installation.");let[i,a]=await Promise.all([this.authority.devicePublicKey(),this.authority.assignmentPublicKey()]),c=await j(this.options.client,{roomId:e,serviceId:this.options.serviceId,generation:this.options.generation,shardIds:this.options.shardIds,deviceId:n,maxPeers:this.options.maxPeers,irohRelay:this.options.irohRelay!==false,devicePublicKeyX:i.x,assignmentPublicKeyX:a.x,deviceSign:s=>this.authority.signDeviceBytes(s),grantProvider:async s=>{if(s.avenue.kind!=="room"||s.avenue.id!==e)throw new Error("[OpenRTC] ServiceNode grant request escaped its room.");if(s.deviceId!==n)throw new Error("[OpenRTC] ServiceNode grant request escaped its device.");return this.authority.requestGrant({roomId:e,runtimeInstanceId:s.runtimeInstanceId,ticketFingerprint:s.ticketFingerprint,maxPeers:this.options.maxPeers,refreshGrant:s.refreshGrant,features:{irohRelay:this.options.irohRelay!==false}})}}),o=new I(c,this.authority,t);return this.attachConnectionListener(e,o),o}evictRoom(e,t){this.rooms.get(e)===t&&(this.rooms.delete(e),this.connectionCleanups.get(e)?.(),this.connectionCleanups.delete(e));}attachConnectionListener(e,t){this.closed||this.connectionListeners.size===0||this.connectionCleanups.has(e)||this.connectionCleanups.set(e,t.onConnection(n=>{for(let i of this.connectionListeners)i({room:t,connection:n});}));}};
-export{p as a,S as b};

package/dist/chunk-NS32P65Z.js

@@ -1,2 +0,0 @@
-import {a}from'./chunk-GMPEZXPD.js';function u(){let r=crypto.getRandomValues(new Uint8Array(24)),e="";for(let t of r)e+=String.fromCharCode(t);return btoa(e).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function d(r){if(!r||typeof r!="object")throw new Error("[OpenRTC] Native host returned no device public key.");let e=r;if(e.kty!=="OKP"||e.crv!=="Ed25519"||typeof e.x!="string"||!/^[A-Za-z0-9_-]{43}$/.test(e.x)||e.d!==void 0)throw new Error("[OpenRTC] Native host returned an invalid Ed25519 public key.");return {kty:"OKP",crv:"Ed25519",x:e.x}}function v(r){return {async readSecureRecord(e,t){return r.invoke("openrtc_read_secure_record",{appTag:e,key:t})},async writeSecureRecord(e,t,c){await r.invoke("openrtc_write_secure_record",{appTag:e,key:t,value:c});},async deleteSecureRecord(e,t){await r.invoke("openrtc_delete_secure_record",{appTag:e,key:t});},async delete(e){await r.invoke("openrtc_delete_device_key",{appTag:e});},async getOrCreate(e){let t=d(await r.invoke("openrtc_device_public_key",{appTag:e})),c=await a(t);return {publicKeyJwk:t,thumbprint:c,async sign(i){let o=new TextDecoder("utf-8",{fatal:true}).decode(i),n=await r.invoke("openrtc_sign_device_proof",{appTag:e,challenge:o});if(!/^[A-Za-z0-9_-]{80,128}$/.test(n))throw new Error("[OpenRTC] Native host returned an invalid device signature.");return n},async proof(i){let o=u(),n=Math.floor(Date.now()/1e3),a=await r.invoke("openrtc_sign_device_proof",{appTag:e,challenge:i(o,n)});if(!/^[A-Za-z0-9_-]{80,128}$/.test(a))throw new Error("[OpenRTC] Native host returned an invalid device proof.");return {publicKeyJwk:t,signature:a,nonce:o,issuedAt:n}}}}}}
-export{v as a};

package/dist/controlPlane-45AU3CSM.js

@@ -1 +0,0 @@
-export{a as ControlPlane}from'./chunk-2Q75GXGE.js';export{a as PRODUCTION_ENDPOINTS,b as decodeClaims}from'./chunk-ZA44REGI.js';import'./chunk-L7N4T2PX.js';import'./chunk-72MN7BNQ.js';

package/dist/deviceKey-2NTRYCSR.js

@@ -1 +0,0 @@
-export{c as browserDeviceKeyProvider,b as createDeviceKey,d as createSessionDeviceKeyProvider,a as deviceKeyThumbprint}from'./chunk-GMPEZXPD.js';