slybrowser 0.1.0

package/dist/service.js

@@ -0,0 +1,1271 @@
+import { spawn } from "node:child_process";
+import { createDecipheriv, createHash, createPublicKey, randomUUID, scryptSync, verify as verifySignature } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { gunzipSync } from "node:zlib";
+import { canonicalJson, decodeBase64Url } from "./canonical.js";
+import { LicenseServiceError } from "./errors.js";
+import { LicenseVerifier } from "./license.js";
+import { isSdkCompatible, selectArtifact, verifyReleaseManifest, } from "./manifest.js";
+function fail(code, message, status = 0, details = {}) {
+    throw new LicenseServiceError(message, code, status, details);
+}
+const SAFE_ERROR_DETAIL_FIELDS = new Set([
+    "state",
+    "concurrencyLimit",
+    "activeSessions",
+    "availableSessions",
+    "retryAfterSeconds",
+    "action",
+    "dimension",
+]);
+function safeRemoteErrorCode(code) {
+    return typeof code === "string" && /^[a-z0-9_]{2,96}$/.test(code) ? code : "license_service_error";
+}
+function remoteErrorMessage(status, code) {
+    if (code === "license_plan_expired") {
+        return "The SlyBrowser paid plan has expired. Renew the plan before starting SlyBrowser.";
+    }
+    return `License service request failed with HTTP ${status} (${code})`;
+}
+function safeErrorDetails(error) {
+    if (!error)
+        return {};
+    const details = {};
+    for (const [key, value] of Object.entries(error)) {
+        if (SAFE_ERROR_DETAIL_FIELDS.has(key)) {
+            const safeValue = safeErrorDetailValue(key, value);
+            if (safeValue !== undefined)
+                details[key] = safeValue;
+        }
+        else if (key === "actions" && Array.isArray(value)) {
+            const actions = value.map(safeErrorAction).filter((action) => Object.keys(action).length > 0);
+            if (actions.length)
+                details.actions = actions;
+        }
+    }
+    return details;
+}
+function safeErrorDetailValue(key, value) {
+    if (["concurrencyLimit", "activeSessions", "availableSessions", "retryAfterSeconds"].includes(key)) {
+        return Number.isSafeInteger(value) ? value : undefined;
+    }
+    return typeof value === "string" && /^[a-z0-9_:-]{1,96}$/.test(value) ? value : undefined;
+}
+function safeErrorAction(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return {};
+    const action = value;
+    const result = {};
+    if (typeof action.type === "string" && /^[a-z0-9_:-]{1,96}$/.test(action.type))
+        result.type = action.type;
+    if (typeof action.url === "string" && action.url.startsWith("https://slybrowser.com/"))
+        result.url = action.url;
+    return result;
+}
+function parseAuthorization(value, allowInsecureLocalhost = false) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        fail("authorization_invalid", "Authorization file must be an object");
+    const document = value;
+    if (Object.keys(document).sort().join(",") !== "channel,licenseKey,schemaVersion,serviceUrl" ||
+        document.schemaVersion !== 1 || document.channel !== "stable" ||
+        typeof document.licenseKey !== "string" ||
+        !/^sly_live_[0-9a-f-]{36}\.[A-Za-z0-9_-]{40,}$/.test(document.licenseKey) ||
+        typeof document.serviceUrl !== "string") {
+        fail("authorization_invalid", "Authorization file fields are invalid");
+    }
+    let url;
+    try {
+        url = new URL(document.serviceUrl);
+    }
+    catch {
+        fail("authorization_invalid", "Authorization service URL is invalid");
+    }
+    const local = new Set(["127.0.0.1", "localhost", "::1"]).has(url.hostname);
+    if (url.protocol !== "https:" && !(allowInsecureLocalhost && local && url.protocol === "http:")) {
+        fail("authorization_invalid", "Authorization service URL must use HTTPS");
+    }
+    return {
+        schemaVersion: 1,
+        serviceUrl: url.toString().replace(/\/$/, ""),
+        licenseKey: document.licenseKey,
+        channel: "stable",
+    };
+}
+const LICENSE_FILE_TOP_LEVEL_FIELDS = new Set([
+    "schemaVersion",
+    "type",
+    "audience",
+    "serviceUrl",
+    "licenseId",
+    "channel",
+    "issuedAt",
+    "expiresAt",
+    "fileId",
+    "encryption",
+    "ciphertext",
+    "tag",
+    "signature",
+]);
+const LICENSE_FILE_SECRET_FIELDS = new Set([
+    "schemaVersion",
+    "type",
+    "audience",
+    "licenseId",
+    "fileId",
+    "serviceUrl",
+    "channel",
+    "licenseKey",
+    "secretVersion",
+    "createdAt",
+    "expiresAt",
+    "nonce",
+    "scope",
+]);
+const USER_LICENSE_FILE_FORMAT = "slybrowser-license-compact-v1";
+const USER_LICENSE_FILE_FIELDS = new Set(["schemaVersion", "type", "format", "license"]);
+const USER_LICENSE_FILE_MAX_COMPRESSED_BYTES = 64 * 1024;
+const USER_LICENSE_FILE_MAX_DOCUMENT_BYTES = 256 * 1024;
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function normalizeServiceUrl(value, allowInsecureLocalhost = false) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        fail("authorization_invalid", "Authorization service URL is invalid");
+    }
+    const local = new Set(["127.0.0.1", "localhost", "::1"]).has(url.hostname);
+    if (url.protocol !== "https:" && !(allowInsecureLocalhost && local && url.protocol === "http:")) {
+        fail("authorization_invalid", "Authorization service URL must use HTTPS");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+function requiredText(document, name, maximum = 2048) {
+    const value = document[name];
+    if (typeof value !== "string" || !value || value.length > maximum || /[\u0000-\u001f]/.test(value)) {
+        fail("authorization_invalid", `License file ${name} is invalid`);
+    }
+    return value;
+}
+function requiredInteger(document, name) {
+    const value = document[name];
+    if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+        fail("authorization_invalid", `License file ${name} is invalid`);
+    }
+    return value;
+}
+function requiredObject(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        fail("authorization_invalid", "License file fields are invalid");
+    }
+    return value;
+}
+function unwrapUserLicenseFile(value) {
+    const wrapper = requiredObject(value);
+    if (wrapper.schemaVersion !== 1 ||
+        wrapper.type !== "slybrowser-license" ||
+        wrapper.format !== USER_LICENSE_FILE_FORMAT) {
+        return value;
+    }
+    if (Object.keys(wrapper).some((name) => !USER_LICENSE_FILE_FIELDS.has(name)) ||
+        Object.keys(wrapper).length !== USER_LICENSE_FILE_FIELDS.size) {
+        fail("authorization_invalid", "License file wrapper fields are invalid");
+    }
+    let serialized;
+    try {
+        serialized = gunzipSync(decodeBase64Url(requiredText(wrapper, "license", USER_LICENSE_FILE_MAX_COMPRESSED_BYTES * 2), USER_LICENSE_FILE_MAX_COMPRESSED_BYTES), { maxOutputLength: USER_LICENSE_FILE_MAX_DOCUMENT_BYTES }).toString("utf8");
+    }
+    catch {
+        fail("authorization_invalid", "License file wrapper payload is invalid");
+    }
+    if (Buffer.byteLength(serialized, "utf8") > USER_LICENSE_FILE_MAX_DOCUMENT_BYTES) {
+        fail("authorization_invalid", "License file wrapper payload is too large");
+    }
+    try {
+        return JSON.parse(serialized);
+    }
+    catch {
+        fail("authorization_invalid", "License file wrapper payload is invalid");
+    }
+}
+function publicLicenseFileHeader(document) {
+    return {
+        schemaVersion: document.schemaVersion,
+        type: document.type,
+        audience: document.audience,
+        serviceUrl: document.serviceUrl,
+        licenseId: document.licenseId,
+        channel: document.channel,
+        issuedAt: document.issuedAt,
+        expiresAt: document.expiresAt,
+        fileId: document.fileId,
+        encryption: document.encryption,
+    };
+}
+function signedLicenseFileBody(document) {
+    return {
+        ...publicLicenseFileHeader(document),
+        ciphertext: document.ciphertext,
+        tag: document.tag,
+    };
+}
+function trustedKeyMap(keys) {
+    const entries = keys instanceof Map ? keys.entries() : Object.entries(keys ?? {});
+    return new Map([...entries].map(([key, value]) => [key, Buffer.from(value)]));
+}
+function parseEncryptedLicenseFile(value, options) {
+    const document = requiredObject(unwrapUserLicenseFile(value));
+    if (Object.keys(document).some((name) => !LICENSE_FILE_TOP_LEVEL_FIELDS.has(name)) ||
+        Object.keys(document).length !== LICENSE_FILE_TOP_LEVEL_FIELDS.size ||
+        document.schemaVersion !== 2 ||
+        document.type !== "slybrowser-license" ||
+        document.audience !== "slybrowser-license-file" ||
+        document.channel !== "stable") {
+        fail("authorization_invalid", "License file fields are invalid");
+    }
+    const serviceUrl = normalizeServiceUrl(requiredText(document, "serviceUrl"), options.allowInsecureLocalhost ?? false);
+    const trustedServiceUrls = (options.trustedServiceUrls ?? ["https://api.slybrowser.com"])
+        .map((url) => normalizeServiceUrl(url, options.allowInsecureLocalhost ?? false));
+    if (!trustedServiceUrls.includes(serviceUrl)) {
+        fail("license_file_untrusted_origin", "License file service URL is not trusted", 403);
+    }
+    const licenseId = requiredText(document, "licenseId", 64);
+    const issuedAt = Date.parse(requiredText(document, "issuedAt", 64));
+    const expiresAt = Date.parse(requiredText(document, "expiresAt", 64));
+    if (!/^[0-9a-f-]{36}$/.test(licenseId) || !Number.isFinite(issuedAt) ||
+        !Number.isFinite(expiresAt) || expiresAt <= issuedAt) {
+        fail("authorization_invalid", "License file identity fields are invalid");
+    }
+    if (expiresAt <= Date.now())
+        fail("license_file_expired", "License file has expired", 401);
+    requiredText(document, "fileId", 128);
+    const encryption = requiredObject(document.encryption);
+    const kdf = requiredObject(encryption.kdf);
+    const signature = requiredObject(document.signature);
+    const kdfName = requiredText(kdf, "name", 64);
+    const kdfPurpose = requiredText(kdf, "purpose", 64);
+    const expectedScope = (kdfName === "sly-test-scrypt-v1" && kdfPurpose === "test-private-preview") || (kdfName === "sly-portable-scrypt-v1" && kdfPurpose === "portable-passphrase") ? kdfPurpose : null;
+    if (requiredText(encryption, "algorithm", 64) !== "AES-256-GCM" ||
+        requiredText(encryption, "aad", 128) !== "slybrowser-license-v2-public-header" ||
+        expectedScope === null ||
+        requiredInteger(kdf, "cost") !== 16_384 ||
+        requiredInteger(kdf, "blockSize") !== 8 ||
+        requiredInteger(kdf, "parallelization") !== 1 ||
+        requiredInteger(kdf, "keyLength") !== 32 ||
+        requiredText(signature, "algorithm", 64) !== "Ed25519") {
+        fail("authorization_invalid", "License file algorithms are invalid");
+    }
+    const keyId = requiredText(signature, "keyId", 64);
+    const publicKey = trustedKeyMap(options.licenseFileTrustedKeys).get(keyId);
+    if (!publicKey)
+        fail("license_file_key_unknown", "License file signing key is not trusted", 403);
+    if (publicKey.length !== 32)
+        fail("license_file_key_invalid", "License file signing key is invalid", 403);
+    const signedBody = canonicalJson(signedLicenseFileBody({ ...document, serviceUrl }));
+    const verified = verifySignature(null, signedBody, createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, publicKey]), format: "der", type: "spki" }), decodeBase64Url(requiredText(signature, "signature", 256), 64));
+    if (!verified)
+        fail("license_file_signature_invalid", "License file signature is invalid", 401);
+    const passphrase = options.licenseFilePassphrase;
+    if (typeof passphrase !== "string" || passphrase.length < 12) {
+        fail("license_file_locked", "License file passphrase is missing or too short", 401);
+    }
+    const salt = decodeBase64Url(requiredText(kdf, "salt", 64), 16);
+    if (salt.length !== 16)
+        fail("authorization_invalid", "License file salt length is invalid");
+    const nonce = decodeBase64Url(requiredText(encryption, "nonce", 64), 12);
+    if (nonce.length !== 12)
+        fail("authorization_invalid", "License file nonce length is invalid");
+    const decipher = createDecipheriv("aes-256-gcm", scryptSync(passphrase, salt, 32, { N: 16_384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 }), nonce);
+    decipher.setAAD(canonicalJson(publicLicenseFileHeader({ ...document, serviceUrl })));
+    decipher.setAuthTag(decodeBase64Url(requiredText(document, "tag", 64), 16));
+    let payload;
+    try {
+        const plaintext = Buffer.concat([
+            decipher.update(decodeBase64Url(requiredText(document, "ciphertext", 64 * 1024), 64 * 1024)),
+            decipher.final(),
+        ]);
+        payload = requiredObject(JSON.parse(plaintext.toString("utf8")));
+    }
+    catch (error) {
+        if (error instanceof LicenseServiceError)
+            throw error;
+        fail("license_file_locked", "License file cannot be decrypted", 401);
+    }
+    if (Object.keys(payload).some((name) => !LICENSE_FILE_SECRET_FIELDS.has(name)) ||
+        Object.keys(payload).length !== LICENSE_FILE_SECRET_FIELDS.size) {
+        fail("license_file_payload_invalid", "License file payload contains unsupported claims");
+    }
+    const licenseKey = requiredText(payload, "licenseKey", 256);
+    if (payload.schemaVersion !== 2 ||
+        payload.type !== "slybrowser-license-secret" ||
+        payload.audience !== document.audience ||
+        payload.licenseId !== licenseId ||
+        payload.fileId !== document.fileId ||
+        normalizeServiceUrl(requiredText(payload, "serviceUrl"), options.allowInsecureLocalhost ?? false) !== serviceUrl ||
+        payload.channel !== "stable" ||
+        payload.secretVersion !== 1 ||
+        payload.expiresAt !== document.expiresAt ||
+        payload.scope !== expectedScope ||
+        !/^sly_live_[0-9a-f-]{36}\.[A-Za-z0-9_-]{40,}$/.test(licenseKey) ||
+        !licenseKey.startsWith(`sly_live_${licenseId}.`)) {
+        fail("license_file_payload_invalid", "License file payload does not match its public header");
+    }
+    return { schemaVersion: 1, serviceUrl, licenseKey, channel: "stable" };
+}
+function localLicenseFileUnlockRequested(options) {
+    return options.licenseFilePassphrase !== undefined || options.licenseFileTrustedKeys !== undefined;
+}
+async function resolveEncryptedLicenseFileViaService(value, options) {
+    const document = requiredObject(unwrapUserLicenseFile(value));
+    if (document.schemaVersion !== 2 || document.type !== "slybrowser-license" ||
+        document.audience !== "slybrowser-license-file" || document.channel !== "stable") {
+        fail("authorization_invalid", "License file fields are invalid");
+    }
+    const documentServiceUrl = normalizeServiceUrl(requiredText(document, "serviceUrl"), options.allowInsecureLocalhost ?? false);
+    assertTrustedAuthorizationOrigin(documentServiceUrl, options);
+    const resolutionServiceUrl = normalizeServiceUrl(options.licenseFileResolutionServiceUrl ?? documentServiceUrl, options.allowInsecureLocalhost ?? false);
+    const fetchImplementation = options.fetch ?? fetch;
+    let response;
+    try {
+        response = await fetchImplementation(`${resolutionServiceUrl}/v1/license-files/authorization`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                "user-agent": "SlyBrowserNodeSDK/license-file",
+            },
+            body: JSON.stringify({ schemaVersion: 1, licenseFile: value }),
+        });
+    }
+    catch {
+        fail("license_service_unreachable", "License-file authorization service is unreachable", 0);
+    }
+    const text = await response.text();
+    let parsed = {};
+    try {
+        parsed = text ? JSON.parse(text) : {};
+    }
+    catch {
+        fail("license_service_invalid_response", "License-file authorization service returned invalid JSON", response.status);
+    }
+    if (!response.ok) {
+        const error = parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed.error
+            : undefined;
+        const details = error && typeof error === "object" && !Array.isArray(error)
+            ? error
+            : {};
+        const code = typeof details.code === "string" ? details.code : "license_file_authorization_failed";
+        const message = typeof details.message === "string"
+            ? details.message
+            : "License-file authorization service rejected the license file";
+        throw new LicenseServiceError(message, code, response.status, details);
+    }
+    const authorization = parseAuthorization(parsed, options.allowInsecureLocalhost ?? false);
+    if (authorization.serviceUrl !== documentServiceUrl) {
+        fail("license_service_invalid_response", "License-file authorization service URL does not match the license file", response.status);
+    }
+    return authorization;
+}
+const SEALED_LICENSE_TOP_LEVEL_FIELDS = new Set([
+    "schemaVersion",
+    "type",
+    "audience",
+    "serviceUrl",
+    "channel",
+    "sealedAt",
+    "licenseKeySha256",
+    "protection",
+    "ciphertext",
+]);
+function licenseKeySha256(licenseKey) {
+    return createHash("sha256").update(licenseKey, "utf8").digest("hex");
+}
+function sealedLicenseEntropy(document) {
+    return [
+        "slybrowser-sealed-license-v1",
+        requiredText(document, "serviceUrl", 2048),
+        requiredText(document, "channel", 16),
+        requiredText(document, "licenseKeySha256", 64),
+    ].join("\0");
+}
+function assertTrustedAuthorizationOrigin(serviceUrl, options) {
+    const trustedServiceUrls = (options.trustedServiceUrls ?? ["https://api.slybrowser.com"])
+        .map((url) => normalizeServiceUrl(url, options.allowInsecureLocalhost ?? false));
+    if (!trustedServiceUrls.includes(serviceUrl)) {
+        fail("license_file_untrusted_origin", "License file service URL is not trusted", 403);
+    }
+}
+async function windowsDpapi(operation, data, entropy) {
+    if (process.platform !== "win32") {
+        fail("sealed_license_unsupported", "Windows DPAPI sealed license files are only supported on Windows", 400);
+    }
+    const script = `
+$ErrorActionPreference = 'Stop'
+[System.Reflection.Assembly]::LoadWithPartialName('System.Security') | Out-Null
+$request = [Console]::In.ReadToEnd() | ConvertFrom-Json
+$data = [Convert]::FromBase64String([string]$request.data)
+$entropy = [Convert]::FromBase64String([string]$request.entropy)
+$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser
+if ([string]$request.operation -eq 'protect') {
+  $output = [System.Security.Cryptography.ProtectedData]::Protect($data, $entropy, $scope)
+} elseif ([string]$request.operation -eq 'unprotect') {
+  $output = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $entropy, $scope)
+} else {
+  throw 'Unsupported DPAPI operation'
+}
+[Console]::Out.Write([Convert]::ToBase64String($output))
+`;
+    const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
+    const request = JSON.stringify({
+        operation,
+        data: data.toString("base64"),
+        entropy: Buffer.from(entropy, "utf8").toString("base64"),
+    });
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn("powershell.exe", [
+            "-NoLogo",
+            "-NoProfile",
+            "-NonInteractive",
+            "-ExecutionPolicy",
+            "Bypass",
+            "-EncodedCommand",
+            encodedCommand,
+        ], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+        const stdout = [];
+        const stderr = [];
+        let settled = false;
+        const rejectOnce = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+        child.stdout.on("data", (chunk) => {
+            stdout.push(chunk);
+            if (Buffer.concat(stdout).length > 16 * 1024) {
+                child.kill();
+                rejectOnce(new LicenseServiceError("Windows DPAPI returned an oversized response", "sealed_license_invalid", 400));
+            }
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr.push(chunk);
+            if (Buffer.concat(stderr).length > 8 * 1024)
+                child.kill();
+        });
+        child.on("error", () => {
+            rejectOnce(new LicenseServiceError("Windows DPAPI is unavailable", "sealed_license_unsupported", 400));
+        });
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (code !== 0) {
+                reject(new LicenseServiceError("Sealed license file cannot be decrypted on this Windows user or machine", "sealed_license_locked", 401));
+                return;
+            }
+            try {
+                resolvePromise(Buffer.from(Buffer.concat(stdout).toString("utf8").trim(), "base64"));
+            }
+            catch {
+                reject(new LicenseServiceError("Windows DPAPI returned an invalid sealed license response", "sealed_license_invalid", 400));
+            }
+        });
+        child.stdin.end(request);
+    });
+}
+async function parseSealedLicenseFile(value, options) {
+    const document = requiredObject(value);
+    if (Object.keys(document).some((name) => !SEALED_LICENSE_TOP_LEVEL_FIELDS.has(name)) ||
+        Object.keys(document).length !== SEALED_LICENSE_TOP_LEVEL_FIELDS.size ||
+        document.schemaVersion !== 3 ||
+        document.type !== "slybrowser-sealed-authorization" ||
+        document.audience !== "slybrowser") {
+        fail("sealed_license_invalid", "Sealed license file fields are invalid");
+    }
+    const serviceUrl = normalizeServiceUrl(requiredText(document, "serviceUrl"), options.allowInsecureLocalhost ?? false);
+    assertTrustedAuthorizationOrigin(serviceUrl, options);
+    if (requiredText(document, "channel", 16) !== "stable")
+        fail("sealed_license_invalid", "Sealed license channel is invalid");
+    const sealedAt = Date.parse(requiredText(document, "sealedAt", 64));
+    if (!Number.isFinite(sealedAt))
+        fail("sealed_license_invalid", "Sealed license timestamp is invalid");
+    const sha256 = requiredText(document, "licenseKeySha256", 64);
+    if (!/^[0-9a-f]{64}$/.test(sha256))
+        fail("sealed_license_invalid", "Sealed license fingerprint is invalid");
+    const protection = requiredObject(document.protection);
+    if (Object.keys(protection).sort().join(",") !== "provider,scope" ||
+        protection.provider !== "windows-dpapi" ||
+        protection.scope !== "current-user") {
+        fail("sealed_license_unsupported", "Sealed license protection is not supported", 400);
+    }
+    const ciphertext = decodeBase64Url(requiredText(document, "ciphertext", 64 * 1024), 64 * 1024);
+    let parsed;
+    try {
+        const plaintext = await windowsDpapi("unprotect", ciphertext, sealedLicenseEntropy({ ...document, serviceUrl }));
+        parsed = JSON.parse(plaintext.toString("utf8"));
+    }
+    catch (error) {
+        if (error instanceof LicenseServiceError)
+            throw error;
+        fail("sealed_license_locked", "Sealed license file cannot be decrypted on this Windows user or machine", 401);
+    }
+    const authorization = parseAuthorization(parsed, options.allowInsecureLocalhost ?? false);
+    if (authorization.serviceUrl !== serviceUrl || authorization.channel !== "stable" ||
+        licenseKeySha256(authorization.licenseKey) !== sha256) {
+        fail("sealed_license_mismatch", "Sealed license payload does not match its public header", 400);
+    }
+    return authorization;
+}
+export async function importLicenseFileToSealedAuthorization(inputPath, outputPath, options = {}) {
+    const raw = await readFile(resolve(inputPath));
+    if (raw.length > 64 * 1024)
+        fail("authorization_invalid", "Authorization file is too large");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        fail("authorization_invalid", "Authorization file is not valid JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || parsed.schemaVersion !== 2) {
+        fail("license_file_invalid", "Only encrypted v2 SlyBrowser license files can be imported", 400);
+    }
+    const authorization = parseEncryptedLicenseFile(parsed, options);
+    assertTrustedAuthorizationOrigin(authorization.serviceUrl, options);
+    const fingerprint = licenseKeySha256(authorization.licenseKey);
+    const sealedAt = new Date().toISOString();
+    const document = {
+        schemaVersion: 3,
+        type: "slybrowser-sealed-authorization",
+        audience: "slybrowser",
+        serviceUrl: authorization.serviceUrl,
+        channel: authorization.channel,
+        sealedAt,
+        licenseKeySha256: fingerprint,
+        protection: {
+            provider: "windows-dpapi",
+            scope: "current-user",
+        },
+        ciphertext: "",
+    };
+    const ciphertext = await windowsDpapi("protect", Buffer.from(JSON.stringify(authorization), "utf8"), sealedLicenseEntropy(document));
+    document.ciphertext = ciphertext.toString("base64url");
+    const output = resolve(outputPath);
+    await writeFile(output, `${JSON.stringify(document, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+    return {
+        output,
+        serviceUrl: authorization.serviceUrl,
+        channel: "stable",
+        protection: "windows-dpapi-current-user",
+        licenseKeySha256: fingerprint,
+    };
+}
+export async function readLicenseAuthorization(path, options = {}) {
+    const raw = await readFile(resolve(path));
+    if (raw.length > 64 * 1024)
+        fail("authorization_invalid", "Authorization file is too large");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        fail("authorization_invalid", "Authorization file is not valid JSON");
+    }
+    try {
+        const document = parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? unwrapUserLicenseFile(parsed)
+            : parsed;
+        if (document && typeof document === "object" && !Array.isArray(document) &&
+            document.schemaVersion === 2) {
+            if (!localLicenseFileUnlockRequested(options)) {
+                return await resolveEncryptedLicenseFileViaService(parsed, options);
+            }
+            return parseEncryptedLicenseFile(parsed, options);
+        }
+        if (document && typeof document === "object" && !Array.isArray(document) &&
+            document.schemaVersion === 3) {
+            return await parseSealedLicenseFile(parsed, options);
+        }
+        return parseAuthorization(parsed, options.allowInsecureLocalhost ?? false);
+    }
+    catch (error) {
+        if (error instanceof LicenseServiceError)
+            throw error;
+        fail("authorization_invalid", "Authorization file is not valid JSON");
+    }
+}
+function currentPlatform() {
+    if (process.platform === "win32")
+        return "windows";
+    if (process.platform === "linux")
+        return "linux";
+    if (process.platform === "darwin")
+        return "macos";
+    fail("platform_unsupported", `Unsupported platform: ${process.platform}`);
+}
+function currentArch() {
+    if (process.arch === "x64" || process.arch === "arm64")
+        return process.arch;
+    fail("platform_unsupported", `Unsupported architecture: ${process.arch}`);
+}
+function object(value, code) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        fail(code, "License service returned an invalid response");
+    return value;
+}
+function versionParts(value) {
+    if (!/^\d+(\.\d+){0,7}$/.test(value))
+        fail("browser_version_invalid", `Browser version is invalid: ${value}`);
+    return value.split(".").map(Number);
+}
+function compareVersion(left, right) {
+    const a = versionParts(left);
+    const b = versionParts(right);
+    for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+        const difference = (a[index] ?? 0) - (b[index] ?? 0);
+        if (difference !== 0)
+            return Math.sign(difference);
+    }
+    return 0;
+}
+function newStartupId() {
+    return `st_${randomUUID().replaceAll("-", "")}`;
+}
+function requiredLeaseFeatures(backend) {
+    const base = ["browser", "release-download", "webdriver"];
+    if (backend === "playwright")
+        return [...base, "playwright"];
+    if (backend === "puppeteer")
+        return [...base, "puppeteer"];
+    return base;
+}
+function parseResponseFeatures(value, fallback) {
+    const source = value === undefined ? fallback : value;
+    if (!Array.isArray(source) ||
+        source.some((item) => typeof item !== "string" || !item || item.length > 128) ||
+        new Set(source).size !== source.length) {
+        fail("license_service_invalid_response", "License service features response is invalid");
+    }
+    return Object.freeze([...source]);
+}
+function parseRequestedKernelMajor(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "latest")
+        return "latest";
+    if (typeof value === "number" && Number.isSafeInteger(value) && value > 0)
+        return value;
+    fail("license_service_invalid_response", "License service requested-kernel response is invalid");
+}
+function parseSelectionMode(value) {
+    if (value === undefined)
+        return undefined;
+    if (new Set(["latest", "latest-in-major", "cached-approved", "exact", "rollback"]).has(String(value))) {
+        return value;
+    }
+    fail("license_service_invalid_response", "License service selection-mode response is invalid");
+}
+function parseOptionalVersion(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === "string" && /^\d+(\.\d+){0,7}$/.test(value))
+        return value;
+    fail("license_service_invalid_response", `License service ${field} response is invalid`);
+}
+function parseOptionalBoolean(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === "boolean")
+        return value;
+    fail("license_service_invalid_response", `License service ${field} response is invalid`);
+}
+function sameStringSet(left, right) {
+    return left.length === right.length && left.every((item) => right.includes(item));
+}
+function assertClaimsMatchPlan(claims, plan, concurrencyLimit, features) {
+    if (claims.planId !== undefined && claims.planId !== plan) {
+        fail("license_service_invalid_response", "Signed lease plan does not match the service response");
+    }
+    if (claims.concurrencyLimit !== undefined && claims.concurrencyLimit !== concurrencyLimit) {
+        fail("license_service_invalid_response", "Signed lease concurrency does not match the service response");
+    }
+    if (!sameStringSet(claims.features, features)) {
+        fail("license_service_invalid_response", "Signed lease features do not match the service response");
+    }
+}
+export class LicenseServiceClient {
+    authorization;
+    #fetch;
+    #licenseVerifier;
+    #releaseTrustedKeys;
+    constructor(authorization, options) {
+        this.authorization = parseAuthorization(authorization, options.allowInsecureLocalhost ?? false);
+        this.#fetch = options.fetch ?? fetch;
+        this.#licenseVerifier = new LicenseVerifier(options.licenseTrustedKeys);
+        this.#releaseTrustedKeys = options.releaseTrustedKeys;
+    }
+    async licenseInfo(options = {}) {
+        const platform = options.platform ?? currentPlatform();
+        const arch = options.arch ?? currentArch();
+        const sdkVersion = options.sdkVersion ?? "0.1.0";
+        const versionPolicy = options.versionPolicy ?? (options.browserVersion === undefined ? "latest" : "exact");
+        if (versionPolicy === "latest" && options.browserVersion !== undefined) {
+            fail("version_policy_invalid", "Latest selection cannot include a requested browser version");
+        }
+        if (versionPolicy !== "latest" && options.browserVersion === undefined) {
+            fail("version_policy_invalid", `${versionPolicy} selection requires a browser version`);
+        }
+        if (options.browserVersion !== undefined)
+            versionParts(options.browserVersion);
+        if (options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            (!Number.isSafeInteger(options.kernelMajor) || options.kernelMajor < 1)) {
+            fail("version_policy_invalid", "kernelMajor must be a positive integer or latest");
+        }
+        if (options.browserVersion !== undefined && options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            Number(options.browserVersion.split(".")[0]) !== options.kernelMajor) {
+            fail("version_policy_invalid", "browserVersion does not match kernelMajor");
+        }
+        const value = object(await this.#request("POST", "/v2/licenses/info", {
+            authorization: `License ${this.authorization.licenseKey}`,
+            body: {
+                platform,
+                arch,
+                channel: this.authorization.channel,
+                sdkVersion,
+                ...(options.deviceHash === undefined ? {} : { deviceHash: options.deviceHash }),
+                ...(options.kernelMajor === undefined ? {} : { kernelMajor: options.kernelMajor }),
+                ...(options.updateKernel === undefined ? {} : { updateKernel: options.updateKernel }),
+                versionPolicy,
+                ...(options.browserVersion === undefined ? {} : { browserVersion: options.browserVersion }),
+            },
+        }), "license_service_invalid_response");
+        const plan = String(value.plan ?? "");
+        const effectivePlan = String(value.effectivePlan ?? "");
+        const licenseStatus = String(value.licenseStatus ?? "");
+        const browserVersion = String(value.browserVersion ?? "");
+        const requestedBrowserVersion = value.requestedBrowserVersion;
+        const availableBrowserVersions = value.availableBrowserVersions;
+        const updateRights = value.updateRights;
+        const requestedKernelMajor = parseRequestedKernelMajor(value.requestedKernelMajor);
+        const selectionMode = parseSelectionMode(value.selectionMode);
+        const latestAvailableVersion = parseOptionalVersion(value.latestAvailableVersion, "latest-available-version");
+        const updateAvailable = parseOptionalBoolean(value.updateAvailable, "update-available");
+        const updateRequired = parseOptionalBoolean(value.updateRequired, "update-required");
+        const sessionState = value.sessionState;
+        const plans = new Set(["free", "basic", "pro", "max", "ultra"]);
+        if (value.schemaVersion !== 1 || value.channel !== "stable" ||
+            !new Set(["active", "hold", "revoked"]).has(licenseStatus) ||
+            !plans.has(plan) || !plans.has(effectivePlan) ||
+            !Number.isSafeInteger(value.concurrencyLimit) ||
+            !Number.isSafeInteger(value.activeSessions) ||
+            !Number.isSafeInteger(value.availableSessions) ||
+            !browserVersion || !/^\d+(\.\d+){0,7}$/.test(browserVersion) ||
+            value.versionPolicy !== versionPolicy ||
+            !new Set(["latest", "exact", "rollback"]).has(String(value.selectionReason ?? "")) ||
+            (options.browserVersion === undefined ? requestedBrowserVersion !== undefined : requestedBrowserVersion !== options.browserVersion) ||
+            !Array.isArray(availableBrowserVersions) ||
+            !availableBrowserVersions.every((item) => typeof item === "string" && /^\d+(\.\d+){0,7}$/.test(item)) ||
+            !updateRights || updateRights.status !== "active" || updateRights.channel !== "stable" ||
+            (updateRights.updatesThrough !== null && !Number.isSafeInteger(updateRights.updatesThrough)) ||
+            updateRights.exactVersion !== true || updateRights.rollback !== true ||
+            value.stableErrorCode !== null ||
+            !sessionState ||
+            sessionState.activeBrowserProcesses !== value.activeSessions ||
+            sessionState.limit !== value.concurrencyLimit ||
+            sessionState.available !== value.availableSessions) {
+            fail("license_service_invalid_response", "License service info response is invalid");
+        }
+        const features = parseResponseFeatures(value.features, []);
+        const result = {
+            schemaVersion: 1,
+            channel: "stable",
+            licenseStatus: licenseStatus,
+            plan: plan,
+            effectivePlan: effectivePlan,
+            paidThrough: value.paidThrough === null ? null : Number(value.paidThrough),
+            features,
+            concurrencyLimit: Number(value.concurrencyLimit),
+            activeSessions: Number(value.activeSessions),
+            availableSessions: Number(value.availableSessions),
+            sessionState: {
+                activeBrowserProcesses: Number(sessionState.activeBrowserProcesses),
+                limit: Number(sessionState.limit),
+                available: Number(sessionState.available),
+            },
+            browserVersion,
+            ...(requestedBrowserVersion === undefined ? {} : { requestedBrowserVersion: String(requestedBrowserVersion) }),
+            ...(requestedKernelMajor === undefined ? {} : { requestedKernelMajor }),
+            versionPolicy,
+            selectionReason: String(value.selectionReason),
+            ...(selectionMode === undefined ? {} : { selectionMode }),
+            availableBrowserVersions: availableBrowserVersions,
+            ...(latestAvailableVersion === undefined ? {} : { latestAvailableVersion }),
+            ...(updateAvailable === undefined ? {} : { updateAvailable }),
+            ...(updateRequired === undefined ? {} : { updateRequired }),
+            updateRights: updateRights,
+            stableErrorCode: null,
+        };
+        if (value.paidThrough !== null && !Number.isSafeInteger(value.paidThrough)) {
+            fail("license_service_invalid_response", "License service paid-through response is invalid");
+        }
+        return result;
+    }
+    async createSession(options = {}) {
+        const platform = options.platform ?? currentPlatform();
+        const arch = options.arch ?? currentArch();
+        const sdkVersion = options.sdkVersion ?? "0.1.0";
+        const versionPolicy = options.versionPolicy ?? (options.browserVersion === undefined ? "latest" : "exact");
+        if (versionPolicy === "latest" && options.browserVersion !== undefined) {
+            fail("version_policy_invalid", "Latest selection cannot include a requested browser version");
+        }
+        if (versionPolicy !== "latest" && options.browserVersion === undefined) {
+            fail("version_policy_invalid", `${versionPolicy} selection requires a browser version`);
+        }
+        if (options.browserVersion !== undefined)
+            versionParts(options.browserVersion);
+        if (options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            (!Number.isSafeInteger(options.kernelMajor) || options.kernelMajor < 1)) {
+            fail("version_policy_invalid", "kernelMajor must be a positive integer or latest");
+        }
+        if (options.browserVersion !== undefined && options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            Number(options.browserVersion.split(".")[0]) !== options.kernelMajor) {
+            fail("version_policy_invalid", "browserVersion does not match kernelMajor");
+        }
+        const value = object(await this.#request("POST", "/v1/licenses/sessions", {
+            authorization: `License ${this.authorization.licenseKey}`,
+            body: {
+                platform,
+                arch,
+                channel: this.authorization.channel,
+                sdkVersion,
+                ...(options.deviceHash === undefined ? {} : { deviceHash: options.deviceHash }),
+                ...(options.kernelMajor === undefined ? {} : { kernelMajor: options.kernelMajor }),
+                ...(options.updateKernel === undefined ? {} : { updateKernel: options.updateKernel }),
+                versionPolicy,
+                ...(options.browserVersion === undefined ? {} : { browserVersion: options.browserVersion }),
+            },
+        }), "license_service_invalid_response");
+        const sessionId = String(value.sessionId ?? "");
+        const sessionToken = String(value.sessionToken ?? "");
+        const browserVersion = String(value.browserVersion ?? "");
+        if (!sessionId || !sessionToken || !browserVersion || !Number.isSafeInteger(value.expiresAt) ||
+            !Number.isSafeInteger(value.heartbeatAfterSeconds)) {
+            fail("license_service_invalid_response", "License service session response is invalid");
+        }
+        const returnedPolicy = String(value.versionPolicy ?? "");
+        const selectionReason = String(value.selectionReason ?? "");
+        const requestedBrowserVersion = value.requestedBrowserVersion;
+        const availableBrowserVersions = value.availableBrowserVersions;
+        const updateRights = value.updateRights;
+        const requestedKernelMajor = parseRequestedKernelMajor(value.requestedKernelMajor);
+        const selectionMode = parseSelectionMode(value.selectionMode);
+        const latestAvailableVersion = parseOptionalVersion(value.latestAvailableVersion, "latest-available-version");
+        const updateAvailable = parseOptionalBoolean(value.updateAvailable, "update-available");
+        const updateRequired = parseOptionalBoolean(value.updateRequired, "update-required");
+        if (returnedPolicy !== versionPolicy ||
+            !new Set(["latest", "exact", "rollback"]).has(selectionReason) ||
+            (options.browserVersion === undefined
+                ? requestedBrowserVersion !== undefined
+                : requestedBrowserVersion !== options.browserVersion) ||
+            !Array.isArray(availableBrowserVersions) ||
+            !availableBrowserVersions.every((item) => typeof item === "string" && /^\d+(\.\d+){0,7}$/.test(item)) ||
+            !updateRights || updateRights.status !== "active" || updateRights.channel !== "stable" ||
+            (updateRights.updatesThrough !== null && !Number.isSafeInteger(updateRights.updatesThrough)) ||
+            updateRights.exactVersion !== true || updateRights.rollback !== true) {
+            fail("license_service_invalid_response", "License service version-selection response is invalid");
+        }
+        if (versionPolicy === "exact" && browserVersion !== options.browserVersion) {
+            fail("release_version_mismatch", `Requested browser ${options.browserVersion} but service selected ${browserVersion}`);
+        }
+        if (versionPolicy === "at-or-before" && compareVersion(browserVersion, options.browserVersion) > 0) {
+            fail("release_version_mismatch", `Rollback selection ${browserVersion} is newer than requested ${options.browserVersion}`);
+        }
+        const lease = value.lease;
+        const claims = this.#licenseVerifier.verify(lease, {
+            browserVersion,
+            requiredFeatures: requiredLeaseFeatures(),
+            ...(options.deviceHash === undefined ? {} : { deviceHash: options.deviceHash }),
+        });
+        if (claims.sessionId !== sessionId || claims.expiresAt !== value.expiresAt) {
+            fail("license_service_invalid_response", "Signed lease does not match the allocated session");
+        }
+        const manifest = verifyReleaseManifest(value.manifest, this.#releaseTrustedKeys);
+        if (manifest.browserVersion !== browserVersion) {
+            fail("license_service_invalid_response", "Release manifest does not match the signed lease");
+        }
+        if (!isSdkCompatible(manifest.sdkCompatibility, sdkVersion)) {
+            fail("sdk_version_unsupported", `Browser ${browserVersion} does not support SDK ${sdkVersion}`);
+        }
+        const artifact = selectArtifact(manifest, platform, arch);
+        const serviceOrigin = new URL(this.authorization.serviceUrl).origin;
+        if (new URL(artifact.url).origin !== serviceOrigin) {
+            fail("artifact_origin_invalid", "Authorized artifacts must be served by the license service origin");
+        }
+        const plan = value.plan;
+        if (!new Set(["free", "basic", "pro", "max", "ultra"]).has(String(plan)) ||
+            !Number.isSafeInteger(value.concurrencyLimit) || !Number.isSafeInteger(value.activeSessions)) {
+            fail("license_service_invalid_response", "License service plan response is invalid");
+        }
+        const features = parseResponseFeatures(value.features, claims.features);
+        assertClaimsMatchPlan(claims, plan, Number(value.concurrencyLimit), features);
+        return {
+            sessionId,
+            sessionToken,
+            heartbeatAfterSeconds: Number(value.heartbeatAfterSeconds),
+            expiresAt: Number(value.expiresAt),
+            plan: plan,
+            features,
+            concurrencyLimit: Number(value.concurrencyLimit),
+            activeSessions: Number(value.activeSessions),
+            browserVersion,
+            ...(requestedBrowserVersion === undefined ? {} : { requestedBrowserVersion: String(requestedBrowserVersion) }),
+            ...(requestedKernelMajor === undefined ? {} : { requestedKernelMajor }),
+            versionPolicy,
+            selectionReason: selectionReason,
+            ...(selectionMode === undefined ? {} : { selectionMode }),
+            availableBrowserVersions: availableBrowserVersions,
+            ...(latestAvailableVersion === undefined ? {} : { latestAvailableVersion }),
+            ...(updateAvailable === undefined ? {} : { updateAvailable }),
+            ...(updateRequired === undefined ? {} : { updateRequired }),
+            updateRights: updateRights,
+            lease,
+            claims,
+            manifest,
+            artifact,
+            platform,
+            arch,
+        };
+    }
+    async createRuntimeSession(options = {}) {
+        const platform = options.platform ?? currentPlatform();
+        const arch = options.arch ?? currentArch();
+        const sdkVersion = options.sdkVersion ?? "0.1.0";
+        const startupId = options.startupId ?? newStartupId();
+        if (!/^st_[A-Za-z0-9_-]{16,120}$/.test(startupId)) {
+            fail("startup_id_invalid", "Runtime startup ID is invalid");
+        }
+        const versionPolicy = options.versionPolicy ?? (options.browserVersion === undefined ? "latest" : "exact");
+        if (versionPolicy === "latest" && options.browserVersion !== undefined) {
+            fail("version_policy_invalid", "Latest selection cannot include a requested browser version");
+        }
+        if (versionPolicy !== "latest" && options.browserVersion === undefined) {
+            fail("version_policy_invalid", `${versionPolicy} selection requires a browser version`);
+        }
+        if (options.browserVersion !== undefined)
+            versionParts(options.browserVersion);
+        if (options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            (!Number.isSafeInteger(options.kernelMajor) || options.kernelMajor < 1)) {
+            fail("version_policy_invalid", "kernelMajor must be a positive integer or latest");
+        }
+        if (options.browserVersion !== undefined && options.kernelMajor !== undefined && options.kernelMajor !== "latest" &&
+            Number(options.browserVersion.split(".")[0]) !== options.kernelMajor) {
+            fail("version_policy_invalid", "browserVersion does not match kernelMajor");
+        }
+        const value = object(await this.#request("POST", "/v2/runtime/sessions", {
+            authorization: `License ${this.authorization.licenseKey}`,
+            body: {
+                startupId,
+                platform,
+                arch,
+                channel: this.authorization.channel,
+                sdkVersion,
+                ...(options.automationBackend === undefined ? {} : { automationBackend: options.automationBackend }),
+                ...(options.deviceHash === undefined ? {} : { deviceHash: options.deviceHash }),
+                ...(options.kernelMajor === undefined ? {} : { kernelMajor: options.kernelMajor }),
+                ...(options.updateKernel === undefined ? {} : { updateKernel: options.updateKernel }),
+                versionPolicy,
+                ...(options.browserVersion === undefined ? {} : { browserVersion: options.browserVersion }),
+            },
+        }), "license_service_invalid_response");
+        if (value.schemaVersion !== 2 || value.state !== "reserved" && value.state !== "active" && value.state !== "closing" ||
+            value.startupId !== startupId) {
+            fail("license_service_invalid_response", "Runtime session response is invalid");
+        }
+        const sessionId = String(value.sessionId ?? "");
+        const bootstrapToken = String(value.bootstrapToken ?? "");
+        const activationTicket = String(value.activationTicket ?? "");
+        const driverActivationTicket = value.driverActivationTicket;
+        const browserVersion = String(value.browserVersion ?? "");
+        if (!sessionId || !bootstrapToken || !activationTicket || !browserVersion || !Number.isSafeInteger(value.expiresAt) ||
+            !Number.isSafeInteger(value.heartbeatAfterSeconds)) {
+            fail("license_service_invalid_response", "Runtime session response is invalid");
+        }
+        if (driverActivationTicket !== undefined && (typeof driverActivationTicket !== "string" || driverActivationTicket.length === 0)) {
+            fail("license_service_invalid_response", "Runtime driver activation ticket is invalid");
+        }
+        if (options.automationBackend === "project-webdriver" && driverActivationTicket === undefined) {
+            fail("license_service_invalid_response", "Project WebDriver runtime session is missing a driver activation ticket");
+        }
+        const returnedPolicy = String(value.versionPolicy ?? "");
+        const selectionReason = String(value.selectionReason ?? "");
+        const requestedBrowserVersion = value.requestedBrowserVersion;
+        const availableBrowserVersions = value.availableBrowserVersions;
+        const updateRights = value.updateRights;
+        const requestedKernelMajor = parseRequestedKernelMajor(value.requestedKernelMajor);
+        const selectionMode = parseSelectionMode(value.selectionMode);
+        const latestAvailableVersion = parseOptionalVersion(value.latestAvailableVersion, "latest-available-version");
+        const updateAvailable = parseOptionalBoolean(value.updateAvailable, "update-available");
+        const updateRequired = parseOptionalBoolean(value.updateRequired, "update-required");
+        if (returnedPolicy !== versionPolicy ||
+            !new Set(["latest", "exact", "rollback"]).has(selectionReason) ||
+            (options.browserVersion === undefined
+                ? requestedBrowserVersion !== undefined
+                : requestedBrowserVersion !== options.browserVersion) ||
+            !Array.isArray(availableBrowserVersions) ||
+            !availableBrowserVersions.every((item) => typeof item === "string" && /^\d+(\.\d+){0,7}$/.test(item)) ||
+            !updateRights || updateRights.status !== "active" || updateRights.channel !== "stable" ||
+            (updateRights.updatesThrough !== null && !Number.isSafeInteger(updateRights.updatesThrough)) ||
+            updateRights.exactVersion !== true || updateRights.rollback !== true) {
+            fail("license_service_invalid_response", "Runtime version-selection response is invalid");
+        }
+        if (versionPolicy === "exact" && browserVersion !== options.browserVersion) {
+            fail("release_version_mismatch", `Requested browser ${options.browserVersion} but service selected ${browserVersion}`);
+        }
+        if (versionPolicy === "at-or-before" && compareVersion(browserVersion, options.browserVersion) > 0) {
+            fail("release_version_mismatch", `Rollback selection ${browserVersion} is newer than requested ${options.browserVersion}`);
+        }
+        const lease = value.lease;
+        const claims = this.#licenseVerifier.verify(lease, {
+            browserVersion,
+            requiredFeatures: requiredLeaseFeatures(options.automationBackend),
+            ...(options.deviceHash === undefined ? {} : { deviceHash: options.deviceHash }),
+        });
+        if (claims.sessionId !== sessionId || claims.expiresAt !== value.expiresAt) {
+            fail("license_service_invalid_response", "Runtime lease does not match the allocated session");
+        }
+        const manifest = verifyReleaseManifest(value.manifest, this.#releaseTrustedKeys);
+        if (manifest.browserVersion !== browserVersion) {
+            fail("license_service_invalid_response", "Release manifest does not match the runtime lease");
+        }
+        if (!isSdkCompatible(manifest.sdkCompatibility, sdkVersion)) {
+            fail("sdk_version_unsupported", `Browser ${browserVersion} does not support SDK ${sdkVersion}`);
+        }
+        const artifact = selectArtifact(manifest, platform, arch);
+        const serviceOrigin = new URL(this.authorization.serviceUrl).origin;
+        if (new URL(artifact.url).origin !== serviceOrigin) {
+            fail("artifact_origin_invalid", "Authorized artifacts must be served by the license service origin");
+        }
+        const ticket = value.downloadTicket;
+        const artifactUrl = String(ticket?.artifactUrl ?? "");
+        const artifactSha256 = String(ticket?.artifactSha256 ?? "");
+        if (!ticket || typeof ticket.token !== "string" || !ticket.token ||
+            !Number.isSafeInteger(ticket.expiresAt) || ticket.expiresAt !== value.expiresAt ||
+            artifactSha256 !== artifact.sha256 || !artifactUrl ||
+            new URL(artifactUrl).origin !== serviceOrigin) {
+            fail("license_service_invalid_response", "Runtime download ticket response is invalid");
+        }
+        const plan = value.plan;
+        if (!new Set(["free", "basic", "pro", "max", "ultra"]).has(String(plan)) ||
+            !Number.isSafeInteger(value.concurrencyLimit) || !Number.isSafeInteger(value.activeSessions)) {
+            fail("license_service_invalid_response", "Runtime plan response is invalid");
+        }
+        const features = parseResponseFeatures(value.features, claims.features);
+        assertClaimsMatchPlan(claims, plan, Number(value.concurrencyLimit), features);
+        return {
+            schemaVersion: 2,
+            state: value.state,
+            startupId,
+            sessionId,
+            bootstrapToken,
+            activationTicket,
+            ...(driverActivationTicket === undefined ? {} : { driverActivationTicket }),
+            heartbeatAfterSeconds: Number(value.heartbeatAfterSeconds),
+            expiresAt: Number(value.expiresAt),
+            plan: plan,
+            features,
+            concurrencyLimit: Number(value.concurrencyLimit),
+            activeSessions: Number(value.activeSessions),
+            browserVersion,
+            ...(requestedBrowserVersion === undefined ? {} : { requestedBrowserVersion: String(requestedBrowserVersion) }),
+            ...(requestedKernelMajor === undefined ? {} : { requestedKernelMajor }),
+            versionPolicy,
+            selectionReason: selectionReason,
+            ...(selectionMode === undefined ? {} : { selectionMode }),
+            availableBrowserVersions: availableBrowserVersions,
+            ...(latestAvailableVersion === undefined ? {} : { latestAvailableVersion }),
+            ...(updateAvailable === undefined ? {} : { updateAvailable }),
+            ...(updateRequired === undefined ? {} : { updateRequired }),
+            updateRights: updateRights,
+            lease,
+            claims,
+            manifest,
+            artifact,
+            platform,
+            arch,
+            ...(options.automationBackend === undefined ? {} : { automationBackend: options.automationBackend }),
+            downloadTicket: {
+                token: ticket.token,
+                expiresAt: Number(ticket.expiresAt),
+                artifactSha256,
+                artifactUrl,
+            },
+        };
+    }
+    async heartbeat(grant) {
+        const value = object(await this.#request("POST", `/v1/licenses/sessions/${encodeURIComponent(grant.sessionId)}/heartbeat`, {
+            authorization: `Session ${grant.sessionToken}`,
+            body: {},
+        }), "license_service_invalid_response");
+        const lease = value.lease;
+        const claims = this.#licenseVerifier.verify(lease, {
+            browserVersion: grant.browserVersion,
+            requiredFeatures: requiredLeaseFeatures(),
+            ...(grant.claims.deviceHash === undefined ? {} : { deviceHash: grant.claims.deviceHash }),
+        });
+        if (claims.sessionId !== grant.sessionId || claims.expiresAt !== value.expiresAt) {
+            fail("license_service_invalid_response", "Heartbeat lease does not match the active session");
+        }
+        const plan = value.plan;
+        if (!new Set(["free", "basic", "pro", "max", "ultra"]).has(String(plan)) ||
+            !Number.isSafeInteger(value.concurrencyLimit) || !Number.isSafeInteger(value.activeSessions)) {
+            fail("license_service_invalid_response", "Heartbeat plan response is invalid");
+        }
+        const features = parseResponseFeatures(value.features, claims.features);
+        assertClaimsMatchPlan(claims, plan, Number(value.concurrencyLimit), features);
+        return { expiresAt: Number(value.expiresAt), lease, claims };
+    }
+    async bootstrapHeartbeat(grant) {
+        const value = object(await this.#request("POST", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}/bootstrap-heartbeat`, {
+            authorization: `Bootstrap ${grant.bootstrapToken}`,
+        }), "license_service_invalid_response");
+        return this.#runtimeHeartbeatGrant(value, grant);
+    }
+    async activateRuntimeSession(grant) {
+        const value = object(await this.#request("POST", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}/activate`, {
+            authorization: `Activation ${grant.activationTicket}`,
+        }), "license_service_invalid_response");
+        const heartbeat = this.#runtimeHeartbeatGrant(value, grant);
+        const runtimeToken = String(value.runtimeToken ?? "");
+        if (heartbeat.state !== "active" || !runtimeToken) {
+            fail("license_service_invalid_response", "Runtime activation response is invalid");
+        }
+        return { ...heartbeat, state: "active", runtimeToken };
+    }
+    async runtimeHeartbeat(grant) {
+        const value = object(await this.#request("POST", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}/heartbeat`, {
+            authorization: `Runtime ${grant.runtimeToken}`,
+        }), "license_service_invalid_response");
+        return this.#runtimeHeartbeatGrant(value, grant);
+    }
+    async closeRuntimeSession(grant) {
+        const value = object(await this.#request("POST", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}/close`, {
+            authorization: `Runtime ${grant.runtimeToken}`,
+        }), "license_service_invalid_response");
+        return this.#runtimeHeartbeatGrant(value, grant);
+    }
+    async release(grant) {
+        await this.#request("DELETE", `/v1/licenses/sessions/${encodeURIComponent(grant.sessionId)}`, {
+            authorization: `Session ${grant.sessionToken}`,
+        });
+    }
+    async releaseRuntimeSession(grant) {
+        if ("runtimeToken" in grant) {
+            await this.#request("DELETE", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}`, {
+                authorization: `Runtime ${grant.runtimeToken}`,
+            });
+            return;
+        }
+        await this.#request("DELETE", `/v2/runtime/sessions/${encodeURIComponent(grant.sessionId)}`, {
+            authorization: `Bootstrap ${grant.bootstrapToken}`,
+        });
+    }
+    async downloadArtifact(grant) {
+        const response = await this.#fetch(grant.artifact.url, {
+            method: "GET",
+            headers: { authorization: `Session ${grant.sessionToken}` },
+            redirect: "error",
+        });
+        if (!response.ok || !response.body)
+            await this.#throwResponse(response);
+        return response;
+    }
+    async downloadRuntimeArtifact(grant) {
+        const artifactUrl = new URL(grant.downloadTicket.artifactUrl);
+        if (artifactUrl.pathname.startsWith("/v1/releases/artifacts/")) {
+            artifactUrl.pathname = artifactUrl.pathname.replace("/v1/releases/artifacts/", "/v2/runtime/artifacts/");
+        }
+        if (!artifactUrl.pathname.startsWith("/v2/runtime/artifacts/")) {
+            fail("license_service_invalid_response", "Runtime artifact URL is invalid");
+        }
+        const response = await this.#fetch(artifactUrl.toString(), {
+            method: "GET",
+            headers: { authorization: `Download ${grant.downloadTicket.token}` },
+            redirect: "error",
+        });
+        if (!response.ok || !response.body)
+            await this.#throwResponse(response);
+        return response;
+    }
+    #runtimeHeartbeatGrant(value, grant) {
+        if (value.schemaVersion !== 2 || value.startupId !== grant.startupId ||
+            value.sessionId !== grant.sessionId || !Number.isSafeInteger(value.expiresAt) ||
+            !Number.isSafeInteger(value.heartbeatAfterSeconds)) {
+            fail("license_service_invalid_response", "Runtime heartbeat response is invalid");
+        }
+        const state = String(value.state ?? "");
+        if (state !== "reserved" && state !== "active" && state !== "closing") {
+            fail("license_service_invalid_response", "Runtime session state is invalid");
+        }
+        const lease = value.lease;
+        const claims = this.#licenseVerifier.verify(lease, {
+            browserVersion: grant.browserVersion,
+            requiredFeatures: requiredLeaseFeatures(grant.automationBackend),
+            ...(grant.claims.deviceHash === undefined ? {} : { deviceHash: grant.claims.deviceHash }),
+        });
+        if (claims.sessionId !== grant.sessionId || claims.expiresAt !== value.expiresAt) {
+            fail("license_service_invalid_response", "Runtime heartbeat lease does not match the active session");
+        }
+        const plan = value.plan;
+        if (!new Set(["free", "basic", "pro", "max", "ultra"]).has(String(plan)) ||
+            !Number.isSafeInteger(value.concurrencyLimit) || !Number.isSafeInteger(value.activeSessions)) {
+            fail("license_service_invalid_response", "Runtime heartbeat plan response is invalid");
+        }
+        const features = parseResponseFeatures(value.features, claims.features);
+        assertClaimsMatchPlan(claims, plan, Number(value.concurrencyLimit), features);
+        return {
+            schemaVersion: 2,
+            state: state,
+            startupId: grant.startupId,
+            sessionId: grant.sessionId,
+            heartbeatAfterSeconds: Number(value.heartbeatAfterSeconds),
+            expiresAt: Number(value.expiresAt),
+            plan: plan,
+            features,
+            concurrencyLimit: Number(value.concurrencyLimit),
+            activeSessions: Number(value.activeSessions),
+            browserVersion: grant.browserVersion,
+            ...(grant.automationBackend === undefined ? {} : { automationBackend: grant.automationBackend }),
+            lease,
+            claims,
+        };
+    }
+    async #request(method, path, options) {
+        const response = await this.#fetch(`${this.authorization.serviceUrl}${path}`, {
+            method,
+            headers: {
+                authorization: options.authorization,
+                ...(options.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            ...(options.body === undefined ? {} : { body: JSON.stringify(options.body) }),
+            redirect: "error",
+        });
+        if (!response.ok)
+            await this.#throwResponse(response);
+        if (response.status === 204)
+            return {};
+        try {
+            return await response.json();
+        }
+        catch {
+            fail("license_service_invalid_response", "License service returned invalid JSON", response.status);
+        }
+    }
+    async #throwResponse(response) {
+        const payload = await response.json().catch(() => null);
+        const error = payload?.error;
+        const code = safeRemoteErrorCode(error?.code);
+        fail(code, remoteErrorMessage(response.status, code), response.status, safeErrorDetails(error));
+    }
+}
+//# sourceMappingURL=service.js.map