wire-mesh-core 1.45.2 → 1.47.0

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
-import { i as verifyCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
+import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.cjs";
-import { t as IdentityPort } from "../identity-B4XBWkqg.cjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-C9Kwy0Gk.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-CkQV0Iq7.cjs";
+import { a as RevocationCheck } from "../tokens-Cl8sQo7o.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-DpOfZOdl.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-gbXtNeOc.mjs";
-import { t as IdentityPort } from "../identity-CIb9dGkJ.mjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-k172l0Iy.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-BggPfYr8.mjs";
+import { a as RevocationCheck } from "../tokens-CVyPoJ6l.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-BdtM1rQ4.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/shard-manifest.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-gbXtNeOc.cjs";
+import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.cjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/shard-manifest.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-gbXtNeOc.mjs";
+import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.mjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/threshold-subject.cjs

@@ -0,0 +1,35 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+//#region src/domain/threshold-subject.ts
+/**
+* `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.
+*/
+/**
+* The kinds this participant recognises out of the box -- `capability-token`, `revocation-entry`, `handle-record`, and `room-notice` are the self-certifying payload shapes this codebase already defines. A caller extending recognised kinds (e.g. an application-defined one) supplies its own recogniser rather than this module growing a closed list.
+*/
+const KNOWN_KINDS = [
+	"capability-token",
+	"revocation-entry",
+	"handle-record",
+	"room-notice"
+];
+/**
+* The verifier obligation `spec/threshold.cddl` states directly: an unrecognised `kind` MUST be refused, never signed blindly. This is the fail-closed default every content policy is checked against BEFORE any kind-specific review runs; a caller's own policy closure only ever gets a chance to run for a kind it (or `KNOWN_KINDS`) actually recognises.
+*/
+function refuseUnrecognisedKind(subject, known = KNOWN_KINDS) {
+	if (known.includes(subject.kind)) return;
+	return {
+		authorise: false,
+		reason: `unrecognised threshold-subject.kind ${JSON.stringify(subject.kind)} -- refusing to sign`
+	};
+}
+/**
+* Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
+*/
+function toBeSigned(subject) {
+	return Uint8Array.from(require_tokens.sig1ToBeSigned(subject.protected, subject.payload));
+}
+//#endregion
+exports.KNOWN_KINDS = KNOWN_KINDS;
+exports.refuseUnrecognisedKind = refuseUnrecognisedKind;
+exports.toBeSigned = toBeSigned;

package/dist/domain/threshold-subject.d.cts

@@ -0,0 +1,33 @@
+//#region src/domain/threshold-subject.d.ts
+/**
+ * The `kind` discriminator on `threshold-subject` -- an open `tstr` per `spec/CONVENTIONS.md`'s own open-tstr-over-closed-enum convention, since future content a group signs is not limited to what wire-mesh itself already defines self-certifying payloads for.
+ */
+export interface ThresholdSubject {
+  kind: string;
+  /** `bstr .cbor cose-token-headers` -- the protected header the aggregate signature will carry. */
+  protected: Uint8Array;
+  /** `bstr .cbor` of the claims structure `kind` names. */
+  payload: Uint8Array;
+}
+/**
+ * The kinds this participant recognises out of the box -- `capability-token`, `revocation-entry`, `handle-record`, and `room-notice` are the self-certifying payload shapes this codebase already defines. A caller extending recognised kinds (e.g. an application-defined one) supplies its own recogniser rather than this module growing a closed list.
+ */
+export declare const KNOWN_KINDS: readonly string[];
+/**
+ * A participant's decision on whether to authorise a `threshold-subject`. Deliberately not a bare `boolean`: a refusal MUST carry a reason so the coordinator (and, ideally, a human reviewing a denied session) can understand why, matching this spec's own fail-closed-with-a-reason idiom elsewhere (`manage-error.message`, `threshold-abort.reason`).
+ */
+export type SubjectDecision = {
+  authorise: true;
+} | {
+  authorise: false;
+  reason: string;
+};
+/**
+ * The verifier obligation `spec/threshold.cddl` states directly: an unrecognised `kind` MUST be refused, never signed blindly. This is the fail-closed default every content policy is checked against BEFORE any kind-specific review runs; a caller's own policy closure only ever gets a chance to run for a kind it (or `KNOWN_KINDS`) actually recognises.
+ */
+export declare function refuseUnrecognisedKind(subject: ThresholdSubject, known?: readonly string[]): SubjectDecision | undefined;
+/**
+ * Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
+ */
+export declare function toBeSigned(subject: ThresholdSubject): Uint8Array<ArrayBuffer>;
+//#endregion

package/dist/domain/threshold-subject.d.mts

@@ -0,0 +1,33 @@
+//#region src/domain/threshold-subject.d.ts
+/**
+ * The `kind` discriminator on `threshold-subject` -- an open `tstr` per `spec/CONVENTIONS.md`'s own open-tstr-over-closed-enum convention, since future content a group signs is not limited to what wire-mesh itself already defines self-certifying payloads for.
+ */
+export interface ThresholdSubject {
+  kind: string;
+  /** `bstr .cbor cose-token-headers` -- the protected header the aggregate signature will carry. */
+  protected: Uint8Array;
+  /** `bstr .cbor` of the claims structure `kind` names. */
+  payload: Uint8Array;
+}
+/**
+ * The kinds this participant recognises out of the box -- `capability-token`, `revocation-entry`, `handle-record`, and `room-notice` are the self-certifying payload shapes this codebase already defines. A caller extending recognised kinds (e.g. an application-defined one) supplies its own recogniser rather than this module growing a closed list.
+ */
+export declare const KNOWN_KINDS: readonly string[];
+/**
+ * A participant's decision on whether to authorise a `threshold-subject`. Deliberately not a bare `boolean`: a refusal MUST carry a reason so the coordinator (and, ideally, a human reviewing a denied session) can understand why, matching this spec's own fail-closed-with-a-reason idiom elsewhere (`manage-error.message`, `threshold-abort.reason`).
+ */
+export type SubjectDecision = {
+  authorise: true;
+} | {
+  authorise: false;
+  reason: string;
+};
+/**
+ * The verifier obligation `spec/threshold.cddl` states directly: an unrecognised `kind` MUST be refused, never signed blindly. This is the fail-closed default every content policy is checked against BEFORE any kind-specific review runs; a caller's own policy closure only ever gets a chance to run for a kind it (or `KNOWN_KINDS`) actually recognises.
+ */
+export declare function refuseUnrecognisedKind(subject: ThresholdSubject, known?: readonly string[]): SubjectDecision | undefined;
+/**
+ * Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
+ */
+export declare function toBeSigned(subject: ThresholdSubject): Uint8Array<ArrayBuffer>;
+//#endregion

package/dist/domain/threshold-subject.mjs

@@ -0,0 +1,32 @@
+import { i as sig1ToBeSigned } from "../tokens-B0dpTLhS.mjs";
+//#region src/domain/threshold-subject.ts
+/**
+* `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.
+*/
+/**
+* The kinds this participant recognises out of the box -- `capability-token`, `revocation-entry`, `handle-record`, and `room-notice` are the self-certifying payload shapes this codebase already defines. A caller extending recognised kinds (e.g. an application-defined one) supplies its own recogniser rather than this module growing a closed list.
+*/
+const KNOWN_KINDS = [
+	"capability-token",
+	"revocation-entry",
+	"handle-record",
+	"room-notice"
+];
+/**
+* The verifier obligation `spec/threshold.cddl` states directly: an unrecognised `kind` MUST be refused, never signed blindly. This is the fail-closed default every content policy is checked against BEFORE any kind-specific review runs; a caller's own policy closure only ever gets a chance to run for a kind it (or `KNOWN_KINDS`) actually recognises.
+*/
+function refuseUnrecognisedKind(subject, known = KNOWN_KINDS) {
+	if (known.includes(subject.kind)) return;
+	return {
+		authorise: false,
+		reason: `unrecognised threshold-subject.kind ${JSON.stringify(subject.kind)} -- refusing to sign`
+	};
+}
+/**
+* Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
+*/
+function toBeSigned(subject) {
+	return Uint8Array.from(sig1ToBeSigned(subject.protected, subject.payload));
+}
+//#endregion
+export { KNOWN_KINDS, refuseUnrecognisedKind, toBeSigned };

package/dist/domain/tokens.cjs

@@ -1,7 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DxGVURpB.cjs");
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;
+exports.sig1ToBeSigned = require_tokens.sig1ToBeSigned;
 exports.verifyCapabilityToken = require_tokens.verifyCapabilityToken;
 exports.verifyRevocationEntry = require_tokens.verifyRevocationEntry;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-C9Kwy0Gk.cjs";
-export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-Cl8sQo7o.cjs";
+export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-k172l0Iy.mjs";
-export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CVyPoJ6l.mjs";
+export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-CdQwzCyJ.mjs";
-export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };
+import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-B0dpTLhS.mjs";
+export { canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/webrtc-signaling.cjs

@@ -0,0 +1,107 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+//#region src/domain/webrtc-signaling.ts
+/** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
+const WEBRTC_SIGNAL_VERB = "webrtc:signal";
+/** No path: there is no filesystem subtree involved in signaling, only the node itself. */
+const WEBRTC_SIGNAL_SCOPE = { kind: "node" };
+function isWebrtcOffer(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.offer";
+}
+function isWebrtcAnswer(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.answer";
+}
+function isWebrtcIceCandidate(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.ice-candidate";
+}
+function isSfuTrackMap(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.sfu-track-map";
+}
+function buildOfferCommand(negotiationId, sdp) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.offer",
+			"negotiation-id": negotiationId,
+			sdp
+		}
+	};
+}
+function buildAnswerCommand(negotiationId, sdp) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.answer",
+			"negotiation-id": negotiationId,
+			sdp
+		}
+	};
+}
+function buildIceCandidateCommand(negotiationId, candidate) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.ice-candidate",
+			"negotiation-id": negotiationId,
+			...candidate !== void 0 ? { candidate } : {}
+		}
+	};
+}
+/** Builds the manage-command an SFU sends to report which room member each SDP mid on a negotiation belongs to: sent once a negotiation completes (the initial track set) and again, as a full resend rather than an incremental diff, on every membership change. An empty tracks array is itself a valid, meaningful message (the call is now empty), not a degenerate case. */
+function buildSfuTrackMapCommand(negotiationId, tracks) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.sfu-track-map",
+			"negotiation-id": negotiationId,
+			tracks: [...tracks]
+		}
+	};
+}
+function wireIceCandidateFromRtc(candidate) {
+	return {
+		candidate: candidate.candidate,
+		...candidate.sdpMid !== null ? { "sdp-mid": candidate.sdpMid } : {},
+		...candidate.sdpMLineIndex !== null ? { "sdp-m-line-index": candidate.sdpMLineIndex } : {},
+		...candidate.usernameFragment !== null ? { "username-fragment": candidate.usernameFragment } : {}
+	};
+}
+function rtcIceCandidateInitFromWire(wire) {
+	return {
+		candidate: wire.candidate,
+		...wire["sdp-mid"] !== void 0 ? { sdpMid: wire["sdp-mid"] } : {},
+		...wire["sdp-m-line-index"] !== void 0 ? { sdpMLineIndex: wire["sdp-m-line-index"] } : {},
+		...wire["username-fragment"] !== void 0 ? { usernameFragment: wire["username-fragment"] } : {}
+	};
+}
+/** A fresh, independent, monotonically increasing negotiation-id source starting at 0, extracted as its own pure function so id allocation is testable without an RTCPeerConnection or any transport. */
+function createNegotiationIdAllocator() {
+	let next = 0;
+	return () => {
+		const id = next;
+		next += 1;
+		return id;
+	};
+}
+/** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
+async function authorizeIncomingOffer(incoming, options) {
+	if (incoming.token === void 0) return false;
+	const verdict = await require_tokens.verifyCapabilityToken(incoming.token, options);
+	if (!verdict.ok) return false;
+	return verdict.claims.capability === "webrtc:signal" && verdict.claims.scope.kind === WEBRTC_SIGNAL_SCOPE.kind;
+}
+//#endregion
+exports.WEBRTC_SIGNAL_SCOPE = WEBRTC_SIGNAL_SCOPE;
+exports.WEBRTC_SIGNAL_VERB = WEBRTC_SIGNAL_VERB;
+exports.authorizeIncomingOffer = authorizeIncomingOffer;
+exports.buildAnswerCommand = buildAnswerCommand;
+exports.buildIceCandidateCommand = buildIceCandidateCommand;
+exports.buildOfferCommand = buildOfferCommand;
+exports.buildSfuTrackMapCommand = buildSfuTrackMapCommand;
+exports.createNegotiationIdAllocator = createNegotiationIdAllocator;
+exports.isSfuTrackMap = isSfuTrackMap;
+exports.isWebrtcAnswer = isWebrtcAnswer;
+exports.isWebrtcIceCandidate = isWebrtcIceCandidate;
+exports.isWebrtcOffer = isWebrtcOffer;
+exports.rtcIceCandidateInitFromWire = rtcIceCandidateInitFromWire;
+exports.wireIceCandidateFromRtc = wireIceCandidateFromRtc;

package/dist/domain/webrtc-signaling.d.cts

@@ -0,0 +1,38 @@
+import { $t as WebrtcOffer, H as ManageCommandParams, Mt as SfuTrackEntry, Nt as SfuTrackMap, Qt as WebrtcIceCandidate, V as ManageCommand, Zt as WebrtcAnswer, f as CapabilityScope, z as IceCandidateInit } from "../protocol-CNFRVx9w.cjs";
+import { IncomingManageRequest } from "./mesh-session.cjs";
+import { u as VerifyCapabilityTokenOptions } from "../tokens-Cl8sQo7o.cjs";
+//#region src/domain/webrtc-signaling.d.ts
+/** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
+export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";
+/** No path: there is no filesystem subtree involved in signaling, only the node itself. */
+export declare const WEBRTC_SIGNAL_SCOPE: CapabilityScope;
+export declare function isWebrtcOffer(params: ManageCommandParams): params is WebrtcOffer;
+export declare function isWebrtcAnswer(params: ManageCommandParams): params is WebrtcAnswer;
+export declare function isWebrtcIceCandidate(params: ManageCommandParams): params is WebrtcIceCandidate;
+export declare function isSfuTrackMap(params: ManageCommandParams): params is SfuTrackMap;
+export declare function buildOfferCommand(negotiationId: number, sdp: string): ManageCommand;
+export declare function buildAnswerCommand(negotiationId: number, sdp: string): ManageCommand;
+export declare function buildIceCandidateCommand(negotiationId: number, candidate?: Readonly<IceCandidateInit>): ManageCommand;
+/** Builds the manage-command an SFU sends to report which room member each SDP mid on a negotiation belongs to: sent once a negotiation completes (the initial track set) and again, as a full resend rather than an incremental diff, on every membership change. An empty tracks array is itself a valid, meaningful message (the call is now empty), not a degenerate case. */
+export declare function buildSfuTrackMapCommand(negotiationId: number, tracks: readonly SfuTrackEntry[]): ManageCommand;
+/** The subset of RTCIceCandidate's own fields this module actually reads: a real RTCIceCandidate satisfies this structurally, and so does a plain test object or a server-side candidate description, with no cast needed either way. */
+export type MinimalRtcIceCandidate = Readonly<{
+  candidate: string;
+  sdpMid: string | null;
+  sdpMLineIndex: number | null;
+  usernameFragment: string | null;
+}>;
+export declare function wireIceCandidateFromRtc(candidate: MinimalRtcIceCandidate): IceCandidateInit;
+/** The subset of RTCIceCandidateInit's own shape this module produces: structurally identical to the DOM lib's own type (candidate, sdpMid, sdpMLineIndex, usernameFragment, each optional), so a caller in an environment with the DOM lib available (web-console) can pass this straight to RTCPeerConnection.addIceCandidate() with no cast, while core itself stays free of any DOM lib dependency. */
+export interface WireRtcIceCandidateInit {
+  candidate?: string;
+  sdpMid?: string;
+  sdpMLineIndex?: number;
+  usernameFragment?: string;
+}
+export declare function rtcIceCandidateInitFromWire(wire: Readonly<IceCandidateInit>): WireRtcIceCandidateInit;
+/** A fresh, independent, monotonically increasing negotiation-id source starting at 0, extracted as its own pure function so id allocation is testable without an RTCPeerConnection or any transport. */
+export declare function createNegotiationIdAllocator(): () => number;
+/** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
+export declare function authorizeIncomingOffer(incoming: Readonly<IncomingManageRequest>, options: Readonly<VerifyCapabilityTokenOptions>): Promise<boolean>;
+//#endregion

package/dist/domain/webrtc-signaling.d.mts

@@ -0,0 +1,38 @@
+import { $t as WebrtcOffer, H as ManageCommandParams, Mt as SfuTrackEntry, Nt as SfuTrackMap, Qt as WebrtcIceCandidate, V as ManageCommand, Zt as WebrtcAnswer, f as CapabilityScope, z as IceCandidateInit } from "../protocol-CNFRVx9w.mjs";
+import { IncomingManageRequest } from "./mesh-session.mjs";
+import { u as VerifyCapabilityTokenOptions } from "../tokens-CVyPoJ6l.mjs";
+//#region src/domain/webrtc-signaling.d.ts
+/** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
+export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";
+/** No path: there is no filesystem subtree involved in signaling, only the node itself. */
+export declare const WEBRTC_SIGNAL_SCOPE: CapabilityScope;
+export declare function isWebrtcOffer(params: ManageCommandParams): params is WebrtcOffer;
+export declare function isWebrtcAnswer(params: ManageCommandParams): params is WebrtcAnswer;
+export declare function isWebrtcIceCandidate(params: ManageCommandParams): params is WebrtcIceCandidate;
+export declare function isSfuTrackMap(params: ManageCommandParams): params is SfuTrackMap;
+export declare function buildOfferCommand(negotiationId: number, sdp: string): ManageCommand;
+export declare function buildAnswerCommand(negotiationId: number, sdp: string): ManageCommand;
+export declare function buildIceCandidateCommand(negotiationId: number, candidate?: Readonly<IceCandidateInit>): ManageCommand;
+/** Builds the manage-command an SFU sends to report which room member each SDP mid on a negotiation belongs to: sent once a negotiation completes (the initial track set) and again, as a full resend rather than an incremental diff, on every membership change. An empty tracks array is itself a valid, meaningful message (the call is now empty), not a degenerate case. */
+export declare function buildSfuTrackMapCommand(negotiationId: number, tracks: readonly SfuTrackEntry[]): ManageCommand;
+/** The subset of RTCIceCandidate's own fields this module actually reads: a real RTCIceCandidate satisfies this structurally, and so does a plain test object or a server-side candidate description, with no cast needed either way. */
+export type MinimalRtcIceCandidate = Readonly<{
+  candidate: string;
+  sdpMid: string | null;
+  sdpMLineIndex: number | null;
+  usernameFragment: string | null;
+}>;
+export declare function wireIceCandidateFromRtc(candidate: MinimalRtcIceCandidate): IceCandidateInit;
+/** The subset of RTCIceCandidateInit's own shape this module produces: structurally identical to the DOM lib's own type (candidate, sdpMid, sdpMLineIndex, usernameFragment, each optional), so a caller in an environment with the DOM lib available (web-console) can pass this straight to RTCPeerConnection.addIceCandidate() with no cast, while core itself stays free of any DOM lib dependency. */
+export interface WireRtcIceCandidateInit {
+  candidate?: string;
+  sdpMid?: string;
+  sdpMLineIndex?: number;
+  usernameFragment?: string;
+}
+export declare function rtcIceCandidateInitFromWire(wire: Readonly<IceCandidateInit>): WireRtcIceCandidateInit;
+/** A fresh, independent, monotonically increasing negotiation-id source starting at 0, extracted as its own pure function so id allocation is testable without an RTCPeerConnection or any transport. */
+export declare function createNegotiationIdAllocator(): () => number;
+/** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
+export declare function authorizeIncomingOffer(incoming: Readonly<IncomingManageRequest>, options: Readonly<VerifyCapabilityTokenOptions>): Promise<boolean>;
+//#endregion

package/dist/domain/webrtc-signaling.mjs

@@ -0,0 +1,93 @@
+import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+//#region src/domain/webrtc-signaling.ts
+/** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
+const WEBRTC_SIGNAL_VERB = "webrtc:signal";
+/** No path: there is no filesystem subtree involved in signaling, only the node itself. */
+const WEBRTC_SIGNAL_SCOPE = { kind: "node" };
+function isWebrtcOffer(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.offer";
+}
+function isWebrtcAnswer(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.answer";
+}
+function isWebrtcIceCandidate(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.ice-candidate";
+}
+function isSfuTrackMap(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "webrtc.sfu-track-map";
+}
+function buildOfferCommand(negotiationId, sdp) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.offer",
+			"negotiation-id": negotiationId,
+			sdp
+		}
+	};
+}
+function buildAnswerCommand(negotiationId, sdp) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.answer",
+			"negotiation-id": negotiationId,
+			sdp
+		}
+	};
+}
+function buildIceCandidateCommand(negotiationId, candidate) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.ice-candidate",
+			"negotiation-id": negotiationId,
+			...candidate !== void 0 ? { candidate } : {}
+		}
+	};
+}
+/** Builds the manage-command an SFU sends to report which room member each SDP mid on a negotiation belongs to: sent once a negotiation completes (the initial track set) and again, as a full resend rather than an incremental diff, on every membership change. An empty tracks array is itself a valid, meaningful message (the call is now empty), not a degenerate case. */
+function buildSfuTrackMapCommand(negotiationId, tracks) {
+	return {
+		verb: WEBRTC_SIGNAL_VERB,
+		params: {
+			verb: "webrtc.sfu-track-map",
+			"negotiation-id": negotiationId,
+			tracks: [...tracks]
+		}
+	};
+}
+function wireIceCandidateFromRtc(candidate) {
+	return {
+		candidate: candidate.candidate,
+		...candidate.sdpMid !== null ? { "sdp-mid": candidate.sdpMid } : {},
+		...candidate.sdpMLineIndex !== null ? { "sdp-m-line-index": candidate.sdpMLineIndex } : {},
+		...candidate.usernameFragment !== null ? { "username-fragment": candidate.usernameFragment } : {}
+	};
+}
+function rtcIceCandidateInitFromWire(wire) {
+	return {
+		candidate: wire.candidate,
+		...wire["sdp-mid"] !== void 0 ? { sdpMid: wire["sdp-mid"] } : {},
+		...wire["sdp-m-line-index"] !== void 0 ? { sdpMLineIndex: wire["sdp-m-line-index"] } : {},
+		...wire["username-fragment"] !== void 0 ? { usernameFragment: wire["username-fragment"] } : {}
+	};
+}
+/** A fresh, independent, monotonically increasing negotiation-id source starting at 0, extracted as its own pure function so id allocation is testable without an RTCPeerConnection or any transport. */
+function createNegotiationIdAllocator() {
+	let next = 0;
+	return () => {
+		const id = next;
+		next += 1;
+		return id;
+	};
+}
+/** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
+async function authorizeIncomingOffer(incoming, options) {
+	if (incoming.token === void 0) return false;
+	const verdict = await verifyCapabilityToken(incoming.token, options);
+	if (!verdict.ok) return false;
+	return verdict.claims.capability === "webrtc:signal" && verdict.claims.scope.kind === WEBRTC_SIGNAL_SCOPE.kind;
+}
+//#endregion
+export { WEBRTC_SIGNAL_SCOPE, WEBRTC_SIGNAL_VERB, authorizeIncomingOffer, buildAnswerCommand, buildIceCandidateCommand, buildOfferCommand, buildSfuTrackMapCommand, createNegotiationIdAllocator, isSfuTrackMap, isWebrtcAnswer, isWebrtcIceCandidate, isWebrtcOffer, rtcIceCandidateInitFromWire, wireIceCandidateFromRtc };