A host may replace its delivery channel after a webview reload without
changing the authenticated epoch. Logout/account replacement must retire
this bridge; Rust capabilities observe that epoch change immediately.
Result of offering one already-admitted, already-protected peer stream to
the OpenRTC-owned native protocol projection. A host must continue its own
protocol dispatch only for Unhandled; there is still exactly one owner of
the underlying incoming-stream queue.
Host-owned private-storage bridge for the OpenRTC 2.0 per-install device
proof key. OpenRTC never receives private key bytes and does not prescribe
an interactive OS credential store. The host exposes only public JWK export
and signing; Plutonium’s current shipping owner is its prompt-free,
app-private store.
Private native relay mechanics boundary. Implementations resolve the
non-secret allocation label to provider credentials inside Rust and never
return those credentials through Tauri IPC.
Host-supplied implementation for a native transport that cannot be bundled
in the publishable Tauri plugin. The OpenRTC constructor remains the sole
activation switch; registering an installer only declares compiled support.