@7h3/protocol 0.1.0

package/index.js

@@ -0,0 +1,1702 @@
+const S = new TextEncoder(), ue = 256, I = /* @__PURE__ */ new Map(), J = 256, M = /* @__PURE__ */ new Map(), k = /* @__PURE__ */ new Map();
+function j() {
+  return globalThis.Buffer ?? null;
+}
+function he(t) {
+  const e = [
+    `"messageId":${JSON.stringify(t.messageId)}`,
+    `"nonce":${JSON.stringify(t.nonce)}`
+  ];
+  return t.recipient !== void 0 && e.push(`"recipient":${JSON.stringify(t.recipient)}`), e.push(`"sender":${JSON.stringify(t.sender)}`), e.push(`"timestampMs":${t.timestampMs}`), e.push(`"ttlMs":${t.ttlMs}`), e.push(`"version":${JSON.stringify(t.version)}`), `{${e.join(",")}}`;
+}
+function fe(t) {
+  const e = [];
+  return t.capability !== void 0 && e.push(`"capability":${JSON.stringify(t.capability)}`), e.push(`"content":${JSON.stringify(t.content)}`), t.correlationId !== void 0 && e.push(`"correlationId":${JSON.stringify(t.correlationId)}`), e.push(`"intent":${JSON.stringify(t.intent)}`), `{${e.join(",")}}`;
+}
+function H(t) {
+  const e = `hs256:${t}`, r = I.get(e);
+  if (r) return r;
+  I.size >= ue && I.clear();
+  const s = b().importKey(
+    "raw",
+    S.encode(t),
+    { name: "HMAC", hash: "SHA-256" },
+    !1,
+    ["sign", "verify"]
+  ).catch((i) => {
+    throw I.delete(e), i;
+  });
+  return I.set(e, s), s;
+}
+function ye(t) {
+  const e = `ed25519:pkcs8:${t}`, r = M.get(e);
+  if (r) return r;
+  M.size >= J && M.clear();
+  const s = b().importKey("pkcs8", V(N(t)), { name: "Ed25519" }, !1, ["sign"]).catch((i) => {
+    throw M.delete(e), i;
+  });
+  return M.set(e, s), s;
+}
+function pe(t) {
+  const e = `ed25519:spki:${t}`, r = k.get(e);
+  if (r) return r;
+  k.size >= J && k.clear();
+  const s = b().importKey("spki", V(N(t)), { name: "Ed25519" }, !1, ["verify"]).catch((i) => {
+    throw k.delete(e), i;
+  });
+  return k.set(e, s), s;
+}
+function C(t) {
+  const e = j();
+  return (e ? e.from(t).toString("base64") : btoa(String.fromCharCode(...t))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function N(t) {
+  const e = t.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(t.length / 4) * 4, "="), r = j();
+  if (r)
+    return new Uint8Array(r.from(e, "base64"));
+  const n = atob(e), s = new Uint8Array(n.length);
+  for (let i = 0; i < n.length; i += 1)
+    s[i] = n.charCodeAt(i);
+  return s;
+}
+function V(t) {
+  return t.buffer.slice(t.byteOffset, t.byteOffset + t.byteLength);
+}
+function A(t) {
+  return `{"body":${fe(t.body)},"header":${he(t.header)}}`;
+}
+function b() {
+  if (typeof crypto > "u" || !crypto.subtle)
+    throw new Error("Web Crypto API is not available in this runtime");
+  return crypto.subtle;
+}
+async function W(t, e) {
+  const r = b(), n = await H(e), s = await r.sign("HMAC", n, S.encode(t));
+  return C(new Uint8Array(s));
+}
+async function G(t, e, r) {
+  const n = b(), s = await H(r), i = N(e);
+  return n.verify("HMAC", s, i.buffer, S.encode(t));
+}
+async function Y(t, e) {
+  const r = b(), n = await ye(e), s = await r.sign("Ed25519", n, S.encode(t));
+  return C(new Uint8Array(s));
+}
+async function X(t, e, r) {
+  const n = b(), s = await pe(r), i = N(e);
+  return n.verify("Ed25519", s, i.buffer, S.encode(t));
+}
+async function ct(t, e) {
+  return W(t, e);
+}
+async function me(t, e, r) {
+  return G(t, e, r);
+}
+async function dt() {
+  const t = b(), e = await t.generateKey({ name: "Ed25519" }, !0, ["sign", "verify"]), r = await t.exportKey("pkcs8", e.privateKey), n = await t.exportKey("spki", e.publicKey);
+  return {
+    privateKey: C(new Uint8Array(r)),
+    publicKey: C(new Uint8Array(n))
+  };
+}
+async function lt(t, e) {
+  return Y(t, e);
+}
+async function ge(t, e, r) {
+  return X(t, e, r);
+}
+async function Q(t, e, r = "local-dev-key") {
+  const n = A(t), s = await W(n, e);
+  return {
+    ...t,
+    signature: {
+      alg: "HS256",
+      keyId: r,
+      value: s
+    }
+  };
+}
+async function we(t, e) {
+  if (!t.signature || t.signature.alg !== "HS256") return !1;
+  const r = {
+    header: t.header,
+    body: t.body
+  }, n = A(r);
+  return G(n, t.signature.value, e);
+}
+async function ut(t, e, r = "local-ed25519-key") {
+  const n = A(t), s = await Y(n, e);
+  return {
+    ...t,
+    signature: {
+      alg: "ED25519",
+      keyId: r,
+      value: s
+    }
+  };
+}
+async function be(t, e) {
+  if (!t.signature || t.signature.alg !== "ED25519") return !1;
+  const r = {
+    header: t.header,
+    body: t.body
+  }, n = A(r);
+  return X(n, t.signature.value, e);
+}
+async function ht(t, e) {
+  return !t.signature || t.signature.alg !== e.alg ? !1 : e.alg === "HS256" ? we(t, e.secret) : be(t, e.publicKey);
+}
+async function ve(t, e, r) {
+  return !e || e.alg !== r.alg ? !1 : r.alg === "HS256" ? me(t, e.value, r.secret) : ge(t, e.value, r.publicKey);
+}
+function Ie(t, e = Date.now()) {
+  const r = [], n = t.header ?? {}, s = t.body ?? {}, i = typeof n.version == "string" ? n.version : "", a = typeof n.messageId == "string" ? n.messageId : "", o = typeof n.sender == "string" ? n.sender : "", l = typeof n.timestampMs == "number" ? n.timestampMs : 0, c = typeof n.ttlMs == "number" ? n.ttlMs : 0, h = typeof s.content == "string" ? s.content : "";
+  return i !== "aip/0.1" && r.push({ level: "error", message: `Unsupported protocol version '${i}'` }), a.trim() || r.push({ level: "error", message: "Missing messageId" }), o.trim() || r.push({ level: "error", message: "Missing sender identity" }), c <= 0 && r.push({ level: "error", message: "ttlMs must be greater than zero" }), l + c < e && r.push({ level: "error", message: "Message TTL expired" }), h.trim() || r.push({ level: "warning", message: "Empty content payload" }), r;
+}
+function P(t) {
+  const e = t.nowMs ?? Date.now();
+  return {
+    header: {
+      version: "aip/0.1",
+      messageId: t.messageId ?? `msg-${e}-${Math.random().toString(36).slice(2, 10)}`,
+      timestampMs: e,
+      ttlMs: t.ttlMs ?? 6e4,
+      sender: t.sender,
+      recipient: t.recipient,
+      nonce: t.nonce ?? Math.random().toString(36).slice(2, 12)
+    },
+    body: {
+      intent: t.intent,
+      content: t.content,
+      capability: t.capability,
+      correlationId: t.correlationId
+    }
+  };
+}
+const Z = [65, 73, 80, 66], D = Uint8Array.from(Z), q = 1, Me = 1024 * 1024, ee = 1, te = 2, re = 4, ne = 8, ke = new TextEncoder(), Se = new TextDecoder(), Ae = /* @__PURE__ */ new Set(["PING", "PONG", "CAPS", "TASK", "RESULT", "ERROR"]);
+function Ee(t) {
+  return ke.encode(t);
+}
+function xe(t) {
+  return Se.decode(t);
+}
+function Re(t) {
+  return t === "ED25519" ? 2 : 1;
+}
+function Ce(t) {
+  return t === 1 ? "HS256" : t === 2 ? "ED25519" : null;
+}
+function g(t) {
+  return { bytes: Ee(t) };
+}
+function w(t) {
+  return t ? 4 + t.bytes.byteLength : 0;
+}
+class Ne {
+  bytes;
+  view;
+  offset = 0;
+  constructor(e) {
+    this.bytes = new Uint8Array(e), this.view = new DataView(this.bytes.buffer, this.bytes.byteOffset, this.bytes.byteLength);
+  }
+  writeU8(e) {
+    this.bytes[this.offset] = e & 255, this.offset += 1;
+  }
+  writeU32(e) {
+    this.view.setUint32(this.offset, e, !1), this.offset += 4;
+  }
+  writeU64(e) {
+    this.view.setBigUint64(this.offset, BigInt(e), !1), this.offset += 8;
+  }
+  writeBytes(e) {
+    this.bytes.set(e, this.offset), this.offset += e.byteLength;
+  }
+  writeString(e) {
+    this.writeU32(e.bytes.byteLength), this.writeBytes(e.bytes);
+  }
+  finish() {
+    return this.bytes;
+  }
+}
+class Pe {
+  bytes;
+  offset = 0;
+  constructor(e) {
+    this.bytes = e;
+  }
+  remaining() {
+    return this.bytes.byteLength - this.offset;
+  }
+  readU8() {
+    if (this.remaining() < 1) throw new Error("Unexpected end of binary envelope");
+    const e = this.bytes[this.offset];
+    return this.offset += 1, e ?? 0;
+  }
+  readU32() {
+    if (this.remaining() < 4) throw new Error("Unexpected end of binary envelope");
+    const e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 4).getUint32(0, !1);
+    return this.offset += 4, e;
+  }
+  readU64() {
+    if (this.remaining() < 8) throw new Error("Unexpected end of binary envelope");
+    const e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 8).getBigUint64(0, !1);
+    return this.offset += 8, Number(e);
+  }
+  readBytes(e) {
+    if (e < 0 || this.remaining() < e) throw new Error("Unexpected end of binary envelope");
+    const r = this.bytes.slice(this.offset, this.offset + e);
+    return this.offset += e, r;
+  }
+  readString() {
+    const e = this.readU32(), r = this.readBytes(e);
+    return xe(r);
+  }
+}
+function Te(t) {
+  const e = (t.header.recipient ? ee : 0) | (t.body.capability ? te : 0) | (t.body.correlationId ? re : 0) | (t.signature ? ne : 0), r = g(t.header.version), n = g(t.header.messageId), s = g(t.header.sender), i = g(t.header.nonce), a = g(t.body.intent), o = g(t.body.content), l = t.header.recipient ? g(t.header.recipient) : null, c = t.body.capability ? g(t.body.capability) : null, h = t.body.correlationId ? g(t.body.correlationId) : null, f = t.signature ? g(t.signature.keyId) : null, y = t.signature ? g(t.signature.value) : null, u = D.byteLength + 1 + 1 + 8 + 4 + w(r) + w(n) + w(s) + w(i) + w(a) + w(o) + w(l) + w(c) + w(h) + (t.signature ? 1 : 0) + w(f) + w(y), d = new Ne(u);
+  return d.writeBytes(D), d.writeU8(q), d.writeU8(e), d.writeU64(t.header.timestampMs), d.writeU32(t.header.ttlMs), d.writeString(r), d.writeString(n), d.writeString(s), d.writeString(i), d.writeString(a), d.writeString(o), l && d.writeString(l), c && d.writeString(c), h && d.writeString(h), t.signature && f && y && (d.writeU8(Re(t.signature.alg)), d.writeString(f), d.writeString(y)), d.finish();
+}
+function _e(t, e = {}) {
+  try {
+    const r = e.maxFrameBytes ?? Me;
+    if (t.byteLength > r)
+      return {
+        ok: !1,
+        diagnostics: [{ level: "error", message: `Binary envelope exceeds maximum frame size '${r}'` }],
+        envelope: null
+      };
+    const n = new Pe(t);
+    if ([n.readU8(), n.readU8(), n.readU8(), n.readU8()].some((h, f) => h !== Z[f]))
+      return {
+        ok: !1,
+        diagnostics: [{ level: "error", message: "Invalid binary envelope magic" }],
+        envelope: null
+      };
+    const i = n.readU8();
+    if (i !== q)
+      return {
+        ok: !1,
+        diagnostics: [{ level: "error", message: `Unsupported binary envelope version '${i}'` }],
+        envelope: null
+      };
+    const a = n.readU8(), o = n.readU64(), l = n.readU32(), c = {
+      header: {
+        version: n.readString(),
+        messageId: n.readString(),
+        timestampMs: o,
+        ttlMs: l,
+        sender: n.readString(),
+        nonce: n.readString()
+      },
+      body: {
+        intent: n.readString(),
+        content: n.readString()
+      }
+    };
+    if (c.header.version !== "aip/0.1")
+      return {
+        ok: !1,
+        diagnostics: [{ level: "error", message: `Unsupported protocol version '${c.header.version}'` }],
+        envelope: null
+      };
+    if (!Ae.has(c.body.intent))
+      return {
+        ok: !1,
+        diagnostics: [{ level: "error", message: `Unsupported intent '${c.body.intent}'` }],
+        envelope: null
+      };
+    if (a & ee && (c.header.recipient = n.readString()), a & te && (c.body.capability = n.readString()), a & re && (c.body.correlationId = n.readString()), a & ne) {
+      const h = n.readU8(), f = Ce(h);
+      if (!f)
+        return {
+          ok: !1,
+          diagnostics: [{ level: "error", message: `Unsupported binary signature algorithm '${h}'` }],
+          envelope: null
+        };
+      c.signature = {
+        alg: f,
+        keyId: n.readString(),
+        value: n.readString()
+      };
+    }
+    return n.remaining() !== 0 ? {
+      ok: !1,
+      diagnostics: [{ level: "error", message: "Trailing bytes found in binary envelope" }],
+      envelope: null
+    } : {
+      ok: !0,
+      diagnostics: [],
+      envelope: c
+    };
+  } catch (r) {
+    return {
+      ok: !1,
+      diagnostics: [{ level: "error", message: r instanceof Error ? r.message : "Invalid binary envelope" }],
+      envelope: null
+    };
+  }
+}
+class $e {
+  items = [];
+  peek() {
+    return this.items[0];
+  }
+  push(e) {
+    this.items.push(e), this.bubbleUp(this.items.length - 1);
+  }
+  pop() {
+    if (this.items.length === 0) return;
+    const e = this.items[0], r = this.items.pop();
+    return this.items.length > 0 && r && (this.items[0] = r, this.bubbleDown(0)), e;
+  }
+  bubbleUp(e) {
+    let r = e;
+    for (; r > 0; ) {
+      const n = Math.floor((r - 1) / 2), s = this.items[n], i = this.items[r];
+      if (!s || !i || s.expiresAt <= i.expiresAt) break;
+      this.items[n] = i, this.items[r] = s, r = n;
+    }
+  }
+  bubbleDown(e) {
+    let r = e;
+    for (; ; ) {
+      const n = r * 2 + 1, s = r * 2 + 2;
+      let i = r;
+      const a = this.items[r], o = this.items[n], l = this.items[s];
+      o && a && o.expiresAt < a.expiresAt && (i = n);
+      const c = this.items[i];
+      if (l && c && l.expiresAt < c.expiresAt && (i = s), i === r) break;
+      const h = this.items[r], f = this.items[i];
+      if (!h || !f) break;
+      this.items[r] = f, this.items[i] = h, r = i;
+    }
+  }
+}
+class T {
+  entries = /* @__PURE__ */ new Map();
+  maxEntries;
+  expiries = new $e();
+  constructor(e = 1e4) {
+    this.maxEntries = e;
+  }
+  makeKey(e) {
+    return `${e.header.sender}|${e.header.messageId}|${e.header.nonce}`;
+  }
+  prune(e = Date.now()) {
+    for (; ; ) {
+      const r = this.expiries.peek();
+      if (!r || r.expiresAt > e) break;
+      this.expiries.pop();
+      const n = this.entries.get(r.key);
+      n !== void 0 && n === r.expiresAt && n <= e && this.entries.delete(r.key);
+    }
+  }
+  evictOne() {
+    for (; this.entries.size >= this.maxEntries; ) {
+      const e = this.expiries.pop();
+      if (!e) break;
+      const r = this.entries.get(e.key);
+      if (r !== void 0 && r === e.expiresAt) {
+        this.entries.delete(e.key);
+        return;
+      }
+    }
+    if (this.entries.size >= this.maxEntries) {
+      const e = this.entries.keys().next().value;
+      e && this.entries.delete(e);
+    }
+  }
+  consume(e, r = Date.now()) {
+    this.prune(r);
+    const n = this.makeKey(e), s = this.entries.get(n);
+    if (s && s > r)
+      return { ok: !1, reason: "Replay detected for sender/messageId/nonce" };
+    this.entries.size >= this.maxEntries && this.evictOne();
+    const i = e.header.timestampMs + e.header.ttlMs;
+    return this.entries.set(n, i), this.expiries.push({ key: n, expiresAt: i }), { ok: !0 };
+  }
+  consumeMany(e, r = Date.now()) {
+    return e.map((n) => this.consume(n, r));
+  }
+}
+class ft {
+  store;
+  constructor(e) {
+    this.store = e;
+  }
+  makeKey(e) {
+    return `${e.header.sender}|${e.header.messageId}|${e.header.nonce}`;
+  }
+  async consume(e, r = Date.now()) {
+    const n = this.makeKey(e), s = e.header.timestampMs + e.header.ttlMs;
+    return await this.store.reserve(n, s, r) ? { ok: !0 } : { ok: !1, reason: "Replay detected for sender/messageId/nonce" };
+  }
+  async consumeMany(e, r = Date.now()) {
+    if (this.store.reserveMany) {
+      const n = e.map((i) => ({
+        key: this.makeKey(i),
+        expiresAtMs: i.header.timestampMs + i.header.ttlMs
+      }));
+      return (await this.store.reserveMany(n, r)).map(
+        (i) => i ? { ok: !0 } : { ok: !1, reason: "Replay detected for sender/messageId/nonce" }
+      );
+    }
+    return Promise.all(e.map((n) => this.consume(n, r)));
+  }
+}
+class Oe {
+  entries = /* @__PURE__ */ new Map();
+  maxEntries;
+  constructor(e = 512) {
+    this.maxEntries = e;
+  }
+  get(e, r = Date.now()) {
+    const n = this.entries.get(e);
+    if (n) {
+      if (n.expiresAtMs <= r) {
+        this.entries.delete(e);
+        return;
+      }
+      return n.material;
+    }
+  }
+  set(e, r, n) {
+    if (this.entries.size >= this.maxEntries) {
+      const s = this.entries.keys().next().value;
+      s && this.entries.delete(s);
+    }
+    this.entries.set(e, { expiresAtMs: n, material: r });
+  }
+  delete(e) {
+    this.entries.delete(e);
+  }
+}
+function Fe(t, e) {
+  return `${e}|${t.alg}|${t.keyId}`;
+}
+function ie(t) {
+  if (!t || typeof t != "object") return !1;
+  const e = t;
+  return !!(e.header && e.body);
+}
+function se(t) {
+  if (!t || typeof t != "object") return !1;
+  const e = t;
+  return e.v === "aip/0.1" && typeof e.mid == "string" && typeof e.i == "string";
+}
+function ae(t) {
+  return {
+    header: {
+      version: t.v,
+      messageId: t.mid,
+      timestampMs: t.ts,
+      ttlMs: t.ttl,
+      sender: t.s,
+      recipient: t.r,
+      nonce: t.n
+    },
+    body: {
+      intent: t.i,
+      content: t.c,
+      capability: t.cap,
+      correlationId: t.cid
+    },
+    signature: t.sig ? {
+      alg: t.sig.a ?? "HS256",
+      keyId: t.sig.k,
+      value: t.sig.v
+    } : void 0
+  };
+}
+function oe(t) {
+  return {
+    v: t.header.version,
+    mid: t.header.messageId,
+    ts: t.header.timestampMs,
+    ttl: t.header.ttlMs,
+    s: t.header.sender,
+    r: t.header.recipient,
+    n: t.header.nonce,
+    i: t.body.intent,
+    c: t.body.content,
+    cap: t.body.capability,
+    cid: t.body.correlationId,
+    sig: t.signature ? {
+      a: t.signature.alg,
+      k: t.signature.keyId,
+      v: t.signature.value
+    } : void 0
+  };
+}
+function Ke(t) {
+  if (t instanceof Uint8Array)
+    return _e(t);
+  try {
+    const e = JSON.parse(t);
+    return se(e) ? { ok: !0, diagnostics: [], envelope: ae(e) } : ie(e) ? { ok: !0, diagnostics: [], envelope: e } : {
+      ok: !1,
+      diagnostics: [{ level: "error", message: "Envelope JSON shape is not recognized" }],
+      envelope: null
+    };
+  } catch {
+    return {
+      ok: !1,
+      diagnostics: [{ level: "error", message: "Invalid JSON envelope" }],
+      envelope: null
+    };
+  }
+}
+function U(t, e = "json") {
+  return e === "binary" ? Te(t) : JSON.stringify(e === "compact" ? oe(t) : t);
+}
+function yt(t, e = "compact") {
+  return JSON.stringify(e === "compact" ? t.map(oe) : t);
+}
+function Ue(t) {
+  try {
+    const e = JSON.parse(t);
+    return Array.isArray(e) ? e.map((r) => se(r) ? { ok: !0, diagnostics: [], envelope: ae(r) } : ie(r) ? { ok: !0, diagnostics: [], envelope: r } : {
+      ok: !1,
+      diagnostics: [{ level: "error", message: "Batch item has unrecognized envelope shape" }],
+      envelope: null
+    }) : [
+      {
+        ok: !1,
+        diagnostics: [{ level: "error", message: "Batch payload must be a JSON array" }],
+        envelope: null
+      }
+    ];
+  } catch {
+    return [
+      {
+        ok: !1,
+        diagnostics: [{ level: "error", message: "Invalid JSON batch payload" }],
+        envelope: null
+      }
+    ];
+  }
+}
+async function E(t, e = {}) {
+  const r = e.nowMs ?? Date.now(), n = e.requireSignature ?? !0, s = e.maxClockSkewMs ?? 3e4;
+  async function i(u) {
+    e.telemetry && await e.telemetry({
+      nowMs: r,
+      ...u
+    });
+  }
+  const a = typeof t == "string" || t instanceof Uint8Array ? Ke(t) : { ok: !0, diagnostics: [], envelope: t };
+  if (!a.ok || !a.envelope) return a;
+  if (await i({
+    phase: "decoded",
+    sender: a.envelope.header.sender,
+    messageId: a.envelope.header.messageId
+  }), a.envelope.header.timestampMs > r + s) {
+    const u = "Message timestamp exceeds allowed clock skew", d = [{ level: "error", message: u }];
+    return await i({
+      phase: "rejected_clock_skew",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId,
+      reason: u
+    }), { ok: !1, diagnostics: d, envelope: a.envelope };
+  }
+  const o = [...Ie(a.envelope, r)];
+  if (o.some((u) => u.level === "error"))
+    return await i({
+      phase: "rejected_validation",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId,
+      reason: o.find((u) => u.level === "error")?.message
+    }), { ok: !1, diagnostics: o, envelope: a.envelope };
+  if (!a.envelope.signature)
+    return n ? (o.push({ level: "error", message: "Missing signature" }), await i({
+      phase: "rejected_missing_signature",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId,
+      reason: "Missing signature"
+    }), { ok: !1, diagnostics: o, envelope: a.envelope }) : (await i({
+      phase: "accepted",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId
+    }), { ok: !0, diagnostics: o, envelope: a.envelope });
+  let l;
+  const c = a.envelope.signature, h = Fe(c, a.envelope.header.sender);
+  if (e.verificationMaterialCache && (l = e.verificationMaterialCache.get(h, r)), e.signatureResolver && (l = l ?? await e.signatureResolver(c, a.envelope.header.sender)), !l && c.alg === "HS256" && e.secretResolver) {
+    const u = await e.secretResolver(c.keyId, a.envelope.header.sender);
+    u && (l = { alg: "HS256", secret: u });
+  }
+  if (l && e.verificationMaterialCache) {
+    const u = Math.max(r + 1, a.envelope.header.timestampMs + a.envelope.header.ttlMs);
+    e.verificationMaterialCache.set(h, l, u);
+  }
+  if (!l)
+    return o.push({ level: "error", message: "No signature verification material found for keyId/sender" }), await i({
+      phase: "rejected_missing_material",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId,
+      reason: "No signature verification material found for keyId/sender"
+    }), { ok: !1, diagnostics: o, envelope: a.envelope };
+  const f = A({ header: a.envelope.header, body: a.envelope.body });
+  if (!await ve(f, a.envelope.signature, l))
+    return o.push({ level: "error", message: "Signature verification failed" }), await i({
+      phase: "rejected_bad_signature",
+      sender: a.envelope.header.sender,
+      messageId: a.envelope.header.messageId,
+      reason: "Signature verification failed"
+    }), { ok: !1, diagnostics: o, envelope: a.envelope };
+  if (e.replayCache) {
+    const u = await e.replayCache.consume(a.envelope, r);
+    if (!u.ok)
+      return o.push({ level: "error", message: u.reason ?? "Replay detected" }), await i({
+        phase: "rejected_replay",
+        sender: a.envelope.header.sender,
+        messageId: a.envelope.header.messageId,
+        reason: u.reason
+      }), { ok: !1, diagnostics: o, envelope: a.envelope };
+  }
+  return await i({
+    phase: "accepted",
+    sender: a.envelope.header.sender,
+    messageId: a.envelope.header.messageId
+  }), { ok: !0, diagnostics: o, envelope: a.envelope };
+}
+async function De(t, e = {}) {
+  const r = Math.max(1, Math.floor(e.batchConcurrency ?? Number.POSITIVE_INFINITY)), n = async (s) => {
+    const i = new Array(s.length);
+    let a = 0;
+    const o = Number.isFinite(r) ? Math.min(r, s.length) : s.length;
+    return await Promise.all(
+      Array.from({ length: o }, async () => {
+        for (; a < s.length; ) {
+          const l = a;
+          a += 1;
+          const c = s[l];
+          c && typeof c == "object" && "ok" in c && "diagnostics" in c && "envelope" in c ? i[l] = c : i[l] = await E(c, e);
+        }
+      })
+    ), await e.telemetry?.({
+      phase: "batch_summary",
+      nowMs: e.nowMs ?? Date.now(),
+      reason: `items=${s.length};accepted=${i.filter((l) => l?.ok).length}`
+    }), i;
+  };
+  if (typeof t == "string") {
+    const s = Ue(t);
+    return n(s.map((i) => i.ok && i.envelope ? i.envelope : i));
+  }
+  return n(t);
+}
+class pt {
+  options;
+  constructor(e = {}) {
+    this.options = {
+      ...e,
+      replayCache: e.replayCache ?? new T(),
+      verificationMaterialCache: e.verificationMaterialCache ?? new Oe()
+    };
+  }
+  receive(e, r = Date.now()) {
+    return E(e, { ...this.options, nowMs: r });
+  }
+  receiveBatch(e, r = Date.now()) {
+    return De(e, { ...this.options, nowMs: r });
+  }
+}
+async function mt(t) {
+  const e = P(t);
+  return Q(e, t.secret, t.keyId);
+}
+const Be = ["binary", "compact", "json"], Le = ["fast", "receipt"];
+function ze(t) {
+  return {
+    agent: t.agent,
+    capabilities: t.capabilities ?? [],
+    wireFormats: t.wireFormats ?? ["compact", "json"],
+    batchMax: t.batchMax ?? 1,
+    ackModes: t.ackModes ?? ["receipt"]
+  };
+}
+function Je(t) {
+  return JSON.stringify(t);
+}
+function gt(t) {
+  try {
+    const e = JSON.parse(t);
+    return typeof e.agent != "string" || !Array.isArray(e.capabilities) || !Array.isArray(e.wireFormats) || !Array.isArray(e.ackModes) || typeof e.batchMax != "number" || e.batchMax < 1 ? null : {
+      agent: e.agent,
+      capabilities: e.capabilities.filter((r) => typeof r == "string"),
+      wireFormats: e.wireFormats.filter((r) => r === "json" || r === "compact" || r === "binary"),
+      batchMax: Math.floor(e.batchMax),
+      ackModes: e.ackModes.filter((r) => r === "fast" || r === "receipt")
+    };
+  } catch {
+    return null;
+  }
+}
+function wt(t, e) {
+  const r = Be.find((s) => t.wireFormats.includes(s) && e.wireFormats.includes(s)) ?? "compact", n = Le.find((s) => t.ackModes.includes(s) && e.ackModes.includes(s)) ?? "receipt";
+  return {
+    wireFormat: r,
+    batchMax: Math.max(1, Math.min(t.batchMax, e.batchMax)),
+    ackMode: n
+  };
+}
+class bt {
+  records;
+  constructor(e = []) {
+    this.records = [...e];
+  }
+  add(e) {
+    this.records.push(e);
+  }
+  revoke(e, r, n = Date.now()) {
+    const s = this.records.find((i) => i.sender === e && i.keyId === r);
+    return s ? (s.status = "revoked", s.notAfterMs = Math.min(s.notAfterMs, n), !0) : !1;
+  }
+  selectSigningKey(e, r, n = Date.now()) {
+    return this.records.filter(
+      (i) => i.sender === e && i.alg === r && i.status === "active" && i.notBeforeMs <= n && n < i.notAfterMs
+    ).sort((i, a) => a.notBeforeMs - i.notBeforeMs)[0] ?? null;
+  }
+  resolveVerificationMaterial(e, r, n = Date.now()) {
+    return this.records.filter(
+      (i) => i.sender === r && i.keyId === e.keyId && i.alg === e.alg && i.status !== "revoked" && i.notBeforeMs <= n && n < i.notAfterMs
+    ).sort((i, a) => a.notBeforeMs - i.notBeforeMs)[0]?.material;
+  }
+}
+function vt(t, e = () => Date.now()) {
+  return async (r, n) => t.resolveVerificationMaterial(r, n, e());
+}
+class je {
+  agentId;
+  outboundSecret;
+  keyId;
+  capabilities;
+  supportedWireFormats;
+  maxBatchSize;
+  ackModes;
+  requireSignature;
+  replayCache;
+  sharedSecrets;
+  resolveInboundSecret;
+  onTask;
+  constructor(e) {
+    this.agentId = e.agentId, this.outboundSecret = e.outboundSecret, this.keyId = e.keyId ?? `${e.agentId}-k1`, this.capabilities = e.capabilities ?? [], this.supportedWireFormats = e.supportedWireFormats ?? ["compact", "json"], this.maxBatchSize = e.maxBatchSize ?? 1, this.ackModes = e.ackModes ?? ["receipt"], this.requireSignature = e.requireSignature ?? !0, this.replayCache = e.replayCache ?? new T(), this.sharedSecrets = e.sharedSecrets ?? {}, this.resolveInboundSecret = e.resolveInboundSecret, this.onTask = e.onTask;
+  }
+  async inboundSecretResolver(e, r) {
+    return this.resolveInboundSecret ? this.resolveInboundSecret(e, r) : this.sharedSecrets[r];
+  }
+  async createSignedIntent(e) {
+    const r = P({
+      sender: this.agentId,
+      recipient: e.recipient,
+      intent: e.intent,
+      content: e.content,
+      capability: e.capability,
+      correlationId: e.correlationId,
+      ttlMs: e.ttlMs,
+      messageId: e.messageId,
+      nonce: e.nonce,
+      nowMs: e.nowMs
+    });
+    return Q(r, this.outboundSecret, this.keyId);
+  }
+  async receiveAndRespond(e, r = Date.now()) {
+    const n = await E(e, {
+      nowMs: r,
+      requireSignature: this.requireSignature,
+      replayCache: this.replayCache,
+      secretResolver: (a, o) => this.inboundSecretResolver(a, o)
+    });
+    if (!n.ok || !n.envelope)
+      return {
+        ok: !1,
+        diagnostics: n.diagnostics,
+        received: n.envelope,
+        response: null
+      };
+    const s = n.envelope, i = await this.buildAutoResponse(s, r);
+    return {
+      ok: !0,
+      diagnostics: n.diagnostics,
+      received: s,
+      response: i
+    };
+  }
+  async buildAutoResponse(e, r) {
+    if (e.body.intent === "PING")
+      return this.createSignedIntent({
+        recipient: e.header.sender,
+        intent: "PONG",
+        content: "pong",
+        correlationId: e.header.messageId,
+        nowMs: r
+      });
+    if (e.body.intent === "CAPS")
+      return this.createSignedIntent({
+        recipient: e.header.sender,
+        intent: "RESULT",
+        content: Je(
+          ze({
+            agent: this.agentId,
+            capabilities: this.capabilities,
+            wireFormats: this.supportedWireFormats,
+            batchMax: this.maxBatchSize,
+            ackModes: this.ackModes
+          })
+        ),
+        capability: "caps",
+        correlationId: e.header.messageId,
+        nowMs: r
+      });
+    if (e.body.intent === "TASK") {
+      const n = this.onTask ? await this.onTask(e) : { intent: "RESULT", content: "ACK", capability: e.body.capability };
+      return this.createSignedIntent({
+        recipient: e.header.sender,
+        intent: n.intent ?? "RESULT",
+        content: n.content,
+        capability: n.capability,
+        correlationId: e.header.messageId,
+        nowMs: r
+      });
+    }
+    return null;
+  }
+}
+class He {
+  session;
+  wireFormat;
+  constructor(e) {
+    this.session = new je(e), this.wireFormat = e.wireFormat ?? "compact";
+  }
+  toRaw(e) {
+    return U(e, this.wireFormat);
+  }
+  async createRawIntent(e) {
+    const r = await this.session.createSignedIntent(e);
+    return this.toRaw(r);
+  }
+  async receiveRaw(e, r = Date.now()) {
+    return this.session.receiveAndRespond(e, r);
+  }
+  async handleRaw(e, r, n = Date.now()) {
+    const s = await this.session.receiveAndRespond(e, n);
+    return s.response && await r(this.toRaw(s.response), s.response), s;
+  }
+}
+function B(t) {
+  return new He(t);
+}
+async function It(t, e, r = {}) {
+  return t.createRawIntent({
+    recipient: r.recipient,
+    intent: "TASK",
+    content: e.content,
+    capability: r.capability,
+    correlationId: r.correlationId
+  });
+}
+function Mt(t) {
+  return {
+    content: t.body.content,
+    name: t.body.intent,
+    additionalKwargs: {
+      capability: t.body.capability,
+      correlationId: t.body.correlationId,
+      sender: t.header.sender,
+      recipient: t.header.recipient,
+      messageId: t.header.messageId,
+      timestampMs: t.header.timestampMs
+    }
+  };
+}
+async function kt(t, e, r = {}) {
+  return t.createRawIntent({
+    recipient: r.recipient,
+    intent: "TASK",
+    content: e.content,
+    capability: r.capability,
+    correlationId: r.correlationId
+  });
+}
+function St(t) {
+  return {
+    role: t.body.intent === "TASK" ? "user" : "assistant",
+    content: t.body.content,
+    additionalKwargs: {
+      intent: t.body.intent,
+      capability: t.body.capability,
+      correlationId: t.body.correlationId,
+      sender: t.header.sender,
+      recipient: t.header.recipient
+    }
+  };
+}
+function L(t) {
+  return `mcp.${t}`;
+}
+async function Ve(t, e, r = {}) {
+  async function n(a) {
+    r.onPolicyEvent && await r.onPolicyEvent(a);
+  }
+  if (r.allowedMethods && !r.allowedMethods.includes(e.method)) {
+    const a = r.methodToCapability ? r.methodToCapability(e.method) : L(e.method), o = {
+      intent: "TASK",
+      recipient: r.recipient,
+      capability: a,
+      correlationId: String(e.id),
+      createdAtMs: Date.now()
+    };
+    throw await n({
+      stage: "allowlist",
+      decision: "deny",
+      method: e.method,
+      context: o,
+      reason: "method_not_allowed"
+    }), new Error(`JSON-RPC method '${e.method}' is not allowed`);
+  }
+  const s = r.methodToCapability ? r.methodToCapability(e.method) : L(e.method), i = {
+    intent: "TASK",
+    recipient: r.recipient,
+    capability: s,
+    correlationId: String(e.id),
+    createdAtMs: Date.now()
+  };
+  if (await n({
+    stage: "allowlist",
+    decision: "allow",
+    method: e.method,
+    context: i
+  }), r.authorizeMethod) {
+    if (!await r.authorizeMethod(e, i))
+      throw await n({
+        stage: "authorize",
+        decision: "deny",
+        method: e.method,
+        context: i,
+        reason: "not_authorized"
+      }), new Error(`JSON-RPC method '${e.method}' is not authorized`);
+    await n({
+      stage: "authorize",
+      decision: "allow",
+      method: e.method,
+      context: i
+    });
+  }
+  if (r.rateLimiter) {
+    const a = r.rateLimitKey ? r.rateLimitKey(e, i) : e.method;
+    if (!await r.rateLimiter.consume(a, e, i))
+      throw await n({
+        stage: "rateLimit",
+        decision: "deny",
+        method: e.method,
+        context: i,
+        reason: "rate_limited"
+      }), new Error(`JSON-RPC method '${e.method}' is rate-limited`);
+    await n({
+      stage: "rateLimit",
+      decision: "allow",
+      method: e.method,
+      context: i
+    });
+  }
+  return t.createRawIntent({
+    recipient: r.recipient,
+    intent: "TASK",
+    capability: s,
+    correlationId: String(e.id),
+    content: JSON.stringify({ method: e.method, params: e.params ?? null })
+  });
+}
+function We(t, e, r = {}) {
+  if (t.body.intent === "ERROR")
+    return {
+      jsonrpc: "2.0",
+      id: e,
+      error: {
+        code: r.defaultErrorCode ?? -32e3,
+        message: t.body.content,
+        data: {
+          capability: t.body.capability,
+          correlationId: t.body.correlationId
+        }
+      }
+    };
+  let n = t.body.content;
+  try {
+    n = JSON.parse(t.body.content);
+  } catch {
+    n = t.body.content;
+  }
+  return {
+    jsonrpc: "2.0",
+    id: e,
+    result: n
+  };
+}
+function Ge(t) {
+  return typeof t == "object" && t !== null && !Array.isArray(t);
+}
+function $(t, e) {
+  if (typeof t != "string" || t.trim().length === 0)
+    throw new Error(`Invalid runtime policy: '${e}' must be a non-empty string`);
+  return t;
+}
+function Ye(t) {
+  if (!Ge(t))
+    throw new Error("Invalid runtime policy: root must be an object");
+  const e = $(t.version, "version"), r = $(t.name, "name"), n = $(t.status, "status");
+  return {
+    ...t,
+    version: e,
+    name: r,
+    status: n
+  };
+}
+function Xe(t) {
+  let e;
+  try {
+    e = JSON.parse(t);
+  } catch (r) {
+    const n = r instanceof Error ? r.message : String(r);
+    throw new Error(`Invalid runtime policy JSON: ${n}`);
+  }
+  return Ye(e);
+}
+async function Qe(t) {
+  if (typeof fetch == "function") {
+    const e = await fetch(t);
+    if (!e.ok)
+      throw new Error(`Failed to fetch runtime policy at '${t}': ${e.status} ${e.statusText}`);
+    return e.text();
+  }
+  throw new Error(
+    "No default runtime file reader available in this environment. Provide 'readTextFile' in loadRuntimePolicy(options)."
+  );
+}
+async function Ze(t = {}) {
+  const e = t.path ?? "AI_RUNTIME_POLICY.json", n = await (t.readTextFile ?? Qe)(e);
+  return Xe(n);
+}
+function O(t, e) {
+  if (!Array.isArray(t) || t.length !== 2)
+    throw new Error(`Invalid policy tuning range '${e}': expected [min,max]`);
+  const r = Number(t[0]), n = Number(t[1]);
+  if (!Number.isFinite(r) || !Number.isFinite(n) || r <= 0 || n < r)
+    throw new Error(`Invalid policy tuning range '${e}': expected positive ascending numbers`);
+  return [Math.floor(r), Math.floor(n)];
+}
+function qe(t) {
+  return t === "http" || t === "ws" || t === "http-binary" || t === "http-batch" || t === "http-binary-batch" || t === "ws-batch" || t === "ws-binary" || t === "ws-binary-batch";
+}
+function et(t) {
+  const e = Number((t.slo_defaults ?? {}).drop_pct_max ?? 0.1), r = Number((t.slo_defaults ?? {}).p99_ms_max ?? 20), n = Number((t.tuning ?? {}).max_retry_attempts ?? 3), s = Array.isArray((t.tuning ?? {}).retriable_status_codes) ? (t.tuning ?? {}).retriable_status_codes.map((d) => Number(d)).filter((d) => Number.isFinite(d)) : [503], i = t.tuning ?? {}, a = i.batch_size, o = i.inflight_cap, l = i.retry_backoff_ms, c = (d) => ({
+    batchSizeRange: O(a?.[`${d}_traffic`], `batch_size.${d}_traffic`),
+    inflightCapRange: O(o?.[`${d}_traffic`], `inflight_cap.${d}_traffic`),
+    retryBackoffMsRange: O(l?.[`${d}_traffic`], `retry_backoff_ms.${d}_traffic`)
+  });
+  function h(d) {
+    return d.concurrency >= 100 ? "http-binary-batch" : d.latencySensitive ? "ws-batch" : d.compatibilityFirst ? "http" : "ws-batch";
+  }
+  function f(d) {
+    const p = c(d.trafficClass), m = [];
+    return typeof d.dropPct == "number" && d.dropPct > e && (m.push("reduce inflight cap"), m.push("reduce batch size"), m.push("increase retry backoff"), m.push("switch to binary-batch mode")), typeof d.p99Ms == "number" && d.p99Ms > r && (m.push("reduce batch size"), m.push("reduce inflight cap"), m.push("re-run adaptive benchmark")), {
+      ...p,
+      actions: m
+    };
+  }
+  function y(d) {
+    if (d.attempt >= n) return !1;
+    const p = d.error instanceof Error ? d.error.message : String(d.error), m = /http status\s+(\d+)/i.exec(p), v = m ? Number(m[1]) : NaN;
+    return Number.isFinite(v) && s.includes(v);
+  }
+  function u(d) {
+    const p = [];
+    if (d.signatureVerification || p.push("signatureVerification=false"), d.canonicalization || p.push("canonicalization=false"), d.replayDefense || p.push("replayDefense=false"), d.ttlClockSkewEnforcement || p.push("ttlClockSkewEnforcement=false"), p.length > 0)
+      throw new Error(`Invariant violation: ${p.join(", ")}`);
+  }
+  return {
+    selectMode: h,
+    tune: f,
+    shouldRetry: y,
+    assertInvariant: u,
+    metadata: {
+      policyName: t.name,
+      policyVersion: t.version,
+      policyStatus: t.status,
+      enforcedSlo: {
+        dropPctMax: e,
+        p99MsMax: r
+      }
+    }
+  };
+}
+async function F(t = {}) {
+  const e = await Ze(t), r = et(e);
+  return { policy: e, enforcer: r };
+}
+function At(t) {
+  return qe(t);
+}
+const tt = ["tools/call", "resources/read", "prompts/get"];
+function K(t) {
+  return JSON.stringify(t);
+}
+function x(t, e, r) {
+  return K({
+    jsonrpc: "2.0",
+    id: t,
+    error: { code: e, message: r }
+  });
+}
+function rt(t) {
+  const e = JSON.parse(t);
+  return e.jsonrpc !== "2.0" || typeof e.method != "string" || e.method.length === 0 || typeof e.id != "string" && typeof e.id != "number" ? null : {
+    jsonrpc: "2.0",
+    id: e.id,
+    method: e.method,
+    params: e.params
+  };
+}
+function nt(t) {
+  return t.includes("not allowed") ? -32601 : t.includes("not authorized") ? -32001 : t.includes("rate-limited") ? -32002 : -32603;
+}
+function z(t) {
+  const e = t.gatewayAgentId ?? "agent.gateway", r = t.workerAgentId ?? "agent.worker", n = t.allowedMethods ?? tt, s = t.workerCapabilityPrefix ?? "mcp.", i = t.gatewayWireFormat ?? "compact", a = t.workerWireFormat ?? "compact";
+  async function o(h) {
+    t.onAuditEvent && await t.onAuditEvent({
+      ...h,
+      timestampMs: Date.now()
+    });
+  }
+  const l = B({
+    agentId: e,
+    outboundSecret: t.sharedSecret,
+    sharedSecrets: { [r]: t.sharedSecret },
+    wireFormat: i
+  }), c = B({
+    agentId: r,
+    outboundSecret: t.sharedSecret,
+    sharedSecrets: { [e]: t.sharedSecret },
+    wireFormat: a,
+    onTask: async (h) => ({
+      intent: "RESULT",
+      content: K({
+        ok: !0,
+        capability: h.body.capability,
+        content: h.body.content
+      }),
+      capability: h.body.capability?.startsWith(s) ? h.body.capability : `${s}${h.body.capability ?? "unknown"}`
+    })
+  });
+  return {
+    async handleLine(h) {
+      const f = h.trim();
+      if (!f) return null;
+      let y = null;
+      try {
+        const u = rt(f);
+        if (!u)
+          return await o({
+            phase: "request_error",
+            code: -32600,
+            message: "Invalid Request"
+          }), x(null, -32600, "Invalid Request");
+        y = u.id, await o({
+          phase: "request_received",
+          id: u.id,
+          method: u.method
+        });
+        const d = {
+          recipient: r,
+          allowedMethods: n,
+          methodToCapability: t.methodToCapability,
+          authorizeMethod: t.authorizeMethod,
+          rateLimitKey: t.rateLimitKey,
+          rateLimiter: t.rateLimiter,
+          onPolicyEvent: async (_) => {
+            await o({
+              phase: "policy",
+              id: u.id,
+              method: u.method,
+              policy: _
+            });
+          }
+        }, p = await Ve(l, u, d);
+        let m = null;
+        if (await c.handleRaw(p, async (_) => {
+          m = _;
+        }), !m)
+          return await o({
+            phase: "verification_failed",
+            id: u.id,
+            method: u.method,
+            code: -32603,
+            message: "AIP worker did not produce a response"
+          }), x(y, -32603, "AIP worker did not produce a response");
+        const v = await l.receiveRaw(m);
+        return !v.ok || !v.received ? (await o({
+          phase: "verification_failed",
+          id: u.id,
+          method: u.method,
+          code: -32603,
+          message: "AIP verification failed"
+        }), x(y, -32603, "AIP verification failed")) : (await o({
+          phase: "request_success",
+          id: u.id,
+          method: u.method
+        }), K(We(v.received, u.id)));
+      } catch (u) {
+        const d = u instanceof Error ? u.message : "Internal error", p = nt(d);
+        return await o({
+          phase: "request_error",
+          id: y,
+          code: p,
+          message: d
+        }), x(y, p, d);
+      }
+    }
+  };
+}
+async function Et(t) {
+  if (!t.runtimePolicy?.enabled)
+    return z(t);
+  const { enforcer: e } = await F(t.runtimePolicy.options);
+  e.assertInvariant({
+    signatureVerification: !0,
+    canonicalization: !0,
+    replayDefense: !0,
+    ttlClockSkewEnforcement: !0
+  });
+  const r = e.selectMode({
+    concurrency: t.runtimePolicy.concurrencyHint ?? 1,
+    latencySensitive: t.runtimePolicy.latencySensitive,
+    compatibilityFirst: t.runtimePolicy.compatibilityFirst
+  }), n = r.includes("binary") ? "binary" : "compact";
+  return z({
+    ...t,
+    gatewayWireFormat: n,
+    workerWireFormat: n,
+    gatewayAgentId: t.gatewayAgentId,
+    workerAgentId: t.workerAgentId,
+    onAuditEvent: async (s) => {
+      t.onAuditEvent && await t.onAuditEvent({
+        ...s,
+        message: s.message ?? `policy-mode=${r};wire-format=${n}`
+      });
+    }
+  });
+}
+class xt {
+  snapshot = null;
+  options;
+  constructor(e = {}) {
+    this.options = e;
+  }
+  async loadInitial() {
+    const e = await F(this.options);
+    return this.snapshot = {
+      ...e,
+      loadedAtMs: Date.now()
+    }, this.snapshot;
+  }
+  current() {
+    if (!this.snapshot)
+      throw new Error("Runtime policy not loaded. Call loadInitial() first.");
+    return this.snapshot;
+  }
+  async refresh() {
+    const e = this.snapshot;
+    try {
+      const r = await F(this.options);
+      return this.snapshot = {
+        ...r,
+        loadedAtMs: Date.now()
+      }, this.snapshot;
+    } catch (r) {
+      if (e)
+        return e;
+      throw r;
+    }
+  }
+}
+const it = {
+  dev: {
+    environment: "dev",
+    mode: "ws-batch",
+    poolSize: 1,
+    batchSize: 8,
+    inflightCap: 64,
+    retryMaxAttempts: 2
+  },
+  staging: {
+    environment: "staging",
+    mode: "http-binary-batch",
+    poolSize: 2,
+    batchSize: 32,
+    inflightCap: 256,
+    retryMaxAttempts: 3
+  },
+  prod: {
+    environment: "prod",
+    mode: "http-binary-batch",
+    poolSize: 4,
+    batchSize: 64,
+    inflightCap: 1024,
+    retryMaxAttempts: 3
+  }
+};
+function Rt(t) {
+  return it[t];
+}
+function Ct(t) {
+  const e = [];
+  let r = "normal";
+  return t.dropPct > 0.1 && (e.push("reduce inflight cap"), e.push("reduce batch size"), e.push("increase retry backoff"), t.mode === "http" && t.concurrency >= 100 && e.push("switch to http-binary-batch"), r = t.dropPct > 2 ? "critical" : "warn"), t.p99Ms > 20 && (e.push("reduce batch size"), e.push("run adaptive benchmark and re-baseline"), r === "normal" && (r = "warn"), t.p99Ms > 100 && (r = "critical")), {
+    severity: r,
+    actions: e
+  };
+}
+class st {
+  entries = /* @__PURE__ */ new Map();
+  now;
+  constructor(e = {}) {
+    this.now = e.now ?? (() => Date.now());
+  }
+  live(e) {
+    const r = this.entries.get(e);
+    if (r) {
+      if (r.expiresAt !== void 0 && r.expiresAt <= this.now()) {
+        this.entries.delete(e);
+        return;
+      }
+      return r;
+    }
+  }
+  async set(e, r, n = {}) {
+    if (n.nx && this.live(e)) return null;
+    const s = n.pxMs !== void 0 ? this.now() + n.pxMs : void 0;
+    return this.entries.set(e, { value: r, expiresAt: s }), "OK";
+  }
+  async get(e) {
+    return this.live(e)?.value ?? null;
+  }
+  async del(e) {
+    const r = this.live(e) !== void 0;
+    return this.entries.delete(e), r ? 1 : 0;
+  }
+  pipeline() {
+    const e = [], r = {
+      set: (n, s, i) => (e.push({ key: n, value: s, options: i }), r),
+      exec: async () => {
+        const n = [];
+        for (const s of e)
+          n.push(await this.set(s.key, s.value, s.options));
+        return n;
+      }
+    };
+    return r;
+  }
+}
+function at(t, e = {}) {
+  const r = e.keyPrefix ?? "aip:replay:", n = e.errorBehavior ?? "fallback", s = e.onDegraded, i = e.fallback ?? (n === "fallback" ? (
+    // The local fallback runs over a non-throwing in-memory client, so it
+    // needs no fallback of its own — `reject` terminates the chain.
+    at(new st(), { keyPrefix: r, errorBehavior: "reject" })
+  ) : void 0);
+  function a(o, l, c, h) {
+    return s?.(o, { key: l, behavior: n }), n === "allow" ? !0 : n === "reject" ? !1 : i ? i.reserve(l, c, h) : !1;
+  }
+  return {
+    async reserve(o, l, c) {
+      const h = Math.max(1, l - c);
+      try {
+        return await t.set(`${r}${o}`, "1", { nx: !0, pxMs: h }) === "OK";
+      } catch (f) {
+        return a(f, o, l, c);
+      }
+    },
+    async reserveMany(o, l) {
+      if (o.length === 0) return [];
+      if (t.pipeline)
+        try {
+          const c = t.pipeline();
+          for (const { key: f, expiresAtMs: y } of o)
+            c.set(`${r}${f}`, "1", { nx: !0, pxMs: Math.max(1, y - l) });
+          return (await c.exec()).map((f) => f === "OK");
+        } catch (c) {
+          return Promise.all(o.map((h) => a(c, h.key, h.expiresAtMs, l)));
+        }
+      return Promise.all(o.map((c) => this.reserve(c.key, c.expiresAtMs, l)));
+    }
+  };
+}
+class Nt {
+  /** keyId map value: revoked-until timestamp, or `Infinity` for permanent. */
+  revoked = /* @__PURE__ */ new Map();
+  now;
+  constructor(e = {}) {
+    this.now = e.now ?? (() => Date.now());
+  }
+  makeKey(e, r) {
+    return `${e}\0${r}`;
+  }
+  isRevoked(e, r, n = this.now()) {
+    const s = this.revoked.get(this.makeKey(e, r));
+    return s === void 0 ? !1 : s <= n ? (this.revoked.delete(this.makeKey(e, r)), !1) : !0;
+  }
+  revoke(e, r, n = {}) {
+    this.revoked.set(this.makeKey(e, r), n.untilMs ?? Number.POSITIVE_INFINITY);
+  }
+}
+function Pt(t, e = {}) {
+  const r = e.keyPrefix ?? "aip:revoked:", n = e.errorBehavior ?? "reject", s = e.cacheTtlMs ?? 5e3, i = e.onDegraded, a = e.now ?? (() => Date.now()), o = /* @__PURE__ */ new Map();
+  function l(c, h) {
+    return `${r}${c}\0${h}`;
+  }
+  return {
+    async isRevoked(c, h, f = a()) {
+      const y = l(c, h), u = o.get(y);
+      if (u && u.freshUntil > f) return u.revoked;
+      try {
+        if (!t.get) throw new Error("RedisLikeClient.get is required for revocation reads");
+        const p = await t.get(y) !== null;
+        return o.set(y, { revoked: p, freshUntil: f + s }), p;
+      } catch (d) {
+        return i?.(d, { sender: c, keyId: h }), u ? u.revoked : n === "reject";
+      }
+    },
+    async revoke(c, h, f = {}) {
+      const y = l(c, h), u = f.untilMs !== void 0 ? Math.max(1, f.untilMs - a()) : void 0;
+      await t.set(y, "1", u !== void 0 ? { pxMs: u } : void 0), o.set(y, { revoked: !0, freshUntil: a() + s });
+    }
+  };
+}
+function Tt(t, e, r = {}) {
+  const n = r.nowMsProvider ?? (() => Date.now());
+  return async (s, i) => {
+    if (!await e.isRevoked(i, s.keyId, n()))
+      return t(s, i);
+  };
+}
+function R(t, e, r) {
+  return { jsonrpc: "2.0", id: t, error: { code: e, message: r } };
+}
+function ce(t, e) {
+  return { requireSignature: !0, ...t.receive, replayCache: e };
+}
+function _t(t, e) {
+  const r = e.wireFormat ?? "compact", n = e.ttlMs ?? 6e4, s = e.receive?.replayCache ?? new T(), i = ce(e, s);
+  async function a(l) {
+    return U(await e.sign(l), r);
+  }
+  function o(l, c, h, f) {
+    return a(
+      P({ sender: e.selfAgentId, recipient: l, intent: c, content: JSON.stringify(h), correlationId: f, ttlMs: n })
+    );
+  }
+  return async (l) => {
+    const c = await E(l, i), h = c.envelope?.header.sender, f = c.envelope?.header.messageId;
+    if (!c.ok || !c.envelope) {
+      const d = c.diagnostics.find((p) => p.level === "error")?.message ?? "AIP verification failed";
+      return o(h, "ERROR", R(null, -32600, d), f);
+    }
+    if (c.envelope.header.recipient !== e.selfAgentId)
+      return o(h, "ERROR", R(null, -32600, "Recipient mismatch: envelope not addressed to this agent"), f);
+    let y;
+    try {
+      y = JSON.parse(c.envelope.body.content);
+    } catch {
+      return o(h, "ERROR", R(null, -32700, "Parse error: envelope body is not JSON-RPC"), f);
+    }
+    let u;
+    try {
+      u = await t(y);
+    } catch (d) {
+      u = R(y.id ?? null, -32603, d instanceof Error ? d.message : "Internal error");
+    }
+    return o(c.envelope.header.sender, "RESULT", u, f);
+  };
+}
+function ot(t) {
+  const e = t.wireFormat ?? "compact", r = t.ttlMs ?? 6e4, n = t.receive?.replayCache ?? new T(), s = ce(t, n);
+  return {
+    async encodeRequest(i) {
+      const a = P({
+        sender: t.selfAgentId,
+        recipient: t.peerAgentId,
+        intent: "TASK",
+        content: JSON.stringify(i),
+        ttlMs: r
+      });
+      return { raw: U(await t.sign(a), e), messageId: a.header.messageId };
+    },
+    async decodeResponse(i, a = {}) {
+      const o = await E(i, s);
+      if (!o.ok || !o.envelope) {
+        const l = o.diagnostics.find((c) => c.level === "error")?.message ?? "unknown";
+        throw new Error(`AIP response verification failed: ${l}`);
+      }
+      if (!t.peerAgentId)
+        throw new Error("createMcpClientCodec requires peerAgentId to bind the response sender");
+      if (o.envelope.header.sender !== t.peerAgentId)
+        throw new Error(`AIP response sender '${o.envelope.header.sender}' is not the expected peer '${t.peerAgentId}'`);
+      if (a.expectCorrelationId !== void 0 && o.envelope.body.correlationId !== a.expectCorrelationId)
+        throw new Error(
+          `AIP response correlationId '${o.envelope.body.correlationId ?? ""}' does not match request '${a.expectCorrelationId}'`
+        );
+      return JSON.parse(o.envelope.body.content);
+    }
+  };
+}
+function $t(t, e) {
+  const r = ot(e);
+  return async (n) => {
+    const { raw: s, messageId: i } = await r.encodeRequest(n);
+    return r.decodeResponse(await t(s), { expectCorrelationId: i });
+  };
+}
+const de = {};
+function le(t) {
+  if (typeof t != "string")
+    throw new Error("stdio adapter supports json/compact (string) wire formats; use the HTTP adapter for binary");
+  return t;
+}
+function Ot(t, e = {}) {
+  const r = e.input ?? process.stdin, n = e.output ?? process.stdout, s = de.createInterface({ input: r, crlfDelay: Number.POSITIVE_INFINITY });
+  let i = Promise.resolve();
+  const a = (o) => {
+    const l = o.trim();
+    l && (i = i.then(async () => {
+      try {
+        const c = await t(l);
+        n.write(`${le(c)}
+`);
+      } catch (c) {
+        e.onError?.(c);
+      }
+    }));
+  };
+  return s.on("line", a), {
+    close() {
+      s.off("line", a), s.close();
+    }
+  };
+}
+function Ft(t) {
+  const e = de.createInterface({ input: t.input, crlfDelay: Number.POSITIVE_INFINITY }), r = [], n = (s) => {
+    const i = s.trim();
+    if (!i) return;
+    const a = r.shift();
+    a && a(i);
+  };
+  return e.on("line", n), {
+    send(s) {
+      const i = le(s);
+      return new Promise((a) => {
+        r.push(a), t.output.write(`${i}
+`);
+      });
+    },
+    close() {
+      e.off("line", n), e.close();
+    }
+  };
+}
+function Kt(t, e = {}) {
+  return (r, n) => {
+    const s = [];
+    r.on("data", (i) => s.push(i)), r.on("error", () => {
+      n.writeHead(400), n.end();
+    }), r.on("end", () => {
+      (async () => {
+        try {
+          const i = Buffer.concat(s), a = e.binary ? new Uint8Array(i) : i.toString("utf8"), o = await t(a);
+          typeof o == "string" ? (n.writeHead(200, { "content-type": "application/json" }), n.end(o)) : (n.writeHead(200, { "content-type": "application/octet-stream" }), n.end(Buffer.from(o)));
+        } catch (i) {
+          n.writeHead(500, { "content-type": "application/json" }), n.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32603, message: i instanceof Error ? i.message : "internal error" } }));
+        }
+      })();
+    });
+  };
+}
+function Ut(t) {
+  const e = t.fetchImpl ?? fetch, r = t.binary ? "application/octet-stream" : "application/json";
+  return {
+    async send(n) {
+      const s = await e(t.url, {
+        method: "POST",
+        headers: { "content-type": r, ...t.headers },
+        body: typeof n == "string" ? n : Buffer.from(n)
+      });
+      return t.binary ? new Uint8Array(await s.arrayBuffer()) : s.text();
+    }
+  };
+}
+export {
+  je as AgentSession,
+  He as AipAgentAdapter,
+  Me as DEFAULT_MAX_BINARY_ENVELOPE_BYTES,
+  ft as DistributedReplayCache,
+  st as InMemoryRedisLikeClient,
+  T as InMemoryReplayCache,
+  Nt as InMemoryRevocationStore,
+  Oe as InMemoryVerificationMaterialCache,
+  bt as RollingKeyring,
+  xt as RuntimePolicyManager,
+  pt as SessionTransport,
+  F as bootstrapRuntimePolicyEnforcer,
+  A as canonicalizeEnvelope,
+  B as createAipAgentAdapter,
+  ze as createAipCapabilities,
+  z as createAipMcpGatewayRuntime,
+  Et as createAipMcpGatewayRuntimeWithPolicy,
+  P as createEnvelope,
+  Ut as createHttpMcpClient,
+  Kt as createHttpMcpHandler,
+  vt as createKeyringSignatureResolver,
+  ot as createMcpClientCodec,
+  et as createPolicyEnforcer,
+  Ve as createRawTaskFromJsonRpc,
+  It as createRawTaskFromLangChain,
+  kt as createRawTaskFromLlamaIndex,
+  at as createRedisReplayStore,
+  Pt as createRedisRevocationStore,
+  mt as createSignedMessage,
+  Ft as createStdioMcpClient,
+  Ke as decodeEnvelope,
+  Ue as decodeEnvelopeBatch,
+  _e as decodeEnvelopeBinary,
+  Je as encodeAipCapabilities,
+  U as encodeEnvelope,
+  yt as encodeEnvelopeBatch,
+  Te as encodeEnvelopeBinary,
+  dt as generateEd25519KeypairBase64Url,
+  Rt as getRuntimeTuningPreset,
+  At as isRuntimeMode,
+  Ze as loadRuntimePolicy,
+  wt as negotiateAipCapabilities,
+  gt as parseAipCapabilities,
+  Xe as parseRuntimePolicyJson,
+  E as receiveEnvelope,
+  De as receiveEnvelopeBatch,
+  Ct as recommendPolicyAdjustments,
+  Ot as serveMcpOverStdio,
+  lt as signCanonicalPayloadEd25519,
+  ct as signCanonicalPayloadHmac,
+  ut as signEnvelopeEd25519,
+  Q as signEnvelopeHmac,
+  We as toJsonRpcResponse,
+  Mt as toLangChainMessage,
+  St as toLlamaIndexMessage,
+  Ie as validateEnvelope,
+  Ye as validateRuntimePolicy,
+  ge as verifyCanonicalPayloadEd25519,
+  me as verifyCanonicalPayloadHmac,
+  ve as verifyCanonicalPayloadSignature,
+  be as verifyEnvelopeEd25519,
+  we as verifyEnvelopeHmac,
+  ht as verifyEnvelopeSignature,
+  Tt as withRevocationCheck,
+  $t as wrapMcpClient,
+  _t as wrapMcpServer
+};