@7h3/protocol 0.1.2 → 0.5.0

package/index.js

@@ -1,1702 +0,0 @@
-const S = new TextEncoder(), ue = 256, I = /* @__PURE__ */ new Map(), J = 256, M = /* @__PURE__ */ new Map(), k = /* @__PURE__ */ new Map();
-function j() {
-  return globalThis.Buffer ?? null;
-}
-function he(t) {
-  const e = [
-    `"messageId":${JSON.stringify(t.messageId)}`,
-    `"nonce":${JSON.stringify(t.nonce)}`
-  ];
-  return t.recipient !== void 0 && e.push(`"recipient":${JSON.stringify(t.recipient)}`), e.push(`"sender":${JSON.stringify(t.sender)}`), e.push(`"timestampMs":${t.timestampMs}`), e.push(`"ttlMs":${t.ttlMs}`), e.push(`"version":${JSON.stringify(t.version)}`), `{${e.join(",")}}`;
-}
-function fe(t) {
-  const e = [];
-  return t.capability !== void 0 && e.push(`"capability":${JSON.stringify(t.capability)}`), e.push(`"content":${JSON.stringify(t.content)}`), t.correlationId !== void 0 && e.push(`"correlationId":${JSON.stringify(t.correlationId)}`), e.push(`"intent":${JSON.stringify(t.intent)}`), `{${e.join(",")}}`;
-}
-function H(t) {
-  const e = `hs256:${t}`, r = I.get(e);
-  if (r) return r;
-  I.size >= ue && I.clear();
-  const s = b().importKey(
-    "raw",
-    S.encode(t),
-    { name: "HMAC", hash: "SHA-256" },
-    !1,
-    ["sign", "verify"]
-  ).catch((i) => {
-    throw I.delete(e), i;
-  });
-  return I.set(e, s), s;
-}
-function ye(t) {
-  const e = `ed25519:pkcs8:${t}`, r = M.get(e);
-  if (r) return r;
-  M.size >= J && M.clear();
-  const s = b().importKey("pkcs8", V(N(t)), { name: "Ed25519" }, !1, ["sign"]).catch((i) => {
-    throw M.delete(e), i;
-  });
-  return M.set(e, s), s;
-}
-function pe(t) {
-  const e = `ed25519:spki:${t}`, r = k.get(e);
-  if (r) return r;
-  k.size >= J && k.clear();
-  const s = b().importKey("spki", V(N(t)), { name: "Ed25519" }, !1, ["verify"]).catch((i) => {
-    throw k.delete(e), i;
-  });
-  return k.set(e, s), s;
-}
-function C(t) {
-  const e = j();
-  return (e ? e.from(t).toString("base64") : btoa(String.fromCharCode(...t))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function N(t) {
-  const e = t.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(t.length / 4) * 4, "="), r = j();
-  if (r)
-    return new Uint8Array(r.from(e, "base64"));
-  const n = atob(e), s = new Uint8Array(n.length);
-  for (let i = 0; i < n.length; i += 1)
-    s[i] = n.charCodeAt(i);
-  return s;
-}
-function V(t) {
-  return t.buffer.slice(t.byteOffset, t.byteOffset + t.byteLength);
-}
-function A(t) {
-  return `{"body":${fe(t.body)},"header":${he(t.header)}}`;
-}
-function b() {
-  if (typeof crypto > "u" || !crypto.subtle)
-    throw new Error("Web Crypto API is not available in this runtime");
-  return crypto.subtle;
-}
-async function W(t, e) {
-  const r = b(), n = await H(e), s = await r.sign("HMAC", n, S.encode(t));
-  return C(new Uint8Array(s));
-}
-async function G(t, e, r) {
-  const n = b(), s = await H(r), i = N(e);
-  return n.verify("HMAC", s, i.buffer, S.encode(t));
-}
-async function Y(t, e) {
-  const r = b(), n = await ye(e), s = await r.sign("Ed25519", n, S.encode(t));
-  return C(new Uint8Array(s));
-}
-async function X(t, e, r) {
-  const n = b(), s = await pe(r), i = N(e);
-  return n.verify("Ed25519", s, i.buffer, S.encode(t));
-}
-async function ct(t, e) {
-  return W(t, e);
-}
-async function me(t, e, r) {
-  return G(t, e, r);
-}
-async function dt() {
-  const t = b(), e = await t.generateKey({ name: "Ed25519" }, !0, ["sign", "verify"]), r = await t.exportKey("pkcs8", e.privateKey), n = await t.exportKey("spki", e.publicKey);
-  return {
-    privateKey: C(new Uint8Array(r)),
-    publicKey: C(new Uint8Array(n))
-  };
-}
-async function lt(t, e) {
-  return Y(t, e);
-}
-async function ge(t, e, r) {
-  return X(t, e, r);
-}
-async function Q(t, e, r = "local-dev-key") {
-  const n = A(t), s = await W(n, e);
-  return {
-    ...t,
-    signature: {
-      alg: "HS256",
-      keyId: r,
-      value: s
-    }
-  };
-}
-async function we(t, e) {
-  if (!t.signature || t.signature.alg !== "HS256") return !1;
-  const r = {
-    header: t.header,
-    body: t.body
-  }, n = A(r);
-  return G(n, t.signature.value, e);
-}
-async function ut(t, e, r = "local-ed25519-key") {
-  const n = A(t), s = await Y(n, e);
-  return {
-    ...t,
-    signature: {
-      alg: "ED25519",
-      keyId: r,
-      value: s
-    }
-  };
-}
-async function be(t, e) {
-  if (!t.signature || t.signature.alg !== "ED25519") return !1;
-  const r = {
-    header: t.header,
-    body: t.body
-  }, n = A(r);
-  return X(n, t.signature.value, e);
-}
-async function ht(t, e) {
-  return !t.signature || t.signature.alg !== e.alg ? !1 : e.alg === "HS256" ? we(t, e.secret) : be(t, e.publicKey);
-}
-async function ve(t, e, r) {
-  return !e || e.alg !== r.alg ? !1 : r.alg === "HS256" ? me(t, e.value, r.secret) : ge(t, e.value, r.publicKey);
-}
-function Ie(t, e = Date.now()) {
-  const r = [], n = t.header ?? {}, s = t.body ?? {}, i = typeof n.version == "string" ? n.version : "", a = typeof n.messageId == "string" ? n.messageId : "", o = typeof n.sender == "string" ? n.sender : "", l = typeof n.timestampMs == "number" ? n.timestampMs : 0, c = typeof n.ttlMs == "number" ? n.ttlMs : 0, h = typeof s.content == "string" ? s.content : "";
-  return i !== "aip/0.1" && r.push({ level: "error", message: `Unsupported protocol version '${i}'` }), a.trim() || r.push({ level: "error", message: "Missing messageId" }), o.trim() || r.push({ level: "error", message: "Missing sender identity" }), c <= 0 && r.push({ level: "error", message: "ttlMs must be greater than zero" }), l + c < e && r.push({ level: "error", message: "Message TTL expired" }), h.trim() || r.push({ level: "warning", message: "Empty content payload" }), r;
-}
-function P(t) {
-  const e = t.nowMs ?? Date.now();
-  return {
-    header: {
-      version: "aip/0.1",
-      messageId: t.messageId ?? `msg-${e}-${Math.random().toString(36).slice(2, 10)}`,
-      timestampMs: e,
-      ttlMs: t.ttlMs ?? 6e4,
-      sender: t.sender,
-      recipient: t.recipient,
-      nonce: t.nonce ?? Math.random().toString(36).slice(2, 12)
-    },
-    body: {
-      intent: t.intent,
-      content: t.content,
-      capability: t.capability,
-      correlationId: t.correlationId
-    }
-  };
-}
-const Z = [65, 73, 80, 66], D = Uint8Array.from(Z), q = 1, Me = 1024 * 1024, ee = 1, te = 2, re = 4, ne = 8, ke = new TextEncoder(), Se = new TextDecoder(), Ae = /* @__PURE__ */ new Set(["PING", "PONG", "CAPS", "TASK", "RESULT", "ERROR"]);
-function Ee(t) {
-  return ke.encode(t);
-}
-function xe(t) {
-  return Se.decode(t);
-}
-function Re(t) {
-  return t === "ED25519" ? 2 : 1;
-}
-function Ce(t) {
-  return t === 1 ? "HS256" : t === 2 ? "ED25519" : null;
-}
-function g(t) {
-  return { bytes: Ee(t) };
-}
-function w(t) {
-  return t ? 4 + t.bytes.byteLength : 0;
-}
-class Ne {
-  bytes;
-  view;
-  offset = 0;
-  constructor(e) {
-    this.bytes = new Uint8Array(e), this.view = new DataView(this.bytes.buffer, this.bytes.byteOffset, this.bytes.byteLength);
-  }
-  writeU8(e) {
-    this.bytes[this.offset] = e & 255, this.offset += 1;
-  }
-  writeU32(e) {
-    this.view.setUint32(this.offset, e, !1), this.offset += 4;
-  }
-  writeU64(e) {
-    this.view.setBigUint64(this.offset, BigInt(e), !1), this.offset += 8;
-  }
-  writeBytes(e) {
-    this.bytes.set(e, this.offset), this.offset += e.byteLength;
-  }
-  writeString(e) {
-    this.writeU32(e.bytes.byteLength), this.writeBytes(e.bytes);
-  }
-  finish() {
-    return this.bytes;
-  }
-}
-class Pe {
-  bytes;
-  offset = 0;
-  constructor(e) {
-    this.bytes = e;
-  }
-  remaining() {
-    return this.bytes.byteLength - this.offset;
-  }
-  readU8() {
-    if (this.remaining() < 1) throw new Error("Unexpected end of binary envelope");
-    const e = this.bytes[this.offset];
-    return this.offset += 1, e ?? 0;
-  }
-  readU32() {
-    if (this.remaining() < 4) throw new Error("Unexpected end of binary envelope");
-    const e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 4).getUint32(0, !1);
-    return this.offset += 4, e;
-  }
-  readU64() {
-    if (this.remaining() < 8) throw new Error("Unexpected end of binary envelope");
-    const e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 8).getBigUint64(0, !1);
-    return this.offset += 8, Number(e);
-  }
-  readBytes(e) {
-    if (e < 0 || this.remaining() < e) throw new Error("Unexpected end of binary envelope");
-    const r = this.bytes.slice(this.offset, this.offset + e);
-    return this.offset += e, r;
-  }
-  readString() {
-    const e = this.readU32(), r = this.readBytes(e);
-    return xe(r);
-  }
-}
-function Te(t) {
-  const e = (t.header.recipient ? ee : 0) | (t.body.capability ? te : 0) | (t.body.correlationId ? re : 0) | (t.signature ? ne : 0), r = g(t.header.version), n = g(t.header.messageId), s = g(t.header.sender), i = g(t.header.nonce), a = g(t.body.intent), o = g(t.body.content), l = t.header.recipient ? g(t.header.recipient) : null, c = t.body.capability ? g(t.body.capability) : null, h = t.body.correlationId ? g(t.body.correlationId) : null, f = t.signature ? g(t.signature.keyId) : null, y = t.signature ? g(t.signature.value) : null, u = D.byteLength + 1 + 1 + 8 + 4 + w(r) + w(n) + w(s) + w(i) + w(a) + w(o) + w(l) + w(c) + w(h) + (t.signature ? 1 : 0) + w(f) + w(y), d = new Ne(u);
-  return d.writeBytes(D), d.writeU8(q), d.writeU8(e), d.writeU64(t.header.timestampMs), d.writeU32(t.header.ttlMs), d.writeString(r), d.writeString(n), d.writeString(s), d.writeString(i), d.writeString(a), d.writeString(o), l && d.writeString(l), c && d.writeString(c), h && d.writeString(h), t.signature && f && y && (d.writeU8(Re(t.signature.alg)), d.writeString(f), d.writeString(y)), d.finish();
-}
-function _e(t, e = {}) {
-  try {
-    const r = e.maxFrameBytes ?? Me;
-    if (t.byteLength > r)
-      return {
-        ok: !1,
-        diagnostics: [{ level: "error", message: `Binary envelope exceeds maximum frame size '${r}'` }],
-        envelope: null
-      };
-    const n = new Pe(t);
-    if ([n.readU8(), n.readU8(), n.readU8(), n.readU8()].some((h, f) => h !== Z[f]))
-      return {
-        ok: !1,
-        diagnostics: [{ level: "error", message: "Invalid binary envelope magic" }],
-        envelope: null
-      };
-    const i = n.readU8();
-    if (i !== q)
-      return {
-        ok: !1,
-        diagnostics: [{ level: "error", message: `Unsupported binary envelope version '${i}'` }],
-        envelope: null
-      };
-    const a = n.readU8(), o = n.readU64(), l = n.readU32(), c = {
-      header: {
-        version: n.readString(),
-        messageId: n.readString(),
-        timestampMs: o,
-        ttlMs: l,
-        sender: n.readString(),
-        nonce: n.readString()
-      },
-      body: {
-        intent: n.readString(),
-        content: n.readString()
-      }
-    };
-    if (c.header.version !== "aip/0.1")
-      return {
-        ok: !1,
-        diagnostics: [{ level: "error", message: `Unsupported protocol version '${c.header.version}'` }],
-        envelope: null
-      };
-    if (!Ae.has(c.body.intent))
-      return {
-        ok: !1,
-        diagnostics: [{ level: "error", message: `Unsupported intent '${c.body.intent}'` }],
-        envelope: null
-      };
-    if (a & ee && (c.header.recipient = n.readString()), a & te && (c.body.capability = n.readString()), a & re && (c.body.correlationId = n.readString()), a & ne) {
-      const h = n.readU8(), f = Ce(h);
-      if (!f)
-        return {
-          ok: !1,
-          diagnostics: [{ level: "error", message: `Unsupported binary signature algorithm '${h}'` }],
-          envelope: null
-        };
-      c.signature = {
-        alg: f,
-        keyId: n.readString(),
-        value: n.readString()
-      };
-    }
-    return n.remaining() !== 0 ? {
-      ok: !1,
-      diagnostics: [{ level: "error", message: "Trailing bytes found in binary envelope" }],
-      envelope: null
-    } : {
-      ok: !0,
-      diagnostics: [],
-      envelope: c
-    };
-  } catch (r) {
-    return {
-      ok: !1,
-      diagnostics: [{ level: "error", message: r instanceof Error ? r.message : "Invalid binary envelope" }],
-      envelope: null
-    };
-  }
-}
-class $e {
-  items = [];
-  peek() {
-    return this.items[0];
-  }
-  push(e) {
-    this.items.push(e), this.bubbleUp(this.items.length - 1);
-  }
-  pop() {
-    if (this.items.length === 0) return;
-    const e = this.items[0], r = this.items.pop();
-    return this.items.length > 0 && r && (this.items[0] = r, this.bubbleDown(0)), e;
-  }
-  bubbleUp(e) {
-    let r = e;
-    for (; r > 0; ) {
-      const n = Math.floor((r - 1) / 2), s = this.items[n], i = this.items[r];
-      if (!s || !i || s.expiresAt <= i.expiresAt) break;
-      this.items[n] = i, this.items[r] = s, r = n;
-    }
-  }
-  bubbleDown(e) {
-    let r = e;
-    for (; ; ) {
-      const n = r * 2 + 1, s = r * 2 + 2;
-      let i = r;
-      const a = this.items[r], o = this.items[n], l = this.items[s];
-      o && a && o.expiresAt < a.expiresAt && (i = n);
-      const c = this.items[i];
-      if (l && c && l.expiresAt < c.expiresAt && (i = s), i === r) break;
-      const h = this.items[r], f = this.items[i];
-      if (!h || !f) break;
-      this.items[r] = f, this.items[i] = h, r = i;
-    }
-  }
-}
-class T {
-  entries = /* @__PURE__ */ new Map();
-  maxEntries;
-  expiries = new $e();
-  constructor(e = 1e4) {
-    this.maxEntries = e;
-  }
-  makeKey(e) {
-    return `${e.header.sender}|${e.header.messageId}|${e.header.nonce}`;
-  }
-  prune(e = Date.now()) {
-    for (; ; ) {
-      const r = this.expiries.peek();
-      if (!r || r.expiresAt > e) break;
-      this.expiries.pop();
-      const n = this.entries.get(r.key);
-      n !== void 0 && n === r.expiresAt && n <= e && this.entries.delete(r.key);
-    }
-  }
-  evictOne() {
-    for (; this.entries.size >= this.maxEntries; ) {
-      const e = this.expiries.pop();
-      if (!e) break;
-      const r = this.entries.get(e.key);
-      if (r !== void 0 && r === e.expiresAt) {
-        this.entries.delete(e.key);
-        return;
-      }
-    }
-    if (this.entries.size >= this.maxEntries) {
-      const e = this.entries.keys().next().value;
-      e && this.entries.delete(e);
-    }
-  }
-  consume(e, r = Date.now()) {
-    this.prune(r);
-    const n = this.makeKey(e), s = this.entries.get(n);
-    if (s && s > r)
-      return { ok: !1, reason: "Replay detected for sender/messageId/nonce" };
-    this.entries.size >= this.maxEntries && this.evictOne();
-    const i = e.header.timestampMs + e.header.ttlMs;
-    return this.entries.set(n, i), this.expiries.push({ key: n, expiresAt: i }), { ok: !0 };
-  }
-  consumeMany(e, r = Date.now()) {
-    return e.map((n) => this.consume(n, r));
-  }
-}
-class ft {
-  store;
-  constructor(e) {
-    this.store = e;
-  }
-  makeKey(e) {
-    return `${e.header.sender}|${e.header.messageId}|${e.header.nonce}`;
-  }
-  async consume(e, r = Date.now()) {
-    const n = this.makeKey(e), s = e.header.timestampMs + e.header.ttlMs;
-    return await this.store.reserve(n, s, r) ? { ok: !0 } : { ok: !1, reason: "Replay detected for sender/messageId/nonce" };
-  }
-  async consumeMany(e, r = Date.now()) {
-    if (this.store.reserveMany) {
-      const n = e.map((i) => ({
-        key: this.makeKey(i),
-        expiresAtMs: i.header.timestampMs + i.header.ttlMs
-      }));
-      return (await this.store.reserveMany(n, r)).map(
-        (i) => i ? { ok: !0 } : { ok: !1, reason: "Replay detected for sender/messageId/nonce" }
-      );
-    }
-    return Promise.all(e.map((n) => this.consume(n, r)));
-  }
-}
-class Oe {
-  entries = /* @__PURE__ */ new Map();
-  maxEntries;
-  constructor(e = 512) {
-    this.maxEntries = e;
-  }
-  get(e, r = Date.now()) {
-    const n = this.entries.get(e);
-    if (n) {
-      if (n.expiresAtMs <= r) {
-        this.entries.delete(e);
-        return;
-      }
-      return n.material;
-    }
-  }
-  set(e, r, n) {
-    if (this.entries.size >= this.maxEntries) {
-      const s = this.entries.keys().next().value;
-      s && this.entries.delete(s);
-    }
-    this.entries.set(e, { expiresAtMs: n, material: r });
-  }
-  delete(e) {
-    this.entries.delete(e);
-  }
-}
-function Fe(t, e) {
-  return `${e}|${t.alg}|${t.keyId}`;
-}
-function ie(t) {
-  if (!t || typeof t != "object") return !1;
-  const e = t;
-  return !!(e.header && e.body);
-}
-function se(t) {
-  if (!t || typeof t != "object") return !1;
-  const e = t;
-  return e.v === "aip/0.1" && typeof e.mid == "string" && typeof e.i == "string";
-}
-function ae(t) {
-  return {
-    header: {
-      version: t.v,
-      messageId: t.mid,
-      timestampMs: t.ts,
-      ttlMs: t.ttl,
-      sender: t.s,
-      recipient: t.r,
-      nonce: t.n
-    },
-    body: {
-      intent: t.i,
-      content: t.c,
-      capability: t.cap,
-      correlationId: t.cid
-    },
-    signature: t.sig ? {
-      alg: t.sig.a ?? "HS256",
-      keyId: t.sig.k,
-      value: t.sig.v
-    } : void 0
-  };
-}
-function oe(t) {
-  return {
-    v: t.header.version,
-    mid: t.header.messageId,
-    ts: t.header.timestampMs,
-    ttl: t.header.ttlMs,
-    s: t.header.sender,
-    r: t.header.recipient,
-    n: t.header.nonce,
-    i: t.body.intent,
-    c: t.body.content,
-    cap: t.body.capability,
-    cid: t.body.correlationId,
-    sig: t.signature ? {
-      a: t.signature.alg,
-      k: t.signature.keyId,
-      v: t.signature.value
-    } : void 0
-  };
-}
-function Ke(t) {
-  if (t instanceof Uint8Array)
-    return _e(t);
-  try {
-    const e = JSON.parse(t);
-    return se(e) ? { ok: !0, diagnostics: [], envelope: ae(e) } : ie(e) ? { ok: !0, diagnostics: [], envelope: e } : {
-      ok: !1,
-      diagnostics: [{ level: "error", message: "Envelope JSON shape is not recognized" }],
-      envelope: null
-    };
-  } catch {
-    return {
-      ok: !1,
-      diagnostics: [{ level: "error", message: "Invalid JSON envelope" }],
-      envelope: null
-    };
-  }
-}
-function U(t, e = "json") {
-  return e === "binary" ? Te(t) : JSON.stringify(e === "compact" ? oe(t) : t);
-}
-function yt(t, e = "compact") {
-  return JSON.stringify(e === "compact" ? t.map(oe) : t);
-}
-function Ue(t) {
-  try {
-    const e = JSON.parse(t);
-    return Array.isArray(e) ? e.map((r) => se(r) ? { ok: !0, diagnostics: [], envelope: ae(r) } : ie(r) ? { ok: !0, diagnostics: [], envelope: r } : {
-      ok: !1,
-      diagnostics: [{ level: "error", message: "Batch item has unrecognized envelope shape" }],
-      envelope: null
-    }) : [
-      {
-        ok: !1,
-        diagnostics: [{ level: "error", message: "Batch payload must be a JSON array" }],
-        envelope: null
-      }
-    ];
-  } catch {
-    return [
-      {
-        ok: !1,
-        diagnostics: [{ level: "error", message: "Invalid JSON batch payload" }],
-        envelope: null
-      }
-    ];
-  }
-}
-async function E(t, e = {}) {
-  const r = e.nowMs ?? Date.now(), n = e.requireSignature ?? !0, s = e.maxClockSkewMs ?? 3e4;
-  async function i(u) {
-    e.telemetry && await e.telemetry({
-      nowMs: r,
-      ...u
-    });
-  }
-  const a = typeof t == "string" || t instanceof Uint8Array ? Ke(t) : { ok: !0, diagnostics: [], envelope: t };
-  if (!a.ok || !a.envelope) return a;
-  if (await i({
-    phase: "decoded",
-    sender: a.envelope.header.sender,
-    messageId: a.envelope.header.messageId
-  }), a.envelope.header.timestampMs > r + s) {
-    const u = "Message timestamp exceeds allowed clock skew", d = [{ level: "error", message: u }];
-    return await i({
-      phase: "rejected_clock_skew",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId,
-      reason: u
-    }), { ok: !1, diagnostics: d, envelope: a.envelope };
-  }
-  const o = [...Ie(a.envelope, r)];
-  if (o.some((u) => u.level === "error"))
-    return await i({
-      phase: "rejected_validation",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId,
-      reason: o.find((u) => u.level === "error")?.message
-    }), { ok: !1, diagnostics: o, envelope: a.envelope };
-  if (!a.envelope.signature)
-    return n ? (o.push({ level: "error", message: "Missing signature" }), await i({
-      phase: "rejected_missing_signature",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId,
-      reason: "Missing signature"
-    }), { ok: !1, diagnostics: o, envelope: a.envelope }) : (await i({
-      phase: "accepted",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId
-    }), { ok: !0, diagnostics: o, envelope: a.envelope });
-  let l;
-  const c = a.envelope.signature, h = Fe(c, a.envelope.header.sender);
-  if (e.verificationMaterialCache && (l = e.verificationMaterialCache.get(h, r)), e.signatureResolver && (l = l ?? await e.signatureResolver(c, a.envelope.header.sender)), !l && c.alg === "HS256" && e.secretResolver) {
-    const u = await e.secretResolver(c.keyId, a.envelope.header.sender);
-    u && (l = { alg: "HS256", secret: u });
-  }
-  if (l && e.verificationMaterialCache) {
-    const u = Math.max(r + 1, a.envelope.header.timestampMs + a.envelope.header.ttlMs);
-    e.verificationMaterialCache.set(h, l, u);
-  }
-  if (!l)
-    return o.push({ level: "error", message: "No signature verification material found for keyId/sender" }), await i({
-      phase: "rejected_missing_material",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId,
-      reason: "No signature verification material found for keyId/sender"
-    }), { ok: !1, diagnostics: o, envelope: a.envelope };
-  const f = A({ header: a.envelope.header, body: a.envelope.body });
-  if (!await ve(f, a.envelope.signature, l))
-    return o.push({ level: "error", message: "Signature verification failed" }), await i({
-      phase: "rejected_bad_signature",
-      sender: a.envelope.header.sender,
-      messageId: a.envelope.header.messageId,
-      reason: "Signature verification failed"
-    }), { ok: !1, diagnostics: o, envelope: a.envelope };
-  if (e.replayCache) {
-    const u = await e.replayCache.consume(a.envelope, r);
-    if (!u.ok)
-      return o.push({ level: "error", message: u.reason ?? "Replay detected" }), await i({
-        phase: "rejected_replay",
-        sender: a.envelope.header.sender,
-        messageId: a.envelope.header.messageId,
-        reason: u.reason
-      }), { ok: !1, diagnostics: o, envelope: a.envelope };
-  }
-  return await i({
-    phase: "accepted",
-    sender: a.envelope.header.sender,
-    messageId: a.envelope.header.messageId
-  }), { ok: !0, diagnostics: o, envelope: a.envelope };
-}
-async function De(t, e = {}) {
-  const r = Math.max(1, Math.floor(e.batchConcurrency ?? Number.POSITIVE_INFINITY)), n = async (s) => {
-    const i = new Array(s.length);
-    let a = 0;
-    const o = Number.isFinite(r) ? Math.min(r, s.length) : s.length;
-    return await Promise.all(
-      Array.from({ length: o }, async () => {
-        for (; a < s.length; ) {
-          const l = a;
-          a += 1;
-          const c = s[l];
-          c && typeof c == "object" && "ok" in c && "diagnostics" in c && "envelope" in c ? i[l] = c : i[l] = await E(c, e);
-        }
-      })
-    ), await e.telemetry?.({
-      phase: "batch_summary",
-      nowMs: e.nowMs ?? Date.now(),
-      reason: `items=${s.length};accepted=${i.filter((l) => l?.ok).length}`
-    }), i;
-  };
-  if (typeof t == "string") {
-    const s = Ue(t);
-    return n(s.map((i) => i.ok && i.envelope ? i.envelope : i));
-  }
-  return n(t);
-}
-class pt {
-  options;
-  constructor(e = {}) {
-    this.options = {
-      ...e,
-      replayCache: e.replayCache ?? new T(),
-      verificationMaterialCache: e.verificationMaterialCache ?? new Oe()
-    };
-  }
-  receive(e, r = Date.now()) {
-    return E(e, { ...this.options, nowMs: r });
-  }
-  receiveBatch(e, r = Date.now()) {
-    return De(e, { ...this.options, nowMs: r });
-  }
-}
-async function mt(t) {
-  const e = P(t);
-  return Q(e, t.secret, t.keyId);
-}
-const Be = ["binary", "compact", "json"], Le = ["fast", "receipt"];
-function ze(t) {
-  return {
-    agent: t.agent,
-    capabilities: t.capabilities ?? [],
-    wireFormats: t.wireFormats ?? ["compact", "json"],
-    batchMax: t.batchMax ?? 1,
-    ackModes: t.ackModes ?? ["receipt"]
-  };
-}
-function Je(t) {
-  return JSON.stringify(t);
-}
-function gt(t) {
-  try {
-    const e = JSON.parse(t);
-    return typeof e.agent != "string" || !Array.isArray(e.capabilities) || !Array.isArray(e.wireFormats) || !Array.isArray(e.ackModes) || typeof e.batchMax != "number" || e.batchMax < 1 ? null : {
-      agent: e.agent,
-      capabilities: e.capabilities.filter((r) => typeof r == "string"),
-      wireFormats: e.wireFormats.filter((r) => r === "json" || r === "compact" || r === "binary"),
-      batchMax: Math.floor(e.batchMax),
-      ackModes: e.ackModes.filter((r) => r === "fast" || r === "receipt")
-    };
-  } catch {
-    return null;
-  }
-}
-function wt(t, e) {
-  const r = Be.find((s) => t.wireFormats.includes(s) && e.wireFormats.includes(s)) ?? "compact", n = Le.find((s) => t.ackModes.includes(s) && e.ackModes.includes(s)) ?? "receipt";
-  return {
-    wireFormat: r,
-    batchMax: Math.max(1, Math.min(t.batchMax, e.batchMax)),
-    ackMode: n
-  };
-}
-class bt {
-  records;
-  constructor(e = []) {
-    this.records = [...e];
-  }
-  add(e) {
-    this.records.push(e);
-  }
-  revoke(e, r, n = Date.now()) {
-    const s = this.records.find((i) => i.sender === e && i.keyId === r);
-    return s ? (s.status = "revoked", s.notAfterMs = Math.min(s.notAfterMs, n), !0) : !1;
-  }
-  selectSigningKey(e, r, n = Date.now()) {
-    return this.records.filter(
-      (i) => i.sender === e && i.alg === r && i.status === "active" && i.notBeforeMs <= n && n < i.notAfterMs
-    ).sort((i, a) => a.notBeforeMs - i.notBeforeMs)[0] ?? null;
-  }
-  resolveVerificationMaterial(e, r, n = Date.now()) {
-    return this.records.filter(
-      (i) => i.sender === r && i.keyId === e.keyId && i.alg === e.alg && i.status !== "revoked" && i.notBeforeMs <= n && n < i.notAfterMs
-    ).sort((i, a) => a.notBeforeMs - i.notBeforeMs)[0]?.material;
-  }
-}
-function vt(t, e = () => Date.now()) {
-  return async (r, n) => t.resolveVerificationMaterial(r, n, e());
-}
-class je {
-  agentId;
-  outboundSecret;
-  keyId;
-  capabilities;
-  supportedWireFormats;
-  maxBatchSize;
-  ackModes;
-  requireSignature;
-  replayCache;
-  sharedSecrets;
-  resolveInboundSecret;
-  onTask;
-  constructor(e) {
-    this.agentId = e.agentId, this.outboundSecret = e.outboundSecret, this.keyId = e.keyId ?? `${e.agentId}-k1`, this.capabilities = e.capabilities ?? [], this.supportedWireFormats = e.supportedWireFormats ?? ["compact", "json"], this.maxBatchSize = e.maxBatchSize ?? 1, this.ackModes = e.ackModes ?? ["receipt"], this.requireSignature = e.requireSignature ?? !0, this.replayCache = e.replayCache ?? new T(), this.sharedSecrets = e.sharedSecrets ?? {}, this.resolveInboundSecret = e.resolveInboundSecret, this.onTask = e.onTask;
-  }
-  async inboundSecretResolver(e, r) {
-    return this.resolveInboundSecret ? this.resolveInboundSecret(e, r) : this.sharedSecrets[r];
-  }
-  async createSignedIntent(e) {
-    const r = P({
-      sender: this.agentId,
-      recipient: e.recipient,
-      intent: e.intent,
-      content: e.content,
-      capability: e.capability,
-      correlationId: e.correlationId,
-      ttlMs: e.ttlMs,
-      messageId: e.messageId,
-      nonce: e.nonce,
-      nowMs: e.nowMs
-    });
-    return Q(r, this.outboundSecret, this.keyId);
-  }
-  async receiveAndRespond(e, r = Date.now()) {
-    const n = await E(e, {
-      nowMs: r,
-      requireSignature: this.requireSignature,
-      replayCache: this.replayCache,
-      secretResolver: (a, o) => this.inboundSecretResolver(a, o)
-    });
-    if (!n.ok || !n.envelope)
-      return {
-        ok: !1,
-        diagnostics: n.diagnostics,
-        received: n.envelope,
-        response: null
-      };
-    const s = n.envelope, i = await this.buildAutoResponse(s, r);
-    return {
-      ok: !0,
-      diagnostics: n.diagnostics,
-      received: s,
-      response: i
-    };
-  }
-  async buildAutoResponse(e, r) {
-    if (e.body.intent === "PING")
-      return this.createSignedIntent({
-        recipient: e.header.sender,
-        intent: "PONG",
-        content: "pong",
-        correlationId: e.header.messageId,
-        nowMs: r
-      });
-    if (e.body.intent === "CAPS")
-      return this.createSignedIntent({
-        recipient: e.header.sender,
-        intent: "RESULT",
-        content: Je(
-          ze({
-            agent: this.agentId,
-            capabilities: this.capabilities,
-            wireFormats: this.supportedWireFormats,
-            batchMax: this.maxBatchSize,
-            ackModes: this.ackModes
-          })
-        ),
-        capability: "caps",
-        correlationId: e.header.messageId,
-        nowMs: r
-      });
-    if (e.body.intent === "TASK") {
-      const n = this.onTask ? await this.onTask(e) : { intent: "RESULT", content: "ACK", capability: e.body.capability };
-      return this.createSignedIntent({
-        recipient: e.header.sender,
-        intent: n.intent ?? "RESULT",
-        content: n.content,
-        capability: n.capability,
-        correlationId: e.header.messageId,
-        nowMs: r
-      });
-    }
-    return null;
-  }
-}
-class He {
-  session;
-  wireFormat;
-  constructor(e) {
-    this.session = new je(e), this.wireFormat = e.wireFormat ?? "compact";
-  }
-  toRaw(e) {
-    return U(e, this.wireFormat);
-  }
-  async createRawIntent(e) {
-    const r = await this.session.createSignedIntent(e);
-    return this.toRaw(r);
-  }
-  async receiveRaw(e, r = Date.now()) {
-    return this.session.receiveAndRespond(e, r);
-  }
-  async handleRaw(e, r, n = Date.now()) {
-    const s = await this.session.receiveAndRespond(e, n);
-    return s.response && await r(this.toRaw(s.response), s.response), s;
-  }
-}
-function B(t) {
-  return new He(t);
-}
-async function It(t, e, r = {}) {
-  return t.createRawIntent({
-    recipient: r.recipient,
-    intent: "TASK",
-    content: e.content,
-    capability: r.capability,
-    correlationId: r.correlationId
-  });
-}
-function Mt(t) {
-  return {
-    content: t.body.content,
-    name: t.body.intent,
-    additionalKwargs: {
-      capability: t.body.capability,
-      correlationId: t.body.correlationId,
-      sender: t.header.sender,
-      recipient: t.header.recipient,
-      messageId: t.header.messageId,
-      timestampMs: t.header.timestampMs
-    }
-  };
-}
-async function kt(t, e, r = {}) {
-  return t.createRawIntent({
-    recipient: r.recipient,
-    intent: "TASK",
-    content: e.content,
-    capability: r.capability,
-    correlationId: r.correlationId
-  });
-}
-function St(t) {
-  return {
-    role: t.body.intent === "TASK" ? "user" : "assistant",
-    content: t.body.content,
-    additionalKwargs: {
-      intent: t.body.intent,
-      capability: t.body.capability,
-      correlationId: t.body.correlationId,
-      sender: t.header.sender,
-      recipient: t.header.recipient
-    }
-  };
-}
-function L(t) {
-  return `mcp.${t}`;
-}
-async function Ve(t, e, r = {}) {
-  async function n(a) {
-    r.onPolicyEvent && await r.onPolicyEvent(a);
-  }
-  if (r.allowedMethods && !r.allowedMethods.includes(e.method)) {
-    const a = r.methodToCapability ? r.methodToCapability(e.method) : L(e.method), o = {
-      intent: "TASK",
-      recipient: r.recipient,
-      capability: a,
-      correlationId: String(e.id),
-      createdAtMs: Date.now()
-    };
-    throw await n({
-      stage: "allowlist",
-      decision: "deny",
-      method: e.method,
-      context: o,
-      reason: "method_not_allowed"
-    }), new Error(`JSON-RPC method '${e.method}' is not allowed`);
-  }
-  const s = r.methodToCapability ? r.methodToCapability(e.method) : L(e.method), i = {
-    intent: "TASK",
-    recipient: r.recipient,
-    capability: s,
-    correlationId: String(e.id),
-    createdAtMs: Date.now()
-  };
-  if (await n({
-    stage: "allowlist",
-    decision: "allow",
-    method: e.method,
-    context: i
-  }), r.authorizeMethod) {
-    if (!await r.authorizeMethod(e, i))
-      throw await n({
-        stage: "authorize",
-        decision: "deny",
-        method: e.method,
-        context: i,
-        reason: "not_authorized"
-      }), new Error(`JSON-RPC method '${e.method}' is not authorized`);
-    await n({
-      stage: "authorize",
-      decision: "allow",
-      method: e.method,
-      context: i
-    });
-  }
-  if (r.rateLimiter) {
-    const a = r.rateLimitKey ? r.rateLimitKey(e, i) : e.method;
-    if (!await r.rateLimiter.consume(a, e, i))
-      throw await n({
-        stage: "rateLimit",
-        decision: "deny",
-        method: e.method,
-        context: i,
-        reason: "rate_limited"
-      }), new Error(`JSON-RPC method '${e.method}' is rate-limited`);
-    await n({
-      stage: "rateLimit",
-      decision: "allow",
-      method: e.method,
-      context: i
-    });
-  }
-  return t.createRawIntent({
-    recipient: r.recipient,
-    intent: "TASK",
-    capability: s,
-    correlationId: String(e.id),
-    content: JSON.stringify({ method: e.method, params: e.params ?? null })
-  });
-}
-function We(t, e, r = {}) {
-  if (t.body.intent === "ERROR")
-    return {
-      jsonrpc: "2.0",
-      id: e,
-      error: {
-        code: r.defaultErrorCode ?? -32e3,
-        message: t.body.content,
-        data: {
-          capability: t.body.capability,
-          correlationId: t.body.correlationId
-        }
-      }
-    };
-  let n = t.body.content;
-  try {
-    n = JSON.parse(t.body.content);
-  } catch {
-    n = t.body.content;
-  }
-  return {
-    jsonrpc: "2.0",
-    id: e,
-    result: n
-  };
-}
-function Ge(t) {
-  return typeof t == "object" && t !== null && !Array.isArray(t);
-}
-function $(t, e) {
-  if (typeof t != "string" || t.trim().length === 0)
-    throw new Error(`Invalid runtime policy: '${e}' must be a non-empty string`);
-  return t;
-}
-function Ye(t) {
-  if (!Ge(t))
-    throw new Error("Invalid runtime policy: root must be an object");
-  const e = $(t.version, "version"), r = $(t.name, "name"), n = $(t.status, "status");
-  return {
-    ...t,
-    version: e,
-    name: r,
-    status: n
-  };
-}
-function Xe(t) {
-  let e;
-  try {
-    e = JSON.parse(t);
-  } catch (r) {
-    const n = r instanceof Error ? r.message : String(r);
-    throw new Error(`Invalid runtime policy JSON: ${n}`);
-  }
-  return Ye(e);
-}
-async function Qe(t) {
-  if (typeof fetch == "function") {
-    const e = await fetch(t);
-    if (!e.ok)
-      throw new Error(`Failed to fetch runtime policy at '${t}': ${e.status} ${e.statusText}`);
-    return e.text();
-  }
-  throw new Error(
-    "No default runtime file reader available in this environment. Provide 'readTextFile' in loadRuntimePolicy(options)."
-  );
-}
-async function Ze(t = {}) {
-  const e = t.path ?? "AI_RUNTIME_POLICY.json", n = await (t.readTextFile ?? Qe)(e);
-  return Xe(n);
-}
-function O(t, e) {
-  if (!Array.isArray(t) || t.length !== 2)
-    throw new Error(`Invalid policy tuning range '${e}': expected [min,max]`);
-  const r = Number(t[0]), n = Number(t[1]);
-  if (!Number.isFinite(r) || !Number.isFinite(n) || r <= 0 || n < r)
-    throw new Error(`Invalid policy tuning range '${e}': expected positive ascending numbers`);
-  return [Math.floor(r), Math.floor(n)];
-}
-function qe(t) {
-  return t === "http" || t === "ws" || t === "http-binary" || t === "http-batch" || t === "http-binary-batch" || t === "ws-batch" || t === "ws-binary" || t === "ws-binary-batch";
-}
-function et(t) {
-  const e = Number((t.slo_defaults ?? {}).drop_pct_max ?? 0.1), r = Number((t.slo_defaults ?? {}).p99_ms_max ?? 20), n = Number((t.tuning ?? {}).max_retry_attempts ?? 3), s = Array.isArray((t.tuning ?? {}).retriable_status_codes) ? (t.tuning ?? {}).retriable_status_codes.map((d) => Number(d)).filter((d) => Number.isFinite(d)) : [503], i = t.tuning ?? {}, a = i.batch_size, o = i.inflight_cap, l = i.retry_backoff_ms, c = (d) => ({
-    batchSizeRange: O(a?.[`${d}_traffic`], `batch_size.${d}_traffic`),
-    inflightCapRange: O(o?.[`${d}_traffic`], `inflight_cap.${d}_traffic`),
-    retryBackoffMsRange: O(l?.[`${d}_traffic`], `retry_backoff_ms.${d}_traffic`)
-  });
-  function h(d) {
-    return d.concurrency >= 100 ? "http-binary-batch" : d.latencySensitive ? "ws-batch" : d.compatibilityFirst ? "http" : "ws-batch";
-  }
-  function f(d) {
-    const p = c(d.trafficClass), m = [];
-    return typeof d.dropPct == "number" && d.dropPct > e && (m.push("reduce inflight cap"), m.push("reduce batch size"), m.push("increase retry backoff"), m.push("switch to binary-batch mode")), typeof d.p99Ms == "number" && d.p99Ms > r && (m.push("reduce batch size"), m.push("reduce inflight cap"), m.push("re-run adaptive benchmark")), {
-      ...p,
-      actions: m
-    };
-  }
-  function y(d) {
-    if (d.attempt >= n) return !1;
-    const p = d.error instanceof Error ? d.error.message : String(d.error), m = /http status\s+(\d+)/i.exec(p), v = m ? Number(m[1]) : NaN;
-    return Number.isFinite(v) && s.includes(v);
-  }
-  function u(d) {
-    const p = [];
-    if (d.signatureVerification || p.push("signatureVerification=false"), d.canonicalization || p.push("canonicalization=false"), d.replayDefense || p.push("replayDefense=false"), d.ttlClockSkewEnforcement || p.push("ttlClockSkewEnforcement=false"), p.length > 0)
-      throw new Error(`Invariant violation: ${p.join(", ")}`);
-  }
-  return {
-    selectMode: h,
-    tune: f,
-    shouldRetry: y,
-    assertInvariant: u,
-    metadata: {
-      policyName: t.name,
-      policyVersion: t.version,
-      policyStatus: t.status,
-      enforcedSlo: {
-        dropPctMax: e,
-        p99MsMax: r
-      }
-    }
-  };
-}
-async function F(t = {}) {
-  const e = await Ze(t), r = et(e);
-  return { policy: e, enforcer: r };
-}
-function At(t) {
-  return qe(t);
-}
-const tt = ["tools/call", "resources/read", "prompts/get"];
-function K(t) {
-  return JSON.stringify(t);
-}
-function x(t, e, r) {
-  return K({
-    jsonrpc: "2.0",
-    id: t,
-    error: { code: e, message: r }
-  });
-}
-function rt(t) {
-  const e = JSON.parse(t);
-  return e.jsonrpc !== "2.0" || typeof e.method != "string" || e.method.length === 0 || typeof e.id != "string" && typeof e.id != "number" ? null : {
-    jsonrpc: "2.0",
-    id: e.id,
-    method: e.method,
-    params: e.params
-  };
-}
-function nt(t) {
-  return t.includes("not allowed") ? -32601 : t.includes("not authorized") ? -32001 : t.includes("rate-limited") ? -32002 : -32603;
-}
-function z(t) {
-  const e = t.gatewayAgentId ?? "agent.gateway", r = t.workerAgentId ?? "agent.worker", n = t.allowedMethods ?? tt, s = t.workerCapabilityPrefix ?? "mcp.", i = t.gatewayWireFormat ?? "compact", a = t.workerWireFormat ?? "compact";
-  async function o(h) {
-    t.onAuditEvent && await t.onAuditEvent({
-      ...h,
-      timestampMs: Date.now()
-    });
-  }
-  const l = B({
-    agentId: e,
-    outboundSecret: t.sharedSecret,
-    sharedSecrets: { [r]: t.sharedSecret },
-    wireFormat: i
-  }), c = B({
-    agentId: r,
-    outboundSecret: t.sharedSecret,
-    sharedSecrets: { [e]: t.sharedSecret },
-    wireFormat: a,
-    onTask: async (h) => ({
-      intent: "RESULT",
-      content: K({
-        ok: !0,
-        capability: h.body.capability,
-        content: h.body.content
-      }),
-      capability: h.body.capability?.startsWith(s) ? h.body.capability : `${s}${h.body.capability ?? "unknown"}`
-    })
-  });
-  return {
-    async handleLine(h) {
-      const f = h.trim();
-      if (!f) return null;
-      let y = null;
-      try {
-        const u = rt(f);
-        if (!u)
-          return await o({
-            phase: "request_error",
-            code: -32600,
-            message: "Invalid Request"
-          }), x(null, -32600, "Invalid Request");
-        y = u.id, await o({
-          phase: "request_received",
-          id: u.id,
-          method: u.method
-        });
-        const d = {
-          recipient: r,
-          allowedMethods: n,
-          methodToCapability: t.methodToCapability,
-          authorizeMethod: t.authorizeMethod,
-          rateLimitKey: t.rateLimitKey,
-          rateLimiter: t.rateLimiter,
-          onPolicyEvent: async (_) => {
-            await o({
-              phase: "policy",
-              id: u.id,
-              method: u.method,
-              policy: _
-            });
-          }
-        }, p = await Ve(l, u, d);
-        let m = null;
-        if (await c.handleRaw(p, async (_) => {
-          m = _;
-        }), !m)
-          return await o({
-            phase: "verification_failed",
-            id: u.id,
-            method: u.method,
-            code: -32603,
-            message: "AIP worker did not produce a response"
-          }), x(y, -32603, "AIP worker did not produce a response");
-        const v = await l.receiveRaw(m);
-        return !v.ok || !v.received ? (await o({
-          phase: "verification_failed",
-          id: u.id,
-          method: u.method,
-          code: -32603,
-          message: "AIP verification failed"
-        }), x(y, -32603, "AIP verification failed")) : (await o({
-          phase: "request_success",
-          id: u.id,
-          method: u.method
-        }), K(We(v.received, u.id)));
-      } catch (u) {
-        const d = u instanceof Error ? u.message : "Internal error", p = nt(d);
-        return await o({
-          phase: "request_error",
-          id: y,
-          code: p,
-          message: d
-        }), x(y, p, d);
-      }
-    }
-  };
-}
-async function Et(t) {
-  if (!t.runtimePolicy?.enabled)
-    return z(t);
-  const { enforcer: e } = await F(t.runtimePolicy.options);
-  e.assertInvariant({
-    signatureVerification: !0,
-    canonicalization: !0,
-    replayDefense: !0,
-    ttlClockSkewEnforcement: !0
-  });
-  const r = e.selectMode({
-    concurrency: t.runtimePolicy.concurrencyHint ?? 1,
-    latencySensitive: t.runtimePolicy.latencySensitive,
-    compatibilityFirst: t.runtimePolicy.compatibilityFirst
-  }), n = r.includes("binary") ? "binary" : "compact";
-  return z({
-    ...t,
-    gatewayWireFormat: n,
-    workerWireFormat: n,
-    gatewayAgentId: t.gatewayAgentId,
-    workerAgentId: t.workerAgentId,
-    onAuditEvent: async (s) => {
-      t.onAuditEvent && await t.onAuditEvent({
-        ...s,
-        message: s.message ?? `policy-mode=${r};wire-format=${n}`
-      });
-    }
-  });
-}
-class xt {
-  snapshot = null;
-  options;
-  constructor(e = {}) {
-    this.options = e;
-  }
-  async loadInitial() {
-    const e = await F(this.options);
-    return this.snapshot = {
-      ...e,
-      loadedAtMs: Date.now()
-    }, this.snapshot;
-  }
-  current() {
-    if (!this.snapshot)
-      throw new Error("Runtime policy not loaded. Call loadInitial() first.");
-    return this.snapshot;
-  }
-  async refresh() {
-    const e = this.snapshot;
-    try {
-      const r = await F(this.options);
-      return this.snapshot = {
-        ...r,
-        loadedAtMs: Date.now()
-      }, this.snapshot;
-    } catch (r) {
-      if (e)
-        return e;
-      throw r;
-    }
-  }
-}
-const it = {
-  dev: {
-    environment: "dev",
-    mode: "ws-batch",
-    poolSize: 1,
-    batchSize: 8,
-    inflightCap: 64,
-    retryMaxAttempts: 2
-  },
-  staging: {
-    environment: "staging",
-    mode: "http-binary-batch",
-    poolSize: 2,
-    batchSize: 32,
-    inflightCap: 256,
-    retryMaxAttempts: 3
-  },
-  prod: {
-    environment: "prod",
-    mode: "http-binary-batch",
-    poolSize: 4,
-    batchSize: 64,
-    inflightCap: 1024,
-    retryMaxAttempts: 3
-  }
-};
-function Rt(t) {
-  return it[t];
-}
-function Ct(t) {
-  const e = [];
-  let r = "normal";
-  return t.dropPct > 0.1 && (e.push("reduce inflight cap"), e.push("reduce batch size"), e.push("increase retry backoff"), t.mode === "http" && t.concurrency >= 100 && e.push("switch to http-binary-batch"), r = t.dropPct > 2 ? "critical" : "warn"), t.p99Ms > 20 && (e.push("reduce batch size"), e.push("run adaptive benchmark and re-baseline"), r === "normal" && (r = "warn"), t.p99Ms > 100 && (r = "critical")), {
-    severity: r,
-    actions: e
-  };
-}
-class st {
-  entries = /* @__PURE__ */ new Map();
-  now;
-  constructor(e = {}) {
-    this.now = e.now ?? (() => Date.now());
-  }
-  live(e) {
-    const r = this.entries.get(e);
-    if (r) {
-      if (r.expiresAt !== void 0 && r.expiresAt <= this.now()) {
-        this.entries.delete(e);
-        return;
-      }
-      return r;
-    }
-  }
-  async set(e, r, n = {}) {
-    if (n.nx && this.live(e)) return null;
-    const s = n.pxMs !== void 0 ? this.now() + n.pxMs : void 0;
-    return this.entries.set(e, { value: r, expiresAt: s }), "OK";
-  }
-  async get(e) {
-    return this.live(e)?.value ?? null;
-  }
-  async del(e) {
-    const r = this.live(e) !== void 0;
-    return this.entries.delete(e), r ? 1 : 0;
-  }
-  pipeline() {
-    const e = [], r = {
-      set: (n, s, i) => (e.push({ key: n, value: s, options: i }), r),
-      exec: async () => {
-        const n = [];
-        for (const s of e)
-          n.push(await this.set(s.key, s.value, s.options));
-        return n;
-      }
-    };
-    return r;
-  }
-}
-function at(t, e = {}) {
-  const r = e.keyPrefix ?? "aip:replay:", n = e.errorBehavior ?? "fallback", s = e.onDegraded, i = e.fallback ?? (n === "fallback" ? (
-    // The local fallback runs over a non-throwing in-memory client, so it
-    // needs no fallback of its own — `reject` terminates the chain.
-    at(new st(), { keyPrefix: r, errorBehavior: "reject" })
-  ) : void 0);
-  function a(o, l, c, h) {
-    return s?.(o, { key: l, behavior: n }), n === "allow" ? !0 : n === "reject" ? !1 : i ? i.reserve(l, c, h) : !1;
-  }
-  return {
-    async reserve(o, l, c) {
-      const h = Math.max(1, l - c);
-      try {
-        return await t.set(`${r}${o}`, "1", { nx: !0, pxMs: h }) === "OK";
-      } catch (f) {
-        return a(f, o, l, c);
-      }
-    },
-    async reserveMany(o, l) {
-      if (o.length === 0) return [];
-      if (t.pipeline)
-        try {
-          const c = t.pipeline();
-          for (const { key: f, expiresAtMs: y } of o)
-            c.set(`${r}${f}`, "1", { nx: !0, pxMs: Math.max(1, y - l) });
-          return (await c.exec()).map((f) => f === "OK");
-        } catch (c) {
-          return Promise.all(o.map((h) => a(c, h.key, h.expiresAtMs, l)));
-        }
-      return Promise.all(o.map((c) => this.reserve(c.key, c.expiresAtMs, l)));
-    }
-  };
-}
-class Nt {
-  /** keyId map value: revoked-until timestamp, or `Infinity` for permanent. */
-  revoked = /* @__PURE__ */ new Map();
-  now;
-  constructor(e = {}) {
-    this.now = e.now ?? (() => Date.now());
-  }
-  makeKey(e, r) {
-    return `${e}\0${r}`;
-  }
-  isRevoked(e, r, n = this.now()) {
-    const s = this.revoked.get(this.makeKey(e, r));
-    return s === void 0 ? !1 : s <= n ? (this.revoked.delete(this.makeKey(e, r)), !1) : !0;
-  }
-  revoke(e, r, n = {}) {
-    this.revoked.set(this.makeKey(e, r), n.untilMs ?? Number.POSITIVE_INFINITY);
-  }
-}
-function Pt(t, e = {}) {
-  const r = e.keyPrefix ?? "aip:revoked:", n = e.errorBehavior ?? "reject", s = e.cacheTtlMs ?? 5e3, i = e.onDegraded, a = e.now ?? (() => Date.now()), o = /* @__PURE__ */ new Map();
-  function l(c, h) {
-    return `${r}${c}\0${h}`;
-  }
-  return {
-    async isRevoked(c, h, f = a()) {
-      const y = l(c, h), u = o.get(y);
-      if (u && u.freshUntil > f) return u.revoked;
-      try {
-        if (!t.get) throw new Error("RedisLikeClient.get is required for revocation reads");
-        const p = await t.get(y) !== null;
-        return o.set(y, { revoked: p, freshUntil: f + s }), p;
-      } catch (d) {
-        return i?.(d, { sender: c, keyId: h }), u ? u.revoked : n === "reject";
-      }
-    },
-    async revoke(c, h, f = {}) {
-      const y = l(c, h), u = f.untilMs !== void 0 ? Math.max(1, f.untilMs - a()) : void 0;
-      await t.set(y, "1", u !== void 0 ? { pxMs: u } : void 0), o.set(y, { revoked: !0, freshUntil: a() + s });
-    }
-  };
-}
-function Tt(t, e, r = {}) {
-  const n = r.nowMsProvider ?? (() => Date.now());
-  return async (s, i) => {
-    if (!await e.isRevoked(i, s.keyId, n()))
-      return t(s, i);
-  };
-}
-function R(t, e, r) {
-  return { jsonrpc: "2.0", id: t, error: { code: e, message: r } };
-}
-function ce(t, e) {
-  return { requireSignature: !0, ...t.receive, replayCache: e };
-}
-function _t(t, e) {
-  const r = e.wireFormat ?? "compact", n = e.ttlMs ?? 6e4, s = e.receive?.replayCache ?? new T(), i = ce(e, s);
-  async function a(l) {
-    return U(await e.sign(l), r);
-  }
-  function o(l, c, h, f) {
-    return a(
-      P({ sender: e.selfAgentId, recipient: l, intent: c, content: JSON.stringify(h), correlationId: f, ttlMs: n })
-    );
-  }
-  return async (l) => {
-    const c = await E(l, i), h = c.envelope?.header.sender, f = c.envelope?.header.messageId;
-    if (!c.ok || !c.envelope) {
-      const d = c.diagnostics.find((p) => p.level === "error")?.message ?? "AIP verification failed";
-      return o(h, "ERROR", R(null, -32600, d), f);
-    }
-    if (c.envelope.header.recipient !== e.selfAgentId)
-      return o(h, "ERROR", R(null, -32600, "Recipient mismatch: envelope not addressed to this agent"), f);
-    let y;
-    try {
-      y = JSON.parse(c.envelope.body.content);
-    } catch {
-      return o(h, "ERROR", R(null, -32700, "Parse error: envelope body is not JSON-RPC"), f);
-    }
-    let u;
-    try {
-      u = await t(y);
-    } catch (d) {
-      u = R(y.id ?? null, -32603, d instanceof Error ? d.message : "Internal error");
-    }
-    return o(c.envelope.header.sender, "RESULT", u, f);
-  };
-}
-function ot(t) {
-  const e = t.wireFormat ?? "compact", r = t.ttlMs ?? 6e4, n = t.receive?.replayCache ?? new T(), s = ce(t, n);
-  return {
-    async encodeRequest(i) {
-      const a = P({
-        sender: t.selfAgentId,
-        recipient: t.peerAgentId,
-        intent: "TASK",
-        content: JSON.stringify(i),
-        ttlMs: r
-      });
-      return { raw: U(await t.sign(a), e), messageId: a.header.messageId };
-    },
-    async decodeResponse(i, a = {}) {
-      const o = await E(i, s);
-      if (!o.ok || !o.envelope) {
-        const l = o.diagnostics.find((c) => c.level === "error")?.message ?? "unknown";
-        throw new Error(`AIP response verification failed: ${l}`);
-      }
-      if (!t.peerAgentId)
-        throw new Error("createMcpClientCodec requires peerAgentId to bind the response sender");
-      if (o.envelope.header.sender !== t.peerAgentId)
-        throw new Error(`AIP response sender '${o.envelope.header.sender}' is not the expected peer '${t.peerAgentId}'`);
-      if (a.expectCorrelationId !== void 0 && o.envelope.body.correlationId !== a.expectCorrelationId)
-        throw new Error(
-          `AIP response correlationId '${o.envelope.body.correlationId ?? ""}' does not match request '${a.expectCorrelationId}'`
-        );
-      return JSON.parse(o.envelope.body.content);
-    }
-  };
-}
-function $t(t, e) {
-  const r = ot(e);
-  return async (n) => {
-    const { raw: s, messageId: i } = await r.encodeRequest(n);
-    return r.decodeResponse(await t(s), { expectCorrelationId: i });
-  };
-}
-const de = {};
-function le(t) {
-  if (typeof t != "string")
-    throw new Error("stdio adapter supports json/compact (string) wire formats; use the HTTP adapter for binary");
-  return t;
-}
-function Ot(t, e = {}) {
-  const r = e.input ?? process.stdin, n = e.output ?? process.stdout, s = de.createInterface({ input: r, crlfDelay: Number.POSITIVE_INFINITY });
-  let i = Promise.resolve();
-  const a = (o) => {
-    const l = o.trim();
-    l && (i = i.then(async () => {
-      try {
-        const c = await t(l);
-        n.write(`${le(c)}
-`);
-      } catch (c) {
-        e.onError?.(c);
-      }
-    }));
-  };
-  return s.on("line", a), {
-    close() {
-      s.off("line", a), s.close();
-    }
-  };
-}
-function Ft(t) {
-  const e = de.createInterface({ input: t.input, crlfDelay: Number.POSITIVE_INFINITY }), r = [], n = (s) => {
-    const i = s.trim();
-    if (!i) return;
-    const a = r.shift();
-    a && a(i);
-  };
-  return e.on("line", n), {
-    send(s) {
-      const i = le(s);
-      return new Promise((a) => {
-        r.push(a), t.output.write(`${i}
-`);
-      });
-    },
-    close() {
-      e.off("line", n), e.close();
-    }
-  };
-}
-function Kt(t, e = {}) {
-  return (r, n) => {
-    const s = [];
-    r.on("data", (i) => s.push(i)), r.on("error", () => {
-      n.writeHead(400), n.end();
-    }), r.on("end", () => {
-      (async () => {
-        try {
-          const i = Buffer.concat(s), a = e.binary ? new Uint8Array(i) : i.toString("utf8"), o = await t(a);
-          typeof o == "string" ? (n.writeHead(200, { "content-type": "application/json" }), n.end(o)) : (n.writeHead(200, { "content-type": "application/octet-stream" }), n.end(Buffer.from(o)));
-        } catch (i) {
-          n.writeHead(500, { "content-type": "application/json" }), n.end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code: -32603, message: i instanceof Error ? i.message : "internal error" } }));
-        }
-      })();
-    });
-  };
-}
-function Ut(t) {
-  const e = t.fetchImpl ?? fetch, r = t.binary ? "application/octet-stream" : "application/json";
-  return {
-    async send(n) {
-      const s = await e(t.url, {
-        method: "POST",
-        headers: { "content-type": r, ...t.headers },
-        body: typeof n == "string" ? n : Buffer.from(n)
-      });
-      return t.binary ? new Uint8Array(await s.arrayBuffer()) : s.text();
-    }
-  };
-}
-export {
-  je as AgentSession,
-  He as AipAgentAdapter,
-  Me as DEFAULT_MAX_BINARY_ENVELOPE_BYTES,
-  ft as DistributedReplayCache,
-  st as InMemoryRedisLikeClient,
-  T as InMemoryReplayCache,
-  Nt as InMemoryRevocationStore,
-  Oe as InMemoryVerificationMaterialCache,
-  bt as RollingKeyring,
-  xt as RuntimePolicyManager,
-  pt as SessionTransport,
-  F as bootstrapRuntimePolicyEnforcer,
-  A as canonicalizeEnvelope,
-  B as createAipAgentAdapter,
-  ze as createAipCapabilities,
-  z as createAipMcpGatewayRuntime,
-  Et as createAipMcpGatewayRuntimeWithPolicy,
-  P as createEnvelope,
-  Ut as createHttpMcpClient,
-  Kt as createHttpMcpHandler,
-  vt as createKeyringSignatureResolver,
-  ot as createMcpClientCodec,
-  et as createPolicyEnforcer,
-  Ve as createRawTaskFromJsonRpc,
-  It as createRawTaskFromLangChain,
-  kt as createRawTaskFromLlamaIndex,
-  at as createRedisReplayStore,
-  Pt as createRedisRevocationStore,
-  mt as createSignedMessage,
-  Ft as createStdioMcpClient,
-  Ke as decodeEnvelope,
-  Ue as decodeEnvelopeBatch,
-  _e as decodeEnvelopeBinary,
-  Je as encodeAipCapabilities,
-  U as encodeEnvelope,
-  yt as encodeEnvelopeBatch,
-  Te as encodeEnvelopeBinary,
-  dt as generateEd25519KeypairBase64Url,
-  Rt as getRuntimeTuningPreset,
-  At as isRuntimeMode,
-  Ze as loadRuntimePolicy,
-  wt as negotiateAipCapabilities,
-  gt as parseAipCapabilities,
-  Xe as parseRuntimePolicyJson,
-  E as receiveEnvelope,
-  De as receiveEnvelopeBatch,
-  Ct as recommendPolicyAdjustments,
-  Ot as serveMcpOverStdio,
-  lt as signCanonicalPayloadEd25519,
-  ct as signCanonicalPayloadHmac,
-  ut as signEnvelopeEd25519,
-  Q as signEnvelopeHmac,
-  We as toJsonRpcResponse,
-  Mt as toLangChainMessage,
-  St as toLlamaIndexMessage,
-  Ie as validateEnvelope,
-  Ye as validateRuntimePolicy,
-  ge as verifyCanonicalPayloadEd25519,
-  me as verifyCanonicalPayloadHmac,
-  ve as verifyCanonicalPayloadSignature,
-  be as verifyEnvelopeEd25519,
-  we as verifyEnvelopeHmac,
-  ht as verifyEnvelopeSignature,
-  Tt as withRevocationCheck,
-  $t as wrapMcpClient,
-  _t as wrapMcpServer
-};