@7h3/protocol 0.4.0 → 0.5.1

package/bench-results/wire-codecs-quick-1778843936130.json

@@ -1,93 +0,0 @@
-{
-  "generatedAt": "2026-05-15T11:18:56.130Z",
-  "profile": "quick",
-  "iterations": 10000,
-  "payloadSizes": [
-    256,
-    1024,
-    4096,
-    16384
-  ],
-  "results": [
-    {
-      "profile": "quick",
-      "payloadBytes": 256,
-      "format": "compact-json",
-      "encodedBytes": 498,
-      "encodeUsPerOp": 0.861,
-      "decodeUsPerOp": 0.93,
-      "encodeOpsPerSecond": 1161370.719,
-      "decodeOpsPerSecond": 1075066.173
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 256,
-      "format": "binary",
-      "encodedBytes": 426,
-      "encodeUsPerOp": 6.016,
-      "decodeUsPerOp": 2.499,
-      "encodeOpsPerSecond": 166209.883,
-      "decodeOpsPerSecond": 400117.683
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 1024,
-      "format": "compact-json",
-      "encodedBytes": 1269,
-      "encodeUsPerOp": 0.963,
-      "decodeUsPerOp": 0.904,
-      "encodeOpsPerSecond": 1038530.737,
-      "decodeOpsPerSecond": 1105743.219
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 1024,
-      "format": "binary",
-      "encodedBytes": 1197,
-      "encodeUsPerOp": 6.58,
-      "decodeUsPerOp": 2.551,
-      "encodeOpsPerSecond": 151983.004,
-      "decodeOpsPerSecond": 391961.804
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 4096,
-      "format": "compact-json",
-      "encodedBytes": 4341,
-      "encodeUsPerOp": 2.29,
-      "decodeUsPerOp": 1.706,
-      "encodeOpsPerSecond": 436690.681,
-      "decodeOpsPerSecond": 586132.045
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 4096,
-      "format": "binary",
-      "encodedBytes": 4269,
-      "encodeUsPerOp": 8.274,
-      "decodeUsPerOp": 2.81,
-      "encodeOpsPerSecond": 120859.221,
-      "decodeOpsPerSecond": 355922.792
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 16384,
-      "format": "compact-json",
-      "encodedBytes": 16632,
-      "encodeUsPerOp": 6.953,
-      "decodeUsPerOp": 3.802,
-      "encodeOpsPerSecond": 143830.843,
-      "decodeOpsPerSecond": 263020.978
-    },
-    {
-      "profile": "quick",
-      "payloadBytes": 16384,
-      "format": "binary",
-      "encodedBytes": 16560,
-      "encodeUsPerOp": 13.34,
-      "decodeUsPerOp": 3.786,
-      "encodeOpsPerSecond": 74962.159,
-      "decodeOpsPerSecond": 264160.181
-    }
-  ]
-}

package/bin/7h3.ts

@@ -1,385 +0,0 @@
-#!/usr/bin/env node
-import { parseArgs } from 'node:util'
-import { createServer } from 'node:http'
-import { writeFileSync } from 'node:fs'
-
-const USAGE = `
-7h3 — Aurelion Interaction Protocol CLI (wire version 7h3/0.1)
-
-Usage:
-  7h3 keygen [--output <file>]
-  7h3 sign   --private-key <key> --sender <id> [--recipient <id>] [--payload <str>] [--ttl <ms>]
-  7h3 verify --public-key <key> --envelope <json>
-  7h3 inspect --envelope <json>
-  7h3 gateway --upstream <url> [--port <n>] [--public-key <key>] [--require ed25519|none]
-              [--sign-responses] [--private-key <key>] [--sender <id>]
-  7h3 keys serve [--public-key <key>] [--key-id <id>] [--port <n>]
-  7h3 help
-
-Commands:
-  keygen     Generate an Ed25519 keypair (PKCS8/SPKI, base64url-encoded)
-  sign       Create and sign an AIP envelope
-  verify     Verify an AIP envelope signature
-  inspect    Pretty-print an AIP envelope fields
-  gateway    Run a verifying HTTP proxy gateway
-  keys serve Serve a /.well-known/7h3-keys endpoint
-  help       Show this usage table
-`
-
-function die(msg: string): never {
-  process.stderr.write(`Error: ${msg}\n`)
-  process.exit(1)
-}
-
-async function cmdKeygen(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      output: { type: 'string', short: 'o' },
-    },
-    strict: false,
-  })
-
-  const { generateEd25519KeypairBase64Url } = await import('../src/protocol.js')
-  const { publicKey, privateKey } = await generateEd25519KeypairBase64Url()
-
-  const result = {
-    algorithm: 'Ed25519',
-    wireVersion: '7h3/0.1',
-    publicKey,
-    privateKey,
-    createdAt: new Date().toISOString(),
-    warning: 'Keep privateKey secret — it grants signing authority over your agent identity.',
-  }
-
-  const json = JSON.stringify(result, null, 2)
-
-  if (values.output) {
-    writeFileSync(values.output as string, json, 'utf8')
-    process.stdout.write(`Keypair written to ${values.output}\n`)
-    process.stdout.write(`  algorithm : Ed25519\n`)
-    process.stdout.write(`  publicKey : ${publicKey}\n`)
-    process.stdout.write(`  createdAt : ${result.createdAt}\n`)
-  } else {
-    process.stdout.write(json + '\n')
-  }
-}
-
-async function cmdSign(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      'private-key': { type: 'string' },
-      sender: { type: 'string' },
-      recipient: { type: 'string' },
-      payload: { type: 'string' },
-      ttl: { type: 'string' },
-    },
-    strict: false,
-  })
-
-  const privateKey = values['private-key'] as string | undefined
-  const sender = values['sender'] as string | undefined
-
-  if (!privateKey) die('--private-key is required')
-  if (!sender) die('--sender is required')
-
-  const { createEnvelope, signEnvelopeEd25519 } = await import('../src/protocol.js')
-
-  const envelope = createEnvelope({
-    sender: sender!,
-    recipient: values['recipient'] as string | undefined,
-    intent: 'PING',
-    content: (values['payload'] as string | undefined) ?? '',
-    ttlMs: values['ttl'] ? parseInt(values['ttl'] as string, 10) : 60_000,
-  })
-
-  const signed = await signEnvelopeEd25519(envelope, privateKey!)
-  process.stdout.write(JSON.stringify(signed) + '\n')
-}
-
-async function cmdVerify(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      'public-key': { type: 'string' },
-      envelope: { type: 'string' },
-    },
-    strict: false,
-  })
-
-  const publicKey = values['public-key'] as string | undefined
-  const envelopeJson = values['envelope'] as string | undefined
-
-  if (!publicKey) die('--public-key is required')
-  if (!envelopeJson) die('--envelope is required')
-
-  const { validateEnvelope, verifyEnvelopeEd25519 } = await import('../src/protocol.js')
-
-  let envelope: ReturnType<typeof JSON.parse>
-  try {
-    envelope = JSON.parse(envelopeJson!)
-  } catch {
-    die('--envelope is not valid JSON')
-  }
-
-  const diagnostics = validateEnvelope(envelope)
-  const errors = diagnostics.filter(d => d.level === 'error')
-  const warnings = diagnostics.filter(d => d.level === 'warning')
-
-  if (errors.length > 0) {
-    process.stdout.write('INVALID — envelope validation errors:\n')
-    for (const e of errors) process.stdout.write(`  [error] ${e.message}\n`)
-    for (const w of warnings) process.stdout.write(`  [warning] ${w.message}\n`)
-    process.exit(1)
-  }
-
-  const valid = await verifyEnvelopeEd25519(envelope, publicKey!)
-
-  if (valid) {
-    process.stdout.write('Signature valid\n')
-    if (warnings.length > 0) {
-      for (const w of warnings) process.stdout.write(`  [warning] ${w.message}\n`)
-    }
-  } else {
-    process.stdout.write('INVALID — signature verification failed\n')
-    process.stdout.write(`  alg   : ${envelope.signature?.alg ?? 'none'}\n`)
-    process.stdout.write(`  keyId : ${envelope.signature?.keyId ?? 'none'}\n`)
-    process.exit(1)
-  }
-}
-
-async function cmdInspect(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      envelope: { type: 'string' },
-    },
-    strict: false,
-  })
-
-  const envelopeJson = values['envelope'] as string | undefined
-  if (!envelopeJson) die('--envelope is required')
-
-  let envelope: ReturnType<typeof JSON.parse>
-  try {
-    envelope = JSON.parse(envelopeJson!)
-  } catch {
-    die('--envelope is not valid JSON')
-  }
-
-  const h = envelope.header ?? {}
-  const b = envelope.body ?? {}
-  const s = envelope.signature
-
-  const nowMs = Date.now()
-  const expiresMs = (h.timestampMs ?? 0) + (h.ttlMs ?? 0)
-  const expired = expiresMs < nowMs
-  const expiresStatus = expired
-    ? `EXPIRED (${new Date(expiresMs).toISOString()})`
-    : `OK — expires ${new Date(expiresMs).toISOString()}`
-
-  const content: string = typeof b.content === 'string' ? b.content : ''
-  const contentPreview = content.length > 80 ? content.slice(0, 77) + '...' : content
-
-  process.stdout.write(`Wire Version : ${h.version ?? '(none)'}\n`)
-  process.stdout.write(`Message ID   : ${h.messageId ?? '(none)'}\n`)
-  process.stdout.write(`Sender       : ${h.sender ?? '(none)'}\n`)
-  process.stdout.write(`Recipient    : ${h.recipient ?? '(none)'}\n`)
-  process.stdout.write(`Timestamp    : ${h.timestampMs ? new Date(h.timestampMs).toISOString() : '(none)'}\n`)
-  process.stdout.write(`TTL          : ${h.ttlMs ?? '(none)'} ms\n`)
-  process.stdout.write(`Expires      : ${expiresStatus}\n`)
-  process.stdout.write(`Intent       : ${b.intent ?? '(none)'}\n`)
-  process.stdout.write(`Content      : ${contentPreview || '(empty)'}\n`)
-  if (s) {
-    process.stdout.write(`Sig alg      : ${s.alg}\n`)
-    process.stdout.write(`Sig keyId    : ${s.keyId}\n`)
-  } else {
-    process.stdout.write(`Signature    : (none)\n`)
-  }
-}
-
-async function cmdGateway(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      upstream: { type: 'string' },
-      port: { type: 'string' },
-      'public-key': { type: 'string' },
-      require: { type: 'string' },
-      'sign-responses': { type: 'boolean' },
-      'private-key': { type: 'string' },
-      sender: { type: 'string' },
-    },
-    strict: false,
-  })
-
-  const upstream = values['upstream'] as string | undefined
-  if (!upstream) die('--upstream is required')
-
-  const port = parseInt((values['port'] as string | undefined) ?? '8080', 10)
-  const publicKey = values['public-key'] as string | undefined
-  const requireMode = (values['require'] as string | undefined) ?? (publicKey ? 'ed25519' : 'none')
-  const signResponses = !!(values['sign-responses'])
-  const privateKey = values['private-key'] as string | undefined
-  const sender = values['sender'] as string | undefined
-
-  const { createGateway } = await import('../src/gateway.js')
-  const { createStaticKeyRegistry } = await import('../src/keyRegistry.js')
-
-  const keys: Record<string, string> = {}
-  if (publicKey && sender) keys[sender] = publicKey
-  const keyRegistry = createStaticKeyRegistry(keys)
-
-  const gateway = createGateway({
-    upstream: upstream!,
-    keyRegistry,
-    signResponses: signResponses && !!privateKey,
-    privateKey,
-    sender,
-    defaultPolicy: requireMode === 'none' ? 'allow' : 'deny',
-  })
-
-  const server = createServer(async (req, res) => {
-    const chunks: Buffer[] = []
-    req.on('data', (chunk: Buffer) => chunks.push(chunk))
-    req.on('end', async () => {
-      const body = Buffer.concat(chunks)
-
-      // Flatten headers: string | string[] => string
-      const headers: Record<string, string> = {}
-      for (const [k, v] of Object.entries(req.headers)) {
-        if (v === undefined) continue
-        headers[k] = Array.isArray(v) ? v.join(', ') : v
-      }
-
-      try {
-        const result = await gateway.handle({
-          method: req.method ?? 'GET',
-          path: req.url ?? '/',
-          headers,
-          body: body.length > 0 ? body.toString('utf8') : undefined,
-        })
-        res.writeHead(result.status, result.headers)
-        res.end(result.body)
-      } catch (err) {
-        res.writeHead(502, { 'content-type': 'text/plain' })
-        res.end(`Gateway error: ${String(err)}`)
-      }
-    })
-  })
-
-  server.listen(port, () => {
-    process.stderr.write(`7h3 gateway listening on port ${port}\n`)
-    process.stderr.write(`  upstream      : ${upstream}\n`)
-    process.stderr.write(`  verify mode   : ${requireMode}\n`)
-    process.stderr.write(`  sign-responses: ${signResponses && !!privateKey}\n`)
-    if (sender) process.stderr.write(`  sender        : ${sender}\n`)
-  })
-}
-
-async function cmdKeysServe(argv: string[]): Promise<void> {
-  const { values } = parseArgs({
-    args: argv,
-    options: {
-      'public-key': { type: 'string' },
-      'key-id': { type: 'string' },
-      port: { type: 'string' },
-    },
-    strict: false,
-  })
-
-  const publicKey = values['public-key'] as string | undefined
-  const keyId = (values['key-id'] as string | undefined) ?? 'default'
-  const port = parseInt((values['port'] as string | undefined) ?? '8081', 10)
-
-  const { serveWellKnownKeys } = await import('../src/keyInfra.js')
-
-  const doc = {
-    version: '7h3/0.1' as const,
-    updated: Date.now(),
-    keys: publicKey
-      ? [
-          {
-            id: keyId,
-            algorithm: 'Ed25519' as const,
-            publicKey,
-            created: Date.now(),
-          },
-        ]
-      : [],
-  }
-
-  const body = serveWellKnownKeys(doc)
-
-  const server = createServer((req, res) => {
-    if (req.url === '/.well-known/7h3-keys') {
-      res.writeHead(200, { 'content-type': 'application/json' })
-      res.end(body)
-    } else {
-      res.writeHead(404, { 'content-type': 'text/plain' })
-      res.end('Not Found')
-    }
-  })
-
-  server.listen(port, () => {
-    process.stderr.write(`7h3 key server listening on port ${port}\n`)
-    process.stderr.write(`  GET /.well-known/7h3-keys\n`)
-    if (publicKey) process.stderr.write(`  key-id: ${keyId}\n`)
-    else process.stderr.write(`  (no keys configured — empty document)\n`)
-  })
-}
-
-async function main(): Promise<void> {
-  const args = process.argv.slice(2)
-  const command = args[0] ?? 'help'
-  const rest = args.slice(1)
-
-  switch (command) {
-    case 'keygen':
-      await cmdKeygen(rest)
-      break
-
-    case 'sign':
-      await cmdSign(rest)
-      break
-
-    case 'verify':
-      await cmdVerify(rest)
-      break
-
-    case 'inspect':
-      await cmdInspect(rest)
-      break
-
-    case 'gateway':
-      await cmdGateway(rest)
-      break
-
-    case 'keys': {
-      const sub = rest[0]
-      if (sub === 'serve') {
-        await cmdKeysServe(rest.slice(1))
-      } else {
-        die(`Unknown subcommand 'keys ${sub ?? ''}'. Did you mean 'keys serve'?`)
-      }
-      break
-    }
-
-    case 'help':
-    case '--help':
-    case '-h':
-      process.stdout.write(USAGE)
-      break
-
-    default:
-      process.stderr.write(`Unknown command: ${command}\n`)
-      process.stdout.write(USAGE)
-      process.exit(1)
-  }
-}
-
-main().catch(err => {
-  process.stderr.write(`Fatal: ${String(err)}\n`)
-  process.exit(1)
-})

package/conformance/7h3_v0_1.json

@@ -1,77 +0,0 @@
-{
-  "version": "7h3/0.1",
-  "vectors": [
-    {
-      "id": "task-with-capability-and-recipient",
-      "secret": "vector-secret-1",
-      "keyId": "vector-key-1",
-      "envelope": {
-        "header": {
-          "version": "7h3/0.1",
-          "messageId": "vec-1",
-          "timestampMs": 1712500000000,
-          "ttlMs": 60000,
-          "sender": "agent.alpha",
-          "recipient": "agent.beta",
-          "nonce": "nonce-vec-1"
-        },
-        "body": {
-          "intent": "TASK",
-          "content": "route:alpha->beta",
-          "capability": "task.plan",
-          "correlationId": "corr-1"
-        }
-      },
-      "canonical": "{\"body\":{\"capability\":\"task.plan\",\"content\":\"route:alpha->beta\",\"correlationId\":\"corr-1\",\"intent\":\"TASK\"},\"header\":{\"messageId\":\"vec-1\",\"nonce\":\"nonce-vec-1\",\"recipient\":\"agent.beta\",\"sender\":\"agent.alpha\",\"timestampMs\":1712500000000,\"ttlMs\":60000,\"version\":\"7h3/0.1\"}}",
-      "signature": "bZP1N1f4w4RGSKw6pfdcA6dQjvpv9nIHAQCttjNCZyI"
-    },
-    {
-      "id": "result-with-minimal-fields",
-      "secret": "vector-secret-2",
-      "keyId": "vector-key-2",
-      "envelope": {
-        "header": {
-          "version": "7h3/0.1",
-          "messageId": "vec-2",
-          "timestampMs": 1712500005000,
-          "ttlMs": 30000,
-          "sender": "memory.agent",
-          "nonce": "nonce-vec-2"
-        },
-        "body": {
-          "intent": "RESULT",
-          "content": "memory:ok"
-        }
-      },
-      "canonical": "{\"body\":{\"content\":\"memory:ok\",\"intent\":\"RESULT\"},\"header\":{\"messageId\":\"vec-2\",\"nonce\":\"nonce-vec-2\",\"sender\":\"memory.agent\",\"timestampMs\":1712500005000,\"ttlMs\":30000,\"version\":\"7h3/0.1\"}}",
-      "signature": "_soWM4GZS8qWZDWyXEeXPaQp7Diyp2SQua9mKy2q0BQ"
-    }
-  ],
-  "ed25519Vectors": [
-    {
-      "id": "task-ed25519-with-recipient",
-      "keyId": "ed-vector-key-1",
-      "publicKey": "MCowBQYDK2VwAyEA-mUFiTQtcKN4nnD19V_-Wyy4q19OivnAutRUPhOcC78",
-      "privateKey": "MC4CAQAwBQYDK2VwBCIEICheZbQGuDVb6hezIlcs0QnCHGxz6IhiLkC9M0qr8OOZ",
-      "envelope": {
-        "header": {
-          "version": "7h3/0.1",
-          "messageId": "vec-ed-1",
-          "timestampMs": 1712500010000,
-          "ttlMs": 45000,
-          "sender": "agent.ed",
-          "recipient": "agent.verify",
-          "nonce": "nonce-ed-1"
-        },
-        "body": {
-          "intent": "TASK",
-          "content": "route:ed25519",
-          "capability": "task.sign",
-          "correlationId": "corr-ed-1"
-        }
-      },
-      "canonical": "{\"body\":{\"capability\":\"task.sign\",\"content\":\"route:ed25519\",\"correlationId\":\"corr-ed-1\",\"intent\":\"TASK\"},\"header\":{\"messageId\":\"vec-ed-1\",\"nonce\":\"nonce-ed-1\",\"recipient\":\"agent.verify\",\"sender\":\"agent.ed\",\"timestampMs\":1712500010000,\"ttlMs\":45000,\"version\":\"7h3/0.1\"}}",
-      "signature": "AAWu-6pp7NQZ-NtWKrgREWlMBx-kMZZzZ5dIiBqOdT-zdr-u4HtS6upE79yX7UUNPYUfyKs7lfssi0EeOvIxAA"
-    }
-  ]
-}

package/conformance/7h3_v0_1_binary.json

@@ -1,20 +0,0 @@
-{
-  "generatedAt": "2026-06-28T00:56:52.383Z",
-  "vectors": [
-    {
-      "id": "task-with-capability-and-recipient",
-      "alg": "HS256",
-      "binaryHex": "41495042010f0000018eb8f445000000ea60000000073768332f302e31000000057665632d310000000b6167656e742e616c7068610000000b6e6f6e63652d7665632d31000000045441534b00000011726f7574653a616c7068612d3e626574610000000a6167656e742e62657461000000097461736b2e706c616e00000006636f72722d31010000000c766563746f722d6b65792d310000002b625a50314e31663477345247534b773670666463413664516a767076396e494841514374746a4e435a7949"
-    },
-    {
-      "id": "result-with-minimal-fields",
-      "alg": "HS256",
-      "binaryHex": "4149504201080000018eb8f4588800007530000000073768332f302e31000000057665632d320000000c6d656d6f72792e6167656e740000000b6e6f6e63652d7665632d3200000006524553554c54000000096d656d6f72793a6f6b010000000c766563746f722d6b65792d320000002b5f736f574d34475a533871575a445779584565585061517037446979703253517561396d4b793271304251"
-    },
-    {
-      "id": "task-ed25519-with-recipient",
-      "alg": "ED25519",
-      "binaryHex": "41495042010f0000018eb8f46c100000afc8000000073768332f302e31000000087665632d65642d31000000086167656e742e65640000000a6e6f6e63652d65642d31000000045441534b0000000d726f7574653a656432353531390000000c6167656e742e766572696679000000097461736b2e7369676e00000009636f72722d65642d31020000000f65642d766563746f722d6b65792d3100000056414157752d367070374e515a2d4e74574b72675245576c4d42782d6b4d5a5a7a5a3564496942714f64542d7a64722d753448745336757045373979583755554e50595566794b73376c667373693045654f7649784141"
-    }
-  ]
-}

package/conformance/aip_v0_1_binary.json

@@ -1,20 +0,0 @@
-{
-  "generatedAt": "2026-05-04T04:49:29.647Z",
-  "vectors": [
-    {
-      "id": "task-with-capability-and-recipient",
-      "alg": "HS256",
-      "binaryHex": "41495042010f0000018eb8f445000000ea60000000076169702f302e31000000057665632d310000000b6167656e742e616c7068610000000b6e6f6e63652d7665632d31000000045441534b00000011726f7574653a616c7068612d3e626574610000000a6167656e742e62657461000000097461736b2e706c616e00000006636f72722d31010000000c766563746f722d6b65792d310000002b4f6c376c516b5259336c52534961303576686b43795a32336f705973525139416250774670326378324430"
-    },
-    {
-      "id": "result-with-minimal-fields",
-      "alg": "HS256",
-      "binaryHex": "4149504201080000018eb8f4588800007530000000076169702f302e31000000057665632d320000000c6d656d6f72792e6167656e740000000b6e6f6e63652d7665632d3200000006524553554c54000000096d656d6f72793a6f6b010000000c766563746f722d6b65792d320000002b5a57775a5045787732646341416c354278507a33313337386d4351352d674768395566587536705a4b646f"
-    },
-    {
-      "id": "task-ed25519-with-recipient",
-      "alg": "ED25519",
-      "binaryHex": "41495042010f0000018eb8f46c100000afc8000000076169702f302e31000000087665632d65642d31000000086167656e742e65640000000a6e6f6e63652d65642d31000000045441534b0000000d726f7574653a656432353531390000000c6167656e742e766572696679000000097461736b2e7369676e00000009636f72722d65642d31020000000f65642d766563746f722d6b65792d310000005677787941674e494b6f66344d563478487757697a73623366366b326a574168325a7a7132703967684153456b5f464a4157346774366239317a76327a363344506b73416f485a365135334a64656a486f6150316f4251"
-    }
-  ]
-}

package/docker-compose.yaml

@@ -1,77 +0,0 @@
-# 7h3 Protocol — Docker Compose development stack
-# Brings up:
-#   gateway — verifying AIP proxy (port 8080)
-#   api     — minimal example upstream (port 3000, internal only)
-#
-# Quick start:
-#   docker compose up --build
-
-services:
-
-  # ---------------------------------------------------------------------------
-  # gateway — 7h3 Protocol verifying HTTP proxy
-  # ---------------------------------------------------------------------------
-  gateway:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    ports:
-      - "8080:8080"
-    command:
-      - "--port"
-      - "8080"
-      - "--upstream"
-      - "http://api:3000"
-      - "--require"
-      - "ed25519"
-    environment:
-      # Override these at runtime to enable response signing:
-      #   GATEWAY_PRIVATE_KEY=<base64url private key>
-      #   GATEWAY_SENDER=gateway@my-service.example.com
-      NODE_ENV: production
-    depends_on:
-      api:
-        condition: service_started
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
-      interval: 30s
-      timeout: 5s
-      start_period: 10s
-      retries: 3
-
-  # ---------------------------------------------------------------------------
-  # api — minimal example upstream service
-  #
-  # This is a self-contained inline Node.js server that demonstrates the
-  # headers the gateway injects after successful envelope verification:
-  #   x-7h3-sender   — verified sender identity from the AIP envelope
-  #   x-7h3-verified — always "true" when the gateway passed the request
-  #
-  # Replace this service with your actual application in production.
-  # ---------------------------------------------------------------------------
-  api:
-    image: node:22-alpine
-    command: >
-      node -e "
-        const http = require('http');
-        const server = http.createServer((req, res) => {
-          const sender = req.headers['x-7h3-sender'] || null;
-          const verified = req.headers['x-7h3-verified'] === 'true';
-          const body = JSON.stringify({
-            ok: true,
-            path: req.url,
-            sender,
-            verified,
-            method: req.method,
-          });
-          res.writeHead(200, { 'content-type': 'application/json' });
-          res.end(body);
-        });
-        server.listen(3000, () => {
-          process.stderr.write('example api listening on port 3000\n');
-        });
-      "
-    expose:
-      - "3000"
-    restart: unless-stopped