@7h3/protocol 0.4.0 → 0.5.1

package/index.js

@@ -0,0 +1,3662 @@
+//#region \0rolldown/runtime.js
+var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescriptor, r = Object.getOwnPropertyNames, i = Object.getPrototypeOf, a = Object.prototype.hasOwnProperty, o = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), s = (e, i, o, s) => {
+	if (i && typeof i == "object" || typeof i == "function") for (var c = r(i), l = 0, u = c.length, d; l < u; l++) d = c[l], !a.call(e, d) && d !== o && t(e, d, {
+		get: ((e) => i[e]).bind(null, d),
+		enumerable: !(s = n(i, d)) || s.enumerable
+	});
+	return e;
+}, c = (n, r, a) => (a = n == null ? {} : e(i(n)), s(r || !n || !n.__esModule ? t(a, "default", {
+	value: n,
+	enumerable: !0
+}) : a, n)), l = new TextEncoder(), u = 256, d = /* @__PURE__ */ new Map(), f = 256, p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+function ee() {
+	return globalThis.Buffer ?? null;
+}
+function te(e) {
+	let t = [`"messageId":${JSON.stringify(e.messageId)}`, `"nonce":${JSON.stringify(e.nonce)}`];
+	return e.recipient !== void 0 && t.push(`"recipient":${JSON.stringify(e.recipient)}`), t.push(`"sender":${JSON.stringify(e.sender)}`), t.push(`"timestampMs":${e.timestampMs}`), t.push(`"ttlMs":${e.ttlMs}`), t.push(`"version":${JSON.stringify(e.version)}`), `{${t.join(",")}}`;
+}
+function ne(e) {
+	let t = [];
+	return e.capability !== void 0 && t.push(`"capability":${JSON.stringify(e.capability)}`), t.push(`"content":${JSON.stringify(e.content)}`), e.correlationId !== void 0 && t.push(`"correlationId":${JSON.stringify(e.correlationId)}`), t.push(`"intent":${JSON.stringify(e.intent)}`), `{${t.join(",")}}`;
+}
+function re(e) {
+	let t = `hs256:${e}`, n = d.get(t);
+	if (n) return n;
+	d.size >= u && d.clear();
+	let r = v().importKey("raw", l.encode(e), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, !1, ["sign", "verify"]).catch((e) => {
+		throw d.delete(t), e;
+	});
+	return d.set(t, r), r;
+}
+function ie(e) {
+	let t = `ed25519:pkcs8:${e}`, n = p.get(t);
+	if (n) return n;
+	p.size >= f && p.clear();
+	let r = v().importKey("pkcs8", oe(g(e)), { name: "Ed25519" }, !1, ["sign"]).catch((e) => {
+		throw p.delete(t), e;
+	});
+	return p.set(t, r), r;
+}
+function ae(e) {
+	let t = `ed25519:spki:${e}`, n = m.get(t);
+	if (n) return n;
+	m.size >= f && m.clear();
+	let r = v().importKey("spki", oe(g(e)), { name: "Ed25519" }, !1, ["verify"]).catch((e) => {
+		throw m.delete(t), e;
+	});
+	return m.set(t, r), r;
+}
+function h(e) {
+	let t = ee();
+	return (t ? t.from(e).toString("base64") : btoa(String.fromCharCode(...e))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function g(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(e.length / 4) * 4, "="), n = ee();
+	if (n) return new Uint8Array(n.from(t, "base64"));
+	let r = atob(t), i = new Uint8Array(r.length);
+	for (let e = 0; e < r.length; e += 1) i[e] = r.charCodeAt(e);
+	return i;
+}
+function oe(e) {
+	return e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength);
+}
+function _(e) {
+	return `{"body":${ne(e.body)},"header":${te(e.header)}}`;
+}
+function v() {
+	if (typeof crypto > "u" || !crypto.subtle) throw Error("Web Crypto API is not available in this runtime");
+	return crypto.subtle;
+}
+async function se(e, t) {
+	let n = v(), r = await re(t), i = await n.sign("HMAC", r, l.encode(e));
+	return h(new Uint8Array(i));
+}
+async function ce(e, t, n) {
+	let r = v(), i = await re(n), a = g(t);
+	return r.verify("HMAC", i, a.buffer, l.encode(e));
+}
+async function le(e, t) {
+	let n = v(), r = await ie(t), i = await n.sign("Ed25519", r, l.encode(e));
+	return h(new Uint8Array(i));
+}
+async function ue(e, t, n) {
+	let r = v(), i = await ae(n), a = g(t);
+	return r.verify("Ed25519", i, a.buffer, l.encode(e));
+}
+async function de(e, t) {
+	return se(e, t);
+}
+async function fe(e, t, n) {
+	return ce(e, t, n);
+}
+async function pe() {
+	let e = v(), t = await e.generateKey({ name: "Ed25519" }, !0, ["sign", "verify"]), n = await e.exportKey("pkcs8", t.privateKey), r = await e.exportKey("spki", t.publicKey);
+	return {
+		privateKey: h(new Uint8Array(n)),
+		publicKey: h(new Uint8Array(r))
+	};
+}
+async function y(e, t) {
+	return le(e, t);
+}
+async function b(e, t, n) {
+	return ue(e, t, n);
+}
+async function x(e, t, n = "local-dev-key") {
+	let r = await se(_(e), t);
+	return {
+		...e,
+		signature: {
+			alg: "HS256",
+			keyId: n,
+			value: r
+		}
+	};
+}
+async function me(e, t) {
+	return !e.signature || e.signature.alg !== "HS256" ? !1 : ce(_({
+		header: e.header,
+		body: e.body
+	}), e.signature.value, t);
+}
+async function S(e, t, n = "local-ed25519-key") {
+	let r = await le(_(e), t);
+	return {
+		...e,
+		signature: {
+			alg: "ED25519",
+			keyId: n,
+			value: r
+		}
+	};
+}
+async function C(e, t) {
+	return !e.signature || e.signature.alg !== "ED25519" ? !1 : ue(_({
+		header: e.header,
+		body: e.body
+	}), e.signature.value, t);
+}
+async function he(e, t) {
+	return !e.signature || e.signature.alg !== t.alg ? !1 : t.alg === "HS256" ? me(e, t.secret) : C(e, t.publicKey);
+}
+async function ge(e, t, n) {
+	return !t || t.alg !== n.alg ? !1 : n.alg === "HS256" ? fe(e, t.value, n.secret) : b(e, t.value, n.publicKey);
+}
+function w(e, t = Date.now()) {
+	let n = [], r = e.header ?? {}, i = e.body ?? {}, a = typeof r.version == "string" ? r.version : "", o = typeof r.messageId == "string" ? r.messageId : "", s = typeof r.sender == "string" ? r.sender : "", c = typeof r.nonce == "string" ? r.nonce : "", l = typeof r.timestampMs == "number" ? r.timestampMs : 0, u = typeof r.ttlMs == "number" ? r.ttlMs : 0, d = typeof i.content == "string" ? i.content : "";
+	return a !== "7h3/0.1" && n.push({
+		level: "error",
+		message: `Unsupported protocol version '${a}'`
+	}), o.trim() || n.push({
+		level: "error",
+		message: "Missing messageId"
+	}), s.trim() || n.push({
+		level: "error",
+		message: "Missing sender identity"
+	}), c.trim() || n.push({
+		level: "error",
+		message: "Missing nonce — replay protection requires a unique nonce per message"
+	}), u <= 0 && n.push({
+		level: "error",
+		message: "ttlMs must be greater than zero"
+	}), l + u < t && n.push({
+		level: "error",
+		message: "Message TTL expired"
+	}), d.trim() || n.push({
+		level: "warning",
+		message: "Empty content payload"
+	}), n;
+}
+function T(e) {
+	let t = e.nowMs ?? Date.now();
+	return {
+		header: {
+			version: "7h3/0.1",
+			messageId: e.messageId ?? `msg-${t}-${Math.random().toString(36).slice(2, 10)}`,
+			timestampMs: t,
+			ttlMs: e.ttlMs ?? 6e4,
+			sender: e.sender,
+			recipient: e.recipient,
+			nonce: e.nonce ?? Math.random().toString(36).slice(2, 12)
+		},
+		body: {
+			intent: e.intent,
+			content: e.content,
+			capability: e.capability,
+			correlationId: e.correlationId
+		}
+	};
+}
+//#endregion
+//#region src/protocolBinary.ts
+var _e = [
+	65,
+	73,
+	80,
+	66
+], ve = Uint8Array.from(_e), ye = 1, be = 1024 * 1024, xe = 1, Se = 2, Ce = 4, we = 8, Te = new TextEncoder(), Ee = new TextDecoder(), De = new Set([
+	"PING",
+	"PONG",
+	"CAPS",
+	"TASK",
+	"RESULT",
+	"ERROR"
+]);
+function Oe(e) {
+	return Te.encode(e);
+}
+function ke(e) {
+	return Ee.decode(e);
+}
+function Ae(e) {
+	return e === "ED25519" ? 2 : 1;
+}
+function je(e) {
+	return e === 1 ? "HS256" : e === 2 ? "ED25519" : null;
+}
+function E(e) {
+	return { bytes: Oe(e) };
+}
+function D(e) {
+	return e ? 4 + e.bytes.byteLength : 0;
+}
+var Me = class {
+	bytes;
+	view;
+	offset = 0;
+	constructor(e) {
+		this.bytes = new Uint8Array(e), this.view = new DataView(this.bytes.buffer, this.bytes.byteOffset, this.bytes.byteLength);
+	}
+	writeU8(e) {
+		this.bytes[this.offset] = e & 255, this.offset += 1;
+	}
+	writeU32(e) {
+		this.view.setUint32(this.offset, e, !1), this.offset += 4;
+	}
+	writeU64(e) {
+		this.view.setBigUint64(this.offset, BigInt(e), !1), this.offset += 8;
+	}
+	writeBytes(e) {
+		this.bytes.set(e, this.offset), this.offset += e.byteLength;
+	}
+	writeString(e) {
+		this.writeU32(e.bytes.byteLength), this.writeBytes(e.bytes);
+	}
+	finish() {
+		return this.bytes;
+	}
+}, Ne = class {
+	bytes;
+	offset = 0;
+	constructor(e) {
+		this.bytes = e;
+	}
+	remaining() {
+		return this.bytes.byteLength - this.offset;
+	}
+	readU8() {
+		if (this.remaining() < 1) throw Error("Unexpected end of binary envelope");
+		let e = this.bytes[this.offset];
+		return this.offset += 1, e ?? 0;
+	}
+	readU32() {
+		if (this.remaining() < 4) throw Error("Unexpected end of binary envelope");
+		let e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 4).getUint32(0, !1);
+		return this.offset += 4, e;
+	}
+	readU64() {
+		if (this.remaining() < 8) throw Error("Unexpected end of binary envelope");
+		let e = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.offset, 8).getBigUint64(0, !1);
+		return this.offset += 8, Number(e);
+	}
+	readBytes(e) {
+		if (e < 0 || this.remaining() < e) throw Error("Unexpected end of binary envelope");
+		let t = this.bytes.slice(this.offset, this.offset + e);
+		return this.offset += e, t;
+	}
+	readString() {
+		let e = this.readU32();
+		return ke(this.readBytes(e));
+	}
+};
+function Pe(e) {
+	let t = (e.header.recipient ? xe : 0) | (e.body.capability ? Se : 0) | (e.body.correlationId ? Ce : 0) | (e.signature ? we : 0), n = E(e.header.version), r = E(e.header.messageId), i = E(e.header.sender), a = E(e.header.nonce), o = E(e.body.intent), s = E(e.body.content), c = e.header.recipient ? E(e.header.recipient) : null, l = e.body.capability ? E(e.body.capability) : null, u = e.body.correlationId ? E(e.body.correlationId) : null, d = e.signature ? E(e.signature.keyId) : null, f = e.signature ? E(e.signature.value) : null, p = new Me(ve.byteLength + 1 + 1 + 8 + 4 + D(n) + D(r) + D(i) + D(a) + D(o) + D(s) + D(c) + D(l) + D(u) + +!!e.signature + D(d) + D(f));
+	return p.writeBytes(ve), p.writeU8(ye), p.writeU8(t), p.writeU64(e.header.timestampMs), p.writeU32(e.header.ttlMs), p.writeString(n), p.writeString(r), p.writeString(i), p.writeString(a), p.writeString(o), p.writeString(s), c && p.writeString(c), l && p.writeString(l), u && p.writeString(u), e.signature && d && f && (p.writeU8(Ae(e.signature.alg)), p.writeString(d), p.writeString(f)), p.finish();
+}
+function Fe(e, t = {}) {
+	try {
+		let n = t.maxFrameBytes ?? 1048576;
+		if (e.byteLength > n) return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: `Binary envelope exceeds maximum frame size '${n}'`
+			}],
+			envelope: null
+		};
+		let r = new Ne(e);
+		if ([
+			r.readU8(),
+			r.readU8(),
+			r.readU8(),
+			r.readU8()
+		].some((e, t) => e !== _e[t])) return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Invalid binary envelope magic"
+			}],
+			envelope: null
+		};
+		let i = r.readU8();
+		if (i !== ye) return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: `Unsupported binary envelope version '${i}'`
+			}],
+			envelope: null
+		};
+		let a = r.readU8(), o = r.readU64(), s = r.readU32(), c = {
+			header: {
+				version: r.readString(),
+				messageId: r.readString(),
+				timestampMs: o,
+				ttlMs: s,
+				sender: r.readString(),
+				nonce: r.readString()
+			},
+			body: {
+				intent: r.readString(),
+				content: r.readString()
+			}
+		};
+		if (c.header.version !== "7h3/0.1") return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: `Unsupported protocol version '${c.header.version}'`
+			}],
+			envelope: null
+		};
+		if (!De.has(c.body.intent)) return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: `Unsupported intent '${c.body.intent}'`
+			}],
+			envelope: null
+		};
+		if (a & xe && (c.header.recipient = r.readString()), a & Se && (c.body.capability = r.readString()), a & Ce && (c.body.correlationId = r.readString()), a & we) {
+			let e = r.readU8(), t = je(e);
+			if (!t) return {
+				ok: !1,
+				diagnostics: [{
+					level: "error",
+					message: `Unsupported binary signature algorithm '${e}'`
+				}],
+				envelope: null
+			};
+			c.signature = {
+				alg: t,
+				keyId: r.readString(),
+				value: r.readString()
+			};
+		}
+		return r.remaining() === 0 ? {
+			ok: !0,
+			diagnostics: [],
+			envelope: c
+		} : {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Trailing bytes found in binary envelope"
+			}],
+			envelope: null
+		};
+	} catch (e) {
+		return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: e instanceof Error ? e.message : "Invalid binary envelope"
+			}],
+			envelope: null
+		};
+	}
+}
+//#endregion
+//#region src/protocolReplay.ts
+var Ie = class {
+	items = [];
+	peek() {
+		return this.items[0];
+	}
+	push(e) {
+		this.items.push(e), this.bubbleUp(this.items.length - 1);
+	}
+	pop() {
+		if (this.items.length === 0) return;
+		let e = this.items[0], t = this.items.pop();
+		return this.items.length > 0 && t && (this.items[0] = t, this.bubbleDown(0)), e;
+	}
+	bubbleUp(e) {
+		let t = e;
+		for (; t > 0;) {
+			let e = Math.floor((t - 1) / 2), n = this.items[e], r = this.items[t];
+			if (!n || !r || n.expiresAt <= r.expiresAt) break;
+			this.items[e] = r, this.items[t] = n, t = e;
+		}
+	}
+	bubbleDown(e) {
+		let t = e;
+		for (;;) {
+			let e = t * 2 + 1, n = t * 2 + 2, r = t, i = this.items[t], a = this.items[e], o = this.items[n];
+			a && i && a.expiresAt < i.expiresAt && (r = e);
+			let s = this.items[r];
+			if (o && s && o.expiresAt < s.expiresAt && (r = n), r === t) break;
+			let c = this.items[t], l = this.items[r];
+			if (!c || !l) break;
+			this.items[t] = l, this.items[r] = c, t = r;
+		}
+	}
+}, O = class {
+	entries = /* @__PURE__ */ new Map();
+	maxEntries;
+	expiries = new Ie();
+	constructor(e = 1e4) {
+		this.maxEntries = e;
+	}
+	makeKey(e) {
+		return `${encodeURIComponent(e.header.sender)}|${encodeURIComponent(e.header.messageId)}|${encodeURIComponent(e.header.nonce)}`;
+	}
+	prune(e = Date.now()) {
+		for (;;) {
+			let t = this.expiries.peek();
+			if (!t || t.expiresAt > e) break;
+			this.expiries.pop();
+			let n = this.entries.get(t.key);
+			n !== void 0 && n === t.expiresAt && n <= e && this.entries.delete(t.key);
+		}
+	}
+	evictOne() {
+		for (; this.entries.size >= this.maxEntries;) {
+			let e = this.expiries.pop();
+			if (!e) break;
+			let t = this.entries.get(e.key);
+			if (t !== void 0 && t === e.expiresAt) {
+				this.entries.delete(e.key);
+				return;
+			}
+		}
+		if (this.entries.size >= this.maxEntries) {
+			let e = this.entries.keys().next().value;
+			e && this.entries.delete(e);
+		}
+	}
+	consume(e, t = Date.now()) {
+		this.prune(t);
+		let n = this.makeKey(e), r = this.entries.get(n);
+		if (r && r > t) return {
+			ok: !1,
+			reason: "Replay detected for sender/messageId/nonce"
+		};
+		this.entries.size >= this.maxEntries && this.evictOne();
+		let i = e.header.timestampMs + e.header.ttlMs;
+		return this.entries.set(n, i), this.expiries.push({
+			key: n,
+			expiresAt: i
+		}), { ok: !0 };
+	}
+	consumeMany(e, t = Date.now()) {
+		return e.map((e) => this.consume(e, t));
+	}
+}, Le = class {
+	store;
+	constructor(e) {
+		this.store = e;
+	}
+	makeKey(e) {
+		return `${encodeURIComponent(e.header.sender)}|${encodeURIComponent(e.header.messageId)}|${encodeURIComponent(e.header.nonce)}`;
+	}
+	async consume(e, t = Date.now()) {
+		let n = this.makeKey(e), r = e.header.timestampMs + e.header.ttlMs;
+		return await this.store.reserve(n, r, t) ? { ok: !0 } : {
+			ok: !1,
+			reason: "Replay detected for sender/messageId/nonce"
+		};
+	}
+	async consumeMany(e, t = Date.now()) {
+		if (this.store.reserveMany) {
+			let n = e.map((e) => ({
+				key: this.makeKey(e),
+				expiresAtMs: e.header.timestampMs + e.header.ttlMs
+			}));
+			return (await this.store.reserveMany(n, t)).map((e) => e ? { ok: !0 } : {
+				ok: !1,
+				reason: "Replay detected for sender/messageId/nonce"
+			});
+		}
+		return Promise.all(e.map((e) => this.consume(e, t)));
+	}
+}, Re = class {
+	entries = /* @__PURE__ */ new Map();
+	maxEntries;
+	constructor(e = 512) {
+		this.maxEntries = e;
+	}
+	get(e, t = Date.now()) {
+		let n = this.entries.get(e);
+		if (n) {
+			if (n.expiresAtMs <= t) {
+				this.entries.delete(e);
+				return;
+			}
+			return n.material;
+		}
+	}
+	set(e, t, n) {
+		if (this.entries.size >= this.maxEntries) {
+			let e = this.entries.keys().next().value;
+			e && this.entries.delete(e);
+		}
+		this.entries.set(e, {
+			expiresAtMs: n,
+			material: t
+		});
+	}
+	delete(e) {
+		this.entries.delete(e);
+	}
+};
+function ze(e, t) {
+	return `${t}|${e.alg}|${e.keyId}`;
+}
+function Be(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e;
+	return !!(t.header && t.body);
+}
+function Ve(e) {
+	if (!e || typeof e != "object") return !1;
+	let t = e;
+	return t.v === "7h3/0.1" && typeof t.mid == "string" && typeof t.i == "string";
+}
+function He(e) {
+	return {
+		header: {
+			version: e.v,
+			messageId: e.mid,
+			timestampMs: e.ts,
+			ttlMs: e.ttl,
+			sender: e.s,
+			recipient: e.r,
+			nonce: e.n
+		},
+		body: {
+			intent: e.i,
+			content: e.c,
+			capability: e.cap,
+			correlationId: e.cid
+		},
+		signature: e.sig ? {
+			alg: e.sig.a ?? "HS256",
+			keyId: e.sig.k,
+			value: e.sig.v
+		} : void 0
+	};
+}
+function Ue(e) {
+	return {
+		v: e.header.version,
+		mid: e.header.messageId,
+		ts: e.header.timestampMs,
+		ttl: e.header.ttlMs,
+		s: e.header.sender,
+		r: e.header.recipient,
+		n: e.header.nonce,
+		i: e.body.intent,
+		c: e.body.content,
+		cap: e.body.capability,
+		cid: e.body.correlationId,
+		sig: e.signature ? {
+			a: e.signature.alg,
+			k: e.signature.keyId,
+			v: e.signature.value
+		} : void 0
+	};
+}
+function We(e) {
+	if (e instanceof Uint8Array) return Fe(e);
+	try {
+		let t = JSON.parse(e);
+		return Ve(t) ? {
+			ok: !0,
+			diagnostics: [],
+			envelope: He(t)
+		} : Be(t) ? {
+			ok: !0,
+			diagnostics: [],
+			envelope: t
+		} : {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Envelope JSON shape is not recognized"
+			}],
+			envelope: null
+		};
+	} catch {
+		return {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Invalid JSON envelope"
+			}],
+			envelope: null
+		};
+	}
+}
+function Ge(e, t = "json") {
+	return t === "binary" ? Pe(e) : JSON.stringify(t === "compact" ? Ue(e) : e);
+}
+function Ke(e, t = "compact") {
+	return JSON.stringify(t === "compact" ? e.map(Ue) : e);
+}
+function qe(e) {
+	try {
+		let t = JSON.parse(e);
+		return Array.isArray(t) ? t.map((e) => Ve(e) ? {
+			ok: !0,
+			diagnostics: [],
+			envelope: He(e)
+		} : Be(e) ? {
+			ok: !0,
+			diagnostics: [],
+			envelope: e
+		} : {
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Batch item has unrecognized envelope shape"
+			}],
+			envelope: null
+		}) : [{
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Batch payload must be a JSON array"
+			}],
+			envelope: null
+		}];
+	} catch {
+		return [{
+			ok: !1,
+			diagnostics: [{
+				level: "error",
+				message: "Invalid JSON batch payload"
+			}],
+			envelope: null
+		}];
+	}
+}
+async function k(e, t = {}) {
+	let n = t.nowMs ?? Date.now(), r = t.requireSignature ?? !0, i = t.maxClockSkewMs ?? 3e4;
+	async function a(e) {
+		t.telemetry && await t.telemetry({
+			nowMs: n,
+			...e
+		});
+	}
+	let o = typeof e == "string" || e instanceof Uint8Array ? We(e) : {
+		ok: !0,
+		diagnostics: [],
+		envelope: e
+	};
+	if (!o.ok || !o.envelope) return o;
+	if (await a({
+		phase: "decoded",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId
+	}), o.envelope.header.timestampMs > n + i) {
+		let e = "Message timestamp exceeds allowed clock skew", t = [{
+			level: "error",
+			message: e
+		}];
+		return await a({
+			phase: "rejected_clock_skew",
+			sender: o.envelope.header.sender,
+			messageId: o.envelope.header.messageId,
+			reason: e
+		}), {
+			ok: !1,
+			diagnostics: t,
+			envelope: o.envelope
+		};
+	}
+	let s = [...w(o.envelope, n)];
+	if (s.some((e) => e.level === "error")) return await a({
+		phase: "rejected_validation",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId,
+		reason: s.find((e) => e.level === "error")?.message
+	}), {
+		ok: !1,
+		diagnostics: s,
+		envelope: o.envelope
+	};
+	if (!o.envelope.signature) return r ? (s.push({
+		level: "error",
+		message: "Missing signature"
+	}), await a({
+		phase: "rejected_missing_signature",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId,
+		reason: "Missing signature"
+	}), {
+		ok: !1,
+		diagnostics: s,
+		envelope: o.envelope
+	}) : (await a({
+		phase: "accepted",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId
+	}), {
+		ok: !0,
+		diagnostics: s,
+		envelope: o.envelope
+	});
+	let c, l = o.envelope.signature, u = ze(l, o.envelope.header.sender);
+	if (t.verificationMaterialCache && (c = t.verificationMaterialCache.get(u, n)), t.signatureResolver && (c ??= await t.signatureResolver(l, o.envelope.header.sender)), !c && l.alg === "HS256" && t.secretResolver) {
+		let e = await t.secretResolver(l.keyId, o.envelope.header.sender);
+		e && (c = {
+			alg: "HS256",
+			secret: e
+		});
+	}
+	if (c && t.verificationMaterialCache) {
+		let e = Math.max(n + 1, o.envelope.header.timestampMs + o.envelope.header.ttlMs);
+		t.verificationMaterialCache.set(u, c, e);
+	}
+	if (!c) return s.push({
+		level: "error",
+		message: "No signature verification material found for keyId/sender"
+	}), await a({
+		phase: "rejected_missing_material",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId,
+		reason: "No signature verification material found for keyId/sender"
+	}), {
+		ok: !1,
+		diagnostics: s,
+		envelope: o.envelope
+	};
+	if (!await ge(_({
+		header: o.envelope.header,
+		body: o.envelope.body
+	}), o.envelope.signature, c)) return s.push({
+		level: "error",
+		message: "Signature verification failed"
+	}), await a({
+		phase: "rejected_bad_signature",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId,
+		reason: "Signature verification failed"
+	}), {
+		ok: !1,
+		diagnostics: s,
+		envelope: o.envelope
+	};
+	if (t.replayCache) {
+		let e = await t.replayCache.consume(o.envelope, n);
+		if (!e.ok) return s.push({
+			level: "error",
+			message: e.reason ?? "Replay detected"
+		}), await a({
+			phase: "rejected_replay",
+			sender: o.envelope.header.sender,
+			messageId: o.envelope.header.messageId,
+			reason: e.reason
+		}), {
+			ok: !1,
+			diagnostics: s,
+			envelope: o.envelope
+		};
+	}
+	return await a({
+		phase: "accepted",
+		sender: o.envelope.header.sender,
+		messageId: o.envelope.header.messageId
+	}), {
+		ok: !0,
+		diagnostics: s,
+		envelope: o.envelope
+	};
+}
+async function Je(e, t = {}) {
+	let n = Math.max(1, Math.floor(t.batchConcurrency ?? Infinity));
+	return (async (e) => {
+		let r = Array(e.length), i = 0, a = Number.isFinite(n) ? Math.min(n, e.length) : e.length;
+		return await Promise.all(Array.from({ length: a }, async () => {
+			for (; i < e.length;) {
+				let n = i;
+				i += 1;
+				let a = e[n];
+				a && typeof a == "object" && "ok" in a && "diagnostics" in a && "envelope" in a ? r[n] = a : r[n] = await k(a, t);
+			}
+		})), await t.telemetry?.({
+			phase: "batch_summary",
+			nowMs: t.nowMs ?? Date.now(),
+			reason: `items=${e.length};accepted=${r.filter((e) => e?.ok).length}`
+		}), r;
+	})(typeof e == "string" ? qe(e).map((e) => e.ok && e.envelope ? e.envelope : e) : e);
+}
+var Ye = class {
+	options;
+	constructor(e = {}) {
+		this.options = {
+			...e,
+			replayCache: e.replayCache ?? new O(),
+			verificationMaterialCache: e.verificationMaterialCache ?? new Re()
+		};
+	}
+	receive(e, t = Date.now()) {
+		return k(e, {
+			...this.options,
+			nowMs: t
+		});
+	}
+	receiveBatch(e, t = Date.now()) {
+		return Je(e, {
+			...this.options,
+			nowMs: t
+		});
+	}
+};
+async function Xe(e) {
+	return x(T(e), e.secret, e.keyId);
+}
+//#endregion
+//#region src/protocolCapabilities.ts
+var Ze = [
+	"binary",
+	"compact",
+	"json"
+], Qe = ["fast", "receipt"];
+function $e(e) {
+	return {
+		agent: e.agent,
+		capabilities: e.capabilities ?? [],
+		wireFormats: e.wireFormats ?? ["compact", "json"],
+		batchMax: e.batchMax ?? 1,
+		ackModes: e.ackModes ?? ["receipt"]
+	};
+}
+function et(e) {
+	return JSON.stringify(e);
+}
+function tt(e) {
+	try {
+		let t = JSON.parse(e);
+		return typeof t.agent != "string" || !Array.isArray(t.capabilities) || !Array.isArray(t.wireFormats) || !Array.isArray(t.ackModes) || typeof t.batchMax != "number" || t.batchMax < 1 ? null : {
+			agent: t.agent,
+			capabilities: t.capabilities.filter((e) => typeof e == "string"),
+			wireFormats: t.wireFormats.filter((e) => e === "json" || e === "compact" || e === "binary"),
+			batchMax: Math.floor(t.batchMax),
+			ackModes: t.ackModes.filter((e) => e === "fast" || e === "receipt")
+		};
+	} catch {
+		return null;
+	}
+}
+function nt(e, t) {
+	let n = Ze.find((n) => e.wireFormats.includes(n) && t.wireFormats.includes(n)) ?? "compact", r = Qe.find((n) => e.ackModes.includes(n) && t.ackModes.includes(n)) ?? "receipt";
+	return {
+		wireFormat: n,
+		batchMax: Math.max(1, Math.min(e.batchMax, t.batchMax)),
+		ackMode: r
+	};
+}
+//#endregion
+//#region src/keyRotation.ts
+var rt = class {
+	records;
+	constructor(e = []) {
+		this.records = [...e];
+	}
+	add(e) {
+		this.records.push(e);
+	}
+	revoke(e, t, n = Date.now()) {
+		let r = this.records.find((n) => n.sender === e && n.keyId === t);
+		return r ? (r.status = "revoked", r.notAfterMs = Math.min(r.notAfterMs, n), !0) : !1;
+	}
+	selectSigningKey(e, t, n = Date.now()) {
+		return this.records.filter((r) => r.sender === e && r.alg === t && r.status === "active" && r.notBeforeMs <= n && n < r.notAfterMs).sort((e, t) => t.notBeforeMs - e.notBeforeMs)[0] ?? null;
+	}
+	resolveVerificationMaterial(e, t, n = Date.now()) {
+		return this.records.filter((r) => r.sender === t && r.keyId === e.keyId && r.alg === e.alg && r.status !== "revoked" && r.notBeforeMs <= n && n < r.notAfterMs).sort((e, t) => t.notBeforeMs - e.notBeforeMs)[0]?.material;
+	}
+};
+function it(e, t = () => Date.now()) {
+	return async (n, r) => e.resolveVerificationMaterial(n, r, t());
+}
+//#endregion
+//#region src/protocolAgent.ts
+var at = class {
+	agentId;
+	outboundSecret;
+	keyId;
+	capabilities;
+	supportedWireFormats;
+	maxBatchSize;
+	ackModes;
+	requireSignature;
+	replayCache;
+	sharedSecrets;
+	resolveInboundSecret;
+	onTask;
+	constructor(e) {
+		this.agentId = e.agentId, this.outboundSecret = e.outboundSecret, this.keyId = e.keyId ?? `${e.agentId}-k1`, this.capabilities = e.capabilities ?? [], this.supportedWireFormats = e.supportedWireFormats ?? ["compact", "json"], this.maxBatchSize = e.maxBatchSize ?? 1, this.ackModes = e.ackModes ?? ["receipt"], this.requireSignature = e.requireSignature ?? !0, this.replayCache = e.replayCache ?? new O(), this.sharedSecrets = e.sharedSecrets ?? {}, this.resolveInboundSecret = e.resolveInboundSecret, this.onTask = e.onTask;
+	}
+	async inboundSecretResolver(e, t) {
+		return this.resolveInboundSecret ? this.resolveInboundSecret(e, t) : this.sharedSecrets[t];
+	}
+	async createSignedIntent(e) {
+		return x(T({
+			sender: this.agentId,
+			recipient: e.recipient,
+			intent: e.intent,
+			content: e.content,
+			capability: e.capability,
+			correlationId: e.correlationId,
+			ttlMs: e.ttlMs,
+			messageId: e.messageId,
+			nonce: e.nonce,
+			nowMs: e.nowMs
+		}), this.outboundSecret, this.keyId);
+	}
+	async receiveAndRespond(e, t = Date.now()) {
+		let n = await k(e, {
+			nowMs: t,
+			requireSignature: this.requireSignature,
+			replayCache: this.replayCache,
+			secretResolver: (e, t) => this.inboundSecretResolver(e, t)
+		});
+		if (!n.ok || !n.envelope) return {
+			ok: !1,
+			diagnostics: n.diagnostics,
+			received: n.envelope,
+			response: null
+		};
+		let r = n.envelope, i = await this.buildAutoResponse(r, t);
+		return {
+			ok: !0,
+			diagnostics: n.diagnostics,
+			received: r,
+			response: i
+		};
+	}
+	async buildAutoResponse(e, t) {
+		if (e.body.intent === "PING") return this.createSignedIntent({
+			recipient: e.header.sender,
+			intent: "PONG",
+			content: "pong",
+			correlationId: e.header.messageId,
+			nowMs: t
+		});
+		if (e.body.intent === "CAPS") return this.createSignedIntent({
+			recipient: e.header.sender,
+			intent: "RESULT",
+			content: et($e({
+				agent: this.agentId,
+				capabilities: this.capabilities,
+				wireFormats: this.supportedWireFormats,
+				batchMax: this.maxBatchSize,
+				ackModes: this.ackModes
+			})),
+			capability: "caps",
+			correlationId: e.header.messageId,
+			nowMs: t
+		});
+		if (e.body.intent === "TASK") {
+			let n = this.onTask ? await this.onTask(e) : {
+				intent: "RESULT",
+				content: "ACK",
+				capability: e.body.capability
+			};
+			return this.createSignedIntent({
+				recipient: e.header.sender,
+				intent: n.intent ?? "RESULT",
+				content: n.content,
+				capability: n.capability,
+				correlationId: e.header.messageId,
+				nowMs: t
+			});
+		}
+		return null;
+	}
+}, ot = class {
+	session;
+	wireFormat;
+	constructor(e) {
+		this.session = new at(e), this.wireFormat = e.wireFormat ?? "compact";
+	}
+	toRaw(e) {
+		return Ge(e, this.wireFormat);
+	}
+	async createRawIntent(e) {
+		let t = await this.session.createSignedIntent(e);
+		return this.toRaw(t);
+	}
+	async receiveRaw(e, t = Date.now()) {
+		return this.session.receiveAndRespond(e, t);
+	}
+	async handleRaw(e, t, n = Date.now()) {
+		let r = await this.session.receiveAndRespond(e, n);
+		return r.response && await t(this.toRaw(r.response), r.response), r;
+	}
+};
+function st(e) {
+	return new ot(e);
+}
+//#endregion
+//#region src/frameworkAdapters.ts
+async function ct(e, t, n = {}) {
+	return e.createRawIntent({
+		recipient: n.recipient,
+		intent: "TASK",
+		content: t.content,
+		capability: n.capability,
+		correlationId: n.correlationId
+	});
+}
+function lt(e) {
+	return {
+		content: e.body.content,
+		name: e.body.intent,
+		additionalKwargs: {
+			capability: e.body.capability,
+			correlationId: e.body.correlationId,
+			sender: e.header.sender,
+			recipient: e.header.recipient,
+			messageId: e.header.messageId,
+			timestampMs: e.header.timestampMs
+		}
+	};
+}
+async function ut(e, t, n = {}) {
+	return e.createRawIntent({
+		recipient: n.recipient,
+		intent: "TASK",
+		content: t.content,
+		capability: n.capability,
+		correlationId: n.correlationId
+	});
+}
+function dt(e) {
+	return {
+		role: e.body.intent === "TASK" ? "user" : "assistant",
+		content: e.body.content,
+		additionalKwargs: {
+			intent: e.body.intent,
+			capability: e.body.capability,
+			correlationId: e.body.correlationId,
+			sender: e.header.sender,
+			recipient: e.header.recipient
+		}
+	};
+}
+function ft(e) {
+	return `mcp.${e}`;
+}
+async function pt(e, t, n = {}) {
+	async function r(e) {
+		n.onPolicyEvent && await n.onPolicyEvent(e);
+	}
+	if (n.allowedMethods && !n.allowedMethods.includes(t.method)) {
+		let e = n.methodToCapability ? n.methodToCapability(t.method) : ft(t.method), i = {
+			intent: "TASK",
+			recipient: n.recipient,
+			capability: e,
+			correlationId: String(t.id),
+			createdAtMs: Date.now()
+		};
+		throw await r({
+			stage: "allowlist",
+			decision: "deny",
+			method: t.method,
+			context: i,
+			reason: "method_not_allowed"
+		}), Error(`JSON-RPC method '${t.method}' is not allowed`);
+	}
+	let i = n.methodToCapability ? n.methodToCapability(t.method) : ft(t.method), a = {
+		intent: "TASK",
+		recipient: n.recipient,
+		capability: i,
+		correlationId: String(t.id),
+		createdAtMs: Date.now()
+	};
+	if (await r({
+		stage: "allowlist",
+		decision: "allow",
+		method: t.method,
+		context: a
+	}), n.authorizeMethod) {
+		if (!await n.authorizeMethod(t, a)) throw await r({
+			stage: "authorize",
+			decision: "deny",
+			method: t.method,
+			context: a,
+			reason: "not_authorized"
+		}), Error(`JSON-RPC method '${t.method}' is not authorized`);
+		await r({
+			stage: "authorize",
+			decision: "allow",
+			method: t.method,
+			context: a
+		});
+	}
+	if (n.rateLimiter) {
+		let e = n.rateLimitKey ? n.rateLimitKey(t, a) : t.method;
+		if (!await n.rateLimiter.consume(e, t, a)) throw await r({
+			stage: "rateLimit",
+			decision: "deny",
+			method: t.method,
+			context: a,
+			reason: "rate_limited"
+		}), Error(`JSON-RPC method '${t.method}' is rate-limited`);
+		await r({
+			stage: "rateLimit",
+			decision: "allow",
+			method: t.method,
+			context: a
+		});
+	}
+	return e.createRawIntent({
+		recipient: n.recipient,
+		intent: "TASK",
+		capability: i,
+		correlationId: String(t.id),
+		content: JSON.stringify({
+			method: t.method,
+			params: t.params ?? null
+		})
+	});
+}
+function mt(e, t, n = {}) {
+	if (e.body.intent === "ERROR") return {
+		jsonrpc: "2.0",
+		id: t,
+		error: {
+			code: n.defaultErrorCode ?? -32e3,
+			message: e.body.content,
+			data: {
+				capability: e.body.capability,
+				correlationId: e.body.correlationId
+			}
+		}
+	};
+	let r = e.body.content;
+	try {
+		r = JSON.parse(e.body.content);
+	} catch {
+		r = e.body.content;
+	}
+	return {
+		jsonrpc: "2.0",
+		id: t,
+		result: r
+	};
+}
+//#endregion
+//#region src/runtimePolicy.ts
+function ht(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+function gt(e, t) {
+	if (typeof e != "string" || e.trim().length === 0) throw Error(`Invalid runtime policy: '${t}' must be a non-empty string`);
+	return e;
+}
+function _t(e) {
+	if (!ht(e)) throw Error("Invalid runtime policy: root must be an object");
+	let t = gt(e.version, "version"), n = gt(e.name, "name"), r = gt(e.status, "status");
+	return {
+		...e,
+		version: t,
+		name: n,
+		status: r
+	};
+}
+function vt(e) {
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch (e) {
+		let t = e instanceof Error ? e.message : String(e);
+		throw Error(`Invalid runtime policy JSON: ${t}`);
+	}
+	return _t(t);
+}
+async function yt(e) {
+	if (typeof fetch == "function") {
+		let t = await fetch(e);
+		if (!t.ok) throw Error(`Failed to fetch runtime policy at '${e}': ${t.status} ${t.statusText}`);
+		return t.text();
+	}
+	throw Error("No default runtime file reader available in this environment. Provide 'readTextFile' in loadRuntimePolicy(options).");
+}
+async function bt(e = {}) {
+	let t = e.path ?? "AI_RUNTIME_POLICY.json";
+	return vt(await (e.readTextFile ?? yt)(t));
+}
+//#endregion
+//#region src/policyEnforcer.ts
+function xt(e, t) {
+	if (!Array.isArray(e) || e.length !== 2) throw Error(`Invalid policy tuning range '${t}': expected [min,max]`);
+	let n = Number(e[0]), r = Number(e[1]);
+	if (!Number.isFinite(n) || !Number.isFinite(r) || n <= 0 || r < n) throw Error(`Invalid policy tuning range '${t}': expected positive ascending numbers`);
+	return [Math.floor(n), Math.floor(r)];
+}
+function St(e) {
+	return e === "http" || e === "ws" || e === "http-binary" || e === "http-batch" || e === "http-binary-batch" || e === "ws-batch" || e === "ws-binary" || e === "ws-binary-batch";
+}
+function Ct(e) {
+	let t = Number((e.slo_defaults ?? {}).drop_pct_max ?? .1), n = Number((e.slo_defaults ?? {}).p99_ms_max ?? 20), r = Number((e.tuning ?? {}).max_retry_attempts ?? 3), i = Array.isArray((e.tuning ?? {}).retriable_status_codes) ? (e.tuning ?? {}).retriable_status_codes.map((e) => Number(e)).filter((e) => Number.isFinite(e)) : [503], a = e.tuning ?? {}, o = a.batch_size, s = a.inflight_cap, c = a.retry_backoff_ms, l = (e) => ({
+		batchSizeRange: xt(o?.[`${e}_traffic`], `batch_size.${e}_traffic`),
+		inflightCapRange: xt(s?.[`${e}_traffic`], `inflight_cap.${e}_traffic`),
+		retryBackoffMsRange: xt(c?.[`${e}_traffic`], `retry_backoff_ms.${e}_traffic`)
+	});
+	function u(e) {
+		return e.concurrency >= 100 ? "http-binary-batch" : e.latencySensitive ? "ws-batch" : e.compatibilityFirst ? "http" : "ws-batch";
+	}
+	function d(e) {
+		let r = l(e.trafficClass), i = [];
+		return typeof e.dropPct == "number" && e.dropPct > t && (i.push("reduce inflight cap"), i.push("reduce batch size"), i.push("increase retry backoff"), i.push("switch to binary-batch mode")), typeof e.p99Ms == "number" && e.p99Ms > n && (i.push("reduce batch size"), i.push("reduce inflight cap"), i.push("re-run adaptive benchmark")), {
+			...r,
+			actions: i
+		};
+	}
+	function f(e) {
+		if (e.attempt >= r) return !1;
+		let t = e.error instanceof Error ? e.error.message : String(e.error), n = /http status\s+(\d+)/i.exec(t), a = n ? Number(n[1]) : NaN;
+		return Number.isFinite(a) && i.includes(a);
+	}
+	function p(e) {
+		let t = [];
+		if (e.signatureVerification || t.push("signatureVerification=false"), e.canonicalization || t.push("canonicalization=false"), e.replayDefense || t.push("replayDefense=false"), e.ttlClockSkewEnforcement || t.push("ttlClockSkewEnforcement=false"), t.length > 0) throw Error(`Invariant violation: ${t.join(", ")}`);
+	}
+	return {
+		selectMode: u,
+		tune: d,
+		shouldRetry: f,
+		assertInvariant: p,
+		metadata: {
+			policyName: e.name,
+			policyVersion: e.version,
+			policyStatus: e.status,
+			enforcedSlo: {
+				dropPctMax: t,
+				p99MsMax: n
+			}
+		}
+	};
+}
+async function A(e = {}) {
+	let t = await bt(e);
+	return {
+		policy: t,
+		enforcer: Ct(t)
+	};
+}
+function wt(e) {
+	return St(e);
+}
+//#endregion
+//#region src/mcpGateway.ts
+var Tt = [
+	"tools/call",
+	"resources/read",
+	"prompts/get"
+];
+function Et(e) {
+	return JSON.stringify(e);
+}
+function j(e, t, n) {
+	return Et({
+		jsonrpc: "2.0",
+		id: e,
+		error: {
+			code: t,
+			message: n
+		}
+	});
+}
+function Dt(e) {
+	let t = JSON.parse(e);
+	return t.jsonrpc !== "2.0" || typeof t.method != "string" || t.method.length === 0 || typeof t.id != "string" && typeof t.id != "number" ? null : {
+		jsonrpc: "2.0",
+		id: t.id,
+		method: t.method,
+		params: t.params
+	};
+}
+function Ot(e) {
+	return e.includes("not allowed") ? -32601 : e.includes("not authorized") ? -32001 : e.includes("rate-limited") ? -32002 : -32603;
+}
+function kt(e) {
+	let t = e.gatewayAgentId ?? "agent.gateway", n = e.workerAgentId ?? "agent.worker", r = e.allowedMethods ?? Tt, i = e.workerCapabilityPrefix ?? "mcp.", a = e.gatewayWireFormat ?? "compact", o = e.workerWireFormat ?? "compact";
+	async function s(t) {
+		e.onAuditEvent && await e.onAuditEvent({
+			...t,
+			timestampMs: Date.now()
+		});
+	}
+	let c = st({
+		agentId: t,
+		outboundSecret: e.sharedSecret,
+		sharedSecrets: { [n]: e.sharedSecret },
+		wireFormat: a
+	}), l = st({
+		agentId: n,
+		outboundSecret: e.sharedSecret,
+		sharedSecrets: { [t]: e.sharedSecret },
+		wireFormat: o,
+		onTask: async (e) => ({
+			intent: "RESULT",
+			content: Et({
+				ok: !0,
+				capability: e.body.capability,
+				content: e.body.content
+			}),
+			capability: e.body.capability?.startsWith(i) ? e.body.capability : `${i}${e.body.capability ?? "unknown"}`
+		})
+	});
+	return { async handleLine(t) {
+		let i = t.trim();
+		if (!i) return null;
+		let a = null;
+		try {
+			let t = Dt(i);
+			if (!t) return await s({
+				phase: "request_error",
+				code: -32600,
+				message: "Invalid Request"
+			}), j(null, -32600, "Invalid Request");
+			a = t.id, await s({
+				phase: "request_received",
+				id: t.id,
+				method: t.method
+			});
+			let o = await pt(c, t, {
+				recipient: n,
+				allowedMethods: r,
+				methodToCapability: e.methodToCapability,
+				authorizeMethod: e.authorizeMethod,
+				rateLimitKey: e.rateLimitKey,
+				rateLimiter: e.rateLimiter,
+				onPolicyEvent: async (e) => {
+					await s({
+						phase: "policy",
+						id: t.id,
+						method: t.method,
+						policy: e
+					});
+				}
+			}), u = null;
+			if (await l.handleRaw(o, async (e) => {
+				u = e;
+			}), !u) return await s({
+				phase: "verification_failed",
+				id: t.id,
+				method: t.method,
+				code: -32603,
+				message: "AIP worker did not produce a response"
+			}), j(a, -32603, "AIP worker did not produce a response");
+			let d = await c.receiveRaw(u);
+			return !d.ok || !d.received ? (await s({
+				phase: "verification_failed",
+				id: t.id,
+				method: t.method,
+				code: -32603,
+				message: "AIP verification failed"
+			}), j(a, -32603, "AIP verification failed")) : (await s({
+				phase: "request_success",
+				id: t.id,
+				method: t.method
+			}), Et(mt(d.received, t.id)));
+		} catch (e) {
+			let t = e instanceof Error ? e.message : "Internal error", n = Ot(t);
+			return await s({
+				phase: "request_error",
+				id: a,
+				code: n,
+				message: t
+			}), j(a, n, t);
+		}
+	} };
+}
+async function At(e) {
+	if (!e.runtimePolicy?.enabled) return kt(e);
+	let { enforcer: t } = await A(e.runtimePolicy.options);
+	t.assertInvariant({
+		signatureVerification: !0,
+		canonicalization: !0,
+		replayDefense: !0,
+		ttlClockSkewEnforcement: !0
+	});
+	let n = t.selectMode({
+		concurrency: e.runtimePolicy.concurrencyHint ?? 1,
+		latencySensitive: e.runtimePolicy.latencySensitive,
+		compatibilityFirst: e.runtimePolicy.compatibilityFirst
+	}), r = n.includes("binary") ? "binary" : "compact";
+	return kt({
+		...e,
+		gatewayWireFormat: r,
+		workerWireFormat: r,
+		gatewayAgentId: e.gatewayAgentId,
+		workerAgentId: e.workerAgentId,
+		onAuditEvent: async (t) => {
+			e.onAuditEvent && await e.onAuditEvent({
+				...t,
+				message: t.message ?? `policy-mode=${n};wire-format=${r}`
+			});
+		}
+	});
+}
+//#endregion
+//#region src/runtimePolicyManager.ts
+var jt = class {
+	snapshot = null;
+	options;
+	constructor(e = {}) {
+		this.options = e;
+	}
+	async loadInitial() {
+		let e = await A(this.options);
+		return this.snapshot = {
+			...e,
+			loadedAtMs: Date.now()
+		}, this.snapshot;
+	}
+	current() {
+		if (!this.snapshot) throw Error("Runtime policy not loaded. Call loadInitial() first.");
+		return this.snapshot;
+	}
+	async refresh() {
+		let e = this.snapshot;
+		try {
+			let e = await A(this.options);
+			return this.snapshot = {
+				...e,
+				loadedAtMs: Date.now()
+			}, this.snapshot;
+		} catch (t) {
+			if (e) return e;
+			throw t;
+		}
+	}
+}, Mt = {
+	dev: {
+		environment: "dev",
+		mode: "ws-batch",
+		poolSize: 1,
+		batchSize: 8,
+		inflightCap: 64,
+		retryMaxAttempts: 2
+	},
+	staging: {
+		environment: "staging",
+		mode: "http-binary-batch",
+		poolSize: 2,
+		batchSize: 32,
+		inflightCap: 256,
+		retryMaxAttempts: 3
+	},
+	prod: {
+		environment: "prod",
+		mode: "http-binary-batch",
+		poolSize: 4,
+		batchSize: 64,
+		inflightCap: 1024,
+		retryMaxAttempts: 3
+	}
+};
+function Nt(e) {
+	return Mt[e];
+}
+//#endregion
+//#region src/policyTelemetryFeedback.ts
+function Pt(e) {
+	let t = [], n = "normal";
+	return e.dropPct > .1 && (t.push("reduce inflight cap"), t.push("reduce batch size"), t.push("increase retry backoff"), e.mode === "http" && e.concurrency >= 100 && t.push("switch to http-binary-batch"), n = e.dropPct > 2 ? "critical" : "warn"), e.p99Ms > 20 && (t.push("reduce batch size"), t.push("run adaptive benchmark and re-baseline"), n === "normal" && (n = "warn"), e.p99Ms > 100 && (n = "critical")), {
+		severity: n,
+		actions: t
+	};
+}
+//#endregion
+//#region src/redisClient.ts
+var Ft = class {
+	entries = /* @__PURE__ */ new Map();
+	now;
+	constructor(e = {}) {
+		this.now = e.now ?? (() => Date.now());
+	}
+	live(e) {
+		let t = this.entries.get(e);
+		if (t) {
+			if (t.expiresAt !== void 0 && t.expiresAt <= this.now()) {
+				this.entries.delete(e);
+				return;
+			}
+			return t;
+		}
+	}
+	async set(e, t, n = {}) {
+		if (n.nx && this.live(e)) return null;
+		let r = n.pxMs === void 0 ? void 0 : this.now() + n.pxMs;
+		return this.entries.set(e, {
+			value: t,
+			expiresAt: r
+		}), "OK";
+	}
+	async get(e) {
+		return this.live(e)?.value ?? null;
+	}
+	async del(e) {
+		let t = this.live(e) !== void 0;
+		return this.entries.delete(e), +!!t;
+	}
+	pipeline() {
+		let e = [], t = {
+			set: (n, r, i) => (e.push({
+				key: n,
+				value: r,
+				options: i
+			}), t),
+			exec: async () => {
+				let t = [];
+				for (let n of e) t.push(await this.set(n.key, n.value, n.options));
+				return t;
+			}
+		};
+		return t;
+	}
+}, It = class {
+	keyPrefix;
+	client;
+	constructor(e = {}) {
+		if (this.keyPrefix = e.keyPrefix ?? "7h3:nonce:", e.client) this.client = e.client;
+		else {
+			let e = new Ft();
+			this.client = {
+				set: (t, n, r) => e.set(t, n, {
+					nx: r?.nx,
+					pxMs: r?.px
+				}),
+				get: (t) => e.get ? e.get(t) : Promise.resolve(null),
+				del: (t) => e.del ? e.del(t) : Promise.resolve(0),
+				quit: () => Promise.resolve()
+			};
+		}
+	}
+	async check(e, t) {
+		let n = `${this.keyPrefix}${e}`;
+		return await this.client.set(n, "1", {
+			nx: !0,
+			px: Math.max(1, t)
+		}) === null;
+	}
+}, Lt = class {
+	nodes;
+	constructor(e) {
+		this.nodes = e;
+	}
+	async check(e, t) {
+		return (await Promise.all(this.nodes.map((n) => n.check(e, t)))).some((e) => e);
+	}
+};
+function Rt(e, t = {}) {
+	return zt(e) ? Vt(e, t) : new It(e);
+}
+function zt(e) {
+	return typeof e == "object" && !!e && typeof e.set == "function" && (typeof e.pipeline == "function" || !("quit" in e));
+}
+function Bt(e) {
+	return new Lt(e.map((e) => new It({ redisUrl: e })));
+}
+function Vt(e, t = {}) {
+	let n = t.keyPrefix ?? "aip:replay:", r = t.errorBehavior ?? "fallback", i = t.onDegraded, a = t.fallback ?? (r === "fallback" ? Vt(new Ft(), {
+		keyPrefix: n,
+		errorBehavior: "reject"
+	}) : void 0);
+	function o(e, t, n, o) {
+		return i?.(e, {
+			key: t,
+			behavior: r
+		}), r === "allow" ? !0 : r === "reject" ? !1 : a ? a.reserve(t, n, o) : !1;
+	}
+	return {
+		async reserve(t, r, i) {
+			let a = Math.max(1, r - i);
+			try {
+				return await e.set(`${n}${t}`, "1", {
+					nx: !0,
+					pxMs: a
+				}) === "OK";
+			} catch (e) {
+				return o(e, t, r, i);
+			}
+		},
+		async reserveMany(t, r) {
+			if (t.length === 0) return [];
+			if (e.pipeline) try {
+				let i = e.pipeline();
+				for (let { key: e, expiresAtMs: a } of t) i.set(`${n}${e}`, "1", {
+					nx: !0,
+					pxMs: Math.max(1, a - r)
+				});
+				return (await i.exec()).map((e) => e === "OK");
+			} catch (e) {
+				return Promise.all(t.map((t) => o(e, t.key, t.expiresAtMs, r)));
+			}
+			return Promise.all(t.map((e) => this.reserve(e.key, e.expiresAtMs, r)));
+		}
+	};
+}
+//#endregion
+//#region src/revocation.ts
+var Ht = class {
+	revoked = /* @__PURE__ */ new Map();
+	now;
+	constructor(e = {}) {
+		this.now = e.now ?? (() => Date.now());
+	}
+	makeKey(e, t) {
+		return `${e}${t}`;
+	}
+	isRevoked(e, t, n = this.now()) {
+		let r = this.revoked.get(this.makeKey(e, t));
+		return r === void 0 ? !1 : r <= n ? (this.revoked.delete(this.makeKey(e, t)), !1) : !0;
+	}
+	revoke(e, t, n = {}) {
+		this.revoked.set(this.makeKey(e, t), n.untilMs ?? Infinity);
+	}
+};
+function Ut(e, t = {}) {
+	let n = t.keyPrefix ?? "aip:revoked:", r = t.errorBehavior ?? "reject", i = t.cacheTtlMs ?? 5e3, a = t.onDegraded, o = t.now ?? (() => Date.now()), s = /* @__PURE__ */ new Map();
+	function c(e, t) {
+		return `${n}${e}${t}`;
+	}
+	return {
+		async isRevoked(t, n, l = o()) {
+			let u = c(t, n), d = s.get(u);
+			if (d && d.freshUntil > l) return d.revoked;
+			try {
+				if (!e.get) throw Error("RedisLikeClient.get is required for revocation reads");
+				let t = await e.get(u) !== null;
+				return s.set(u, {
+					revoked: t,
+					freshUntil: l + i
+				}), t;
+			} catch (e) {
+				return a?.(e, {
+					sender: t,
+					keyId: n
+				}), d ? d.revoked : r === "reject";
+			}
+		},
+		async revoke(t, n, r = {}) {
+			let a = c(t, n), l = r.untilMs === void 0 ? void 0 : Math.max(1, r.untilMs - o());
+			await e.set(a, "1", l === void 0 ? void 0 : { pxMs: l }), s.set(a, {
+				revoked: !0,
+				freshUntil: o() + i
+			});
+		}
+	};
+}
+function Wt(e, t, n = {}) {
+	let r = n.nowMsProvider ?? (() => Date.now());
+	return async (n, i) => {
+		if (!await t.isRevoked(i, n.keyId, r())) return e(n, i);
+	};
+}
+//#endregion
+//#region src/mcpWrapper.ts
+function Gt(e, t, n) {
+	return {
+		jsonrpc: "2.0",
+		id: e,
+		error: {
+			code: t,
+			message: n
+		}
+	};
+}
+function Kt(e, t) {
+	return {
+		requireSignature: !0,
+		...e.receive,
+		replayCache: t
+	};
+}
+function qt(e, t) {
+	let n = t.wireFormat ?? "compact", r = t.ttlMs ?? 6e4, i = Kt(t, t.receive?.replayCache ?? new O());
+	async function a(e) {
+		return Ge(await t.sign(e), n);
+	}
+	function o(e, n, i, o) {
+		return a(T({
+			sender: t.selfAgentId,
+			recipient: e,
+			intent: n,
+			content: JSON.stringify(i),
+			correlationId: o,
+			ttlMs: r
+		}));
+	}
+	return async (n) => {
+		let r = await k(n, i), a = r.envelope?.header.sender, s = r.envelope?.header.messageId;
+		if (!r.ok || !r.envelope) return o(a, "ERROR", Gt(null, -32600, r.diagnostics.find((e) => e.level === "error")?.message ?? "AIP verification failed"), s);
+		if (r.envelope.header.recipient !== t.selfAgentId) return o(a, "ERROR", Gt(null, -32600, "Recipient mismatch: envelope not addressed to this agent"), s);
+		let c;
+		try {
+			c = JSON.parse(r.envelope.body.content);
+		} catch {
+			return o(a, "ERROR", Gt(null, -32700, "Parse error: envelope body is not JSON-RPC"), s);
+		}
+		let l;
+		try {
+			l = await e(c);
+		} catch (e) {
+			l = Gt(c.id ?? null, -32603, e instanceof Error ? e.message : "Internal error");
+		}
+		return o(r.envelope.header.sender, "RESULT", l, s);
+	};
+}
+function Jt(e) {
+	let t = e.wireFormat ?? "compact", n = e.ttlMs ?? 6e4, r = Kt(e, e.receive?.replayCache ?? new O());
+	return {
+		async encodeRequest(r) {
+			let i = T({
+				sender: e.selfAgentId,
+				recipient: e.peerAgentId,
+				intent: "TASK",
+				content: JSON.stringify(r),
+				ttlMs: n
+			});
+			return {
+				raw: Ge(await e.sign(i), t),
+				messageId: i.header.messageId
+			};
+		},
+		async decodeResponse(t, n = {}) {
+			let i = await k(t, r);
+			if (!i.ok || !i.envelope) {
+				let e = i.diagnostics.find((e) => e.level === "error")?.message ?? "unknown";
+				throw Error(`AIP response verification failed: ${e}`);
+			}
+			if (!e.peerAgentId) throw Error("createMcpClientCodec requires peerAgentId to bind the response sender");
+			if (i.envelope.header.sender !== e.peerAgentId) throw Error(`AIP response sender '${i.envelope.header.sender}' is not the expected peer '${e.peerAgentId}'`);
+			if (n.expectCorrelationId !== void 0 && i.envelope.body.correlationId !== n.expectCorrelationId) throw Error(`AIP response correlationId '${i.envelope.body.correlationId ?? ""}' does not match request '${n.expectCorrelationId}'`);
+			return JSON.parse(i.envelope.body.content);
+		}
+	};
+}
+function Yt(e, t) {
+	let n = Jt(t);
+	return async (t) => {
+		let { raw: r, messageId: i } = await n.encodeRequest(t);
+		return n.decodeResponse(await e(r), { expectCorrelationId: i });
+	};
+}
+//#endregion
+//#region src/mcpTransports.ts
+var M = /* @__PURE__ */ c((/* @__PURE__ */ o(((e, t) => {
+	t.exports = {};
+})))(), 1);
+function Xt(e) {
+	if (typeof e != "string") throw Error("stdio adapter supports json/compact (string) wire formats; use the HTTP adapter for binary");
+	return e;
+}
+function Zt(e, t = {}) {
+	let n = t.input ?? process.stdin, r = t.output ?? process.stdout, i = M.default.createInterface({
+		input: n,
+		crlfDelay: Infinity
+	}), a = Promise.resolve(), o = (n) => {
+		let i = n.trim();
+		i && (a = a.then(async () => {
+			try {
+				let t = await e(i);
+				r.write(`${Xt(t)}\n`);
+			} catch (e) {
+				t.onError?.(e);
+			}
+		}));
+	};
+	return i.on("line", o), { close() {
+		i.off("line", o), i.close();
+	} };
+}
+function Qt(e) {
+	let t = M.default.createInterface({
+		input: e.input,
+		crlfDelay: Infinity
+	}), n = [], r = (e) => {
+		let t = e.trim();
+		if (!t) return;
+		let r = n.shift();
+		r && r(t);
+	};
+	return t.on("line", r), {
+		send(t) {
+			let r = Xt(t);
+			return new Promise((t) => {
+				n.push(t), e.output.write(`${r}\n`);
+			});
+		},
+		close() {
+			t.off("line", r), t.close();
+		}
+	};
+}
+function $t(e, t = {}) {
+	return (n, r) => {
+		let i = [];
+		n.on("data", (e) => i.push(e)), n.on("error", () => {
+			r.writeHead(400), r.end();
+		}), n.on("end", () => {
+			(async () => {
+				try {
+					let n = Buffer.concat(i), a = await e(t.binary ? new Uint8Array(n) : n.toString("utf8"));
+					typeof a == "string" ? (r.writeHead(200, { "content-type": "application/json" }), r.end(a)) : (r.writeHead(200, { "content-type": "application/octet-stream" }), r.end(Buffer.from(a)));
+				} catch (e) {
+					r.writeHead(500, { "content-type": "application/json" }), r.end(JSON.stringify({
+						jsonrpc: "2.0",
+						id: null,
+						error: {
+							code: -32603,
+							message: e instanceof Error ? e.message : "internal error"
+						}
+					}));
+				}
+			})();
+		});
+	};
+}
+function en(e) {
+	let t = e.fetchImpl ?? fetch, n = e.binary ? "application/octet-stream" : "application/json";
+	return { async send(r) {
+		let i = await t(e.url, {
+			method: "POST",
+			headers: {
+				"content-type": n,
+				...e.headers
+			},
+			body: typeof r == "string" ? r : Buffer.from(r)
+		});
+		return e.binary ? new Uint8Array(await i.arrayBuffer()) : i.text();
+	} };
+}
+//#endregion
+//#region src/keyRegistry.ts
+function tn(e) {
+	return { async getPublicKey(t) {
+		return e[t] ?? null;
+	} };
+}
+function nn(...e) {
+	return {
+		async getPublicKey(t) {
+			for (let n of e) {
+				let e = await n.getPublicKey(t);
+				if (e !== null) return e;
+			}
+			return null;
+		},
+		async getSharedSecret(t) {
+			for (let n of e) {
+				if (!n.getSharedSecret) continue;
+				let e = await n.getSharedSecret(t);
+				if (e !== null) return e;
+			}
+			return null;
+		}
+	};
+}
+function rn(e, t) {
+	let n = t?.ttlMs ?? 6e4, r = /* @__PURE__ */ new Map();
+	async function i(e, t) {
+		let i = Date.now(), a = r.get(e);
+		if (a && a.expiresAt > i) return a.value;
+		let o = await t();
+		return r.set(e, {
+			value: o,
+			expiresAt: i + n
+		}), o;
+	}
+	return {
+		async getPublicKey(t) {
+			return i(`pk:${t}`, () => e.getPublicKey(t));
+		},
+		async getSharedSecret(t) {
+			return e.getSharedSecret ? i(`ss:${t}`, () => e.getSharedSecret(t)) : null;
+		}
+	};
+}
+//#endregion
+//#region src/cborCodec.ts
+var N = new TextEncoder(), an = new TextDecoder(), P = 0, on = 1, sn = 2, F = 3, cn = 4, ln = 5, un = 7, dn = 244, fn = 245, pn = 246, mn = 24, hn = 25, gn = 26, _n = 27, vn = 27, yn = class {
+	chunks = [];
+	encode(e) {
+		return this.chunks = [], this._encode(e), this._concat();
+	}
+	_encode(e) {
+		if (e == null) {
+			this.chunks.push(new Uint8Array([pn]));
+			return;
+		}
+		if (typeof e == "boolean") {
+			this.chunks.push(new Uint8Array([e ? fn : dn]));
+			return;
+		}
+		if (typeof e == "number") {
+			this._encodeNumber(e);
+			return;
+		}
+		if (typeof e == "string") {
+			this._encodeString(e);
+			return;
+		}
+		if (e instanceof Uint8Array) {
+			this._encodeByteString(e);
+			return;
+		}
+		if (Array.isArray(e)) {
+			this._encodeArray(e);
+			return;
+		}
+		if (e instanceof Map) {
+			let t = [...e.entries()];
+			this._encodeMapFromAnyEntries(t);
+			return;
+		}
+		if (typeof e == "object") {
+			let t = Object.entries(e);
+			this._encodeMapFromEntries(t);
+			return;
+		}
+		throw Error(`CborEncoder: unsupported type: ${typeof e}`);
+	}
+	_encodeNumber(e) {
+		if (!Number.isFinite(e) || !Number.isInteger(e)) {
+			this.chunks.push(this._float64Header());
+			let t = /* @__PURE__ */ new ArrayBuffer(8);
+			new DataView(t).setFloat64(0, e, !1), this.chunks.push(new Uint8Array(t));
+			return;
+		}
+		e >= 0 ? this._encodeHead(P, e) : this._encodeHead(on, -1 - e);
+	}
+	_float64Header() {
+		return new Uint8Array([251]);
+	}
+	_encodeString(e) {
+		let t = N.encode(e);
+		this._encodeHead(F, t.length), this.chunks.push(t);
+	}
+	_encodeByteString(e) {
+		this._encodeHead(sn, e.length), this.chunks.push(e);
+	}
+	_encodeArray(e) {
+		this._encodeHead(cn, e.length);
+		for (let t of e) this._encode(t);
+	}
+	_encodeMapFromAnyEntries(e) {
+		let t = e.map(([e, t]) => {
+			let n;
+			if (typeof e == "number" && Number.isInteger(e)) n = this._encodeHeadBytes(P, e);
+			else {
+				let t = N.encode(String(e)), r = this._encodeHeadBytes(F, t.length);
+				n = this._concatPair(r, t);
+			}
+			return {
+				keyEncoded: n,
+				key: e,
+				value: t
+			};
+		});
+		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(ln, t.length);
+		for (let { key: e, value: n } of t) {
+			if (typeof e == "number" && Number.isInteger(e)) this._encodeHead(P, e);
+			else {
+				let t = N.encode(String(e));
+				this._encodeHead(F, t.length), this.chunks.push(t);
+			}
+			this._encode(n);
+		}
+	}
+	_encodeMapFromEntries(e) {
+		let t = e.map(([e, t]) => {
+			let n = N.encode(e), r = this._encodeHeadBytes(F, n.length);
+			return {
+				keyBytes: n,
+				keyEncoded: this._concatPair(r, n),
+				value: t
+			};
+		});
+		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(ln, t.length);
+		for (let { keyBytes: e, value: n } of t) this._encodeHead(F, e.length), this.chunks.push(e), this._encode(n);
+	}
+	_compareBytes(e, t) {
+		let n = Math.min(e.length, t.length);
+		for (let r = 0; r < n; r++) {
+			let n = (e[r] ?? 0) - (t[r] ?? 0);
+			if (n !== 0) return n;
+		}
+		return e.length - t.length;
+	}
+	_concatPair(e, t) {
+		let n = new Uint8Array(e.length + t.length);
+		return n.set(e, 0), n.set(t, e.length), n;
+	}
+	_encodeHead(e, t) {
+		this.chunks.push(this._encodeHeadBytes(e, t));
+	}
+	_encodeHeadBytes(e, t) {
+		let n = e << 5;
+		if (t <= 23) return new Uint8Array([n | t]);
+		if (t <= 255) return new Uint8Array([n | mn, t]);
+		if (t <= 65535) {
+			let e = /* @__PURE__ */ new ArrayBuffer(3), r = new DataView(e);
+			return r.setUint8(0, n | hn), r.setUint16(1, t, !1), new Uint8Array(e);
+		}
+		if (t <= 4294967295) {
+			let e = /* @__PURE__ */ new ArrayBuffer(5), r = new DataView(e);
+			return r.setUint8(0, n | gn), r.setUint32(1, t, !1), new Uint8Array(e);
+		}
+		let r = /* @__PURE__ */ new ArrayBuffer(9), i = new DataView(r);
+		return i.setUint8(0, n | _n), i.setBigUint64(1, BigInt(t), !1), new Uint8Array(r);
+	}
+	_concat() {
+		let e = this.chunks.reduce((e, t) => e + t.length, 0), t = new Uint8Array(e), n = 0;
+		for (let e of this.chunks) t.set(e, n), n += e.length;
+		return t;
+	}
+}, bn = class {
+	data;
+	offset = 0;
+	decode(e) {
+		return this.data = e, this.offset = 0, this._decode();
+	}
+	_decode() {
+		let e = this._readByte(), t = e >> 5 & 7, n = e & 31;
+		switch (t) {
+			case P: return this._decodeUint(n);
+			case on: return -1 - this._decodeUint(n);
+			case sn: {
+				let e = this._decodeUint(n);
+				return this._readBytes(e);
+			}
+			case F: {
+				let e = this._decodeUint(n), t = this._readBytes(e);
+				return an.decode(t);
+			}
+			case cn: {
+				let e = this._decodeUint(n), t = [];
+				for (let n = 0; n < e; n++) t.push(this._decode());
+				return t;
+			}
+			case ln: {
+				let e = this._decodeUint(n), t = {};
+				for (let n = 0; n < e; n++) {
+					let e = this._decode();
+					t[String(e)] = this._decode();
+				}
+				return t;
+			}
+			case un:
+				if (n === 20) return !1;
+				if (n === 21) return !0;
+				if (n === 22) return null;
+				if (n === vn) {
+					let e = this._readBytes(8);
+					return new DataView(e.buffer, e.byteOffset, 8).getFloat64(0, !1);
+				}
+				throw Error(`CborDecoder: unsupported simple value ${n}`);
+			default: throw Error(`CborDecoder: unsupported major type ${t}`);
+		}
+	}
+	_decodeUint(e) {
+		if (e <= 23) return e;
+		if (e === mn) return this._readByte();
+		if (e === hn) {
+			let e = this._readBytes(2);
+			return new DataView(e.buffer, e.byteOffset, 2).getUint16(0, !1);
+		}
+		if (e === gn) {
+			let e = this._readBytes(4);
+			return new DataView(e.buffer, e.byteOffset, 4).getUint32(0, !1);
+		}
+		if (e === _n) {
+			let e = this._readBytes(8);
+			return Number(new DataView(e.buffer, e.byteOffset, 8).getBigUint64(0, !1));
+		}
+		throw Error(`CborDecoder: unsupported additional info ${e}`);
+	}
+	_readByte() {
+		if (this.offset >= this.data.length) throw Error("CborDecoder: unexpected end of data");
+		return this.data[this.offset++] ?? 0;
+	}
+	_readBytes(e) {
+		if (this.offset + e > this.data.length) throw Error("CborDecoder: unexpected end of data");
+		let t = this.data.slice(this.offset, this.offset + e);
+		return this.offset += e, t;
+	}
+};
+function xn(e) {
+	return new yn().encode(e);
+}
+function Sn(e) {
+	return new bn().decode(e);
+}
+//#endregion
+//#region src/envelopeCbor.ts
+var Cn = "application/7h3-cbor";
+function wn(e) {
+	let t = /* @__PURE__ */ new Map();
+	t.set(1, e.header.version), t.set(2, e.header.messageId), t.set(3, e.header.timestampMs), t.set(4, e.header.ttlMs), t.set(5, e.header.sender), e.header.recipient !== void 0 && t.set(6, e.header.recipient), t.set(7, e.header.nonce);
+	let n = /* @__PURE__ */ new Map();
+	n.set(1, e.body.intent), n.set(2, e.body.content), e.body.capability !== void 0 && n.set(3, e.body.capability), e.body.correlationId !== void 0 && n.set(4, e.body.correlationId);
+	let r = /* @__PURE__ */ new Map();
+	r.set(1, t), r.set(2, n);
+	let i = e.signature;
+	if (i) {
+		let e = /* @__PURE__ */ new Map();
+		e.set(1, i.alg), e.set(2, i.keyId), e.set(3, i.value), r.set(3, e);
+	}
+	return xn(r);
+}
+function Tn(e) {
+	let t = Sn(e);
+	if (!t || typeof t != "object" || Array.isArray(t)) throw Error("decodeEnvelopeCbor: expected a map at top level");
+	let n = t, r = n[1];
+	if (!r || typeof r != "object" || Array.isArray(r)) throw Error("decodeEnvelopeCbor: missing header map (key 1)");
+	let i = r, a = n[2];
+	if (!a || typeof a != "object" || Array.isArray(a)) throw Error("decodeEnvelopeCbor: missing body map (key 2)");
+	let o = a, s = {
+		header: {
+			version: i[1],
+			messageId: i[2],
+			timestampMs: i[3],
+			ttlMs: i[4],
+			sender: i[5],
+			nonce: i[7]
+		},
+		body: {
+			intent: o[1],
+			content: o[2]
+		}
+	};
+	i[6] !== void 0 && (s.header.recipient = i[6]), o[3] !== void 0 && (s.body.capability = o[3]), o[4] !== void 0 && (s.body.correlationId = o[4]);
+	let c = n[3];
+	if (c != null) {
+		if (typeof c != "object" || Array.isArray(c)) throw Error("decodeEnvelopeCbor: expected signature map at key 3");
+		let e = c;
+		s.signature = {
+			alg: e[1],
+			keyId: e[2],
+			value: e[3]
+		};
+	}
+	return s;
+}
+//#endregion
+//#region src/httpBinding.ts
+var En = "x-7h3-envelope";
+async function Dn(e, t, n) {
+	let r = t.headerName ?? "x-7h3-envelope", i = (Array.isArray(e["content-type"]) ? e["content-type"][0] : e["content-type"]) ?? "", a;
+	if (i.includes("7h3-cbor") && n instanceof Uint8Array) try {
+		a = Tn(n);
+	} catch (e) {
+		return {
+			ok: !1,
+			reason: "malformed-envelope",
+			detail: e instanceof Error ? e.message : "CBOR decode failed"
+		};
+	}
+	else {
+		let t = e[r], n = Array.isArray(t) ? t[0] : t;
+		if (!n) return {
+			ok: !1,
+			reason: "missing-header"
+		};
+		try {
+			a = JSON.parse(n);
+		} catch {
+			return {
+				ok: !1,
+				reason: "malformed-envelope",
+				detail: "JSON parse failed"
+			};
+		}
+	}
+	if (!a?.signature || !a?.header) return {
+		ok: !1,
+		reason: "malformed-envelope",
+		detail: "missing required fields"
+	};
+	if (t.strictTtl ?? !0) {
+		let e = w(a).filter((e) => e.level === "error");
+		if (e.length > 0) return {
+			ok: !1,
+			reason: "ttl-expired",
+			detail: e.map((e) => e.message).join("; ")
+		};
+	}
+	let o = a.header.sender, s = a.signature.alg;
+	if (s === "ED25519") {
+		let e = await t.keyRegistry.getPublicKey(o);
+		if (!e) return {
+			ok: !1,
+			reason: "unknown-sender",
+			detail: o
+		};
+		if (!await C(a, e)) return {
+			ok: !1,
+			reason: "invalid-signature"
+		};
+	} else if (s === "HS256") {
+		let e = await t.keyRegistry.getSharedSecret?.(a.signature.keyId);
+		if (!e) return {
+			ok: !1,
+			reason: "unknown-sender",
+			detail: a.signature.keyId
+		};
+		if (!await me(a, e)) return {
+			ok: !1,
+			reason: "invalid-signature"
+		};
+	} else return {
+		ok: !1,
+		reason: "malformed-envelope",
+		detail: `unsupported alg: ${String(a.signature.alg)}`
+	};
+	return {
+		ok: !0,
+		envelope: a
+	};
+}
+async function On(e, t, n) {
+	let r = await S(e, t);
+	if (n?.format === "cbor") {
+		let e = wn(r);
+		return {
+			headers: { "content-type": Cn },
+			body: e
+		};
+	}
+	return { headers: { [n?.headerName ?? "x-7h3-envelope"]: JSON.stringify(r) } };
+}
+async function kn(e, t, n, r) {
+	let i = await x(e, t, n);
+	return { headers: { [r?.headerName ?? "x-7h3-envelope"]: JSON.stringify(i) } };
+}
+function An(e) {
+	return async function(t, n, r) {
+		let i = await Dn(t.headers, e);
+		if (!i.ok) {
+			n.status(401).json({
+				error: "7h3: request verification failed",
+				reason: i.reason,
+				detail: i.detail
+			});
+			return;
+		}
+		t["7h3Envelope"] = i.envelope, r();
+	};
+}
+async function jn(e, t, n, r) {
+	let { headers: i } = await On(t, n, r), a = new Headers(e.headers);
+	for (let [e, t] of Object.entries(i)) a.set(e, t);
+	return new Request(e, { headers: a });
+}
+async function Mn(e, t) {
+	return jn(e, T({
+		sender: t.sender,
+		recipient: t.recipient,
+		ttlMs: t.ttlMs ?? 6e4,
+		intent: "TASK",
+		content: e.url
+	}), t.privateKey, { headerName: t.headerName });
+}
+//#endregion
+//#region src/webhookBinding.ts
+var I = "x-7h3-sig", L = "x-7h3-ts", Nn = 3e5;
+function R(e, t) {
+	return `${e}.${t}`;
+}
+async function Pn(e, t) {
+	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await y(R(r, n), t.privateKey);
+	return {
+		[I]: i,
+		[L]: String(r)
+	};
+}
+async function Fn(e, t) {
+	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await de(R(r, n), t.secret);
+	return {
+		[I]: i,
+		[L]: String(r)
+	};
+}
+async function In(e, t, n) {
+	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[I], a = t[L];
+	if (!i || !a) return !1;
+	let o = Number(a);
+	if (!Number.isFinite(o)) return !1;
+	let s = n.maxAgeMs ?? 3e5;
+	return Date.now() - o > s ? !1 : b(R(o, r), i, n.publicKey);
+}
+async function Ln(e, t, n) {
+	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[I], a = t[L];
+	if (!i || !a) return !1;
+	let o = Number(a);
+	if (!Number.isFinite(o)) return !1;
+	let s = n.maxAgeMs ?? 3e5;
+	return Date.now() - o > s ? !1 : fe(R(o, r), i, n.secret);
+}
+async function Rn(e, t, n) {
+	if (!await In(e, t, n)) throw Error("7h3: webhook signature verification failed");
+	return JSON.parse(e);
+}
+//#endregion
+//#region src/queueBinding.ts
+async function zn(e, t) {
+	let n = t.ttlMs ?? 36e5, r = typeof e == "string" ? e : JSON.stringify(e), i = {
+		envelope: await S(T({
+			sender: t.sender,
+			recipient: t.recipient,
+			intent: "TASK",
+			content: r,
+			ttlMs: n
+		}), t.privateKey, t.keyId),
+		payload: e
+	};
+	return JSON.stringify(i);
+}
+async function Bn(e, t) {
+	let n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		throw Error("Queue message is not valid JSON");
+	}
+	if (!n.envelope || typeof n.envelope != "object") throw Error("Queue message missing envelope");
+	if (!await C(n.envelope, t.publicKey)) throw Error("Queue message signature verification failed");
+	return {
+		payload: n.payload,
+		envelope: n.envelope
+	};
+}
+async function Vn(e, t) {
+	return Promise.all(e.map(async (e) => {
+		try {
+			let { payload: n, envelope: r } = await Bn(e, t);
+			return {
+				ok: !0,
+				payload: n,
+				envelope: r
+			};
+		} catch (t) {
+			return {
+				ok: !1,
+				raw: e,
+				error: t instanceof Error ? t.message : String(t)
+			};
+		}
+	}));
+}
+//#endregion
+//#region src/stream.ts
+var Hn = "x-7h3-stream", z = new TextEncoder();
+function B() {
+	if (typeof crypto > "u" || !crypto.subtle) throw Error("Web Crypto API is not available in this runtime");
+	return crypto.subtle;
+}
+function V(e) {
+	let t = globalThis.Buffer;
+	return (t ? t.from(e).toString("base64") : btoa(String.fromCharCode(...e))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function H(e) {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(e.length / 4) * 4, "="), n = globalThis.Buffer;
+	if (n) return new Uint8Array(n.from(t, "base64"));
+	let r = atob(t), i = new Uint8Array(r.length);
+	for (let e = 0; e < r.length; e++) i[e] = r.charCodeAt(e);
+	return i;
+}
+function U(e) {
+	return e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength);
+}
+function Un() {
+	let e = new Uint8Array(16);
+	return crypto.getRandomValues(e), V(e);
+}
+var W = /* @__PURE__ */ new Map(), Wn = 128;
+function Gn(e, t) {
+	let n = `${e}:${t}`, r = W.get(n);
+	if (r) return r;
+	W.size >= Wn && W.clear();
+	let i = B(), a = H(e), o = (async () => {
+		let e = await i.importKey("raw", U(a), "HKDF", !1, ["deriveBits"]), n = await i.deriveBits({
+			name: "HKDF",
+			hash: "SHA-256",
+			salt: z.encode(t),
+			info: z.encode("7h3-stream/1")
+		}, e, 256);
+		return i.importKey("raw", n, {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, !1, ["sign"]);
+	})();
+	return o.catch(() => W.delete(n)), W.set(n, o), o;
+}
+var G = /* @__PURE__ */ new Map(), Kn = 64;
+function qn(e) {
+	let t = G.get(e);
+	if (t) return t;
+	G.size >= Kn && G.clear();
+	let n = B().importKey("pkcs8", U(H(e)), { name: "Ed25519" }, !1, ["sign"]).catch((t) => {
+		throw G.delete(e), t;
+	});
+	return G.set(e, n), n;
+}
+var K = /* @__PURE__ */ new Map(), Jn = 64;
+function Yn(e) {
+	let t = K.get(e);
+	if (t) return t;
+	K.size >= Jn && K.clear();
+	let n = B().importKey("spki", U(H(e)), { name: "Ed25519" }, !1, ["verify"]).catch((t) => {
+		throw K.delete(e), t;
+	});
+	return K.set(e, n), n;
+}
+function Xn(e) {
+	let t = e.map((e) => `${e.i}:${e.d}`);
+	return z.encode(t.join("\n"));
+}
+async function Zn(e) {
+	let t = await B().digest("SHA-256", U(e));
+	return new Uint8Array(t);
+}
+var q = class {
+	opts;
+	seq = 0;
+	accum = [];
+	hmacKeyPromise = null;
+	constructor(e) {
+		this.opts = {
+			nonce: e.nonce ?? Un(),
+			keyId: e.keyId ?? "stream-key",
+			...e
+		};
+	}
+	get nonce() {
+		return this.opts.nonce;
+	}
+	getHmacKey() {
+		return this.hmacKeyPromise ||= Gn(this.opts.privateKey, this.opts.nonce), this.hmacKeyPromise;
+	}
+	async computeChunkHmac(e, t) {
+		let n = B(), r = await this.getHmacKey(), i = `${this.opts.nonce}:${e}:${t}`, a = await n.sign("HMAC", r, z.encode(i));
+		return V(new Uint8Array(a));
+	}
+	async writeChunk(e) {
+		let t = this.seq++, n = await this.computeChunkHmac(t, e);
+		return this.accum.push({
+			i: t,
+			d: e
+		}), {
+			i: t,
+			d: e,
+			h: n,
+			f: !1
+		};
+	}
+	async finalize() {
+		let e = B(), t = await qn(this.opts.privateKey), n = await Zn(Xn(this.accum)), r = await e.sign("Ed25519", t, U(n)), i = V(new Uint8Array(r)), a = this.seq;
+		return {
+			i: a,
+			d: "",
+			h: await this.computeChunkHmac(a, V(n)),
+			f: !0,
+			sig: i,
+			kid: this.opts.keyId
+		};
+	}
+}, Qn = class {
+	opts;
+	expectedSeq = 0;
+	accum = [];
+	totalBytes = 0;
+	done = !1;
+	constructor(e) {
+		this.opts = e;
+	}
+	async receiveChunk(e) {
+		if (this.done) return {
+			ok: !1,
+			reason: "stream already finalized"
+		};
+		let t = this.opts.maxChunks ?? 1e4;
+		return this.accum.length >= t ? {
+			ok: !1,
+			reason: `exceeded maxChunks (${t})`
+		} : e.i === this.expectedSeq ? (this.expectedSeq++, this.accum.push({
+			i: e.i,
+			d: e.d
+		}), this.totalBytes += z.encode(e.d).length, { ok: !0 }) : {
+			ok: !1,
+			reason: `sequence error: expected ${this.expectedSeq}, got ${e.i}`
+		};
+	}
+	async finalize(e) {
+		if (this.done) return {
+			ok: !1,
+			reason: "stream already finalized"
+		};
+		if (this.done = !0, !e.sig) return {
+			ok: !1,
+			reason: "missing signature on final chunk"
+		};
+		let t = B(), n;
+		try {
+			n = await Yn(this.opts.publicKey);
+		} catch {
+			return {
+				ok: !1,
+				reason: "invalid public key"
+			};
+		}
+		let r = await Zn(Xn(this.accum)), i = H(e.sig);
+		return await t.verify("Ed25519", n, U(i), U(r)) ? {
+			ok: !0,
+			totalBytes: this.totalBytes,
+			chunkCount: this.accum.length
+		} : {
+			ok: !1,
+			reason: "signature verification failed"
+		};
+	}
+};
+function $n(e) {
+	return new q(e);
+}
+function er(e) {
+	return new Qn(e);
+}
+async function tr(e, t) {
+	let n = new q(t), r = [];
+	if (Array.isArray(e)) for (let t of e) r.push(await n.writeChunk(t));
+	else for await (let t of e) r.push(await n.writeChunk(t));
+	return r.push(await n.finalize()), r;
+}
+async function nr(e, t) {
+	let n = new Qn(t), r = e.slice(0, -1), i = e[e.length - 1];
+	if (e.length === 0) return {
+		ok: !1,
+		reason: "empty chunk array — missing final frame"
+	};
+	for (let e of r) {
+		let t = await n.receiveChunk(e);
+		if (!t.ok) return {
+			ok: !1,
+			reason: t.reason,
+			chunkIndex: e.i
+		};
+	}
+	if (!i.f) {
+		let e = await n.receiveChunk(i);
+		return e.ok ? {
+			ok: !1,
+			reason: "missing final frame"
+		} : {
+			ok: !1,
+			reason: e.reason,
+			chunkIndex: i.i
+		};
+	}
+	return n.finalize(i);
+}
+function rr(e) {
+	return JSON.stringify(e);
+}
+function ir(e) {
+	let t;
+	try {
+		t = JSON.parse(e);
+	} catch {
+		throw Error("decodeStreamChunk: invalid JSON");
+	}
+	let n = t;
+	if (typeof n.i != "number" || typeof n.d != "string" || typeof n.h != "string" || typeof n.f != "boolean") throw Error("decodeStreamChunk: missing required fields (i, d, h, f)");
+	let r = {
+		i: n.i,
+		d: n.d,
+		h: n.h,
+		f: n.f
+	};
+	if (n.sig !== void 0) {
+		if (typeof n.sig != "string") throw Error("decodeStreamChunk: sig must be string");
+		r.sig = n.sig;
+	}
+	if (n.kid !== void 0) {
+		if (typeof n.kid != "string") throw Error("decodeStreamChunk: kid must be string");
+		r.kid = n.kid;
+	}
+	return r;
+}
+//#endregion
+//#region src/wsBinding.ts
+function ar(e, t) {
+	let n = 0, r = [], i = [];
+	function a(e, n) {
+		t.onVerifyFail?.(e, n);
+		for (let t of i) t(e, n);
+	}
+	let o = async (e) => {
+		let n = typeof e.data == "string" ? e.data : e.data.toString("utf8"), i;
+		try {
+			i = JSON.parse(n);
+		} catch {
+			a(/* @__PURE__ */ Error("malformed frame"), n);
+			return;
+		}
+		let o = i?.header?.sender;
+		if (!o) {
+			a(/* @__PURE__ */ Error("missing sender"), n);
+			return;
+		}
+		let s = await t.keyRegistry.getPublicKey(o);
+		if (!s) {
+			a(/* @__PURE__ */ Error(`unknown sender: ${o}`), n);
+			return;
+		}
+		if (!await C(i, s).catch(() => !1)) {
+			a(/* @__PURE__ */ Error("invalid signature"), n);
+			return;
+		}
+		let c = w(i);
+		if (c.some((e) => e.level === "error")) {
+			a(/* @__PURE__ */ Error(`envelope invalid: ${c.map((e) => e.message).join("; ")}`), n);
+			return;
+		}
+		let l = i.body.content;
+		try {
+			l = JSON.parse(i.body.content);
+		} catch {}
+		for (let e of r) e(l, i);
+	};
+	return e.addEventListener("message", o), e.addEventListener("close", () => {
+		e.removeEventListener("message", o);
+	}), {
+		get seq() {
+			return n;
+		},
+		async send(r) {
+			let i = typeof r == "string" ? r : JSON.stringify(r), a = T({
+				sender: t.sender,
+				recipient: t.recipient,
+				ttlMs: t.ttlMs ?? 3e4,
+				intent: "TASK",
+				content: i
+			});
+			a.body.correlationId = String(++n);
+			let o = await S(a, t.privateKey);
+			e.send(JSON.stringify(o));
+		},
+		onMessage(e) {
+			r.push(e);
+		},
+		onVerifyFail(e) {
+			i.push(e);
+		}
+	};
+}
+function or(e, t) {
+	let n = new q(t), r = async (t) => {
+		let r = typeof t.data == "string" ? t.data : t.data.toString("utf8"), i = await n.writeChunk(r);
+		e.send(rr(i));
+	}, i = async () => {
+		e.removeEventListener("message", r), e.removeEventListener("close", i);
+		let t = await n.finalize();
+		e.send(rr(t));
+	};
+	return e.addEventListener("message", r), e.addEventListener("close", i), n;
+}
+function sr(e, t) {
+	return new Promise((n, r) => {
+		let i = [], a = async (e) => {
+			let a = typeof e.data == "string" ? e.data : e.data.toString("utf8"), o;
+			try {
+				o = ir(a);
+			} catch (e) {
+				s(), r(e);
+				return;
+			}
+			i.push(o), o.f && (s(), n(await nr(i, t)));
+		}, o = () => {
+			s(), n({
+				ok: !1,
+				reason: "connection closed before final frame"
+			});
+		};
+		function s() {
+			e.removeEventListener("message", a), e.removeEventListener("close", o);
+		}
+		e.addEventListener("message", a), e.addEventListener("close", o);
+	});
+}
+//#endregion
+//#region src/grpcBinding.ts
+var cr = "7h3-envelope-bin";
+async function lr(e) {
+	let t = await S(T({
+		sender: e.sender,
+		recipient: e.recipient,
+		ttlMs: e.ttlMs ?? 6e4,
+		intent: "TASK",
+		content: "grpc-call"
+	}), e.privateKey);
+	return { [e.metadataKey ?? "7h3-envelope-bin"]: JSON.stringify(t) };
+}
+async function ur(e, t) {
+	let n = e[t.metadataKey ?? "7h3-envelope-bin"], r = Array.isArray(n) ? n[0] : n instanceof Uint8Array ? new TextDecoder().decode(n) : n;
+	if (!r) return {
+		ok: !1,
+		code: 16,
+		message: "7h3: missing gRPC envelope metadata"
+	};
+	let i;
+	try {
+		i = JSON.parse(typeof r == "string" ? r : String(r));
+	} catch {
+		return {
+			ok: !1,
+			code: 3,
+			message: "7h3: malformed envelope metadata"
+		};
+	}
+	if (t.strictTtl !== !1 && w(i).some((e) => e.level === "error")) return {
+		ok: !1,
+		code: 4,
+		message: "7h3: envelope expired or invalid"
+	};
+	let a = i.header?.sender, o = i.signature?.alg;
+	if (!a || !o) return {
+		ok: !1,
+		code: 3,
+		message: "7h3: missing sender or alg"
+	};
+	if (o === "ED25519") {
+		let e = await t.keyRegistry.getPublicKey(a);
+		if (!e) return {
+			ok: !1,
+			code: 16,
+			message: `7h3: unknown sender ${a}`
+		};
+		if (!await C(i, e)) return {
+			ok: !1,
+			code: 16,
+			message: "7h3: invalid signature"
+		};
+	} else if (o === "HS256") {
+		let e = await t.keyRegistry.getSharedSecret?.(i.signature.keyId);
+		if (!e) return {
+			ok: !1,
+			code: 16,
+			message: "7h3: unknown key"
+		};
+		if (!await me(i, e)) return {
+			ok: !1,
+			code: 16,
+			message: "7h3: invalid signature"
+		};
+	} else return {
+		ok: !1,
+		code: 3,
+		message: `7h3: unsupported alg ${String(o)}`
+	};
+	return {
+		ok: !0,
+		envelope: i
+	};
+}
+function dr(e, t) {
+	return async (n) => {
+		let r = await ur(n.metadata, t);
+		if (!r.ok) throw Object.assign(Error(r.message), { code: r.code });
+		return n["7h3Envelope"] = r.envelope, e(n);
+	};
+}
+//#endregion
+//#region src/keyInfra.ts
+function fr(e) {
+	return JSON.stringify(e);
+}
+function pr(e) {
+	let t = JSON.parse(e);
+	if (t.version !== "7h3/0.1") throw Error(`unsupported version: ${t.version}`);
+	return t;
+}
+async function mr(e, t) {
+	let n = e.replace(/\/$/, "") + "/.well-known/7h3-keys", r = new AbortController(), i = t?.timeout ? setTimeout(() => r.abort(), t.timeout) : void 0;
+	try {
+		let e = await fetch(n, { signal: r.signal });
+		if (!e.ok) throw Error(`HTTP ${e.status} from ${n}`);
+		return pr(await e.text());
+	} finally {
+		i !== void 0 && clearTimeout(i);
+	}
+}
+function hr(e) {
+	let t = /* @__PURE__ */ new Map(), n = e?.cacheMs ?? 6e4, r = e?.timeout ?? 5e3;
+	async function i(e) {
+		let i = Date.now(), a = t.get(e);
+		if (a && a.expiresAt > i) return a.doc;
+		let o = await mr(e, { timeout: r });
+		return t.set(e, {
+			doc: o,
+			expiresAt: i + n
+		}), o;
+	}
+	return { async getPublicKey(e) {
+		let t = e.includes("@") ? e.split("@")[1] : e.split(".").slice(-2).join(".");
+		if (!t) return null;
+		try {
+			let n = await i(`https://${t}`), r = Date.now();
+			return n.keys.find((t) => (t.id === e || t.id === e.split("@")[0]) && !t.revoked && (!t.expires || t.expires > r))?.publicKey ?? null;
+		} catch {
+			return null;
+		}
+	} };
+}
+var gr = class {
+	maxAgeMs;
+	overlapMs;
+	keys = [];
+	constructor(e) {
+		this.maxAgeMs = e.maxAgeMs, this.overlapMs = e.overlapMs ?? Math.floor(e.maxAgeMs * .1);
+	}
+	addKey(e) {
+		this.keys.push(e);
+	}
+	getCurrentKey() {
+		let e = Date.now(), t = this.keys.filter((t) => !t.expiresAt || t.expiresAt > e);
+		return t.length === 0 ? null : t.reduce((e, t) => e.createdAt > t.createdAt ? e : t);
+	}
+	async rotateIfNeeded() {
+		let e = Date.now(), t = this.getCurrentKey();
+		if (t && e - t.createdAt < this.maxAgeMs - this.overlapMs) return null;
+		t && !t.expiresAt && (t.expiresAt = e + this.overlapMs);
+		let { publicKey: n, privateKey: r } = await pe(), i = {
+			id: `key-${e}-${Math.random().toString(36).slice(2, 8)}`,
+			publicKey: n,
+			privateKey: r,
+			createdAt: e
+		};
+		return this.keys.push(i), i;
+	}
+	getWellKnownDocument() {
+		let e = Date.now();
+		return {
+			version: "7h3/0.1",
+			updated: e,
+			keys: this.keys.map((t) => ({
+				id: t.id,
+				algorithm: "Ed25519",
+				publicKey: t.publicKey,
+				created: t.createdAt,
+				...t.expiresAt ? { expires: t.expiresAt } : {},
+				...t.expiresAt && t.expiresAt < e ? {
+					revoked: !0,
+					revokedAt: t.expiresAt
+				} : {}
+			}))
+		};
+	}
+	toKeyRegistry() {
+		return { getPublicKey: async (e) => {
+			let t = Date.now();
+			return this.keys.find((n) => n.id === e && (!n.expiresAt || n.expiresAt > t))?.publicKey ?? this.getCurrentKey()?.publicKey ?? null;
+		} };
+	}
+}, _r = class {
+	revoked = /* @__PURE__ */ new Map();
+	revoke(e, t) {
+		this.revoked.set(e, {
+			id: e,
+			revokedAt: Date.now(),
+			reason: t
+		});
+	}
+	isRevoked(e) {
+		return this.revoked.has(e);
+	}
+	getList() {
+		return {
+			version: "7h3/0.1",
+			updated: Date.now(),
+			revokedKeys: [...this.revoked.values()]
+		};
+	}
+	importList(e) {
+		for (let t of e.revokedKeys) this.revoked.has(t.id) || this.revoked.set(t.id, t);
+	}
+	wrapRegistry(e) {
+		let t = this;
+		return {
+			async getPublicKey(n) {
+				return t.isRevoked(n) ? null : e.getPublicKey(n);
+			},
+			getSharedSecret: e.getSharedSecret?.bind(e)
+		};
+	}
+}, vr = class {
+	windows = /* @__PURE__ */ new Map();
+	check(e, t, n = Date.now()) {
+		let r = n - t.windowMs, i = (this.windows.get(e) ?? []).filter((e) => e > r), a = i.length, o = a < t.requests;
+		return {
+			allowed: o,
+			remaining: Math.max(0, t.requests - a - +!!o),
+			resetMs: i.length > 0 ? Math.max(0, i[0] + t.windowMs - n) : 0
+		};
+	}
+	consume(e, t, n = Date.now()) {
+		let r = n - t.windowMs, i = (this.windows.get(e) ?? []).filter((e) => e > r), a = i.length < t.requests;
+		return a && (i.push(n), this.windows.set(e, i)), {
+			allowed: a,
+			remaining: Math.max(0, t.requests - i.length),
+			resetMs: i.length > 0 ? Math.max(0, i[0] + t.windowMs - n) : 0
+		};
+	}
+	reset(e) {
+		this.windows.delete(e);
+	}
+	clear() {
+		this.windows.clear();
+	}
+}, yr = new vr();
+//#endregion
+//#region src/routePolicy.ts
+function J(e, t) {
+	let n = "^", r = 0;
+	for (; r < e.length;) {
+		let t = e[r];
+		t === "*" ? e[r + 1] === "*" ? (n += ".*", r += 2) : (n += "[^/]*", r += 1) : t === "?" ? (n += "[^/]", r += 1) : (n += t.replace(/[.+^${}()|[\]\\]/g, "\\$&"), r += 1);
+	}
+	return n += "$", new RegExp(n).test(t);
+}
+function br(e, t) {
+	for (let n of e) if (J(n.path, t)) return n;
+	return null;
+}
+function xr(e, t) {
+	return !e.allowedSenders || e.allowedSenders.length === 0 ? !0 : e.allowedSenders.includes(t);
+}
+//#endregion
+//#region src/signedResponse.ts
+var Sr = "x-7h3-response";
+async function Cr(e, t) {
+	let n = await S(T({
+		sender: t.sender,
+		recipient: t.recipient,
+		intent: "RESULT",
+		content: e,
+		correlationId: t.correlationId,
+		ttlMs: t.ttlMs ?? 6e4
+	}), t.privateKey);
+	return { headers: { [Sr]: JSON.stringify(n) } };
+}
+async function wr(e, t, n) {
+	let r = t[Sr], i = Array.isArray(r) ? r[0] : r;
+	if (!i) return {
+		ok: !1,
+		reason: "missing-header"
+	};
+	let a;
+	try {
+		a = JSON.parse(i);
+	} catch {
+		return {
+			ok: !1,
+			reason: "malformed-envelope"
+		};
+	}
+	let o = Date.now(), { timestampMs: s, ttlMs: c } = a.header;
+	return s + c < o || n.maxAgeMs !== void 0 && o - s > n.maxAgeMs ? {
+		ok: !1,
+		reason: "ttl-expired",
+		envelope: a
+	} : await C(a, n.publicKey) ? a.body.content === e ? {
+		ok: !0,
+		envelope: a
+	} : {
+		ok: !1,
+		reason: "content-mismatch",
+		envelope: a
+	} : {
+		ok: !1,
+		reason: "invalid-signature",
+		envelope: a
+	};
+}
+//#endregion
+//#region src/telemetry.ts
+function Y(e) {
+	return !e || Object.keys(e).length === 0 ? "__default__" : Object.entries(e).sort(([e], [t]) => e.localeCompare(t)).map(([e, t]) => `${e}=${t}`).join(",");
+}
+function Tr(e) {
+	return !e || Object.keys(e).length === 0 ? "" : `{${Object.entries(e).sort(([e], [t]) => e.localeCompare(t)).map(([e, t]) => `${e}="${t}"`).join(",")}}`;
+}
+var X = class {
+	counts = /* @__PURE__ */ new Map();
+	labelSets = /* @__PURE__ */ new Map();
+	increment(e) {
+		let t = Y(e);
+		this.counts.set(t, (this.counts.get(t) ?? 0) + 1), this.labelSets.has(t) || this.labelSets.set(t, e);
+	}
+	value(e) {
+		return this.counts.get(Y(e)) ?? 0;
+	}
+	entries() {
+		let e = [];
+		for (let [t, n] of this.counts) e.push({
+			labels: this.labelSets.get(t),
+			value: n
+		});
+		return e;
+	}
+}, Er = class {
+	bucketBounds;
+	states = /* @__PURE__ */ new Map();
+	labelSets = /* @__PURE__ */ new Map();
+	constructor(e = [
+		.005,
+		.01,
+		.025,
+		.05,
+		.1,
+		.25,
+		.5,
+		1,
+		2.5,
+		5,
+		10
+	]) {
+		this.bucketBounds = [...e].sort((e, t) => e - t);
+	}
+	observe(e, t) {
+		let n = Y(t);
+		this.states.has(n) || (this.states.set(n, {
+			count: 0,
+			sum: 0,
+			observations: []
+		}), this.labelSets.set(n, t));
+		let r = this.states.get(n);
+		r.count++, r.sum += e, r.observations.push(e);
+	}
+	snapshot(e) {
+		let t = Y(e), n = this.states.get(t) ?? {
+			count: 0,
+			sum: 0,
+			observations: []
+		}, r = {};
+		for (let e of this.bucketBounds) r[String(e)] = n.observations.filter((t) => t <= e).length;
+		return r["+Inf"] = n.count, {
+			count: n.count,
+			sum: n.sum,
+			buckets: r
+		};
+	}
+	entries() {
+		let e = [];
+		for (let [t] of this.states) {
+			let n = this.labelSets.get(t);
+			e.push({
+				labels: n,
+				snapshot: this.snapshot(n)
+			});
+		}
+		return e;
+	}
+	getBounds() {
+		return [...this.bucketBounds];
+	}
+}, Dr = class {
+	verifications_total = new X();
+	verification_duration_ms = new Er([
+		.1,
+		.5,
+		1,
+		5,
+		10,
+		50,
+		100
+	]);
+	rate_limit_hits_total = new X();
+	sender_denials_total = new X();
+	replay_detections_total = new X();
+	audit_entries_total = new X();
+	active_connections = new X();
+}, Z = new Dr();
+function Or(e, t = "7h3") {
+	let n = [];
+	function r(e, r, i) {
+		let a = `${t}_${e}`;
+		n.push(`# HELP ${a} ${r}`), n.push(`# TYPE ${a} counter`);
+		let o = i.entries();
+		if (o.length === 0) n.push(`${a} 0`);
+		else for (let { labels: e, value: t } of o) e && Object.keys(e).length > 0 ? n.push(`${a}${Tr(e)} ${t}`) : n.push(`${a} ${t}`);
+	}
+	function i(e, r, i) {
+		let a = `${t}_${e}`;
+		n.push(`# HELP ${a} ${r}`), n.push(`# TYPE ${a} histogram`);
+		let o = i.entries();
+		if (o.length === 0) {
+			for (let e of i.getBounds()) n.push(`${a}_bucket{le="${e}"} 0`);
+			n.push(`${a}_bucket{le="+Inf"} 0`), n.push(`${a}_sum 0`), n.push(`${a}_count 0`);
+		} else for (let { labels: e, snapshot: t } of o) {
+			let r = e && Object.keys(e).length > 0 ? Tr(e) : "";
+			for (let [e, i] of Object.entries(t.buckets)) {
+				if (e === "+Inf") continue;
+				let t = r ? r.slice(0, -1) + `,le="${e}"}` : `{le="${e}"}`;
+				n.push(`${a}_bucket${t} ${i}`);
+			}
+			let i = r ? r.slice(0, -1) + ",le=\"+Inf\"}" : "{le=\"+Inf\"}";
+			n.push(`${a}_bucket${i} ${t.count}`), n.push(`${a}_sum${r} ${t.sum}`), n.push(`${a}_count${r} ${t.count}`);
+		}
+	}
+	return r("verifications_total", "Total number of AIP envelope verifications, by result, algorithm, and transport", e.verifications_total), i("verification_duration_ms", "Verification latency in milliseconds", e.verification_duration_ms), r("rate_limit_hits_total", "Total number of rate-limit rejections, by sender and path", e.rate_limit_hits_total), r("sender_denials_total", "Total number of sender-denied (403) rejections, by sender and path", e.sender_denials_total), r("replay_detections_total", "Total number of replay-detected events, by transport", e.replay_detections_total), r("audit_entries_total", "Total number of audit log entries written, by type", e.audit_entries_total), r("active_connections", "Current active connections, by transport (WS/gRPC)", e.active_connections), n.join("\n") + "\n";
+}
+function kr(e = "/metrics", t = Z, n = "7h3") {
+	return (r, i, a) => {
+		if (r.url === e && (r.method === "GET" || r.method === void 0)) {
+			let e = Or(t, n);
+			i.writeHead(200, { "content-type": "text/plain; version=0.0.4; charset=utf-8" }), i.end(e);
+		} else a();
+	};
+}
+//#endregion
+//#region src/capability.ts
+var Ar = "x-7h3-capability";
+function jr(e) {
+	let t = [];
+	return e.maxDelegations !== void 0 && t.push(`"maxDelegations":${e.maxDelegations}`), e.methods !== void 0 && t.push(`"methods":${JSON.stringify(e.methods)}`), t.push(`"pathGlob":${JSON.stringify(e.pathGlob)}`), `{${t.join(",")}}`;
+}
+function Q(e) {
+	let t = [];
+	t.push(`"delegationDepth":${e.delegationDepth}`), t.push(`"expiresAt":${e.expiresAt}`), t.push(`"id":${JSON.stringify(e.id)}`), t.push(`"issuedAt":${e.issuedAt}`), t.push(`"issuer":${JSON.stringify(e.issuer)}`), t.push(`"keyId":${JSON.stringify(e.keyId)}`), e.maxDelegations !== void 0 && t.push(`"maxDelegations":${e.maxDelegations}`), e.parentTokenId !== void 0 && t.push(`"parentTokenId":${JSON.stringify(e.parentTokenId)}`);
+	let n = `[${e.scopes.map(jr).join(",")}]`;
+	return t.push(`"scopes":${n}`), t.push(`"subject":${JSON.stringify(e.subject)}`), t.push(`"version":${JSON.stringify(e.version)}`), `{${t.join(",")}}`;
+}
+async function Mr(e) {
+	let t = Date.now(), n = `cap-${t}-${Math.random().toString(36).slice(2, 12)}`, r = e.keyId ?? `${e.issuerId}-key`, i = e.maxDelegations ?? 0, a = {
+		id: n,
+		version: "7h3-cap/1",
+		issuer: e.issuerId,
+		subject: e.subject,
+		scopes: e.scopes,
+		issuedAt: t,
+		expiresAt: t + e.ttlMs,
+		delegationDepth: 0,
+		maxDelegations: i,
+		keyId: r
+	}, o = await y(Q(a), e.issuerPrivateKey);
+	return {
+		...a,
+		signature: o
+	};
+}
+function Nr(e, t) {
+	if (!J(t.pathGlob, e.pathGlob)) return !1;
+	if (t.methods !== void 0) {
+		if (e.methods === void 0) return !1;
+		for (let n of e.methods) if (!t.methods.includes(n)) return !1;
+	}
+	return !0;
+}
+function Pr(e, t) {
+	for (let n of e) if (!t.some((e) => Nr(n, e))) return !1;
+	return !0;
+}
+async function Fr(e) {
+	let { parentToken: t, delegatorId: n, newSubject: r } = e;
+	if (n !== t.subject) throw Error(`delegatorId '${n}' does not match parentToken.subject '${t.subject}'`);
+	let i = Date.now();
+	if (i >= t.expiresAt) throw Error("Parent token is expired");
+	if (t.maxDelegations !== void 0 && t.maxDelegations <= 0) throw Error("Parent token does not allow further delegation (maxDelegations=0)");
+	let a = e.scopes ?? t.scopes;
+	if (!Pr(a, t.scopes)) throw Error("Delegated scopes exceed parent token scopes");
+	let o = t.expiresAt - i;
+	if (e.ttlMs > o) throw Error(`Delegated ttlMs (${e.ttlMs}) exceeds parent token remaining TTL (${o})`);
+	let s = `cap-${i}-${Math.random().toString(36).slice(2, 12)}`, c = e.keyId ?? `${n}-key`, l = t.maxDelegations === void 0 ? void 0 : t.maxDelegations - 1, u = {
+		id: s,
+		version: "7h3-cap/1",
+		issuer: n,
+		subject: r,
+		scopes: a,
+		issuedAt: i,
+		expiresAt: i + e.ttlMs,
+		delegationDepth: t.delegationDepth + 1,
+		parentTokenId: t.id,
+		maxDelegations: l,
+		keyId: c
+	}, d = await y(Q(u), e.delegatorPrivateKey);
+	return {
+		...u,
+		signature: d
+	};
+}
+async function Ir(e, t, n) {
+	if ((n?.now ?? Date.now()) >= e.expiresAt) return !1;
+	let { signature: r, ...i } = e;
+	return b(Q(i), r, t);
+}
+async function Lr(e, t, n) {
+	if (e.length === 0) return {
+		ok: !1,
+		reason: "empty-chain"
+	};
+	let r = n?.now ?? Date.now();
+	for (let n = 0; n < e.length; n++) {
+		let i = e[n];
+		if (n === 0 && i.delegationDepth !== 0) return {
+			ok: !1,
+			reason: "root-token-delegation-depth-must-be-zero"
+		};
+		if (n > 0) {
+			let t = e[n - 1];
+			if (i.issuer !== t.subject) return {
+				ok: !1,
+				reason: `chain-broken: token[${n}].issuer '${i.issuer}' !== token[${n - 1}].subject '${t.subject}'`
+			};
+			if (i.parentTokenId !== t.id) return {
+				ok: !1,
+				reason: `chain-broken: token[${n}].parentTokenId '${i.parentTokenId}' !== token[${n - 1}].id '${t.id}'`
+			};
+			if (i.delegationDepth !== t.delegationDepth + 1) return {
+				ok: !1,
+				reason: `chain-broken: token[${n}].delegationDepth ${i.delegationDepth} !== ${t.delegationDepth + 1}`
+			};
+		}
+		if (r >= i.expiresAt) return {
+			ok: !1,
+			reason: `token[${n}]-expired`
+		};
+		let a = await t.getPublicKey(i.issuer);
+		if (!a) return {
+			ok: !1,
+			reason: `no-public-key-for-issuer:${i.issuer}`
+		};
+		let { signature: o, ...s } = i;
+		if (!await b(Q(s), o, a)) return {
+			ok: !1,
+			reason: `invalid-signature-at-index:${n}`
+		};
+	}
+	let i = e[e.length - 1];
+	return n?.requiredPathGlob !== void 0 && !Rr(i, n.requiredPathGlob, n.requiredMethod) ? {
+		ok: !1,
+		reason: "leaf-token-does-not-cover-required-scope"
+	} : {
+		ok: !0,
+		token: i,
+		chain: e
+	};
+}
+function Rr(e, t, n) {
+	for (let r of e.scopes) if (J(r.pathGlob, t) && (r.methods === void 0 || n === void 0 || r.methods.includes(n.toUpperCase()))) return !0;
+	return !1;
+}
+function zr(e) {
+	return JSON.stringify(e);
+}
+function Br(e) {
+	return JSON.parse(e);
+}
+//#endregion
+//#region src/gateway.ts
+var Vr = class {
+	config;
+	rateLimiter;
+	constructor(e) {
+		this.config = e, this.rateLimiter = new vr();
+	}
+	async verify(e) {
+		let t = performance.now(), n = br(this.config.policies ?? [], e.path);
+		if (n?.require === "none" || !n && (this.config.defaultPolicy ?? "allow") === "allow") {
+			let e = performance.now() - t;
+			return Z.verifications_total.increment({
+				result: "ok",
+				alg: "none",
+				transport: "http"
+			}), Z.verification_duration_ms.observe(e), {
+				ok: !0,
+				sender: ""
+			};
+		}
+		if (this.config.capabilityRegistry) {
+			let n = e.headers[Ar], r = Array.isArray(n) ? n[0] : n;
+			if (r) try {
+				let n = await Lr(Br(r), this.config.capabilityRegistry, {
+					requiredPathGlob: e.path,
+					requiredMethod: e.method
+				});
+				if (n.ok && Rr(n.token, e.path, e.method)) {
+					let e = performance.now() - t;
+					return Z.verifications_total.increment({
+						result: "ok",
+						alg: "ED25519",
+						transport: "http"
+					}), Z.verification_duration_ms.observe(e), {
+						ok: !0,
+						sender: n.token.subject
+					};
+				}
+				let i = performance.now() - t;
+				return Z.verifications_total.increment({
+					result: "fail",
+					alg: "none",
+					transport: "http"
+				}), Z.verification_duration_ms.observe(i), {
+					ok: !1,
+					status: 401,
+					reason: n.ok ? "capability-scope-mismatch" : n.reason
+				};
+			} catch {
+				let e = performance.now() - t;
+				return Z.verifications_total.increment({
+					result: "fail",
+					alg: "none",
+					transport: "http"
+				}), Z.verification_duration_ms.observe(e), {
+					ok: !1,
+					status: 401,
+					reason: "invalid-capability-chain"
+				};
+			}
+		}
+		if (!n && (this.config.defaultPolicy ?? "allow") === "deny") {
+			let n = performance.now() - t;
+			return Z.verifications_total.increment({
+				result: "fail",
+				alg: "none",
+				transport: "http"
+			}), Z.verification_duration_ms.observe(n), Z.sender_denials_total.increment({
+				sender: "",
+				path: e.path
+			}), {
+				ok: !1,
+				status: 403,
+				reason: "no-matching-policy"
+			};
+		}
+		let r = await Dn(e.headers, {
+			keyRegistry: this.config.keyRegistry,
+			headerName: this.config.headerName
+		});
+		if (!r.ok) {
+			let e = performance.now() - t;
+			return Z.verifications_total.increment({
+				result: "fail",
+				alg: "none",
+				transport: "http"
+			}), Z.verification_duration_ms.observe(e), {
+				ok: !1,
+				status: 401,
+				reason: r.reason
+			};
+		}
+		let i = r.envelope, a = i.header.sender, o = i.header.messageId, s = i.signature?.alg ?? "none";
+		if (this.config.replayStore && await this.config.replayStore.check(i.header.nonce, i.header.ttlMs)) return {
+			ok: !1,
+			status: 401,
+			reason: "replay-detected"
+		};
+		if (n && n.require !== "any") {
+			let e = i.signature?.alg, r = n.require === "ed25519" && e !== "ED25519", a = n.require === "hmac" && e !== "HS256";
+			if (r || a) {
+				let e = performance.now() - t;
+				return Z.verifications_total.increment({
+					result: "fail",
+					alg: s,
+					transport: "http"
+				}), Z.verification_duration_ms.observe(e), {
+					ok: !1,
+					status: 401,
+					reason: "invalid-signature"
+				};
+			}
+		}
+		if (n && !xr(n, a)) {
+			let n = performance.now() - t;
+			return Z.verifications_total.increment({
+				result: "fail",
+				alg: s,
+				transport: "http"
+			}), Z.verification_duration_ms.observe(n), Z.sender_denials_total.increment({
+				sender: a,
+				path: e.path
+			}), {
+				ok: !1,
+				status: 403,
+				reason: "sender-denied"
+			};
+		}
+		if (n?.rateLimit && !this.rateLimiter.consume(a, n.rateLimit).allowed) {
+			let n = performance.now() - t;
+			return Z.verifications_total.increment({
+				result: "fail",
+				alg: s,
+				transport: "http"
+			}), Z.verification_duration_ms.observe(n), Z.rate_limit_hits_total.increment({
+				sender: a,
+				path: e.path
+			}), {
+				ok: !1,
+				status: 429,
+				reason: "rate-limited"
+			};
+		}
+		let c = performance.now() - t;
+		return Z.verifications_total.increment({
+			result: "ok",
+			alg: s,
+			transport: "http"
+		}), Z.verification_duration_ms.observe(c), {
+			ok: !0,
+			sender: a,
+			envelopeId: o
+		};
+	}
+	async handle(e) {
+		let t = await this.verify(e);
+		if (!t.ok) return {
+			status: t.status,
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({ error: t.reason })
+		};
+		let n = this.config.upstream.replace(/\/$/, "") + e.path, r = {};
+		for (let [t, n] of Object.entries(e.headers)) r[t] = Array.isArray(n) ? n[0] : n;
+		t.sender && (r["x-7h3-sender"] = t.sender), r["x-7h3-verified"] = "true";
+		let i = await fetch(n, {
+			method: e.method,
+			headers: r,
+			body: e.body
+		}), a = await i.text(), o = { "content-type": i.headers.get("content-type") ?? "application/json" };
+		if (this.config.privateKey !== void 0 && (this.config.signResponses ?? !0) && this.config.sender !== void 0) {
+			let e = await Cr(a, {
+				privateKey: this.config.privateKey,
+				sender: this.config.sender,
+				recipient: t.sender || void 0
+			});
+			Object.assign(o, e.headers);
+		}
+		return {
+			status: i.status,
+			headers: o,
+			body: a
+		};
+	}
+	getRateLimiter() {
+		return this.rateLimiter;
+	}
+};
+function Hr(e) {
+	return new Vr(e);
+}
+//#endregion
+//#region src/auditLog.ts
+function Ur(e) {
+	let t = [
+		`"id":${JSON.stringify(e.id)}`,
+		`"timestampMs":${e.timestampMs}`,
+		`"type":${JSON.stringify(e.type)}`
+	];
+	return e.sender !== void 0 && t.push(`"sender":${JSON.stringify(e.sender)}`), e.path !== void 0 && t.push(`"path":${JSON.stringify(e.path)}`), e.method !== void 0 && t.push(`"method":${JSON.stringify(e.method)}`), e.envelopeId !== void 0 && t.push(`"envelopeId":${JSON.stringify(e.envelopeId)}`), e.failReason !== void 0 && t.push(`"failReason":${JSON.stringify(e.failReason)}`), e.upstream !== void 0 && t.push(`"upstream":${JSON.stringify(e.upstream)}`), e.responseStatus !== void 0 && t.push(`"responseStatus":${e.responseStatus}`), `{${t.join(",")}}`;
+}
+var Wr = class {
+	entries = [];
+	privateKey;
+	maxEntries;
+	constructor(e, t = 1e4) {
+		this.privateKey = e, this.maxEntries = t;
+	}
+	async log(e) {
+		let t = {
+			id: `audit-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`,
+			timestampMs: Date.now(),
+			...e
+		}, n = await y(Ur(t), this.privateKey), r = {
+			...t,
+			entrySignature: n
+		};
+		this.entries.length >= this.maxEntries && this.entries.shift(), this.entries.push(r);
+	}
+	async query(e) {
+		let t = [...this.entries];
+		return e?.type !== void 0 && (t = t.filter((t) => t.type === e.type)), e?.sender !== void 0 && (t = t.filter((t) => t.sender === e.sender)), e?.since !== void 0 && (t = t.filter((t) => t.timestampMs >= e.since)), e?.limit !== void 0 && (t = t.slice(-e.limit)), t;
+	}
+	async verify(e, t) {
+		return b(Ur({
+			id: e.id,
+			timestampMs: e.timestampMs,
+			type: e.type,
+			sender: e.sender,
+			path: e.path,
+			method: e.method,
+			envelopeId: e.envelopeId,
+			failReason: e.failReason,
+			upstream: e.upstream,
+			responseStatus: e.responseStatus
+		}), e.entrySignature, t);
+	}
+	size() {
+		return this.entries.length;
+	}
+}, Gr = class {
+	async log(e) {}
+	async query(e) {
+		return [];
+	}
+	async verify(e, t) {
+		return !1;
+	}
+	size() {
+		return 0;
+	}
+};
+function Kr(e, t) {
+	return new Wr(e, t?.maxEntries);
+}
+//#endregion
+//#region src/otel.ts
+var qr = null;
+function Jr(e) {
+	qr = e;
+}
+function Yr() {
+	if (qr === null) return null;
+	try {
+		return qr.getTracer("7h3/protocol");
+	} catch {
+		return null;
+	}
+}
+async function Xr(e, t) {
+	let n = Yr();
+	if (n === null) return e(null);
+	let r = n.startSpan("7h3.verify", t);
+	try {
+		return await e(r);
+	} catch (e) {
+		throw e instanceof Error ? r.recordException(e) : r.recordException(Error(String(e))), e;
+	} finally {
+		r.end();
+	}
+}
+async function Zr(e) {
+	let t = Yr();
+	if (t === null) return e(null);
+	let n = t.startSpan("7h3.audit.write");
+	try {
+		return await e(n);
+	} catch (e) {
+		throw e instanceof Error ? n.recordException(e) : n.recordException(Error(String(e))), e;
+	} finally {
+		n.end();
+	}
+}
+//#endregion
+//#region src/encryption.ts
+function Qr(e) {
+	return Buffer.from(e).toString("base64url");
+}
+function $(e) {
+	return Buffer.from(e, "base64url");
+}
+var $r = Buffer.from("302e020100300506032b656e04220420", "hex"), ei = Buffer.from("302a300506032b656e032100", "hex");
+function ti(e) {
+	let t = $(e);
+	return (0, M.createPrivateKey)({
+		key: Buffer.concat([$r, t]),
+		format: "der",
+		type: "pkcs8"
+	});
+}
+function ni(e) {
+	let t = $(e);
+	return (0, M.createPublicKey)({
+		key: Buffer.concat([ei, t]),
+		format: "der",
+		type: "spki"
+	});
+}
+function ri() {
+	let { privateKey: e, publicKey: t } = (0, M.generateKeyPairSync)("x25519"), n = e.export({ format: "jwk" });
+	return {
+		publicKey: t.export({ format: "jwk" }).x,
+		privateKey: n.d
+	};
+}
+function ii(e, t, n) {
+	let r = (0, M.hkdfSync)("sha256", (0, M.diffieHellman)({
+		privateKey: ti(e),
+		publicKey: ni(t)
+	}), $(n), Buffer.from("7h3-enc/1", "utf8"), 32);
+	return Buffer.from(r);
+}
+function ai(e, t) {
+	let n = ri(), r = (0, M.randomBytes)(12), i = Qr(r), a = ii(n.privateKey, t, i), o = Buffer.from(JSON.stringify(e), "utf8"), s = (0, M.createCipheriv)("chacha20-poly1305", a, r, { authTagLength: 16 }), c = Buffer.concat([s.update(o), s.final()]), l = s.getAuthTag(), u = {
+		ephemeralPublic: n.publicKey,
+		nonce: i,
+		ciphertext: Qr(c),
+		tag: Qr(l)
+	};
+	return {
+		encryptedContent: Qr(Buffer.from(JSON.stringify(u), "utf8")),
+		ephemeralPublic: n.publicKey
+	};
+}
+function oi(e, t) {
+	let n = $(e).toString("utf8"), { ephemeralPublic: r, nonce: i, ciphertext: a, tag: o } = JSON.parse(n), s = ii(t, r, i), c = $(i), l = $(a), u = $(o), d = (0, M.createDecipheriv)("chacha20-poly1305", s, c, { authTagLength: 16 });
+	d.setAuthTag(u);
+	let f = Buffer.concat([d.update(l), d.final()]);
+	return JSON.parse(f.toString("utf8"));
+}
+async function si(e, t) {
+	let { encryptedContent: n } = ai(e.body, t.recipientX25519PublicKey);
+	return S({
+		header: e.header,
+		body: {
+			intent: "ENCRYPTED",
+			content: n,
+			capability: "x25519-chacha20poly1305",
+			correlationId: e.body.correlationId
+		}
+	}, t.senderEd25519PrivateKey);
+}
+async function ci(e, t) {
+	if (!await C(e, t.senderEd25519PublicKey)) throw Error("7h3/encryption: Ed25519 signature verification failed");
+	return {
+		envelope: e,
+		body: oi(e.body.content, t.recipientX25519PrivateKey)
+	};
+}
+//#endregion
+export { at as AgentSession, ot as AipAgentAdapter, Ar as CAP_HEADER, Cn as CBOR_CONTENT_TYPE, bn as CborDecoder, yn as CborEncoder, Lt as ClusterRedisReplayStore, En as DEFAULT_HEADER, be as DEFAULT_MAX_BINARY_ENVELOPE_BYTES, Le as DistributedReplayCache, cr as GRPC_METADATA_KEY, Wr as InMemoryAuditLog, Ft as InMemoryRedisLikeClient, O as InMemoryReplayCache, Ht as InMemoryRevocationStore, Re as InMemoryVerificationMaterialCache, gr as KeyRotationManager, Gr as NoopAuditLog, Vr as Protocol7h3Gateway, Dr as Protocol7h3Metrics, Sr as RESPONSE_HEADER, It as RedisReplayStore, _r as RevocationRegistry, rt as RollingKeyring, jt as RuntimePolicyManager, Hn as STREAM_HEADER, Ye as SessionTransport, Qn as SignedStreamReader, q as SignedStreamWriter, X as SimpleCounter, Er as SimpleHistogram, vr as SlidingWindowRateLimiter, Nn as WEBHOOK_DEFAULT_TTL_MS, I as WEBHOOK_SIG_HEADER, L as WEBHOOK_TS_HEADER, A as bootstrapRuntimePolicyEnforcer, Q as canonicalizeCapabilityToken, _ as canonicalizeEnvelope, Rn as consumeWebhook, st as createAipAgentAdapter, $e as createAipCapabilities, kt as createAipMcpGatewayRuntime, At as createAipMcpGatewayRuntimeWithPolicy, Kr as createAuditLog, rn as createCachingKeyRegistry, Bt as createClusterReplayStore, nn as createCompositeKeyRegistry, T as createEnvelope, Hr as createGateway, hr as createHttpKeyRegistry, en as createHttpMcpClient, $t as createHttpMcpHandler, An as createHttpMiddleware, it as createKeyringSignatureResolver, Jt as createMcpClientCodec, kr as createMetricsMiddleware, Ct as createPolicyEnforcer, pt as createRawTaskFromJsonRpc, ct as createRawTaskFromLangChain, ut as createRawTaskFromLlamaIndex, Rt as createRedisReplayStore, Ut as createRedisRevocationStore, Mn as createSignedFetchRequest, Xe as createSignedMessage, $n as createSignedStream, or as createSignedWebSocketStream, tn as createStaticKeyRegistry, Qt as createStdioMcpClient, er as createStreamVerifier, Sn as decodeCbor, We as decodeEnvelope, qe as decodeEnvelopeBatch, Fe as decodeEnvelopeBinary, Tn as decodeEnvelopeCbor, ir as decodeStreamChunk, oi as decryptBody, Fr as delegateCapabilityToken, ii as deriveEncryptionKey, et as encodeAipCapabilities, xn as encodeCbor, Ge as encodeEnvelope, Ke as encodeEnvelopeBatch, Pe as encodeEnvelopeBinary, wn as encodeEnvelopeCbor, rr as encodeStreamChunk, ai as encryptBody, mr as fetchWellKnownKeys, pe as generateEd25519KeypairBase64Url, ri as generateX25519KeyPair, Yr as getOtelTracer, Nt as getRuntimeTuningPreset, yr as globalRateLimiter, xr as isAllowedSender, wt as isRuntimeMode, Mr as issueCapabilityToken, bt as loadRuntimePolicy, J as matchGlob, br as matchPolicy, Z as metrics, nt as negotiateAipCapabilities, ci as openEnvelope, tt as parseAipCapabilities, Br as parseCapabilityChain, vt as parseRuntimePolicyJson, pr as parseWellKnownKeys, k as receiveEnvelope, Je as receiveEnvelopeBatch, sr as receiveSignedWebSocketStream, Pt as recommendPolicyAdjustments, Or as renderPrometheusText, si as sealEnvelope, zr as serializeCapabilityChain, Zt as serveMcpOverStdio, fr as serveWellKnownKeys, Jr as setOtelProvider, y as signCanonicalPayloadEd25519, de as signCanonicalPayloadHmac, S as signEnvelopeEd25519, x as signEnvelopeHmac, jn as signFetchRequest, lr as signGrpcCall, On as signHttpRequest, kn as signHttpRequestHmac, zn as signQueueMessage, Cr as signResponse, tr as signStream, Pn as signWebhook, Fn as signWebhookHmac, mt as toJsonRpcResponse, lt as toLangChainMessage, dt as toLlamaIndexMessage, Rr as tokenMatchesScope, w as validateEnvelope, _t as validateRuntimePolicy, b as verifyCanonicalPayloadEd25519, fe as verifyCanonicalPayloadHmac, ge as verifyCanonicalPayloadSignature, Lr as verifyCapabilityChain, Ir as verifyCapabilityToken, C as verifyEnvelopeEd25519, me as verifyEnvelopeHmac, he as verifyEnvelopeSignature, ur as verifyGrpcCall, Dn as verifyHttpEnvelope, Vn as verifyQueueBatch, Bn as verifyQueueMessage, wr as verifyResponse, nr as verifyStream, In as verifyWebhook, Ln as verifyWebhookHmac, Zr as withAuditSpan, dr as withGrpcVerification, Wt as withRevocationCheck, Xr as withVerificationSpan, Yt as wrapMcpClient, qt as wrapMcpServer, ar as wrapWebSocket };