@7h3/protocol 0.5.0 → 0.5.1

package/protocolReplay.d.ts

@@ -0,0 +1,35 @@
+import type { ProtocolEnvelope } from './protocol';
+export interface ReplayCheckResult {
+    ok: boolean;
+    reason?: string;
+}
+export interface ReplayCache {
+    consume(envelope: ProtocolEnvelope, nowMs?: number): ReplayCheckResult | Promise<ReplayCheckResult>;
+    consumeMany?(envelopes: ProtocolEnvelope[], nowMs?: number): ReplayCheckResult[] | Promise<ReplayCheckResult[]>;
+}
+export interface DistributedReplayStore {
+    reserve(key: string, expiresAtMs: number, nowMs: number): boolean | Promise<boolean>;
+    /** Optional batch reserve; enables single round-trip checks for batched envelopes. */
+    reserveMany?(entries: Array<{
+        key: string;
+        expiresAtMs: number;
+    }>, nowMs: number): boolean[] | Promise<boolean[]>;
+}
+export declare class InMemoryReplayCache implements ReplayCache {
+    private readonly entries;
+    private readonly maxEntries;
+    private readonly expiries;
+    constructor(maxEntries?: number);
+    private makeKey;
+    prune(nowMs?: number): void;
+    private evictOne;
+    consume(envelope: ProtocolEnvelope, nowMs?: number): ReplayCheckResult;
+    consumeMany(envelopes: ProtocolEnvelope[], nowMs?: number): ReplayCheckResult[];
+}
+export declare class DistributedReplayCache implements ReplayCache {
+    private readonly store;
+    constructor(store: DistributedReplayStore);
+    private makeKey;
+    consume(envelope: ProtocolEnvelope, nowMs?: number): Promise<ReplayCheckResult>;
+    consumeMany(envelopes: ProtocolEnvelope[], nowMs?: number): Promise<ReplayCheckResult[]>;
+}

package/protocolTransport.d.ts

@@ -0,0 +1,73 @@
+import { type SignatureVerificationMaterial, type IntentKind, type ProtocolDiagnostic, type ProtocolEnvelope } from './protocol';
+import { type ReplayCache } from './protocolReplay';
+export type WireFormat = 'json' | 'compact' | 'binary';
+export type BatchWireFormat = Exclude<WireFormat, 'binary'>;
+export interface ReceiveEnvelopeOptions {
+    nowMs?: number;
+    requireSignature?: boolean;
+    maxClockSkewMs?: number;
+    replayCache?: ReplayCache;
+    verificationMaterialCache?: VerificationMaterialCache;
+    secretResolver?: (keyId: string, sender: string) => string | undefined | Promise<string | undefined>;
+    signatureResolver?: (signature: NonNullable<ProtocolEnvelope['signature']>, sender: string) => SignatureVerificationMaterial | undefined | Promise<SignatureVerificationMaterial | undefined>;
+    telemetry?: (event: TransportTelemetryEvent) => void | Promise<void>;
+}
+export interface ReceiveEnvelopeBatchOptions extends ReceiveEnvelopeOptions {
+    batchConcurrency?: number;
+}
+export interface TransportTelemetryEvent {
+    phase: 'decoded' | 'rejected_clock_skew' | 'rejected_validation' | 'rejected_replay' | 'rejected_missing_signature' | 'rejected_missing_material' | 'rejected_bad_signature' | 'batch_summary' | 'accepted';
+    nowMs: number;
+    sender?: string;
+    messageId?: string;
+    reason?: string;
+}
+export interface ReceiveEnvelopeResult {
+    ok: boolean;
+    diagnostics: ProtocolDiagnostic[];
+    envelope: ProtocolEnvelope | null;
+}
+export interface VerificationMaterialCache {
+    get(key: string, nowMs?: number): SignatureVerificationMaterial | undefined;
+    set(key: string, material: SignatureVerificationMaterial, expiresAtMs: number): void;
+    delete?(key: string): void;
+}
+export declare class InMemoryVerificationMaterialCache implements VerificationMaterialCache {
+    private readonly entries;
+    private readonly maxEntries;
+    constructor(maxEntries?: number);
+    get(key: string, nowMs?: number): SignatureVerificationMaterial | undefined;
+    set(key: string, material: SignatureVerificationMaterial, expiresAtMs: number): void;
+    delete(key: string): void;
+}
+export type WireEnvelope = string | Uint8Array;
+export declare function decodeEnvelope(raw: WireEnvelope): ReceiveEnvelopeResult;
+export declare function encodeEnvelope(envelope: ProtocolEnvelope, format: 'binary'): Uint8Array;
+export declare function encodeEnvelope(envelope: ProtocolEnvelope, format?: 'json' | 'compact'): string;
+export declare function encodeEnvelope(envelope: ProtocolEnvelope, format: WireFormat): WireEnvelope;
+export declare function encodeEnvelopeBatch(envelopes: ProtocolEnvelope[], format?: BatchWireFormat): string;
+export declare function decodeEnvelopeBatch(raw: string): ReceiveEnvelopeResult[];
+export declare function receiveEnvelope(input: WireEnvelope | ProtocolEnvelope, options?: ReceiveEnvelopeOptions): Promise<ReceiveEnvelopeResult>;
+export declare function receiveEnvelopeBatch(input: string | Array<WireEnvelope | ProtocolEnvelope>, options?: ReceiveEnvelopeBatchOptions): Promise<ReceiveEnvelopeResult[]>;
+export declare class SessionTransport {
+    private readonly options;
+    constructor(options?: Omit<ReceiveEnvelopeOptions, 'replayCache'> & {
+        replayCache?: ReplayCache;
+    });
+    receive(input: WireEnvelope | ProtocolEnvelope, nowMs?: number): Promise<ReceiveEnvelopeResult>;
+    receiveBatch(input: string | Array<WireEnvelope | ProtocolEnvelope>, nowMs?: number): Promise<ReceiveEnvelopeResult[]>;
+}
+export declare function createSignedMessage(input: {
+    sender: string;
+    recipient?: string;
+    intent: IntentKind;
+    content: string;
+    capability?: string;
+    correlationId?: string;
+    ttlMs?: number;
+    messageId?: string;
+    nonce?: string;
+    nowMs?: number;
+    secret: string;
+    keyId?: string;
+}): Promise<ProtocolEnvelope>;

package/queueBinding.d.ts

@@ -0,0 +1,43 @@
+import { type ProtocolEnvelope } from './protocol';
+export interface QueueSignOptions {
+    privateKey: string;
+    sender: string;
+    recipient?: string;
+    ttlMs?: number;
+    keyId?: string;
+}
+export interface QueueVerifyOptions {
+    publicKey: string;
+}
+export type SignedEnvelope = ProtocolEnvelope;
+export interface QueueMessage<T> {
+    envelope: SignedEnvelope;
+    payload: T;
+}
+/**
+ * Signs a payload for queue transit (Kafka/SQS/Pub-Sub/RabbitMQ).
+ * Returns a JSON string: {"envelope": SignedEnvelope, "payload": T}
+ * Default TTL is 1 hour (3 600 000 ms).
+ */
+export declare function signQueueMessage<T>(payload: T, opts: QueueSignOptions): Promise<string>;
+/**
+ * Parses a queue message JSON string and verifies the envelope signature.
+ * Throws if the message is malformed or the signature is invalid.
+ */
+export declare function verifyQueueMessage<T>(message: string, opts: QueueVerifyOptions): Promise<{
+    payload: T;
+    envelope: ProtocolEnvelope;
+}>;
+/**
+ * Verifies a batch of queue message strings.
+ * Never throws — returns per-message success/failure objects.
+ */
+export declare function verifyQueueBatch<T>(messages: string[], opts: QueueVerifyOptions): Promise<Array<{
+    ok: true;
+    payload: T;
+    envelope: ProtocolEnvelope;
+} | {
+    ok: false;
+    raw: string;
+    error: string;
+}>>;

package/rateLimiter.d.ts

@@ -0,0 +1,18 @@
+export type RateLimitPolicy = {
+    requests: number;
+    windowMs: number;
+};
+export type RateLimitResult = {
+    allowed: boolean;
+    remaining: number;
+    resetMs: number;
+};
+declare class SlidingWindowRateLimiter {
+    private windows;
+    check(key: string, policy: RateLimitPolicy, nowMs?: number): RateLimitResult;
+    consume(key: string, policy: RateLimitPolicy, nowMs?: number): RateLimitResult;
+    reset(key: string): void;
+    clear(): void;
+}
+export declare const globalRateLimiter: SlidingWindowRateLimiter;
+export { SlidingWindowRateLimiter };

package/{src/redisClient.ts → redisClient.d.ts}

@@ -46,36 +46,27 @@
  *   denial-of-service vector. Choose the posture that matches your threat model.
  * - See `docs/DISTRIBUTED_REPLAY.md` for full operational guidance.
  */
-
 export interface RedisSetOptions {
-  /** Only set when the key does not already exist (Redis `NX`). */
-  nx?: boolean
-  /** Expire the key after this many milliseconds (Redis `PX`). */
-  pxMs?: number
+    /** Only set when the key does not already exist (Redis `NX`). */
+    nx?: boolean;
+    /** Expire the key after this many milliseconds (Redis `PX`). */
+    pxMs?: number;
 }
-
 /** A queued, chainable batch of `set` commands flushed in a single round-trip. */
 export interface RedisPipelineLike {
-  set(key: string, value: string, options?: RedisSetOptions): RedisPipelineLike
-  exec(): Promise<Array<'OK' | null>>
+    set(key: string, value: string, options?: RedisSetOptions): RedisPipelineLike;
+    exec(): Promise<Array<'OK' | null>>;
 }
-
 export interface RedisLikeClient {
-  /** Returns `'OK'` when the value was written, or `null` when `NX` prevented it. */
-  set(key: string, value: string, options?: RedisSetOptions): Promise<'OK' | null>
-  /** Truthy when the key exists and has not expired. */
-  get?(key: string): Promise<string | null>
-  /** Removes a key; returns the number of keys removed. */
-  del?(key: string): Promise<number>
-  /** Optional batch pipeline; when present, batch reserves use a single round-trip. */
-  pipeline?(): RedisPipelineLike
+    /** Returns `'OK'` when the value was written, or `null` when `NX` prevented it. */
+    set(key: string, value: string, options?: RedisSetOptions): Promise<'OK' | null>;
+    /** Truthy when the key exists and has not expired. */
+    get?(key: string): Promise<string | null>;
+    /** Removes a key; returns the number of keys removed. */
+    del?(key: string): Promise<number>;
+    /** Optional batch pipeline; when present, batch reserves use a single round-trip. */
+    pipeline?(): RedisPipelineLike;
 }
-
-interface Entry {
-  value: string
-  expiresAt?: number
-}
-
 /**
  * In-memory reference implementation of {@link RedisLikeClient}.
  *
@@ -85,56 +76,15 @@ interface Entry {
  * cross-process guarantees and must not be used as a production replay store
  * for a horizontally scaled deployment.
  */
-export class InMemoryRedisLikeClient implements RedisLikeClient {
-  private readonly entries = new Map<string, Entry>()
-  private readonly now: () => number
-
-  constructor(options: { now?: () => number } = {}) {
-    this.now = options.now ?? (() => Date.now())
-  }
-
-  private live(key: string): Entry | undefined {
-    const entry = this.entries.get(key)
-    if (!entry) return undefined
-    if (entry.expiresAt !== undefined && entry.expiresAt <= this.now()) {
-      this.entries.delete(key)
-      return undefined
-    }
-    return entry
-  }
-
-  async set(key: string, value: string, options: RedisSetOptions = {}): Promise<'OK' | null> {
-    if (options.nx && this.live(key)) return null
-    const expiresAt = options.pxMs !== undefined ? this.now() + options.pxMs : undefined
-    this.entries.set(key, { value, expiresAt })
-    return 'OK'
-  }
-
-  async get(key: string): Promise<string | null> {
-    return this.live(key)?.value ?? null
-  }
-
-  async del(key: string): Promise<number> {
-    const existed = this.live(key) !== undefined
-    this.entries.delete(key)
-    return existed ? 1 : 0
-  }
-
-  pipeline(): RedisPipelineLike {
-    const commands: Array<{ key: string; value: string; options?: RedisSetOptions }> = []
-    const pipeline: RedisPipelineLike = {
-      set: (key: string, value: string, options?: RedisSetOptions) => {
-        commands.push({ key, value, options })
-        return pipeline
-      },
-      exec: async () => {
-        const results: Array<'OK' | null> = []
-        for (const command of commands) {
-          results.push(await this.set(command.key, command.value, command.options))
-        }
-        return results
-      },
-    }
-    return pipeline
-  }
+export declare class InMemoryRedisLikeClient implements RedisLikeClient {
+    private readonly entries;
+    private readonly now;
+    constructor(options?: {
+        now?: () => number;
+    });
+    private live;
+    set(key: string, value: string, options?: RedisSetOptions): Promise<'OK' | null>;
+    get(key: string): Promise<string | null>;
+    del(key: string): Promise<number>;
+    pipeline(): RedisPipelineLike;
 }

package/replayStores.d.ts

@@ -0,0 +1,98 @@
+import type { DistributedReplayStore } from './protocolReplay';
+import { type RedisLikeClient } from './redisClient';
+/**
+ * Minimal Redis client surface required by RedisReplayStore.
+ *
+ * Distinct from the internal RedisLikeClient: this interface uses a `quit()`
+ * lifecycle method and does not require pipeline support, making it easy to
+ * adapt any Redis client (ioredis, node-redis, Upstash, etc.) without coupling
+ * to the internal pipeline abstraction.
+ */
+export interface RedisClientLike {
+    set(key: string, value: string, opts?: {
+        nx?: boolean;
+        px?: number;
+    }): Promise<string | null>;
+    get(key: string): Promise<string | null>;
+    del(key: string): Promise<number | any>;
+    quit(): Promise<any>;
+}
+/**
+ * Gateway-facing replay store interface.
+ *
+ * `check()` atomically marks a key as seen and returns whether it was already
+ * present: `false` = fresh (first time seen), `true` = replay (already seen).
+ */
+export interface ReplayStore {
+    check(key: string, ttlMs: number): Promise<boolean>;
+}
+/**
+ * Redis-backed implementation of {@link ReplayStore}.
+ *
+ * Uses SET … NX PX for an atomic "set if not exists with TTL" operation.
+ * The operation is single-round-trip and safe under concurrent access from
+ * multiple gateway instances.
+ */
+export declare class RedisReplayStore implements ReplayStore {
+    private readonly keyPrefix;
+    private readonly client;
+    constructor(opts?: {
+        redisUrl?: string;
+        keyPrefix?: string;
+        client?: RedisClientLike;
+    });
+    /**
+     * Returns `false` if the key is fresh (first time seen — key was set in Redis),
+     * or `true` if the key is a replay (key already existed — SET NX returned null).
+     */
+    check(key: string, ttlMs: number): Promise<boolean>;
+}
+/**
+ * Cluster-aware replay store that wraps multiple {@link RedisReplayStore}
+ * instances — one per Redis shard / node.
+ *
+ * A message is treated as a replay if ANY node has already seen the nonce.
+ * All nodes are checked in parallel via Promise.all.
+ */
+export declare class ClusterRedisReplayStore implements ReplayStore {
+    private readonly nodes;
+    constructor(nodes: RedisReplayStore[]);
+    check(key: string, ttlMs: number): Promise<boolean>;
+}
+/**
+ * Convenience factory that creates a {@link RedisReplayStore} from a URL
+ * or options object.
+ */
+export declare function createRedisReplayStore(clientOrOpts: RedisLikeClient | {
+    redisUrl?: string;
+    keyPrefix?: string;
+    client?: RedisClientLike;
+}, options?: RedisReplayStoreOptions): DistributedReplayStore;
+/**
+ * Creates a {@link ClusterRedisReplayStore} from an array of Redis URLs.
+ * Each URL is used to create an independent {@link RedisReplayStore} node.
+ */
+export declare function createClusterReplayStore(redisUrls: string[]): ClusterRedisReplayStore;
+/**
+ * What to do when the Redis client throws (network blip, server down).
+ *
+ * - `fallback` (default): degrade to a local in-memory store so traffic keeps
+ *   flowing with single-node replay protection still in force. Quality +
+ *   reliability + scalability: Redis is never a fleet-wide kill switch.
+ * - `reject`: fail closed — deny the message because uniqueness cannot be confirmed.
+ * - `allow`: fail open — accept the message (skip the check) to maximise uptime.
+ */
+export type ReplayErrorBehavior = 'fallback' | 'reject' | 'allow';
+export interface RedisReplayStoreOptions {
+    /** Key namespace in Redis. Default `aip:replay:`. */
+    keyPrefix?: string;
+    /** Behavior when the Redis client throws. Default `fallback`. */
+    errorBehavior?: ReplayErrorBehavior;
+    /** Local store used when `errorBehavior` is `fallback`. Defaults to an in-memory-backed store. */
+    fallback?: DistributedReplayStore;
+    /** Observability hook fired whenever a Redis error forces degraded handling. */
+    onDegraded?: (error: unknown, context: {
+        key: string;
+        behavior: ReplayErrorBehavior;
+    }) => void;
+}

package/revocation.d.ts

@@ -0,0 +1,71 @@
+import type { ProtocolEnvelope, SignatureVerificationMaterial } from './protocol';
+import type { RedisLikeClient } from './redisClient';
+/**
+ * A shared key-revocation list consulted on the verification hot path.
+ *
+ * `RollingKeyring` enforces revocation in-process; a `RevocationStore` makes a
+ * revocation effective fleet-wide: revoke a `(sender, keyId)` on one node and
+ * every node that consults the same store rejects it.
+ */
+export interface RevocationStore {
+    isRevoked(sender: string, keyId: string, nowMs?: number): boolean | Promise<boolean>;
+    revoke(sender: string, keyId: string, options?: {
+        untilMs?: number;
+    }): void | Promise<void>;
+}
+/** Single-process revocation list (tests, local dev, single-node deployments). */
+export declare class InMemoryRevocationStore implements RevocationStore {
+    /** keyId map value: revoked-until timestamp, or `Infinity` for permanent. */
+    private readonly revoked;
+    private readonly now;
+    constructor(options?: {
+        now?: () => number;
+    });
+    private makeKey;
+    isRevoked(sender: string, keyId: string, nowMs?: number): boolean;
+    revoke(sender: string, keyId: string, options?: {
+        untilMs?: number;
+    }): void;
+}
+/** Behavior when the Redis client throws while checking revocation. */
+export type RevocationErrorBehavior = 'reject' | 'allow';
+export interface RedisRevocationStoreOptions {
+    /** Key namespace in Redis. Default `aip:revoked:`. */
+    keyPrefix?: string;
+    /**
+     * Behavior when the Redis client throws.
+     * - `reject` (default): fail closed — treat the key as revoked. A revoked key
+     *   is a compromised key; never accept on uncertainty.
+     * - `allow`: treat the key as not revoked (favor availability).
+     */
+    errorBehavior?: RevocationErrorBehavior;
+    /** Local cache freshness window in ms for `isRevoked` reads. Default 5000. */
+    cacheTtlMs?: number;
+    /** Observability hook fired whenever a Redis error forces degraded handling. */
+    onDegraded?: (error: unknown, context: {
+        sender: string;
+        keyId: string;
+    }) => void;
+    /** Clock override (testing). */
+    now?: () => number;
+}
+/**
+ * Creates a Redis-backed {@link RevocationStore}.
+ *
+ * Reads are served from a short-lived local cache so the verification hot path
+ * does not hit Redis on every message; known revocations therefore keep
+ * enforcing even through a brief Redis outage.
+ */
+export declare function createRedisRevocationStore(client: Pick<RedisLikeClient, 'set' | 'get' | 'del'>, options?: RedisRevocationStoreOptions): RevocationStore;
+type SignatureResolver = (signature: NonNullable<ProtocolEnvelope['signature']>, sender: string) => SignatureVerificationMaterial | undefined | Promise<SignatureVerificationMaterial | undefined>;
+/**
+ * Wraps a signature resolver so that a revoked `(sender, keyId)` resolves to no
+ * material — which makes signature verification fail and the envelope is rejected.
+ *
+ * Compose over `createKeyringSignatureResolver` (or any resolver) and pass the
+ * result as the transport `signatureResolver`.
+ */
+export declare function withRevocationCheck(resolver: SignatureResolver, store: RevocationStore, options?: {
+    nowMsProvider?: () => number;
+}): SignatureResolver;
+export {};

package/routePolicy.d.ts

@@ -0,0 +1,30 @@
+export type PolicyRequirement = 'ed25519' | 'hmac' | 'any' | 'none';
+export interface RoutePolicy {
+    path: string;
+    require: PolicyRequirement;
+    rateLimit?: {
+        requests: number;
+        windowMs: number;
+    };
+    allowedSenders?: string[];
+    signResponse?: boolean;
+}
+/**
+ * Translate a glob pattern to a RegExp.
+ * Supported:
+ *   - exact: '/health'
+ *   - '?'  → any single non-slash char
+ *   - '*'  → any chars within a single segment (no slash)
+ *   - '**' → any chars at any depth (including slashes)
+ */
+export declare function matchGlob(pattern: string, path: string): boolean;
+/**
+ * Find the first matching policy for a given path.
+ * Returns null if no policy matches.
+ */
+export declare function matchPolicy(policies: RoutePolicy[], path: string): RoutePolicy | null;
+/**
+ * Check whether a sender is permitted by a policy.
+ * If allowedSenders is not set, all senders are allowed.
+ */
+export declare function isAllowedSender(policy: RoutePolicy, sender: string): boolean;

package/runtimePolicy.d.ts

@@ -0,0 +1,24 @@
+export interface RuntimePolicy {
+    version: string;
+    name: string;
+    status: string;
+    owner?: string;
+    updated_at?: string;
+    hard_invariants?: Record<string, unknown>;
+    slo_defaults?: Record<string, unknown>;
+    mode_selection?: Record<string, unknown>;
+    guardrails?: Record<string, unknown>;
+    tuning?: Record<string, unknown>;
+    adaptive_flow?: Record<string, unknown>;
+    benchmark_policy?: Record<string, unknown>;
+    runtime_decision_tree?: unknown[];
+    operator_handoff_required_fields?: string[];
+    [key: string]: unknown;
+}
+export interface LoadRuntimePolicyOptions {
+    path?: string;
+    readTextFile?: (filePath: string) => Promise<string>;
+}
+export declare function validateRuntimePolicy(value: unknown): RuntimePolicy;
+export declare function parseRuntimePolicyJson(jsonText: string): RuntimePolicy;
+export declare function loadRuntimePolicy(options?: LoadRuntimePolicyOptions): Promise<RuntimePolicy>;

package/runtimePolicyManager.d.ts

@@ -0,0 +1,15 @@
+import { type BootstrapRuntimePolicyEnforcerOptions, type PolicyEnforcer } from './policyEnforcer';
+import type { RuntimePolicy } from './runtimePolicy';
+export interface RuntimePolicySnapshot {
+    policy: RuntimePolicy;
+    enforcer: PolicyEnforcer;
+    loadedAtMs: number;
+}
+export declare class RuntimePolicyManager {
+    private snapshot;
+    private readonly options;
+    constructor(options?: BootstrapRuntimePolicyEnforcerOptions);
+    loadInitial(): Promise<RuntimePolicySnapshot>;
+    current(): RuntimePolicySnapshot;
+    refresh(): Promise<RuntimePolicySnapshot>;
+}

package/runtimePolicyPresets.d.ts

@@ -0,0 +1,11 @@
+import type { RuntimeMode } from './policyEnforcer';
+export type RuntimeEnvironment = 'dev' | 'staging' | 'prod';
+export interface RuntimeTuningPreset {
+    environment: RuntimeEnvironment;
+    mode: RuntimeMode;
+    poolSize: number;
+    batchSize: number;
+    inflightCap: number;
+    retryMaxAttempts: number;
+}
+export declare function getRuntimeTuningPreset(environment: RuntimeEnvironment): RuntimeTuningPreset;

package/signedResponse.d.ts

@@ -0,0 +1,21 @@
+import { type ProtocolEnvelope } from './protocol';
+export declare const RESPONSE_HEADER = "x-7h3-response";
+export declare function signResponse(body: string, opts: {
+    privateKey: string;
+    sender: string;
+    recipient?: string;
+    correlationId?: string;
+    ttlMs?: number;
+}): Promise<{
+    headers: {
+        'x-7h3-response': string;
+    };
+}>;
+export declare function verifyResponse(body: string, headers: Record<string, string | string[] | undefined>, opts: {
+    publicKey: string;
+    maxAgeMs?: number;
+}): Promise<{
+    ok: boolean;
+    envelope?: ProtocolEnvelope;
+    reason?: string;
+}>;

package/stream.d.ts

@@ -0,0 +1,59 @@
+export interface StreamChunk {
+    i: number;
+    d: string;
+    h: string;
+    f: boolean;
+    sig?: string;
+    kid?: string;
+}
+export interface StreamSignerOpts {
+    privateKey: string;
+    sender: string;
+    nonce?: string;
+    keyId?: string;
+}
+export interface StreamVerifierOpts {
+    publicKey: string;
+    maxChunks?: number;
+}
+export type StreamVerifyResult = {
+    ok: true;
+    totalBytes: number;
+    chunkCount: number;
+} | {
+    ok: false;
+    reason: string;
+    chunkIndex?: number;
+};
+export declare const STREAM_HEADER = "x-7h3-stream";
+export declare class SignedStreamWriter {
+    private readonly opts;
+    private seq;
+    private readonly accum;
+    private hmacKeyPromise;
+    constructor(opts: StreamSignerOpts);
+    get nonce(): string;
+    private getHmacKey;
+    private computeChunkHmac;
+    writeChunk(data: string): Promise<StreamChunk>;
+    finalize(): Promise<StreamChunk>;
+}
+export declare class SignedStreamReader {
+    private readonly opts;
+    private expectedSeq;
+    private readonly accum;
+    private totalBytes;
+    private done;
+    constructor(opts: StreamVerifierOpts);
+    receiveChunk(chunk: StreamChunk): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    finalize(finalChunk: StreamChunk): Promise<StreamVerifyResult>;
+}
+export declare function createSignedStream(opts: StreamSignerOpts): SignedStreamWriter;
+export declare function createStreamVerifier(opts: StreamVerifierOpts): SignedStreamReader;
+export declare function signStream(chunks: AsyncIterable<string> | string[], opts: StreamSignerOpts): Promise<StreamChunk[]>;
+export declare function verifyStream(chunks: StreamChunk[], opts: StreamVerifierOpts): Promise<StreamVerifyResult>;
+export declare function encodeStreamChunk(chunk: StreamChunk): string;
+export declare function decodeStreamChunk(raw: string): StreamChunk;