@7h3/protocol 0.5.0 → 0.5.1

package/src/protocol.bench.ts

@@ -1,37 +0,0 @@
-import { bench, describe } from 'vitest'
-import { canonicalizeEnvelope, createEnvelope, signEnvelopeHmac, verifyEnvelopeHmac } from './protocol'
-import { decodeEnvelope, encodeEnvelope } from './protocolTransport'
-
-const unsigned = createEnvelope({
-  sender: 'agent.alpha',
-  recipient: 'agent.beta',
-  intent: 'TASK',
-  content: 'route-optimize:alpha-beta',
-  capability: 'task.plan',
-  correlationId: 'corr-1',
-  messageId: 'bench-1',
-  nonce: 'bench-nonce',
-  nowMs: 1_000,
-  ttlMs: 120_000,
-})
-
-describe('protocol throughput', () => {
-  bench('canonicalize envelope', () => {
-    canonicalizeEnvelope(unsigned)
-  })
-
-  bench('encode/decode envelope json', () => {
-    const encoded = encodeEnvelope({ ...unsigned })
-    decodeEnvelope(encoded)
-  })
-
-  bench('encode/decode envelope compact', () => {
-    const encoded = encodeEnvelope({ ...unsigned }, 'compact')
-    decodeEnvelope(encoded)
-  })
-
-  bench('sign + verify envelope', async () => {
-    const signed = await signEnvelopeHmac(unsigned, 'bench-secret', 'bench-k1')
-    await verifyEnvelopeHmac(signed, 'bench-secret')
-  })
-})

package/src/protocol.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["protocol.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,MAAM,GACN,MAAM,GACN,MAAM,GACN,QAAQ,GACR,OAAO,CAAA;AAEX,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,OAAO,GAAG,SAAS,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,YAAY,CAAA;IAClB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB;AASD,MAAM,MAAM,6BAA6B,GACrC;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AA0IzC,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAE1F;AAqCD,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/F;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErH;AAED,wBAAsB,+BAA+B,IAAI,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAS1G;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpH;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,GAC7B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAC7C,MAAM,EAAE,MAAM,EACd,KAAK,SAAkB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAW3B;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrG;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAC7C,wBAAwB,EAAE,MAAM,EAChC,KAAK,SAAsB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAW3B;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUxH;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,6BAA6B,GACtC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,GAAG,SAAS,EACxC,QAAQ,EAAE,6BAA6B,GACtC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,SAAa,GAAG,kBAAkB,EAAE,CAoCrG;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAmBtC"}

package/src/protocol.js

@@ -1,294 +0,0 @@
-const textEncoder = new TextEncoder();
-const HMAC_KEY_CACHE_LIMIT = 256;
-const hmacKeyCache = new Map();
-const ED25519_KEY_CACHE_LIMIT = 256;
-const ed25519PrivateKeyCache = new Map();
-const ed25519PublicKeyCache = new Map();
-function getBufferLike() {
-    const candidate = globalThis;
-    return candidate.Buffer ?? null;
-}
-function serializeHeaderCanonical(header) {
-    const parts = [
-        `"messageId":${JSON.stringify(header.messageId)}`,
-        `"nonce":${JSON.stringify(header.nonce)}`,
-    ];
-    if (header.recipient !== undefined) {
-        parts.push(`"recipient":${JSON.stringify(header.recipient)}`);
-    }
-    parts.push(`"sender":${JSON.stringify(header.sender)}`);
-    parts.push(`"timestampMs":${header.timestampMs}`);
-    parts.push(`"ttlMs":${header.ttlMs}`);
-    parts.push(`"version":${JSON.stringify(header.version)}`);
-    return `{${parts.join(',')}}`;
-}
-function serializeBodyCanonical(body) {
-    const parts = [];
-    if (body.capability !== undefined) {
-        parts.push(`"capability":${JSON.stringify(body.capability)}`);
-    }
-    parts.push(`"content":${JSON.stringify(body.content)}`);
-    if (body.correlationId !== undefined) {
-        parts.push(`"correlationId":${JSON.stringify(body.correlationId)}`);
-    }
-    parts.push(`"intent":${JSON.stringify(body.intent)}`);
-    return `{${parts.join(',')}}`;
-}
-function getCachedHmacKey(secret) {
-    const cacheKey = `hs256:${secret}`;
-    const cached = hmacKeyCache.get(cacheKey);
-    if (cached)
-        return cached;
-    if (hmacKeyCache.size >= HMAC_KEY_CACHE_LIMIT) {
-        hmacKeyCache.clear();
-    }
-    const subtle = requireCryptoSubtle();
-    const imported = subtle
-        .importKey('raw', textEncoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify'])
-        .catch((error) => {
-        hmacKeyCache.delete(cacheKey);
-        throw error;
-    });
-    hmacKeyCache.set(cacheKey, imported);
-    return imported;
-}
-function getCachedEd25519PrivateKey(privateKeyPkcs8Base64Url) {
-    const cacheKey = `ed25519:pkcs8:${privateKeyPkcs8Base64Url}`;
-    const cached = ed25519PrivateKeyCache.get(cacheKey);
-    if (cached)
-        return cached;
-    if (ed25519PrivateKeyCache.size >= ED25519_KEY_CACHE_LIMIT) {
-        ed25519PrivateKeyCache.clear();
-    }
-    const subtle = requireCryptoSubtle();
-    const imported = subtle
-        .importKey('pkcs8', toArrayBuffer(fromBase64Url(privateKeyPkcs8Base64Url)), { name: 'Ed25519' }, false, ['sign'])
-        .catch((error) => {
-        ed25519PrivateKeyCache.delete(cacheKey);
-        throw error;
-    });
-    ed25519PrivateKeyCache.set(cacheKey, imported);
-    return imported;
-}
-function getCachedEd25519PublicKey(publicKeySpkiBase64Url) {
-    const cacheKey = `ed25519:spki:${publicKeySpkiBase64Url}`;
-    const cached = ed25519PublicKeyCache.get(cacheKey);
-    if (cached)
-        return cached;
-    if (ed25519PublicKeyCache.size >= ED25519_KEY_CACHE_LIMIT) {
-        ed25519PublicKeyCache.clear();
-    }
-    const subtle = requireCryptoSubtle();
-    const imported = subtle
-        .importKey('spki', toArrayBuffer(fromBase64Url(publicKeySpkiBase64Url)), { name: 'Ed25519' }, false, ['verify'])
-        .catch((error) => {
-        ed25519PublicKeyCache.delete(cacheKey);
-        throw error;
-    });
-    ed25519PublicKeyCache.set(cacheKey, imported);
-    return imported;
-}
-function toBase64Url(bytes) {
-    const bufferLike = getBufferLike();
-    const base64 = bufferLike ? bufferLike.from(bytes).toString('base64') : btoa(String.fromCharCode(...bytes));
-    return base64
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/g, '');
-}
-function fromBase64Url(value) {
-    const padded = value
-        .replace(/-/g, '+')
-        .replace(/_/g, '/')
-        .padEnd(Math.ceil(value.length / 4) * 4, '=');
-    const bufferLike = getBufferLike();
-    if (bufferLike) {
-        return new Uint8Array(bufferLike.from(padded, 'base64'));
-    }
-    const binary = atob(padded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-}
-function toArrayBuffer(bytes) {
-    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-}
-export function canonicalizeEnvelope(envelope) {
-    return `{"body":${serializeBodyCanonical(envelope.body)},"header":${serializeHeaderCanonical(envelope.header)}}`;
-}
-function requireCryptoSubtle() {
-    if (typeof crypto === 'undefined' || !crypto.subtle) {
-        throw new Error('Web Crypto API is not available in this runtime');
-    }
-    return crypto.subtle;
-}
-async function hmacSign(payload, secret) {
-    const subtle = requireCryptoSubtle();
-    const key = await getCachedHmacKey(secret);
-    const signature = await subtle.sign('HMAC', key, textEncoder.encode(payload));
-    return toBase64Url(new Uint8Array(signature));
-}
-async function hmacVerify(payload, signature, secret) {
-    const subtle = requireCryptoSubtle();
-    const key = await getCachedHmacKey(secret);
-    const signatureBytes = fromBase64Url(signature);
-    return subtle.verify('HMAC', key, signatureBytes.buffer, textEncoder.encode(payload));
-}
-async function ed25519Sign(payload, privateKeyPkcs8Base64Url) {
-    const subtle = requireCryptoSubtle();
-    const key = await getCachedEd25519PrivateKey(privateKeyPkcs8Base64Url);
-    const signature = await subtle.sign('Ed25519', key, textEncoder.encode(payload));
-    return toBase64Url(new Uint8Array(signature));
-}
-async function ed25519Verify(payload, signature, publicKeySpkiBase64Url) {
-    const subtle = requireCryptoSubtle();
-    const key = await getCachedEd25519PublicKey(publicKeySpkiBase64Url);
-    const signatureBytes = fromBase64Url(signature);
-    return subtle.verify('Ed25519', key, signatureBytes.buffer, textEncoder.encode(payload));
-}
-export async function signCanonicalPayloadHmac(payload, secret) {
-    return hmacSign(payload, secret);
-}
-export async function verifyCanonicalPayloadHmac(payload, signature, secret) {
-    return hmacVerify(payload, signature, secret);
-}
-export async function generateEd25519KeypairBase64Url() {
-    const subtle = requireCryptoSubtle();
-    const pair = await subtle.generateKey({ name: 'Ed25519' }, true, ['sign', 'verify']);
-    const privateKeyRaw = await subtle.exportKey('pkcs8', pair.privateKey);
-    const publicKeyRaw = await subtle.exportKey('spki', pair.publicKey);
-    return {
-        privateKey: toBase64Url(new Uint8Array(privateKeyRaw)),
-        publicKey: toBase64Url(new Uint8Array(publicKeyRaw)),
-    };
-}
-export async function signCanonicalPayloadEd25519(payload, privateKeyPkcs8Base64Url) {
-    return ed25519Sign(payload, privateKeyPkcs8Base64Url);
-}
-export async function verifyCanonicalPayloadEd25519(payload, signature, publicKeySpkiBase64Url) {
-    return ed25519Verify(payload, signature, publicKeySpkiBase64Url);
-}
-export async function signEnvelopeHmac(envelope, secret, keyId = 'local-dev-key') {
-    const payload = canonicalizeEnvelope(envelope);
-    const signature = await hmacSign(payload, secret);
-    return {
-        ...envelope,
-        signature: {
-            alg: 'HS256',
-            keyId,
-            value: signature,
-        },
-    };
-}
-export async function verifyEnvelopeHmac(envelope, secret) {
-    if (!envelope.signature)
-        return false;
-    if (envelope.signature.alg !== 'HS256')
-        return false;
-    const unsigned = {
-        header: envelope.header,
-        body: envelope.body,
-    };
-    const payload = canonicalizeEnvelope(unsigned);
-    return hmacVerify(payload, envelope.signature.value, secret);
-}
-export async function signEnvelopeEd25519(envelope, privateKeyPkcs8Base64Url, keyId = 'local-ed25519-key') {
-    const payload = canonicalizeEnvelope(envelope);
-    const signature = await ed25519Sign(payload, privateKeyPkcs8Base64Url);
-    return {
-        ...envelope,
-        signature: {
-            alg: 'ED25519',
-            keyId,
-            value: signature,
-        },
-    };
-}
-export async function verifyEnvelopeEd25519(envelope, publicKeySpkiBase64Url) {
-    if (!envelope.signature)
-        return false;
-    if (envelope.signature.alg !== 'ED25519')
-        return false;
-    const unsigned = {
-        header: envelope.header,
-        body: envelope.body,
-    };
-    const payload = canonicalizeEnvelope(unsigned);
-    return ed25519Verify(payload, envelope.signature.value, publicKeySpkiBase64Url);
-}
-export async function verifyEnvelopeSignature(envelope, material) {
-    if (!envelope.signature)
-        return false;
-    if (envelope.signature.alg !== material.alg)
-        return false;
-    if (material.alg === 'HS256') {
-        return verifyEnvelopeHmac(envelope, material.secret);
-    }
-    return verifyEnvelopeEd25519(envelope, material.publicKey);
-}
-export async function verifyCanonicalPayloadSignature(payload, signature, material) {
-    if (!signature)
-        return false;
-    if (signature.alg !== material.alg)
-        return false;
-    if (material.alg === 'HS256') {
-        return verifyCanonicalPayloadHmac(payload, signature.value, material.secret);
-    }
-    return verifyCanonicalPayloadEd25519(payload, signature.value, material.publicKey);
-}
-export function validateEnvelope(envelope, nowMs = Date.now()) {
-    const diagnostics = [];
-    const header = envelope.header ?? {};
-    const body = envelope.body ?? {};
-    const version = typeof header.version === 'string' ? header.version : '';
-    const messageId = typeof header.messageId === 'string' ? header.messageId : '';
-    const sender = typeof header.sender === 'string' ? header.sender : '';
-    const nonce = typeof header.nonce === 'string' ? header.nonce : '';
-    const timestampMs = typeof header.timestampMs === 'number' ? header.timestampMs : 0;
-    const ttlMs = typeof header.ttlMs === 'number' ? header.ttlMs : 0;
-    const content = typeof body.content === 'string' ? body.content : '';
-    if (version !== '7h3/0.1') {
-        diagnostics.push({ level: 'error', message: `Unsupported protocol version '${version}'` });
-    }
-    if (!messageId.trim()) {
-        diagnostics.push({ level: 'error', message: 'Missing messageId' });
-    }
-    if (!sender.trim()) {
-        diagnostics.push({ level: 'error', message: 'Missing sender identity' });
-    }
-    if (!nonce.trim()) {
-        diagnostics.push({ level: 'error', message: 'Missing nonce — replay protection requires a unique nonce per message' });
-    }
-    if (ttlMs <= 0) {
-        diagnostics.push({ level: 'error', message: 'ttlMs must be greater than zero' });
-    }
-    if (timestampMs + ttlMs < nowMs) {
-        diagnostics.push({ level: 'error', message: 'Message TTL expired' });
-    }
-    if (!content.trim()) {
-        diagnostics.push({ level: 'warning', message: 'Empty content payload' });
-    }
-    return diagnostics;
-}
-export function createEnvelope(input) {
-    const nowMs = input.nowMs ?? Date.now();
-    return {
-        header: {
-            version: '7h3/0.1',
-            messageId: input.messageId ?? `msg-${nowMs}-${Math.random().toString(36).slice(2, 10)}`,
-            timestampMs: nowMs,
-            ttlMs: input.ttlMs ?? 60_000,
-            sender: input.sender,
-            recipient: input.recipient,
-            nonce: input.nonce ?? Math.random().toString(36).slice(2, 12),
-        },
-        body: {
-            intent: input.intent,
-            content: input.content,
-            capability: input.capability,
-            correlationId: input.correlationId,
-        },
-    };
-}

package/src/protocol.test.ts

@@ -1,155 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  canonicalizeEnvelope,
-  createEnvelope,
-  generateEd25519KeypairBase64Url,
-  signCanonicalPayloadHmac,
-  signEnvelopeEd25519,
-  signEnvelopeHmac,
-  verifyCanonicalPayloadEd25519,
-  validateEnvelope,
-  verifyCanonicalPayloadHmac,
-  verifyEnvelopeEd25519,
-  verifyEnvelopeHmac,
-} from './protocol'
-
-describe('GLUV AIP protocol', () => {
-  it('uses stable canonical field order', () => {
-    const envelope = createEnvelope({
-      sender: 'agent.alpha',
-      recipient: 'agent.beta',
-      intent: 'TASK',
-      content: 'compute route',
-      capability: 'task.plan',
-      correlationId: 'c-1',
-      messageId: 'm0',
-      nonce: 'n0',
-      nowMs: 500,
-      ttlMs: 10_000,
-    })
-
-    expect(canonicalizeEnvelope(envelope)).toBe(
-      '{"body":{"capability":"task.plan","content":"compute route","correlationId":"c-1","intent":"TASK"},"header":{"messageId":"m0","nonce":"n0","recipient":"agent.beta","sender":"agent.alpha","timestampMs":500,"ttlMs":10000,"version":"7h3/0.1"}}',
-    )
-  })
-
-  it('canonicalizes envelopes deterministically', () => {
-    const envelope = createEnvelope({
-      sender: 'agent.alpha',
-      recipient: 'agent.beta',
-      intent: 'TASK',
-      content: 'compute route',
-      messageId: 'm1',
-      nonce: 'n1',
-      nowMs: 1000,
-      ttlMs: 10000,
-    })
-
-    const c1 = canonicalizeEnvelope(envelope)
-    const c2 = canonicalizeEnvelope({ header: envelope.header, body: envelope.body })
-    expect(c1).toBe(c2)
-  })
-
-  it('signs and verifies with HMAC', async () => {
-    const unsigned = createEnvelope({
-      sender: 'agent.alpha',
-      intent: 'PING',
-      content: 'hello',
-      messageId: 'm2',
-      nonce: 'n2',
-      nowMs: 2000,
-      ttlMs: 10000,
-    })
-
-    const signed = await signEnvelopeHmac(unsigned, 'secret-key', 'dev-1')
-    const ok = await verifyEnvelopeHmac(signed, 'secret-key')
-    expect(ok).toBe(true)
-
-    const tampered = {
-      ...signed,
-      body: {
-        ...signed.body,
-        content: 'tampered',
-      },
-    }
-    const bad = await verifyEnvelopeHmac(tampered, 'secret-key')
-    expect(bad).toBe(false)
-  })
-
-  it('signs and verifies canonical payload directly', async () => {
-    const unsigned = createEnvelope({
-      sender: 'agent.alpha',
-      intent: 'PING',
-      content: 'hello',
-      messageId: 'm2b',
-      nonce: 'n2b',
-      nowMs: 2000,
-      ttlMs: 10000,
-    })
-
-    const payload = canonicalizeEnvelope(unsigned)
-    const sig = await signCanonicalPayloadHmac(payload, 'secret-key')
-    expect(await verifyCanonicalPayloadHmac(payload, sig, 'secret-key')).toBe(true)
-    expect(await verifyCanonicalPayloadHmac(`${payload}x`, sig, 'secret-key')).toBe(false)
-  })
-
-  it('signs and verifies with Ed25519', async () => {
-    const keys = await generateEd25519KeypairBase64Url()
-    const unsigned = createEnvelope({
-      sender: 'agent.alpha',
-      intent: 'TASK',
-      content: 'route:ed25519',
-      messageId: 'm-ed1',
-      nonce: 'n-ed1',
-      nowMs: 3000,
-      ttlMs: 10000,
-    })
-
-    const signed = await signEnvelopeEd25519(unsigned, keys.privateKey, 'ed-1')
-    const ok = await verifyEnvelopeEd25519(signed, keys.publicKey)
-    expect(ok).toBe(true)
-
-    const tampered = {
-      ...signed,
-      body: {
-        ...signed.body,
-        content: 'tampered',
-      },
-    }
-    const bad = await verifyEnvelopeEd25519(tampered, keys.publicKey)
-    expect(bad).toBe(false)
-  })
-
-  it('signs and verifies Ed25519 canonical payload directly', async () => {
-    const keys = await generateEd25519KeypairBase64Url()
-    const unsigned = createEnvelope({
-      sender: 'agent.alpha',
-      intent: 'PING',
-      content: 'hello-ed25519',
-      messageId: 'm-ed2',
-      nonce: 'n-ed2',
-      nowMs: 3100,
-      ttlMs: 10000,
-    })
-
-    const payload = canonicalizeEnvelope(unsigned)
-    const sig = await signEnvelopeEd25519(unsigned, keys.privateKey, 'ed-2')
-    expect(sig.signature?.alg).toBe('ED25519')
-    expect(await verifyCanonicalPayloadEd25519(payload, sig.signature?.value ?? '', keys.publicKey)).toBe(true)
-    expect(await verifyCanonicalPayloadEd25519(`${payload}x`, sig.signature?.value ?? '', keys.publicKey)).toBe(false)
-  })
-
-  it('flags expired messages', () => {
-    const unsigned = createEnvelope({
-      sender: 'agent.alpha',
-      intent: 'RESULT',
-      content: 'done',
-      messageId: 'm3',
-      nonce: 'n3',
-      nowMs: 0,
-      ttlMs: 100,
-    })
-    const diagnostics = validateEnvelope({ ...unsigned }, 500)
-    expect(diagnostics.some((d) => d.message === 'Message TTL expired')).toBe(true)
-  })
-})