@7h3/protocol 0.5.3 → 0.5.4

package/index.js

@@ -1,14 +1,7 @@
-//#region \0rolldown/runtime.js
-var e = Object.create, t = Object.defineProperty, n = Object.getOwnPropertyDescriptor, r = Object.getOwnPropertyNames, i = Object.getPrototypeOf, a = Object.prototype.hasOwnProperty, o = (e, t) => () => (t || (e((t = { exports: {} }).exports, t), e = null), t.exports), s = (e, i, o, s) => {
-	if (i && typeof i == "object" || typeof i == "function") for (var c = r(i), l = 0, u = c.length, d; l < u; l++) d = c[l], !a.call(e, d) && d !== o && t(e, d, {
-		get: ((e) => i[e]).bind(null, d),
-		enumerable: !(s = n(i, d)) || s.enumerable
-	});
-	return e;
-}, c = (n, r, a) => (a = n == null ? {} : e(i(n)), s(r || !n || !n.__esModule ? t(a, "default", {
-	value: n,
-	enumerable: !0
-}) : a, n)), l = new TextEncoder(), u = 256, d = /* @__PURE__ */ new Map(), f = 256, p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
+import e from "node:readline";
+import { createCipheriv as t, createDecipheriv as n, createPrivateKey as r, createPublicKey as i, diffieHellman as a, generateKeyPairSync as o, hkdfSync as s, randomBytes as c } from "node:crypto";
+//#region src/protocol.ts
+var l = new TextEncoder(), u = 256, d = /* @__PURE__ */ new Map(), f = 256, p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map();
 function ee() {
 	return globalThis.Buffer ?? null;
 }
@@ -24,7 +17,7 @@ function re(e) {
 	let t = `hs256:${e}`, n = d.get(t);
 	if (n) return n;
 	d.size >= u && d.clear();
-	let r = _().importKey("raw", l.encode(e), {
+	let r = v().importKey("raw", l.encode(e), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, !1, ["sign", "verify"]).catch((e) => {
@@ -36,7 +29,7 @@ function ie(e) {
 	let t = `ed25519:pkcs8:${e}`, n = p.get(t);
 	if (n) return n;
 	p.size >= f && p.clear();
-	let r = _().importKey("pkcs8", se(h(e)), { name: "Ed25519" }, !1, ["sign"]).catch((e) => {
+	let r = v().importKey("pkcs8", oe(g(e)), { name: "Ed25519" }, !1, ["sign"]).catch((e) => {
 		throw p.delete(t), e;
 	});
 	return p.set(t, r), r;
@@ -45,33 +38,33 @@ function ae(e) {
 	let t = `ed25519:spki:${e}`, n = m.get(t);
 	if (n) return n;
 	m.size >= f && m.clear();
-	let r = _().importKey("spki", se(h(e)), { name: "Ed25519" }, !1, ["verify"]).catch((e) => {
+	let r = v().importKey("spki", oe(g(e)), { name: "Ed25519" }, !1, ["verify"]).catch((e) => {
 		throw m.delete(t), e;
 	});
 	return m.set(t, r), r;
 }
-function oe(e) {
+function h(e) {
 	let t = ee();
 	return (t ? t.from(e).toString("base64") : btoa(String.fromCharCode(...e))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
-function h(e) {
+function g(e) {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(e.length / 4) * 4, "="), n = ee();
 	if (n) return new Uint8Array(n.from(t, "base64"));
 	let r = atob(t), i = new Uint8Array(r.length);
 	for (let e = 0; e < r.length; e += 1) i[e] = r.charCodeAt(e);
 	return i;
 }
-function se(e) {
+function oe(e) {
 	return e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength);
 }
-function g(e) {
+function _(e) {
 	return `{"body":${ne(e.body)},"header":${te(e.header)}}`;
 }
-function _() {
+function v() {
 	if (typeof crypto > "u" || !crypto.subtle) throw Error("Web Crypto API is not available in this runtime");
 	return crypto.subtle;
 }
-function v(e = 12) {
+function y(e = 12) {
 	if (typeof crypto > "u" || !crypto.getRandomValues) throw Error("Web Crypto API is not available in this runtime");
 	let t = new Uint8Array(e);
 	crypto.getRandomValues(t);
@@ -79,43 +72,43 @@ function v(e = 12) {
 	for (let e of t) n += e.toString(16).padStart(2, "0");
 	return n;
 }
-async function ce(e, t) {
-	let n = _(), r = await re(t), i = await n.sign("HMAC", r, l.encode(e));
-	return oe(new Uint8Array(i));
+async function se(e, t) {
+	let n = v(), r = await re(t), i = await n.sign("HMAC", r, l.encode(e));
+	return h(new Uint8Array(i));
 }
-async function le(e, t, n) {
-	let r = _(), i = await re(n), a = h(t);
+async function ce(e, t, n) {
+	let r = v(), i = await re(n), a = g(t);
 	return r.verify("HMAC", i, a.buffer, l.encode(e));
 }
-async function ue(e, t) {
-	let n = _(), r = await ie(t), i = await n.sign("Ed25519", r, l.encode(e));
-	return oe(new Uint8Array(i));
+async function le(e, t) {
+	let n = v(), r = await ie(t), i = await n.sign("Ed25519", r, l.encode(e));
+	return h(new Uint8Array(i));
 }
-async function de(e, t, n) {
-	let r = _(), i = await ae(n), a = h(t);
+async function ue(e, t, n) {
+	let r = v(), i = await ae(n), a = g(t);
 	return r.verify("Ed25519", i, a.buffer, l.encode(e));
 }
-async function fe(e, t) {
-	return ce(e, t);
+async function de(e, t) {
+	return se(e, t);
 }
-async function pe(e, t, n) {
-	return le(e, t, n);
+async function fe(e, t, n) {
+	return ce(e, t, n);
 }
-async function me() {
-	let e = _(), t = await e.generateKey({ name: "Ed25519" }, !0, ["sign", "verify"]), n = await e.exportKey("pkcs8", t.privateKey), r = await e.exportKey("spki", t.publicKey);
+async function pe() {
+	let e = v(), t = await e.generateKey({ name: "Ed25519" }, !0, ["sign", "verify"]), n = await e.exportKey("pkcs8", t.privateKey), r = await e.exportKey("spki", t.publicKey);
 	return {
-		privateKey: oe(new Uint8Array(n)),
-		publicKey: oe(new Uint8Array(r))
+		privateKey: h(new Uint8Array(n)),
+		publicKey: h(new Uint8Array(r))
 	};
 }
-async function y(e, t) {
-	return ue(e, t);
+async function b(e, t) {
+	return le(e, t);
 }
-async function b(e, t, n) {
-	return de(e, t, n);
+async function x(e, t, n) {
+	return ue(e, t, n);
 }
-async function x(e, t, n = "local-dev-key") {
-	let r = await ce(g(e), t);
+async function me(e, t, n = "local-dev-key") {
+	let r = await se(_(e), t);
 	return {
 		...e,
 		signature: {
@@ -125,14 +118,14 @@ async function x(e, t, n = "local-dev-key") {
 		}
 	};
 }
-async function he(e, t) {
-	return !e.signature || e.signature.alg !== "HS256" ? !1 : le(g({
+async function S(e, t) {
+	return !e.signature || e.signature.alg !== "HS256" ? !1 : ce(_({
 		header: e.header,
 		body: e.body
 	}), e.signature.value, t);
 }
-async function S(e, t, n = "local-ed25519-key") {
-	let r = await ue(g(e), t);
+async function C(e, t, n = "local-ed25519-key") {
+	let r = await le(_(e), t);
 	return {
 		...e,
 		signature: {
@@ -142,19 +135,20 @@ async function S(e, t, n = "local-ed25519-key") {
 		}
 	};
 }
-async function C(e, t) {
-	return !e.signature || e.signature.alg !== "ED25519" ? !1 : de(g({
+async function w(e, t) {
+	return !e.signature || e.signature.alg !== "ED25519" ? !1 : ue(_({
 		header: e.header,
 		body: e.body
 	}), e.signature.value, t);
 }
-async function ge(e, t) {
-	return !e.signature || e.signature.alg !== t.alg ? !1 : t.alg === "HS256" ? he(e, t.secret) : C(e, t.publicKey);
+async function he(e, t) {
+	return !e.signature || e.signature.alg !== t.alg ? !1 : t.alg === "HS256" ? S(e, t.secret) : w(e, t.publicKey);
 }
-async function _e(e, t, n) {
-	return !t || t.alg !== n.alg ? !1 : n.alg === "HS256" ? pe(e, t.value, n.secret) : b(e, t.value, n.publicKey);
+async function ge(e, t, n) {
+	return !t || t.alg !== n.alg ? !1 : n.alg === "HS256" ? fe(e, t.value, n.secret) : x(e, t.value, n.publicKey);
 }
-function w(e, t = Date.now()) {
+var _e = 864e5;
+function T(e, t = Date.now()) {
 	let n = [], r = e.header ?? {}, i = e.body ?? {}, a = typeof r.version == "string" ? r.version : "", o = typeof r.messageId == "string" ? r.messageId : "", s = typeof r.sender == "string" ? r.sender : "", c = typeof r.nonce == "string" ? r.nonce : "", l = typeof r.timestampMs == "number" ? r.timestampMs : 0, u = typeof r.ttlMs == "number" ? r.ttlMs : 0, d = typeof i.content == "string" ? i.content : "";
 	return a !== "7h3/0.1" && n.push({
 		level: "error",
@@ -171,6 +165,9 @@ function w(e, t = Date.now()) {
 	}), u <= 0 && n.push({
 		level: "error",
 		message: "ttlMs must be greater than zero"
+	}), u > 864e5 && n.push({
+		level: "error",
+		message: `ttlMs exceeds maximum allowed ${_e} ms`
 	}), l + u < t && n.push({
 		level: "error",
 		message: "Message TTL expired"
@@ -179,17 +176,17 @@ function w(e, t = Date.now()) {
 		message: "Empty content payload"
 	}), n;
 }
-function T(e) {
+function E(e) {
 	let t = e.nowMs ?? Date.now();
 	return {
 		header: {
 			version: "7h3/0.1",
-			messageId: e.messageId ?? `msg-${t}-${v(6)}`,
+			messageId: e.messageId ?? `msg-${t}-${y(6)}`,
 			timestampMs: t,
 			ttlMs: e.ttlMs ?? 6e4,
 			sender: e.sender,
 			recipient: e.recipient,
-			nonce: e.nonce ?? v(12)
+			nonce: e.nonce ?? y(12)
 		},
 		body: {
 			intent: e.intent,
@@ -206,7 +203,7 @@ var ve = [
 	73,
 	80,
 	66
-], ye = Uint8Array.from(ve), be = 1, xe = 1024 * 1024, Se = 1, Ce = 2, we = 4, Te = 8, Ee = new TextEncoder(), De = new TextDecoder(), Oe = new Set([
+], ye = Uint8Array.from(ve), be = 1, xe = 1024 * 1024, Se = 1, Ce = 2, we = 4, Te = 8, Ee = new TextEncoder(), De = new TextDecoder(), Oe = /* @__PURE__ */ new Set([
 	"PING",
 	"PONG",
 	"CAPS",
@@ -226,10 +223,10 @@ function je(e) {
 function Me(e) {
 	return e === 1 ? "HS256" : e === 2 ? "ED25519" : null;
 }
-function E(e) {
+function D(e) {
 	return { bytes: ke(e) };
 }
-function D(e) {
+function O(e) {
 	return e ? 4 + e.bytes.byteLength : 0;
 }
 var Ne = class {
@@ -292,7 +289,7 @@ var Ne = class {
 	}
 };
 function Fe(e) {
-	let t = (e.header.recipient ? Se : 0) | (e.body.capability ? Ce : 0) | (e.body.correlationId ? we : 0) | (e.signature ? Te : 0), n = E(e.header.version), r = E(e.header.messageId), i = E(e.header.sender), a = E(e.header.nonce), o = E(e.body.intent), s = E(e.body.content), c = e.header.recipient ? E(e.header.recipient) : null, l = e.body.capability ? E(e.body.capability) : null, u = e.body.correlationId ? E(e.body.correlationId) : null, d = e.signature ? E(e.signature.keyId) : null, f = e.signature ? E(e.signature.value) : null, p = new Ne(ye.byteLength + 1 + 1 + 8 + 4 + D(n) + D(r) + D(i) + D(a) + D(o) + D(s) + D(c) + D(l) + D(u) + +!!e.signature + D(d) + D(f));
+	let t = (e.header.recipient ? Se : 0) | (e.body.capability ? Ce : 0) | (e.body.correlationId ? we : 0) | (e.signature ? Te : 0), n = D(e.header.version), r = D(e.header.messageId), i = D(e.header.sender), a = D(e.header.nonce), o = D(e.body.intent), s = D(e.body.content), c = e.header.recipient ? D(e.header.recipient) : null, l = e.body.capability ? D(e.body.capability) : null, u = e.body.correlationId ? D(e.body.correlationId) : null, d = e.signature ? D(e.signature.keyId) : null, f = e.signature ? D(e.signature.value) : null, p = new Ne(ye.byteLength + 1 + 1 + 8 + 4 + O(n) + O(r) + O(i) + O(a) + O(o) + O(s) + O(c) + O(l) + O(u) + +!!e.signature + O(d) + O(f));
 	return p.writeBytes(ye), p.writeU8(be), p.writeU8(t), p.writeU64(e.header.timestampMs), p.writeU32(e.header.ttlMs), p.writeString(n), p.writeString(r), p.writeString(i), p.writeString(a), p.writeString(o), p.writeString(s), c && p.writeString(c), l && p.writeString(l), u && p.writeString(u), e.signature && d && f && (p.writeU8(je(e.signature.alg)), p.writeString(d), p.writeString(f)), p.finish();
 }
 function Ie(e, t = {}) {
@@ -433,7 +430,7 @@ var Le = class {
 			this.items[t] = l, this.items[r] = c, t = r;
 		}
 	}
-}, O = class {
+}, k = class {
 	entries = /* @__PURE__ */ new Map();
 	maxEntries;
 	expiries = new Le();
@@ -673,7 +670,7 @@ function Je(e) {
 		}];
 	}
 }
-async function k(e, t = {}) {
+async function A(e, t = {}) {
 	let n = t.nowMs ?? Date.now(), r = t.requireSignature ?? !0, i = t.maxClockSkewMs ?? 3e4;
 	async function a(e) {
 		t.telemetry && await t.telemetry({
@@ -707,7 +704,7 @@ async function k(e, t = {}) {
 			envelope: o.envelope
 		};
 	}
-	let s = [...w(o.envelope, n)];
+	let s = [...T(o.envelope, n)];
 	if (s.some((e) => e.level === "error")) return await a({
 		phase: "rejected_validation",
 		sender: o.envelope.header.sender,
@@ -764,7 +761,7 @@ async function k(e, t = {}) {
 		diagnostics: s,
 		envelope: o.envelope
 	};
-	if (!await _e(g({
+	if (!await ge(_({
 		header: o.envelope.header,
 		body: o.envelope.body
 	}), o.envelope.signature, c)) return s.push({
@@ -815,7 +812,7 @@ async function Ye(e, t = {}) {
 				let n = i;
 				i += 1;
 				let a = e[n];
-				a && typeof a == "object" && "ok" in a && "diagnostics" in a && "envelope" in a ? r[n] = a : r[n] = await k(a, t);
+				a && typeof a == "object" && "ok" in a && "diagnostics" in a && "envelope" in a ? r[n] = a : r[n] = await A(a, t);
 			}
 		})), await t.telemetry?.({
 			phase: "batch_summary",
@@ -829,12 +826,12 @@ var Xe = class {
 	constructor(e = {}) {
 		this.options = {
 			...e,
-			replayCache: e.replayCache ?? new O(),
+			replayCache: e.replayCache ?? new k(),
 			verificationMaterialCache: e.verificationMaterialCache ?? new ze()
 		};
 	}
 	receive(e, t = Date.now()) {
-		return k(e, {
+		return A(e, {
 			...this.options,
 			nowMs: t
 		});
@@ -847,7 +844,7 @@ var Xe = class {
 	}
 };
 async function Ze(e) {
-	return x(T(e), e.secret, e.keyId);
+	return me(E(e), e.secret, e.keyId);
 }
 //#endregion
 //#region src/protocolCapabilities.ts
@@ -930,13 +927,13 @@ var ot = class {
 	resolveInboundSecret;
 	onTask;
 	constructor(e) {
-		this.agentId = e.agentId, this.outboundSecret = e.outboundSecret, this.keyId = e.keyId ?? `${e.agentId}-k1`, this.capabilities = e.capabilities ?? [], this.supportedWireFormats = e.supportedWireFormats ?? ["compact", "json"], this.maxBatchSize = e.maxBatchSize ?? 1, this.ackModes = e.ackModes ?? ["receipt"], this.requireSignature = e.requireSignature ?? !0, this.replayCache = e.replayCache ?? new O(), this.sharedSecrets = e.sharedSecrets ?? {}, this.resolveInboundSecret = e.resolveInboundSecret, this.onTask = e.onTask;
+		this.agentId = e.agentId, this.outboundSecret = e.outboundSecret, this.keyId = e.keyId ?? `${e.agentId}-k1`, this.capabilities = e.capabilities ?? [], this.supportedWireFormats = e.supportedWireFormats ?? ["compact", "json"], this.maxBatchSize = e.maxBatchSize ?? 1, this.ackModes = e.ackModes ?? ["receipt"], this.requireSignature = e.requireSignature ?? !0, this.replayCache = e.replayCache ?? new k(), this.sharedSecrets = e.sharedSecrets ?? {}, this.resolveInboundSecret = e.resolveInboundSecret, this.onTask = e.onTask;
 	}
 	async inboundSecretResolver(e, t) {
 		return this.resolveInboundSecret ? this.resolveInboundSecret(e, t) : this.sharedSecrets[t];
 	}
 	async createSignedIntent(e) {
-		return x(T({
+		return me(E({
 			sender: this.agentId,
 			recipient: e.recipient,
 			intent: e.intent,
@@ -950,7 +947,7 @@ var ot = class {
 		}), this.outboundSecret, this.keyId);
 	}
 	async receiveAndRespond(e, t = Date.now()) {
-		let n = await k(e, {
+		let n = await A(e, {
 			nowMs: t,
 			requireSignature: this.requireSignature,
 			replayCache: this.replayCache,
@@ -1275,28 +1272,28 @@ function wt(e) {
 		}
 	};
 }
-async function Tt(e = {}) {
+async function j(e = {}) {
 	let t = await xt(e);
 	return {
 		policy: t,
 		enforcer: wt(t)
 	};
 }
-function Et(e) {
+function Tt(e) {
 	return Ct(e);
 }
 //#endregion
 //#region src/mcpGateway.ts
-var Dt = [
+var Et = [
 	"tools/call",
 	"resources/read",
 	"prompts/get"
 ];
-function Ot(e) {
+function Dt(e) {
 	return JSON.stringify(e);
 }
-function A(e, t, n) {
-	return Ot({
+function M(e, t, n) {
+	return Dt({
 		jsonrpc: "2.0",
 		id: e,
 		error: {
@@ -1305,7 +1302,7 @@ function A(e, t, n) {
 		}
 	});
 }
-function kt(e) {
+function Ot(e) {
 	let t = JSON.parse(e);
 	return t.jsonrpc !== "2.0" || typeof t.method != "string" || t.method.length === 0 || typeof t.id != "string" && typeof t.id != "number" ? null : {
 		jsonrpc: "2.0",
@@ -1314,11 +1311,11 @@ function kt(e) {
 		params: t.params
 	};
 }
-function At(e) {
+function kt(e) {
 	return e.includes("not allowed") ? -32601 : e.includes("not authorized") ? -32001 : e.includes("rate-limited") ? -32002 : -32603;
 }
-function jt(e) {
-	let t = e.gatewayAgentId ?? "agent.gateway", n = e.workerAgentId ?? "agent.worker", r = e.allowedMethods ?? Dt, i = e.workerCapabilityPrefix ?? "mcp.", a = e.gatewayWireFormat ?? "compact", o = e.workerWireFormat ?? "compact";
+function At(e) {
+	let t = e.gatewayAgentId ?? "agent.gateway", n = e.workerAgentId ?? "agent.worker", r = e.allowedMethods ?? Et, i = e.workerCapabilityPrefix ?? "mcp.", a = e.gatewayWireFormat ?? "compact", o = e.workerWireFormat ?? "compact";
 	async function s(t) {
 		e.onAuditEvent && await e.onAuditEvent({
 			...t,
@@ -1337,7 +1334,7 @@ function jt(e) {
 		wireFormat: o,
 		onTask: async (e) => ({
 			intent: "RESULT",
-			content: Ot({
+			content: Dt({
 				ok: !0,
 				capability: e.body.capability,
 				content: e.body.content
@@ -1350,18 +1347,18 @@ function jt(e) {
 		if (!i) return null;
 		let a = null;
 		try {
-			let t = kt(i);
+			let t = Ot(i);
 			if (!t) return await s({
 				phase: "request_error",
 				code: -32600,
 				message: "Invalid Request"
-			}), A(null, -32600, "Invalid Request");
+			}), M(null, -32600, "Invalid Request");
 			a = t.id, await s({
 				phase: "request_received",
 				id: t.id,
 				method: t.method
 			});
-			let o = await mt(c, t, {
+			let o = {
 				recipient: n,
 				allowedMethods: r,
 				methodToCapability: e.methodToCapability,
@@ -1376,42 +1373,42 @@ function jt(e) {
 						policy: e
 					});
 				}
-			}), u = null;
-			if (await l.handleRaw(o, async (e) => {
-				u = e;
-			}), !u) return await s({
+			}, u = await mt(c, t, o), d = null;
+			if (await l.handleRaw(u, async (e) => {
+				d = e;
+			}), !d) return await s({
 				phase: "verification_failed",
 				id: t.id,
 				method: t.method,
 				code: -32603,
 				message: "AIP worker did not produce a response"
-			}), A(a, -32603, "AIP worker did not produce a response");
-			let d = await c.receiveRaw(u);
-			return !d.ok || !d.received ? (await s({
+			}), M(a, -32603, "AIP worker did not produce a response");
+			let f = await c.receiveRaw(d);
+			return !f.ok || !f.received ? (await s({
 				phase: "verification_failed",
 				id: t.id,
 				method: t.method,
 				code: -32603,
 				message: "AIP verification failed"
-			}), A(a, -32603, "AIP verification failed")) : (await s({
+			}), M(a, -32603, "AIP verification failed")) : (await s({
 				phase: "request_success",
 				id: t.id,
 				method: t.method
-			}), Ot(ht(d.received, t.id)));
+			}), Dt(ht(f.received, t.id)));
 		} catch (e) {
-			let t = e instanceof Error ? e.message : "Internal error", n = At(t);
+			let t = e instanceof Error ? e.message : "Internal error", n = kt(t);
 			return await s({
 				phase: "request_error",
 				id: a,
 				code: n,
 				message: t
-			}), A(a, n, t);
+			}), M(a, n, t);
 		}
 	} };
 }
-async function Mt(e) {
-	if (!e.runtimePolicy?.enabled) return jt(e);
-	let { enforcer: t } = await Tt(e.runtimePolicy.options);
+async function jt(e) {
+	if (!e.runtimePolicy?.enabled) return At(e);
+	let { enforcer: t } = await j(e.runtimePolicy.options);
 	t.assertInvariant({
 		signatureVerification: !0,
 		canonicalization: !0,
@@ -1423,7 +1420,7 @@ async function Mt(e) {
 		latencySensitive: e.runtimePolicy.latencySensitive,
 		compatibilityFirst: e.runtimePolicy.compatibilityFirst
 	}), r = n.includes("binary") ? "binary" : "compact";
-	return jt({
+	return At({
 		...e,
 		gatewayWireFormat: r,
 		workerWireFormat: r,
@@ -1439,14 +1436,14 @@ async function Mt(e) {
 }
 //#endregion
 //#region src/runtimePolicyManager.ts
-var Nt = class {
+var Mt = class {
 	snapshot = null;
 	options;
 	constructor(e = {}) {
 		this.options = e;
 	}
 	async loadInitial() {
-		let e = await Tt(this.options);
+		let e = await j(this.options);
 		return this.snapshot = {
 			...e,
 			loadedAtMs: Date.now()
@@ -1459,7 +1456,7 @@ var Nt = class {
 	async refresh() {
 		let e = this.snapshot;
 		try {
-			let e = await Tt(this.options);
+			let e = await j(this.options);
 			return this.snapshot = {
 				...e,
 				loadedAtMs: Date.now()
@@ -1469,7 +1466,7 @@ var Nt = class {
 			throw t;
 		}
 	}
-}, Pt = {
+}, Nt = {
 	dev: {
 		environment: "dev",
 		mode: "ws-batch",
@@ -1495,12 +1492,12 @@ var Nt = class {
 		retryMaxAttempts: 3
 	}
 };
-function Ft(e) {
-	return Pt[e];
+function Pt(e) {
+	return Nt[e];
 }
 //#endregion
 //#region src/policyTelemetryFeedback.ts
-function It(e) {
+function Ft(e) {
 	let t = [], n = "normal";
 	return e.dropPct > .1 && (t.push("reduce inflight cap"), t.push("reduce batch size"), t.push("increase retry backoff"), e.mode === "http" && e.concurrency >= 100 && t.push("switch to http-binary-batch"), n = e.dropPct > 2 ? "critical" : "warn"), e.p99Ms > 20 && (t.push("reduce batch size"), t.push("run adaptive benchmark and re-baseline"), n === "normal" && (n = "warn"), e.p99Ms > 100 && (n = "critical")), {
 		severity: n,
@@ -1509,7 +1506,7 @@ function It(e) {
 }
 //#endregion
 //#region src/redisClient.ts
-var Lt = class {
+var It = class {
 	entries = /* @__PURE__ */ new Map();
 	now;
 	constructor(e = {}) {
@@ -1555,13 +1552,13 @@ var Lt = class {
 		};
 		return t;
 	}
-}, Rt = class {
+}, Lt = class {
 	keyPrefix;
 	client;
 	constructor(e = {}) {
 		if (this.keyPrefix = e.keyPrefix ?? "7h3:nonce:", e.client) this.client = e.client;
 		else {
-			let e = new Lt();
+			let e = new It();
 			this.client = {
 				set: (t, n, r) => e.set(t, n, {
 					nx: r?.nx,
@@ -1580,7 +1577,7 @@ var Lt = class {
 			px: Math.max(1, t)
 		}) === null;
 	}
-}, zt = class {
+}, Rt = class {
 	nodes;
 	constructor(e) {
 		this.nodes = e;
@@ -1589,17 +1586,17 @@ var Lt = class {
 		return (await Promise.all(this.nodes.map((n) => n.check(e, t)))).some((e) => e);
 	}
 };
-function Bt(e, t = {}) {
-	return Vt(e) ? Ut(e, t) : new Rt(e);
+function zt(e, t = {}) {
+	return Bt(e) ? Ht(e, t) : new Lt(e);
 }
-function Vt(e) {
+function Bt(e) {
 	return typeof e == "object" && !!e && typeof e.set == "function" && (typeof e.pipeline == "function" || !("quit" in e));
 }
-function Ht(e) {
-	return new zt(e.map((e) => new Rt({ redisUrl: e })));
+function Vt(e) {
+	return new Rt(e.map((e) => new Lt({ redisUrl: e })));
 }
-function Ut(e, t = {}) {
-	let n = t.keyPrefix ?? "aip:replay:", r = t.errorBehavior ?? "fallback", i = t.onDegraded, a = t.fallback ?? (r === "fallback" ? Ut(new Lt(), {
+function Ht(e, t = {}) {
+	let n = t.keyPrefix ?? "aip:replay:", r = t.errorBehavior ?? "fallback", i = t.onDegraded, a = t.fallback ?? (r === "fallback" ? Ht(new It(), {
 		keyPrefix: n,
 		errorBehavior: "reject"
 	}) : void 0);
@@ -1639,7 +1636,7 @@ function Ut(e, t = {}) {
 }
 //#endregion
 //#region src/revocation.ts
-var Wt = class {
+var Ut = class {
 	revoked = /* @__PURE__ */ new Map();
 	now;
 	constructor(e = {}) {
@@ -1656,7 +1653,7 @@ var Wt = class {
 		this.revoked.set(this.makeKey(e, t), n.untilMs ?? Infinity);
 	}
 };
-function Gt(e, t = {}) {
+function Wt(e, t = {}) {
 	let n = t.keyPrefix ?? "aip:revoked:", r = t.errorBehavior ?? "reject", i = t.cacheTtlMs ?? 5e3, a = t.onDegraded, o = t.now ?? (() => Date.now()), s = /* @__PURE__ */ new Map();
 	function c(e, t) {
 		return `${n}${e}${t}`;
@@ -1688,7 +1685,7 @@ function Gt(e, t = {}) {
 		}
 	};
 }
-function Kt(e, t, n = {}) {
+function Gt(e, t, n = {}) {
 	let r = n.nowMsProvider ?? (() => Date.now());
 	return async (n, i) => {
 		if (!await t.isRevoked(i, n.keyId, r())) return e(n, i);
@@ -1696,7 +1693,7 @@ function Kt(e, t, n = {}) {
 }
 //#endregion
 //#region src/mcpWrapper.ts
-function j(e, t, n) {
+function N(e, t, n) {
 	return {
 		jsonrpc: "2.0",
 		id: e,
@@ -1706,20 +1703,20 @@ function j(e, t, n) {
 		}
 	};
 }
-function qt(e, t) {
+function Kt(e, t) {
 	return {
 		requireSignature: !0,
 		...e.receive,
 		replayCache: t
 	};
 }
-function Jt(e, t) {
-	let n = t.wireFormat ?? "compact", r = t.ttlMs ?? 6e4, i = qt(t, t.receive?.replayCache ?? new O());
+function qt(e, t) {
+	let n = t.wireFormat ?? "compact", r = t.ttlMs ?? 6e4, i = Kt(t, t.receive?.replayCache ?? new k());
 	async function a(e) {
 		return Ke(await t.sign(e), n);
 	}
 	function o(e, n, i, o) {
-		return a(T({
+		return a(E({
 			sender: t.selfAgentId,
 			recipient: e,
 			intent: n,
@@ -1729,29 +1726,29 @@ function Jt(e, t) {
 		}));
 	}
 	return async (n) => {
-		let r = await k(n, i), a = r.envelope?.header.sender, s = r.envelope?.header.messageId;
-		if (!r.ok || !r.envelope) return o(a, "ERROR", j(null, -32600, r.diagnostics.find((e) => e.level === "error")?.message ?? "AIP verification failed"), s);
-		if (r.envelope.header.recipient !== t.selfAgentId) return o(a, "ERROR", j(null, -32600, "Recipient mismatch: envelope not addressed to this agent"), s);
+		let r = await A(n, i), a = r.envelope?.header.sender, s = r.envelope?.header.messageId;
+		if (!r.ok || !r.envelope) return o(a, "ERROR", N(null, -32600, r.diagnostics.find((e) => e.level === "error")?.message ?? "AIP verification failed"), s);
+		if (r.envelope.header.recipient !== t.selfAgentId) return o(a, "ERROR", N(null, -32600, "Recipient mismatch: envelope not addressed to this agent"), s);
 		let c;
 		try {
 			c = JSON.parse(r.envelope.body.content);
 		} catch {
-			return o(a, "ERROR", j(null, -32700, "Parse error: envelope body is not JSON-RPC"), s);
+			return o(a, "ERROR", N(null, -32700, "Parse error: envelope body is not JSON-RPC"), s);
 		}
 		let l;
 		try {
 			l = await e(c);
 		} catch (e) {
-			l = j(c.id ?? null, -32603, e instanceof Error ? e.message : "Internal error");
+			l = N(c.id ?? null, -32603, e instanceof Error ? e.message : "Internal error");
 		}
 		return o(r.envelope.header.sender, "RESULT", l, s);
 	};
 }
-function Yt(e) {
-	let t = e.wireFormat ?? "compact", n = e.ttlMs ?? 6e4, r = qt(e, e.receive?.replayCache ?? new O());
+function Jt(e) {
+	let t = e.wireFormat ?? "compact", n = e.ttlMs ?? 6e4, r = Kt(e, e.receive?.replayCache ?? new k());
 	return {
 		async encodeRequest(r) {
-			let i = T({
+			let i = E({
 				sender: e.selfAgentId,
 				recipient: e.peerAgentId,
 				intent: "TASK",
@@ -1764,7 +1761,7 @@ function Yt(e) {
 			};
 		},
 		async decodeResponse(t, n = {}) {
-			let i = await k(t, r);
+			let i = await A(t, r);
 			if (!i.ok || !i.envelope) {
 				let e = i.diagnostics.find((e) => e.level === "error")?.message ?? "unknown";
 				throw Error(`AIP response verification failed: ${e}`);
@@ -1776,8 +1773,8 @@ function Yt(e) {
 		}
 	};
 }
-function Xt(e, t) {
-	let n = Yt(t);
+function Yt(e, t) {
+	let n = Jt(t);
 	return async (t) => {
 		let { raw: r, messageId: i } = await n.encodeRequest(t);
 		return n.decodeResponse(await e(r), { expectCorrelationId: i });
@@ -1785,55 +1782,52 @@ function Xt(e, t) {
 }
 //#endregion
 //#region src/mcpTransports.ts
-var M = /* @__PURE__ */ c((/* @__PURE__ */ o(((e, t) => {
-	t.exports = {};
-})))(), 1);
-function Zt(e) {
+function Xt(e) {
 	if (typeof e != "string") throw Error("stdio adapter supports json/compact (string) wire formats; use the HTTP adapter for binary");
 	return e;
 }
-function Qt(e, t = {}) {
-	let n = t.input ?? process.stdin, r = t.output ?? process.stdout, i = M.default.createInterface({
-		input: n,
+function Zt(t, n = {}) {
+	let r = n.input ?? process.stdin, i = n.output ?? process.stdout, a = e.createInterface({
+		input: r,
 		crlfDelay: Infinity
-	}), a = Promise.resolve(), o = (n) => {
-		let i = n.trim();
-		i && (a = a.then(async () => {
+	}), o = Promise.resolve(), s = (e) => {
+		let r = e.trim();
+		r && (o = o.then(async () => {
 			try {
-				let t = await e(i);
-				r.write(`${Zt(t)}\n`);
+				let e = await t(r);
+				i.write(`${Xt(e)}\n`);
 			} catch (e) {
-				t.onError?.(e);
+				n.onError?.(e);
 			}
 		}));
 	};
-	return i.on("line", o), { close() {
-		i.off("line", o), i.close();
+	return a.on("line", s), { close() {
+		a.off("line", s), a.close();
 	} };
 }
-function $t(e) {
-	let t = M.default.createInterface({
-		input: e.input,
+function Qt(t) {
+	let n = e.createInterface({
+		input: t.input,
 		crlfDelay: Infinity
-	}), n = [], r = (e) => {
+	}), r = [], i = (e) => {
 		let t = e.trim();
 		if (!t) return;
-		let r = n.shift();
-		r && r(t);
-	};
-	return t.on("line", r), {
-		send(t) {
-			let r = Zt(t);
-			return new Promise((t) => {
-				n.push(t), e.output.write(`${r}\n`);
+		let n = r.shift();
+		n && n(t);
+	};
+	return n.on("line", i), {
+		send(e) {
+			let n = Xt(e);
+			return new Promise((e) => {
+				r.push(e), t.output.write(`${n}\n`);
 			});
 		},
 		close() {
-			t.off("line", r), t.close();
+			n.off("line", i), n.close();
 		}
 	};
 }
-function en(e, t = {}) {
+function $t(e, t = {}) {
 	return (n, r) => {
 		let i = [];
 		n.on("data", (e) => i.push(e)), n.on("error", () => {
@@ -1857,7 +1851,7 @@ function en(e, t = {}) {
 		});
 	};
 }
-function tn(e) {
+function en(e) {
 	let t = e.fetchImpl ?? fetch, n = e.binary ? "application/octet-stream" : "application/json";
 	return { async send(r) {
 		let i = await t(e.url, {
@@ -1873,12 +1867,12 @@ function tn(e) {
 }
 //#endregion
 //#region src/keyRegistry.ts
-function nn(e) {
+function tn(e) {
 	return { async getPublicKey(t) {
 		return e[t] ?? null;
 	} };
 }
-function rn(...e) {
+function nn(...e) {
 	return {
 		async getPublicKey(t) {
 			for (let n of e) {
@@ -1887,17 +1881,17 @@ function rn(...e) {
 			}
 			return null;
 		},
-		async getSharedSecret(t) {
-			for (let n of e) {
-				if (!n.getSharedSecret) continue;
-				let e = await n.getSharedSecret(t);
+		async getSharedSecret(t, n) {
+			for (let r of e) {
+				if (!r.getSharedSecret) continue;
+				let e = await r.getSharedSecret(t, n);
 				if (e !== null) return e;
 			}
 			return null;
 		}
 	};
 }
-function an(e, t) {
+function rn(e, t) {
 	let n = t?.ttlMs ?? 6e4, r = /* @__PURE__ */ new Map();
 	async function i(e, t) {
 		let i = Date.now(), a = r.get(e);
@@ -1912,25 +1906,25 @@ function an(e, t) {
 		async getPublicKey(t) {
 			return i(`pk:${t}`, () => e.getPublicKey(t));
 		},
-		async getSharedSecret(t) {
-			return e.getSharedSecret ? i(`ss:${t}`, () => e.getSharedSecret(t)) : null;
+		async getSharedSecret(t, n) {
+			return e.getSharedSecret ? i(`ss:${n}:${t}`, () => e.getSharedSecret(t, n)) : null;
 		}
 	};
 }
 //#endregion
 //#region src/cborCodec.ts
-var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3, ln = 4, un = 5, dn = 7, fn = 244, pn = 245, mn = 246, hn = 24, gn = 25, _n = 26, vn = 27, yn = 27, bn = class {
+var P = new TextEncoder(), an = new TextDecoder(), F = 0, on = 1, sn = 2, I = 3, cn = 4, ln = 5, un = 7, dn = 244, fn = 245, pn = 246, mn = 24, hn = 25, gn = 26, _n = 27, vn = 27, yn = class {
 	chunks = [];
 	encode(e) {
 		return this.chunks = [], this._encode(e), this._concat();
 	}
 	_encode(e) {
 		if (e == null) {
-			this.chunks.push(new Uint8Array([mn]));
+			this.chunks.push(new Uint8Array([pn]));
 			return;
 		}
 		if (typeof e == "boolean") {
-			this.chunks.push(new Uint8Array([e ? pn : fn]));
+			this.chunks.push(new Uint8Array([e ? fn : dn]));
 			return;
 		}
 		if (typeof e == "number") {
@@ -1968,28 +1962,28 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 			new DataView(t).setFloat64(0, e, !1), this.chunks.push(new Uint8Array(t));
 			return;
 		}
-		e >= 0 ? this._encodeHead(P, e) : this._encodeHead(sn, -1 - e);
+		e >= 0 ? this._encodeHead(F, e) : this._encodeHead(on, -1 - e);
 	}
 	_float64Header() {
 		return new Uint8Array([251]);
 	}
 	_encodeString(e) {
-		let t = N.encode(e);
-		this._encodeHead(F, t.length), this.chunks.push(t);
+		let t = P.encode(e);
+		this._encodeHead(I, t.length), this.chunks.push(t);
 	}
 	_encodeByteString(e) {
-		this._encodeHead(cn, e.length), this.chunks.push(e);
+		this._encodeHead(sn, e.length), this.chunks.push(e);
 	}
 	_encodeArray(e) {
-		this._encodeHead(ln, e.length);
+		this._encodeHead(cn, e.length);
 		for (let t of e) this._encode(t);
 	}
 	_encodeMapFromAnyEntries(e) {
 		let t = e.map(([e, t]) => {
 			let n;
-			if (typeof e == "number" && Number.isInteger(e)) n = this._encodeHeadBytes(P, e);
+			if (typeof e == "number" && Number.isInteger(e)) n = this._encodeHeadBytes(F, e);
 			else {
-				let t = N.encode(String(e)), r = this._encodeHeadBytes(F, t.length);
+				let t = P.encode(String(e)), r = this._encodeHeadBytes(I, t.length);
 				n = this._concatPair(r, t);
 			}
 			return {
@@ -1998,27 +1992,27 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 				value: t
 			};
 		});
-		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(un, t.length);
+		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(ln, t.length);
 		for (let { key: e, value: n } of t) {
-			if (typeof e == "number" && Number.isInteger(e)) this._encodeHead(P, e);
+			if (typeof e == "number" && Number.isInteger(e)) this._encodeHead(F, e);
 			else {
-				let t = N.encode(String(e));
-				this._encodeHead(F, t.length), this.chunks.push(t);
+				let t = P.encode(String(e));
+				this._encodeHead(I, t.length), this.chunks.push(t);
 			}
 			this._encode(n);
 		}
 	}
 	_encodeMapFromEntries(e) {
 		let t = e.map(([e, t]) => {
-			let n = N.encode(e), r = this._encodeHeadBytes(F, n.length);
+			let n = P.encode(e), r = this._encodeHeadBytes(I, n.length);
 			return {
 				keyBytes: n,
 				keyEncoded: this._concatPair(r, n),
 				value: t
 			};
 		});
-		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(un, t.length);
-		for (let { keyBytes: e, value: n } of t) this._encodeHead(F, e.length), this.chunks.push(e), this._encode(n);
+		t.sort((e, t) => this._compareBytes(e.keyEncoded, t.keyEncoded)), this._encodeHead(ln, t.length);
+		for (let { keyBytes: e, value: n } of t) this._encodeHead(I, e.length), this.chunks.push(e), this._encode(n);
 	}
 	_compareBytes(e, t) {
 		let n = Math.min(e.length, t.length);
@@ -2038,24 +2032,24 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 	_encodeHeadBytes(e, t) {
 		let n = e << 5;
 		if (t <= 23) return new Uint8Array([n | t]);
-		if (t <= 255) return new Uint8Array([n | hn, t]);
+		if (t <= 255) return new Uint8Array([n | mn, t]);
 		if (t <= 65535) {
 			let e = /* @__PURE__ */ new ArrayBuffer(3), r = new DataView(e);
-			return r.setUint8(0, n | gn), r.setUint16(1, t, !1), new Uint8Array(e);
+			return r.setUint8(0, n | hn), r.setUint16(1, t, !1), new Uint8Array(e);
 		}
 		if (t <= 4294967295) {
 			let e = /* @__PURE__ */ new ArrayBuffer(5), r = new DataView(e);
-			return r.setUint8(0, n | _n), r.setUint32(1, t, !1), new Uint8Array(e);
+			return r.setUint8(0, n | gn), r.setUint32(1, t, !1), new Uint8Array(e);
 		}
 		let r = /* @__PURE__ */ new ArrayBuffer(9), i = new DataView(r);
-		return i.setUint8(0, n | vn), i.setBigUint64(1, BigInt(t), !1), new Uint8Array(r);
+		return i.setUint8(0, n | _n), i.setBigUint64(1, BigInt(t), !1), new Uint8Array(r);
 	}
 	_concat() {
 		let e = this.chunks.reduce((e, t) => e + t.length, 0), t = new Uint8Array(e), n = 0;
 		for (let e of this.chunks) t.set(e, n), n += e.length;
 		return t;
 	}
-}, xn = class {
+}, bn = class {
 	data;
 	offset = 0;
 	decode(e) {
@@ -2064,22 +2058,22 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 	_decode() {
 		let e = this._readByte(), t = e >> 5 & 7, n = e & 31;
 		switch (t) {
-			case P: return this._decodeUint(n);
-			case sn: return -1 - this._decodeUint(n);
-			case cn: {
+			case F: return this._decodeUint(n);
+			case on: return -1 - this._decodeUint(n);
+			case sn: {
 				let e = this._decodeUint(n);
 				return this._readBytes(e);
 			}
-			case F: {
+			case I: {
 				let e = this._decodeUint(n), t = this._readBytes(e);
-				return on.decode(t);
+				return an.decode(t);
 			}
-			case ln: {
+			case cn: {
 				let e = this._decodeUint(n), t = [];
 				for (let n = 0; n < e; n++) t.push(this._decode());
 				return t;
 			}
-			case un: {
+			case ln: {
 				let e = this._decodeUint(n), t = {};
 				for (let n = 0; n < e; n++) {
 					let e = this._decode();
@@ -2087,11 +2081,11 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 				}
 				return t;
 			}
-			case dn:
+			case un:
 				if (n === 20) return !1;
 				if (n === 21) return !0;
 				if (n === 22) return null;
-				if (n === yn) {
+				if (n === vn) {
 					let e = this._readBytes(8);
 					return new DataView(e.buffer, e.byteOffset, 8).getFloat64(0, !1);
 				}
@@ -2101,16 +2095,16 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 	}
 	_decodeUint(e) {
 		if (e <= 23) return e;
-		if (e === hn) return this._readByte();
-		if (e === gn) {
+		if (e === mn) return this._readByte();
+		if (e === hn) {
 			let e = this._readBytes(2);
 			return new DataView(e.buffer, e.byteOffset, 2).getUint16(0, !1);
 		}
-		if (e === _n) {
+		if (e === gn) {
 			let e = this._readBytes(4);
 			return new DataView(e.buffer, e.byteOffset, 4).getUint32(0, !1);
 		}
-		if (e === vn) {
+		if (e === _n) {
 			let e = this._readBytes(8);
 			return Number(new DataView(e.buffer, e.byteOffset, 8).getBigUint64(0, !1));
 		}
@@ -2126,16 +2120,16 @@ var N = new TextEncoder(), on = new TextDecoder(), P = 0, sn = 1, cn = 2, F = 3,
 		return this.offset += e, t;
 	}
 };
-function Sn(e) {
-	return new bn().encode(e);
+function xn(e) {
+	return new yn().encode(e);
 }
-function Cn(e) {
-	return new xn().decode(e);
+function Sn(e) {
+	return new bn().decode(e);
 }
 //#endregion
 //#region src/envelopeCbor.ts
-var wn = "application/7h3-cbor";
-function Tn(e) {
+var Cn = "application/7h3-cbor";
+function wn(e) {
 	let t = /* @__PURE__ */ new Map();
 	t.set(1, e.header.version), t.set(2, e.header.messageId), t.set(3, e.header.timestampMs), t.set(4, e.header.ttlMs), t.set(5, e.header.sender), e.header.recipient !== void 0 && t.set(6, e.header.recipient), t.set(7, e.header.nonce);
 	let n = /* @__PURE__ */ new Map();
@@ -2147,10 +2141,10 @@ function Tn(e) {
 		let e = /* @__PURE__ */ new Map();
 		e.set(1, i.alg), e.set(2, i.keyId), e.set(3, i.value), r.set(3, e);
 	}
-	return Sn(r);
+	return xn(r);
 }
-function En(e) {
-	let t = Cn(e);
+function Tn(e) {
+	let t = Sn(e);
 	if (!t || typeof t != "object" || Array.isArray(t)) throw Error("decodeEnvelopeCbor: expected a map at top level");
 	let n = t, r = n[1];
 	if (!r || typeof r != "object" || Array.isArray(r)) throw Error("decodeEnvelopeCbor: missing header map (key 1)");
@@ -2185,11 +2179,11 @@ function En(e) {
 }
 //#endregion
 //#region src/httpBinding.ts
-var Dn = "x-7h3-envelope";
-async function On(e, t, n) {
+var En = "x-7h3-envelope";
+async function Dn(e, t, n) {
 	let r = t.headerName ?? "x-7h3-envelope", i = (Array.isArray(e["content-type"]) ? e["content-type"][0] : e["content-type"]) ?? "", a;
 	if (i.includes("7h3-cbor") && n instanceof Uint8Array) try {
-		a = En(n);
+		a = Tn(n);
 	} catch (e) {
 		return {
 			ok: !1,
@@ -2219,7 +2213,7 @@ async function On(e, t, n) {
 		detail: "missing required fields"
 	};
 	if (t.strictTtl ?? !0) {
-		let e = w(a).filter((e) => e.level === "error");
+		let e = T(a).filter((e) => e.level === "error");
 		if (e.length > 0) return {
 			ok: !1,
 			reason: "ttl-expired",
@@ -2234,18 +2228,18 @@ async function On(e, t, n) {
 			reason: "unknown-sender",
 			detail: o
 		};
-		if (!await C(a, e)) return {
+		if (!await w(a, e)) return {
 			ok: !1,
 			reason: "invalid-signature"
 		};
 	} else if (s === "HS256") {
-		let e = await t.keyRegistry.getSharedSecret?.(a.signature.keyId);
+		let e = await t.keyRegistry.getSharedSecret?.(a.signature.keyId, o);
 		if (!e) return {
 			ok: !1,
 			reason: "unknown-sender",
 			detail: a.signature.keyId
 		};
-		if (!await he(a, e)) return {
+		if (!await S(a, e)) return {
 			ok: !1,
 			reason: "invalid-signature"
 		};
@@ -2259,24 +2253,24 @@ async function On(e, t, n) {
 		envelope: a
 	};
 }
-async function kn(e, t, n) {
-	let r = await S(e, t);
+async function On(e, t, n) {
+	let r = await C(e, t);
 	if (n?.format === "cbor") {
-		let e = Tn(r);
+		let e = wn(r);
 		return {
-			headers: { "content-type": wn },
+			headers: { "content-type": Cn },
 			body: e
 		};
 	}
 	return { headers: { [n?.headerName ?? "x-7h3-envelope"]: JSON.stringify(r) } };
 }
-async function An(e, t, n, r) {
-	let i = await x(e, t, n);
+async function kn(e, t, n, r) {
+	let i = await me(e, t, n);
 	return { headers: { [r?.headerName ?? "x-7h3-envelope"]: JSON.stringify(i) } };
 }
-function jn(e) {
+function An(e) {
 	return async function(t, n, r) {
-		let i = await On(t.headers, e);
+		let i = await Dn(t.headers, e);
 		if (!i.ok) {
 			n.status(401).json({
 				error: "7h3: request verification failed",
@@ -2288,13 +2282,13 @@ function jn(e) {
 		t["7h3Envelope"] = i.envelope, r();
 	};
 }
-async function Mn(e, t, n, r) {
-	let { headers: i } = await kn(t, n, r), a = new Headers(e.headers);
+async function jn(e, t, n, r) {
+	let { headers: i } = await On(t, n, r), a = new Headers(e.headers);
 	for (let [e, t] of Object.entries(i)) a.set(e, t);
 	return new Request(e, { headers: a });
 }
-async function Nn(e, t) {
-	return Mn(e, T({
+async function Mn(e, t) {
+	return jn(e, E({
 		sender: t.sender,
 		recipient: t.recipient,
 		ttlMs: t.ttlMs ?? 6e4,
@@ -2304,39 +2298,39 @@ async function Nn(e, t) {
 }
 //#endregion
 //#region src/webhookBinding.ts
-var I = "x-7h3-sig", L = "x-7h3-ts", Pn = 3e5;
-function R(e, t) {
+var L = "x-7h3-sig", R = "x-7h3-ts", Nn = 3e5;
+function Pn(e, t) {
 	return `${e}.${t}`;
 }
 async function Fn(e, t) {
-	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await y(R(r, n), t.privateKey);
+	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await b(Pn(r, n), t.privateKey);
 	return {
-		[I]: i,
-		[L]: String(r)
+		[L]: i,
+		[R]: String(r)
 	};
 }
 async function In(e, t) {
-	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await fe(R(r, n), t.secret);
+	let n = typeof e == "string" ? e : new TextDecoder().decode(e), r = Date.now(), i = await de(Pn(r, n), t.secret);
 	return {
-		[I]: i,
-		[L]: String(r)
+		[L]: i,
+		[R]: String(r)
 	};
 }
 async function Ln(e, t, n) {
-	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[I], a = t[L];
+	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[L], a = t[R];
 	if (!i || !a) return !1;
 	let o = Number(a);
 	if (!Number.isFinite(o)) return !1;
 	let s = n.maxAgeMs ?? 3e5;
-	return Date.now() - o > s ? !1 : b(R(o, r), i, n.publicKey);
+	return Date.now() - o > s ? !1 : x(Pn(o, r), i, n.publicKey);
 }
 async function Rn(e, t, n) {
-	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[I], a = t[L];
+	let r = typeof e == "string" ? e : new TextDecoder().decode(e), i = t[L], a = t[R];
 	if (!i || !a) return !1;
 	let o = Number(a);
 	if (!Number.isFinite(o)) return !1;
 	let s = n.maxAgeMs ?? 3e5;
-	return Date.now() - o > s ? !1 : pe(R(o, r), i, n.secret);
+	return Date.now() - o > s ? !1 : fe(Pn(o, r), i, n.secret);
 }
 async function zn(e, t, n) {
 	if (!await Ln(e, t, n)) throw Error("7h3: webhook signature verification failed");
@@ -2346,7 +2340,7 @@ async function zn(e, t, n) {
 //#region src/queueBinding.ts
 async function Bn(e, t) {
 	let n = t.ttlMs ?? 36e5, r = typeof e == "string" ? e : JSON.stringify(e), i = {
-		envelope: await S(T({
+		envelope: await C(E({
 			sender: t.sender,
 			recipient: t.recipient,
 			intent: "TASK",
@@ -2365,7 +2359,16 @@ async function Vn(e, t) {
 		throw Error("Queue message is not valid JSON");
 	}
 	if (!n.envelope || typeof n.envelope != "object") throw Error("Queue message missing envelope");
-	if (!await C(n.envelope, t.publicKey)) throw Error("Queue message signature verification failed");
+	let r = t.nowMs ?? Date.now();
+	if (t.strictTtl ?? !0) {
+		let e = T(n.envelope, r).filter((e) => e.level === "error");
+		if (e.length > 0) throw Error(`Queue message failed validation: ${e.map((e) => e.message).join("; ")}`);
+	}
+	if (!await w(n.envelope, t.publicKey)) throw Error("Queue message signature verification failed");
+	if (t.replayCache) {
+		let e = await t.replayCache.consume(n.envelope, r);
+		if (!e.ok) throw Error(e.reason ?? "Queue message replay detected");
+	}
 	return {
 		payload: n.payload,
 		envelope: n.envelope
@@ -2414,7 +2417,7 @@ function U(e) {
 	return e.buffer.slice(e.byteOffset, e.byteOffset + e.byteLength);
 }
 function Gn() {
-	let e = new Uint8Array(16);
+	let e = /* @__PURE__ */ new Uint8Array(16);
 	return crypto.getRandomValues(e), V(e);
 }
 var W = /* @__PURE__ */ new Map(), Kn = 128;
@@ -2657,11 +2660,11 @@ function sr(e, t) {
 			a(/* @__PURE__ */ Error(`unknown sender: ${o}`), n);
 			return;
 		}
-		if (!await C(i, s).catch(() => !1)) {
+		if (!await w(i, s).catch(() => !1)) {
 			a(/* @__PURE__ */ Error("invalid signature"), n);
 			return;
 		}
-		let c = w(i);
+		let c = T(i);
 		if (c.some((e) => e.level === "error")) {
 			a(/* @__PURE__ */ Error(`envelope invalid: ${c.map((e) => e.message).join("; ")}`), n);
 			return;
@@ -2679,7 +2682,7 @@ function sr(e, t) {
 			return n;
 		},
 		async send(r) {
-			let i = typeof r == "string" ? r : JSON.stringify(r), a = await S(T({
+			let i = typeof r == "string" ? r : JSON.stringify(r), a = await C(E({
 				sender: t.sender,
 				recipient: t.recipient,
 				ttlMs: t.ttlMs ?? 3e4,
@@ -2735,7 +2738,7 @@ function lr(e, t) {
 //#region src/grpcBinding.ts
 var ur = "7h3-envelope-bin";
 async function dr(e) {
-	let t = await S(T({
+	let t = await C(E({
 		sender: e.sender,
 		recipient: e.recipient,
 		ttlMs: e.ttlMs ?? 6e4,
@@ -2761,7 +2764,7 @@ async function fr(e, t) {
 			message: "7h3: malformed envelope metadata"
 		};
 	}
-	if (t.strictTtl !== !1 && w(i).some((e) => e.level === "error")) return {
+	if (t.strictTtl !== !1 && T(i).some((e) => e.level === "error")) return {
 		ok: !1,
 		code: 4,
 		message: "7h3: envelope expired or invalid"
@@ -2779,19 +2782,19 @@ async function fr(e, t) {
 			code: 16,
 			message: `7h3: unknown sender ${a}`
 		};
-		if (!await C(i, e)) return {
+		if (!await w(i, e)) return {
 			ok: !1,
 			code: 16,
 			message: "7h3: invalid signature"
 		};
 	} else if (o === "HS256") {
-		let e = await t.keyRegistry.getSharedSecret?.(i.signature.keyId);
+		let e = await t.keyRegistry.getSharedSecret?.(i.signature.keyId, a);
 		if (!e) return {
 			ok: !1,
 			code: 16,
 			message: "7h3: unknown key"
 		};
-		if (!await he(i, e)) return {
+		if (!await S(i, e)) return {
 			ok: !1,
 			code: 16,
 			message: "7h3: invalid signature"
@@ -2873,8 +2876,8 @@ var vr = class {
 		let e = Date.now(), t = this.getCurrentKey();
 		if (t && e - t.createdAt < this.maxAgeMs - this.overlapMs) return null;
 		t && !t.expiresAt && (t.expiresAt = e + this.overlapMs);
-		let { publicKey: n, privateKey: r } = await me(), i = {
-			id: `key-${e}-${v(4)}`,
+		let { publicKey: n, privateKey: r } = await pe(), i = {
+			id: `key-${e}-${y(4)}`,
 			publicKey: n,
 			privateKey: r,
 			createdAt: e
@@ -2973,13 +2976,13 @@ function Sr(e, t) {
 	return null;
 }
 function Cr(e, t) {
-	return !e.allowedSenders || e.allowedSenders.length === 0 ? !0 : e.allowedSenders.includes(t);
+	return !e.allowedSenders || e.allowedSenders.length === 0 || e.allowedSenders.includes(t);
 }
 //#endregion
 //#region src/signedResponse.ts
 var wr = "x-7h3-response";
 async function Tr(e, t) {
-	let n = await S(T({
+	let n = await C(E({
 		sender: t.sender,
 		recipient: t.recipient,
 		intent: "RESULT",
@@ -3009,7 +3012,7 @@ async function Er(e, t, n) {
 		ok: !1,
 		reason: "ttl-expired",
 		envelope: a
-	} : await C(a, n.publicKey) ? a.body.content === e ? {
+	} : await w(a, n.publicKey) ? a.body.content === e ? {
 		ok: !0,
 		envelope: a
 	} : {
@@ -3172,7 +3175,7 @@ function Q(e) {
 	return t.push(`"scopes":${n}`), t.push(`"subject":${JSON.stringify(e.subject)}`), t.push(`"version":${JSON.stringify(e.version)}`), `{${t.join(",")}}`;
 }
 async function Pr(e) {
-	let t = Date.now(), n = `cap-${t}-${v(6)}`, r = e.keyId ?? `${e.issuerId}-key`, i = e.maxDelegations ?? 0, a = {
+	let t = Date.now(), n = `cap-${t}-${y(6)}`, r = e.keyId ?? `${e.issuerId}-key`, i = e.maxDelegations ?? 0, a = {
 		id: n,
 		version: "7h3-cap/1",
 		issuer: e.issuerId,
@@ -3183,7 +3186,7 @@ async function Pr(e) {
 		delegationDepth: 0,
 		maxDelegations: i,
 		keyId: r
-	}, o = await y(Q(a), e.issuerPrivateKey);
+	}, o = await b(Q(a), e.issuerPrivateKey);
 	return {
 		...a,
 		signature: o
@@ -3211,7 +3214,7 @@ async function Lr(e) {
 	if (!Ir(a, t.scopes)) throw Error("Delegated scopes exceed parent token scopes");
 	let o = t.expiresAt - i;
 	if (e.ttlMs > o) throw Error(`Delegated ttlMs (${e.ttlMs}) exceeds parent token remaining TTL (${o})`);
-	let s = `cap-${i}-${v(6)}`, c = e.keyId ?? `${n}-key`, l = t.maxDelegations === void 0 ? void 0 : t.maxDelegations - 1, u = {
+	let s = `cap-${i}-${y(6)}`, c = e.keyId ?? `${n}-key`, l = t.maxDelegations === void 0 ? void 0 : t.maxDelegations - 1, u = {
 		id: s,
 		version: "7h3-cap/1",
 		issuer: n,
@@ -3223,7 +3226,7 @@ async function Lr(e) {
 		parentTokenId: t.id,
 		maxDelegations: l,
 		keyId: c
-	}, d = await y(Q(u), e.delegatorPrivateKey);
+	}, d = await b(Q(u), e.delegatorPrivateKey);
 	return {
 		...u,
 		signature: d
@@ -3232,7 +3235,7 @@ async function Lr(e) {
 async function Rr(e, t, n) {
 	if ((n?.now ?? Date.now()) >= e.expiresAt) return !1;
 	let { signature: r, ...i } = e;
-	return b(Q(i), r, t);
+	return x(Q(i), r, t);
 }
 async function zr(e, t, n) {
 	if (e.length === 0) return {
@@ -3271,7 +3274,7 @@ async function zr(e, t, n) {
 			reason: `no-public-key-for-issuer:${i.issuer}`
 		};
 		let { signature: o, ...s } = i;
-		if (!await b(Q(s), o, a)) return {
+		if (!await x(Q(s), o, a)) return {
 			ok: !1,
 			reason: `invalid-signature-at-index:${n}`
 		};
@@ -3302,7 +3305,7 @@ var Ur = class {
 	config;
 	rateLimiter;
 	constructor(e) {
-		this.config = e, this.rateLimiter = new br();
+		this.config = e, this.rateLimiter = new br(), !e.replayStore && (e.policies ?? []).some((e) => e.require !== "none") && console.warn("[7h3-protocol] createGateway(): no replayStore configured with signature-requiring policies. Nonce/replay protection will not survive multiple gateway instances or restarts. See docs/GATEWAY.md#production-safety.");
 	}
 	async verify(e) {
 		let t = performance.now(), n = Sr(this.config.policies ?? [], e.path);
@@ -3373,7 +3376,7 @@ var Ur = class {
 				reason: "no-matching-policy"
 			};
 		}
-		let r = await On(e.headers, {
+		let r = await Dn(e.headers, {
 			keyRegistry: this.config.keyRegistry,
 			headerName: this.config.headerName
 		});
@@ -3425,7 +3428,7 @@ var Ur = class {
 				reason: "sender-denied"
 			};
 		}
-		if (n?.rateLimit && !this.rateLimiter.consume(a, n.rateLimit).allowed) {
+		if (n?.rateLimit && !(this.config.rateLimitStore ? await this.config.rateLimitStore.consume(a, n.rateLimit) : this.rateLimiter.consume(a, n.rateLimit)).allowed) {
 			let n = performance.now() - t;
 			return Z.verifications_total.increment({
 				result: "fail",
@@ -3487,9 +3490,14 @@ var Ur = class {
 function Wr(e) {
 	return new Ur(e);
 }
+function Gr(e) {
+	if (e.defaultPolicy !== "deny") throw Error("createProductionGateway(): defaultPolicy must be explicitly 'deny'. Unmatched routes must never be forwarded unverified in production.");
+	if (!e.replayStore) throw Error("createProductionGateway(): replayStore is required. Use a shared store (Redis/KV/Durable Object) so nonce replay protection survives multiple instances and restarts.");
+	return new Ur(e);
+}
 //#endregion
 //#region src/auditLog.ts
-function Gr(e) {
+function Kr(e) {
 	let t = [
 		`"id":${JSON.stringify(e.id)}`,
 		`"timestampMs":${e.timestampMs}`,
@@ -3497,7 +3505,7 @@ function Gr(e) {
 	];
 	return e.sender !== void 0 && t.push(`"sender":${JSON.stringify(e.sender)}`), e.path !== void 0 && t.push(`"path":${JSON.stringify(e.path)}`), e.method !== void 0 && t.push(`"method":${JSON.stringify(e.method)}`), e.envelopeId !== void 0 && t.push(`"envelopeId":${JSON.stringify(e.envelopeId)}`), e.failReason !== void 0 && t.push(`"failReason":${JSON.stringify(e.failReason)}`), e.upstream !== void 0 && t.push(`"upstream":${JSON.stringify(e.upstream)}`), e.responseStatus !== void 0 && t.push(`"responseStatus":${e.responseStatus}`), `{${t.join(",")}}`;
 }
-var Kr = class {
+var qr = class {
 	entries = [];
 	privateKey;
 	maxEntries;
@@ -3506,10 +3514,10 @@ var Kr = class {
 	}
 	async log(e) {
 		let t = {
-			id: `audit-${Date.now()}-${v(5)}`,
+			id: `audit-${Date.now()}-${y(5)}`,
 			timestampMs: Date.now(),
 			...e
-		}, n = await y(Gr(t), this.privateKey), r = {
+		}, n = await b(Kr(t), this.privateKey), r = {
 			...t,
 			entrySignature: n
 		};
@@ -3520,7 +3528,7 @@ var Kr = class {
 		return e?.type !== void 0 && (t = t.filter((t) => t.type === e.type)), e?.sender !== void 0 && (t = t.filter((t) => t.sender === e.sender)), e?.since !== void 0 && (t = t.filter((t) => t.timestampMs >= e.since)), e?.limit !== void 0 && (t = t.slice(-e.limit)), t;
 	}
 	async verify(e, t) {
-		return b(Gr({
+		return x(Kr({
 			id: e.id,
 			timestampMs: e.timestampMs,
 			type: e.type,
@@ -3536,7 +3544,7 @@ var Kr = class {
 	size() {
 		return this.entries.length;
 	}
-}, qr = class {
+}, Jr = class {
 	async log(e) {}
 	async query(e) {
 		return [];
@@ -3548,25 +3556,25 @@ var Kr = class {
 		return 0;
 	}
 };
-function Jr(e, t) {
-	return new Kr(e, t?.maxEntries);
+function Yr(e, t) {
+	return new qr(e, t?.maxEntries);
 }
 //#endregion
 //#region src/otel.ts
-var Yr = null;
-function Xr(e) {
-	Yr = e;
+var Xr = null;
+function Zr(e) {
+	Xr = e;
 }
-function Zr() {
-	if (Yr === null) return null;
+function Qr() {
+	if (Xr === null) return null;
 	try {
-		return Yr.getTracer("7h3/protocol");
+		return Xr.getTracer("7h3/protocol");
 	} catch {
 		return null;
 	}
 }
-async function Qr(e, t) {
-	let n = Zr();
+async function $r(e, t) {
+	let n = Qr();
 	if (n === null) return e(null);
 	let r = n.startSpan("7h3.verify", t);
 	try {
@@ -3577,8 +3585,8 @@ async function Qr(e, t) {
 		r.end();
 	}
 }
-async function $r(e) {
-	let t = Zr();
+async function ei(e) {
+	let t = Qr();
 	if (t === null) return e(null);
 	let n = t.startSpan("7h3.audit.write");
 	try {
@@ -3591,64 +3599,64 @@ async function $r(e) {
 }
 //#endregion
 //#region src/encryption.ts
-function ei(e) {
+function ti(e) {
 	return Buffer.from(e).toString("base64url");
 }
 function $(e) {
 	return Buffer.from(e, "base64url");
 }
-var ti = Buffer.from("302e020100300506032b656e04220420", "hex"), ni = Buffer.from("302a300506032b656e032100", "hex");
-function ri(e) {
+var ni = Buffer.from("302e020100300506032b656e04220420", "hex"), ri = Buffer.from("302a300506032b656e032100", "hex");
+function ii(e) {
 	let t = $(e);
-	return (0, M.createPrivateKey)({
-		key: Buffer.concat([ti, t]),
+	return r({
+		key: Buffer.concat([ni, t]),
 		format: "der",
 		type: "pkcs8"
 	});
 }
-function ii(e) {
+function ai(e) {
 	let t = $(e);
-	return (0, M.createPublicKey)({
-		key: Buffer.concat([ni, t]),
+	return i({
+		key: Buffer.concat([ri, t]),
 		format: "der",
 		type: "spki"
 	});
 }
-function ai() {
-	let { privateKey: e, publicKey: t } = (0, M.generateKeyPairSync)("x25519"), n = e.export({ format: "jwk" });
+function oi() {
+	let { privateKey: e, publicKey: t } = o("x25519"), n = e.export({ format: "jwk" });
 	return {
 		publicKey: t.export({ format: "jwk" }).x,
 		privateKey: n.d
 	};
 }
-function oi(e, t, n) {
-	let r = (0, M.hkdfSync)("sha256", (0, M.diffieHellman)({
-		privateKey: ri(e),
-		publicKey: ii(t)
+function si(e, t, n) {
+	let r = s("sha256", a({
+		privateKey: ii(e),
+		publicKey: ai(t)
 	}), $(n), Buffer.from("7h3-enc/1", "utf8"), 32);
 	return Buffer.from(r);
 }
-function si(e, t) {
-	let n = ai(), r = (0, M.randomBytes)(12), i = ei(r), a = oi(n.privateKey, t, i), o = Buffer.from(JSON.stringify(e), "utf8"), s = (0, M.createCipheriv)("chacha20-poly1305", a, r, { authTagLength: 16 }), c = Buffer.concat([s.update(o), s.final()]), l = s.getAuthTag(), u = {
-		ephemeralPublic: n.publicKey,
-		nonce: i,
-		ciphertext: ei(c),
-		tag: ei(l)
+function ci(e, n) {
+	let r = oi(), i = c(12), a = ti(i), o = si(r.privateKey, n, a), s = Buffer.from(JSON.stringify(e), "utf8"), l = t("chacha20-poly1305", o, i, { authTagLength: 16 }), u = Buffer.concat([l.update(s), l.final()]), d = l.getAuthTag(), f = {
+		ephemeralPublic: r.publicKey,
+		nonce: a,
+		ciphertext: ti(u),
+		tag: ti(d)
 	};
 	return {
-		encryptedContent: ei(Buffer.from(JSON.stringify(u), "utf8")),
-		ephemeralPublic: n.publicKey
+		encryptedContent: ti(Buffer.from(JSON.stringify(f), "utf8")),
+		ephemeralPublic: r.publicKey
 	};
 }
-function ci(e, t) {
-	let n = $(e).toString("utf8"), { ephemeralPublic: r, nonce: i, ciphertext: a, tag: o } = JSON.parse(n), s = oi(t, r, i), c = $(i), l = $(a), u = $(o), d = (0, M.createDecipheriv)("chacha20-poly1305", s, c, { authTagLength: 16 });
-	d.setAuthTag(u);
-	let f = Buffer.concat([d.update(l), d.final()]);
-	return JSON.parse(f.toString("utf8"));
+function li(e, t) {
+	let r = $(e).toString("utf8"), { ephemeralPublic: i, nonce: a, ciphertext: o, tag: s } = JSON.parse(r), c = si(t, i, a), l = $(a), u = $(o), d = $(s), f = n("chacha20-poly1305", c, l, { authTagLength: 16 });
+	f.setAuthTag(d);
+	let p = Buffer.concat([f.update(u), f.final()]);
+	return JSON.parse(p.toString("utf8"));
 }
-async function li(e, t) {
-	let { encryptedContent: n } = si(e.body, t.recipientX25519PublicKey);
-	return S({
+async function ui(e, t) {
+	let { encryptedContent: n } = ci(e.body, t.recipientX25519PublicKey);
+	return C({
 		header: e.header,
 		body: {
 			intent: "ENCRYPTED",
@@ -3658,12 +3666,12 @@ async function li(e, t) {
 		}
 	}, t.senderEd25519PrivateKey);
 }
-async function ui(e, t) {
-	if (!await C(e, t.senderEd25519PublicKey)) throw Error("7h3/encryption: Ed25519 signature verification failed");
+async function di(e, t) {
+	if (!await w(e, t.senderEd25519PublicKey)) throw Error("7h3/encryption: Ed25519 signature verification failed");
 	return {
 		envelope: e,
-		body: ci(e.body.content, t.recipientX25519PrivateKey)
+		body: li(e.body.content, t.recipientX25519PrivateKey)
 	};
 }
 //#endregion
-export { ot as AgentSession, st as AipAgentAdapter, Mr as CAP_HEADER, wn as CBOR_CONTENT_TYPE, xn as CborDecoder, bn as CborEncoder, zt as ClusterRedisReplayStore, Dn as DEFAULT_HEADER, xe as DEFAULT_MAX_BINARY_ENVELOPE_BYTES, Re as DistributedReplayCache, ur as GRPC_METADATA_KEY, Kr as InMemoryAuditLog, Lt as InMemoryRedisLikeClient, O as InMemoryReplayCache, Wt as InMemoryRevocationStore, ze as InMemoryVerificationMaterialCache, vr as KeyRotationManager, qr as NoopAuditLog, Ur as Protocol7h3Gateway, kr as Protocol7h3Metrics, wr as RESPONSE_HEADER, Rt as RedisReplayStore, yr as RevocationRegistry, it as RollingKeyring, Nt as RuntimePolicyManager, Un as STREAM_HEADER, Xe as SessionTransport, er as SignedStreamReader, q as SignedStreamWriter, X as SimpleCounter, Or as SimpleHistogram, br as SlidingWindowRateLimiter, Pn as WEBHOOK_DEFAULT_TTL_MS, I as WEBHOOK_SIG_HEADER, L as WEBHOOK_TS_HEADER, Tt as bootstrapRuntimePolicyEnforcer, Q as canonicalizeCapabilityToken, g as canonicalizeEnvelope, zn as consumeWebhook, ct as createAipAgentAdapter, et as createAipCapabilities, jt as createAipMcpGatewayRuntime, Mt as createAipMcpGatewayRuntimeWithPolicy, Jr as createAuditLog, an as createCachingKeyRegistry, Ht as createClusterReplayStore, rn as createCompositeKeyRegistry, T as createEnvelope, Wr as createGateway, _r as createHttpKeyRegistry, tn as createHttpMcpClient, en as createHttpMcpHandler, jn as createHttpMiddleware, at as createKeyringSignatureResolver, Yt as createMcpClientCodec, jr as createMetricsMiddleware, wt as createPolicyEnforcer, mt as createRawTaskFromJsonRpc, lt as createRawTaskFromLangChain, dt as createRawTaskFromLlamaIndex, Bt as createRedisReplayStore, Gt as createRedisRevocationStore, Nn as createSignedFetchRequest, Ze as createSignedMessage, tr as createSignedStream, cr as createSignedWebSocketStream, nn as createStaticKeyRegistry, $t as createStdioMcpClient, nr as createStreamVerifier, Cn as decodeCbor, Ge as decodeEnvelope, Je as decodeEnvelopeBatch, Ie as decodeEnvelopeBinary, En as decodeEnvelopeCbor, or as decodeStreamChunk, ci as decryptBody, Lr as delegateCapabilityToken, oi as deriveEncryptionKey, tt as encodeAipCapabilities, Sn as encodeCbor, Ke as encodeEnvelope, qe as encodeEnvelopeBatch, Fe as encodeEnvelopeBinary, Tn as encodeEnvelopeCbor, ar as encodeStreamChunk, si as encryptBody, gr as fetchWellKnownKeys, me as generateEd25519KeypairBase64Url, ai as generateX25519KeyPair, Zr as getOtelTracer, Ft as getRuntimeTuningPreset, xr as globalRateLimiter, Cr as isAllowedSender, Et as isRuntimeMode, Pr as issueCapabilityToken, xt as loadRuntimePolicy, J as matchGlob, Sr as matchPolicy, Z as metrics, rt as negotiateAipCapabilities, ui as openEnvelope, nt as parseAipCapabilities, Hr as parseCapabilityChain, yt as parseRuntimePolicyJson, hr as parseWellKnownKeys, v as randomHex, k as receiveEnvelope, Ye as receiveEnvelopeBatch, lr as receiveSignedWebSocketStream, It as recommendPolicyAdjustments, Ar as renderPrometheusText, li as sealEnvelope, Vr as serializeCapabilityChain, Qt as serveMcpOverStdio, mr as serveWellKnownKeys, Xr as setOtelProvider, y as signCanonicalPayloadEd25519, fe as signCanonicalPayloadHmac, S as signEnvelopeEd25519, x as signEnvelopeHmac, Mn as signFetchRequest, dr as signGrpcCall, kn as signHttpRequest, An as signHttpRequestHmac, Bn as signQueueMessage, Tr as signResponse, rr as signStream, Fn as signWebhook, In as signWebhookHmac, ht as toJsonRpcResponse, ut as toLangChainMessage, ft as toLlamaIndexMessage, Br as tokenMatchesScope, w as validateEnvelope, vt as validateRuntimePolicy, b as verifyCanonicalPayloadEd25519, pe as verifyCanonicalPayloadHmac, _e as verifyCanonicalPayloadSignature, zr as verifyCapabilityChain, Rr as verifyCapabilityToken, C as verifyEnvelopeEd25519, he as verifyEnvelopeHmac, ge as verifyEnvelopeSignature, fr as verifyGrpcCall, On as verifyHttpEnvelope, Hn as verifyQueueBatch, Vn as verifyQueueMessage, Er as verifyResponse, ir as verifyStream, Ln as verifyWebhook, Rn as verifyWebhookHmac, $r as withAuditSpan, pr as withGrpcVerification, Kt as withRevocationCheck, Qr as withVerificationSpan, Xt as wrapMcpClient, Jt as wrapMcpServer, sr as wrapWebSocket };
+export { ot as AgentSession, st as AipAgentAdapter, Mr as CAP_HEADER, Cn as CBOR_CONTENT_TYPE, bn as CborDecoder, yn as CborEncoder, Rt as ClusterRedisReplayStore, En as DEFAULT_HEADER, xe as DEFAULT_MAX_BINARY_ENVELOPE_BYTES, Re as DistributedReplayCache, ur as GRPC_METADATA_KEY, qr as InMemoryAuditLog, It as InMemoryRedisLikeClient, k as InMemoryReplayCache, Ut as InMemoryRevocationStore, ze as InMemoryVerificationMaterialCache, vr as KeyRotationManager, _e as MAX_TTL_MS, Jr as NoopAuditLog, Ur as Protocol7h3Gateway, kr as Protocol7h3Metrics, wr as RESPONSE_HEADER, Lt as RedisReplayStore, yr as RevocationRegistry, it as RollingKeyring, Mt as RuntimePolicyManager, Un as STREAM_HEADER, Xe as SessionTransport, er as SignedStreamReader, q as SignedStreamWriter, X as SimpleCounter, Or as SimpleHistogram, br as SlidingWindowRateLimiter, Nn as WEBHOOK_DEFAULT_TTL_MS, L as WEBHOOK_SIG_HEADER, R as WEBHOOK_TS_HEADER, j as bootstrapRuntimePolicyEnforcer, Q as canonicalizeCapabilityToken, _ as canonicalizeEnvelope, zn as consumeWebhook, ct as createAipAgentAdapter, et as createAipCapabilities, At as createAipMcpGatewayRuntime, jt as createAipMcpGatewayRuntimeWithPolicy, Yr as createAuditLog, rn as createCachingKeyRegistry, Vt as createClusterReplayStore, nn as createCompositeKeyRegistry, E as createEnvelope, Wr as createGateway, _r as createHttpKeyRegistry, en as createHttpMcpClient, $t as createHttpMcpHandler, An as createHttpMiddleware, at as createKeyringSignatureResolver, Jt as createMcpClientCodec, jr as createMetricsMiddleware, wt as createPolicyEnforcer, Gr as createProductionGateway, mt as createRawTaskFromJsonRpc, lt as createRawTaskFromLangChain, dt as createRawTaskFromLlamaIndex, zt as createRedisReplayStore, Wt as createRedisRevocationStore, Mn as createSignedFetchRequest, Ze as createSignedMessage, tr as createSignedStream, cr as createSignedWebSocketStream, tn as createStaticKeyRegistry, Qt as createStdioMcpClient, nr as createStreamVerifier, Sn as decodeCbor, Ge as decodeEnvelope, Je as decodeEnvelopeBatch, Ie as decodeEnvelopeBinary, Tn as decodeEnvelopeCbor, or as decodeStreamChunk, li as decryptBody, Lr as delegateCapabilityToken, si as deriveEncryptionKey, tt as encodeAipCapabilities, xn as encodeCbor, Ke as encodeEnvelope, qe as encodeEnvelopeBatch, Fe as encodeEnvelopeBinary, wn as encodeEnvelopeCbor, ar as encodeStreamChunk, ci as encryptBody, gr as fetchWellKnownKeys, pe as generateEd25519KeypairBase64Url, oi as generateX25519KeyPair, Qr as getOtelTracer, Pt as getRuntimeTuningPreset, xr as globalRateLimiter, Cr as isAllowedSender, Tt as isRuntimeMode, Pr as issueCapabilityToken, xt as loadRuntimePolicy, J as matchGlob, Sr as matchPolicy, Z as metrics, rt as negotiateAipCapabilities, di as openEnvelope, nt as parseAipCapabilities, Hr as parseCapabilityChain, yt as parseRuntimePolicyJson, hr as parseWellKnownKeys, y as randomHex, A as receiveEnvelope, Ye as receiveEnvelopeBatch, lr as receiveSignedWebSocketStream, Ft as recommendPolicyAdjustments, Ar as renderPrometheusText, ui as sealEnvelope, Vr as serializeCapabilityChain, Zt as serveMcpOverStdio, mr as serveWellKnownKeys, Zr as setOtelProvider, b as signCanonicalPayloadEd25519, de as signCanonicalPayloadHmac, C as signEnvelopeEd25519, me as signEnvelopeHmac, jn as signFetchRequest, dr as signGrpcCall, On as signHttpRequest, kn as signHttpRequestHmac, Bn as signQueueMessage, Tr as signResponse, rr as signStream, Fn as signWebhook, In as signWebhookHmac, ht as toJsonRpcResponse, ut as toLangChainMessage, ft as toLlamaIndexMessage, Br as tokenMatchesScope, T as validateEnvelope, vt as validateRuntimePolicy, x as verifyCanonicalPayloadEd25519, fe as verifyCanonicalPayloadHmac, ge as verifyCanonicalPayloadSignature, zr as verifyCapabilityChain, Rr as verifyCapabilityToken, w as verifyEnvelopeEd25519, S as verifyEnvelopeHmac, he as verifyEnvelopeSignature, fr as verifyGrpcCall, Dn as verifyHttpEnvelope, Hn as verifyQueueBatch, Vn as verifyQueueMessage, Er as verifyResponse, ir as verifyStream, Ln as verifyWebhook, Rn as verifyWebhookHmac, ei as withAuditSpan, pr as withGrpcVerification, Gt as withRevocationCheck, $r as withVerificationSpan, Yt as wrapMcpClient, qt as wrapMcpServer, sr as wrapWebSocket };