@agentplat/mesh-crypto 0.3.0-alpha.1

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,41 @@
+# `@agentplat/mesh-crypto`
+
+Provider-neutral Web Crypto contracts for hashing, signing and verifying
+AgentPlat Mesh envelopes.
+
+The Alpha 1 implementation provides:
+
+- canonical SHA-256 payload digests;
+- Ed25519 signing and verification through Web Crypto;
+- stable fail-closed signing and verification errors;
+- exact tenant, mesh, peer, key and algorithm binding;
+- inclusive `validFrom`, exclusive `validUntil` and explicit revocation checks;
+- a fixed, bounded `StaticMeshKeyResolver`; and
+- public verification fixtures under `fixtures/v0`.
+
+Use `signMeshEnvelope` for the reference outbound path and
+`verifyMeshEnvelope` for the inbound cryptographic boundary. Injectable class
+implementations are available through `createWebCryptoMeshEnvelopeSigner` and
+`createWebCryptoMeshEnvelopeVerifier`.
+
+Key resolution is synchronous by design so ordinary inbound verification cannot
+trigger network access. `StaticMeshKeyResolver` rejects duplicate bindings and
+configurations above its explicit record limit.
+
+`verifiedAt` is trusted local time supplied by the caller; key validity and
+revocation never depend on the sender-controlled envelope timestamp. Live
+verification always rejects revoked keys. A separate historical-verification
+API may be introduced later, but historical results must never re-enter live
+admission or a reducer.
+
+Public-key import and export use the provider-neutral raw 32-byte Ed25519
+representation. Private-key import and export are intentionally outside this
+package's public surface.
+
+Verification establishes payload integrity, signature validity and a live
+local key binding. It does not admit a peer, authorize a message, apply replay
+state or mutate domain state.
+
+Private keys are never protocol payloads, fixtures or telemetry. Signing tests
+generate temporary key pairs at runtime; public fixtures contain only a raw
+public key and its fixed signed envelope.

package/dist/base64url.d.ts

@@ -0,0 +1,3 @@
+export declare function encodeBase64Url(bytes: Uint8Array): string;
+export declare function decodeBase64Url(value: string, expectedBytes: number): Uint8Array | undefined;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAIA,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAiBzD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,UAAU,GAAG,SAAS,CAwBxB"}

package/dist/base64url.js

@@ -0,0 +1,50 @@
+const base64UrlPattern = /^[A-Za-z0-9_-]+$/;
+const base64UrlAlphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+export function encodeBase64Url(bytes) {
+    let encoded = '';
+    for (let offset = 0; offset < bytes.byteLength; offset += 3) {
+        const first = bytes[offset];
+        const second = bytes[offset + 1];
+        const third = bytes[offset + 2];
+        encoded += base64UrlAlphabet[first >> 2];
+        encoded += base64UrlAlphabet[((first & 0b11) << 4) | ((second ?? 0) >> 4)];
+        if (second !== undefined) {
+            encoded +=
+                base64UrlAlphabet[((second & 0b1111) << 2) | ((third ?? 0) >> 6)];
+        }
+        if (third !== undefined) {
+            encoded += base64UrlAlphabet[third & 0b111111];
+        }
+    }
+    return encoded;
+}
+export function decodeBase64Url(value, expectedBytes) {
+    if (!base64UrlPattern.test(value))
+        return undefined;
+    const remainder = value.length % 4;
+    if (remainder === 1)
+        return undefined;
+    if (Math.floor((value.length * 6) / 8) !== expectedBytes)
+        return undefined;
+    const decoded = new Uint8Array(expectedBytes);
+    let accumulator = 0;
+    let availableBits = 0;
+    let outputOffset = 0;
+    for (const character of value) {
+        const index = base64UrlAlphabet.indexOf(character);
+        if (index < 0)
+            return undefined;
+        accumulator = (accumulator << 6) | index;
+        availableBits += 6;
+        if (availableBits >= 8) {
+            availableBits -= 8;
+            decoded[outputOffset] = (accumulator >> availableBits) & 0xff;
+            outputOffset += 1;
+            accumulator &= (1 << availableBits) - 1;
+        }
+    }
+    if (outputOffset !== expectedBytes || accumulator !== 0)
+        return undefined;
+    return decoded;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../src/base64url.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,iBAAiB,GACrB,kEAAkE,CAAC;AAErE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,iBAAiB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,iBAAiB,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,iBAAiB,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,aAAqB;IAErB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,WAAW,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QACzC,aAAa,IAAI,CAAC,CAAC;QACnB,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,aAAa,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa,CAAC,GAAG,IAAI,CAAC;YAC9D,YAAY,IAAI,CAAC,CAAC;YAClB,WAAW,IAAI,CAAC,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,IAAI,YAAY,KAAK,aAAa,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/contracts.d.ts

@@ -0,0 +1,101 @@
+import type { MeshMessagePayload, MeshProtocolOptions, MeshSignatureAlgorithm, SignedMeshEnvelope, UnsignedMeshEnvelope, VerifiedMeshEnvelope } from '@agentplat/mesh-protocol';
+/** Locally configured live verification status for one public key. */
+export type MeshKeyStatus = 'active' | 'revoked';
+/**
+ * Preprovisioned identity and public-key binding.
+ *
+ * `validFrom` is inclusive and `validUntil` is exclusive.
+ */
+interface MeshKeyRecordBase {
+    readonly tenantId: string;
+    readonly meshId: string;
+    readonly peerId: string;
+    readonly keyId: string;
+    readonly algorithm: MeshSignatureAlgorithm;
+    readonly publicKey: CryptoKey;
+    readonly validFrom: string;
+    readonly validUntil: string;
+}
+/** Live key record whose validity interval has not been revoked. */
+export interface MeshActiveKeyRecord extends MeshKeyRecordBase {
+    readonly status: 'active';
+    readonly revokedAt?: never;
+}
+/** Key record explicitly removed from live verification. */
+export interface MeshRevokedKeyRecord extends MeshKeyRecordBase {
+    readonly status: 'revoked';
+    readonly revokedAt: string;
+}
+export type MeshKeyRecord = MeshActiveKeyRecord | MeshRevokedKeyRecord;
+/**
+ * Bounded local key lookup. The synchronous return type intentionally prevents
+ * network access from being hidden in the inbound verification path.
+ */
+export interface MeshKeyResolver {
+    resolve(input: {
+        tenantId: string;
+        meshId: string;
+        peerId: string;
+        keyId: string;
+        algorithm: MeshSignatureAlgorithm;
+    }): MeshKeyRecord | undefined;
+}
+/** Cryptographic suites and key states accepted by one local peer. */
+export interface MeshCryptoPolicy {
+    readonly allowedAlgorithms: readonly MeshSignatureAlgorithm[];
+}
+/** Input required to canonicalize and hash one protocol payload. */
+export interface MeshDigestRequest<TPayload extends MeshMessagePayload = MeshMessagePayload> {
+    readonly payload: TPayload;
+    readonly crypto?: Crypto;
+    readonly protocolOptions?: MeshProtocolOptions;
+}
+/** Input required to hash and sign one outbound envelope. */
+export interface MeshSignRequest<TPayload extends MeshMessagePayload = MeshMessagePayload> {
+    readonly envelope: UnsignedMeshEnvelope<TPayload>;
+    readonly privateKey: CryptoKey;
+    readonly crypto?: Crypto;
+    readonly protocolOptions?: MeshProtocolOptions;
+}
+/** Input required for bounded local signature verification. */
+export interface MeshVerifyRequest<TPayload extends MeshMessagePayload = MeshMessagePayload> {
+    readonly envelope: SignedMeshEnvelope<TPayload>;
+    readonly resolver: MeshKeyResolver;
+    readonly policy: MeshCryptoPolicy;
+    readonly verifiedAt: string;
+    readonly crypto?: Crypto;
+    readonly protocolOptions?: MeshProtocolOptions;
+}
+/** Stable fail-closed verification failures safe for redacted telemetry. */
+export type MeshCryptoRejectionCode = 'crypto_unavailable' | 'crypto_operation_failed' | 'invalid_envelope' | 'invalid_verification_time' | 'unsupported_algorithm' | 'payload_hash_mismatch' | 'key_not_found' | 'key_resolution_failed' | 'key_binding_mismatch' | 'invalid_key_record' | 'invalid_key_material' | 'key_not_yet_valid' | 'key_expired' | 'key_revoked' | 'signature_invalid';
+/** Stable signer/digest failure raised without including sensitive input. */
+export type MeshCryptoErrorCode = 'crypto_unavailable' | 'crypto_operation_failed' | 'invalid_envelope' | 'invalid_private_key' | 'invalid_public_key' | 'unsupported_algorithm';
+/** Typed operational failure for digest and signing APIs. */
+export declare class MeshCryptoError extends Error {
+    readonly code: MeshCryptoErrorCode;
+    readonly name = "MeshCryptoError";
+    constructor(code: MeshCryptoErrorCode);
+}
+/** Result returned by the reference envelope verifier. */
+export type MeshVerificationResult<TPayload extends MeshMessagePayload = MeshMessagePayload> = {
+    readonly verified: true;
+    readonly envelope: VerifiedMeshEnvelope<TPayload>;
+    readonly key: MeshKeyRecord;
+} | {
+    readonly verified: false;
+    readonly code: MeshCryptoRejectionCode;
+};
+/** Injectable signer used by production and loopback drivers. */
+export interface MeshEnvelopeSigner {
+    sign<TPayload extends MeshMessagePayload>(request: MeshSignRequest<TPayload>): Promise<SignedMeshEnvelope<TPayload>>;
+}
+/** Injectable verifier used before local admission and replay checks. */
+export interface MeshEnvelopeVerifier {
+    verify<TPayload extends MeshMessagePayload>(request: MeshVerifyRequest<TPayload>): Promise<MeshVerificationResult<TPayload>>;
+}
+/** Construction bound for the static in-memory key resolver. */
+export interface StaticMeshKeyResolverOptions {
+    readonly maximumRecords?: number;
+}
+export {};
+//# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAC;AAElC,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;CAC5B;AAED,4DAA4D;AAC5D,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,sBAAsB,CAAC;KACnC,GAAG,aAAa,GAAG,SAAS,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/D;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB,CAChC,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB;IAExD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC;CAChD;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe,CAC9B,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB;IAExD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC;CAChD;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB,CAChC,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB;IAExD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC;CAChD;AAED,4EAA4E;AAC5E,MAAM,MAAM,uBAAuB,GAC/B,oBAAoB,GACpB,yBAAyB,GACzB,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,eAAe,GACf,uBAAuB,GACvB,sBAAsB,GACtB,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,mBAAmB,CAAC;AAExB,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,yBAAyB,GACzB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,uBAAuB,CAAC;AAE5B,6DAA6D;AAC7D,qBAAa,eAAgB,SAAQ,KAAK;IAG5B,QAAQ,CAAC,IAAI,EAAE,mBAAmB;IAF9C,QAAQ,CAAC,IAAI,qBAAqB;gBAEb,IAAI,EAAE,mBAAmB;CAG/C;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,CAChC,QAAQ,SAAS,kBAAkB,GAAG,kBAAkB,IAEtD;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;CACxC,CAAC;AAEN,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,QAAQ,SAAS,kBAAkB,EACtC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,GACjC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC1C;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,QAAQ,SAAS,kBAAkB,EACxC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC9C;AAED,gEAAgE;AAChE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}

package/dist/contracts.js

@@ -0,0 +1,10 @@
+/** Typed operational failure for digest and signing APIs. */
+export class MeshCryptoError extends Error {
+    code;
+    name = 'MeshCryptoError';
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAuHA,6DAA6D;AAC7D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGnB;IAFZ,IAAI,GAAG,iBAAiB,CAAC;IAElC,YAAqB,IAAyB;QAC5C,KAAK,CAAC,IAAI,CAAC,CAAC;QADO,SAAI,GAAJ,IAAI,CAAqB;IAE9C,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './contracts.js';
+export { StaticMeshKeyResolver, createStaticMeshKeyResolver, } from './static-key-resolver.js';
+export { DEFAULT_MESH_CRYPTO_POLICY, WebCryptoMeshEnvelopeSigner, WebCryptoMeshEnvelopeVerifier, computeMeshPayloadHash, createWebCryptoMeshEnvelopeSigner, createWebCryptoMeshEnvelopeVerifier, exportMeshEd25519PublicKey, importMeshEd25519PublicKey, signMeshEnvelope, verifyMeshEnvelope, } from './web-crypto.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,EACjC,mCAAmC,EACnC,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './contracts.js';
+export { StaticMeshKeyResolver, createStaticMeshKeyResolver, } from './static-key-resolver.js';
+export { DEFAULT_MESH_CRYPTO_POLICY, WebCryptoMeshEnvelopeSigner, WebCryptoMeshEnvelopeVerifier, computeMeshPayloadHash, createWebCryptoMeshEnvelopeSigner, createWebCryptoMeshEnvelopeVerifier, exportMeshEd25519PublicKey, importMeshEd25519PublicKey, signMeshEnvelope, verifyMeshEnvelope, } from './web-crypto.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,EACjC,mCAAmC,EACnC,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC"}

package/dist/static-key-resolver.d.ts

@@ -0,0 +1,19 @@
+import { MESH_SIGNATURE_ALGORITHM } from '@agentplat/mesh-protocol';
+import type { MeshKeyRecord, MeshKeyResolver, StaticMeshKeyResolverOptions } from './contracts.js';
+/**
+ * Fixed, bounded key resolver with no callbacks, I/O or hidden network path.
+ */
+export declare class StaticMeshKeyResolver implements MeshKeyResolver {
+    private readonly records;
+    constructor(records: readonly MeshKeyRecord[], options?: StaticMeshKeyResolverOptions);
+    resolve(input: {
+        tenantId: string;
+        meshId: string;
+        peerId: string;
+        keyId: string;
+        algorithm: typeof MESH_SIGNATURE_ALGORITHM;
+    }): MeshKeyRecord | undefined;
+}
+/** Creates a fixed local resolver without requiring `new`. */
+export declare function createStaticMeshKeyResolver(records: readonly MeshKeyRecord[], options?: StaticMeshKeyResolverOptions): StaticMeshKeyResolver;
+//# sourceMappingURL=static-key-resolver.d.ts.map

package/dist/static-key-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-key-resolver.d.ts","sourceRoot":"","sources":["../src/static-key-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EAEzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,4BAA4B,EAC7B,MAAM,gBAAgB,CAAC;AAIxB;;GAEG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;gBAG1D,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,OAAO,GAAE,4BAAiC;IAyB5C,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,OAAO,wBAAwB,CAAC;KAC5C,GAAG,aAAa,GAAG,SAAS;CAW9B;AAED,8DAA8D;AAC9D,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,OAAO,GAAE,4BAAiC,GACzC,qBAAqB,CAEvB"}

package/dist/static-key-resolver.js

@@ -0,0 +1,83 @@
+import { MESH_SIGNATURE_ALGORITHM, compareMeshTimestamps, } from '@agentplat/mesh-protocol';
+const defaultMaximumRecords = 256;
+/**
+ * Fixed, bounded key resolver with no callbacks, I/O or hidden network path.
+ */
+export class StaticMeshKeyResolver {
+    records = new Map();
+    constructor(records, options = {}) {
+        const maximumRecords = options.maximumRecords ?? defaultMaximumRecords;
+        if (!Number.isSafeInteger(maximumRecords) || maximumRecords < 1) {
+            throw new RangeError('maximumRecords must be a positive safe integer');
+        }
+        if (records.length > maximumRecords) {
+            throw new RangeError('Static Mesh key record limit exceeded');
+        }
+        for (const record of records) {
+            assertConfiguredRecord(record);
+            const key = recordKey(record.tenantId, record.meshId, record.peerId, record.keyId, record.algorithm);
+            if (this.records.has(key)) {
+                throw new TypeError('Duplicate static Mesh key binding');
+            }
+            this.records.set(key, Object.freeze({ ...record }));
+        }
+    }
+    resolve(input) {
+        return this.records.get(recordKey(input.tenantId, input.meshId, input.peerId, input.keyId, input.algorithm));
+    }
+}
+/** Creates a fixed local resolver without requiring `new`. */
+export function createStaticMeshKeyResolver(records, options = {}) {
+    return new StaticMeshKeyResolver(records, options);
+}
+function assertConfiguredRecord(record) {
+    if (!record ||
+        typeof record.tenantId !== 'string' ||
+        typeof record.meshId !== 'string' ||
+        typeof record.peerId !== 'string' ||
+        typeof record.keyId !== 'string' ||
+        record.algorithm !== MESH_SIGNATURE_ALGORITHM ||
+        (record.status !== 'active' && record.status !== 'revoked') ||
+        !isEd25519Key(record.publicKey, 'public', 'verify')) {
+        throw new TypeError('Invalid static Mesh key record');
+    }
+    const validity = compareMeshTimestamps(record.validFrom, record.validUntil);
+    if (!validity.ok || validity.value >= 0) {
+        throw new TypeError('Invalid static Mesh key validity interval');
+    }
+    if (record.revokedAt !== undefined &&
+        !compareMeshTimestamps(record.revokedAt, record.revokedAt).ok) {
+        throw new TypeError('Invalid static Mesh key revocation timestamp');
+    }
+    if (record.status === 'active' && record.revokedAt !== undefined) {
+        throw new TypeError('Active static Mesh key cannot have revokedAt');
+    }
+    if (record.status === 'revoked') {
+        if (record.revokedAt === undefined) {
+            throw new TypeError('Revoked static Mesh key requires revokedAt');
+        }
+        const revokedAfterStart = compareMeshTimestamps(record.revokedAt, record.validFrom);
+        const revokedBeforeEnd = compareMeshTimestamps(record.revokedAt, record.validUntil);
+        if (!revokedAfterStart.ok ||
+            !revokedBeforeEnd.ok ||
+            revokedAfterStart.value < 0 ||
+            revokedBeforeEnd.value >= 0) {
+            throw new TypeError('Invalid static Mesh key revocation interval');
+        }
+    }
+}
+function isEd25519Key(key, type, usage) {
+    try {
+        return (!!key &&
+            key.type === type &&
+            key.algorithm?.name === MESH_SIGNATURE_ALGORITHM &&
+            Array.from(key.usages).includes(usage));
+    }
+    catch {
+        return false;
+    }
+}
+function recordKey(tenantId, meshId, peerId, keyId, algorithm) {
+    return JSON.stringify([tenantId, meshId, peerId, keyId, algorithm]);
+}
+//# sourceMappingURL=static-key-resolver.js.map

package/dist/static-key-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-key-resolver.js","sourceRoot":"","sources":["../src/static-key-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAQlC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;GAEG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE5D,YACE,OAAiC,EACjC,UAAwC,EAAE;QAE1C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,SAAS,CACnB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,SAAS,CACjB,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAMP;QACC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CACrB,SAAS,CACP,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,CAChB,CACF,CAAC;IACJ,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,2BAA2B,CACzC,OAAiC,EACjC,UAAwC,EAAE;IAE1C,OAAO,IAAI,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqB;IACnD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,MAAM,CAAC,SAAS,KAAK,wBAAwB;QAC7C,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QAC3D,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACnD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,CAAC,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAC7D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,UAAU,CAClB,CAAC;QACF,IACE,CAAC,iBAAiB,CAAC,EAAE;YACrB,CAAC,gBAAgB,CAAC,EAAE;YACpB,iBAAiB,CAAC,KAAK,GAAG,CAAC;YAC3B,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAC3B,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAc,EAAE,IAAa,EAAE,KAAe;IAClE,IAAI,CAAC;QACH,OAAO,CACL,CAAC,CAAC,GAAG;YACL,GAAG,CAAC,IAAI,KAAK,IAAI;YACjB,GAAG,CAAC,SAAS,EAAE,IAAI,KAAK,wBAAwB;YAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,MAAc,EACd,MAAc,EACd,KAAa,EACb,SAAiB;IAEjB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/web-crypto.d.ts

@@ -0,0 +1,27 @@
+import { type MeshMessagePayload, type SignedMeshEnvelope } from '@agentplat/mesh-protocol';
+import { type MeshCryptoPolicy, type MeshDigestRequest, type MeshEnvelopeSigner, type MeshEnvelopeVerifier, type MeshSignRequest, type MeshVerificationResult, type MeshVerifyRequest } from './contracts.js';
+/** Strict default policy for the reference cryptographic suite. */
+export declare const DEFAULT_MESH_CRYPTO_POLICY: Readonly<MeshCryptoPolicy>;
+/** Computes the canonical SHA-256 payload representation. */
+export declare function computeMeshPayloadHash<TPayload extends MeshMessagePayload>(request: MeshDigestRequest<TPayload>): Promise<string>;
+/** Hashes, constructs and signs one structurally valid outbound envelope. */
+export declare function signMeshEnvelope<TPayload extends MeshMessagePayload>(request: MeshSignRequest<TPayload>): Promise<SignedMeshEnvelope<TPayload>>;
+/** Verifies digest, proof, key binding, validity and revocation fail-closed. */
+export declare function verifyMeshEnvelope<TPayload extends MeshMessagePayload>(request: MeshVerifyRequest<TPayload>): Promise<MeshVerificationResult<TPayload>>;
+/** Imports one extractable raw 32-byte Ed25519 public key. */
+export declare function importMeshEd25519PublicKey(rawKey: Uint8Array, injectedCrypto?: Crypto): Promise<CryptoKey>;
+/** Exports one Ed25519 public key as an independent 32-byte raw value. */
+export declare function exportMeshEd25519PublicKey(publicKey: CryptoKey, injectedCrypto?: Crypto): Promise<Uint8Array>;
+/** Reference Web Crypto signer implementation. */
+export declare class WebCryptoMeshEnvelopeSigner implements MeshEnvelopeSigner {
+    sign<TPayload extends MeshMessagePayload>(request: MeshSignRequest<TPayload>): Promise<SignedMeshEnvelope<TPayload>>;
+}
+/** Reference Web Crypto verifier implementation. */
+export declare class WebCryptoMeshEnvelopeVerifier implements MeshEnvelopeVerifier {
+    verify<TPayload extends MeshMessagePayload>(request: MeshVerifyRequest<TPayload>): Promise<MeshVerificationResult<TPayload>>;
+}
+/** Creates the reference signer without requiring `new`. */
+export declare function createWebCryptoMeshEnvelopeSigner(): WebCryptoMeshEnvelopeSigner;
+/** Creates the reference verifier without requiring `new`. */
+export declare function createWebCryptoMeshEnvelopeVerifier(): WebCryptoMeshEnvelopeVerifier;
+//# sourceMappingURL=web-crypto.d.ts.map

package/dist/web-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-crypto.d.ts","sourceRoot":"","sources":["../src/web-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAEzB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAOxB,mEAAmE;AACnE,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,gBAAgB,CAG9D,CAAC;AAEL,6DAA6D;AAC7D,wBAAsB,sBAAsB,CAC1C,QAAQ,SAAS,kBAAkB,EACnC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvD;AA+BD,6EAA6E;AAC7E,wBAAsB,gBAAgB,CAAC,QAAQ,SAAS,kBAAkB,EACxE,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,GACjC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAMvC;AAkGD,gFAAgF;AAChF,wBAAsB,kBAAkB,CAAC,QAAQ,SAAS,kBAAkB,EAC1E,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAQ3C;AAiHD,8DAA8D;AAC9D,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,UAAU,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,SAAS,CAAC,CAoBpB;AAED,0EAA0E;AAC1E,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,SAAS,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAED,kDAAkD;AAClD,qBAAa,2BAA4B,YAAW,kBAAkB;IACpE,IAAI,CAAC,QAAQ,SAAS,kBAAkB,EACtC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,GACjC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CAGzC;AAED,oDAAoD;AACpD,qBAAa,6BAA8B,YAAW,oBAAoB;IACxE,MAAM,CAAC,QAAQ,SAAS,kBAAkB,EACxC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;CAG7C;AAED,4DAA4D;AAC5D,wBAAgB,iCAAiC,IAAI,2BAA2B,CAE/E;AAED,8DAA8D;AAC9D,wBAAgB,mCAAmC,IAAI,6BAA6B,CAEnF"}

package/dist/web-crypto.js

@@ -0,0 +1,378 @@
+import { MESH_SIGNATURE_ALGORITHM, canonicalizeMeshPayload, canonicalizeMeshSigningDocument, compareMeshTimestamps, validateSignedMeshEnvelope, } from '@agentplat/mesh-protocol';
+import { decodeBase64Url, encodeBase64Url } from './base64url.js';
+import { MeshCryptoError, } from './contracts.js';
+const placeholderPayloadHash = 'sha256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+const placeholderSignature = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+/** Strict default policy for the reference cryptographic suite. */
+export const DEFAULT_MESH_CRYPTO_POLICY = Object.freeze({
+    allowedAlgorithms: Object.freeze([MESH_SIGNATURE_ALGORITHM]),
+});
+/** Computes the canonical SHA-256 payload representation. */
+export async function computeMeshPayloadHash(request) {
+    try {
+        return await computeMeshPayloadHashInternal(request);
+    }
+    catch (error) {
+        throw normalizeCryptoError(error);
+    }
+}
+async function computeMeshPayloadHashInternal(request) {
+    if (!request || typeof request !== 'object') {
+        throw new MeshCryptoError('invalid_envelope');
+    }
+    const crypto = resolveCrypto(request.crypto);
+    const payloadBytes = canonicalizeMeshPayload(request.payload, request.protocolOptions);
+    if (!payloadBytes.ok)
+        throw new MeshCryptoError('invalid_envelope');
+    let digest;
+    try {
+        digest = new Uint8Array(await crypto.subtle.digest('SHA-256', copyToArrayBuffer(payloadBytes.value)));
+    }
+    catch {
+        throw new MeshCryptoError('crypto_operation_failed');
+    }
+    if (digest.byteLength !== 32) {
+        throw new MeshCryptoError('crypto_operation_failed');
+    }
+    return `sha256:${encodeBase64Url(digest)}`;
+}
+/** Hashes, constructs and signs one structurally valid outbound envelope. */
+export async function signMeshEnvelope(request) {
+    try {
+        return await signMeshEnvelopeInternal(request);
+    }
+    catch (error) {
+        throw normalizeCryptoError(error);
+    }
+}
+async function signMeshEnvelopeInternal(request) {
+    if (!request || typeof request !== 'object') {
+        throw new MeshCryptoError('invalid_envelope');
+    }
+    const inputEnvelope = request.envelope;
+    const privateKey = request.privateKey;
+    const injectedCrypto = request.crypto;
+    const protocolOptions = snapshotProtocolOptions(request.protocolOptions);
+    if (!inputEnvelope ||
+        typeof inputEnvelope !== 'object' ||
+        !inputEnvelope.proof ||
+        typeof inputEnvelope.proof !== 'object') {
+        throw new MeshCryptoError('invalid_envelope');
+    }
+    if (inputEnvelope.proof.algorithm !== MESH_SIGNATURE_ALGORITHM) {
+        throw new MeshCryptoError('unsupported_algorithm');
+    }
+    if (!isEd25519Key(privateKey, 'private', 'sign')) {
+        throw new MeshCryptoError('invalid_private_key');
+    }
+    const inputValidation = validateSignedMeshEnvelope({
+        ...inputEnvelope,
+        payloadHash: placeholderPayloadHash,
+        proof: {
+            ...inputEnvelope.proof,
+            value: placeholderSignature,
+        },
+    }, protocolOptions);
+    if (!inputValidation.ok) {
+        throw new MeshCryptoError('invalid_envelope');
+    }
+    const envelopeSnapshot = inputValidation.value;
+    const crypto = resolveCrypto(injectedCrypto);
+    const payloadHash = await computeMeshPayloadHash({
+        payload: envelopeSnapshot.payload,
+        crypto,
+        protocolOptions,
+    });
+    const structuralCandidate = {
+        ...envelopeSnapshot,
+        payloadHash,
+    };
+    const structuralValidation = validateSignedMeshEnvelope(structuralCandidate, protocolOptions);
+    if (!structuralValidation.ok) {
+        throw new MeshCryptoError('invalid_envelope');
+    }
+    const structuralEnvelope = structuralValidation.value;
+    const signingBytes = canonicalizeMeshSigningDocument(structuralEnvelope, protocolOptions);
+    if (!signingBytes.ok)
+        throw new MeshCryptoError('invalid_envelope');
+    let signature;
+    try {
+        signature = new Uint8Array(await crypto.subtle.sign(MESH_SIGNATURE_ALGORITHM, privateKey, copyToArrayBuffer(signingBytes.value)));
+    }
+    catch {
+        throw new MeshCryptoError('crypto_operation_failed');
+    }
+    if (signature.byteLength !== 64) {
+        throw new MeshCryptoError('crypto_operation_failed');
+    }
+    const signedCandidate = {
+        ...structuralEnvelope,
+        proof: {
+            ...structuralEnvelope.proof,
+            value: encodeBase64Url(signature),
+        },
+    };
+    const signedValidation = validateSignedMeshEnvelope(signedCandidate, protocolOptions);
+    if (!signedValidation.ok)
+        throw new MeshCryptoError('invalid_envelope');
+    return signedValidation.value;
+}
+/** Verifies digest, proof, key binding, validity and revocation fail-closed. */
+export async function verifyMeshEnvelope(request) {
+    try {
+        return await verifyMeshEnvelopeInternal(request);
+    }
+    catch (error) {
+        return rejection(error instanceof MeshCryptoError ? error.code : 'crypto_operation_failed');
+    }
+}
+async function verifyMeshEnvelopeInternal(request) {
+    if (!request || typeof request !== 'object') {
+        return rejection('invalid_envelope');
+    }
+    const inputEnvelope = request.envelope;
+    if (!inputEnvelope || typeof inputEnvelope !== 'object') {
+        return rejection('invalid_envelope');
+    }
+    const resolver = request.resolver;
+    const allowedAlgorithms = Array.from(request.policy.allowedAlgorithms);
+    const verifiedAt = request.verifiedAt;
+    const injectedCrypto = request.crypto;
+    const protocolOptions = snapshotProtocolOptions(request.protocolOptions);
+    const structuralValidation = validateSignedMeshEnvelope(inputEnvelope, protocolOptions);
+    if (!structuralValidation.ok)
+        return rejection('invalid_envelope');
+    const envelope = structuralValidation.value;
+    if (envelope.proof.algorithm !== MESH_SIGNATURE_ALGORITHM ||
+        !allowedAlgorithms.includes(envelope.proof.algorithm)) {
+        return rejection('unsupported_algorithm');
+    }
+    if (!compareMeshTimestamps(verifiedAt, verifiedAt).ok) {
+        return rejection('invalid_verification_time');
+    }
+    let resolvedKey;
+    try {
+        resolvedKey = resolver.resolve({
+            tenantId: envelope.tenantId,
+            meshId: envelope.meshId,
+            peerId: envelope.sender.peerId,
+            keyId: envelope.proof.keyId,
+            algorithm: envelope.proof.algorithm,
+        });
+    }
+    catch {
+        return rejection('key_resolution_failed');
+    }
+    if (!resolvedKey)
+        return rejection('key_not_found');
+    if (isPromiseLike(resolvedKey))
+        return rejection('invalid_key_record');
+    let key;
+    try {
+        key = Object.freeze({ ...resolvedKey });
+    }
+    catch {
+        return rejection('invalid_key_record');
+    }
+    if (!isEd25519Key(key.publicKey, 'public', 'verify')) {
+        return rejection('invalid_key_material');
+    }
+    let payloadHash;
+    try {
+        payloadHash = await computeMeshPayloadHash({
+            payload: envelope.payload,
+            crypto: injectedCrypto,
+            protocolOptions,
+        });
+    }
+    catch (error) {
+        return rejection(error instanceof MeshCryptoError ? error.code : 'crypto_operation_failed');
+    }
+    if (payloadHash !== envelope.payloadHash) {
+        return rejection('payload_hash_mismatch');
+    }
+    const signature = decodeBase64Url(envelope.proof.value, 64);
+    const signingBytes = canonicalizeMeshSigningDocument(envelope, protocolOptions);
+    if (!signature || !signingBytes.ok)
+        return rejection('invalid_envelope');
+    const crypto = optionalCrypto(injectedCrypto);
+    if (!crypto)
+        return rejection('crypto_unavailable');
+    let signatureValid;
+    try {
+        signatureValid = await crypto.subtle.verify(MESH_SIGNATURE_ALGORITHM, key.publicKey, copyToArrayBuffer(signature), copyToArrayBuffer(signingBytes.value));
+    }
+    catch {
+        return rejection('crypto_operation_failed');
+    }
+    if (signatureValid !== true)
+        return rejection('signature_invalid');
+    const keyState = validateKeyState(key, envelope.tenantId, envelope.meshId, envelope.sender.peerId, envelope.proof.keyId, envelope.proof.algorithm, verifiedAt);
+    if (keyState)
+        return rejection(keyState);
+    return {
+        verified: true,
+        envelope: envelope,
+        key,
+    };
+}
+/** Imports one extractable raw 32-byte Ed25519 public key. */
+export async function importMeshEd25519PublicKey(rawKey, injectedCrypto) {
+    if (!(rawKey instanceof Uint8Array) || rawKey.byteLength !== 32) {
+        throw new MeshCryptoError('invalid_public_key');
+    }
+    try {
+        const crypto = resolveCrypto(injectedCrypto);
+        const key = await crypto.subtle.importKey('raw', copyToArrayBuffer(rawKey), { name: MESH_SIGNATURE_ALGORITHM }, true, ['verify']);
+        if (!isEd25519Key(key, 'public', 'verify')) {
+            throw new MeshCryptoError('invalid_public_key');
+        }
+        return key;
+    }
+    catch (error) {
+        throw normalizeCryptoError(error);
+    }
+}
+/** Exports one Ed25519 public key as an independent 32-byte raw value. */
+export async function exportMeshEd25519PublicKey(publicKey, injectedCrypto) {
+    if (!isEd25519Key(publicKey, 'public', 'verify')) {
+        throw new MeshCryptoError('invalid_public_key');
+    }
+    try {
+        const crypto = resolveCrypto(injectedCrypto);
+        const rawKey = new Uint8Array(await crypto.subtle.exportKey('raw', publicKey));
+        if (rawKey.byteLength !== 32) {
+            throw new MeshCryptoError('invalid_public_key');
+        }
+        return rawKey.slice();
+    }
+    catch (error) {
+        throw normalizeCryptoError(error);
+    }
+}
+/** Reference Web Crypto signer implementation. */
+export class WebCryptoMeshEnvelopeSigner {
+    sign(request) {
+        return signMeshEnvelope(request);
+    }
+}
+/** Reference Web Crypto verifier implementation. */
+export class WebCryptoMeshEnvelopeVerifier {
+    verify(request) {
+        return verifyMeshEnvelope(request);
+    }
+}
+/** Creates the reference signer without requiring `new`. */
+export function createWebCryptoMeshEnvelopeSigner() {
+    return new WebCryptoMeshEnvelopeSigner();
+}
+/** Creates the reference verifier without requiring `new`. */
+export function createWebCryptoMeshEnvelopeVerifier() {
+    return new WebCryptoMeshEnvelopeVerifier();
+}
+function validateKeyState(key, tenantId, meshId, peerId, keyId, algorithm, verifiedAt) {
+    if (key.tenantId !== tenantId ||
+        key.meshId !== meshId ||
+        key.peerId !== peerId ||
+        key.keyId !== keyId ||
+        key.algorithm !== algorithm) {
+        return 'key_binding_mismatch';
+    }
+    const from = compareMeshTimestamps(verifiedAt, key.validFrom);
+    const until = compareMeshTimestamps(verifiedAt, key.validUntil);
+    const interval = compareMeshTimestamps(key.validFrom, key.validUntil);
+    if (!from.ok || !until.ok || !interval.ok || interval.value >= 0) {
+        return 'invalid_key_record';
+    }
+    if (from.value < 0)
+        return 'key_not_yet_valid';
+    if (until.value >= 0)
+        return 'key_expired';
+    if (key.revokedAt !== undefined &&
+        !compareMeshTimestamps(key.revokedAt, key.revokedAt).ok) {
+        return 'invalid_key_record';
+    }
+    if (key.status !== 'active' && key.status !== 'revoked') {
+        return 'invalid_key_record';
+    }
+    if (key.status === 'active' && key.revokedAt !== undefined) {
+        return 'invalid_key_record';
+    }
+    if (key.status === 'revoked') {
+        if (key.revokedAt === undefined)
+            return 'invalid_key_record';
+        const revokedAfterStart = compareMeshTimestamps(key.revokedAt, key.validFrom);
+        const revokedBeforeEnd = compareMeshTimestamps(key.revokedAt, key.validUntil);
+        if (!revokedAfterStart.ok ||
+            !revokedBeforeEnd.ok ||
+            revokedAfterStart.value < 0 ||
+            revokedBeforeEnd.value >= 0) {
+            return 'invalid_key_record';
+        }
+        return 'key_revoked';
+    }
+    return undefined;
+}
+function isEd25519Key(key, type, usage) {
+    try {
+        return (!!key &&
+            key.type === type &&
+            key.algorithm?.name === MESH_SIGNATURE_ALGORITHM &&
+            Array.from(key.usages).includes(usage));
+    }
+    catch {
+        return false;
+    }
+}
+function resolveCrypto(injected) {
+    const crypto = optionalCrypto(injected);
+    if (!crypto)
+        throw new MeshCryptoError('crypto_unavailable');
+    return crypto;
+}
+function optionalCrypto(injected) {
+    const candidate = injected ?? globalThis.crypto;
+    return candidate?.subtle ? candidate : undefined;
+}
+function copyToArrayBuffer(bytes) {
+    const copy = new Uint8Array(bytes.byteLength);
+    copy.set(bytes);
+    return copy.buffer;
+}
+function snapshotProtocolOptions(options) {
+    if (options === undefined)
+        return undefined;
+    return Object.freeze({
+        ...(options.limits === undefined
+            ? {}
+            : { limits: Object.freeze({ ...options.limits }) }),
+    });
+}
+function isPromiseLike(value) {
+    try {
+        return (typeof value === 'object' &&
+            value !== null &&
+            typeof value.then === 'function');
+    }
+    catch {
+        return true;
+    }
+}
+function normalizeCryptoError(error) {
+    return error instanceof MeshCryptoError
+        ? error
+        : new MeshCryptoError('crypto_operation_failed');
+}
+function rejection(code) {
+    return {
+        verified: false,
+        code: code === 'invalid_private_key'
+            ? 'invalid_key_material'
+            : code === 'invalid_public_key'
+                ? 'invalid_key_material'
+                : code === 'unsupported_algorithm'
+                    ? 'unsupported_algorithm'
+                    : code,
+    };
+}
+//# sourceMappingURL=web-crypto.js.map

package/dist/web-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-crypto.js","sourceRoot":"","sources":["../src/web-crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,0BAA0B,GAK3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EACL,eAAe,GAUhB,MAAM,gBAAgB,CAAC;AAExB,MAAM,sBAAsB,GAC1B,oDAAoD,CAAC;AACvD,MAAM,oBAAoB,GACxB,wFAAwF,CAAC;AAE3F,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GACrC,MAAM,CAAC,MAAM,CAAC;IACZ,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;CAC7D,CAAC,CAAC;AAEL,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAE1C,OAAoC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAE3C,OAAoC;IACpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,uBAAuB,CAC1C,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACpE,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,UAAU,CACrB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CACtC,CACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,UAAU,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAkC;IAElC,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,OAAkC;IAElC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,IACE,CAAC,aAAa;QACd,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,aAAa,CAAC,KAAK;QACpB,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ,EACvC,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,eAAe,GAAG,0BAA0B,CAChD;QACE,GAAG,aAAa;QAChB,WAAW,EAAE,sBAAsB;QACnC,KAAK,EAAE;YACL,GAAG,aAAa,CAAC,KAAK;YACtB,KAAK,EAAE,oBAAoB;SAC5B;KACF,EACD,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,gBAAgB,GACpB,eAAe,CAAC,KAAqC,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC;QAC/C,OAAO,EAAE,gBAAgB,CAAC,OAAO;QACjC,MAAM;QACN,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,mBAAmB,GAA2B;QAClD,GAAG,gBAAgB;QACnB,WAAW;KACZ,CAAC;IACF,MAAM,oBAAoB,GAAG,0BAA0B,CACrD,mBAAmB,EACnB,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,kBAAkB,GACtB,oBAAoB,CAAC,KAAqC,CAAC;IAC7D,MAAM,YAAY,GAAG,+BAA+B,CAClD,kBAAkB,EAClB,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAEpE,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,UAAU,CACxB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACtB,wBAAwB,EACxB,UAAU,EACV,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CACtC,CACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,GAA2B;QAC9C,GAAG,kBAAkB;QACrB,KAAK,EAAE;YACL,GAAG,kBAAkB,CAAC,KAAK;YAC3B,KAAK,EAAE,eAAe,CAAC,SAAS,CAAC;SAClC;KACF,CAAC;IACF,MAAM,gBAAgB,GAAG,0BAA0B,CACjD,eAAe,EACf,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC,KAAqC,CAAC;AAChE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAoC;IAEpC,IAAI,CAAC;QACH,OAAO,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CACd,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,OAAoC;IAEpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IACvC,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,oBAAoB,GAAG,0BAA0B,CACrD,aAAa,EACb,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAqC,CAAC;IAC5E,IACE,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,wBAAwB;QACrD,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EACrD,CAAC;QACD,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,WAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;YAC9B,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;YAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACvE,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,sBAAsB,CAAC;YACzC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,cAAc;YACtB,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CACd,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,+BAA+B,CAClD,QAAQ,EACR,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAEpD,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACzC,wBAAwB,EACxB,GAAG,CAAC,SAAS,EACb,iBAAiB,CAAC,SAAS,CAAC,EAC5B,iBAAiB,CAAC,YAAY,CAAC,KAAK,CAAC,CACtC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,GAAG,EACH,QAAQ,CAAC,QAAQ,EACjB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EACtB,QAAQ,CAAC,KAAK,CAAC,KAAK,EACpB,QAAQ,CAAC,KAAK,CAAC,SAAS,EACxB,UAAU,CACX,CAAC;IACF,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAA0C;QACpD,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAkB,EAClB,cAAuB;IAEvB,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,iBAAiB,CAAC,MAAM,CAAC,EACzB,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAClC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAoB,EACpB,cAAuB;IAEvB,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAChD,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,OAAO,2BAA2B;IACtC,IAAI,CACF,OAAkC;QAElC,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,OAAO,6BAA6B;IACxC,MAAM,CACJ,OAAoC;QAEpC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,UAAU,iCAAiC;IAC/C,OAAO,IAAI,2BAA2B,EAAE,CAAC;AAC3C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mCAAmC;IACjD,OAAO,IAAI,6BAA6B,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,MAAc,EACd,KAAa,EACb,SAA0C,EAC1C,UAAkB;IAElB,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,GAAG,CAAC,KAAK,KAAK,KAAK;QACnB,GAAG,CAAC,SAAS,KAAK,SAAS,EAC3B,CAAC;QACD,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC/C,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IAC3C,IACE,GAAG,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EACvD,CAAC;QACD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,oBAAoB,CAAC;QAC7D,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,CACd,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,CACf,CAAC;QACF,IACE,CAAC,iBAAiB,CAAC,EAAE;YACrB,CAAC,gBAAgB,CAAC,EAAE;YACpB,iBAAiB,CAAC,KAAK,GAAG,CAAC;YAC3B,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAC3B,CAAC;YACD,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAc,EAAE,IAAa,EAAE,KAAe;IAClE,IAAI,CAAC;QACH,OAAO,CACL,CAAC,CAAC,GAAG;YACL,GAAG,CAAC,IAAI,KAAK,IAAI;YACjB,GAAG,CAAC,SAAS,EAAE,IAAI,KAAK,wBAAwB;YAChD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B;IAClD,MAAM,SAAS,GACb,QAAQ,IAAK,UAAsD,CAAC,MAAM,CAAC;IAC7E,OAAO,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAA2C;IAE3C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CACzD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,eAAe;QACrC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,SAAS,CAChB,IAAuD;IAEvD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,IAAI,EACF,IAAI,KAAK,qBAAqB;YAC5B,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,KAAK,oBAAoB;gBAC7B,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAChC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,IAAI;KACf,CAAC;AACJ,CAAC"}

package/fixtures/v0/README.md

@@ -0,0 +1,13 @@
+# Protocol v0 cryptographic fixtures
+
+`signed-peer-hello.json` and `peer-a-public.raw.json` form one fixed Ed25519
+verification vector. The payload digest and signature cover the exact
+canonical protocol documents defined by `@agentplat/mesh-protocol`.
+
+The public key uses the provider-neutral raw 32-byte representation as a JSON
+byte array so the fixture remains reviewable text.
+
+The private key used to create the signature was ephemeral and discarded. It
+is not included in source, package output, telemetry or documentation. Tests
+that exercise signing generate temporary key pairs at runtime and never export
+their private components.

package/fixtures/v0/peer-a-public.raw.json

@@ -0,0 +1,8 @@
+{
+  "format": "raw",
+  "algorithm": "Ed25519",
+  "publicKey": [
+    228, 35, 78, 133, 92, 183, 90, 49, 38, 170, 83, 181, 191, 40, 239, 175, 208,
+    16, 54, 81, 220, 74, 200, 22, 95, 152, 65, 23, 206, 235, 80, 192
+  ]
+}

package/fixtures/v0/signed-peer-hello.json

@@ -0,0 +1,30 @@
+{
+  "protocol": "agentplat.mesh",
+  "wireVersion": 0,
+  "messageId": "CCCCCCCCCCCCCCCCCCCCCA",
+  "tenantId": "tenant-conformance",
+  "meshId": "mesh-conformance",
+  "type": "peer.hello",
+  "sender": {
+    "peerId": "peer-conformance-a",
+    "instanceId": "instance-conformance-a"
+  },
+  "audience": {
+    "kind": "peer",
+    "peerId": "peer-conformance-b"
+  },
+  "sequence": 1,
+  "sentAt": "2026-07-30T12:00:00Z",
+  "expiresAt": "2026-07-30T12:02:00Z",
+  "payloadHash": "sha256:1eTTFKIr3MahNi_Mx-duQidWUAeerEpEK-qWQemPkzQ",
+  "payload": {
+    "type": "peer.hello",
+    "peerCardId": "card-conformance-a",
+    "cardRevision": 1
+  },
+  "proof": {
+    "algorithm": "Ed25519",
+    "keyId": "key-conformance-a",
+    "value": "YOM_6GfMuv9xppudjCXvuFxuCOzcl-XbVjBIOV-8LCyE4ECDY8CA3n_idLBMw_Z3Glvgccdmvexr3s2QjIudAw"
+  }
+}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@agentplat/mesh-crypto",
+  "version": "0.3.0-alpha.1",
+  "description": "Web Crypto signing and verification contracts for AgentPlat Mesh envelopes.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "fixtures",
+    "README.md"
+  ],
+  "dependencies": {
+    "@agentplat/mesh-protocol": "^0.3.0-alpha.1"
+  },
+  "engines": {
+    "node": ">=20.19.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Agentplat/agentplat.git",
+    "directory": "packages/mesh-crypto"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "type-check": "tsc -p tsconfig.json --noEmit",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
+  }
+}