@agentplat/mesh 0.3.0-beta.2 → 0.3.0-beta.4

package/dist/authenticated-overlay-transport.js

@@ -0,0 +1,702 @@
+import { MESH_SIGNATURE_ALGORITHM, canonicalizeMeshJsonBytes, } from "@agentplat/mesh-protocol";
+import { sha256Base64Url } from "./sha256.js";
+/**
+ * Authenticated, epoch-bound envelopes for the sparse peer transport.
+ *
+ * The transport deliberately does not define a directory, PKI or membership
+ * protocol. Those decisions are supplied by the authority ports below.  The
+ * only persisted evidence is public routing metadata, digests and signatures.
+ */
+export const MESH_AUTHENTICATED_OVERLAY_TRANSPORT_SCHEMA_VERSION_V1 = 1;
+const DEFAULT_LIMITS = Object.freeze({
+    maximumFutureSequence: 4_096,
+    maximumFutureLogicalTime: 30_000,
+    maximumInboundPeers: 4_096,
+    maximumCommitAttempts: 8,
+});
+/**
+ * Authenticated next-hop adapter for MeshSparsePeerTransportRuntimeV1.
+ * Pass it as that runtime's `nextHop`; the underlying durable overlay remains
+ * responsible for queueing, causal recovery and delivery idempotency.
+ */
+export class MeshAuthenticatedSparseOverlayNextHopTransportV1 {
+    #runtime;
+    constructor(options) {
+        this.#runtime = new AuthenticatedOverlayRuntimeV1(options);
+    }
+    async deliver(input) {
+        const response = await this.#request("deliver", input.recipient, {
+            overlayId: input.overlayId,
+            membershipDigest: input.membershipDigest,
+            sender: input.sender,
+            delivery: input.delivery,
+            logicalTime: input.logicalTime,
+        }, input.logicalTime);
+        return admissionFromResponse(response);
+    }
+    async catchUp(input) {
+        const response = await this.#request("catch_up", input.recipient, {
+            overlayId: input.overlayId,
+            membershipDigest: input.membershipDigest,
+            requester: input.requester,
+            afterSequence: input.afterSequence,
+            maximumItems: input.maximumItems,
+            logicalTime: input.logicalTime,
+        }, input.logicalTime);
+        if (!response.accepted || !isObject(response.body))
+            throw new Error("authenticated_overlay_catch_up_rejected");
+        return response.body;
+    }
+    async fetchCausal(input) {
+        const response = await this.#request("fetch_causal", input.recipient, {
+            overlayId: input.overlayId,
+            membershipDigest: input.membershipDigest,
+            requester: input.requester,
+            deliveryDigest: input.deliveryDigest,
+            logicalTime: input.logicalTime,
+        }, input.logicalTime);
+        if (!response.accepted)
+            return undefined;
+        return response.body === null
+            ? undefined
+            : response.body;
+    }
+    async #request(operation, recipient, body, logicalTime) {
+        const target = peerIdentity(recipient, "recipient");
+        const envelope = await this.#runtime.createRequest(operation, target, body, logicalTime);
+        const response = await this.#runtime.network.exchange({
+            recipient: target,
+            envelope,
+            logicalTime,
+        });
+        await this.#runtime.verifyAndRememberResponse(envelope, response, logicalTime);
+        return response;
+    }
+}
+/** Endpoint adapter. It authenticates before invoking the durable overlay endpoint. */
+export class MeshAuthenticatedSparseOverlayEndpointV1 {
+    #runtime;
+    #endpoint;
+    constructor(options) {
+        this.#runtime = new AuthenticatedOverlayRuntimeV1({
+            ...options,
+            network: rejectingNetwork(),
+        });
+        if (!options.endpoint)
+            throw new TypeError("sparse overlay endpoint is required");
+        this.#endpoint = options.endpoint;
+    }
+    async receive(input) {
+        let verified;
+        try {
+            verified = await this.#runtime.verifyAndRememberRequest(input.envelope, input.logicalTime);
+        }
+        catch (error) {
+            return this.#runtime.rejection(input.envelope, rejectionCode(error), input.logicalTime);
+        }
+        try {
+            const body = await this.#dispatch(verified);
+            return this.#runtime.response(verified, true, null, body, input.logicalTime);
+        }
+        catch {
+            return this.#runtime.response(verified, false, "unsupported_operation", null, input.logicalTime);
+        }
+    }
+    async #dispatch(envelope) {
+        const body = isObject(envelope.body)
+            ? envelope.body
+            : fail("request_binding_invalid");
+        assertDispatchBinding(envelope, body);
+        if (envelope.operation === "deliver") {
+            const input = body;
+            return this.#endpoint.receive(input);
+        }
+        if (envelope.operation === "catch_up") {
+            const input = body;
+            return this.#endpoint.catchUp(input);
+        }
+        if (envelope.operation === "fetch_causal") {
+            const input = body;
+            return (await this.#endpoint.fetchCausal(input)) ?? null;
+        }
+        return fail("unsupported_operation");
+    }
+}
+/**
+ * Bounded in-memory reference persistence, suitable only for local development.
+ * Its anchor shares process memory with the state and is therefore not an
+ * independently protected production anti-rollback witness.
+ */
+export class InMemoryMeshAuthenticatedOverlayStateStoreV1 {
+    #snapshots = new Map();
+    async loadCurrent(scope) {
+        const snapshot = this.#snapshots.get(scope);
+        return snapshot ? structuredClone(snapshot) : undefined;
+    }
+    async compareAndSet(input) {
+        const current = this.#snapshots.get(input.scope);
+        if ((current?.anchor.revision ?? null) !== (input.expected?.revision ?? null) ||
+            (current?.anchor.stateDigest ?? null) !==
+                (input.expected?.stateDigest ?? null))
+            return false;
+        if (input.next.revision !== (current?.state.revision ?? -1) + 1 ||
+            input.next.previousStateDigest !== (current?.state.stateDigest ?? null))
+            throw new Error("authenticated_overlay_invalid_state_transition");
+        this.#snapshots.set(input.scope, structuredClone({
+            state: input.next,
+            anchor: {
+                revision: input.next.revision,
+                stateDigest: input.next.stateDigest,
+            },
+        }));
+        return true;
+    }
+    snapshot() {
+        return Object.freeze([...this.#snapshots.values()].map((snapshot) => snapshot.state));
+    }
+}
+/** Explicit local wiring for development; it is a route table, never a directory. */
+export class InMemoryMeshAuthenticatedOverlayNetworkV1 {
+    #endpoints = new Map();
+    connect(peer, endpoint) {
+        const identity = peerIdentity(peer, "peer");
+        if (!endpoint)
+            throw new TypeError("authenticated overlay endpoint is required");
+        this.#endpoints.set(networkKey(identity), endpoint);
+    }
+    disconnect(peer) {
+        this.#endpoints.delete(networkKey(peerIdentity(peer, "peer")));
+    }
+    async exchange(input) {
+        const endpoint = this.#endpoints.get(networkKey(peerIdentity(input.recipient, "recipient")));
+        if (!endpoint)
+            throw new Error("authenticated_overlay_peer_unavailable");
+        return endpoint.receive({
+            envelope: input.envelope,
+            logicalTime: input.logicalTime,
+        });
+    }
+}
+/** Opaque Web Crypto signer adapter; callers retain private-key lifecycle control. */
+export class WebCryptoMeshAuthenticatedOverlaySignerV1 {
+    keyId;
+    privateKey;
+    crypto;
+    constructor(keyId, privateKey, crypto = globalThis.crypto) {
+        this.keyId = keyId;
+        this.privateKey = privateKey;
+        this.crypto = crypto;
+        identifier(keyId, "keyId");
+        if (!crypto?.subtle ||
+            privateKey.type !== "private" ||
+            privateKey.algorithm.name !== MESH_SIGNATURE_ALGORITHM ||
+            !privateKey.usages.includes("sign"))
+            throw new TypeError("Web Crypto signing key is invalid");
+    }
+    async sign(input) {
+        return new Uint8Array(await this.crypto.subtle.sign(MESH_SIGNATURE_ALGORITHM, this.privateKey, copy(input.bytes)));
+    }
+}
+class AuthenticatedOverlayRuntimeV1 {
+    network;
+    #options;
+    #limits;
+    #scope;
+    constructor(options) {
+        if (!options || typeof options !== "object")
+            throw new TypeError("authenticated overlay options are required");
+        identifier(options.overlayId, "overlayId");
+        integer(options.membershipEpoch, "membershipEpoch", 0);
+        peerIdentity(options.localPeer, "localPeer");
+        identifier(options.signer?.keyId, "signer.keyId");
+        if (!options.membership ||
+            !options.keys ||
+            !options.store ||
+            !options.network)
+            throw new TypeError("authenticated overlay authority, state and network ports are required");
+        if (typeof options.membership.resolve !== "function" ||
+            typeof options.keys.resolve !== "function" ||
+            typeof options.store.loadCurrent !== "function" ||
+            typeof options.store.compareAndSet !== "function" ||
+            typeof options.network.exchange !== "function")
+            throw new TypeError("authenticated overlay port is invalid");
+        this.#options = options;
+        this.network = options.network;
+        this.#limits = Object.freeze({
+            maximumFutureSequence: positive(options.maximumFutureSequence, DEFAULT_LIMITS.maximumFutureSequence, "maximumFutureSequence"),
+            maximumFutureLogicalTime: positive(options.maximumFutureLogicalTime, DEFAULT_LIMITS.maximumFutureLogicalTime, "maximumFutureLogicalTime"),
+            maximumInboundPeers: positive(options.maximumInboundPeers, DEFAULT_LIMITS.maximumInboundPeers, "maximumInboundPeers"),
+            maximumCommitAttempts: positive(options.maximumCommitAttempts, DEFAULT_LIMITS.maximumCommitAttempts, "maximumCommitAttempts"),
+        });
+        this.#scope = `authenticated-overlay:${options.overlayId}:${options.localPeer.peerId}:${options.membershipEpoch}`;
+    }
+    async createRequest(operation, recipient, body, logicalTime) {
+        await this.#assertLocalSigningKey(logicalTime);
+        const sequence = await this.#reserveOutbound(logicalTime);
+        const payloadDigest = digest(body);
+        const unsigned = {
+            schemaVersion: 1,
+            kind: "request",
+            requestId: `authenticated-overlay:${this.#options.localPeer.peerId}:${sequence}`,
+            overlayId: this.#options.overlayId,
+            membershipEpoch: this.#options.membershipEpoch,
+            sender: this.#options.localPeer,
+            recipient,
+            sequence,
+            logicalTime,
+            payloadDigest,
+            operation,
+            body,
+            proof: {
+                algorithm: MESH_SIGNATURE_ALGORITHM,
+                keyId: this.#options.signer.keyId,
+            },
+        };
+        return {
+            ...unsigned,
+            proof: {
+                ...unsigned.proof,
+                value: encode(await this.#options.signer.sign({ bytes: canonical(unsigned) })),
+            },
+        };
+    }
+    async verifyAndRememberRequest(envelope, logicalTime) {
+        await this.#verifyAndRemember(envelope, logicalTime, "request");
+        return envelope;
+    }
+    async verifyAndRememberResponse(request, response, logicalTime) {
+        await this.#verifyEnvelope(response, logicalTime, "response");
+        if (response.requestId !== request.requestId ||
+            response.operation !== request.operation ||
+            response.requestDigest !== digest(request) ||
+            !samePeer(response.recipient, request.sender) ||
+            !samePeer(response.sender, request.recipient))
+            fail("response_binding_invalid");
+        // Do not consume a peer's sequence until this response is correlated to
+        // the exact authenticated request that triggered it.
+        await this.#rememberInbound(response, logicalTime);
+    }
+    async response(request, accepted, reasonCode, body, logicalTime) {
+        await this.#assertLocalSigningKey(logicalTime);
+        const sequence = await this.#reserveOutbound(logicalTime);
+        const unsigned = {
+            schemaVersion: 1,
+            kind: "response",
+            requestId: request.requestId,
+            requestDigest: digest(request),
+            operation: request.operation,
+            accepted,
+            reasonCode,
+            body,
+            overlayId: this.#options.overlayId,
+            membershipEpoch: this.#options.membershipEpoch,
+            sender: this.#options.localPeer,
+            recipient: request.sender,
+            sequence,
+            logicalTime,
+            payloadDigest: digest(body),
+            proof: {
+                algorithm: MESH_SIGNATURE_ALGORITHM,
+                keyId: this.#options.signer.keyId,
+            },
+        };
+        return {
+            ...unsigned,
+            proof: {
+                ...unsigned.proof,
+                value: encode(await this.#options.signer.sign({ bytes: canonical(unsigned) })),
+            },
+        };
+    }
+    async rejection(request, reasonCode, logicalTime) {
+        return this.response(request, false, reasonCode, null, logicalTime);
+    }
+    async #verifyAndRemember(envelope, logicalTime, expectedKind) {
+        await this.#verifyEnvelope(envelope, logicalTime, expectedKind);
+        await this.#rememberInbound(envelope, logicalTime);
+    }
+    async #verifyEnvelope(envelope, logicalTime, expectedKind) {
+        integer(logicalTime, "logicalTime", 0);
+        if (!envelope ||
+            envelope.kind !== expectedKind ||
+            envelope.schemaVersion !== 1)
+            fail("request_binding_invalid");
+        if (envelope.overlayId !== this.#options.overlayId)
+            fail("overlay_mismatch");
+        if (envelope.membershipEpoch !== this.#options.membershipEpoch)
+            fail("membership_epoch_mismatch");
+        if (!samePeer(envelope.recipient, this.#options.localPeer))
+            fail("recipient_mismatch");
+        peerIdentity(envelope.sender, "sender");
+        peerIdentity(envelope.recipient, "recipient");
+        integer(envelope.sequence, "sequence", 1);
+        integer(envelope.logicalTime, "envelope logicalTime", 0);
+        if (envelope.logicalTime >
+            logicalTime + this.#limits.maximumFutureLogicalTime)
+            fail("logical_time_future");
+        const recipientMembership = await this.#options.membership.resolve({
+            overlayId: this.#options.overlayId,
+            membershipEpoch: this.#options.membershipEpoch,
+            ...this.#options.localPeer,
+            logicalTime,
+        });
+        if (!recipientMembership?.active)
+            fail("recipient_not_active");
+        if (!validDigest(envelope.payloadDigest) ||
+            digest(envelope.body) !== envelope.payloadDigest)
+            fail("payload_digest_invalid");
+        if (envelope.proof?.algorithm !== MESH_SIGNATURE_ALGORITHM ||
+            !identifier(envelope.proof?.keyId, "proof.keyId") ||
+            !base64(envelope.proof?.value))
+            fail("signature_invalid");
+        await this.#assertRemoteKey(envelope, logicalTime);
+        const bytes = canonical({
+            ...envelope,
+            proof: {
+                algorithm: envelope.proof.algorithm,
+                keyId: envelope.proof.keyId,
+            },
+        });
+        const key = await this.#options.keys.resolve({
+            overlayId: envelope.overlayId,
+            membershipEpoch: envelope.membershipEpoch,
+            peerId: envelope.sender.peerId,
+            keyId: envelope.proof.keyId,
+            logicalTime,
+        });
+        if (!key || key.status !== "active")
+            fail(key?.status === "revoked" ? "key_revoked" : "key_not_accepted");
+        const verified = await crypto(this.#options.crypto).subtle.verify(MESH_SIGNATURE_ALGORITHM, key.publicKey, copy(decode(envelope.proof.value)), copy(bytes));
+        if (!verified)
+            fail("signature_invalid");
+    }
+    async #assertLocalSigningKey(logicalTime) {
+        const membership = await this.#options.membership.resolve({
+            overlayId: this.#options.overlayId,
+            membershipEpoch: this.#options.membershipEpoch,
+            ...this.#options.localPeer,
+            logicalTime,
+        });
+        if (!membership?.active)
+            fail("sender_not_active");
+        if (membership.currentKeyId !== this.#options.signer.keyId)
+            fail("key_not_accepted");
+        const key = await this.#options.keys.resolve({
+            overlayId: this.#options.overlayId,
+            membershipEpoch: this.#options.membershipEpoch,
+            peerId: this.#options.localPeer.peerId,
+            keyId: this.#options.signer.keyId,
+            logicalTime,
+        });
+        if (!key || key.status === "revoked")
+            fail(key?.status === "revoked" ? "key_revoked" : "key_not_accepted");
+        if (logicalTime < key.validFromLogicalTime)
+            fail("key_not_yet_valid");
+        if (logicalTime >= key.validUntilLogicalTime)
+            fail("key_expired");
+    }
+    async #assertRemoteKey(envelope, logicalTime) {
+        const membership = await this.#options.membership.resolve({
+            overlayId: envelope.overlayId,
+            membershipEpoch: envelope.membershipEpoch,
+            ...envelope.sender,
+            logicalTime,
+        });
+        if (!membership?.active)
+            fail("sender_not_active");
+        const isCurrent = membership.currentKeyId === envelope.proof.keyId;
+        const isPrevious = membership.previousKeyId === envelope.proof.keyId;
+        if (!isCurrent && !isPrevious)
+            fail("key_not_accepted");
+        if (isPrevious &&
+            (membership.previousKeyAcceptUntilLogicalTime === undefined ||
+                logicalTime > membership.previousKeyAcceptUntilLogicalTime))
+            fail("rotation_window_expired");
+        const key = await this.#options.keys.resolve({
+            overlayId: envelope.overlayId,
+            membershipEpoch: envelope.membershipEpoch,
+            peerId: envelope.sender.peerId,
+            keyId: envelope.proof.keyId,
+            logicalTime,
+        });
+        if (!key || key.status === "revoked")
+            fail(key?.status === "revoked" ? "key_revoked" : "key_not_accepted");
+        if (logicalTime < key.validFromLogicalTime)
+            fail("key_not_yet_valid");
+        if (logicalTime >= key.validUntilLogicalTime)
+            fail("key_expired");
+    }
+    async #reserveOutbound(logicalTime) {
+        let sequence = 0;
+        await this.#mutate(logicalTime, (state) => {
+            sequence = state.nextOutboundSequence;
+            return stateWith(state, {
+                nextOutboundSequence: sequence + 1,
+                lastLogicalTime: Math.max(state.lastLogicalTime, logicalTime),
+            });
+        });
+        return sequence;
+    }
+    async #rememberInbound(envelope, logicalTime) {
+        await this.#mutate(logicalTime, (state) => {
+            const current = state.inboundCursors.find((cursor) => cursor.peerId === envelope.sender.peerId &&
+                cursor.membershipEpoch === envelope.membershipEpoch);
+            const highest = current?.highestSequence ?? 0;
+            if (envelope.sequence <= highest)
+                fail("sequence_replayed");
+            if (envelope.sequence > highest + this.#limits.maximumFutureSequence)
+                fail("sequence_future");
+            if (!current &&
+                state.inboundCursors.length >= this.#limits.maximumInboundPeers)
+                fail("state_conflict");
+            const replacement = Object.freeze({
+                peerId: envelope.sender.peerId,
+                membershipEpoch: envelope.membershipEpoch,
+                highestSequence: envelope.sequence,
+            });
+            return stateWith(state, {
+                inboundCursors: Object.freeze([
+                    ...state.inboundCursors.filter((cursor) => cursor !== current),
+                    replacement,
+                ].sort((left, right) => left.peerId.localeCompare(right.peerId) ||
+                    left.membershipEpoch - right.membershipEpoch)),
+                lastLogicalTime: Math.max(state.lastLogicalTime, logicalTime),
+            });
+        });
+    }
+    async #mutate(logicalTime, operation) {
+        for (let attempt = 0; attempt < this.#limits.maximumCommitAttempts; attempt += 1) {
+            const current = await this.#restore(logicalTime);
+            const next = operation(current);
+            if (!(await this.#options.store.compareAndSet({
+                scope: this.#scope,
+                expected: {
+                    revision: current.revision,
+                    stateDigest: current.stateDigest,
+                },
+                next,
+            })))
+                continue;
+            return;
+        }
+        fail("state_conflict");
+    }
+    async #restore(logicalTime) {
+        const snapshot = await this.#options.store.loadCurrent(this.#scope);
+        if (snapshot) {
+            const validated = validateState(snapshot.state, this.#scope, this.#options);
+            if (snapshot.anchor.revision !== validated.revision ||
+                snapshot.anchor.stateDigest !== validated.stateDigest)
+                fail("state_rollback_detected");
+            return validated;
+        }
+        const initial = stateWith({
+            schemaVersion: 1,
+            scope: this.#scope,
+            overlayId: this.#options.overlayId,
+            localPeer: this.#options.localPeer,
+            membershipEpoch: this.#options.membershipEpoch,
+            revision: -1,
+            nextOutboundSequence: 1,
+            inboundCursors: [],
+            lastLogicalTime: logicalTime,
+            previousStateDigest: null,
+            stateDigest: "sha256:bootstrap",
+        }, {});
+        if (await this.#options.store.compareAndSet({
+            scope: this.#scope,
+            expected: null,
+            next: initial,
+        }))
+            return initial;
+        const raced = await this.#options.store.loadCurrent(this.#scope);
+        if (!raced)
+            fail("state_conflict");
+        const validated = validateState(raced.state, this.#scope, this.#options);
+        if (raced.anchor.revision !== validated.revision ||
+            raced.anchor.stateDigest !== validated.stateDigest)
+            fail("state_rollback_detected");
+        return validated;
+    }
+}
+function stateWith(state, change) {
+    const base = {
+        ...state,
+        ...change,
+        revision: state.revision + 1,
+        previousStateDigest: state.revision < 0 ? null : state.stateDigest,
+    };
+    const stateDigest = digest(withoutStateDigest(base));
+    return Object.freeze({ ...base, stateDigest });
+}
+function validateState(state, scope, options) {
+    if (!state ||
+        state.schemaVersion !== 1 ||
+        state.scope !== scope ||
+        state.overlayId !== options.overlayId ||
+        state.membershipEpoch !== options.membershipEpoch ||
+        !samePeer(state.localPeer, options.localPeer) ||
+        !validDigest(state.stateDigest) ||
+        state.revision < 0 ||
+        state.nextOutboundSequence < 1)
+        fail("state_rollback_detected");
+    const calculated = digest(withoutStateDigest(state));
+    if (calculated !== state.stateDigest)
+        fail("state_rollback_detected");
+    return state;
+}
+function admissionFromResponse(response) {
+    if (!response.accepted || !isObject(response.body))
+        return Object.freeze({
+            status: "rejected",
+            reasonCode: response.reasonCode ?? "authenticated_overlay_rejected",
+        });
+    const result = response.body;
+    if (result.status === "admitted" ||
+        result.status === "duplicate" ||
+        result.status === "backpressured" ||
+        result.status === "rejected")
+        return result;
+    return Object.freeze({
+        status: "rejected",
+        reasonCode: "authenticated_overlay_response_invalid",
+    });
+}
+function rejectingNetwork() {
+    return {
+        async exchange() {
+            throw new Error("endpoint_has_no_outbound_network");
+        },
+    };
+}
+function peerIdentity(value, label) {
+    if (!isObject(value))
+        throw new TypeError(`${label} is invalid`);
+    return Object.freeze({
+        peerId: identifier(value.peerId, `${label}.peerId`),
+        peerIndex: integer(value.peerIndex, `${label}.peerIndex`, 0),
+    });
+}
+function samePeer(left, right) {
+    return left.peerId === right.peerId && left.peerIndex === right.peerIndex;
+}
+function networkKey(peer) {
+    return `${peer.peerIndex}:${peer.peerId}`;
+}
+function assertDispatchBinding(envelope, body) {
+    if (body.overlayId !== envelope.overlayId ||
+        body.logicalTime !== envelope.logicalTime)
+        fail("request_binding_invalid");
+    const actor = envelope.operation === "deliver" ? body.sender : body.requester;
+    if (!isObject(actor) ||
+        actor.peerId !== envelope.sender.peerId ||
+        actor.peerIndex !== envelope.sender.peerIndex)
+        fail("request_binding_invalid");
+    if (envelope.operation === "deliver") {
+        const delivery = body.delivery;
+        if (!delivery || delivery.senderPeerIndex !== envelope.sender.peerIndex)
+            fail("request_binding_invalid");
+    }
+}
+function withoutStateDigest(state) {
+    const { stateDigest: _stateDigest, ...unsigned } = state;
+    return unsigned;
+}
+function identifier(value, label) {
+    if (typeof value !== "string" ||
+        value.length < 1 ||
+        value.length > 256 ||
+        !/^[A-Za-z0-9][A-Za-z0-9._:@/-]*$/u.test(value))
+        throw new TypeError(`${label} is invalid`);
+    return value;
+}
+function integer(value, label, minimum) {
+    if (!Number.isSafeInteger(value) || value < minimum)
+        throw new TypeError(`${label} is invalid`);
+    return value;
+}
+function positive(value, fallback, label) {
+    return integer(value ?? fallback, label, 1);
+}
+function isObject(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function canonical(value) {
+    const result = canonicalizeMeshJsonBytes(value);
+    if (!result.ok)
+        throw new TypeError("authenticated overlay canonicalization failed");
+    return result.value;
+}
+function digest(value) {
+    const bytes = canonical(value);
+    return `sha256:${sha256(bytes)}`;
+}
+function validDigest(value) {
+    return typeof value === "string" && /^sha256:[A-Za-z0-9_-]{43}$/u.test(value);
+}
+function sha256(bytes) {
+    return sha256Base64Url(bytes);
+}
+function encode(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/=/gu, "")
+        .replace(/\+/gu, "-")
+        .replace(/\//gu, "_");
+}
+function decode(value) {
+    if (!base64(value))
+        fail("signature_invalid");
+    const normalized = value.replace(/-/gu, "+").replace(/_/gu, "/");
+    const binary = atob(normalized + "=".repeat((4 - (normalized.length % 4)) % 4));
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+function base64(value) {
+    return typeof value === "string" && /^[A-Za-z0-9_-]+$/u.test(value);
+}
+function copy(value) {
+    return value.slice().buffer;
+}
+function crypto(injected) {
+    const value = injected ?? globalThis.crypto;
+    if (!value?.subtle)
+        throw new TypeError("Web Crypto is unavailable");
+    return value;
+}
+function fail(code) {
+    const error = new Error(code);
+    error.name = "MeshAuthenticatedOverlayTransportErrorV1";
+    throw error;
+}
+function rejectionCode(error) {
+    const message = error instanceof Error ? error.message : "unsupported_operation";
+    return isRejection(message) ? message : "unsupported_operation";
+}
+function isRejection(value) {
+    return [
+        "overlay_mismatch",
+        "recipient_mismatch",
+        "membership_epoch_mismatch",
+        "sender_not_active",
+        "recipient_not_active",
+        "peer_binding_invalid",
+        "key_not_accepted",
+        "key_revoked",
+        "key_not_yet_valid",
+        "key_expired",
+        "rotation_window_expired",
+        "signature_invalid",
+        "payload_digest_invalid",
+        "sequence_replayed",
+        "sequence_future",
+        "logical_time_future",
+        "request_binding_invalid",
+        "response_binding_invalid",
+        "state_rollback_detected",
+        "state_conflict",
+        "unsupported_operation",
+    ].includes(value);
+}
+//# sourceMappingURL=authenticated-overlay-transport.js.map