@agentproto/secrets 0.2.6 → 1.0.0

package/dist/chunk-JNTDSOZQ.mjs

@@ -0,0 +1,623 @@
+import { identityFingerprint, verifyTranscript, signTranscript } from './chunk-NQX3KBPW.mjs';
+import { seal, unseal, SealError } from './chunk-432SC3XS.mjs';
+import { webCryptoProvider, compareBytes, concatBytes, utf8Encode, base64Encode, base64Decode, base64UrlEncode, utf8Decode, u64be, timingSafeEqualBytes } from './chunk-3YRYO6LK.mjs';
+
+/**
+ * @agentproto/secrets v0.1.0-alpha
+ * AIP-19 SECRETS.md `defineSecrets` reference implementation.
+ */
+
+// src/pairing/derive.ts
+var PAIR_ROOT_INFO = "agentproto/pair-root";
+var RV_ROUTE_INFO = "agentproto/rv-route";
+var RV_AUTH_INFO = "agentproto/rv-auth";
+var RV_ROUTE_SALT = "agentproto/rv-route-salt";
+var RV_AUTH_SALT = "agentproto/rv-auth-salt";
+var OFFER_SALT = "agentproto/pair-offer";
+var ROUTE_TOKEN_LEN = 16;
+var AUTH_TOKEN_LEN = 32;
+var PAIR_ROOT_LEN = 32;
+var MS_PER_DAY = 864e5;
+async function derivePairRoot(session, crypto = webCryptoProvider) {
+  const k1 = session.sendKey;
+  const k2 = session.recvKey;
+  const [lo, hi] = compareBytes(k1, k2) <= 0 ? [k1, k2] : [k2, k1];
+  const ikm = concatBytes(lo, hi);
+  const okm = await crypto.hkdfSha256(ikm, session.transcriptHash, utf8Encode(PAIR_ROOT_INFO), PAIR_ROOT_LEN);
+  return base64Encode(okm);
+}
+function currentEpoch(now = Date.now()) {
+  return Math.floor(now / MS_PER_DAY);
+}
+async function importPairRootKey(pairRoot) {
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    Uint8Array.from(base64Decode(pairRoot)),
+    "HKDF",
+    false,
+    ["deriveBits"]
+  );
+}
+async function pairRootHkdf(pairRoot, salt, info, length, crypto) {
+  if (typeof pairRoot === "string") {
+    return crypto.hkdfSha256(base64Decode(pairRoot), salt, info, length);
+  }
+  const bits = await globalThis.crypto.subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt: Uint8Array.from(salt), info: Uint8Array.from(info) },
+    pairRoot,
+    length * 8
+  );
+  return new Uint8Array(bits);
+}
+function epochInfo(label, epoch) {
+  return concatBytes(utf8Encode(label), u64be(epoch));
+}
+async function deriveEpochRoutingToken(pairRoot, epoch, crypto = webCryptoProvider) {
+  const okm = await pairRootHkdf(
+    pairRoot,
+    utf8Encode(RV_ROUTE_SALT),
+    epochInfo(RV_ROUTE_INFO, epoch),
+    ROUTE_TOKEN_LEN,
+    crypto
+  );
+  return base64UrlEncode(okm);
+}
+async function deriveEpochAuthToken(pairRoot, epoch, crypto = webCryptoProvider) {
+  const okm = await pairRootHkdf(
+    pairRoot,
+    utf8Encode(RV_AUTH_SALT),
+    epochInfo(RV_AUTH_INFO, epoch),
+    AUTH_TOKEN_LEN,
+    crypto
+  );
+  return base64UrlEncode(okm);
+}
+async function deriveEpochTokens(pairRoot, epoch, crypto = webCryptoProvider) {
+  return {
+    route: await deriveEpochRoutingToken(pairRoot, epoch, crypto),
+    auth: await deriveEpochAuthToken(pairRoot, epoch, crypto)
+  };
+}
+async function deriveOfferTokens(offerSecret, crypto = webCryptoProvider) {
+  const ikm = utf8Encode(offerSecret);
+  const salt = utf8Encode(OFFER_SALT);
+  const route = await crypto.hkdfSha256(ikm, salt, utf8Encode(RV_ROUTE_INFO), ROUTE_TOKEN_LEN);
+  const auth = await crypto.hkdfSha256(ikm, salt, utf8Encode(RV_AUTH_INFO), AUTH_TOKEN_LEN);
+  return { route: base64UrlEncode(route), auth: base64UrlEncode(auth) };
+}
+async function epochRoutingTokens(pairRoot, now = Date.now(), crypto = webCryptoProvider) {
+  const epoch = currentEpoch(now);
+  return [
+    { epoch, ...await deriveEpochTokens(pairRoot, epoch, crypto) },
+    { epoch: epoch - 1, ...await deriveEpochTokens(pairRoot, epoch - 1, crypto) }
+  ];
+}
+
+// src/pairing/handshake.ts
+var PAIR_VERSION = 2;
+var LEGACY_PAIR_VERSION = 1;
+var PAIRING_PROTOCOL_OUTDATED_MESSAGE = "this pairing uses the retired pair/v1 protocol, which let the rendezvous broker authenticate as a client. Upgrade agentproto on both machines and re-pair: run `agentproto pair offer` on the daemon, then `agentproto pair accept` on the client";
+function hkdfInfo(version) {
+  return utf8Encode(`agentproto/pair/v${version}`);
+}
+var KEY_LEN = 32;
+var PairingError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "PairingError";
+    this.code = code;
+  }
+};
+async function x25519PublicKey(crypto, b64Der, what) {
+  const der = base64Decode(b64Der);
+  try {
+    await crypto.x25519ValidatePublicKey(der);
+  } catch {
+    throw new PairingError("invalid_key", `invalid ${what} X25519 public key`);
+  }
+  return der;
+}
+function transcriptHash(crypto, ePubB64, ct0, dePubB64) {
+  return crypto.sha256(concatBytes(base64Decode(ePubB64), utf8Encode(ct0), base64Decode(dePubB64)));
+}
+async function deriveDirectionKeys(crypto, version, ecdhEphemeral, ecdhStatic, transcript) {
+  const ikm = concatBytes(ecdhEphemeral, ecdhStatic);
+  const okm = await crypto.hkdfSha256(ikm, transcript, hkdfInfo(version), KEY_LEN * 2);
+  return {
+    kc2d: okm.subarray(0, KEY_LEN),
+    kd2c: okm.subarray(KEY_LEN, KEY_LEN * 2)
+  };
+}
+async function startClientHandshake(params, crypto = webCryptoProvider) {
+  const daemonStatic = await x25519PublicKey(crypto, params.daemonX25519Pub, "daemon");
+  const ephemeral = await crypto.x25519GenerateKeyPair();
+  const ePubB64 = base64Encode(ephemeral.publicKey);
+  const payload = {
+    clientPub: ePubB64,
+    clientName: params.clientName,
+    auth: params.authToken
+  };
+  const ct0 = await seal(JSON.stringify(payload), params.daemonX25519Pub, crypto);
+  const hello = { v: PAIR_VERSION, ePub: ePubB64, ct0 };
+  const complete = async (reply) => {
+    if (reply.v !== PAIR_VERSION) {
+      throw new PairingError("malformed_reply", `unsupported reply version ${reply.v}`);
+    }
+    const dePub = await x25519PublicKey(crypto, reply.dePub, "daemon ephemeral");
+    const transcript = await transcriptHash(crypto, ePubB64, ct0, reply.dePub);
+    if (!await verifyTranscript(params.daemonEd25519Pub, transcript, reply.sig, crypto)) {
+      throw new PairingError(
+        "bad_signature",
+        "daemon transcript signature did not verify against the offered key"
+      );
+    }
+    const ecdhEphemeral = await crypto.x25519(ephemeral.privateKey, dePub);
+    const ecdhStatic = await crypto.x25519(ephemeral.privateKey, daemonStatic);
+    const { kc2d, kd2c } = await deriveDirectionKeys(crypto, PAIR_VERSION, ecdhEphemeral, ecdhStatic, transcript);
+    return {
+      sendKey: kc2d,
+      recvKey: kd2c,
+      peerFingerprint: await identityFingerprint(params.daemonX25519Pub, crypto),
+      transcriptHash: transcript,
+      clientName: params.clientName
+    };
+  };
+  return { hello, complete };
+}
+async function openHello(crypto, ePub, ct0, identity) {
+  const clientEphemeral = await x25519PublicKey(crypto, ePub, "client ephemeral");
+  let payloadJson;
+  try {
+    payloadJson = await unseal(ct0, identity.x25519.priv, crypto);
+  } catch (err) {
+    if (err instanceof SealError) {
+      throw new PairingError(
+        "unseal_failed",
+        "could not open sealed hello \u2014 wrong daemon key or tampered ct\u2080"
+      );
+    }
+    throw err;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadJson);
+  } catch {
+    throw new PairingError("malformed_hello", "sealed hello payload was not valid JSON");
+  }
+  if (!isRecord(payload) || typeof payload["clientPub"] !== "string") {
+    throw new PairingError("malformed_hello", "sealed hello payload is missing required fields");
+  }
+  if (payload["clientPub"] !== ePub) {
+    throw new PairingError(
+      "ephemeral_mismatch",
+      "sealed clientPub does not match the hello ephemeral key"
+    );
+  }
+  return { clientEphemeral, payload };
+}
+async function completeDaemonSide(crypto, version, identity, ePub, ct0, clientEphemeral) {
+  const daemonEphemeral = await crypto.x25519GenerateKeyPair();
+  const dePubB64 = base64Encode(daemonEphemeral.publicKey);
+  const transcript = await transcriptHash(crypto, ePub, ct0, dePubB64);
+  const sig = await signTranscript(identity.ed25519.priv, transcript, crypto);
+  const daemonStaticPriv = base64Decode(identity.x25519.priv);
+  const ecdhEphemeral = await crypto.x25519(daemonEphemeral.privateKey, clientEphemeral);
+  let ecdhStatic;
+  try {
+    ecdhStatic = await crypto.x25519(daemonStaticPriv, clientEphemeral);
+  } catch {
+    throw new PairingError("invalid_key", "invalid daemon static X25519 private key");
+  }
+  const { kc2d, kd2c } = await deriveDirectionKeys(crypto, version, ecdhEphemeral, ecdhStatic, transcript);
+  return { dePub: dePubB64, sig, sendKey: kd2c, recvKey: kc2d, transcript };
+}
+async function respondToHandshake(hello, params, crypto = webCryptoProvider) {
+  if (hello.v !== PAIR_VERSION) {
+    throw new PairingError("malformed_hello", `unsupported hello version ${hello.v}`);
+  }
+  const { clientEphemeral, payload: raw } = await openHello(crypto, hello.ePub, hello.ct0, params.identity);
+  const payload = parseHelloPayload(raw);
+  if (!await params.verifyAuthToken(payload.auth)) {
+    throw new PairingError("offer_rejected", "auth token was rejected (unknown, expired, spent, or wrong)");
+  }
+  const d = await completeDaemonSide(crypto, PAIR_VERSION, params.identity, hello.ePub, hello.ct0, clientEphemeral);
+  return {
+    reply: { v: PAIR_VERSION, dePub: d.dePub, sig: d.sig },
+    session: {
+      sendKey: d.sendKey,
+      recvKey: d.recvKey,
+      peerFingerprint: await identityFingerprint(payload.clientPub, crypto),
+      transcriptHash: d.transcript,
+      clientName: payload.clientName
+    }
+  };
+}
+async function respondToLegacyHandshake(helloBytes, identity, crypto = webCryptoProvider) {
+  const parsed = parseJson(helloBytes, "malformed_hello");
+  if (!isRecord(parsed) || parsed["v"] !== LEGACY_PAIR_VERSION || typeof parsed["ePub"] !== "string" || typeof parsed["ct0"] !== "string") {
+    throw new PairingError("malformed_hello", "not a pair/v1 hello");
+  }
+  const ePub = parsed["ePub"];
+  const ct0 = parsed["ct0"];
+  const { clientEphemeral, payload } = await openHello(crypto, ePub, ct0, identity);
+  if (typeof payload["offerToken"] !== "string") {
+    throw new PairingError("malformed_hello", "not a pair/v1 hello payload");
+  }
+  const d = await completeDaemonSide(crypto, LEGACY_PAIR_VERSION, identity, ePub, ct0, clientEphemeral);
+  return {
+    reply: utf8Encode(JSON.stringify({ v: LEGACY_PAIR_VERSION, dePub: d.dePub, sig: d.sig })),
+    keys: { sendKey: d.sendKey, recvKey: d.recvKey }
+  };
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null;
+}
+function parseHelloPayload(parsed) {
+  if (typeof parsed["clientPub"] !== "string" || typeof parsed["clientName"] !== "string" || typeof parsed["auth"] !== "string") {
+    throw new PairingError("malformed_hello", "sealed hello payload is missing required fields");
+  }
+  return {
+    clientPub: parsed["clientPub"],
+    clientName: parsed["clientName"],
+    auth: parsed["auth"]
+  };
+}
+function encodePairingMessage(message) {
+  return utf8Encode(JSON.stringify(message));
+}
+function decodePairingHello(bytes) {
+  const parsed = parseJson(bytes, "malformed_hello");
+  if (isRecord(parsed) && parsed["v"] === LEGACY_PAIR_VERSION) {
+    throw new PairingError("pairing_protocol_outdated", PAIRING_PROTOCOL_OUTDATED_MESSAGE);
+  }
+  if (!isRecord(parsed) || parsed["v"] !== PAIR_VERSION || typeof parsed["ePub"] !== "string" || typeof parsed["ct0"] !== "string") {
+    throw new PairingError("malformed_hello", "hello message is malformed");
+  }
+  return { v: PAIR_VERSION, ePub: parsed["ePub"], ct0: parsed["ct0"] };
+}
+function decodePairingReply(bytes) {
+  const parsed = parseJson(bytes, "malformed_reply");
+  if (isRecord(parsed) && parsed["v"] === LEGACY_PAIR_VERSION) {
+    throw new PairingError("pairing_protocol_outdated", PAIRING_PROTOCOL_OUTDATED_MESSAGE);
+  }
+  if (!isRecord(parsed) || parsed["v"] !== PAIR_VERSION || typeof parsed["dePub"] !== "string" || typeof parsed["sig"] !== "string") {
+    throw new PairingError("malformed_reply", "reply message is malformed");
+  }
+  return { v: PAIR_VERSION, dePub: parsed["dePub"], sig: parsed["sig"] };
+}
+function parseJson(bytes, code) {
+  try {
+    return JSON.parse(utf8Decode(bytes));
+  } catch {
+    throw new PairingError(code, "message was not valid JSON (truncated or corrupt)");
+  }
+}
+
+// src/pairing/offer-url.ts
+var OFFER_URL_SCHEME = "agentproto:";
+var OFFER_URL_HOST = "pair";
+var OFFER_VERSION = 2;
+var PAIR_WEB_URL = "https://cli.agentproto.sh/pair";
+var PAIR_PAGE_FP_PLACEHOLDER = "{fp}";
+var PAIR_WEB_URL_TEMPLATE_CLOUD = "https://{fp}.agentproto.cloud/pair";
+var DEFAULT_PAIR_PAGE = PAIR_WEB_URL_TEMPLATE_CLOUD;
+function b64ToB64url(b64) {
+  return b64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlToB64(b64url) {
+  const replaced = b64url.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = replaced.length % 4;
+  return pad === 0 ? replaced : replaced + "=".repeat(4 - pad);
+}
+function isB64url(s) {
+  return s.length > 0 && /^[A-Za-z0-9_-]+$/.test(s);
+}
+function encodeOfferUrl(offer) {
+  const params = new URLSearchParams();
+  params.set("v", String(OFFER_VERSION));
+  params.set("rv", offer.rendezvousUrl);
+  params.set("id", offer.fingerprint);
+  params.set("pk", b64ToB64url(offer.daemonX25519Pub));
+  params.set("sk", b64ToB64url(offer.daemonEd25519Pub));
+  params.set("s", offer.secret);
+  params.set("exp", String(offer.exp));
+  return `${OFFER_URL_SCHEME}//${OFFER_URL_HOST}?${params.toString()}`;
+}
+var DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function badPage(message) {
+  return new PairingError("malformed_offer", `pair page: ${message}`);
+}
+function resolvePairPageUrl(templateOrUrl, fingerprint) {
+  let resolved = templateOrUrl;
+  if (templateOrUrl.includes(PAIR_PAGE_FP_PLACEHOLDER)) {
+    const m = /^(https?:\/\/)([^/?#]*)(.*)$/i.exec(templateOrUrl);
+    if (!m) throw badPage("a {fp} template must be an http(s) URL");
+    const [, scheme, authority, rest] = m;
+    if (rest.includes(PAIR_PAGE_FP_PLACEHOLDER)) {
+      throw badPage("{fp} is only allowed in the hostname");
+    }
+    if (authority.includes("@")) throw badPage("userinfo is not allowed in a pair page URL");
+    const colon = authority.lastIndexOf(":");
+    const port = colon >= 0 && !authority.includes("]") ? authority.slice(colon) : "";
+    if (port.includes(PAIR_PAGE_FP_PLACEHOLDER)) throw badPage("{fp} is only allowed in the hostname");
+    const fp = fingerprint.toLowerCase();
+    if (!/^[0-9a-f]+$/.test(fp) || !DNS_LABEL.test(fp)) {
+      throw badPage(`daemon fingerprint "${fingerprint}" is not a valid DNS label`);
+    }
+    resolved = `${scheme}${authority.split(PAIR_PAGE_FP_PLACEHOLDER).join(fp)}${rest}`;
+  }
+  if (/[{}]/.test(resolved)) {
+    throw badPage("unknown placeholder (only {fp}, in the hostname, is supported)");
+  }
+  let page;
+  try {
+    page = new URL(resolved);
+  } catch {
+    throw badPage("not a valid URL");
+  }
+  if (page.protocol !== "https:" && page.protocol !== "http:" || page.hash !== "" || resolved.includes("#")) {
+    throw badPage("must be an http(s) URL without a fragment");
+  }
+  return resolved;
+}
+function expectedPairHost(templateOrUrl, fingerprint) {
+  return new URL(resolvePairPageUrl(templateOrUrl, fingerprint)).host;
+}
+function encodeOfferWebUrl(offerUrl, pageUrl = DEFAULT_PAIR_PAGE) {
+  const q = offerUrl.indexOf("?");
+  if (!offerUrl.startsWith(`${OFFER_URL_SCHEME}//${OFFER_URL_HOST}?`) || q < 0) {
+    throw new PairingError("malformed_offer", `expected an ${OFFER_URL_SCHEME}//${OFFER_URL_HOST}?\u2026 offer URL`);
+  }
+  const query = offerUrl.slice(q + 1);
+  const fingerprint = new URLSearchParams(query).get("id") ?? "";
+  if (pageUrl.includes(PAIR_PAGE_FP_PLACEHOLDER) && !fingerprint) {
+    throw new PairingError("malformed_offer", "offer has no daemon fingerprint (`id`) for the {fp} pair page");
+  }
+  return `${resolvePairPageUrl(pageUrl, fingerprint)}#${query}`;
+}
+function fromWebForm(url) {
+  if (!/^https?:\/\//i.test(url)) return url;
+  const hash = url.indexOf("#");
+  if (hash < 0 || hash === url.length - 1) {
+    throw new PairingError("malformed_offer", "web offer URL carries no offer in its fragment");
+  }
+  return `${OFFER_URL_SCHEME}//${OFFER_URL_HOST}?${url.slice(hash + 1)}`;
+}
+async function parseOfferUrl(url, opts = {}, crypto = webCryptoProvider) {
+  let parsed;
+  try {
+    parsed = new URL(fromWebForm(url));
+  } catch {
+    throw new PairingError("malformed_offer", "offer is not a valid URL");
+  }
+  if (parsed.protocol !== OFFER_URL_SCHEME) {
+    throw new PairingError(
+      "malformed_offer",
+      `offer scheme must be "${OFFER_URL_SCHEME}//" (got "${parsed.protocol}//")`
+    );
+  }
+  const host = parsed.host || parsed.pathname.replace(/^\/+/, "");
+  if (host !== OFFER_URL_HOST) {
+    throw new PairingError("malformed_offer", `offer host must be "${OFFER_URL_HOST}"`);
+  }
+  const q = parsed.searchParams;
+  const v = q.get("v");
+  if (v === "1") {
+    throw new PairingError(
+      "pairing_protocol_outdated",
+      "this offer uses the retired pair/v1 protocol, which let the rendezvous broker authenticate as a client. Upgrade agentproto on the daemon and mint a new offer: run `agentproto pair offer`"
+    );
+  }
+  if (v !== String(OFFER_VERSION)) {
+    throw new PairingError("malformed_offer", `unsupported offer version "${v ?? "(absent)"}"`);
+  }
+  const rendezvousUrl = req(q, "rv");
+  let rvParsed;
+  try {
+    rvParsed = new URL(rendezvousUrl);
+  } catch {
+    throw new PairingError("malformed_offer", "offer `rv` is not a valid URL");
+  }
+  if (rvParsed.protocol !== "ws:" && rvParsed.protocol !== "wss:") {
+    throw new PairingError("malformed_offer", "offer `rv` must be a ws:// or wss:// URL");
+  }
+  const fingerprint = req(q, "id");
+  if (!/^[0-9a-f]{32}$/.test(fingerprint)) {
+    throw new PairingError("malformed_offer", "offer `id` is not a 32-hex fingerprint");
+  }
+  const pkUrl = req(q, "pk");
+  const skUrl = req(q, "sk");
+  if (!isB64url(pkUrl) || !isB64url(skUrl)) {
+    throw new PairingError("malformed_offer", "offer `pk`/`sk` must be base64url");
+  }
+  const daemonX25519Pub = b64urlToB64(pkUrl);
+  const daemonEd25519Pub = b64urlToB64(skUrl);
+  const secret = req(q, "s");
+  if (!isB64url(secret)) {
+    throw new PairingError("malformed_offer", "offer `s` (secret) must be base64url");
+  }
+  const expRaw = req(q, "exp");
+  const exp = Number(expRaw);
+  if (!Number.isInteger(exp) || exp <= 0) {
+    throw new PairingError("malformed_offer", "offer `exp` is not a positive unix timestamp");
+  }
+  if (await identityFingerprint(daemonX25519Pub, crypto) !== fingerprint) {
+    throw new PairingError(
+      "malformed_offer",
+      "offer `id` does not match fingerprint(pk) \u2014 tampered or corrupt offer"
+    );
+  }
+  if (opts.now !== void 0 && exp * 1e3 <= opts.now) {
+    throw new PairingError("offer_expired", "offer has expired");
+  }
+  return {
+    v: OFFER_VERSION,
+    rendezvousUrl,
+    fingerprint,
+    daemonX25519Pub,
+    daemonEd25519Pub,
+    secret,
+    exp
+  };
+}
+function req(q, key) {
+  const v = q.get(key);
+  if (v === null || v === "") {
+    throw new PairingError("malformed_offer", `offer is missing required param "${key}"`);
+  }
+  return v;
+}
+
+// src/pairing/tunnel-handshake.ts
+var TUNNEL_E2E_VERSION = 1;
+var SESSION_INFO = "agentproto/tunnel-e2e/v1";
+var AUTH_INFO = "agentproto/tunnel-e2e/auth/v1";
+var OFFER_MAC_LABEL = "offer/v1";
+var ACCEPT_MAC_LABEL = "accept/v1";
+var KEY_LEN2 = 32;
+var AUTH_KEY_LEN = 32;
+var TunnelHandshakeError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "TunnelHandshakeError";
+    this.code = code;
+  }
+};
+function tokenSalt(crypto, token) {
+  return crypto.sha256(utf8Encode(token));
+}
+function deriveAuthKey(crypto, token, salt) {
+  return crypto.hkdfSha256(utf8Encode(token), salt, utf8Encode(AUTH_INFO), AUTH_KEY_LEN);
+}
+function computeMac(crypto, authKey, label, ...parts) {
+  return crypto.hmacSha256(authKey, concatBytes(utf8Encode(label), ...parts));
+}
+function macMatches(expected, receivedB64) {
+  return timingSafeEqualBytes(base64Decode(receivedB64), expected);
+}
+async function x25519PublicKey2(crypto, b64Der) {
+  const der = base64Decode(b64Der);
+  try {
+    await crypto.x25519ValidatePublicKey(der);
+  } catch {
+    throw new TunnelHandshakeError("invalid_key", "peer ephemeral X25519 public key is invalid");
+  }
+  return der;
+}
+function transcriptHash2(crypto, ePubDRaw, ePubHRaw) {
+  return crypto.sha256(concatBytes(utf8Encode(SESSION_INFO), ePubDRaw, ePubHRaw));
+}
+async function deriveDirectionKeys2(crypto, ecdh, salt) {
+  const okm = await crypto.hkdfSha256(ecdh, salt, utf8Encode(SESSION_INFO), KEY_LEN2 * 2);
+  return { kd2h: okm.subarray(0, KEY_LEN2), kh2d: okm.subarray(KEY_LEN2, KEY_LEN2 * 2) };
+}
+async function generateEphemeral(crypto) {
+  const kp = await crypto.x25519GenerateKeyPair();
+  return { priv: kp.privateKey, pubB64: base64Encode(kp.publicKey), pubRaw: kp.publicKey };
+}
+async function startTunnelHandshake(token, crypto = webCryptoProvider) {
+  const salt = await tokenSalt(crypto, token);
+  const authKey = await deriveAuthKey(crypto, token, salt);
+  const eph = await generateEphemeral(crypto);
+  const offer = {
+    v: TUNNEL_E2E_VERSION,
+    ePub: eph.pubB64,
+    mac: base64Encode(await computeMac(crypto, authKey, OFFER_MAC_LABEL, eph.pubRaw))
+  };
+  const complete = async (accept) => {
+    if (accept.v !== TUNNEL_E2E_VERSION) {
+      throw new TunnelHandshakeError(
+        "unsupported_version",
+        `unsupported accept version ${String(accept.v)}`
+      );
+    }
+    const hostPubRaw = await x25519PublicKey2(crypto, accept.ePub);
+    const expected = await computeMac(crypto, authKey, ACCEPT_MAC_LABEL, eph.pubRaw, hostPubRaw);
+    if (!macMatches(expected, accept.mac)) {
+      throw new TunnelHandshakeError(
+        "bad_auth",
+        "host accept did not authenticate under the shared tunnel token"
+      );
+    }
+    const ecdh = await crypto.x25519(eph.priv, hostPubRaw);
+    const { kd2h, kh2d } = await deriveDirectionKeys2(crypto, ecdh, salt);
+    return {
+      // Daemon SENDS daemon→host (kd2h) and RECEIVES host→daemon (kh2d).
+      sendKey: kd2h,
+      recvKey: kh2d,
+      transcriptHash: await transcriptHash2(crypto, eph.pubRaw, hostPubRaw)
+    };
+  };
+  return { offer, complete };
+}
+async function respondToTunnelHandshake(offer, token, crypto = webCryptoProvider) {
+  if (offer.v !== TUNNEL_E2E_VERSION) {
+    throw new TunnelHandshakeError(
+      "unsupported_version",
+      `unsupported offer version ${String(offer.v)}`
+    );
+  }
+  const salt = await tokenSalt(crypto, token);
+  const authKey = await deriveAuthKey(crypto, token, salt);
+  const daemonPubRaw = await x25519PublicKey2(crypto, offer.ePub);
+  const expected = await computeMac(crypto, authKey, OFFER_MAC_LABEL, daemonPubRaw);
+  if (!macMatches(expected, offer.mac)) {
+    throw new TunnelHandshakeError(
+      "bad_auth",
+      "daemon offer did not authenticate under the shared tunnel token"
+    );
+  }
+  const eph = await generateEphemeral(crypto);
+  const accept = {
+    v: TUNNEL_E2E_VERSION,
+    ePub: eph.pubB64,
+    mac: base64Encode(await computeMac(crypto, authKey, ACCEPT_MAC_LABEL, daemonPubRaw, eph.pubRaw))
+  };
+  const ecdh = await crypto.x25519(eph.priv, daemonPubRaw);
+  const { kd2h, kh2d } = await deriveDirectionKeys2(crypto, ecdh, salt);
+  return {
+    accept,
+    session: {
+      // Host SENDS host→daemon (kh2d) and RECEIVES daemon→host (kd2h).
+      sendKey: kh2d,
+      recvKey: kd2h,
+      transcriptHash: await transcriptHash2(crypto, daemonPubRaw, eph.pubRaw)
+    }
+  };
+}
+function isRecord2(v) {
+  return typeof v === "object" && v !== null;
+}
+function encodeTunnelMessage(message) {
+  return utf8Encode(JSON.stringify(message));
+}
+function parseJson2(bytes, code) {
+  try {
+    return JSON.parse(utf8Decode(bytes));
+  } catch {
+    throw new TunnelHandshakeError(code, "message was not valid JSON (truncated or corrupt)");
+  }
+}
+function decodeTunnelOffer(bytes) {
+  const parsed = parseJson2(bytes, "malformed_offer");
+  if (!isRecord2(parsed) || parsed["v"] !== TUNNEL_E2E_VERSION || typeof parsed["ePub"] !== "string" || typeof parsed["mac"] !== "string") {
+    throw new TunnelHandshakeError("malformed_offer", "offer message is malformed");
+  }
+  return { v: TUNNEL_E2E_VERSION, ePub: parsed["ePub"], mac: parsed["mac"] };
+}
+function decodeTunnelAccept(bytes) {
+  const parsed = parseJson2(bytes, "malformed_accept");
+  if (!isRecord2(parsed) || parsed["v"] !== TUNNEL_E2E_VERSION || typeof parsed["ePub"] !== "string" || typeof parsed["mac"] !== "string") {
+    throw new TunnelHandshakeError("malformed_accept", "accept message is malformed");
+  }
+  return { v: TUNNEL_E2E_VERSION, ePub: parsed["ePub"], mac: parsed["mac"] };
+}
+
+// src/pairing/rendezvous.ts
+var HOSTED_RENDEZVOUS_URL = "wss://rdv.agentproto.sh/v1";
+
+export { DEFAULT_PAIR_PAGE, HOSTED_RENDEZVOUS_URL, LEGACY_PAIR_VERSION, OFFER_URL_HOST, OFFER_URL_SCHEME, OFFER_VERSION, PAIRING_PROTOCOL_OUTDATED_MESSAGE, PAIR_PAGE_FP_PLACEHOLDER, PAIR_VERSION, PAIR_WEB_URL, PAIR_WEB_URL_TEMPLATE_CLOUD, PairingError, TUNNEL_E2E_VERSION, TunnelHandshakeError, currentEpoch, decodePairingHello, decodePairingReply, decodeTunnelAccept, decodeTunnelOffer, deriveEpochAuthToken, deriveEpochRoutingToken, deriveEpochTokens, deriveOfferTokens, derivePairRoot, encodeOfferUrl, encodeOfferWebUrl, encodePairingMessage, encodeTunnelMessage, epochRoutingTokens, expectedPairHost, importPairRootKey, parseOfferUrl, resolvePairPageUrl, respondToHandshake, respondToLegacyHandshake, respondToTunnelHandshake, startClientHandshake, startTunnelHandshake };
+//# sourceMappingURL=chunk-JNTDSOZQ.mjs.map
+//# sourceMappingURL=chunk-JNTDSOZQ.mjs.map