@awiki/anp-typescript-sdk 0.2.0

package/dist/index.js

@@ -0,0 +1,4868 @@
+import bs58 from 'bs58';
+import { randomBytes, verify, ECDH, sign, createHash, randomUUID, createPublicKey, createPrivateKey, createECDH, generateKeyPairSync } from 'crypto';
+import { x25519, ed25519 } from '@noble/curves/ed25519';
+import { isIP } from 'net';
+import canonicalize from 'canonicalize';
+import { readFile, mkdir, writeFile, rename, chmod, unlink } from 'fs/promises';
+import { jwtVerify, SignJWT, importPKCS8, importSPKI } from 'jose';
+import { dirname } from 'path';
+
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/errors/index.ts
+var ANPError = class extends Error {
+  constructor(message, code, cause) {
+    super(message, { cause });
+    this.code = code;
+    this.name = "ANPError";
+  }
+};
+var CryptoError = class extends ANPError {
+  constructor(message, cause) {
+    super(message, "CRYPTO_ERROR", cause);
+    this.name = "CryptoError";
+  }
+};
+var AuthenticationError = class extends ANPError {
+  constructor(message, cause) {
+    super(message, "AUTHENTICATION_ERROR", cause);
+    this.name = "AuthenticationError";
+  }
+};
+var ProofError = class extends ANPError {
+  constructor(message, cause) {
+    super(message, "PROOF_ERROR", cause);
+    this.name = "ProofError";
+  }
+};
+var NetworkError = class extends ANPError {
+  constructor(message, statusCode, cause) {
+    super(message, "NETWORK_ERROR", cause);
+    this.statusCode = statusCode;
+    this.name = "NetworkError";
+  }
+};
+var WnsError = class extends ANPError {
+  constructor(message, code = "WNS_ERROR", cause) {
+    super(message, code, cause);
+    this.name = "WnsError";
+  }
+};
+var HandleValidationError = class extends WnsError {
+  constructor(message) {
+    super(message, "HANDLE_VALIDATION_ERROR");
+    this.name = "HandleValidationError";
+  }
+};
+var HandleResolutionError = class extends WnsError {
+  constructor(message, statusCode, cause) {
+    super(message, "HANDLE_RESOLUTION_ERROR", cause);
+    this.statusCode = statusCode;
+    this.name = "HandleResolutionError";
+  }
+};
+var HandleNotFoundError = class extends HandleResolutionError {
+  constructor(message) {
+    super(message, 404);
+    this.name = "HandleNotFoundError";
+  }
+};
+var HandleGoneError = class extends HandleResolutionError {
+  constructor(message) {
+    super(message, 410);
+    this.name = "HandleGoneError";
+  }
+};
+var HandleMovedError = class extends HandleResolutionError {
+  constructor(message, redirectUrl = "") {
+    super(message, 301);
+    this.redirectUrl = redirectUrl;
+    this.name = "HandleMovedError";
+  }
+};
+var HandleBindingError = class extends WnsError {
+  constructor(message) {
+    super(message, "HANDLE_BINDING_ERROR");
+    this.name = "HandleBindingError";
+  }
+};
+var WbaUriParseError = class extends WnsError {
+  constructor(message) {
+    super(message, "WBA_URI_PARSE_ERROR");
+    this.name = "WbaUriParseError";
+  }
+};
+
+// src/authentication/types.ts
+var DidProfile = /* @__PURE__ */ ((DidProfile2) => {
+  DidProfile2["E1"] = "e1";
+  DidProfile2["K1"] = "k1";
+  DidProfile2["PlainLegacy"] = "plain_legacy";
+  return DidProfile2;
+})(DidProfile || {});
+var AuthMode = /* @__PURE__ */ ((AuthMode2) => {
+  AuthMode2["HttpSignatures"] = "http_signatures";
+  AuthMode2["LegacyDidWba"] = "legacy_didwba";
+  AuthMode2["Auto"] = "auto";
+  return AuthMode2;
+})(AuthMode || {});
+
+// src/internal/base64.ts
+function encodeBase64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function decodeBase64Url(value) {
+  return new Uint8Array(Buffer.from(value, "base64url"));
+}
+function encodeBase64(value) {
+  return Buffer.from(value).toString("base64");
+}
+function decodeBase64(value) {
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+
+// src/internal/pem.ts
+var PEM_LINE_LENGTH = 64;
+function encodePem(label, bytes) {
+  const encoded = encodeBase64(bytes);
+  const lines = [];
+  for (let index = 0; index < encoded.length; index += PEM_LINE_LENGTH) {
+    lines.push(encoded.slice(index, index + PEM_LINE_LENGTH));
+  }
+  return `-----BEGIN ${label}-----
+${lines.join("\n")}
+-----END ${label}-----
+`;
+}
+function decodePem(input) {
+  const lines = input.trim().split(/\r?\n/);
+  if (lines.length < 3) {
+    throw new Error("Invalid PEM structure");
+  }
+  const beginLine = lines[0];
+  const endLine = lines.at(-1);
+  if (!beginLine.startsWith("-----BEGIN ") || !beginLine.endsWith("-----")) {
+    throw new Error("Invalid PEM structure");
+  }
+  const label = beginLine.slice("-----BEGIN ".length, -"-----".length);
+  if (endLine !== `-----END ${label}-----`) {
+    throw new Error("Invalid PEM structure");
+  }
+  const body = lines.slice(1, -1).join("");
+  return {
+    label,
+    bytes: decodeBase64(body)
+  };
+}
+
+// src/internal/keys.ts
+var PRIVATE_LABELS = {
+  secp256k1: "ANP SECP256K1 PRIVATE KEY",
+  secp256r1: "ANP SECP256R1 PRIVATE KEY",
+  ed25519: "ANP ED25519 PRIVATE KEY",
+  x25519: "ANP X25519 PRIVATE KEY"
+};
+var PUBLIC_LABELS = {
+  secp256k1: "ANP SECP256K1 PUBLIC KEY",
+  secp256r1: "ANP SECP256R1 PUBLIC KEY",
+  ed25519: "ANP ED25519 PUBLIC KEY",
+  x25519: "ANP X25519 PUBLIC KEY"
+};
+var EC_CURVES = {
+  secp256k1: "secp256k1",
+  secp256r1: "prime256v1"
+};
+function sha256(value) {
+  return new Uint8Array(createHash("sha256").update(value).digest());
+}
+function normalizePrivateKeyMaterial(input) {
+  return typeof input === "string" ? privateKeyFromPem(input) : input;
+}
+function normalizePublicKeyMaterial(input) {
+  return typeof input === "string" ? publicKeyFromPem(input) : input;
+}
+function generatePrivateKeyMaterial(type) {
+  switch (type) {
+    case "secp256k1": {
+      const { privateKey } = generateKeyPairSync("ec", { namedCurve: "secp256k1" });
+      const jwk = privateKey.export({ format: "jwk" });
+      return { type, bytes: requireBase64UrlBytes(jwk.d, "Missing secp256k1 private key") };
+    }
+    case "secp256r1": {
+      const { privateKey } = generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+      const jwk = privateKey.export({ format: "jwk" });
+      return { type, bytes: requireBase64UrlBytes(jwk.d, "Missing secp256r1 private key") };
+    }
+    case "ed25519": {
+      const { privateKey } = generateKeyPairSync("ed25519");
+      const jwk = privateKey.export({ format: "jwk" });
+      return { type, bytes: requireBase64UrlBytes(jwk.d, "Missing ed25519 private key") };
+    }
+    case "x25519": {
+      const { privateKey } = generateKeyPairSync("x25519");
+      const jwk = privateKey.export({ format: "jwk" });
+      return { type, bytes: requireBase64UrlBytes(jwk.d, "Missing x25519 private key") };
+    }
+    default:
+      throw new CryptoError(`Unsupported key type: ${String(type)}`);
+  }
+}
+function derivePublicKey(privateKey) {
+  switch (privateKey.type) {
+    case "secp256k1":
+    case "secp256r1": {
+      const ecdh = createECDH(EC_CURVES[privateKey.type]);
+      ecdh.setPrivateKey(Buffer.from(privateKey.bytes));
+      return {
+        type: privateKey.type,
+        bytes: new Uint8Array(ecdh.getPublicKey(void 0, "compressed"))
+      };
+    }
+    case "ed25519":
+      return { type: "ed25519", bytes: ed25519.getPublicKey(privateKey.bytes) };
+    case "x25519":
+      return { type: "x25519", bytes: x25519.getPublicKey(privateKey.bytes) };
+    default:
+      throw new CryptoError(`Unsupported key type: ${String(privateKey.type)}`);
+  }
+}
+function generateKeyPairPem(type) {
+  const privateKey = generatePrivateKeyMaterial(type);
+  const publicKey = derivePublicKey(privateKey);
+  return {
+    privateKey,
+    publicKey,
+    pair: {
+      privateKeyPem: privateKeyToPem(privateKey),
+      publicKeyPem: publicKeyToPem(publicKey)
+    }
+  };
+}
+function privateKeyToPem(privateKey) {
+  return encodePem(PRIVATE_LABELS[privateKey.type], privateKey.bytes);
+}
+function publicKeyToPem(publicKey) {
+  return encodePem(PUBLIC_LABELS[publicKey.type], publicKey.bytes);
+}
+function privateKeyFromPem(input) {
+  const decoded = decodePem(input);
+  return { type: keyTypeFromLabel(decoded.label, true), bytes: decoded.bytes };
+}
+function publicKeyFromPem(input) {
+  const decoded = decodePem(input);
+  return { type: keyTypeFromLabel(decoded.label, false), bytes: decoded.bytes };
+}
+function signMessage(privateKey, message) {
+  const keyObject = toPrivateKeyObject(privateKey);
+  switch (privateKey.type) {
+    case "secp256k1":
+    case "secp256r1":
+      return new Uint8Array(
+        sign("sha256", Buffer.from(message), {
+          key: keyObject,
+          dsaEncoding: "ieee-p1363"
+        })
+      );
+    case "ed25519":
+      return new Uint8Array(sign(null, Buffer.from(message), keyObject));
+    case "x25519":
+      throw new CryptoError("X25519 keys cannot be used for signing");
+    default:
+      throw new CryptoError(`Unsupported key type: ${String(privateKey.type)}`);
+  }
+}
+function verifyMessage(publicKey, message, signature) {
+  const keyObject = toPublicKeyObject(publicKey);
+  switch (publicKey.type) {
+    case "secp256k1":
+    case "secp256r1":
+      return verify(
+        "sha256",
+        Buffer.from(message),
+        { key: keyObject, dsaEncoding: "ieee-p1363" },
+        Buffer.from(signature)
+      );
+    case "ed25519":
+      return verify(null, Buffer.from(message), keyObject, Buffer.from(signature));
+    case "x25519":
+      throw new CryptoError("X25519 keys cannot be used for signature verification");
+    default:
+      throw new CryptoError(`Unsupported key type: ${String(publicKey.type)}`);
+  }
+}
+function publicKeyToJwk(publicKey) {
+  switch (publicKey.type) {
+    case "secp256k1":
+    case "secp256r1": {
+      const uncompressed = new Uint8Array(
+        ECDH.convertKey(
+          Buffer.from(publicKey.bytes),
+          EC_CURVES[publicKey.type],
+          void 0,
+          void 0,
+          "uncompressed"
+        )
+      );
+      if (uncompressed.length !== 65 || uncompressed[0] !== 4) {
+        throw new AuthenticationError("Invalid EC public key");
+      }
+      return {
+        kty: "EC",
+        crv: publicKey.type === "secp256k1" ? "secp256k1" : "P-256",
+        x: encodeBase64Url(uncompressed.slice(1, 33)),
+        y: encodeBase64Url(uncompressed.slice(33, 65))
+      };
+    }
+    case "ed25519":
+      return { kty: "OKP", crv: "Ed25519", x: encodeBase64Url(publicKey.bytes) };
+    case "x25519":
+      return { kty: "OKP", crv: "X25519", x: encodeBase64Url(publicKey.bytes) };
+    default:
+      throw new AuthenticationError("Unsupported public key type");
+  }
+}
+function computeJwkThumbprint(jwk) {
+  const ordered = Object.keys(jwk).sort().reduce((result, key) => {
+    const value = jwk[key];
+    if (typeof value === "string") {
+      result[key] = value;
+    }
+    return result;
+  }, {});
+  return encodeBase64Url(sha256(new TextEncoder().encode(JSON.stringify(ordered))));
+}
+function ed25519PublicKeyToMultibase(publicKey) {
+  return `z${bs58.encode(Buffer.concat([Buffer.from([237, 1]), Buffer.from(publicKey)]))}`;
+}
+function x25519PublicKeyToMultibase(publicKey) {
+  return `z${bs58.encode(Buffer.concat([Buffer.from([236, 1]), Buffer.from(publicKey)]))}`;
+}
+function parseEd25519Multibase(value) {
+  const bytes = bs58.decode(stripMultibasePrefix(value));
+  const normalized = bytes.length === 34 && bytes[0] === 237 && bytes[1] === 1 ? bytes.slice(2) : bytes;
+  if (normalized.length !== 32) {
+    throw new AuthenticationError("Invalid Ed25519 multibase value");
+  }
+  return { type: "ed25519", bytes: new Uint8Array(normalized) };
+}
+function parseX25519Multibase(value) {
+  const bytes = bs58.decode(stripMultibasePrefix(value));
+  const normalized = bytes.length === 34 && bytes[0] === 236 && bytes[1] === 1 ? bytes.slice(2) : bytes;
+  if (normalized.length !== 32) {
+    throw new AuthenticationError("Invalid X25519 multibase value");
+  }
+  return { type: "x25519", bytes: new Uint8Array(normalized) };
+}
+function publicKeyFromJwk(jwk) {
+  if (jwk.kty === "EC" && jwk.x && jwk.y) {
+    const curve = jwk.crv;
+    if (curve !== "secp256k1" && curve !== "P-256") {
+      throw new AuthenticationError(`Unsupported EC curve: ${curve}`);
+    }
+    const keySize = 32;
+    const uncompressed = Buffer.concat([
+      Buffer.from([4]),
+      leftPadCoordinate(decodeBase64Url(jwk.x), keySize),
+      leftPadCoordinate(decodeBase64Url(jwk.y), keySize)
+    ]);
+    const bytes = new Uint8Array(
+      ECDH.convertKey(
+        uncompressed,
+        curve === "secp256k1" ? "secp256k1" : "prime256v1",
+        void 0,
+        void 0,
+        "compressed"
+      )
+    );
+    return { type: curve === "secp256k1" ? "secp256k1" : "secp256r1", bytes };
+  }
+  if (jwk.kty === "OKP" && jwk.x) {
+    if (jwk.crv === "Ed25519") {
+      return { type: "ed25519", bytes: decodeBase64Url(jwk.x) };
+    }
+    if (jwk.crv === "X25519") {
+      return { type: "x25519", bytes: decodeBase64Url(jwk.x) };
+    }
+  }
+  throw new AuthenticationError("Unsupported JWK key material");
+}
+function leftPadCoordinate(value, size) {
+  if (value.length > size) {
+    throw new AuthenticationError("Invalid EC public key coordinate length");
+  }
+  if (value.length === size) {
+    return Buffer.from(value);
+  }
+  return Buffer.concat([Buffer.alloc(size - value.length), Buffer.from(value)]);
+}
+function toPrivateKeyObject(privateKey) {
+  switch (privateKey.type) {
+    case "secp256k1":
+    case "secp256r1": {
+      const ecdh = createECDH(EC_CURVES[privateKey.type]);
+      ecdh.setPrivateKey(Buffer.from(privateKey.bytes));
+      const publicKey = new Uint8Array(ecdh.getPublicKey(void 0, "uncompressed"));
+      return createPrivateKey({
+        key: {
+          kty: "EC",
+          crv: privateKey.type === "secp256k1" ? "secp256k1" : "P-256",
+          d: encodeBase64Url(privateKey.bytes),
+          x: encodeBase64Url(publicKey.slice(1, 33)),
+          y: encodeBase64Url(publicKey.slice(33, 65))
+        },
+        format: "jwk"
+      });
+    }
+    case "ed25519": {
+      const publicKey = ed25519.getPublicKey(privateKey.bytes);
+      return createPrivateKey({
+        key: {
+          kty: "OKP",
+          crv: "Ed25519",
+          d: encodeBase64Url(privateKey.bytes),
+          x: encodeBase64Url(publicKey)
+        },
+        format: "jwk"
+      });
+    }
+    case "x25519": {
+      const publicKey = x25519.getPublicKey(privateKey.bytes);
+      return createPrivateKey({
+        key: {
+          kty: "OKP",
+          crv: "X25519",
+          d: encodeBase64Url(privateKey.bytes),
+          x: encodeBase64Url(publicKey)
+        },
+        format: "jwk"
+      });
+    }
+    default:
+      throw new CryptoError(`Unsupported key type: ${String(privateKey.type)}`);
+  }
+}
+function toPublicKeyObject(publicKey) {
+  return createPublicKey({
+    key: publicKeyToJwk(publicKey),
+    format: "jwk"
+  });
+}
+function keyTypeFromLabel(label, isPrivate) {
+  const source = isPrivate ? PRIVATE_LABELS : PUBLIC_LABELS;
+  for (const [type, candidate] of Object.entries(source)) {
+    if (candidate === label) {
+      return type;
+    }
+  }
+  throw new AuthenticationError(`Unsupported PEM label: ${label}`);
+}
+function requireBase64UrlBytes(value, message) {
+  if (!value) {
+    throw new AuthenticationError(message);
+  }
+  return decodeBase64Url(value);
+}
+function stripMultibasePrefix(value) {
+  return value.startsWith("z") ? value.slice(1) : value;
+}
+
+// src/authentication/verification-methods.ts
+var VerificationMethod = class {
+  constructor(id, methodType, publicKey) {
+    this.id = id;
+    this.methodType = methodType;
+    this.publicKey = publicKey;
+  }
+  verifySignature(content, signature) {
+    return verifyMessage(this.publicKey, content, decodeBase64Url(signature));
+  }
+  encodeSignature(signatureBytes) {
+    if (this.publicKey.type === "x25519") {
+      throw new AuthenticationError("X25519 cannot encode signatures");
+    }
+    return encodeBase64Url(signatureBytes);
+  }
+};
+function createVerificationMethod(method) {
+  if (!method.type) {
+    throw new AuthenticationError("Missing verification method type");
+  }
+  return new VerificationMethod(method.id ?? "", method.type, extractPublicKey(method));
+}
+function extractPublicKey(method) {
+  switch (method.type) {
+    case "EcdsaSecp256k1VerificationKey2019":
+      return extractEcPublicKey(method, "secp256k1");
+    case "EcdsaSecp256r1VerificationKey2019":
+      return extractEcPublicKey(method, "P-256");
+    case "Ed25519VerificationKey2018":
+    case "Ed25519VerificationKey2020":
+    case "Multikey":
+      return extractEd25519PublicKey(method);
+    case "X25519KeyAgreementKey2019":
+      return extractX25519PublicKey(method);
+    case "JsonWebKey2020":
+      if (!method.publicKeyJwk) {
+        throw new AuthenticationError("Missing key material");
+      }
+      return publicKeyFromJwk(method.publicKeyJwk);
+    default:
+      throw new AuthenticationError(`Unsupported verification method type: ${method.type}`);
+  }
+}
+function extractEcPublicKey(method, expectedCurve) {
+  if (method.publicKeyJwk) {
+    const publicKey = publicKeyFromJwk(method.publicKeyJwk);
+    const actualCurve = publicKey.type === "secp256k1" ? "secp256k1" : "P-256";
+    if (actualCurve !== expectedCurve) {
+      throw new AuthenticationError("Invalid JWK parameters");
+    }
+    return publicKey;
+  }
+  if (method.publicKeyMultibase) {
+    return {
+      type: expectedCurve === "secp256k1" ? "secp256k1" : "secp256r1",
+      bytes: new Uint8Array(bs58.decode(stripMultibasePrefix2(method.publicKeyMultibase)))
+    };
+  }
+  throw new AuthenticationError("Missing key material");
+}
+function extractEd25519PublicKey(method) {
+  if (method.publicKeyJwk) {
+    return publicKeyFromJwk(method.publicKeyJwk);
+  }
+  if (method.publicKeyMultibase) {
+    return parseEd25519Multibase(method.publicKeyMultibase);
+  }
+  if (method.publicKeyBase58) {
+    const bytes = bs58.decode(method.publicKeyBase58);
+    if (bytes.length !== 32) {
+      throw new AuthenticationError("Invalid Ed25519 publicKeyBase58");
+    }
+    return {
+      type: "ed25519",
+      bytes: new Uint8Array(bytes)
+    };
+  }
+  throw new AuthenticationError("Missing key material");
+}
+function extractX25519PublicKey(method) {
+  if (!method.publicKeyMultibase) {
+    throw new AuthenticationError("Missing key material");
+  }
+  return parseX25519Multibase(method.publicKeyMultibase);
+}
+function stripMultibasePrefix2(value) {
+  return value.startsWith("z") ? value.slice(1) : value;
+}
+function canonicalizeJson(value) {
+  const output = canonicalize(value);
+  if (output === void 0) {
+    throw new Error("Failed to canonicalize JSON value");
+  }
+  return new TextEncoder().encode(output);
+}
+function cloneJson(value) {
+  return structuredClone(value);
+}
+
+// src/proof/proof.ts
+var PROOF_TYPE_SECP256K1 = "EcdsaSecp256k1Signature2019";
+var PROOF_TYPE_ED25519 = "Ed25519Signature2020";
+var PROOF_TYPE_DATA_INTEGRITY = "DataIntegrityProof";
+var CRYPTOSUITE_EDDSA_JCS_2022 = "eddsa-jcs-2022";
+var CRYPTOSUITE_DIDWBA_SECP256K1_2025 = "didwba-jcs-ecdsa-secp256k1-2025";
+function generateW3cProof(document, privateKeyInput, verificationMethod, options = {}) {
+  const privateKey = normalizePrivateKeyMaterial(privateKeyInput);
+  const proofType = options.proofType ?? inferProofType(privateKey.type);
+  validateProofCompatibility(privateKey.type, proofType, options.cryptosuite);
+  const proof2 = {
+    type: proofType,
+    created: options.created ?? (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+    verificationMethod,
+    proofPurpose: options.proofPurpose ?? "assertionMethod",
+    proofValue: ""
+  };
+  if (proofType === PROOF_TYPE_DATA_INTEGRITY) {
+    proof2.cryptosuite = options.cryptosuite ?? inferCryptosuite(privateKey.type);
+  }
+  if (options.domain) {
+    proof2.domain = options.domain;
+  }
+  if (options.challenge) {
+    proof2.challenge = options.challenge;
+  }
+  const signingDocument = cloneJson(document);
+  delete signingDocument.proof;
+  const signingInput = computeSigningInput(signingDocument, omitProofValue(proof2));
+  proof2.proofValue = encodeBase64Url(signMessage(privateKey, signingInput));
+  return {
+    ...cloneJson(document),
+    proof: proof2
+  };
+}
+function verifyW3cProof(document, publicKeyInput, options = {}) {
+  try {
+    verifyW3cProofDetailed(document, publicKeyInput, options);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function verifyW3cProofDetailed(document, publicKeyInput, options = {}) {
+  const publicKey = normalizePublicKeyMaterial(publicKeyInput);
+  const proof2 = document.proof;
+  if (!proof2 || typeof proof2 !== "object") {
+    throw new ProofError("Missing proof object");
+  }
+  const proofObject = proof2;
+  const proofType = requireStringField(proofObject, "type");
+  const proofValue = requireStringField(proofObject, "proofValue");
+  const proofPurpose = requireStringField(proofObject, "proofPurpose");
+  requireStringField(proofObject, "verificationMethod");
+  requireStringField(proofObject, "created");
+  validatePublicKeyCompatibility(publicKey.type, proofType, proofObject.cryptosuite);
+  if (options.expectedPurpose && options.expectedPurpose !== proofPurpose) {
+    throw new ProofError("Verification failed: proofPurpose mismatch");
+  }
+  if (options.expectedDomain && proofObject.domain !== options.expectedDomain) {
+    throw new ProofError("Verification failed: domain mismatch");
+  }
+  if (options.expectedChallenge && proofObject.challenge !== options.expectedChallenge) {
+    throw new ProofError("Verification failed: challenge mismatch");
+  }
+  const signingDocument = cloneJson(document);
+  delete signingDocument.proof;
+  const signingInput = computeSigningInput(signingDocument, omitProofValue(proofObject));
+  const signature = decodeBase64Url(proofValue);
+  if (!verifyMessage(publicKey, signingInput, signature)) {
+    throw new ProofError("Verification failed");
+  }
+}
+function inferProofType(keyType) {
+  switch (keyType) {
+    case "secp256k1":
+      return PROOF_TYPE_SECP256K1;
+    case "ed25519":
+      return PROOF_TYPE_ED25519;
+    default:
+      return PROOF_TYPE_DATA_INTEGRITY;
+  }
+}
+function inferCryptosuite(keyType) {
+  switch (keyType) {
+    case "ed25519":
+      return CRYPTOSUITE_EDDSA_JCS_2022;
+    case "secp256k1":
+      return CRYPTOSUITE_DIDWBA_SECP256K1_2025;
+    default:
+      throw new ProofError(`Unsupported cryptosuite for key type: ${keyType}`);
+  }
+}
+function validateProofCompatibility(keyType, proofType, cryptosuite) {
+  if (proofType === PROOF_TYPE_SECP256K1 && keyType !== "secp256k1") {
+    throw new ProofError("Key type mismatch for secp256k1 proof generation");
+  }
+  if (proofType === PROOF_TYPE_ED25519 && keyType !== "ed25519") {
+    throw new ProofError("Key type mismatch for Ed25519 proof generation");
+  }
+  if (proofType === PROOF_TYPE_DATA_INTEGRITY && cryptosuite) {
+    validateCryptosuite(keyType, cryptosuite);
+  }
+}
+function validatePublicKeyCompatibility(keyType, proofType, cryptosuite) {
+  if (proofType === PROOF_TYPE_SECP256K1 && keyType !== "secp256k1") {
+    throw new ProofError("Invalid public key for proof verification");
+  }
+  if (proofType === PROOF_TYPE_ED25519 && keyType !== "ed25519") {
+    throw new ProofError("Invalid public key for proof verification");
+  }
+  if (proofType === PROOF_TYPE_DATA_INTEGRITY && cryptosuite) {
+    validateCryptosuite(keyType, cryptosuite);
+  }
+}
+function validateCryptosuite(keyType, cryptosuite) {
+  if (cryptosuite === CRYPTOSUITE_EDDSA_JCS_2022 && keyType !== "ed25519") {
+    throw new ProofError("Unsupported cryptosuite for non-Ed25519 key");
+  }
+  if (cryptosuite === CRYPTOSUITE_DIDWBA_SECP256K1_2025 && keyType !== "secp256k1") {
+    throw new ProofError("Unsupported cryptosuite for non-secp256k1 key");
+  }
+  if (cryptosuite !== CRYPTOSUITE_EDDSA_JCS_2022 && cryptosuite !== CRYPTOSUITE_DIDWBA_SECP256K1_2025) {
+    throw new ProofError(`Unsupported cryptosuite: ${cryptosuite}`);
+  }
+}
+function computeSigningInput(document, proofOptions) {
+  const documentHash = sha256(canonicalizeJson(document));
+  const proofHash = sha256(canonicalizeJson(proofOptions));
+  const combined = new Uint8Array(documentHash.length + proofHash.length);
+  combined.set(proofHash, 0);
+  combined.set(documentHash, proofHash.length);
+  return combined;
+}
+function omitProofValue(proof2) {
+  const clone = { ...proof2 };
+  delete clone.proofValue;
+  return clone;
+}
+function requireStringField(proof2, key) {
+  const value = proof2[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new ProofError(`Missing proof field: ${String(key)}`);
+  }
+  return value;
+}
+
+// src/authentication/did-wba.ts
+var VM_KEY_AUTH = "key-1";
+var VM_KEY_E2EE_SIGNING = "key-2";
+var VM_KEY_E2EE_AGREEMENT = "key-3";
+var ANP_MESSAGE_SERVICE_TYPE = "ANPMessageService";
+async function resolveDidWbaDocument(did, verifyProof = true, options = {}) {
+  if (!did.startsWith("did:wba:")) {
+    throw new AuthenticationError("Invalid DID format");
+  }
+  void options.verifySsl;
+  const url = buildDidResolutionUrl(did, options.baseUrlOverride);
+  const timeoutMs = Math.round((options.timeoutSeconds ?? 10) * 1e3);
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/json",
+      ...options.headers ?? {}
+    },
+    signal: AbortSignal.timeout(timeoutMs)
+  }).catch((error) => {
+    throw new NetworkError("Network failure during DID resolution", void 0, error);
+  });
+  if (!response.ok) {
+    throw new NetworkError("Network failure during DID resolution", response.status);
+  }
+  const document = await response.json();
+  if (document.id !== did) {
+    throw new AuthenticationError("Invalid DID document");
+  }
+  if (!validateDidDocumentBinding(document, verifyProof)) {
+    throw new AuthenticationError("DID binding verification failed");
+  }
+  if (verifyProof && document.proof) {
+    const verificationMethodId = document.proof.verificationMethod;
+    const method = findVerificationMethod(document, verificationMethodId);
+    if (!method) {
+      throw new AuthenticationError("Verification method not found");
+    }
+    const publicKey = extractPublicKey(method);
+    if (!verifyW3cProof(document, publicKey)) {
+      throw new AuthenticationError("Verification failed");
+    }
+  }
+  return document;
+}
+function buildAnpMessageService(didOrServiceRef, serviceEndpoint, options = {}) {
+  const fragment = options.fragment ?? "message";
+  const serviceId = didOrServiceRef.startsWith("#") || didOrServiceRef.startsWith("did:") ? didOrServiceRef.startsWith("#") ? didOrServiceRef : `${didOrServiceRef}#${fragment}` : `${didOrServiceRef}#${fragment}`;
+  const service = {
+    id: serviceId,
+    type: ANP_MESSAGE_SERVICE_TYPE,
+    serviceEndpoint
+  };
+  if (options.serviceDid) {
+    service.serviceDid = options.serviceDid;
+  }
+  if (options.profiles?.length) {
+    service.profiles = [...options.profiles];
+  }
+  if (options.securityProfiles?.length) {
+    service.securityProfiles = [...options.securityProfiles];
+  }
+  if (options.accepts?.length) {
+    service.accepts = [...options.accepts];
+  }
+  if (options.priority !== void 0) {
+    service.priority = options.priority;
+  }
+  if (options.authSchemes?.length) {
+    service.authSchemes = [...options.authSchemes];
+  }
+  return service;
+}
+function buildAgentMessageService(didOrServiceRef, serviceEndpoint, options = {}) {
+  return buildAnpMessageService(didOrServiceRef, serviceEndpoint, {
+    profiles: options.profiles ?? ["anp.core.binding.v1", "anp.direct.base.v1", "anp.direct.e2ee.v1"],
+    securityProfiles: options.securityProfiles ?? ["transport-protected", "direct-e2ee"],
+    ...options
+  });
+}
+function buildGroupMessageService(didOrServiceRef, serviceEndpoint, options = {}) {
+  return buildAnpMessageService(didOrServiceRef, serviceEndpoint, {
+    profiles: options.profiles ?? ["anp.core.binding.v1", "anp.group.base.v1", "anp.group.e2ee.v1"],
+    securityProfiles: options.securityProfiles ?? ["transport-protected", "group-e2ee"],
+    ...options
+  });
+}
+function createDidWbaDocument(hostname, options = {}) {
+  if (!hostname.trim()) {
+    throw new AuthenticationError("Hostname cannot be empty");
+  }
+  if (isIP(hostname) !== 0) {
+    throw new AuthenticationError("Hostname cannot be an IP address");
+  }
+  const didProfile = options.didProfile ?? "e1" /* E1 */;
+  const didBase = buildDidBase(hostname, options.port);
+  const pathSegments = [...options.pathSegments ?? []];
+  const contexts = ["https://www.w3.org/ns/did/v1"];
+  const verificationMethods = [];
+  const authentication2 = [];
+  const assertionMethod = [];
+  const keyAgreement = [];
+  const keys = {};
+  const authKey = generateKeyPairPem(
+    didProfile === "e1" /* E1 */ ? "ed25519" : "secp256k1"
+  );
+  const authPublicKey = authKey.publicKey;
+  let did = didBase;
+  if (didProfile === "e1" /* E1 */ && pathSegments.length > 0) {
+    pathSegments.push(`e1_${computeMultikeyFingerprint(authPublicKey)}`);
+  }
+  if (didProfile === "k1" /* K1 */ && pathSegments.length > 0) {
+    pathSegments.push(`k1_${computeJwkFingerprint(authPublicKey)}`);
+  }
+  did = joinDid(didBase, pathSegments);
+  const authVerificationMethodId = `${did}#${VM_KEY_AUTH}`;
+  const authVerificationMethod = buildAuthVerificationMethod(did, didProfile, authPublicKey, contexts);
+  verificationMethods.push(authVerificationMethod);
+  authentication2.push(authVerificationMethodId);
+  if (didProfile === "e1" /* E1 */ || didProfile === "k1" /* K1 */) {
+    assertionMethod.push(authVerificationMethodId);
+  }
+  keys[VM_KEY_AUTH] = authKey.pair;
+  if (options.enableE2ee !== false) {
+    contexts.push("https://w3id.org/security/suites/x25519-2019/v1");
+    const signingKey = generateKeyPairPem("secp256r1");
+    const agreementKey = generateKeyPairPem("x25519");
+    verificationMethods.push({
+      id: `${did}#${VM_KEY_E2EE_SIGNING}`,
+      type: "EcdsaSecp256r1VerificationKey2019",
+      controller: did,
+      publicKeyJwk: publicKeyToJwk(signingKey.publicKey)
+    });
+    verificationMethods.push({
+      id: `${did}#${VM_KEY_E2EE_AGREEMENT}`,
+      type: "X25519KeyAgreementKey2019",
+      controller: did,
+      publicKeyMultibase: x25519PublicKeyToMultibase(agreementKey.publicKey.bytes)
+    });
+    keyAgreement.push(`${did}#${VM_KEY_E2EE_AGREEMENT}`);
+    keys[VM_KEY_E2EE_SIGNING] = signingKey.pair;
+    keys[VM_KEY_E2EE_AGREEMENT] = agreementKey.pair;
+  }
+  const document = {
+    "@context": contexts,
+    id: did,
+    verificationMethod: verificationMethods,
+    authentication: authentication2
+  };
+  if (assertionMethod.length > 0) {
+    document.assertionMethod = assertionMethod;
+  }
+  if (keyAgreement.length > 0) {
+    document.keyAgreement = keyAgreement;
+  }
+  const services = buildServiceEntries(did, options.agentDescriptionUrl, options.services);
+  if (services.length > 0) {
+    document.service = services;
+  }
+  const proofOptions = {
+    proofPurpose: options.proofPurpose ?? "assertionMethod",
+    proofType: didProfile === "plain_legacy" /* PlainLegacy */ ? PROOF_TYPE_SECP256K1 : PROOF_TYPE_DATA_INTEGRITY,
+    cryptosuite: didProfile === "e1" /* E1 */ ? CRYPTOSUITE_EDDSA_JCS_2022 : didProfile === "k1" /* K1 */ ? CRYPTOSUITE_DIDWBA_SECP256K1_2025 : void 0,
+    created: options.created,
+    domain: options.domain,
+    challenge: options.challenge
+  };
+  const signedDocument = generateW3cProof(
+    document,
+    authKey.privateKey,
+    options.verificationMethod ?? authVerificationMethodId,
+    proofOptions
+  );
+  return {
+    didDocument: signedDocument,
+    keys
+  };
+}
+function createDidWbaDocumentWithKeyBinding(hostname, options = {}) {
+  return createDidWbaDocument(hostname, {
+    ...options,
+    pathSegments: options.pathSegments?.length ? options.pathSegments : ["user"],
+    didProfile: "k1" /* K1 */
+  });
+}
+function computeJwkFingerprint(publicKeyInput) {
+  const publicKey = normalizePublicKeyMaterial(publicKeyInput);
+  if (publicKey.type !== "secp256k1") {
+    throw new AuthenticationError("Invalid DID document");
+  }
+  return computeJwkThumbprint(publicKeyToJwk(publicKey));
+}
+function computeMultikeyFingerprint(publicKeyInput) {
+  const publicKey = normalizePublicKeyMaterial(publicKeyInput);
+  if (publicKey.type !== "ed25519") {
+    throw new AuthenticationError("Invalid DID document");
+  }
+  return computeJwkThumbprint(publicKeyToJwk(publicKey));
+}
+function verifyDidKeyBinding(did, bindingMaterial) {
+  const lastSegment = did.split(":").at(-1) ?? "";
+  const publicKey = toPublicKeyMaterial(bindingMaterial);
+  if (lastSegment.startsWith("k1_")) {
+    return publicKey.type === "secp256k1" && computeJwkFingerprint(publicKey) === lastSegment.slice(3);
+  }
+  if (lastSegment.startsWith("e1_")) {
+    return publicKey.type === "ed25519" && computeMultikeyFingerprint(publicKey) === lastSegment.slice(3);
+  }
+  return true;
+}
+function validateDidDocumentBinding(didDocument, verifyProof = true) {
+  const lastSegment = didDocument.id.split(":").at(-1) ?? "";
+  if (lastSegment.startsWith("e1_")) {
+    return validateE1Binding(didDocument, lastSegment.slice(3));
+  }
+  if (lastSegment.startsWith("k1_")) {
+    if (verifyProof) {
+      return validateK1Binding(didDocument, lastSegment.slice(3));
+    }
+    return didDocument.verificationMethod.some(
+      (method) => isAuthenticationAuthorized(didDocument, method.id) && verifyDidKeyBinding(didDocument.id, method)
+    );
+  }
+  return true;
+}
+function generateAuthHeader(didDocument, serviceDomain, privateKeyInput, version = "1.1", options = {}) {
+  const payload = generateAuthPayload(
+    didDocument,
+    serviceDomain,
+    privateKeyInput,
+    version,
+    options
+  );
+  return `DIDWba v="${payload.version}", did="${payload.did}", nonce="${payload.nonce}", timestamp="${payload.timestamp}", verification_method="${payload.verificationMethod}", signature="${payload.signature}"`;
+}
+function generateAuthJson(didDocument, serviceDomain, privateKeyInput, version = "1.1", options = {}) {
+  const payload = generateAuthPayload(
+    didDocument,
+    serviceDomain,
+    privateKeyInput,
+    version,
+    options
+  );
+  return JSON.stringify({
+    v: payload.version,
+    did: payload.did,
+    nonce: payload.nonce,
+    timestamp: payload.timestamp,
+    verification_method: payload.verificationMethod,
+    signature: payload.signature
+  });
+}
+function extractAuthHeaderParts(authHeader) {
+  if (!authHeader.trimStart().startsWith("DIDWba")) {
+    throw new AuthenticationError("Authentication header must start with DIDWba");
+  }
+  const versionMatch = authHeader.match(/\bv="([^"]+)"/i);
+  return {
+    did: requiredHeaderField(authHeader, "did"),
+    nonce: requiredHeaderField(authHeader, "nonce"),
+    timestamp: requiredHeaderField(authHeader, "timestamp"),
+    verificationMethod: requiredHeaderField(authHeader, "verification_method"),
+    signature: requiredHeaderField(authHeader, "signature"),
+    version: versionMatch?.[1] ?? "1.1"
+  };
+}
+function verifyAuthHeaderSignature(authHeader, didDocument, serviceDomain) {
+  verifyAuthPayload(extractAuthHeaderParts(authHeader), didDocument, serviceDomain);
+  return true;
+}
+function verifyAuthJsonSignature(authJson, didDocument, serviceDomain) {
+  const value = JSON.parse(authJson);
+  verifyAuthPayload(
+    {
+      did: String(value.did ?? ""),
+      nonce: String(value.nonce ?? ""),
+      timestamp: String(value.timestamp ?? ""),
+      verificationMethod: String(value.verification_method ?? ""),
+      signature: String(value.signature ?? ""),
+      version: String(value.v ?? "1.1")
+    },
+    didDocument,
+    serviceDomain
+  );
+  return true;
+}
+function findVerificationMethod(didDocument, verificationMethodId) {
+  const directMethod = didDocument.verificationMethod.find(
+    (method) => method.id === verificationMethodId
+  );
+  if (directMethod) {
+    return directMethod;
+  }
+  for (const entry of didDocument.authentication) {
+    if (typeof entry !== "string" && entry.id === verificationMethodId) {
+      return entry;
+    }
+  }
+  for (const entry of didDocument.assertionMethod ?? []) {
+    if (typeof entry !== "string" && entry.id === verificationMethodId) {
+      return entry;
+    }
+  }
+  return void 0;
+}
+function isAuthenticationAuthorized(didDocument, verificationMethodId) {
+  return isVerificationMethodAuthorized(didDocument.authentication, verificationMethodId);
+}
+function isAssertionMethodAuthorized(didDocument, verificationMethodId) {
+  return isVerificationMethodAuthorized(didDocument.assertionMethod ?? [], verificationMethodId);
+}
+function validateE1Binding(didDocument, expectedFingerprint) {
+  const proof2 = didDocument.proof;
+  if (!proof2) {
+    return false;
+  }
+  if (proof2.type !== PROOF_TYPE_DATA_INTEGRITY || proof2.cryptosuite !== CRYPTOSUITE_EDDSA_JCS_2022) {
+    return false;
+  }
+  if (!isAssertionMethodAuthorized(didDocument, proof2.verificationMethod)) {
+    return false;
+  }
+  const method = findVerificationMethod(didDocument, proof2.verificationMethod);
+  if (!method) {
+    return false;
+  }
+  const publicKey = extractPublicKey(method);
+  return publicKey.type === "ed25519" && verifyW3cProof(didDocument, publicKey, { expectedPurpose: "assertionMethod" }) && computeMultikeyFingerprint(publicKey) === expectedFingerprint;
+}
+function validateK1Binding(didDocument, expectedFingerprint) {
+  const proof2 = didDocument.proof;
+  if (!proof2) {
+    return false;
+  }
+  if (!isAssertionMethodAuthorized(didDocument, proof2.verificationMethod)) {
+    return false;
+  }
+  const method = findVerificationMethod(didDocument, proof2.verificationMethod);
+  if (!method) {
+    return false;
+  }
+  const publicKey = extractPublicKey(method);
+  return publicKey.type === "secp256k1" && verifyW3cProof(didDocument, publicKey, { expectedPurpose: "assertionMethod" }) && computeJwkFingerprint(publicKey) === expectedFingerprint;
+}
+function generateAuthPayload(didDocument, serviceDomain, privateKeyInput, version, options = {}) {
+  const did = didDocument.id;
+  const [method, fragment] = selectAuthenticationMethod(didDocument);
+  const nonce = options.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)));
+  const timestamp = options.timestamp ?? (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z");
+  const payload = {
+    nonce,
+    timestamp,
+    [domainFieldForVersion(version)]: serviceDomain,
+    did
+  };
+  const contentHash = sha256(canonicalizeJson(payload));
+  const signatureBytes = signMessage(normalizePrivateKeyMaterial(privateKeyInput), contentHash);
+  const verifier = createVerificationMethod(method);
+  return {
+    did,
+    nonce,
+    timestamp,
+    verificationMethod: fragment,
+    signature: verifier.encodeSignature(signatureBytes),
+    version
+  };
+}
+function verifyAuthPayload(parsed, didDocument, serviceDomain) {
+  if (didDocument.id.toLowerCase() !== parsed.did.toLowerCase()) {
+    throw new AuthenticationError("Verification failed");
+  }
+  const payload = {
+    nonce: parsed.nonce,
+    timestamp: parsed.timestamp,
+    [domainFieldForVersion(parsed.version)]: serviceDomain,
+    did: parsed.did
+  };
+  const contentHash = sha256(canonicalizeJson(payload));
+  const verificationMethodId = `${parsed.did}#${parsed.verificationMethod}`;
+  const method = findVerificationMethod(didDocument, verificationMethodId);
+  if (!method) {
+    throw new AuthenticationError("Verification method not found");
+  }
+  const verifier = createVerificationMethod(method);
+  if (!verifier.verifySignature(contentHash, parsed.signature)) {
+    throw new AuthenticationError("Verification failed");
+  }
+}
+function selectAuthenticationMethod(didDocument) {
+  const first = didDocument.authentication[0];
+  if (!first) {
+    throw new AuthenticationError("Invalid DID document");
+  }
+  if (typeof first === "string") {
+    const method = findVerificationMethod(didDocument, first);
+    if (!method) {
+      throw new AuthenticationError("Verification method not found");
+    }
+    return [method, first.split("#").at(-1) ?? ""];
+  }
+  return [first, first.id.split("#").at(-1) ?? ""];
+}
+function buildAuthVerificationMethod(did, didProfile, authPublicKey, contexts) {
+  if (didProfile === "e1" /* E1 */) {
+    contexts.push("https://w3id.org/security/data-integrity/v2");
+    contexts.push("https://w3id.org/security/multikey/v1");
+    return {
+      id: `${did}#${VM_KEY_AUTH}`,
+      type: "Multikey",
+      controller: did,
+      publicKeyMultibase: ed25519PublicKeyToMultibase(authPublicKey.bytes)
+    };
+  }
+  contexts.push("https://w3id.org/security/suites/jws-2020/v1");
+  contexts.push("https://w3id.org/security/suites/secp256k1-2019/v1");
+  if (didProfile === "k1" /* K1 */) {
+    contexts.push("https://w3id.org/security/data-integrity/v2");
+  }
+  return {
+    id: `${did}#${VM_KEY_AUTH}`,
+    type: "EcdsaSecp256k1VerificationKey2019",
+    controller: did,
+    publicKeyJwk: publicKeyToJwk(authPublicKey)
+  };
+}
+function buildServiceEntries(did, agentDescriptionUrl, services) {
+  const output = [];
+  if (agentDescriptionUrl) {
+    output.push({
+      id: `${did}#ad`,
+      type: "AgentDescription",
+      serviceEndpoint: agentDescriptionUrl
+    });
+  }
+  for (const service of services ?? []) {
+    const copy = cloneJson(service);
+    if (typeof copy.id === "string" && copy.id.startsWith("#")) {
+      copy.id = `${did}${copy.id}`;
+    }
+    output.push(copy);
+  }
+  return output;
+}
+function buildDidBase(hostname, port) {
+  return port === void 0 ? `did:wba:${hostname}` : `did:wba:${hostname}%3A${port}`;
+}
+function joinDid(base, pathSegments) {
+  return pathSegments.length === 0 ? base : `${base}:${pathSegments.join(":")}`;
+}
+function buildDidResolutionUrl(did, baseUrlOverride) {
+  const parts = did.split(":");
+  if (parts.length < 3) {
+    throw new AuthenticationError("Invalid DID format");
+  }
+  const domain = decodeURIComponent(parts[2]);
+  const pathSegments = parts.slice(3);
+  const baseUrl = (baseUrlOverride ?? `https://${domain}`).replace(/\/$/, "");
+  if (pathSegments.length === 0) {
+    return `${baseUrl}/.well-known/did.json`;
+  }
+  return `${baseUrl}/${pathSegments.join("/")}/did.json`;
+}
+function domainFieldForVersion(version) {
+  return Number.parseFloat(version) >= 1.1 ? "aud" : "service";
+}
+function requiredHeaderField(authHeader, field) {
+  const match = authHeader.match(new RegExp(`${field}="([^"]+)"`, "i"));
+  if (!match?.[1]) {
+    throw new AuthenticationError(`Missing field in authorization header: ${field}`);
+  }
+  return match[1];
+}
+function toPublicKeyMaterial(bindingMaterial) {
+  if (typeof bindingMaterial === "string") {
+    return normalizePublicKeyMaterial(bindingMaterial);
+  }
+  if ("bytes" in bindingMaterial) {
+    return bindingMaterial;
+  }
+  return extractPublicKey(bindingMaterial);
+}
+function isVerificationMethodAuthorized(entries, verificationMethodId) {
+  return entries.some(
+    (entry) => typeof entry === "string" ? entry === verificationMethodId : entry.id === verificationMethodId
+  );
+}
+
+// src/authentication/did-resolver.ts
+async function resolveDidDocument(did, verifyProof = true, options = {}) {
+  if (did.startsWith("did:wba:")) {
+    return resolveDidWbaDocument(did, verifyProof, options);
+  }
+  if (!did.startsWith("did:web:")) {
+    throw new AuthenticationError("Unsupported DID method");
+  }
+  void options.verifySsl;
+  const url = buildDidResolutionUrl2(did, options.baseUrlOverride);
+  const timeoutMs = Math.round((options.timeoutSeconds ?? 10) * 1e3);
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/json",
+      ...options.headers ?? {}
+    },
+    signal: AbortSignal.timeout(timeoutMs)
+  }).catch((error) => {
+    throw new NetworkError("Network failure during DID resolution", void 0, error);
+  });
+  if (!response.ok) {
+    throw new NetworkError("Network failure during DID resolution", response.status);
+  }
+  const document = await response.json();
+  if (document.id !== did) {
+    throw new AuthenticationError("Invalid DID document");
+  }
+  if (verifyProof && document.proof) {
+    const verificationMethodId = document.proof.verificationMethod;
+    const method = findVerificationMethod(document, verificationMethodId);
+    if (!method) {
+      throw new AuthenticationError("Verification method not found");
+    }
+    const publicKey = extractPublicKey(method);
+    if (!verifyW3cProof(document, publicKey)) {
+      throw new AuthenticationError("Verification failed");
+    }
+  }
+  return document;
+}
+function buildDidResolutionUrl2(did, baseUrlOverride) {
+  const parts = did.split(":");
+  if (parts.length < 3) {
+    throw new AuthenticationError("Invalid DID format");
+  }
+  const domain = decodeURIComponent(parts[2]);
+  const pathSegments = parts.slice(3).map((segment) => decodeURIComponent(segment));
+  const baseUrl = (baseUrlOverride ?? `https://${domain}`).replace(/\/$/, "");
+  if (pathSegments.length === 0) {
+    return `${baseUrl}/.well-known/did.json`;
+  }
+  return `${baseUrl}/${pathSegments.join("/")}/did.json`;
+}
+function buildContentDigest(body) {
+  const digest = sha256(toBytes(body));
+  return `sha-256=:${encodeBase64(digest)}:`;
+}
+function verifyContentDigest(body, contentDigest) {
+  return buildContentDigest(body) === contentDigest.trim();
+}
+function generateHttpSignatureHeaders(didDocument, requestUrl, requestMethod, privateKeyInput, headers = {}, body, options = {}) {
+  const keyid = options.keyid ?? selectDefaultKeyid(didDocument);
+  const coveredComponents = options.coveredComponents ?? ["@method", "@target-uri", "@authority"];
+  const headersToSign = { ...headers };
+  const bodyBytes = body ? toBytes(body) : new Uint8Array(0);
+  const covered = [...coveredComponents];
+  if (bodyBytes.length > 0) {
+    headersToSign["Content-Digest"] ??= buildContentDigest(bodyBytes);
+    headersToSign["Content-Length"] ??= String(bodyBytes.length);
+    if (!covered.some((component) => component.toLowerCase() === "content-digest")) {
+      covered.push("content-digest");
+    }
+  }
+  const created = options.created ?? Math.floor(Date.now() / 1e3);
+  const expires = options.expires ?? created + 300;
+  const nonce = options.nonce ?? encodeBase64Url(randomBytes(16));
+  const signatureBase = buildSignatureBase(
+    covered,
+    requestMethod,
+    requestUrl,
+    headersToSign,
+    created,
+    expires,
+    nonce,
+    keyid
+  );
+  const signature = signMessage(
+    normalizePrivateKeyMaterial(privateKeyInput),
+    new TextEncoder().encode(signatureBase)
+  );
+  const result = {
+    "Signature-Input": `sig1=${serializeSignatureParams(covered, created, expires, nonce, keyid)}`,
+    Signature: `sig1=:${Buffer.from(signature).toString("base64")}:`
+  };
+  if (headersToSign["Content-Digest"]) {
+    result["Content-Digest"] = headersToSign["Content-Digest"];
+  }
+  return result;
+}
+function extractSignatureMetadata(headers) {
+  const signatureInput = getHeaderCaseInsensitive(headers, "Signature-Input");
+  const signatureHeader = getHeaderCaseInsensitive(headers, "Signature");
+  if (!signatureInput || !signatureHeader) {
+    throw new AuthenticationError("Missing Signature-Input or Signature header");
+  }
+  const [labelInput, components, params] = parseSignatureInput(signatureInput);
+  const [labelSignature] = parseSignatureHeader(signatureHeader);
+  if (labelInput !== labelSignature) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const keyid = params.keyid;
+  const created = Number(params.created);
+  if (!keyid || Number.isNaN(created)) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  return {
+    label: labelInput,
+    components,
+    keyid,
+    nonce: params.nonce,
+    created,
+    expires: params.expires ? Number(params.expires) : void 0
+  };
+}
+function verifyHttpMessageSignature(didDocument, requestMethod, requestUrl, headers, body) {
+  const signatureInput = getHeaderCaseInsensitive(headers, "Signature-Input");
+  const signatureHeader = getHeaderCaseInsensitive(headers, "Signature");
+  if (!signatureInput || !signatureHeader) {
+    throw new AuthenticationError("Missing Signature-Input or Signature header");
+  }
+  const [labelInput, components, params] = parseSignatureInput(signatureInput);
+  const [labelSignature, signatureBytes] = parseSignatureHeader(signatureHeader);
+  if (labelInput !== labelSignature) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const keyid = params.keyid;
+  const created = Number(params.created);
+  if (!keyid || Number.isNaN(created)) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const bodyBytes = body ? toBytes(body) : new Uint8Array(0);
+  if (bodyBytes.length > 0 || components.some((component) => component.toLowerCase() === "content-digest")) {
+    const contentDigest = getHeaderCaseInsensitive(headers, "Content-Digest");
+    if (!contentDigest) {
+      throw new AuthenticationError("Missing Content-Digest header");
+    }
+    if (!verifyContentDigest(bodyBytes, contentDigest)) {
+      throw new AuthenticationError("Content-Digest verification failed");
+    }
+  }
+  const method = findVerificationMethod(didDocument, keyid);
+  if (!method) {
+    throw new AuthenticationError("Verification method not found");
+  }
+  const publicKey = extractPublicKey(method);
+  const signatureBase = buildSignatureBase(
+    components,
+    requestMethod,
+    requestUrl,
+    headers,
+    created,
+    params.expires ? Number(params.expires) : void 0,
+    params.nonce,
+    keyid
+  );
+  if (!verifyMessage(publicKey, new TextEncoder().encode(signatureBase), signatureBytes)) {
+    throw new AuthenticationError("Signature verification failed");
+  }
+  return {
+    label: labelInput,
+    components,
+    keyid,
+    nonce: params.nonce,
+    created,
+    expires: params.expires ? Number(params.expires) : void 0
+  };
+}
+function buildSignatureBase(components, method, url, headers, created, expires, nonce, keyid) {
+  const lines = components.map(
+    (component) => `"${component}": ${componentValue(component, method, url, headers)}`
+  );
+  lines.push(
+    `"@signature-params": ${serializeSignatureParams(components, created, expires, nonce, keyid)}`
+  );
+  return lines.join("\n");
+}
+function componentValue(component, method, url, headers) {
+  switch (component) {
+    case "@method":
+      return method.toUpperCase();
+    case "@target-uri":
+      return url;
+    case "@authority": {
+      const parsed = new URL(url);
+      return parsed.port ? `${parsed.hostname}:${parsed.port}` : parsed.hostname;
+    }
+    default: {
+      const value = getHeaderCaseInsensitive(headers, component);
+      if (!value) {
+        throw new AuthenticationError("Invalid signature input");
+      }
+      return value;
+    }
+  }
+}
+function serializeSignatureParams(components, created, expires, nonce, keyid) {
+  const quotedComponents = components.map((component) => `"${component}"`).join(" ");
+  const parts = [`created=${created}`];
+  if (expires !== void 0) {
+    parts.push(`expires=${expires}`);
+  }
+  if (nonce) {
+    parts.push(`nonce="${nonce}"`);
+  }
+  parts.push(`keyid="${keyid}"`);
+  return `(${quotedComponents});${parts.join(";")}`;
+}
+function parseSignatureInput(value) {
+  const separator = value.indexOf("=");
+  if (separator < 0) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const label = value.slice(0, separator);
+  const remainder = value.slice(separator + 1);
+  const openIndex = remainder.indexOf("(");
+  const closeIndex = remainder.indexOf(")");
+  if (openIndex < 0 || closeIndex < 0 || closeIndex <= openIndex) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const components = remainder.slice(openIndex + 1, closeIndex).split(/\s+/).map((component) => component.replaceAll('"', "")).filter(Boolean);
+  if (components.length === 0) {
+    throw new AuthenticationError("Invalid signature input");
+  }
+  const params = remainder.slice(closeIndex + 1).replace(/^;/, "").split(";").filter(Boolean).reduce((result, part) => {
+    const [name, rawValue] = part.split("=", 2);
+    if (!name || rawValue === void 0) {
+      throw new AuthenticationError("Invalid signature input");
+    }
+    result[name] = rawValue.replace(/^"|"$/g, "");
+    return result;
+  }, {});
+  return [label, components, params];
+}
+function parseSignatureHeader(value) {
+  const separator = value.indexOf("=");
+  if (separator < 0) {
+    throw new AuthenticationError("Invalid signature header format");
+  }
+  const label = value.slice(0, separator);
+  const raw = value.slice(separator + 1);
+  if (!raw.startsWith(":") || !raw.endsWith(":")) {
+    throw new AuthenticationError("Invalid signature header format");
+  }
+  return [label, new Uint8Array(Buffer.from(raw.slice(1, -1), "base64"))];
+}
+function selectDefaultKeyid(didDocument) {
+  const first = didDocument.authentication[0];
+  if (typeof first === "string") {
+    return first;
+  }
+  if (first?.id) {
+    return first.id;
+  }
+  throw new AuthenticationError("Verification method not found");
+}
+function getHeaderCaseInsensitive(headers, name) {
+  const target = name.toLowerCase();
+  return Object.entries(headers).find(([key]) => key.toLowerCase() === target)?.[1];
+}
+function toBytes(value) {
+  return typeof value === "string" ? new TextEncoder().encode(value) : value;
+}
+var DIDWbaAuthHeader = class {
+  constructor(didDocumentPath, privateKeyPath, authMode = "http_signatures" /* HttpSignatures */) {
+    this.didDocumentPath = didDocumentPath;
+    this.privateKeyPath = privateKeyPath;
+    this.authMode = authMode;
+  }
+  didDocumentCache;
+  tokens = /* @__PURE__ */ new Map();
+  async getAuthHeaders(serverUrl, forceNew = false, method = "GET", headers, body) {
+    const domain = extractDomain(serverUrl);
+    if (!forceNew) {
+      const token = this.tokens.get(domain);
+      if (token) {
+        return { Authorization: `Bearer ${token}` };
+      }
+    }
+    const [didDocument, privateKeyPem] = await Promise.all([
+      this.loadDidDocument(),
+      readFile(this.privateKeyPath, "utf8")
+    ]);
+    if (this.authMode === "legacy_didwba" /* LegacyDidWba */) {
+      return {
+        Authorization: generateAuthHeader(didDocument, domain, privateKeyPem, "1.1")
+      };
+    }
+    return generateHttpSignatureHeaders(
+      didDocument,
+      serverUrl,
+      method,
+      privateKeyPem,
+      headers,
+      body
+    );
+  }
+  async getAuthHeader(serverUrl, forceNew = false, method = "GET", headers, body) {
+    return this.getAuthHeaders(serverUrl, forceNew, method, headers, body);
+  }
+  updateToken(serverUrl, headers) {
+    const domain = extractDomain(serverUrl);
+    const authenticationInfo = getHeaderCaseInsensitive2(headers, "Authentication-Info");
+    if (authenticationInfo) {
+      const parsed = parseAuthenticationInfo(authenticationInfo);
+      const accessToken = parsed.access_token;
+      const tokenType = parsed.token_type ?? "Bearer";
+      if (accessToken && tokenType.toLowerCase() === "bearer") {
+        this.tokens.set(domain, accessToken);
+        return accessToken;
+      }
+    }
+    const authorization = getHeaderCaseInsensitive2(headers, "Authorization");
+    if (authorization?.startsWith("Bearer ")) {
+      const token = authorization.slice(7);
+      this.tokens.set(domain, token);
+      return token;
+    }
+    return void 0;
+  }
+  clearToken(serverUrl) {
+    this.tokens.delete(extractDomain(serverUrl));
+  }
+  clearAllTokens() {
+    this.tokens.clear();
+  }
+  shouldRetryAfter401(responseHeaders) {
+    const wwwAuthenticate = getHeaderCaseInsensitive2(responseHeaders, "WWW-Authenticate");
+    if (!wwwAuthenticate) {
+      return false;
+    }
+    const challenge = parseWwwAuthenticate(wwwAuthenticate);
+    if (challenge.nonce) {
+      return true;
+    }
+    return !["invalid_did", "invalid_verification_method", "forbidden_did"].includes(
+      challenge.error ?? ""
+    );
+  }
+  async getChallengeAuthHeaders(serverUrl, responseHeaders, method = "GET", headers, body) {
+    const wwwAuthenticate = getHeaderCaseInsensitive2(responseHeaders, "WWW-Authenticate");
+    const acceptSignature = getHeaderCaseInsensitive2(responseHeaders, "Accept-Signature");
+    const challenge = wwwAuthenticate ? parseWwwAuthenticate(wwwAuthenticate) : {};
+    const coveredComponents = normalizeCoveredComponents(
+      acceptSignature ? parseAcceptSignature(acceptSignature) : void 0,
+      headers,
+      body
+    );
+    const [didDocument, privateKeyPem] = await Promise.all([
+      this.loadDidDocument(),
+      readFile(this.privateKeyPath, "utf8")
+    ]);
+    if (this.authMode === "legacy_didwba" /* LegacyDidWba */) {
+      return {
+        Authorization: generateAuthHeader(
+          didDocument,
+          extractDomain(serverUrl),
+          privateKeyPem,
+          "1.1",
+          {
+            nonce: challenge.nonce
+          }
+        )
+      };
+    }
+    return generateHttpSignatureHeaders(
+      didDocument,
+      serverUrl,
+      method,
+      privateKeyPem,
+      headers,
+      body,
+      {
+        nonce: challenge.nonce,
+        coveredComponents
+      }
+    );
+  }
+  async getChallengeAuthHeader(serverUrl, responseHeaders, method = "GET", headers, body) {
+    return this.getChallengeAuthHeaders(serverUrl, responseHeaders, method, headers, body);
+  }
+  async loadDidDocument() {
+    if (!this.didDocumentCache) {
+      this.didDocumentCache = JSON.parse(
+        await readFile(this.didDocumentPath, "utf8")
+      );
+    }
+    return this.didDocumentCache;
+  }
+};
+function extractDomain(serverUrl) {
+  try {
+    return new URL(serverUrl).hostname;
+  } catch {
+    return serverUrl;
+  }
+}
+function getHeaderCaseInsensitive2(headers, name) {
+  const target = name.toLowerCase();
+  return Object.entries(headers).find(([key]) => key.toLowerCase() === target)?.[1];
+}
+function parseAuthenticationInfo(value) {
+  return value.split(",").map((item) => item.trim()).filter(Boolean).reduce((result, item) => {
+    const [key, rawValue] = item.split("=", 2);
+    if (key && rawValue) {
+      result[key.trim()] = rawValue.trim().replace(/^"|"$/g, "");
+    }
+    return result;
+  }, {});
+}
+function parseWwwAuthenticate(value) {
+  const normalized = value.replace(/^DIDWba\s+/i, "").trim();
+  const matches = [...normalized.matchAll(/([\w-]+)=("[^"]*"|[^,]+)/g)];
+  return matches.reduce((result, match) => {
+    result[match[1]] = match[2].trim().replace(/^"|"$/g, "");
+    return result;
+  }, {});
+}
+function parseAcceptSignature(value) {
+  return [...value.matchAll(/"([^"]+)"/g)].map((match) => match[1]);
+}
+function normalizeCoveredComponents(coveredComponents, headers, body) {
+  if (!coveredComponents) {
+    return void 0;
+  }
+  const normalizedHeaders = Object.fromEntries(
+    Object.entries(headers ?? {}).map(([key, value]) => [key.toLowerCase(), value])
+  );
+  const bodyPresent = body !== void 0 && !(typeof body === "string" && body.length === 0 || body instanceof Uint8Array && body.byteLength === 0);
+  return coveredComponents.filter((component) => {
+    const normalized = component.toLowerCase();
+    if (normalized === "content-digest" && !bodyPresent) {
+      return false;
+    }
+    if (normalized === "content-length" && !bodyPresent && !("content-length" in normalizedHeaders)) {
+      return false;
+    }
+    if (normalized === "content-type" && !("content-type" in normalizedHeaders)) {
+      return false;
+    }
+    if (!normalized.startsWith("@") && normalized !== "content-length" && normalized !== "content-digest" && !(normalized in normalizedHeaders)) {
+      return false;
+    }
+    return true;
+  });
+}
+var DidWbaVerifierError = class extends Error {
+  constructor(message, statusCode = 400, headers = {}) {
+    super(message);
+    this.statusCode = statusCode;
+    this.headers = headers;
+    this.name = "DidWbaVerifierError";
+  }
+};
+var DEFAULT_CONFIG = {
+  jwtAlgorithm: "RS256",
+  accessTokenExpireMinutes: 60,
+  nonceExpirationMinutes: 6,
+  timestampExpirationMinutes: 5,
+  allowHttpSignatures: true,
+  allowLegacyDidwba: true,
+  emitAuthenticationInfoHeader: true,
+  emitLegacyAuthorizationHeader: true,
+  requireNonceForHttpSignatures: true
+};
+var DidWbaVerifier = class {
+  config;
+  usedNonces = /* @__PURE__ */ new Map();
+  constructor(config = {}) {
+    this.config = {
+      ...DEFAULT_CONFIG,
+      ...config
+    };
+  }
+  async verifyRequest(method, url, headers, body, domain) {
+    return this.verifyRequestWithOptionalDidDocument(method, url, headers, body, domain);
+  }
+  async verifyRequestWithDidDocument(method, url, headers, didDocument, body, domain) {
+    return this.verifyRequestWithOptionalDidDocument(
+      method,
+      url,
+      headers,
+      body,
+      domain,
+      didDocument
+    );
+  }
+  async verifyRequestWithOptionalDidDocument(method, url, headers, body, domain, didDocument) {
+    const requestDomain = domain ?? extractDomainFromUrl(url);
+    this.validateAllowedDomain(requestDomain);
+    const authHeader = getHeaderCaseInsensitive3(headers, "Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      return this.handleBearerAuth(authHeader);
+    }
+    if (getHeaderCaseInsensitive3(headers, "Signature-Input") || getHeaderCaseInsensitive3(headers, "Signature")) {
+      if (!this.config.allowHttpSignatures) {
+        throw this.challengeError(
+          "HTTP Message Signatures authentication is disabled",
+          401,
+          requestDomain,
+          "invalid_request"
+        );
+      }
+      return this.handleHttpSignatureAuth(method, url, headers, body, requestDomain, didDocument);
+    }
+    if (authHeader) {
+      if (!this.config.allowLegacyDidwba) {
+        throw this.challengeError(
+          "Legacy DIDWba authentication is disabled",
+          401,
+          requestDomain,
+          "invalid_request"
+        );
+      }
+      return this.handleLegacyDidAuth(authHeader, requestDomain, didDocument);
+    }
+    throw this.challengeError(
+      "Missing authentication headers",
+      401,
+      requestDomain,
+      "invalid_request"
+    );
+  }
+  async handleHttpSignatureAuth(method, url, headers, body, domain, providedDidDocument) {
+    let metadata;
+    try {
+      metadata = extractSignatureMetadata(headers);
+    } catch (error) {
+      throw this.challengeError(
+        `Invalid signature metadata: ${error.message}`,
+        401,
+        domain,
+        "invalid_request"
+      );
+    }
+    if (!metadata.keyid.includes("#")) {
+      throw this.challengeError(
+        "Invalid Signature-Input keyid",
+        401,
+        domain,
+        "invalid_verification_method"
+      );
+    }
+    const did = metadata.keyid.split("#", 1)[0];
+    const didDocument = providedDidDocument ?? await this.resolveDidDocument(did, domain);
+    if (!validateDidDocumentBinding(didDocument, true)) {
+      throw this.challengeError("DID binding verification failed", 401, domain, "invalid_did");
+    }
+    if (!isAuthenticationAuthorized(didDocument, metadata.keyid)) {
+      throw new DidWbaVerifierError(
+        "Verification method is not authorized for authentication",
+        403
+      );
+    }
+    let verification;
+    try {
+      verification = verifyHttpMessageSignature(
+        didDocument,
+        method,
+        url,
+        headers,
+        body ?? void 0
+      );
+    } catch (error) {
+      throw this.challengeError(error.message, 401, domain, "invalid_signature");
+    }
+    if (!this.verifyHttpSignatureTimeWindow(verification.created, verification.expires)) {
+      throw this.challengeError(
+        "HTTP signature timestamp is expired or invalid",
+        401,
+        domain,
+        "invalid_timestamp"
+      );
+    }
+    if (this.config.requireNonceForHttpSignatures && !verification.nonce) {
+      throw this.challengeError("HTTP signature nonce is required", 401, domain, "invalid_nonce");
+    }
+    if (verification.nonce && !await this.isValidServerNonce(did, verification.nonce)) {
+      throw this.challengeError("Invalid or expired nonce", 401, domain, "invalid_nonce");
+    }
+    const accessToken = await this.createAccessToken(did);
+    return this.buildSuccessResult(did, "http_signatures", accessToken);
+  }
+  async handleLegacyDidAuth(authorization, domain, providedDidDocument) {
+    let parsed;
+    try {
+      parsed = extractAuthHeaderParts(authorization);
+    } catch (error) {
+      throw this.challengeError(
+        `Invalid authorization header format: ${error.message}`,
+        401,
+        domain,
+        "invalid_request"
+      );
+    }
+    if (!this.verifyLegacyTimestamp(parsed.timestamp)) {
+      throw this.challengeError("Timestamp expired or invalid", 401, domain, "invalid_timestamp");
+    }
+    if (!await this.isValidServerNonce(parsed.did, parsed.nonce)) {
+      throw this.challengeError("Invalid or expired nonce", 401, domain, "invalid_nonce");
+    }
+    const didDocument = providedDidDocument ?? await this.resolveDidDocument(parsed.did, domain);
+    if (!validateDidDocumentBinding(didDocument, true)) {
+      throw this.challengeError("DID binding verification failed", 401, domain, "invalid_did");
+    }
+    const keyid = `${parsed.did}#${parsed.verificationMethod}`;
+    if (!isAuthenticationAuthorized(didDocument, keyid)) {
+      throw new DidWbaVerifierError(
+        "Verification method is not authorized for authentication",
+        403
+      );
+    }
+    try {
+      verifyAuthHeaderSignature(authorization, didDocument, domain);
+    } catch (error) {
+      throw this.challengeError(
+        `Error verifying signature: ${error.message}`,
+        401,
+        domain,
+        "invalid_signature"
+      );
+    }
+    const accessToken = await this.createAccessToken(parsed.did);
+    return this.buildSuccessResult(parsed.did, "legacy_didwba", accessToken);
+  }
+  async handleBearerAuth(authorization) {
+    if (!this.config.jwtPublicKey) {
+      throw new DidWbaVerifierError("Internal server error during token verification", 500);
+    }
+    const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : authorization;
+    const verifyKey = await importVerifyKey(
+      this.config.jwtPublicKey,
+      this.config.jwtAlgorithm ?? "RS256"
+    );
+    const result = await jwtVerify(token, verifyKey, {
+      algorithms: [this.config.jwtAlgorithm ?? "RS256"]
+    }).catch(() => {
+      throw new DidWbaVerifierError("Invalid token", 401);
+    });
+    const did = result.payload.sub;
+    if (!did || !did.startsWith("did:wba:")) {
+      throw new DidWbaVerifierError("Invalid DID format", 401);
+    }
+    return {
+      did,
+      authScheme: "bearer",
+      responseHeaders: {},
+      accessToken: token,
+      tokenType: "bearer"
+    };
+  }
+  async createAccessToken(did) {
+    if (!this.config.jwtPrivateKey) {
+      return void 0;
+    }
+    const algorithm = this.config.jwtAlgorithm ?? "RS256";
+    const signingKey = await importSigningKey(this.config.jwtPrivateKey, algorithm);
+    return new SignJWT({}).setProtectedHeader({ alg: algorithm }).setSubject(did).setIssuedAt().setExpirationTime(`${this.config.accessTokenExpireMinutes ?? 60}m`).sign(signingKey);
+  }
+  buildSuccessResult(did, authScheme, accessToken) {
+    const responseHeaders = {};
+    if (accessToken) {
+      const expiresInSeconds = (this.config.accessTokenExpireMinutes ?? 60) * 60;
+      if (this.config.emitAuthenticationInfoHeader !== false) {
+        responseHeaders["Authentication-Info"] = `access_token="${accessToken}", token_type="Bearer", expires_in=${expiresInSeconds}`;
+      }
+      if (this.config.emitLegacyAuthorizationHeader !== false) {
+        responseHeaders.Authorization = `Bearer ${accessToken}`;
+      }
+    }
+    return {
+      did,
+      authScheme,
+      responseHeaders,
+      accessToken,
+      tokenType: accessToken ? "bearer" : void 0
+    };
+  }
+  verifyLegacyTimestamp(timestamp) {
+    const requestTime = new Date(timestamp);
+    if (Number.isNaN(requestTime.getTime())) {
+      return false;
+    }
+    const now = Date.now();
+    if (requestTime.getTime() - now > 6e4) {
+      return false;
+    }
+    return now - requestTime.getTime() <= (this.config.timestampExpirationMinutes ?? 5) * 6e4;
+  }
+  verifyHttpSignatureTimeWindow(created, expires) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (created > now + 60) {
+      return false;
+    }
+    if (now - created > (this.config.timestampExpirationMinutes ?? 5) * 60) {
+      return false;
+    }
+    return expires === void 0 || expires >= now;
+  }
+  async isValidServerNonce(did, nonce) {
+    if (this.config.externalNonceValidator) {
+      return Boolean(await this.config.externalNonceValidator(did, nonce));
+    }
+    const expirationMs = (this.config.nonceExpirationMinutes ?? 6) * 6e4;
+    const now = Date.now();
+    for (const [key, createdAt] of this.usedNonces.entries()) {
+      if (now - createdAt.getTime() > expirationMs) {
+        this.usedNonces.delete(key);
+      }
+    }
+    const cacheKey = `${did}:${nonce}`;
+    if (this.usedNonces.has(cacheKey)) {
+      return false;
+    }
+    this.usedNonces.set(cacheKey, new Date(now));
+    return true;
+  }
+  async resolveDidDocument(did, domain) {
+    try {
+      const resolved = this.config.didResolver ? await this.config.didResolver(did) : await resolveDidWbaDocument(did, false, this.config.didResolutionOptions);
+      if (!resolved) {
+        throw this.challengeError("Failed to resolve DID document", 401, domain, "invalid_did");
+      }
+      return resolved;
+    } catch (error) {
+      if (error instanceof DidWbaVerifierError) {
+        throw error;
+      }
+      throw this.challengeError(
+        `Failed to resolve DID document: ${error.message}`,
+        401,
+        domain,
+        "invalid_did"
+      );
+    }
+  }
+  validateAllowedDomain(domain) {
+    if (this.config.allowedDomains && !this.config.allowedDomains.includes(domain)) {
+      throw new DidWbaVerifierError("Domain is not allowed", 403);
+    }
+  }
+  challengeError(message, statusCode, domain, error) {
+    const headers = {
+      "WWW-Authenticate": `DIDWba realm="${domain}", error="${error}", error_description="${message}"`
+    };
+    if (this.config.allowHttpSignatures !== false) {
+      headers["Accept-Signature"] = 'sig1=("@method" "@target-uri" "@authority" "content-digest");created;expires;nonce;keyid';
+    }
+    return new DidWbaVerifierError(message, statusCode, headers);
+  }
+};
+function getHeaderCaseInsensitive3(headers, name) {
+  const target = name.toLowerCase();
+  return Object.entries(headers).find(([key]) => key.toLowerCase() === target)?.[1];
+}
+function extractDomainFromUrl(url) {
+  return new URL(url).hostname;
+}
+async function importSigningKey(key, algorithm) {
+  if (algorithm.startsWith("HS")) {
+    return new TextEncoder().encode(key);
+  }
+  return importPKCS8(key, algorithm);
+}
+async function importVerifyKey(key, algorithm) {
+  if (algorithm.startsWith("HS")) {
+    return new TextEncoder().encode(key);
+  }
+  return importSPKI(key, algorithm);
+}
+
+// src/authentication/federation.ts
+async function verifyFederatedHttpRequest(senderDid, requestMethod, requestUrl, headers, body, options = {}) {
+  const senderDidDocument = options.senderDidDocument ?? await resolveDidDocument(
+    senderDid,
+    options.verifySenderDidProof ?? false,
+    options.didResolutionOptions ?? {}
+  );
+  if (senderDidDocument.id !== senderDid) {
+    throw new AuthenticationError("Sender DID document ID mismatch");
+  }
+  const service = selectAnpMessageService(senderDidDocument, options.serviceId, options.serviceEndpoint);
+  if (!service.serviceDid) {
+    throw new AuthenticationError("Selected ANPMessageService is missing serviceDid");
+  }
+  const signatureMetadata = extractSignatureMetadata(headers);
+  const keyidDid = signatureMetadata.keyid.split("#", 1)[0];
+  if (keyidDid !== service.serviceDid) {
+    throw new AuthenticationError("Signature keyid DID does not match serviceDid");
+  }
+  const serviceDidDocument = options.serviceDidDocument ?? await resolveDidDocument(
+    service.serviceDid,
+    options.verifyServiceDidProof ?? false,
+    options.didResolutionOptions ?? {}
+  );
+  if (serviceDidDocument.id !== service.serviceDid) {
+    throw new AuthenticationError("serviceDid document ID mismatch");
+  }
+  if (!isAuthenticationAuthorized(serviceDidDocument, signatureMetadata.keyid)) {
+    throw new AuthenticationError("Verification method is not authorized for authentication");
+  }
+  const verifiedMetadata = verifyHttpMessageSignature(
+    serviceDidDocument,
+    requestMethod,
+    requestUrl,
+    headers,
+    body
+  );
+  return {
+    senderDid,
+    serviceDid: service.serviceDid,
+    serviceId: service.id,
+    signatureMetadata: verifiedMetadata
+  };
+}
+function selectAnpMessageService(didDocument, serviceId, serviceEndpoint) {
+  const candidates = (didDocument.service ?? []).filter(
+    (service) => service.type === ANP_MESSAGE_SERVICE_TYPE
+  );
+  if (candidates.length === 0) {
+    throw new AuthenticationError("No ANPMessageService found in DID document");
+  }
+  if (serviceId) {
+    const matched = candidates.find((service) => service.id === serviceId);
+    if (!matched) {
+      throw new AuthenticationError(`ANPMessageService not found for serviceId=${serviceId}`);
+    }
+    return matched;
+  }
+  if (serviceEndpoint) {
+    const matched = candidates.find((service) => service.serviceEndpoint === serviceEndpoint);
+    if (!matched) {
+      throw new AuthenticationError("ANPMessageService not found for serviceEndpoint");
+    }
+    return matched;
+  }
+  if (candidates.length === 1) {
+    return candidates[0];
+  }
+  throw new AuthenticationError(
+    "Multiple ANPMessageService entries found; serviceId or serviceEndpoint is required"
+  );
+}
+
+// src/authentication/index.ts
+var didDocuments = {
+  ANP_MESSAGE_SERVICE_TYPE,
+  buildAnpMessageService,
+  buildAgentMessageService,
+  buildGroupMessageService,
+  create: createDidWbaDocument,
+  createWithKeyBinding: createDidWbaDocumentWithKeyBinding,
+  resolve: resolveDidDocument,
+  validateBinding: validateDidDocumentBinding,
+  verifyKeyBinding: verifyDidKeyBinding
+};
+var legacyAuth = {
+  createHeader: generateAuthHeader,
+  createPayload: generateAuthJson,
+  parseHeader: extractAuthHeaderParts,
+  verifyHeader: verifyAuthHeaderSignature,
+  verifyPayload: verifyAuthJsonSignature
+};
+var httpSignatures = {
+  buildContentDigest,
+  verifyContentDigest,
+  createHeaders: generateHttpSignatureHeaders,
+  verifyMessage: verifyHttpMessageSignature,
+  parseMetadata: extractSignatureMetadata
+};
+var authentication = {
+  didDocuments,
+  legacyAuth,
+  httpSignatures,
+  federation: {
+    verifyRequest: verifyFederatedHttpRequest
+  },
+  DidAuthHeaders: DIDWbaAuthHeader,
+  RequestVerifier: DidWbaVerifier
+};
+
+// src/proof/im.ts
+var im_exports = {};
+__export(im_exports, {
+  IM_PROOF_DEFAULT_COMPONENTS: () => IM_PROOF_DEFAULT_COMPONENTS,
+  IM_PROOF_RELATION_ASSERTION_METHOD: () => IM_PROOF_RELATION_ASSERTION_METHOD,
+  IM_PROOF_RELATION_AUTHENTICATION: () => IM_PROOF_RELATION_AUTHENTICATION,
+  buildImContentDigest: () => buildImContentDigest,
+  buildImSignatureInput: () => buildImSignatureInput,
+  decodeImSignature: () => decodeImSignature,
+  encodeImSignature: () => encodeImSignature,
+  generateImProof: () => generateImProof,
+  parseImSignatureInput: () => parseImSignatureInput,
+  verifyImContentDigest: () => verifyImContentDigest,
+  verifyImProof: () => verifyImProof
+});
+var IM_PROOF_DEFAULT_COMPONENTS = ["@method", "@target-uri", "content-digest"];
+var IM_PROOF_RELATION_AUTHENTICATION = "authentication";
+var IM_PROOF_RELATION_ASSERTION_METHOD = "assertionMethod";
+function buildImContentDigest(payload) {
+  return buildContentDigest(payload);
+}
+function verifyImContentDigest(payload, contentDigest) {
+  return buildImContentDigest(payload) === contentDigest.trim();
+}
+function buildImSignatureInput(keyid, options = {}) {
+  const label = options.label ?? "sig1";
+  const components = options.components ?? [...IM_PROOF_DEFAULT_COMPONENTS];
+  if (components.length === 0) {
+    throw new ProofError("signatureInput must include covered components");
+  }
+  const created = options.created ?? Math.floor(Date.now() / 1e3);
+  const nonce = options.nonce ?? encodeBase64Url(randomBytes(16));
+  const quotedComponents = components.map((component) => `"${component}"`).join(" ");
+  const params = [`created=${created}`];
+  if (options.expires !== void 0) {
+    params.push(`expires=${options.expires}`);
+  }
+  params.push(`nonce="${nonce}"`);
+  params.push(`keyid="${keyid}"`);
+  return `${label}=(${quotedComponents});${params.join(";")}`;
+}
+function parseImSignatureInput(value) {
+  const separator = value.indexOf("=");
+  if (separator < 0) {
+    throw new ProofError("invalid proof.signatureInput format");
+  }
+  const label = value.slice(0, separator).trim();
+  const remainder = value.slice(separator + 1).trim();
+  const openIndex = remainder.indexOf("(");
+  const closeIndex = remainder.indexOf(")");
+  if (openIndex < 0 || closeIndex < 0 || closeIndex <= openIndex) {
+    throw new ProofError("invalid proof.signatureInput format");
+  }
+  const components = remainder.slice(openIndex + 1, closeIndex).split(/\s+/).map((component) => component.replaceAll('"', "")).filter(Boolean);
+  if (components.length === 0) {
+    throw new ProofError("proof.signatureInput must include covered components");
+  }
+  const params = {};
+  const paramsRaw = remainder.slice(closeIndex + 1).replace(/^;/, "");
+  for (const part of paramsRaw.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const [name, rawValue] = trimmed.split("=", 2);
+    if (!name || rawValue === void 0) {
+      throw new ProofError("invalid proof.signatureInput format");
+    }
+    params[name.trim()] = rawValue.trim().replace(/^"|"$/g, "");
+  }
+  if (!params.keyid) {
+    throw new ProofError("proof.signatureInput must include keyid");
+  }
+  return {
+    label,
+    components,
+    signatureParams: remainder,
+    keyid: params.keyid,
+    nonce: params.nonce,
+    created: params.created ? Number(params.created) : void 0,
+    expires: params.expires ? Number(params.expires) : void 0
+  };
+}
+function encodeImSignature(signatureBytes, label = "sig1") {
+  return `${label}=:${encodeBase64(signatureBytes)}:`;
+}
+function decodeImSignature(signature) {
+  const trimmed = signature.trim();
+  const labeled = trimmed.match(/^\s*([a-zA-Z0-9_-]+)=:(.+):\s*$/);
+  const unlabeled = trimmed.match(/^\s*:(.+):\s*$/);
+  const label = labeled?.[1];
+  const encoded = labeled?.[2] ?? unlabeled?.[1];
+  if (!encoded) {
+    throw new ProofError("invalid proof.signature encoding");
+  }
+  try {
+    return { label, signatureBytes: decodeBase64(encoded) };
+  } catch {
+    try {
+      return { label, signatureBytes: decodeBase64Url(encoded) };
+    } catch {
+      throw new ProofError("invalid proof.signature encoding");
+    }
+  }
+}
+function generateImProof(payload, signatureBase, privateKeyInput, keyid, options = {}) {
+  const payloadBytes = toBytes2(payload);
+  const signatureInput = buildImSignatureInput(keyid, options);
+  const privateKey = normalizePrivateKeyMaterial(privateKeyInput);
+  const signatureBytes = signMessage(privateKey, toBytes2(signatureBase));
+  return {
+    contentDigest: buildImContentDigest(payloadBytes),
+    signatureInput,
+    signature: encodeImSignature(signatureBytes, options.label ?? "sig1")
+  };
+}
+function verifyImProof(proof2, payload, signatureBase, verificationTarget, expectedSignerDid) {
+  if (!verifyImContentDigest(payload, proof2.contentDigest)) {
+    throw new ProofError("proof contentDigest does not match request payload");
+  }
+  const parsed = parseImSignatureInput(proof2.signatureInput);
+  if (expectedSignerDid && !keyidBelongsToExpectedDid(parsed.keyid, expectedSignerDid)) {
+    throw new ProofError("proof keyid must belong to expected signer DID");
+  }
+  if (verificationTarget.didDocument) {
+    const verificationRelationship = verificationTarget.verificationRelationship ?? IM_PROOF_RELATION_AUTHENTICATION;
+    if (!isVerificationMethodAuthorized2(
+      verificationTarget.didDocument,
+      parsed.keyid,
+      verificationRelationship
+    )) {
+      throw new ProofError(`verification method is not authorized for ${verificationRelationship}`);
+    }
+  }
+  const verificationMethod = verificationTarget.verificationMethod ?? resolveVerificationMethod(verificationTarget.didDocument, parsed.keyid);
+  const publicKey = extractPublicKey(verificationMethod);
+  const { signatureBytes } = decodeImSignature(proof2.signature);
+  if (!verifyMessage(publicKey, toBytes2(signatureBase), signatureBytes)) {
+    throw new ProofError("signature verification failed");
+  }
+  return {
+    parsedSignatureInput: parsed,
+    verificationMethod
+  };
+}
+function resolveVerificationMethod(didDocument, verificationMethodId) {
+  if (!didDocument) {
+    throw new ProofError("didDocument or verificationMethod is required");
+  }
+  const method = findVerificationMethod(didDocument, verificationMethodId);
+  if (!method) {
+    throw new ProofError("verification method not found in DID document");
+  }
+  return method;
+}
+function toBytes2(value) {
+  return typeof value === "string" ? new TextEncoder().encode(value) : value;
+}
+function keyidBelongsToExpectedDid(keyid, expectedSignerDid) {
+  return keyid.split("#", 1)[0] === expectedSignerDid;
+}
+function isVerificationMethodAuthorized2(didDocument, verificationMethodId, verificationRelationship) {
+  if (verificationRelationship === IM_PROOF_RELATION_AUTHENTICATION) {
+    return isAuthenticationAuthorized(didDocument, verificationMethodId);
+  }
+  if (verificationRelationship === IM_PROOF_RELATION_ASSERTION_METHOD) {
+    return isAssertionMethodAuthorized(didDocument, verificationMethodId);
+  }
+  throw new ProofError(`unsupported verification relationship: ${verificationRelationship}`);
+}
+
+// src/proof/index.ts
+var proof = {
+  create: generateW3cProof,
+  verify: verifyW3cProof,
+  verifyDetailed: verifyW3cProofDetailed,
+  im: im_exports
+};
+
+// src/wns/types.ts
+var ANP_HANDLE_SERVICE_TYPE = "ANPHandleService";
+var HandleStatus = /* @__PURE__ */ ((HandleStatus2) => {
+  HandleStatus2["Active"] = "active";
+  HandleStatus2["Suspended"] = "suspended";
+  HandleStatus2["Revoked"] = "revoked";
+  return HandleStatus2;
+})(HandleStatus || {});
+var SubjectType = /* @__PURE__ */ ((SubjectType2) => {
+  SubjectType2["Person"] = "person";
+  SubjectType2["Agent"] = "agent";
+  SubjectType2["Group"] = "group";
+  SubjectType2["Organization"] = "organization";
+  SubjectType2["Service"] = "service";
+  SubjectType2["Application"] = "application";
+  SubjectType2["Unknown"] = "unknown";
+  return SubjectType2;
+})(SubjectType || {});
+
+// src/wns/validator.ts
+var DOMAIN_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validateLocalPart(localPart) {
+  const normalized = localPart.toLowerCase();
+  if (!normalized || normalized.length > 63) {
+    return false;
+  }
+  if (normalized.startsWith("-") || normalized.endsWith("-") || normalized.includes("--")) {
+    return false;
+  }
+  return /^[a-z0-9-]+$/.test(normalized);
+}
+function validateHandle(handle) {
+  const normalized = handle.trim().toLowerCase();
+  if (!normalized) {
+    throw new HandleValidationError("Handle must not be empty");
+  }
+  const dotIndex = normalized.indexOf(".");
+  if (dotIndex < 0) {
+    throw new HandleValidationError(`Handle must contain at least one dot: '${handle}'`);
+  }
+  const localPart = normalized.slice(0, dotIndex);
+  const domain = normalized.slice(dotIndex + 1);
+  if (!localPart) {
+    throw new HandleValidationError(`Handle local-part is empty: '${handle}'`);
+  }
+  if (!domain) {
+    throw new HandleValidationError(`Handle domain is empty: '${handle}'`);
+  }
+  if (!validateLocalPart(localPart)) {
+    throw new HandleValidationError(
+      `Invalid local-part '${localPart}': must be 1-63 chars of a-z, 0-9, hyphen; must start/end with alnum; no consecutive hyphens`
+    );
+  }
+  if (!isValidDomain(domain)) {
+    throw new HandleValidationError(`Invalid domain '${domain}'`);
+  }
+  return [localPart, domain];
+}
+function normalizeHandle(handle) {
+  const [localPart, domain] = validateHandle(handle);
+  return `${localPart}.${domain}`;
+}
+function parseWbaUri(uri) {
+  if (!uri.startsWith("wba://")) {
+    throw new WbaUriParseError(`URI must start with 'wba://': '${uri}'`);
+  }
+  const handlePart = uri.slice("wba://".length);
+  if (!handlePart) {
+    throw new WbaUriParseError(`URI contains no handle after 'wba://': '${uri}'`);
+  }
+  try {
+    const [localPart, domain] = validateHandle(handlePart);
+    return {
+      localPart,
+      domain,
+      handle: `${localPart}.${domain}`,
+      originalUri: uri
+    };
+  } catch (error) {
+    throw new WbaUriParseError(`Invalid handle in URI '${uri}': ${error.message}`);
+  }
+}
+function buildResolutionUrl(localPart, domain) {
+  return `https://${domain}/.well-known/handle/${localPart}`;
+}
+function buildWbaUri(localPart, domain) {
+  return `wba://${localPart}.${domain}`;
+}
+function isValidDomain(domain) {
+  const labels = domain.split(".");
+  return labels.length >= 2 && labels.every((label) => DOMAIN_LABEL_RE.test(label));
+}
+
+// src/wns/generation.ts
+function canonicalizeBindingGeneration(value) {
+  if (typeof value !== "string" || !/^[1-9][0-9]*$/.test(value)) {
+    throw new TypeError("binding_generation must be a canonical positive decimal string");
+  }
+  return value;
+}
+function compareBindingGenerations(current, previous) {
+  const left = canonicalizeBindingGeneration(current);
+  const right = canonicalizeBindingGeneration(previous);
+  if (left.length !== right.length) return left.length < right.length ? -1 : 1;
+  return left === right ? 0 : left < right ? -1 : 1;
+}
+
+// src/wns/resolver.ts
+async function resolveHandle(handle, options = {}) {
+  const bareHandle = stripWbaScheme(handle);
+  const [localPart, domain] = validateHandle(bareHandle);
+  const normalized = `${localPart}.${domain}`;
+  const baseUrl = options.baseUrlOverride?.replace(/\/$/, "");
+  const url = baseUrl ? `${baseUrl}/.well-known/handle/${localPart}` : buildResolutionUrl(localPart, domain);
+  void options.verifySsl;
+  const timeoutMs = Math.round((options.timeoutSeconds ?? 10) * 1e3);
+  const response = await fetch(url, {
+    headers: { Accept: "application/json" },
+    redirect: "manual",
+    signal: AbortSignal.timeout(timeoutMs)
+  }).catch((error) => {
+    throw new HandleResolutionError(
+      `Network error resolving handle '${normalized}': ${error.message}`,
+      502,
+      error
+    );
+  });
+  if (response.status === 301) {
+    throw new HandleMovedError(
+      `Handle '${normalized}' has been migrated`,
+      response.headers.get("Location") ?? ""
+    );
+  }
+  if (response.status === 404) {
+    throw new HandleNotFoundError(`Handle '${normalized}' does not exist`);
+  }
+  if (response.status === 410) {
+    throw new HandleGoneError(`Handle '${normalized}' has been permanently revoked`);
+  }
+  if (!response.ok) {
+    throw new HandleResolutionError(
+      `Unexpected status ${response.status} resolving '${normalized}'`,
+      502
+    );
+  }
+  const payload = await response.json();
+  const document = {
+    handle: String(payload.handle ?? ""),
+    did: String(payload.did ?? ""),
+    status: normalizeStatus(String(payload.status ?? "")),
+    binding_generation: canonicalizeBindingGeneration(payload.binding_generation),
+    updated: payload.updated ? String(payload.updated) : void 0,
+    versionId: payload.versionId ? String(payload.versionId) : void 0,
+    ttl: typeof payload.ttl === "number" ? payload.ttl : void 0,
+    profile: normalizeProfile(payload.profile)
+  };
+  if (document.handle.toLowerCase() !== normalized) {
+    throw new HandleResolutionError(
+      `Handle mismatch: requested '${normalized}', got '${document.handle}'`,
+      502
+    );
+  }
+  dropInvalidProfileProjection(document);
+  return document;
+}
+async function resolveHandleFromUri(wbaUri, options = {}) {
+  const parsed = parseWbaUri(wbaUri);
+  return resolveHandle(parsed.handle, options);
+}
+function stripWbaScheme(handleOrUri) {
+  return handleOrUri.startsWith("wba://") ? handleOrUri.slice("wba://".length) : handleOrUri;
+}
+function normalizeStatus(value) {
+  switch (value.toLowerCase()) {
+    case "active" /* Active */:
+      return "active" /* Active */;
+    case "suspended" /* Suspended */:
+      return "suspended" /* Suspended */;
+    case "revoked" /* Revoked */:
+      return "revoked" /* Revoked */;
+    default:
+      throw new HandleResolutionError(`Unexpected handle status '${value}'`, 502);
+  }
+}
+function normalizeProfile(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  return {
+    type: value.type ? String(value.type) : void 0,
+    subject_did: String(value.subject_did ?? ""),
+    subject_type: normalizeSubjectType(value.subject_type),
+    handle: value.handle ? String(value.handle) : void 0,
+    display_name: value.display_name ? String(value.display_name) : void 0,
+    description: value.description ? String(value.description) : void 0,
+    avatar_uri: value.avatar_uri ? String(value.avatar_uri) : void 0,
+    profile_uri: value.profile_uri ? String(value.profile_uri) : void 0,
+    discoverability: value.discoverability ? String(value.discoverability) : void 0,
+    labels: isRecord(value.labels) ? value.labels : void 0,
+    updated: value.updated ? String(value.updated) : void 0,
+    versionId: value.versionId ? String(value.versionId) : void 0,
+    ttl: typeof value.ttl === "number" ? value.ttl : void 0,
+    proof: isRecord(value.proof) ? value.proof : void 0
+  };
+}
+function dropInvalidProfileProjection(document) {
+  if (!document.profile) {
+    return;
+  }
+  if (document.profile.subject_did !== document.did) {
+    document.profile = void 0;
+    return;
+  }
+  if (document.profile.handle && document.profile.handle !== document.handle) {
+    document.profile = void 0;
+  }
+}
+function normalizeSubjectType(value) {
+  if (!value) {
+    return "unknown" /* Unknown */;
+  }
+  const normalized = String(value).toLowerCase();
+  return Object.values(SubjectType).includes(normalized) ? normalized : "unknown" /* Unknown */;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/wns/binding.ts
+async function verifyHandleBinding(handle, options = {}) {
+  const bareHandle = handle.startsWith("wba://") ? handle.slice("wba://".length) : handle;
+  let localPart;
+  let domain;
+  try {
+    [localPart, domain] = validateHandle(bareHandle);
+  } catch (error) {
+    return {
+      isValid: false,
+      handle: bareHandle,
+      did: "",
+      forwardVerified: false,
+      reverseVerified: false,
+      errorMessage: error.message
+    };
+  }
+  const normalizedHandle = `${localPart}.${domain}`;
+  try {
+    const resolution = await resolveHandle(normalizedHandle, options.resolutionOptions);
+    if (resolution.status !== "active" /* Active */) {
+      return {
+        isValid: false,
+        handle: normalizedHandle,
+        did: resolution.did,
+        forwardVerified: false,
+        reverseVerified: false,
+        errorMessage: `Handle status is '${resolution.status}', expected 'active'`
+      };
+    }
+    if (!resolution.did.startsWith("did:wba:")) {
+      return {
+        isValid: false,
+        handle: normalizedHandle,
+        did: resolution.did,
+        forwardVerified: true,
+        reverseVerified: false,
+        errorMessage: "DID does not use did:wba method"
+      };
+    }
+    const didDomain = resolution.did.split(":")[2] ?? "";
+    if (didDomain.toLowerCase() !== domain) {
+      return {
+        isValid: false,
+        handle: normalizedHandle,
+        did: resolution.did,
+        forwardVerified: true,
+        reverseVerified: false,
+        errorMessage: `Domain mismatch: handle domain '${domain}' != DID domain '${didDomain}'`
+      };
+    }
+    const didDocument = options.didDocument ?? await resolveDidWbaDocument(resolution.did, false, options.didResolutionOptions);
+    const handleServices = extractHandleServiceFromDidDocument(didDocument);
+    const reverseVerified = handleServices.some(
+      (service) => matchesHandleServiceDomain(service.serviceEndpoint, domain)
+    );
+    if (!reverseVerified) {
+      return {
+        isValid: false,
+        handle: normalizedHandle,
+        did: resolution.did,
+        forwardVerified: true,
+        reverseVerified: false,
+        errorMessage: `DID Document does not contain an ${ANP_HANDLE_SERVICE_TYPE} entry whose HTTPS domain matches '${domain}'`
+      };
+    }
+    return {
+      isValid: true,
+      handle: normalizedHandle,
+      did: resolution.did,
+      bindingGeneration: resolution.binding_generation,
+      forwardVerified: true,
+      reverseVerified: true
+    };
+  } catch (error) {
+    if (error instanceof HandleBindingError) {
+      throw error;
+    }
+    return {
+      isValid: false,
+      handle: normalizedHandle,
+      did: "",
+      forwardVerified: false,
+      reverseVerified: false,
+      errorMessage: error.message
+    };
+  }
+}
+function buildHandleServiceEntry(did, localPart, domain) {
+  return {
+    id: `${did}#handle`,
+    type: ANP_HANDLE_SERVICE_TYPE,
+    serviceEndpoint: buildResolutionUrl(localPart, domain)
+  };
+}
+function extractHandleServiceFromDidDocument(didDocument) {
+  return (didDocument.service ?? []).filter((service) => service.type === ANP_HANDLE_SERVICE_TYPE).map((service) => ({
+    id: String(service.id),
+    type: String(service.type),
+    serviceEndpoint: String(service.serviceEndpoint)
+  }));
+}
+function matchesHandleServiceDomain(serviceEndpoint, expectedDomain) {
+  try {
+    const parsed = new URL(serviceEndpoint);
+    return parsed.protocol === "https:" && parsed.hostname.toLowerCase() === expectedDomain.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+
+// src/wns/index.ts
+var wns = {
+  validateLocalPart,
+  validateHandle,
+  normalizeHandle,
+  parseUri: parseWbaUri,
+  buildResolutionUrl,
+  buildUri: buildWbaUri,
+  resolveHandle,
+  resolveUri: resolveHandleFromUri,
+  verifyBinding: verifyHandleBinding,
+  createHandleServiceEntry: buildHandleServiceEntry,
+  extractHandleServices: extractHandleServiceFromDidDocument,
+  canonicalizeBindingGeneration,
+  compareBindingGenerations
+};
+
+// src/im/errors.ts
+var AwikiImError = class extends Error {
+  /**
+   * Create a normalized AWiki IM error.
+   *
+   * @param code Stable category for callers.
+   * @param message Public diagnostic message.
+   * @param options Optional transport status and underlying cause.
+   */
+  constructor(code, message, status, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.code = code;
+    this.status = status;
+    this.name = "AwikiImError";
+  }
+};
+function normalizeAwikiImError(error) {
+  if (error instanceof AwikiImError) {
+    return error;
+  }
+  if (error instanceof TypeError) {
+    return new AwikiImError("network", "AWiki service is unavailable", void 0, {
+      cause: error
+    });
+  }
+  return new AwikiImError("remote", "AWiki operation failed", void 0, { cause: error });
+}
+function awikiImRemoteError(input) {
+  const code = classifyRemoteError(input);
+  return new AwikiImError(code, publicMessage(code), input.status);
+}
+function classifyRemoteError(input) {
+  const serviceCode = input.serviceCode?.toLowerCase() ?? "";
+  const message = input.message?.toLowerCase() ?? "";
+  const combined = `${serviceCode} ${message}`;
+  if (input.rpcCode === 1003) {
+    return "invalid-request";
+  }
+  if (input.rpcCode === 1403 || serviceCode === "anp.forbidden") {
+    return "forbidden";
+  }
+  if (input.rpcCode === 1404 || serviceCode === "anp.target_not_found" || serviceCode === "target_not_found") {
+    return "not-found";
+  }
+  if (input.rpcCode === 1409 || serviceCode === "anp.idempotency_conflict" || serviceCode === "idempotency_conflict") {
+    return "conflict";
+  }
+  if (combined.includes("otp_rate_limited") || input.status === 429 || input.rpcCode === -32005) {
+    return "rate-limited";
+  }
+  if (combined.includes("invalid_otp") || combined.includes("otp_invalid")) {
+    return "invalid-otp";
+  }
+  if (combined.includes("otp_expired") || combined.includes("challenge_expired")) {
+    return "challenge-expired";
+  }
+  if (combined.includes("handle_unavailable") || combined.includes("handle_exists") || combined.includes("handle already")) {
+    return "handle-unavailable";
+  }
+  if (combined.includes("already_registered") || combined.includes("did already")) {
+    return "already-registered";
+  }
+  if (input.status === 404 || input.rpcCode === -32002) {
+    return "not-found";
+  }
+  if (input.status === 401 || input.status === 403 || input.rpcCode === -32001) {
+    return "forbidden";
+  }
+  if (input.status === 409 || input.rpcCode === -32003) {
+    return "conflict";
+  }
+  if (input.rpcCode === -32600 || input.rpcCode === -32602 || input.rpcCode === -32004) {
+    return combined.includes("otp") ? "invalid-otp" : "invalid-request";
+  }
+  if (input.status !== void 0 && input.status >= 400 && input.status < 500) {
+    return "invalid-request";
+  }
+  return "remote";
+}
+function publicMessage(code) {
+  switch (code) {
+    case "not-registered":
+      return "AWiki identity is not registered";
+    case "already-registered":
+      return "AWiki identity is already registered";
+    case "invalid-request":
+      return "AWiki rejected the request";
+    case "invalid-otp":
+      return "AWiki verification code is invalid";
+    case "challenge-expired":
+      return "AWiki registration challenge has expired";
+    case "handle-unavailable":
+      return "AWiki handle is unavailable";
+    case "not-found":
+      return "AWiki resource was not found";
+    case "forbidden":
+      return "AWiki operation is not permitted";
+    case "conflict":
+      return "AWiki operation conflicts with existing state";
+    case "rate-limited":
+      return "AWiki request was rate limited";
+    case "network":
+      return "AWiki service is unavailable";
+    case "remote":
+      return "AWiki service returned an error";
+  }
+}
+
+// src/im/internal.ts
+var STATE_VERSION = 2;
+var DEFAULT_PAGE_LIMIT = 50;
+var MAX_PAGE_LIMIT = 100;
+function emptyState() {
+  return {
+    version: STATE_VERSION,
+    conversations: {},
+    attachments: {},
+    sendOperations: {}
+  };
+}
+function conversationKey(id) {
+  return id;
+}
+var HANDLE_RPC_PATH = "/user-service/v1/handle/rpc";
+var DID_AUTH_RPC_PATH = "/user-service/v1/did-auth/rpc";
+var MESSAGE_RPC_PATH = "/im/rpc";
+var MAX_RPC_RESPONSE_BYTES = 1024 * 1024;
+var MAX_DID_DOCUMENT_BYTES = 512 * 1024;
+var REQUEST_TIMEOUT_MS = 3e4;
+var AwikiImTransport = class {
+  constructor(fetchImpl, options) {
+    this.fetchImpl = fetchImpl;
+    this.options = options;
+    this.allowedAttachmentOrigins = new Set(
+      options.allowedAttachmentOrigins.map(
+        (value) => normalizeAllowedOrigin(value, options.allowInsecureLoopback)
+      )
+    );
+  }
+  controllers = /* @__PURE__ */ new Set();
+  allowedAttachmentOrigins;
+  disposed = false;
+  /** Execute an unsigned or bearer-authenticated JSON-RPC request. */
+  async rpc(baseUrl, path, method, params, accessToken) {
+    const url = joinServiceUrl(baseUrl, path, this.options.allowInsecureLoopback);
+    const request = encodeJsonRpc(method, params);
+    const body = request.body;
+    const headers = { "Content-Type": "application/json" };
+    if (accessToken) {
+      headers.Authorization = `Bearer ${accessToken}`;
+    }
+    return this.executeRpc(url, body, headers, request.id);
+  }
+  /** Execute a DID HTTP-Signature-authenticated JSON-RPC request. */
+  async signedRpc(baseUrl, path, method, params, authentication2) {
+    const url = joinServiceUrl(baseUrl, path, this.options.allowInsecureLoopback);
+    const request = encodeJsonRpc(method, params);
+    const body = request.body;
+    const baseHeaders = { "Content-Type": "application/json" };
+    let headers = {
+      ...baseHeaders,
+      ...generateHttpSignatureHeaders(
+        authentication2.didDocument,
+        url,
+        "POST",
+        authentication2.signingPrivateKeyPem,
+        baseHeaders,
+        body,
+        { keyid: authentication2.signingKeyId }
+      )
+    };
+    const result = await this.withResponse(
+      url,
+      {
+        method: "POST",
+        headers,
+        body,
+        redirect: "error"
+      },
+      async (response) => {
+        if (response.status !== 401) {
+          return {
+            kind: "result",
+            value: await decodeRpcResponse(response, request.id)
+          };
+        }
+        const nonce = parseAuthenticationParameter(
+          response.headers.get("www-authenticate") ?? "",
+          "nonce"
+        );
+        await response.body?.cancel();
+        return { kind: "challenge", nonce };
+      }
+    );
+    if (result.kind === "challenge" && result.nonce) {
+      headers = {
+        ...baseHeaders,
+        ...generateHttpSignatureHeaders(
+          authentication2.didDocument,
+          url,
+          "POST",
+          authentication2.signingPrivateKeyPem,
+          baseHeaders,
+          body,
+          { keyid: authentication2.signingKeyId, nonce: result.nonce }
+        )
+      };
+      return this.withResponse(
+        url,
+        {
+          method: "POST",
+          headers,
+          body,
+          redirect: "error"
+        },
+        (response) => decodeRpcResponse(response, request.id)
+      );
+    }
+    if (result.kind === "challenge") {
+      throw awikiImRemoteError({ status: 401 });
+    }
+    return result.value;
+  }
+  /** Upload one object without following redirects. */
+  async putBytes(url, headers, bytes) {
+    this.validateAttachmentUrl(url);
+    await this.withResponse(
+      url,
+      {
+        method: "PUT",
+        headers: { ...headers },
+        body: Buffer.from(bytes),
+        redirect: "error"
+      },
+      async (response) => {
+        if (!response.ok) {
+          await response.body?.cancel();
+          throw awikiImRemoteError({ status: response.status });
+        }
+        await response.body?.cancel();
+      }
+    );
+  }
+  /** Read one public JSON document without following redirects. */
+  async getJson(url) {
+    this.validateAttachmentUrl(url);
+    return this.withResponse(
+      url,
+      {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        redirect: "error"
+      },
+      async (response) => {
+        if (!response.ok) {
+          await response.body?.cancel();
+          throw awikiImRemoteError({ status: response.status });
+        }
+        const value = parseJson(await readCappedBody(response, MAX_DID_DOCUMENT_BYTES));
+        if (!isRecord2(value)) {
+          throw new AwikiImError("remote", "AWiki service returned an invalid response");
+        }
+        return value;
+      }
+    );
+  }
+  /** Download one object without following redirects. */
+  async getBytes(url, bearerToken, expectedSize) {
+    if (!Number.isSafeInteger(expectedSize) || expectedSize < 0 || expectedSize > this.options.attachmentMaxBytes) {
+      throw new AwikiImError("invalid-request", "AWiki attachment size is invalid");
+    }
+    this.validateAttachmentUrl(url);
+    return this.withResponse(
+      url,
+      {
+        method: "GET",
+        headers: { Authorization: `Bearer ${bearerToken}` },
+        redirect: "error"
+      },
+      async (response) => {
+        if (!response.ok) {
+          await response.body?.cancel();
+          throw awikiImRemoteError({ status: response.status });
+        }
+        const declaredLength = contentLength(response.headers);
+        if (declaredLength !== void 0 && declaredLength !== expectedSize) {
+          await response.body?.cancel();
+          throw new AwikiImError("remote", "AWiki attachment verification failed");
+        }
+        return readCappedBody(response, expectedSize);
+      }
+    );
+  }
+  /** Validate an untrusted DID, service, upload, or object URL against the operator allowlist. */
+  validateAttachmentUrl(value) {
+    const url = validateServiceBaseUrl(value, this.options.allowInsecureLoopback);
+    if (!this.allowedAttachmentOrigins.has(url.origin)) {
+      throw new AwikiImError("forbidden", "AWiki attachment origin is not permitted");
+    }
+    return url;
+  }
+  /** Abort every owned request and reject future work. */
+  dispose() {
+    this.disposed = true;
+    for (const controller of this.controllers) {
+      controller.abort();
+    }
+    this.controllers.clear();
+  }
+  async executeRpc(url, body, headers, requestId) {
+    return this.withResponse(
+      url,
+      {
+        method: "POST",
+        headers,
+        body,
+        redirect: "error"
+      },
+      (response) => decodeRpcResponse(response, requestId)
+    );
+  }
+  async withResponse(input, init, consume) {
+    if (this.disposed) {
+      throw new AwikiImError("remote", "AWiki IM client has been disposed");
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    this.controllers.add(controller);
+    try {
+      const response = await this.fetchImpl(input, { ...init, signal: controller.signal });
+      return await consume(response);
+    } catch (error) {
+      if (this.disposed) {
+        throw new AwikiImError("remote", "AWiki IM client has been disposed");
+      }
+      throw normalizeAwikiImError(error);
+    } finally {
+      clearTimeout(timeout);
+      this.controllers.delete(controller);
+    }
+  }
+};
+function buildOriginAuthentication(input) {
+  const target = input.meta.target;
+  if (!isRecord2(target)) {
+    throw new AwikiImError("invalid-request", "AWiki message target is invalid");
+  }
+  const kind = requiredString(target.kind, "target kind");
+  const did = requiredString(target.did, "target DID");
+  if (kind !== "agent" && kind !== "group" && kind !== "service") {
+    throw new AwikiImError("invalid-request", "AWiki message target is invalid");
+  }
+  const canonicalRequest = canonicalizeJson({
+    method: input.method,
+    meta: input.meta,
+    body: input.body
+  });
+  const signatureInput = buildImSignatureInput(input.signingKeyId, {
+    label: "sig1",
+    components: ["@method", "@target-uri", "content-digest"]
+  });
+  const contentDigest = buildImContentDigest(canonicalRequest);
+  const targetUri = `anp://${kind}/${encodeRfc3986(did)}`;
+  const signatureParams = signatureInput.slice(signatureInput.indexOf("=") + 1);
+  const signatureBase = [
+    `"@method": ${input.method}`,
+    `"@target-uri": ${targetUri}`,
+    `"content-digest": ${contentDigest}`,
+    `"@signature-params": ${signatureParams}`
+  ].join("\n");
+  const signature = signMessage(
+    normalizePrivateKeyMaterial(input.signingPrivateKeyPem),
+    new TextEncoder().encode(signatureBase)
+  );
+  return {
+    scheme: "anp-rfc9421-origin-proof-v1",
+    origin_proof: {
+      contentDigest,
+      signatureInput,
+      signature: encodeImSignature(signature, "sig1")
+    }
+  };
+}
+function joinServiceUrl(baseUrl, path, allowInsecureLoopback = false) {
+  const base = validateServiceBaseUrl(baseUrl, allowInsecureLoopback);
+  return new URL(`/${path.replace(/^\/+/, "")}`, base).toString();
+}
+function validateServiceBaseUrl(value, allowInsecureLoopback = false) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new AwikiImError("invalid-request", "AWiki service URL is invalid", void 0, {
+      cause: error
+    });
+  }
+  if (url.username || url.password || url.protocol !== "https:" && !(allowInsecureLoopback && url.protocol === "http:" && isLoopback(url.hostname))) {
+    throw new AwikiImError("invalid-request", "AWiki service URL is invalid");
+  }
+  return url;
+}
+function operationId(prefix) {
+  return `${prefix}-${randomUUID()}`;
+}
+function randomChallenge() {
+  return randomBytes(16).toString("hex");
+}
+function encodeJsonRpc(method, params) {
+  const id = randomUUID();
+  return { id, body: JSON.stringify({ jsonrpc: "2.0", id, method, params }) };
+}
+async function decodeRpcResponse(response, expectedId) {
+  let decoded;
+  try {
+    decoded = parseJson(await readCappedBody(response, MAX_RPC_RESPONSE_BYTES));
+  } catch (error) {
+    if (!response.ok) {
+      throw awikiImRemoteError({ status: response.status });
+    }
+    throw new AwikiImError(
+      "remote",
+      "AWiki service returned an invalid response",
+      response.status,
+      {
+        cause: error
+      }
+    );
+  }
+  if (!isRecord2(decoded)) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response", response.status);
+  }
+  const hasResult = Object.hasOwn(decoded, "result") && decoded.result !== null;
+  const hasError = Object.hasOwn(decoded, "error") && decoded.error !== null;
+  if (decoded.jsonrpc !== "2.0" || decoded.id !== expectedId || hasResult === hasError) {
+    throw new AwikiImError(
+      "remote",
+      "AWiki JSON-RPC response envelope is invalid",
+      response.status
+    );
+  }
+  if (hasError && !isRecord2(decoded.error)) {
+    throw new AwikiImError(
+      "remote",
+      "AWiki JSON-RPC response envelope is invalid",
+      response.status
+    );
+  }
+  const rpcError = hasError ? decoded.error : void 0;
+  if (!response.ok || rpcError !== void 0) {
+    throw awikiImRemoteError({
+      status: response.status,
+      rpcCode: numberValue(rpcError?.code),
+      serviceCode: serviceErrorCode(rpcError?.data),
+      message: stringValue(rpcError?.message)
+    });
+  }
+  if (!isRecord2(decoded.result)) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response", response.status);
+  }
+  return {
+    value: decoded.result,
+    accessToken: responseAccessToken(response.headers) ?? stringValue(decoded.result.access_token)
+  };
+}
+function responseAccessToken(headers) {
+  const authenticationInfo = headers.get("authentication-info") ?? "";
+  return parseAuthenticationParameter(authenticationInfo, "access_token");
+}
+function parseAuthenticationParameter(value, key) {
+  const match = value.match(new RegExp(`(?:^|[,\\s])${key}=(?:"([^"]+)"|([^,\\s]+))`, "i"));
+  return (match?.[1] ?? match?.[2])?.trim() || void 0;
+}
+function serviceErrorCode(data) {
+  if (!isRecord2(data)) {
+    return void 0;
+  }
+  for (const key of ["awiki_code", "anp_code", "code"]) {
+    const value = stringValue(data[key]);
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function requiredString(value, label) {
+  const result = stringValue(value);
+  if (!result) {
+    throw new AwikiImError("invalid-request", `AWiki ${label} is required`);
+  }
+  return result;
+}
+function normalizeAllowedOrigin(value, allowInsecureLoopback) {
+  const url = validateServiceBaseUrl(value, allowInsecureLoopback);
+  if (url.pathname !== "/" || url.search || url.hash) {
+    throw new AwikiImError("invalid-request", "AWiki attachment origin is invalid");
+  }
+  return url.origin;
+}
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+async function readCappedBody(response, maximumBytes) {
+  const declaredLength = contentLength(response.headers);
+  if (declaredLength !== void 0 && declaredLength > maximumBytes) {
+    await response.body?.cancel();
+    throw new AwikiImError("remote", "AWiki response exceeds the permitted size");
+  }
+  if (!response.body) {
+    return new Uint8Array();
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    let part = await reader.read();
+    while (!part.done) {
+      total += part.value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel();
+        throw new AwikiImError("remote", "AWiki response exceeds the permitted size");
+      }
+      chunks.push(part.value);
+      part = await reader.read();
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const output = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return output;
+}
+function contentLength(headers) {
+  const raw = headers.get("content-length");
+  if (raw === null) {
+    return void 0;
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new AwikiImError("remote", "AWiki response has an invalid Content-Length");
+  }
+  return value;
+}
+function parseJson(bytes) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (error) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response", void 0, {
+      cause: error
+    });
+  }
+}
+function encodeRfc3986(value) {
+  return encodeURIComponent(value).replace(
+    /[!'()*]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`
+  );
+}
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/im/messaging.ts
+var MAX_REFRESH_PAGES = 1e3;
+var AwikiMessagingRuntime = class {
+  constructor(options) {
+    this.options = options;
+  }
+  sendTail = Promise.resolve();
+  /** Refresh conversation records and return one local page. */
+  async listConversations(request = {}) {
+    this.options.identity.requireSecrets();
+    const limit = pageLimit(request.limit);
+    await this.refreshConversations();
+    const conversations = Object.values(this.options.store.snapshot().conversations).map((record) => record.conversation).sort(compareConversationRecency);
+    const offset = decodeOffsetCursor(request.cursor);
+    const items = conversations.slice(offset, offset + limit);
+    const nextOffset = offset + items.length;
+    return {
+      items,
+      hasMore: nextOffset < conversations.length,
+      ...nextOffset < conversations.length ? { nextCursor: encodeOffsetCursor(nextOffset) } : {}
+    };
+  }
+  /** Read and normalize one direct/group history page using the service's offset support. */
+  async getHistory(request) {
+    const record = this.options.store.snapshot().conversations[conversationKey(request.conversationId)];
+    if (!record) {
+      throw new AwikiImError("not-found", "AWiki conversation was not found");
+    }
+    const identity = this.options.identity.requireSecrets();
+    const limit = pageLimit(request.limit);
+    const kind = record.conversation.kind;
+    const skip = decodeHistoryCursor(request.cursor, kind, request.conversationId);
+    const result = kind === "direct" ? await this.authenticatedRpc("direct.get_history", {
+      meta: localMeta(identity.public.did, "anp.direct.local.v1"),
+      body: compactRecord({
+        user_did: identity.public.did,
+        peer_did: requiredConversationValue(record.peerDid),
+        limit,
+        skip: skip || void 0
+      })
+    }) : await this.authenticatedRpc("group.list_messages", {
+      meta: groupLocalMeta(
+        identity.public.did,
+        requiredConversationValue(record.groupDid)
+      ),
+      body: compactRecord({
+        group_did: requiredConversationValue(record.groupDid),
+        limit,
+        skip: skip || void 0
+      })
+    });
+    const wires = arrayValue(result.messages);
+    validateHistoryWires(wires, record, identity.public.did);
+    const mapped = wires.map(
+      (wire) => isRecord3(wire) ? this.mapWireMessage(wire, record.conversation, identity.public.did) : null
+    ).filter((message) => message !== null);
+    await this.persistMappedMessages(mapped);
+    const items = mapped.map((entry) => entry.message).sort(compareMessageTime);
+    const consumed = wires.length;
+    if (result.has_more === true && consumed === 0) {
+      throw new AwikiImError("remote", "AWiki history pagination did not advance");
+    }
+    const hasMore = result.has_more === true;
+    return {
+      items,
+      hasMore,
+      ...hasMore ? { nextCursor: encodeHistoryCursor(kind, request.conversationId, skip + consumed) } : {}
+    };
+  }
+  /** Resolve and send one idempotent text message. */
+  async sendText(request) {
+    return this.exclusiveSend(async () => {
+      const text = request.text.trim();
+      if (!text) {
+        throw new AwikiImError("invalid-request", "AWiki message text is required");
+      }
+      const key = sendOperationKey(request.idempotencyKey);
+      const fingerprint = sendFingerprint({ kind: "text", target: request.target, text });
+      const existing = this.options.store.snapshot().sendOperations[key];
+      if (existing) {
+        assertOperationFingerprint(existing.kind, existing.fingerprint, "text", fingerprint);
+        if (existing.kind !== "text") {
+          throw new AwikiImError("conflict", "AWiki idempotency key is already in use");
+        }
+        if (existing.stage === "completed" && existing.result) {
+          return structuredClone(existing.result);
+        }
+        return this.resumeTextSend(key, existing);
+      }
+      const target = await this.resolveTarget(request.target);
+      const stable = stableIdentifiers(request.idempotencyKey);
+      const operation = {
+        kind: "text",
+        fingerprint,
+        target,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        operationId: stable.operationId,
+        messageId: stable.messageId,
+        text,
+        stage: "prepared"
+      };
+      await this.options.store.mutate((state) => {
+        if (state.sendOperations[key]) {
+          throw new AwikiImError("conflict", "AWiki idempotency key is already in use");
+        }
+        state.sendOperations[key] = operation;
+      });
+      return this.resumeTextSend(key, operation);
+    });
+  }
+  /** Serialize persistent send state machines across text and attachment operations. */
+  async exclusiveSend(operation) {
+    let release = () => void 0;
+    const previous = this.sendTail;
+    this.sendTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+  /** Resolve a direct Handle/DID or an existing group conversation. */
+  async resolveTarget(target) {
+    if (target.kind === "direct") {
+      const peer = target.peer.trim();
+      if (!peer) {
+        throw new AwikiImError("invalid-request", "AWiki direct target is required");
+      }
+      const resolved = peer.startsWith("did:") ? { did: peer } : await this.resolveHandle(peer.replace(/^wba:\/\//, ""));
+      const conversationId = directConversationId(resolved.did);
+      await this.upsertConversation({
+        conversation: {
+          kind: "direct",
+          id: conversationId,
+          peerDid: resolved.did,
+          ...resolved.handle ? { peerHandle: resolved.handle } : {},
+          title: resolved.handle ?? resolved.did
+        },
+        peerDid: resolved.did
+      });
+      return {
+        kind: "direct",
+        did: resolved.did,
+        ...resolved.handle ? { handle: resolved.handle } : {},
+        conversationId
+      };
+    }
+    const group = target.group.trim();
+    if (!group) {
+      throw new AwikiImError("invalid-request", "AWiki group target is required");
+    }
+    let record = this.groupConversation(group);
+    if (!record) {
+      await this.refreshGroups();
+      record = this.groupConversation(group);
+    }
+    if (!record?.groupDid) {
+      throw new AwikiImError("not-found", "AWiki group conversation was not found");
+    }
+    return {
+      kind: "group",
+      did: record.groupDid,
+      conversationId: record.conversation.id
+    };
+  }
+  /** Submit one already-encoded Direct/Group message and persist its projection. */
+  async sendPayload(target, contentType, body, wire, content, attachmentReference) {
+    const identity = this.options.identity.requireSecrets();
+    const method = target.kind === "direct" ? "direct.send" : "group.send";
+    const meta = {
+      profile: target.kind === "direct" ? "anp.direct.base.v1" : "anp.group.base.v1",
+      security_profile: "transport-protected",
+      sender_did: identity.public.did,
+      target: { kind: target.kind === "direct" ? "agent" : "group", did: target.did },
+      operation_id: wire.operationId,
+      message_id: wire.messageId,
+      created_at: wire.createdAt,
+      content_type: contentType
+    };
+    const auth = buildOriginAuthentication({
+      method,
+      meta,
+      body,
+      signingPrivateKeyPem: identity.signingPrivateKeyPem,
+      signingKeyId: identity.signingKeyId
+    });
+    const result = await this.authenticatedRpc(method, { meta, auth, body });
+    validateSendResult(result, wire, target);
+    const messageId = wire.messageId;
+    const sentAt = timestampValue(result.accepted_at) ?? Date.now();
+    const message = {
+      id: messageId,
+      conversationId: target.conversationId,
+      conversationKind: target.kind,
+      senderDid: identity.public.did,
+      senderHandle: identity.public.handle,
+      sentAt,
+      outgoing: true,
+      content
+    };
+    const conversation = this.options.store.snapshot().conversations[conversationKey(target.conversationId)];
+    await this.options.store.mutate((state) => {
+      if (conversation) {
+        state.conversations[conversationKey(target.conversationId)] = {
+          ...conversation,
+          conversation: { ...conversation.conversation, lastMessageAt: sentAt }
+        };
+      }
+      if (attachmentReference) {
+        const persistedReference = {
+          ...attachmentReference,
+          messageId
+        };
+        state.attachments[attachmentReferenceKey(persistedReference)] = persistedReference;
+      }
+    });
+    return message;
+  }
+  async resumeTextSend(key, operation) {
+    const message = await this.sendPayload(
+      operation.target,
+      "text/plain",
+      { text: operation.text },
+      {
+        operationId: operation.operationId,
+        messageId: operation.messageId,
+        createdAt: operation.createdAt
+      },
+      { kind: "text", text: operation.text }
+    );
+    await this.options.store.mutate((state) => {
+      const current = state.sendOperations[key];
+      if (!current || current.kind !== "text" || current.fingerprint !== operation.fingerprint) {
+        throw new AwikiImError("conflict", "AWiki send operation state changed");
+      }
+      state.sendOperations[key] = { ...current, stage: "completed", result: message };
+    });
+    return message;
+  }
+  /** Execute a Message Service RPC, refreshing the bearer once on 401/403. */
+  async authenticatedRpc(method, params) {
+    let identity = this.options.identity.requireSecrets();
+    try {
+      const result = await this.options.transport.rpc(
+        this.options.messageServiceUrl,
+        MESSAGE_RPC_PATH,
+        method,
+        params,
+        identity.accessToken
+      );
+      await this.persistReturnedToken(result.accessToken);
+      return result.value;
+    } catch (error) {
+      const normalized = normalizeAwikiImError(error);
+      if (normalized.code !== "forbidden") {
+        throw normalized;
+      }
+      const accessToken = await this.options.identity.refreshAccessToken();
+      identity = this.options.identity.requireSecrets();
+      const result = await this.options.transport.rpc(
+        this.options.messageServiceUrl,
+        MESSAGE_RPC_PATH,
+        method,
+        params,
+        accessToken || identity.accessToken
+      );
+      await this.persistReturnedToken(result.accessToken);
+      return result.value;
+    }
+  }
+  async refreshConversations() {
+    await this.refreshGroups();
+    const identity = this.options.identity.requireSecrets();
+    let skip = 0;
+    for (let page = 0; page < MAX_REFRESH_PAGES; page += 1) {
+      const result = await this.authenticatedRpc("inbox.get", {
+        meta: localMeta(identity.public.did, "anp.inbox.local.v1"),
+        body: compactRecord({
+          user_did: identity.public.did,
+          limit: MAX_PAGE_LIMIT,
+          skip: skip || void 0
+        })
+      });
+      const wires = arrayValue(result.messages);
+      const mapped = wires.map(
+        (wire) => isRecord3(wire) ? this.mapWireMessage(wire, void 0, identity.public.did) : null
+      ).filter((message) => message !== null);
+      await this.persistMappedMessages(mapped);
+      if (result.has_more !== true) {
+        return;
+      }
+      if (wires.length === 0) {
+        throw new AwikiImError("remote", "AWiki inbox pagination did not advance");
+      }
+      skip += wires.length;
+    }
+    throw new AwikiImError("remote", "AWiki inbox pagination exceeded the safety limit");
+  }
+  async refreshGroups() {
+    const identity = this.options.identity.requireSecrets();
+    let cursor;
+    for (let page = 0; page < MAX_REFRESH_PAGES; page += 1) {
+      const result = await this.authenticatedRpc("group.list", {
+        meta: groupLocalMeta(identity.public.did),
+        body: compactRecord({ limit: MAX_PAGE_LIMIT, cursor })
+      });
+      const groups = arrayValue(result.groups).map(groupConversationFromWire).filter((group) => group !== null);
+      if (groups.length > 0) {
+        await this.options.store.mutate((state) => {
+          for (const group of groups) {
+            state.conversations[conversationKey(group.conversation.id)] = mergeConversation(
+              state.conversations[conversationKey(group.conversation.id)],
+              group
+            );
+          }
+        });
+      }
+      const nextCursor = cursorValue(result.next_cursor);
+      if (result.has_more === true && !nextCursor) {
+        throw new AwikiImError("remote", "AWiki group pagination omitted its cursor");
+      }
+      if (!nextCursor) {
+        return;
+      }
+      if (nextCursor === cursor) {
+        throw new AwikiImError("remote", "AWiki group pagination did not advance");
+      }
+      cursor = nextCursor;
+    }
+    throw new AwikiImError("remote", "AWiki group pagination exceeded the safety limit");
+  }
+  async resolveHandle(peer) {
+    const result = await this.options.transport.rpc(
+      this.options.userServiceUrl,
+      HANDLE_RPC_PATH,
+      "lookup",
+      { handle: peer }
+    );
+    const did = requiredWireString(result.value.did, "resolved DID");
+    const handle = stringValue2(result.value.full_handle) ?? stringValue2(result.value.handle);
+    return { did, ...handle ? { handle } : {} };
+  }
+  mapWireMessage(wire, fallbackConversation, ownerDid) {
+    const messageId = stringValue2(wire.message_id) ?? stringValue2(wire.id) ?? stringValue2(wire.client_msg_id);
+    const senderDid = stringValue2(wire.sender_did);
+    if (!messageId || !senderDid) {
+      return null;
+    }
+    const receiverDid = stringValue2(wire.receiver_did);
+    const groupDid = stringValue2(wire.group_did) ?? (fallbackConversation?.kind === "group" ? fallbackConversation.groupDid : void 0);
+    const kind = groupDid ? "group" : "direct";
+    const peerDid = kind === "direct" ? senderDid !== ownerDid ? senderDid : receiverDid : void 0;
+    if (kind === "direct" && !peerDid) {
+      return null;
+    }
+    const conversationId = fallbackConversation?.id ?? (kind === "group" ? groupConversationId(groupDid) : directConversationId(peerDid));
+    const sentAt = timestampValue(wire.sent_at) ?? timestampValue(wire.accepted_at) ?? timestampValue(wire.created_at) ?? 0;
+    const contentType = stringValue2(wire.content_type) ?? "text/plain";
+    const attachment = parseAttachmentMessage(
+      wire.content,
+      contentType,
+      this.options.attachmentMaxBytes
+    );
+    const content = attachment ? {
+      kind: "attachment",
+      attachment: attachment.attachment,
+      ...attachment.caption ? { caption: attachment.caption } : {}
+    } : { kind: "text", text: textContent(wire) };
+    const peerHandle = stringValue2(wire.peer_full_handle) ?? (senderDid !== ownerDid ? stringValue2(wire.sender_handle) : void 0);
+    const conversation = kind === "group" ? {
+      kind: "group",
+      id: conversationId,
+      groupDid,
+      title: stringValue2(wire.group_name) ?? (fallbackConversation?.kind === "group" ? fallbackConversation.title : groupDid),
+      ...sentAt ? { lastMessageAt: sentAt } : {}
+    } : {
+      kind: "direct",
+      id: conversationId,
+      peerDid,
+      ...peerHandle ? { peerHandle } : {},
+      title: peerHandle ?? (fallbackConversation?.kind === "direct" ? fallbackConversation.title : peerDid),
+      ...sentAt ? { lastMessageAt: sentAt } : {}
+    };
+    const message = {
+      id: messageId,
+      conversationId,
+      conversationKind: kind,
+      senderDid,
+      ...stringValue2(wire.sender_handle) ? { senderHandle: stringValue2(wire.sender_handle) } : {},
+      sentAt,
+      outgoing: senderDid === ownerDid,
+      content
+    };
+    const attachmentReference = attachment ? {
+      attachment: attachment.attachment,
+      objectUri: attachment.objectUri,
+      senderDid,
+      messageId,
+      ...kind === "group" ? { groupDid } : { messageTargetDid: receiverDid ?? peerDid },
+      messageServiceDid: this.options.identity.requireSecrets().messageServiceDid
+    } : void 0;
+    return {
+      message,
+      conversation: {
+        conversation,
+        ...peerDid ? { peerDid } : {},
+        ...groupDid ? { groupDid } : {}
+      },
+      attachmentReference
+    };
+  }
+  async persistMappedMessages(mapped) {
+    if (mapped.length === 0) {
+      return;
+    }
+    await this.options.store.mutate((state) => {
+      for (const entry of mapped) {
+        const key = conversationKey(entry.conversation.conversation.id);
+        state.conversations[key] = mergeConversation(state.conversations[key], entry.conversation);
+        if (entry.attachmentReference) {
+          state.attachments[attachmentReferenceKey(entry.attachmentReference)] = entry.attachmentReference;
+        }
+      }
+    });
+  }
+  async upsertConversation(record) {
+    await this.options.store.mutate((state) => {
+      const key = conversationKey(record.conversation.id);
+      state.conversations[key] = mergeConversation(state.conversations[key], record);
+    });
+  }
+  groupConversation(value) {
+    return Object.values(this.options.store.snapshot().conversations).find(
+      (record) => record.conversation.kind === "group" && (record.conversation.id === value || record.groupDid === value)
+    );
+  }
+  async persistReturnedToken(token) {
+    if (!token || token === this.options.store.snapshot().identity?.accessToken) {
+      return;
+    }
+    await this.options.store.mutate((state) => {
+      if (state.identity) {
+        state.identity = { ...state.identity, accessToken: token };
+      }
+    });
+  }
+};
+function validateHistoryWires(wires, conversation, ownerDid) {
+  for (const wire of wires) {
+    if (!isRecord3(wire)) {
+      throw new AwikiImError("remote", "AWiki history response contains an invalid message");
+    }
+    if (conversation.conversation.kind === "group") {
+      if (stringValue2(wire.group_did) !== conversation.groupDid) {
+        throw new AwikiImError("remote", "AWiki history message does not belong to the group");
+      }
+      continue;
+    }
+    const senderDid = stringValue2(wire.sender_did);
+    const receiverDid = stringValue2(wire.receiver_did);
+    const peerDid = conversation.peerDid;
+    if (!peerDid || !senderDid || !receiverDid || !(senderDid === ownerDid && receiverDid === peerDid || senderDid === peerDid && receiverDid === ownerDid)) {
+      throw new AwikiImError("remote", "AWiki history message does not belong to the direct peer");
+    }
+  }
+}
+function validateSendResult(result, wire, target) {
+  if (result.accepted !== true || result.operation_id !== wire.operationId || result.message_id !== wire.messageId || (target.kind === "direct" ? result.target_did !== target.did : result.group_did !== target.did)) {
+    throw new AwikiImError("remote", "AWiki send acknowledgement is invalid");
+  }
+}
+function localMeta(senderDid, profile) {
+  return {
+    profile,
+    security_profile: "transport-protected",
+    sender_did: senderDid,
+    operation_id: operationId("op"),
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function groupLocalMeta(senderDid, groupDid) {
+  return {
+    profile: "anp.group.local.v1",
+    security_profile: "transport-protected",
+    sender_did: senderDid,
+    ...groupDid ? { target: { kind: "group", did: groupDid } } : {}
+  };
+}
+function groupConversationFromWire(value) {
+  if (!isRecord3(value)) {
+    return null;
+  }
+  const groupDid = stringValue2(value.group_did) ?? stringValue2(value.did) ?? stringValue2(value.id);
+  if (!groupDid) {
+    return null;
+  }
+  const profile = isRecord3(value.profile) ? value.profile : void 0;
+  const title = stringValue2(value.title) ?? stringValue2(value.name) ?? stringValue2(value.display_name) ?? stringValue2(profile?.display_name) ?? groupDid;
+  const lastMessageAt = timestampValue(value.last_message_at);
+  return {
+    conversation: {
+      kind: "group",
+      id: groupConversationId(groupDid),
+      groupDid,
+      title,
+      ...lastMessageAt ? { lastMessageAt } : {}
+    },
+    groupDid
+  };
+}
+function parseAttachmentMessage(rawContent, contentType, maximumBytes) {
+  if (contentType !== "application/anp-attachment-manifest+json") {
+    return null;
+  }
+  const decoded = typeof rawContent === "string" ? parseJsonRecord(rawContent) : isRecord3(rawContent) ? rawContent : void 0;
+  if (!decoded) {
+    throw new AwikiImError("remote", "AWiki attachment manifest is invalid");
+  }
+  const attachments = arrayValue(decoded.attachments);
+  if (attachments.length !== 1 || !isRecord3(attachments[0])) {
+    throw new AwikiImError("remote", "AWiki attachment manifest is invalid");
+  }
+  const selected = attachments[0];
+  const digest = isRecord3(selected.digest) ? selected.digest : void 0;
+  const access = isRecord3(selected.access_info) ? selected.access_info : void 0;
+  const encryption = isRecord3(selected.encryption_info) ? selected.encryption_info : void 0;
+  const id = stringValue2(selected.attachment_id);
+  const mimeType = stringValue2(selected.mime_type);
+  const size = integerValue(selected.size);
+  const digestB64u = stringValue2(digest?.value_b64u);
+  const objectUri = stringValue2(access?.object_uri);
+  if (!id || !mimeType || size === void 0 || size > maximumBytes || !digestB64u || !objectUri || digest?.alg !== "sha-256" || encryption?.mode !== "none" || decoded.primary_attachment_id !== void 0 && decoded.primary_attachment_id !== id) {
+    throw new AwikiImError("remote", "AWiki attachment manifest is invalid");
+  }
+  return {
+    attachment: {
+      id,
+      fileName: stringValue2(selected.filename) ?? id,
+      mimeType,
+      size,
+      sha256: Buffer.from(digestB64u, "base64url").toString("hex")
+    },
+    objectUri,
+    ...stringValue2(decoded.caption) ? { caption: stringValue2(decoded.caption) } : {}
+  };
+}
+function textContent(wire) {
+  const content = wire.content;
+  if (typeof content === "string") {
+    return content;
+  }
+  if (isRecord3(content) && typeof content.text === "string") {
+    return content.text;
+  }
+  if (isRecord3(wire.body) && typeof wire.body.text === "string") {
+    return wire.body.text;
+  }
+  return "";
+}
+function stableIdentifiers(idempotencyKey) {
+  const key = idempotencyKey.trim();
+  if (!key || key.length > 256) {
+    throw new AwikiImError("invalid-request", "AWiki idempotency key is invalid");
+  }
+  const digest = createHash("sha256").update(key).digest("hex").slice(0, 32);
+  return { operationId: `op-${digest}`, messageId: `msg-${digest}` };
+}
+function sendOperationKey(idempotencyKey) {
+  const key = idempotencyKey.trim();
+  if (!key || key.length > 256) {
+    throw new AwikiImError("invalid-request", "AWiki idempotency key is invalid");
+  }
+  return createHash("sha256").update(`send-operation:${key}`).digest("hex");
+}
+function sendFingerprint(value) {
+  return createHash("sha256").update(canonicalizeJson(value)).digest("hex");
+}
+function assertOperationFingerprint(actualKind, actualFingerprint, expectedKind, expectedFingerprint) {
+  if (actualKind !== expectedKind || actualFingerprint !== expectedFingerprint) {
+    throw new AwikiImError("conflict", "AWiki idempotency key is already in use");
+  }
+}
+function attachmentReferenceKey(reference) {
+  return [reference.senderDid, reference.messageId, reference.attachment.id].map((value) => Buffer.from(value).toString("base64url")).join(".");
+}
+function directConversationId(peerDid) {
+  return `direct:${Buffer.from(peerDid).toString("base64url")}`;
+}
+function groupConversationId(groupDid) {
+  return `group:${Buffer.from(groupDid).toString("base64url")}`;
+}
+function mergeConversation(current, next) {
+  if (!current) {
+    return next;
+  }
+  const currentTime = current.conversation.lastMessageAt ?? 0;
+  const nextTime = next.conversation.lastMessageAt ?? 0;
+  return {
+    ...current,
+    ...next,
+    conversation: {
+      ...current.conversation,
+      ...next.conversation,
+      ...Math.max(currentTime, nextTime) > 0 ? { lastMessageAt: Math.max(currentTime, nextTime) } : {}
+    }
+  };
+}
+function compareConversationRecency(left, right) {
+  return (right.lastMessageAt ?? 0) - (left.lastMessageAt ?? 0) || left.title.localeCompare(right.title);
+}
+function compareMessageTime(left, right) {
+  return left.sentAt - right.sentAt || left.id.localeCompare(right.id);
+}
+function pageLimit(value) {
+  if (value === void 0) {
+    return DEFAULT_PAGE_LIMIT;
+  }
+  if (!Number.isSafeInteger(value) || value < 1 || value > MAX_PAGE_LIMIT) {
+    throw new AwikiImError("invalid-request", "AWiki page limit is invalid");
+  }
+  return value;
+}
+function encodeOffsetCursor(offset) {
+  return Buffer.from(JSON.stringify({ v: 1, offset })).toString("base64url");
+}
+function decodeOffsetCursor(cursor) {
+  if (!cursor) {
+    return 0;
+  }
+  try {
+    const decoded = JSON.parse(
+      Buffer.from(cursor, "base64url").toString("utf8")
+    );
+    if (isRecord3(decoded) && decoded.v === 1 && typeof decoded.offset === "number" && Number.isSafeInteger(decoded.offset) && decoded.offset >= 0) {
+      return decoded.offset;
+    }
+  } catch {
+  }
+  throw new AwikiImError("invalid-request", "AWiki page cursor is invalid");
+}
+function encodeHistoryCursor(kind, conversationId, skip) {
+  return Buffer.from(
+    JSON.stringify({ v: 1, kind, conversationId, skip }),
+    "utf8"
+  ).toString("base64url");
+}
+function decodeHistoryCursor(cursor, expectedKind, expectedConversationId) {
+  if (!cursor) {
+    return 0;
+  }
+  try {
+    const decoded = JSON.parse(
+      Buffer.from(cursor, "base64url").toString("utf8")
+    );
+    if (isRecord3(decoded) && decoded.v === 1 && decoded.kind === expectedKind && decoded.conversationId === expectedConversationId && typeof decoded.skip === "number" && Number.isSafeInteger(decoded.skip) && decoded.skip >= 0) {
+      return decoded.skip;
+    }
+  } catch {
+  }
+  throw new AwikiImError("invalid-request", "AWiki history cursor is invalid");
+}
+function compactRecord(record) {
+  return Object.fromEntries(Object.entries(record).filter(([, value]) => value !== void 0));
+}
+function requiredConversationValue(value) {
+  if (!value) {
+    throw new AwikiImError("not-found", "AWiki conversation was not found");
+  }
+  return value;
+}
+function requiredWireString(value, label) {
+  const result = stringValue2(value);
+  if (!result) {
+    throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+  }
+  return result;
+}
+function cursorValue(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  return stringValue2(value);
+}
+function timestampValue(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e10 ? value : value * 1e3;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const numeric = Number(value);
+    if (Number.isFinite(numeric)) {
+      return numeric > 1e10 ? numeric : numeric * 1e3;
+    }
+    const parsed = Date.parse(value);
+    return Number.isNaN(parsed) ? void 0 : parsed;
+  }
+  return void 0;
+}
+function integerValue(value) {
+  const numeric = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+  return Number.isSafeInteger(numeric) && numeric >= 0 ? numeric : void 0;
+}
+function stringValue2(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function arrayValue(value) {
+  return Array.isArray(value) ? value : [];
+}
+function parseJsonRecord(value) {
+  try {
+    const decoded = JSON.parse(value);
+    return isRecord3(decoded) ? decoded : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/im/attachments.ts
+var ATTACHMENT_PROFILE = "anp.attachment.v1";
+var ATTACHMENT_CONTENT_TYPE = "application/anp-attachment-manifest+json";
+var AwikiAttachmentRuntime = class {
+  constructor(options) {
+    this.options = options;
+  }
+  /** Upload, commit, and send one attachment manifest. */
+  async sendAttachment(request) {
+    return this.options.messaging.exclusiveSend(async () => {
+      validateUpload(request.attachment, this.options.attachmentMaxBytes);
+      const prepared = prepareAttachment(request.attachment.bytes);
+      const caption = request.caption?.trim() || void 0;
+      const fingerprint = sendFingerprint({
+        kind: "attachment",
+        target: request.target,
+        fileName: request.attachment.fileName,
+        mimeType: request.attachment.mimeType,
+        size: request.attachment.bytes.byteLength,
+        digest: prepared.digestHex,
+        caption
+      });
+      const key = sendOperationKey(request.idempotencyKey);
+      const existing = this.options.store.snapshot().sendOperations[key];
+      if (existing) {
+        assertOperationFingerprint(existing.kind, existing.fingerprint, "attachment", fingerprint);
+        if (existing.kind !== "attachment") {
+          throw new AwikiImError("conflict", "AWiki idempotency key is already in use");
+        }
+        if (existing.stage === "completed" && existing.result) {
+          return structuredClone(existing.result);
+        }
+        return this.resumeAttachmentSend(key, existing, request.attachment.bytes);
+      }
+      const target = await this.options.messaging.resolveTarget(request.target);
+      const identifiers = attachmentIdentifiers(request.idempotencyKey);
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const operation = {
+        kind: "attachment",
+        fingerprint,
+        target,
+        attachment: {
+          id: identifiers.attachmentId,
+          fileName: request.attachment.fileName,
+          mimeType: request.attachment.mimeType,
+          size: request.attachment.bytes.byteLength,
+          sha256: prepared.digestHex
+        },
+        digestB64u: prepared.digestB64u,
+        ...caption ? { caption } : {},
+        createOperationId: identifiers.createOperationId,
+        commitOperationId: identifiers.commitOperationId,
+        messageOperationId: identifiers.messageOperationId,
+        messageId: identifiers.messageId,
+        createCreatedAt: now,
+        commitCreatedAt: now,
+        messageCreatedAt: now,
+        stage: "prepared"
+      };
+      await this.options.store.mutate((state) => {
+        if (state.sendOperations[key]) {
+          throw new AwikiImError("conflict", "AWiki idempotency key is already in use");
+        }
+        state.sendOperations[key] = operation;
+      });
+      return this.resumeAttachmentSend(key, operation, request.attachment.bytes);
+    });
+  }
+  async resumeAttachmentSend(key, initial, bytes) {
+    const identity = this.options.identity.requireSecrets();
+    let operation = initial;
+    if (operation.stage === "prepared") {
+      const slotResult = await this.options.messaging.authenticatedRpc("attachment.create_slot", {
+        meta: attachmentMeta(
+          identity.public.did,
+          identity.messageServiceDid,
+          operation.createOperationId,
+          operation.createCreatedAt
+        ),
+        body: {
+          attachment_id: operation.attachment.id,
+          expected_size: String(operation.attachment.size),
+          expected_digest: { alg: "sha-256", value_b64u: operation.digestB64u },
+          mime_type: operation.attachment.mimeType,
+          filename: operation.attachment.fileName,
+          intended_message_security_profile: "transport-protected",
+          intended_target: {
+            kind: operation.target.kind === "direct" ? "agent" : "group",
+            did: operation.target.did
+          },
+          object_encryption_mode: "none"
+        }
+      });
+      const slot2 = parseSlot(slotResult, operation.attachment.id);
+      this.options.transport.validateAttachmentUrl(slot2.uploadUri);
+      this.options.transport.validateAttachmentUrl(slot2.objectUri);
+      operation = await this.advanceOperation(key, operation, { stage: "slot-created", slot: slot2 });
+    }
+    const slot = requiredSlot(operation);
+    if (operation.stage === "slot-created") {
+      await this.options.transport.putBytes(slot.uploadUri, slot.uploadHeaders, bytes);
+      operation = await this.advanceOperation(key, operation, { stage: "uploaded" });
+    }
+    if (operation.stage === "uploaded") {
+      const commit = await this.options.messaging.authenticatedRpc("attachment.commit_object", {
+        meta: attachmentMeta(
+          identity.public.did,
+          identity.messageServiceDid,
+          operation.commitOperationId,
+          operation.commitCreatedAt
+        ),
+        body: {
+          attachment_id: operation.attachment.id,
+          slot_id: slot.slotId,
+          commit_token: slot.commitToken,
+          size: String(operation.attachment.size),
+          digest: { alg: "sha-256", value_b64u: operation.digestB64u },
+          object_encryption_mode: "none"
+        }
+      });
+      if (commit.committed !== true || commit.attachment_id !== operation.attachment.id || commit.object_uri !== slot.objectUri) {
+        throw new AwikiImError("remote", "AWiki attachment commit acknowledgement is invalid");
+      }
+      operation = await this.advanceOperation(key, operation, { stage: "committed" });
+    }
+    if (operation.stage !== "committed") {
+      if (operation.stage === "completed" && operation.result) return operation.result;
+      throw new AwikiImError("remote", "AWiki attachment send state is invalid");
+    }
+    const manifest = {
+      attachments: [
+        {
+          attachment_id: operation.attachment.id,
+          filename: operation.attachment.fileName,
+          mime_type: operation.attachment.mimeType,
+          size: String(operation.attachment.size),
+          digest: { alg: "sha-256", value_b64u: operation.digestB64u },
+          access_info: { object_uri: slot.objectUri },
+          encryption_info: { mode: "none" }
+        }
+      ],
+      ...operation.caption ? { caption: operation.caption } : {},
+      primary_attachment_id: operation.attachment.id
+    };
+    const reference = {
+      attachment: operation.attachment,
+      objectUri: slot.objectUri,
+      senderDid: identity.public.did,
+      ...operation.target.kind === "group" ? { groupDid: operation.target.did } : { messageTargetDid: operation.target.did },
+      messageServiceDid: identity.messageServiceDid
+    };
+    const message = await this.options.messaging.sendPayload(
+      operation.target,
+      ATTACHMENT_CONTENT_TYPE,
+      { payload: manifest },
+      {
+        operationId: operation.messageOperationId,
+        messageId: operation.messageId,
+        createdAt: operation.messageCreatedAt
+      },
+      {
+        kind: "attachment",
+        attachment: operation.attachment,
+        ...operation.caption ? { caption: operation.caption } : {}
+      },
+      reference
+    );
+    await this.advanceOperation(key, operation, { stage: "completed", result: message });
+    return message;
+  }
+  async advanceOperation(key, expected, patch) {
+    let updated;
+    await this.options.store.mutate((state) => {
+      const current = state.sendOperations[key];
+      if (!current || current.kind !== "attachment" || current.fingerprint !== expected.fingerprint || current.stage !== expected.stage) {
+        throw new AwikiImError("conflict", "AWiki attachment send operation state changed");
+      }
+      updated = { ...current, ...patch };
+      state.sendOperations[key] = updated;
+    });
+    if (!updated) {
+      throw new AwikiImError("remote", "AWiki attachment send state was not persisted");
+    }
+    return updated;
+  }
+  /** Issue a ticket, download the object, and verify exact size and SHA-256. */
+  async downloadAttachment(request) {
+    const identity = this.options.identity.requireSecrets();
+    const references = Object.values(this.options.store.snapshot().attachments).filter(
+      (candidate) => candidate.attachment.id === request.attachmentId && candidate.messageId === request.messageId
+    );
+    if (references.length === 0) {
+      throw new AwikiImError("not-found", "AWiki attachment was not found");
+    }
+    if (references.length > 1) {
+      throw new AwikiImError("conflict", "AWiki attachment message reference is ambiguous");
+    }
+    const reference = references[0];
+    if (!reference) {
+      throw new AwikiImError("not-found", "AWiki attachment was not found");
+    }
+    this.options.transport.validateAttachmentUrl(reference.objectUri);
+    const operation = operationId("op");
+    const messageServiceDid = await this.resolveAttachmentServiceDid(reference.senderDid);
+    const ticket = await this.options.messaging.authenticatedRpc("attachment.get_download_ticket", {
+      meta: attachmentMeta(
+        identity.public.did,
+        messageServiceDid,
+        operation,
+        (/* @__PURE__ */ new Date()).toISOString()
+      ),
+      body: {
+        attachment_id: reference.attachment.id,
+        object_uri: reference.objectUri,
+        requester_did: identity.public.did,
+        message_security_profile: "transport-protected",
+        message_id: reference.messageId,
+        one_time: true,
+        ...reference.groupDid ? { group_did: reference.groupDid } : { message_target_did: requiredDirectTarget(reference) }
+      }
+    });
+    validateTicketBinding(ticket.ticket_binding, reference, identity.public.did);
+    const ticketValue = requiredString2(ticket.download_ticket_b64u, "download ticket");
+    const bytes = await this.options.transport.getBytes(
+      reference.objectUri,
+      ticketValue,
+      reference.attachment.size
+    );
+    const digestHex = createHash("sha256").update(bytes).digest("hex");
+    if (bytes.byteLength !== reference.attachment.size || digestHex !== reference.attachment.sha256) {
+      throw new AwikiImError("remote", "AWiki attachment verification failed");
+    }
+    return { attachment: reference.attachment, bytes };
+  }
+  async resolveAttachmentServiceDid(senderDid) {
+    const identity = this.options.identity.requireSecrets();
+    const document = senderDid === identity.public.did ? identity.didDocument : await this.options.transport.getJson(didResolutionUrl(senderDid));
+    if (document.id !== senderDid) {
+      throw new AwikiImError("remote", "AWiki service returned an invalid response");
+    }
+    if (!isValidAttachmentDidDocument(document)) {
+      throw new AwikiImError("remote", "AWiki attachment sender DID document is invalid");
+    }
+    const matching = arrayValue2(document.service).filter(isRecord4).filter(
+      (service) => service.type === "ANPMessageService" && arrayValue2(service.profiles).includes(ATTACHMENT_PROFILE) && arrayValue2(service.securityProfiles ?? service.security_profiles).includes(
+        "transport-protected"
+      ) && typeof service.serviceDid === "string" && service.serviceDid.trim() && typeof service.serviceEndpoint === "string" && service.serviceEndpoint.trim()
+    ).map((service, index) => ({
+      service,
+      index,
+      priority: priorityValue(service.priority)
+    })).sort((left, right) => {
+      if (left.priority !== void 0 && right.priority !== void 0) {
+        return left.priority - right.priority || left.index - right.index;
+      }
+      if (left.priority !== void 0) return -1;
+      if (right.priority !== void 0) return 1;
+      return left.index - right.index;
+    });
+    const selected = matching[0]?.service;
+    if (!selected) {
+      throw new AwikiImError("remote", "AWiki attachment service was not found");
+    }
+    this.options.transport.validateAttachmentUrl(
+      requiredString2(selected.serviceEndpoint, "attachment service endpoint")
+    );
+    return requiredString2(selected.serviceDid, "attachment service DID");
+  }
+};
+function requiredSlot(operation) {
+  if (!operation.slot) {
+    throw new AwikiImError("remote", "AWiki attachment slot state is missing");
+  }
+  return operation.slot;
+}
+function parseSlot(result, expectedAttachmentId) {
+  const attachmentId = requiredString2(result.attachment_id, "attachment ID");
+  if (attachmentId !== expectedAttachmentId) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response");
+  }
+  return {
+    attachmentId,
+    slotId: requiredString2(result.slot_id, "attachment slot ID"),
+    uploadUri: requiredString2(result.upload_uri, "attachment upload URI"),
+    uploadHeaders: stringRecord(result.upload_headers, "attachment upload headers"),
+    objectUri: requiredString2(result.object_uri, "attachment object URI"),
+    commitToken: requiredString2(result.commit_token, "attachment commit token")
+  };
+}
+function attachmentMeta(senderDid, serviceDid, operation, createdAt) {
+  return {
+    profile: ATTACHMENT_PROFILE,
+    security_profile: "transport-protected",
+    sender_did: senderDid,
+    target: { kind: "service", did: serviceDid },
+    operation_id: operation,
+    created_at: createdAt
+  };
+}
+function attachmentIdentifiers(idempotencyKey) {
+  const key = idempotencyKey.trim();
+  if (!key || key.length > 256) {
+    throw new AwikiImError("invalid-request", "AWiki idempotency key is invalid");
+  }
+  return {
+    attachmentId: `att-${digestPrefix(`attachment:${key}`)}`,
+    createOperationId: `op-${digestPrefix(`create:${key}`)}`,
+    commitOperationId: `op-${digestPrefix(`commit:${key}`)}`,
+    messageOperationId: `op-${digestPrefix(`message:${key}`)}`,
+    messageId: `msg-${digestPrefix(`message:${key}`)}`
+  };
+}
+function digestPrefix(value) {
+  return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+function prepareAttachment(bytes) {
+  const digest = createHash("sha256").update(bytes).digest();
+  return { digestHex: digest.toString("hex"), digestB64u: digest.toString("base64url") };
+}
+function validateUpload(upload, maximumBytes) {
+  if (!upload.fileName.trim() || upload.fileName.includes("/") || upload.fileName.includes("\\")) {
+    throw new AwikiImError("invalid-request", "AWiki attachment file name is invalid");
+  }
+  if (!/^[\w.+-]+\/[\w.+-]+$/.test(upload.mimeType.trim())) {
+    throw new AwikiImError("invalid-request", "AWiki attachment MIME type is invalid");
+  }
+  if (!(upload.bytes instanceof Uint8Array)) {
+    throw new AwikiImError("invalid-request", "AWiki attachment bytes are invalid");
+  }
+  if (upload.bytes.byteLength > maximumBytes) {
+    throw new AwikiImError("invalid-request", "AWiki attachment exceeds the configured limit");
+  }
+}
+function validateTicketBinding(value, reference, requesterDid) {
+  if (!isRecord4(value)) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response");
+  }
+  const expected = {
+    attachment_id: reference.attachment.id,
+    object_uri: reference.objectUri,
+    requester_did: requesterDid,
+    message_id: reference.messageId,
+    message_security_profile: "transport-protected"
+  };
+  if (Object.entries(expected).some(([key, expectedValue]) => value[key] !== expectedValue) || (reference.groupDid ? value.group_did !== reference.groupDid : value.message_target_did !== reference.messageTargetDid)) {
+    throw new AwikiImError("remote", "AWiki service returned an invalid response");
+  }
+}
+function requiredDirectTarget(reference) {
+  if (!reference.messageTargetDid) {
+    throw new AwikiImError("not-found", "AWiki attachment message context was not found");
+  }
+  return reference.messageTargetDid;
+}
+function didResolutionUrl(did) {
+  if (!did.startsWith("did:wba:")) {
+    throw new AwikiImError("remote", "AWiki attachment sender DID is invalid");
+  }
+  const parts = did.split(":");
+  const authority = parts[2];
+  if (!authority) {
+    throw new AwikiImError("remote", "AWiki attachment sender DID is invalid");
+  }
+  const host = decodeURIComponent(authority);
+  const path = parts.slice(3).map((segment) => encodeURIComponent(segment)).join("/");
+  return path ? `https://${host}/${path}/did.json` : `https://${host}/.well-known/did.json`;
+}
+function requiredString2(value, label) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+  }
+  return value.trim();
+}
+function stringRecord(value, label) {
+  if (!isRecord4(value)) {
+    throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+  }
+  const output = {};
+  for (const [key, headerValue] of Object.entries(value)) {
+    if (typeof headerValue !== "string" || !key.trim()) {
+      throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+    }
+    output[key] = headerValue;
+  }
+  return output;
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function arrayValue2(value) {
+  return Array.isArray(value) ? value : [];
+}
+function priorityValue(value) {
+  const parsed = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+  return Number.isFinite(parsed) ? Math.trunc(parsed) : void 0;
+}
+function isValidAttachmentDidDocument(document) {
+  try {
+    return validateDidDocumentBinding(document, true);
+  } catch {
+    return false;
+  }
+}
+
+// src/im/identity.ts
+var AwikiIdentityRuntime = class {
+  constructor(options) {
+    this.options = options;
+  }
+  registrationTail = Promise.resolve();
+  /** Return the public identity projection. */
+  getIdentity() {
+    return this.options.store.snapshot().identity?.public ?? null;
+  }
+  /** Reject persisted identity material that belongs to a different configured deployment. */
+  validateConfiguredIdentity() {
+    const snapshot = this.options.store.snapshot();
+    const material = snapshot.identity ?? snapshot.pendingRegistration;
+    if (material && material.messageServiceDid !== this.options.messageServiceDid) {
+      throw new AwikiImError("conflict", "AWiki state belongs to a different Message Service");
+    }
+    const handle = snapshot.identity?.public.handle ?? snapshot.pendingRegistration?.handle;
+    if (handle && !handle.endsWith(`.${this.options.userServiceDomain}`)) {
+      throw new AwikiImError("conflict", "AWiki state belongs to a different User Service domain");
+    }
+  }
+  /** Send the phone-only registration OTP supported by the frozen MVP API. */
+  async sendRegistrationOtp(request) {
+    if (this.getIdentity()) {
+      throw new AwikiImError("already-registered", "AWiki identity is already registered");
+    }
+    const phone = normalizePhone(request.phone);
+    const handle = normalizeRegistrationHandle(request.handle, this.options.userServiceDomain);
+    const result = await this.options.transport.rpc(
+      this.options.userServiceUrl,
+      HANDLE_RPC_PATH,
+      "send_otp",
+      { phone }
+    );
+    const retryAfterSeconds = requiredWireNumber(
+      result.value.retry_after_seconds,
+      "retry_after_seconds"
+    );
+    const retryAt = requiredWireString2(result.value.retry_at, "retry_at");
+    const registrationOtp = {
+      handle: handle.full,
+      phone,
+      retryAt
+    };
+    await this.options.store.mutate((state) => {
+      state.registrationOtp = registrationOtp;
+    });
+    return { retryAfterSeconds, retryAt };
+  }
+  /** Register and persist the one deployment identity. */
+  async registerIdentity(request) {
+    return this.exclusiveRegistration(async () => {
+      if (this.getIdentity()) {
+        throw new AwikiImError("already-registered", "AWiki identity is already registered");
+      }
+      const registrationOtp = this.options.store.snapshot().registrationOtp;
+      const phone = normalizePhone(request.phone);
+      const otp = normalizeOtp(request.otp);
+      const handle = normalizeRegistrationHandle(request.handle, this.options.userServiceDomain);
+      if (!registrationOtp || registrationOtp.phone !== phone || registrationOtp.handle !== handle.full) {
+        throw new AwikiImError("invalid-request", "AWiki registration OTP target does not match");
+      }
+      let pending = this.options.store.snapshot().pendingRegistration;
+      if (pending) {
+        if (pending.handle !== handle.full || pending.phone !== phone) {
+          throw new AwikiImError("conflict", "AWiki registration is already pending");
+        }
+        pending = refreshPendingProof(pending, handle.domain);
+      } else {
+        pending = createPendingRegistration(
+          phone,
+          handle,
+          this.options.messageServicePublicUrl,
+          this.options.messageServiceDid
+        );
+      }
+      await this.options.store.mutate((state) => {
+        state.pendingRegistration = pending;
+      });
+      try {
+        const result = await this.options.transport.rpc(
+          this.options.userServiceUrl,
+          DID_AUTH_RPC_PATH,
+          "register",
+          {
+            did_document: pending.didDocument,
+            handle: handle.local,
+            phone,
+            otp_code: otp
+          }
+        );
+        return this.commitRegistration(pending, result.value, result.accessToken);
+      } catch (error) {
+        const normalized = normalizeAwikiImError(error);
+        if (normalized.code === "conflict") {
+          const reconciled = await this.tryReconcilePending(pending);
+          if (reconciled) {
+            return reconciled;
+          }
+        }
+        throw normalized;
+      }
+    });
+  }
+  /** Require secret identity material for a message operation. */
+  requireSecrets() {
+    const identity = this.options.store.snapshot().identity;
+    if (!identity) {
+      throw new AwikiImError("not-registered", "AWiki identity is not registered");
+    }
+    return identity;
+  }
+  /** Refresh an expired bearer by authenticating the persisted DID. */
+  async refreshAccessToken() {
+    const identity = this.requireSecrets();
+    const result = await this.options.transport.signedRpc(
+      this.options.userServiceUrl,
+      DID_AUTH_RPC_PATH,
+      "get_me",
+      {},
+      {
+        didDocument: identity.didDocument,
+        signingPrivateKeyPem: identity.signingPrivateKeyPem,
+        signingKeyId: identity.signingKeyId
+      }
+    );
+    const token = result.accessToken ?? requiredWireString2(result.value.access_token, "access token");
+    await this.options.store.mutate((state) => {
+      if (state.identity) {
+        state.identity = { ...state.identity, accessToken: token };
+      }
+    });
+    return token;
+  }
+  async commitRegistration(pending, result, headerToken) {
+    const state = requiredWireString2(result.state, "registration state");
+    if (state === "join_required") {
+      throw new AwikiImError("already-registered", "AWiki identity is already registered");
+    }
+    if (state !== "registered") {
+      throw new AwikiImError("remote", "AWiki service returned an invalid response");
+    }
+    const did = requiredWireString2(result.did, "registered DID");
+    if (did !== pending.didDocument.id) {
+      throw new AwikiImError("remote", "AWiki service returned an invalid response");
+    }
+    const fullHandle = stringValue3(result.full_handle) ?? pending.handle;
+    if (fullHandle !== pending.handle) {
+      throw new AwikiImError("remote", "AWiki service returned an invalid response");
+    }
+    const accessToken = headerToken ?? requiredWireString2(result.access_token, "access token");
+    return this.persistRegisteredIdentity(pending, did, fullHandle, accessToken);
+  }
+  async tryReconcilePending(pending) {
+    try {
+      const result = await this.options.transport.signedRpc(
+        this.options.userServiceUrl,
+        DID_AUTH_RPC_PATH,
+        "get_me",
+        {},
+        {
+          didDocument: pending.didDocument,
+          signingPrivateKeyPem: pending.signingPrivateKeyPem,
+          signingKeyId: pending.signingKeyId
+        }
+      );
+      const did = requiredWireString2(result.value.did, "registered DID");
+      if (did !== pending.didDocument.id) {
+        return null;
+      }
+      const token = result.accessToken ?? requiredWireString2(result.value.access_token, "access token");
+      return this.persistRegisteredIdentity(pending, did, pending.handle, token);
+    } catch {
+      return null;
+    }
+  }
+  async persistRegisteredIdentity(pending, did, handle, accessToken) {
+    const publicIdentity = {
+      did,
+      handle,
+      registeredAt: Date.now()
+    };
+    await this.options.store.mutate((state) => {
+      state.identity = {
+        public: publicIdentity,
+        didDocument: pending.didDocument,
+        rootPrivateKeyPem: pending.rootPrivateKeyPem,
+        signingPrivateKeyPem: pending.signingPrivateKeyPem,
+        signingKeyId: pending.signingKeyId,
+        accessToken,
+        messageServiceDid: pending.messageServiceDid
+      };
+      delete state.registrationOtp;
+      delete state.pendingRegistration;
+    });
+    return publicIdentity;
+  }
+  async exclusiveRegistration(operation) {
+    let release = () => void 0;
+    const previous = this.registrationTail;
+    this.registrationTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  }
+};
+function createPendingRegistration(phone, handle, messageServicePublicUrl, messageServiceDid) {
+  const messageEndpoint = new URL("/anp-im/rpc", messageServicePublicUrl).toString();
+  const services = [
+    buildAnpMessageService("#message", messageEndpoint, {
+      serviceDid: messageServiceDid,
+      profiles: [
+        "anp.core.binding.v1",
+        "anp.direct.base.v1",
+        "anp.group.base.v1",
+        "anp.attachment.v1"
+      ],
+      securityProfiles: ["transport-protected"]
+    }),
+    {
+      id: "#handle",
+      type: "ANPHandleService",
+      serviceEndpoint: `https://${handle.domain}/.well-known/handle/${handle.local}`
+    }
+  ];
+  const bundle = createDidWbaDocument(handle.domain, {
+    pathSegments: [handle.local],
+    services,
+    domain: handle.domain,
+    challenge: randomChallenge(),
+    didProfile: "e1" /* E1 */,
+    enableE2ee: false
+  });
+  const signingKey = bundle.keys["key-1"];
+  if (!signingKey) {
+    throw new AwikiImError("remote", "AWiki identity generation failed");
+  }
+  return {
+    handle: handle.full,
+    phone,
+    didDocument: bundle.didDocument,
+    rootPrivateKeyPem: signingKey.privateKeyPem,
+    signingPrivateKeyPem: signingKey.privateKeyPem,
+    signingKeyId: `${bundle.didDocument.id}#key-1`,
+    messageServiceDid
+  };
+}
+function refreshPendingProof(pending, domain) {
+  const unsigned = structuredClone(pending.didDocument);
+  delete unsigned.proof;
+  const didDocument = generateW3cProof(
+    unsigned,
+    pending.rootPrivateKeyPem,
+    `${unsigned.id}#key-1`,
+    {
+      proofPurpose: "assertionMethod",
+      proofType: PROOF_TYPE_DATA_INTEGRITY,
+      cryptosuite: CRYPTOSUITE_EDDSA_JCS_2022,
+      domain,
+      challenge: randomChallenge()
+    }
+  );
+  return { ...pending, didDocument };
+}
+function normalizeRegistrationHandle(input, userServiceDomain) {
+  const value = input.trim().toLowerCase().replace(/^wba:\/\//, "");
+  const configuredDomain = userServiceDomain.toLowerCase();
+  const dot = value.indexOf(".");
+  const local = dot < 0 ? value : value.slice(0, dot);
+  const domain = dot < 0 ? configuredDomain : value.slice(dot + 1);
+  if (!validateLocalPart(local) || !domain.includes(".") || domain !== configuredDomain) {
+    throw new AwikiImError("invalid-request", "AWiki handle is invalid");
+  }
+  return { local, domain, full: `${local}.${domain}` };
+}
+function normalizePhone(value) {
+  const phone = value.trim().replace(/[\s()-]/g, "");
+  if (!/^\+?[0-9]{6,20}$/.test(phone)) {
+    throw new AwikiImError("invalid-request", "AWiki phone number is invalid");
+  }
+  return phone;
+}
+function normalizeOtp(value) {
+  const otp = value.trim();
+  if (!/^[0-9]{4,12}$/.test(otp)) {
+    throw new AwikiImError("invalid-otp", "AWiki verification code is invalid");
+  }
+  return otp;
+}
+function requiredWireString2(value, label) {
+  const result = stringValue3(value);
+  if (!result) {
+    throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+  }
+  return result;
+}
+function requiredWireNumber(value, label) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new AwikiImError("remote", `AWiki response is missing ${label}`);
+  }
+  return value;
+}
+function stringValue3(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+var AwikiImStateStore = class {
+  constructor(path) {
+    this.path = path;
+  }
+  state = emptyState();
+  mutationTail = Promise.resolve();
+  /** Load and minimally validate state from disk. */
+  async load() {
+    if (!this.path.trim()) {
+      throw new AwikiImError("invalid-request", "AWiki statePath is required");
+    }
+    try {
+      const decoded = JSON.parse(await readFile(this.path, "utf8"));
+      if (!isPersistedState(decoded)) {
+        throw new AwikiImError("invalid-request", "AWiki identity state is invalid");
+      }
+      this.state = decoded;
+    } catch (error) {
+      if (isMissingFile(error)) {
+        this.state = emptyState();
+        return;
+      }
+      if (error instanceof AwikiImError) {
+        throw error;
+      }
+      throw new AwikiImError("invalid-request", "AWiki identity state cannot be read", void 0, {
+        cause: error
+      });
+    }
+  }
+  /** Return the current in-memory state. Callers must not mutate it directly. */
+  snapshot() {
+    return this.state;
+  }
+  /** Serialize one mutation and persist its complete result atomically. */
+  async mutate(mutator) {
+    const operation = this.mutationTail.then(async () => {
+      const next = structuredClone(this.state);
+      mutator(next);
+      await this.persist(next);
+      this.state = next;
+    });
+    this.mutationTail = operation.catch(() => void 0);
+    await operation;
+  }
+  async persist(state) {
+    const parent = dirname(this.path);
+    await mkdir(parent, { recursive: true, mode: 448 });
+    const temporaryPath = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(temporaryPath, `${JSON.stringify(state)}
+`, {
+        encoding: "utf8",
+        mode: 384,
+        flag: "wx"
+      });
+      await rename(temporaryPath, this.path);
+      await chmod(this.path, 384);
+    } catch (error) {
+      await unlink(temporaryPath).catch((unlinkError) => {
+        if (!isMissingFile(unlinkError)) {
+          throw unlinkError;
+        }
+      });
+      throw new AwikiImError("remote", "AWiki identity state cannot be persisted", void 0, {
+        cause: error
+      });
+    }
+  }
+};
+function isPersistedState(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const record = value;
+  return record.version === STATE_VERSION && isRecord5(record.conversations) && isRecord5(record.attachments) && isRecord5(record.sendOperations);
+}
+function isRecord5(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isMissingFile(error) {
+  return !!error && typeof error === "object" && "code" in error && error.code === "ENOENT";
+}
+
+// src/im/client.ts
+function createAwikiImClient(options) {
+  return new DefaultAwikiImClient(options);
+}
+var DefaultAwikiImClient = class {
+  store;
+  transport;
+  identity;
+  messaging;
+  attachments;
+  ready;
+  inFlight = /* @__PURE__ */ new Set();
+  disposal;
+  disposed = false;
+  constructor(options) {
+    const allowInsecureLoopback = options.allowInsecureLoopbackForTesting === true;
+    validateServiceBaseUrl(options.userServiceUrl, allowInsecureLoopback);
+    validateServiceBaseUrl(options.messageServiceUrl, allowInsecureLoopback);
+    validateServiceBaseUrl(options.messageServicePublicUrl, allowInsecureLoopback);
+    if (!isDomainName(options.userServiceDomain)) {
+      throw new AwikiImError("invalid-request", "AWiki userServiceDomain is invalid");
+    }
+    if (!isBareDomainDidWba(options.messageServiceDid)) {
+      throw new AwikiImError("invalid-request", "AWiki messageServiceDid is invalid");
+    }
+    if (!Array.isArray(options.allowedAttachmentOrigins) || options.allowedAttachmentOrigins.length === 0) {
+      throw new AwikiImError("invalid-request", "AWiki allowedAttachmentOrigins is required");
+    }
+    if (!Number.isSafeInteger(options.attachmentMaxBytes) || options.attachmentMaxBytes < 1) {
+      throw new AwikiImError("invalid-request", "AWiki attachmentMaxBytes is invalid");
+    }
+    if (!options.statePath.trim()) {
+      throw new AwikiImError("invalid-request", "AWiki statePath is required");
+    }
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw new AwikiImError("invalid-request", "AWiki fetch implementation is required");
+    }
+    this.store = new AwikiImStateStore(options.statePath);
+    this.transport = new AwikiImTransport(fetchImpl, {
+      allowedAttachmentOrigins: options.allowedAttachmentOrigins,
+      allowInsecureLoopback,
+      attachmentMaxBytes: options.attachmentMaxBytes
+    });
+    this.identity = new AwikiIdentityRuntime({
+      userServiceUrl: options.userServiceUrl,
+      userServiceDomain: options.userServiceDomain.toLowerCase(),
+      messageServicePublicUrl: options.messageServicePublicUrl,
+      messageServiceDid: options.messageServiceDid,
+      transport: this.transport,
+      store: this.store
+    });
+    this.messaging = new AwikiMessagingRuntime({
+      userServiceUrl: options.userServiceUrl,
+      messageServiceUrl: options.messageServiceUrl,
+      transport: this.transport,
+      store: this.store,
+      identity: this.identity,
+      attachmentMaxBytes: options.attachmentMaxBytes
+    });
+    this.attachments = new AwikiAttachmentRuntime({
+      transport: this.transport,
+      store: this.store,
+      identity: this.identity,
+      messaging: this.messaging,
+      attachmentMaxBytes: options.attachmentMaxBytes
+    });
+    this.ready = this.store.load().then(() => this.identity.validateConfiguredIdentity());
+  }
+  async getIdentity() {
+    return this.run(() => Promise.resolve(structuredClone(this.identity.getIdentity())));
+  }
+  async sendRegistrationOtp(request) {
+    return this.run(() => this.identity.sendRegistrationOtp(request));
+  }
+  async registerIdentity(request) {
+    return this.run(() => this.identity.registerIdentity(request));
+  }
+  async listConversations(request) {
+    return this.run(() => this.messaging.listConversations(request));
+  }
+  async getHistory(request) {
+    return this.run(() => this.messaging.getHistory(request));
+  }
+  async sendText(request) {
+    return this.run(() => this.messaging.sendText(request));
+  }
+  async sendAttachment(request) {
+    return this.run(() => this.attachments.sendAttachment(request));
+  }
+  async downloadAttachment(request) {
+    return this.run(() => this.attachments.downloadAttachment(request));
+  }
+  async dispose() {
+    this.disposal ??= this.disposeOnce();
+    return this.disposal;
+  }
+  run(operation) {
+    if (this.disposed) {
+      return Promise.reject(new AwikiImError("remote", "AWiki IM client has been disposed"));
+    }
+    const pending = (async () => {
+      try {
+        await this.ready;
+        return await operation();
+      } catch (error) {
+        throw normalizeAwikiImError(error);
+      }
+    })();
+    this.inFlight.add(pending);
+    void pending.then(
+      () => this.inFlight.delete(pending),
+      () => this.inFlight.delete(pending)
+    );
+    return pending;
+  }
+  async disposeOnce() {
+    this.disposed = true;
+    this.transport.dispose();
+    const ready = this.ready.catch((error) => {
+      throw normalizeAwikiImError(error);
+    });
+    await Promise.allSettled([...this.inFlight]);
+    await ready;
+  }
+};
+function isDomainName(value) {
+  const domain = value.trim().toLowerCase();
+  if (!domain || domain.length > 253 || domain.includes("/") || domain.includes(":")) {
+    return false;
+  }
+  try {
+    return new URL(`https://${domain}`).hostname === domain;
+  } catch {
+    return false;
+  }
+}
+function isBareDomainDidWba(value) {
+  const prefix = "did:wba:";
+  const normalized = value.trim().toLowerCase();
+  return normalized.startsWith(prefix) && isDomainName(normalized.slice(prefix.length));
+}
+
+export { ANPError, ANP_HANDLE_SERVICE_TYPE, ANP_MESSAGE_SERVICE_TYPE, AuthMode, AuthenticationError, AwikiImError, CRYPTOSUITE_DIDWBA_SECP256K1_2025, CRYPTOSUITE_EDDSA_JCS_2022, CryptoError, DIDWbaAuthHeader, DIDWbaAuthHeader as DidAuthHeaders, DidProfile, DidWbaVerifier, DidWbaVerifierError, HandleBindingError, HandleGoneError, HandleMovedError, HandleNotFoundError, HandleResolutionError, HandleStatus, HandleValidationError, IM_PROOF_DEFAULT_COMPONENTS, IM_PROOF_RELATION_ASSERTION_METHOD, IM_PROOF_RELATION_AUTHENTICATION, NetworkError, PROOF_TYPE_DATA_INTEGRITY, PROOF_TYPE_ED25519, PROOF_TYPE_SECP256K1, ProofError, DidWbaVerifier as RequestVerifier, DidWbaVerifierError as RequestVerifierError, SubjectType, VM_KEY_AUTH, VM_KEY_E2EE_AGREEMENT, VM_KEY_E2EE_SIGNING, VerificationMethod, WbaUriParseError, WnsError, authentication, buildAgentMessageService, buildAnpMessageService, buildContentDigest, buildGroupMessageService, buildHandleServiceEntry, buildImContentDigest, buildImSignatureInput, buildResolutionUrl, buildWbaUri as buildUri, buildWbaUri, canonicalizeBindingGeneration, compareBindingGenerations, computeJwkFingerprint, computeMultikeyFingerprint, createAwikiImClient, createDidWbaDocument as createDidDocument, createDidWbaDocumentWithKeyBinding as createDidDocumentWithKeyBinding, createDidWbaDocument, createDidWbaDocumentWithKeyBinding, buildHandleServiceEntry as createHandleServiceEntry, generateAuthHeader as createLegacyAuthHeader, generateAuthJson as createLegacyAuthPayload, generateW3cProof as createProof, generateHttpSignatureHeaders as createSignatureHeaders, createVerificationMethod, decodeImSignature, didDocuments, encodeImSignature, extractAuthHeaderParts, extractHandleServiceFromDidDocument, extractHandleServiceFromDidDocument as extractHandleServices, extractPublicKey, extractSignatureMetadata, findVerificationMethod, generateAuthHeader, generateAuthJson, generateHttpSignatureHeaders, generateImProof, generateW3cProof, httpSignatures, isAssertionMethodAuthorized, isAuthenticationAuthorized, legacyAuth, normalizeHandle, parseImSignatureInput, extractAuthHeaderParts as parseLegacyAuthHeader, extractSignatureMetadata as parseSignatureMetadata, parseWbaUri as parseUri, parseWbaUri, proof, resolveDidDocument, resolveDidWbaDocument, resolveHandle, resolveHandleFromUri, resolveHandleFromUri as resolveUri, validateDidDocumentBinding as validateDidBinding, validateDidDocumentBinding, validateHandle, validateLocalPart, verifyAuthHeaderSignature, verifyAuthJsonSignature, verifyHandleBinding as verifyBinding, verifyContentDigest, verifyDidKeyBinding as verifyDidBinding, verifyDidKeyBinding, verifyFederatedHttpRequest, verifyHandleBinding, verifyHttpMessageSignature, verifyImContentDigest, verifyImProof, verifyAuthHeaderSignature as verifyLegacyAuthHeader, verifyAuthJsonSignature as verifyLegacyAuthPayload, verifyW3cProof as verifyProof, verifyW3cProofDetailed as verifyProofDetailed, verifyHttpMessageSignature as verifySignatureHeaders, verifyW3cProof, verifyW3cProofDetailed, wns };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map