@byollm/protocol 0.1.0-alpha.93 → 0.1.0-alpha.95

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 import { z } from 'zod';
+import { S as StoredKeys, P as PublicIdentity } from './portable-D2mu8USa.js';
+export { C as CONSOLE_FRAME_VERSION, a as CONSOLE_MAX_DATA_BYTES, b as ConsoleBye, c as ConsoleFrame, d as ConsoleHello, e as ConsoleOrder, f as ConsoleOrderFault, g as ConsoleOrderResult, h as ConsoleResize, i as ConsoleStdin, j as ConsoleStdout, E as ENCRYPTION_KEY_CONTEXT, k as ENVELOPE_BODY_VERSION, l as ENVELOPE_MAX_AGE_MS, m as EnvelopeBodyContext, n as EnvelopeContext, o as EnvelopeDirection, p as EnvelopeFailure, q as EnvelopeInner, O as OpenResult, r as SealedEnvelope, s as consoleEnvelope, t as consoleOrder, u as cryptoReady, v as decodeEnvelopeInner, w as encodeEnvelopeInner, x as envelopeSignedBody, y as fingerprint, z as fromBase64Url, A as generateKeys, B as keyId, D as open, F as publicIdentityOf, G as seal, H as signWith, I as toBase64Url, J as verifyPublicIdentity, K as verifyWith } from './portable-D2mu8USa.js';
 
 /**
  * Protocol version carried on every request; servers refuse what they can't
@@ -2073,174 +2075,6 @@ declare const ClaimedStub: z.ZodObject<{
 }, z.core.$strict>;
 type ClaimedStub = z.infer<typeof ClaimedStub>;
 
-/**
- * Device and site keys — byollm_009 §3.
- *
- * **Two keypairs per party, and the split is load-bearing.** An Ed25519
- * *identity* key signs; an X25519 *encryption* key receives sealed envelopes.
- * The encryption key is signed by the identity key, and **the identity key is
- * what gets pinned**. So "who sent this" and "who can read this" are answered
- * by different keys — which is what lets an encryption key rotate without
- * re-establishing trust, and what byollm_009 §6's signed-then-sealed envelope
- * depends on.
- *
- * **No new dependency.** byollm_009 §2 says established primitives only, via
- * libsodium. Everything *this* module needs — Ed25519 signing, X25519 key
- * generation — Node provides natively, and using it costs nothing and adds no
- * install weight to a daemon that must land fast on a stranger's laptop.
- *
- * libsodium becomes necessary at envelope v2, where sealing does. That is a
- * real dependency decision and it belongs in the change that needs it: a
- * sealed box is a specific reviewed construction, and rebuilding it out of
- * Node primitives is exactly the "novel construction" §2 rules out. Deferring
- * the dependency is not the same as deferring the rule.
- */
-/** A public identity, as it travels on the wire. All values base64url. */
-declare const PublicIdentity: z.ZodObject<{
-    identity: z.ZodString;
-    encryption: z.ZodString;
-    encryptionSig: z.ZodString;
-}, z.core.$strict>;
-type PublicIdentity = z.infer<typeof PublicIdentity>;
-/** Private key material, as stored on disk. Never leaves the machine. */
-declare const StoredKeys: z.ZodObject<{
-    version: z.ZodLiteral<1>;
-    identityPublic: z.ZodString;
-    identityPrivate: z.ZodString;
-    encryptionPublic: z.ZodString;
-    encryptionPrivate: z.ZodString;
-    encryptionSig: z.ZodString;
-    createdAt: z.ZodNumber;
-}, z.core.$strict>;
-type StoredKeys = z.infer<typeof StoredKeys>;
-/** Domain separator, so a signature over an encryption key cannot be
- * replayed as a signature over anything else. */
-/**
- * What an encryption key's signature covers.
- *
- * Exported because a rotation is a real event this protocol has to be able to
- * *test* — a record whose encryption key moved under an identity that signed
- * the move is the one case pinning must refuse loudly, and building one
- * outside this file otherwise means re-typing this string, which is how two
- * copies of a constant start disagreeing.
- */
-declare const ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
-/** Generate a fresh pair of keypairs and bind them together. */
-declare function generateKeys(now: number): StoredKeys;
-/** The public half, for the wire. */
-declare function publicIdentityOf(keys: StoredKeys): PublicIdentity;
-/**
- * Check that an encryption key really belongs to the identity presenting it.
- *
- * Called on everything received, including from an upstream we otherwise
- * trust — the point of pinning the identity is that nothing else needs to be
- * trusted, and that only holds if this is checked every time rather than at
- * first sight.
- */
-declare function verifyPublicIdentity(identity: PublicIdentity): boolean;
-/** Sign arbitrary bytes with an identity key. */
-/**
- * Sign bytes with an identity key.
- *
- * Takes only the private half it uses. A signer that demanded a whole
- * {@link StoredKeys} would make every caller hold an encryption keypair for a
- * job that has no encryption in it — and the control plane, which signs
- * rosters and opens nothing, would be generating and storing secret material
- * it can never need. Every existing caller passes a full `StoredKeys`, which
- * satisfies this.
- */
-declare function signWith(keys: Pick<StoredKeys, "identityPrivate">, data: Uint8Array): string;
-/** Verify bytes against a raw Ed25519 public key. */
-declare function verifyWith(identityPublic: string, data: Uint8Array, signature: string): boolean;
-/**
- * A fingerprint a human can compare out loud.
- *
- * 120 bits of SHA-256 over the raw identity key, as six groups of four. Long
- * enough that grinding a colliding key is not worth anyone's afternoon, short
- * enough to read down a phone line — which is the whole point. A fingerprint
- * nobody can be bothered to compare provides no security at all, so
- * legibility is a security property here, not a nicety.
- *
- * Formatted with a `BYOLLM-` prefix so a pasted fingerprint is recognisable
- * out of context, in a support thread or a screenshot.
- */
-declare function fingerprint(identityPublic: string): string;
-/** The short id used in envelopes and provenance. Stable, and comparable. */
-declare const keyId: (identityPublic: string) => string;
-
-declare function cryptoReady(): Promise<void>;
-/**
- * How long a sealed payload is worth keeping, from creation.
- *
- * Bound into every envelope and recomputed when one is opened, so it lives
- * here rather than in the two places that need it. Two copies of a value the
- * signature depends on is the same bug as two clock readings: it works until
- * they disagree, and then nothing can be opened.
- *
- * Not a job's TTL. That answers how long the *work* is worth doing, belongs
- * to the app and the store, and may legitimately differ per deployment.
- */
-declare const ENVELOPE_MAX_AGE_MS: number;
-/** Which leg an envelope belongs to. Bound into the signature. */
-declare const EnvelopeDirection: z.ZodEnum<{
-    payload: "payload";
-    result: "result";
-}>;
-type EnvelopeDirection = z.infer<typeof EnvelopeDirection>;
-declare const SealedEnvelope: z.ZodObject<{
-    ciphertext: z.ZodString;
-    recipientKeyId: z.ZodString;
-    senderKeyId: z.ZodString;
-    direction: z.ZodEnum<{
-        payload: "payload";
-        result: "result";
-    }>;
-    deadlineAt: z.ZodNumber;
-}, z.core.$strict>;
-type SealedEnvelope = z.infer<typeof SealedEnvelope>;
-/** Everything the signature covers besides the plaintext itself. */
-interface EnvelopeContext {
-    readonly jobId: string;
-    readonly senderKeyId: string;
-    readonly recipientKeyId: string;
-    readonly deadlineAt: number;
-    readonly direction: EnvelopeDirection;
-}
-/** Seal a plaintext to a recipient, signed by the sender's identity. */
-declare function seal(input: {
-    plaintext: string;
-    senderKeys: StoredKeys;
-    recipientEncryptionPublic: string;
-    context: EnvelopeContext;
-}): Promise<SealedEnvelope>;
-/** Why an envelope was refused. Never distinguished to a remote caller. */
-type EnvelopeFailure = "not-for-us" | "unopenable" | "malformed" | "bad-signature" | "context-mismatch";
-type OpenResult = {
-    readonly ok: true;
-    readonly plaintext: string;
-} | {
-    readonly ok: false;
-    readonly reason: EnvelopeFailure;
-};
-/**
- * Open an envelope and verify it came from the pinned sender.
- *
- * Every failure returns rather than throws: this runs on input from the
- * network, and a crash here is a denial of service on the delivery path.
- *
- * The context is checked against the signature, not merely read from the
- * envelope. An envelope carries its own claims about who sent it and to
- * whom — believing those would authenticate the attacker's assertion rather
- * than the sender's key.
- */
-declare function open(input: {
-    envelope: SealedEnvelope;
-    recipientKeys: StoredKeys;
-    senderIdentityPublic: string;
-    /** The deadline is taken from the envelope and checked against its signature. */
-    expected: Omit<EnvelopeContext, "deadlineAt">;
-}): Promise<OpenResult>;
-
 /**
  * Request signing — byollm_009 §4.2.
  *
@@ -2972,227 +2806,4 @@ declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_C
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-/**
- * The terminal stream a hosted box's console runs over — byollm_018 §"Console
- * redesign: brokered E2E replaces SSH-first (RULED, Todd 2026-09-03)".
- *
- * The ruling's item 3 is the whole reason this file exists: *"The terminal
- * stream is E2E encrypted browser↔agent with the sealed-channel pattern jobs
- * use; the hub routes ciphertext."* So the bytes are carried by
- * {@link seal}/{@link open} exactly as a job's payload is, and what is defined
- * here is the thing a sealed envelope does not carry: **what a frame means,
- * and where it sits in the stream.**
- *
- * ## Why an ordering rule is protocol and not an implementation detail
- *
- * Sealing makes the hub unable to READ the stream. It does nothing to make
- * the hub unable to reshape it. A router that holds ciphertext can drop a
- * frame, deliver two out of order, or send the same frame twice, and every
- * envelope still opens, still verifies against the pinned identity, and still
- * looks perfect to the receiver — because each envelope is authenticated on
- * its own and says nothing about the ones around it.
- *
- * On a terminal that is not a theoretical loss of tidiness. A dropped
- * keystroke is a different command; two frames swapped is a different command;
- * a replayed frame is a command run twice. The console carries vendor
- * sign-in flows (byollm_018 item 5), so "a different command" can mean an auth
- * code going somewhere it was not typed.
- *
- * Hence {@link consoleOrder}: a sequence inside the ciphertext, checked by
- * both ends. Inside, because a counter the hub could see is a counter the hub
- * could rewrite.
- *
- * ## One definition, both ends, and there are three ends
- *
- * The browser, the box's agent, and the hub broker all handle these frames,
- * and the first two must agree byte for byte or the stream silently corrupts.
- * The hub must NOT be able to agree — it only ever sees the sealed envelope.
- * This module is the single definition the two real ends share; neither
- * retypes it.
- *
- * ## The pinned box key is the PAIRING key (CCB's call, 09-16)
- *
- * The ruling says "box key pinned at first session", and the backlog left one
- * delta open: whether the identity the owner already approved at pairing can
- * serve as that pinned key. It can, and it should, for three reasons.
- *
- * 1. **The pairing key is the only one a human ever chose.** `PairStartRequest`
- *    carries the device's {@link PublicIdentity} and says why: *"Pairing is
- *    where the two parties learn each other's identities, because it is the
- *    one moment a human is already deciding to trust: the approval click. A
- *    key exchanged anywhere else would be a key nobody chose."* A fresh
- *    trust-on-first-use pin at the first console session is precisely a key
- *    nobody chose — it trusts whoever answers first, which on a brokered
- *    channel is whoever the broker points at.
- * 2. **Two pins of one box can disagree, and silently.** A console pin
- *    separate from the pairing pin is a second record of the same fact, which
- *    is this project's most-repeated defect. When they diverge, nothing reads
- *    both, so nothing notices.
- * 3. **Alarm-on-change comes free from the split already in `keys.ts`.** The
- *    Ed25519 identity is the pinned half and the X25519 encryption key is
- *    signed by it, so {@link verifyPublicIdentity} lets the box rotate its
- *    encryption key without a new ceremony while an IDENTITY change fails to
- *    verify and alarms — which is what the ruling asks for, and it is already
- *    written.
- *
- * **What this does not claim.** Pinning the pairing key does not make the hub
- * unable to lie about which key that was; the hub is the one telling the
- * browser. The ruling is explicit that we build the operator-ACCOUNTABLE
- * version, not the operator-incapable one, and item 4's session feed is where
- * that accountability is paid. What the pin buys is that a CHANGE is
- * detectable, and that the key being pinned is one an owner approved rather
- * than one a broker supplied.
- */
-/** Domain tag for the plaintext inside a console envelope. */
-declare const CONSOLE_FRAME_VERSION = "byollm/v1/console";
-/**
- * The largest `data` payload one frame may carry, before base64.
- *
- * Far below {@link MAX_ENVELOPE_BYTES}, and deliberately: an envelope cap
- * stops a memory attack, while this stops a latency one. A console is
- * interactive, so a peer that batches a megabyte into one frame has made the
- * stream unusable without ever exceeding a limit.
- */
-declare const CONSOLE_MAX_DATA_BYTES: number;
-declare const ConsoleHello: z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"hello">;
-    seq: z.ZodLiteral<1>;
-    browser: z.ZodObject<{
-        identity: z.ZodString;
-        encryption: z.ZodString;
-        encryptionSig: z.ZodString;
-    }, z.core.$strict>;
-    cols: z.ZodNumber;
-    rows: z.ZodNumber;
-}, z.core.$strict>;
-type ConsoleHello = z.infer<typeof ConsoleHello>;
-/**
- * Two schemas rather than one with a `kind: z.enum([...])`, because the union
- * below discriminates on `kind` and a discriminator that is itself a set is
- * how a union quietly stops discriminating.
- */
-declare const ConsoleStdin: z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"stdin">;
-    seq: z.ZodNumber;
-    data: z.ZodString;
-}, z.core.$strict>;
-type ConsoleStdin = z.infer<typeof ConsoleStdin>;
-declare const ConsoleStdout: z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"stdout">;
-    seq: z.ZodNumber;
-    data: z.ZodString;
-}, z.core.$strict>;
-type ConsoleStdout = z.infer<typeof ConsoleStdout>;
-declare const ConsoleResize: z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"resize">;
-    seq: z.ZodNumber;
-    cols: z.ZodNumber;
-    rows: z.ZodNumber;
-}, z.core.$strict>;
-type ConsoleResize = z.infer<typeof ConsoleResize>;
-declare const ConsoleBye: z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"bye">;
-    seq: z.ZodNumber;
-    reason: z.ZodString;
-}, z.core.$strict>;
-type ConsoleBye = z.infer<typeof ConsoleBye>;
-declare const ConsoleFrame: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"hello">;
-    seq: z.ZodLiteral<1>;
-    browser: z.ZodObject<{
-        identity: z.ZodString;
-        encryption: z.ZodString;
-        encryptionSig: z.ZodString;
-    }, z.core.$strict>;
-    cols: z.ZodNumber;
-    rows: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"stdin">;
-    seq: z.ZodNumber;
-    data: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"stdout">;
-    seq: z.ZodNumber;
-    data: z.ZodString;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"resize">;
-    seq: z.ZodNumber;
-    cols: z.ZodNumber;
-    rows: z.ZodNumber;
-}, z.core.$strict>, z.ZodObject<{
-    v: z.ZodLiteral<"byollm/v1/console">;
-    kind: z.ZodLiteral<"bye">;
-    seq: z.ZodNumber;
-    reason: z.ZodString;
-}, z.core.$strict>], "kind">;
-type ConsoleFrame = z.infer<typeof ConsoleFrame>;
-/**
- * The envelope context for a console frame.
- *
- * Exported so that neither end computes it: the session id goes in `jobId`
- * and the direction is derived, and if the two ends disagreed about either,
- * every envelope would fail to open with `not-for-us` — a failure that looks
- * exactly like an attack.
- */
-declare function consoleEnvelope(input: {
-    sessionId: string;
-    from: "browser" | "box";
-    senderKeyId: string;
-    recipientKeyId: string;
-    deadlineAt: number;
-}): EnvelopeContext;
-/** Why a frame was refused. Each one is a distinct thing a router can do. */
-type ConsoleOrderFault = 
-/** Seq went backwards or repeated — the router sent it twice. */
-"replayed"
-/** Seq skipped — the router dropped what was between. */
- | "gap"
-/** A `hello` that was not the first frame, or a first frame that was not `hello`. */
- | "out-of-turn"
-/** A `stdin` from the box, or a `stdout` from the browser. */
- | "wrong-way"
-/** Anything after `bye`. The stream is over. */
- | "closed";
-type ConsoleOrderResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly fault: ConsoleOrderFault;
-};
-/**
- * One direction's ordering rule, which both ends run over what they receive.
- *
- * **Strictly +1, not merely increasing.** Increasing would catch replay and
- * reorder while letting a DROP through silently, and a dropped frame on a
- * terminal is a truncated command that still runs. There is no benign gap
- * here to tolerate: the transport underneath is an ordered, reliable stream,
- * so a gap means something between the ends removed a frame.
- *
- * Every fault is fatal to the session by design. A console has no
- * resynchronisation story that is safe — you cannot ask "what did I miss" of
- * a party that may be the one who took it.
- */
-/**
- * One direction's receiver-side ordering state.
- *
- * Named as an interface rather than inferred, so the box's agent and the
- * browser hold the SAME type — an inferred one would let the two ends drift
- * apart without a compiler ever objecting.
- */
-interface ConsoleOrder {
-    /** The last sequence accepted. 0 before anything has been. */
-    readonly seen: number;
-    accept(frame: ConsoleFrame): ConsoleOrderResult;
-}
-declare function consoleOrder(from: "browser" | "box"): ConsoleOrder;
-
-export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, CONSOLE_FRAME_VERSION, CONSOLE_MAX_DATA_BYTES, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, ConsoleBye, ConsoleFrame, ConsoleHello, type ConsoleOrder, type ConsoleOrderFault, type ConsoleOrderResult, ConsoleResize, ConsoleStdin, ConsoleStdout, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, consoleEnvelope, consoleOrder, cryptoReady, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession, withoutComments };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, payloadTextLength, provenanceFor, resolveCost, signGrant, signRequest, signSiteRequest, signSuccession, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyRequest, verifySiteRequest, walkSuccession, withoutComments };

package/dist/index.js

@@ -1,3 +1,23 @@
+import {
+  CONSOLE_FRAME_VERSION,
+  CONSOLE_MAX_DATA_BYTES,
+  ConsoleBye,
+  ConsoleFrame,
+  ConsoleHello,
+  ConsoleResize,
+  ConsoleStdin,
+  ConsoleStdout,
+  ENVELOPE_BODY_VERSION,
+  PublicIdentity,
+  consoleEnvelope,
+  consoleOrder,
+  decodeEnvelopeInner,
+  encodeEnvelopeInner,
+  envelopeSignedBody,
+  fromBase64Url,
+  toBase64Url
+} from "./chunk-W7Q7DKQ6.js";
+
 // src/wire.ts
 import { z as z9 } from "zod";
 
@@ -11,20 +31,6 @@ import {
   verify
 } from "crypto";
 import { z } from "zod";
-var PublicIdentity = z.object({
-  /** Raw Ed25519 public key. The pinned one. */
-  identity: z.string().min(1),
-  /** Raw X25519 public key, for sealing to this party. */
-  encryption: z.string().min(1),
-  /**
-   * Ed25519 signature over the encryption key, by the identity key.
-   *
-   * This is what stops an upstream substituting an encryption key of its
-   * own while relaying a genuine identity: the receiver pins the identity
-   * and refuses any encryption key not signed by it.
-   */
-  encryptionSig: z.string().min(1)
-}).strict();
 var StoredKeys = z.object({
   version: z.literal(1),
   identityPublic: z.string().min(1),
@@ -89,16 +95,16 @@ function verifyPublicIdentity(identity) {
     return false;
   }
 }
-function signWith(keys, data2) {
-  return sign(null, data2, importPrivate(keys.identityPrivate)).toString(
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
     "base64url"
   );
 }
-function verifyWith(identityPublic, data2, signature) {
+function verifyWith(identityPublic, data, signature) {
   try {
     return verify(
       null,
-      data2,
+      data,
       importPublic(identityPublic, "Ed25519"),
       Buffer.from(signature, "base64url")
     );
@@ -1192,20 +1198,7 @@ var SealedEnvelope = z8.object({
    */
   deadlineAt: z8.number().int().positive()
 }).strict();
-function signedBody(context, plaintext) {
-  return Buffer.from(
-    JSON.stringify({
-      v: "byollm/v1/envelope",
-      jobId: context.jobId,
-      senderKeyId: context.senderKeyId,
-      recipientKeyId: context.recipientKeyId,
-      deadlineAt: context.deadlineAt,
-      direction: context.direction,
-      plaintext
-    }),
-    "utf8"
-  );
-}
+var signedBody = (context, plaintext) => envelopeSignedBody(context, plaintext);
 var rawX25519 = (key, part) => {
   const jwk = key.export({ format: "jwk" });
   const value = part === "x" ? jwk.x : jwk.d;
@@ -1216,7 +1209,7 @@ async function seal(input) {
   await cryptoReady();
   const body = signedBody(input.context, input.plaintext);
   const signature = signWith(input.senderKeys, body);
-  const inner = JSON.stringify({ body: body.toString("base64url"), signature });
+  const inner = encodeEnvelopeInner(body, signature);
   const recipient = new Uint8Array(
     Buffer.from(input.recipientEncryptionPublic, "base64url")
   );
@@ -1255,22 +1248,15 @@ async function open(input) {
   } catch {
     return { ok: false, reason: "unopenable" };
   }
-  let parsed;
-  try {
-    parsed = JSON.parse(inner);
-  } catch {
-    return { ok: false, reason: "malformed" };
-  }
-  if (typeof parsed.body !== "string" || typeof parsed.signature !== "string") {
-    return { ok: false, reason: "malformed" };
-  }
-  const body = Buffer.from(parsed.body, "base64url");
+  const parsed = decodeEnvelopeInner(inner);
+  if (parsed === void 0) return { ok: false, reason: "malformed" };
+  const body = parsed.body;
   if (!verifyWith(input.senderIdentityPublic, body, parsed.signature)) {
     return { ok: false, reason: "bad-signature" };
   }
   let claims;
   try {
-    claims = JSON.parse(body.toString("utf8"));
+    claims = JSON.parse(new TextDecoder().decode(body));
   } catch {
     return { ok: false, reason: "malformed" };
   }
@@ -2663,118 +2649,6 @@ var MUST_IDS = Object.freeze(Object.keys(MUSTS));
 function mustsVerifiedBy(kind) {
   return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
 }
-
-// src/console.ts
-import { z as z12 } from "zod";
-var CONSOLE_FRAME_VERSION = "byollm/v1/console";
-var CONSOLE_MAX_DATA_BYTES = 64 * 1024;
-var data = z12.string().max(Math.ceil(CONSOLE_MAX_DATA_BYTES * 4 / 3) + 4).describe("base64");
-var cols = z12.number().int().min(1).max(1e4);
-var rows = z12.number().int().min(1).max(1e4);
-var seq = z12.number().int().positive();
-var ConsoleHello = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("hello"),
-  seq: z12.literal(1),
-  /**
-   * The browser's EPHEMERAL identity for this session, and the reason hello
-   * exists as its own frame.
-   *
-   * A browser has no long-term key — it is a tab, not a machine — so it
-   * generates one per session and the box seals its output to it. That key
-   * has to reach the box without the hub being able to substitute one of its
-   * own, which is the classic broker attack. So it travels SEALED TO THE
-   * BOX'S PINNED IDENTITY like every other frame: the hub cannot read it and
-   * cannot replace it, because replacing it means producing a sealed box
-   * the box's key opens and the browser's key signed.
-   *
-   * The box does not pin this. It cannot — it is new every session, and
-   * nothing authorises it cryptographically. What authorises the browser is
-   * the hub's per-session grant (ruling item 2); what this key does is keep
-   * the hub from READING what it authorised.
-   */
-  browser: PublicIdentity,
-  cols,
-  rows
-}).strict();
-var ConsoleStdin = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  /** Browser→box only. A `stdin` arriving from the box is `wrong-way`. */
-  kind: z12.literal("stdin"),
-  seq,
-  data
-}).strict();
-var ConsoleStdout = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  /** Box→browser only. */
-  kind: z12.literal("stdout"),
-  seq,
-  data
-}).strict();
-var ConsoleResize = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("resize"),
-  seq,
-  cols,
-  rows
-}).strict();
-var ConsoleBye = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("bye"),
-  seq,
-  /** Shown to the owner in the session feed, so it is a sentence. */
-  reason: z12.string().min(1).max(200)
-}).strict();
-var ConsoleFrame = z12.discriminatedUnion("kind", [
-  ConsoleHello,
-  ConsoleStdin,
-  ConsoleStdout,
-  ConsoleResize,
-  ConsoleBye
-]);
-function consoleEnvelope(input) {
-  return {
-    jobId: input.sessionId,
-    senderKeyId: input.senderKeyId,
-    recipientKeyId: input.recipientKeyId,
-    deadlineAt: input.deadlineAt,
-    direction: input.from === "browser" ? "payload" : "result"
-  };
-}
-function consoleOrder(from) {
-  const maySend = {
-    // The browser drives: it opens, it types, it sets the size, it leaves.
-    browser: ["hello", "stdin", "resize", "bye"],
-    // The box answers, and can end a session. Nothing else.
-    box: ["stdout", "bye"]
-  };
-  const allowed = maySend[from];
-  const opensWithHello = from === "browser";
-  let last = 0;
-  let closed = false;
-  return {
-    /** The last sequence accepted. 0 before anything has been. */
-    get seen() {
-      return last;
-    },
-    accept(frame) {
-      if (closed) return { ok: false, fault: "closed" };
-      if (!allowed.includes(frame.kind)) {
-        return { ok: false, fault: "wrong-way" };
-      }
-      const isFirst = last === 0;
-      const wantsHello = isFirst && opensWithHello;
-      if (wantsHello !== (frame.kind === "hello")) {
-        return { ok: false, fault: "out-of-turn" };
-      }
-      if (frame.seq <= last) return { ok: false, fault: "replayed" };
-      if (frame.seq !== last + 1) return { ok: false, fault: "gap" };
-      last = frame.seq;
-      if (frame.kind === "bye") closed = true;
-      return { ok: true };
-    }
-  };
-}
 export {
   ABOUT,
   ABOUT_SHORT,
@@ -2809,6 +2683,7 @@ export {
   DeliveredResult,
   ENCRYPTION_KEY_CONTEXT,
   ENDPOINTS,
+  ENVELOPE_BODY_VERSION,
   ENVELOPE_MAX_AGE_MS,
   ERROR_STATUS,
   EnvelopeDirection,
@@ -2896,10 +2771,14 @@ export {
   consoleOrder,
   cryptoReady,
   declaredVersion,
+  decodeEnvelopeInner,
   describeBytes,
   effectiveOfferScope,
+  encodeEnvelopeInner,
   envelopeBytes,
+  envelopeSignedBody,
   fingerprint,
+  fromBase64Url,
   generateKeys,
   grantStatement,
   isBackendId,
@@ -2928,6 +2807,7 @@ export {
   sizeClassCeiling,
   sizeClassOf,
   successionStatement,
+  toBase64Url,
   tooLargeMessage,
   updateOfferFor,
   verifyGrant,