@byollm/protocol 0.1.0-alpha.94 → 0.1.0-alpha.96

package/dist/index.js

@@ -1,3 +1,23 @@
+import {
+  CONSOLE_FRAME_VERSION,
+  CONSOLE_MAX_DATA_BYTES,
+  ConsoleBye,
+  ConsoleFrame,
+  ConsoleHello,
+  ConsoleResize,
+  ConsoleStdin,
+  ConsoleStdout,
+  ENVELOPE_BODY_VERSION,
+  PublicIdentity,
+  consoleEnvelope,
+  consoleOrder,
+  decodeEnvelopeInner,
+  encodeEnvelopeInner,
+  envelopeSignedBody,
+  fromBase64Url,
+  toBase64Url
+} from "./chunk-W7Q7DKQ6.js";
+
 // src/wire.ts
 import { z as z9 } from "zod";
 
@@ -11,20 +31,6 @@ import {
   verify
 } from "crypto";
 import { z } from "zod";
-var PublicIdentity = z.object({
-  /** Raw Ed25519 public key. The pinned one. */
-  identity: z.string().min(1),
-  /** Raw X25519 public key, for sealing to this party. */
-  encryption: z.string().min(1),
-  /**
-   * Ed25519 signature over the encryption key, by the identity key.
-   *
-   * This is what stops an upstream substituting an encryption key of its
-   * own while relaying a genuine identity: the receiver pins the identity
-   * and refuses any encryption key not signed by it.
-   */
-  encryptionSig: z.string().min(1)
-}).strict();
 var StoredKeys = z.object({
   version: z.literal(1),
   identityPublic: z.string().min(1),
@@ -89,16 +95,16 @@ function verifyPublicIdentity(identity) {
     return false;
   }
 }
-function signWith(keys, data2) {
-  return sign(null, data2, importPrivate(keys.identityPrivate)).toString(
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
     "base64url"
   );
 }
-function verifyWith(identityPublic, data2, signature) {
+function verifyWith(identityPublic, data, signature) {
   try {
     return verify(
       null,
-      data2,
+      data,
       importPublic(identityPublic, "Ed25519"),
       Buffer.from(signature, "base64url")
     );
@@ -1163,85 +1169,6 @@ var ClaimedStub = JobStub.extend({
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
 import sodium from "libsodium-wrappers";
 import { z as z8 } from "zod";
-
-// src/envelope-format.ts
-var ALPHABET2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-var CHARS = ALPHABET2.split("");
-var VALUES = /* @__PURE__ */ (() => {
-  const table = new Uint8Array(128).fill(255);
-  for (let at = 0; at < ALPHABET2.length; at += 1) {
-    table[ALPHABET2.charCodeAt(at)] = at;
-  }
-  return table;
-})();
-function toBase64Url(bytes) {
-  let out = "";
-  for (let at = 0; at < bytes.length; at += 3) {
-    const a = bytes[at] ?? 0;
-    const b = bytes[at + 1];
-    const c = bytes[at + 2];
-    const word = a << 16 | (b ?? 0) << 8 | (c ?? 0);
-    out += CHARS[word >> 18 & 63] ?? "";
-    out += CHARS[word >> 12 & 63] ?? "";
-    if (b !== void 0) out += CHARS[word >> 6 & 63] ?? "";
-    if (c !== void 0) out += CHARS[word & 63] ?? "";
-  }
-  return out;
-}
-function fromBase64Url(text) {
-  const length = text.length;
-  if (length % 4 === 1) return void 0;
-  const bytes = new Uint8Array(Math.floor(length * 3 / 4));
-  let written = 0;
-  let word = 0;
-  let bits = 0;
-  for (let at = 0; at < length; at += 1) {
-    const code = text.charCodeAt(at);
-    const value = code < 128 ? VALUES[code] : 255;
-    if (value === void 0 || value === 255) return void 0;
-    word = word << 6 | value;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      bytes[written] = word >> bits & 255;
-      written += 1;
-    }
-  }
-  return bytes.subarray(0, written);
-}
-var ENVELOPE_BODY_VERSION = "byollm/v1/envelope";
-function envelopeSignedBody(context, plaintext) {
-  return new TextEncoder().encode(
-    JSON.stringify({
-      v: ENVELOPE_BODY_VERSION,
-      jobId: context.jobId,
-      senderKeyId: context.senderKeyId,
-      recipientKeyId: context.recipientKeyId,
-      deadlineAt: context.deadlineAt,
-      direction: context.direction,
-      plaintext
-    })
-  );
-}
-function encodeEnvelopeInner(body, signature) {
-  return JSON.stringify({ body: toBase64Url(body), signature });
-}
-function decodeEnvelopeInner(text) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    return void 0;
-  }
-  if (typeof parsed.body !== "string" || typeof parsed.signature !== "string") {
-    return void 0;
-  }
-  const body = fromBase64Url(parsed.body);
-  if (body === void 0) return void 0;
-  return { body, signature: parsed.signature };
-}
-
-// src/envelope.ts
 var readied;
 async function cryptoReady() {
   readied ??= sodium.ready;
@@ -2722,118 +2649,6 @@ var MUST_IDS = Object.freeze(Object.keys(MUSTS));
 function mustsVerifiedBy(kind) {
   return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
 }
-
-// src/console.ts
-import { z as z12 } from "zod";
-var CONSOLE_FRAME_VERSION = "byollm/v1/console";
-var CONSOLE_MAX_DATA_BYTES = 64 * 1024;
-var data = z12.string().max(Math.ceil(CONSOLE_MAX_DATA_BYTES * 4 / 3) + 4).describe("base64");
-var cols = z12.number().int().min(1).max(1e4);
-var rows = z12.number().int().min(1).max(1e4);
-var seq = z12.number().int().positive();
-var ConsoleHello = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("hello"),
-  seq: z12.literal(1),
-  /**
-   * The browser's EPHEMERAL identity for this session, and the reason hello
-   * exists as its own frame.
-   *
-   * A browser has no long-term key — it is a tab, not a machine — so it
-   * generates one per session and the box seals its output to it. That key
-   * has to reach the box without the hub being able to substitute one of its
-   * own, which is the classic broker attack. So it travels SEALED TO THE
-   * BOX'S PINNED IDENTITY like every other frame: the hub cannot read it and
-   * cannot replace it, because replacing it means producing a sealed box
-   * the box's key opens and the browser's key signed.
-   *
-   * The box does not pin this. It cannot — it is new every session, and
-   * nothing authorises it cryptographically. What authorises the browser is
-   * the hub's per-session grant (ruling item 2); what this key does is keep
-   * the hub from READING what it authorised.
-   */
-  browser: PublicIdentity,
-  cols,
-  rows
-}).strict();
-var ConsoleStdin = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  /** Browser→box only. A `stdin` arriving from the box is `wrong-way`. */
-  kind: z12.literal("stdin"),
-  seq,
-  data
-}).strict();
-var ConsoleStdout = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  /** Box→browser only. */
-  kind: z12.literal("stdout"),
-  seq,
-  data
-}).strict();
-var ConsoleResize = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("resize"),
-  seq,
-  cols,
-  rows
-}).strict();
-var ConsoleBye = z12.object({
-  v: z12.literal(CONSOLE_FRAME_VERSION),
-  kind: z12.literal("bye"),
-  seq,
-  /** Shown to the owner in the session feed, so it is a sentence. */
-  reason: z12.string().min(1).max(200)
-}).strict();
-var ConsoleFrame = z12.discriminatedUnion("kind", [
-  ConsoleHello,
-  ConsoleStdin,
-  ConsoleStdout,
-  ConsoleResize,
-  ConsoleBye
-]);
-function consoleEnvelope(input) {
-  return {
-    jobId: input.sessionId,
-    senderKeyId: input.senderKeyId,
-    recipientKeyId: input.recipientKeyId,
-    deadlineAt: input.deadlineAt,
-    direction: input.from === "browser" ? "payload" : "result"
-  };
-}
-function consoleOrder(from) {
-  const maySend = {
-    // The browser drives: it opens, it types, it sets the size, it leaves.
-    browser: ["hello", "stdin", "resize", "bye"],
-    // The box answers, and can end a session. Nothing else.
-    box: ["stdout", "bye"]
-  };
-  const allowed = maySend[from];
-  const opensWithHello = from === "browser";
-  let last = 0;
-  let closed = false;
-  return {
-    /** The last sequence accepted. 0 before anything has been. */
-    get seen() {
-      return last;
-    },
-    accept(frame) {
-      if (closed) return { ok: false, fault: "closed" };
-      if (!allowed.includes(frame.kind)) {
-        return { ok: false, fault: "wrong-way" };
-      }
-      const isFirst = last === 0;
-      const wantsHello = isFirst && opensWithHello;
-      if (wantsHello !== (frame.kind === "hello")) {
-        return { ok: false, fault: "out-of-turn" };
-      }
-      if (frame.seq <= last) return { ok: false, fault: "replayed" };
-      if (frame.seq !== last + 1) return { ok: false, fault: "gap" };
-      last = frame.seq;
-      if (frame.kind === "bye") closed = true;
-      return { ok: true };
-    }
-  };
-}
 export {
   ABOUT,
   ABOUT_SHORT,