@did-btcr2/method 0.29.0 → 0.32.0

package/dist/esm/core/aggregation/transport/factory.js

@@ -1,17 +1,26 @@
 import { NotImplementedError } from '@did-btcr2/common';
-import { NostrTransport } from './nostr.js';
 import { TransportError } from './error.js';
-/**
- * Factory for creating Transport instances.
- * @class TransportFactory
- */
+import { HttpClientTransport } from './http/client.js';
+import { HttpServerTransport } from './http/server.js';
+import { NostrTransport } from './nostr.js';
+/** Factory for creating Transport instances. */
 export class TransportFactory {
     static establish(config) {
         switch (config.type) {
             case 'nostr':
-                return new NostrTransport({ relays: config.relays });
+                return new NostrTransport({
+                    relays: config.relays,
+                    logger: config.logger,
+                    broadcastLookbackMs: config.broadcastLookbackMs,
+                });
             case 'didcomm':
                 throw new NotImplementedError('DIDComm transport not implemented yet.');
+            case 'http':
+                if (config.role === 'client')
+                    return new HttpClientTransport(config);
+                if (config.role === 'server')
+                    return new HttpServerTransport(config);
+                throw new NotImplementedError(`HTTP transport role not implemented: ${config.role}`);
             default:
                 throw new TransportError(`Invalid transport type: ${config.type}`, 'INVALID_TRANSPORT_TYPE', { config });
         }

package/dist/esm/core/aggregation/transport/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAQ5C;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,MAAuB;QACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,OAAO;gBACV,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,KAAK,SAAS;gBACZ,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E;gBACE,MAAM,IAAI,cAAc,CACtB,2BAA2B,MAAM,CAAC,IAAI,EAAE,EACxC,wBAAwB,EAAE,EAAE,MAAM,EAAE,CACrC,CAAC;QACN,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../../src/core/aggregation/transport/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA+B5C,gDAAgD;AAChD,MAAM,OAAO,gBAAgB;IAC3B,MAAM,CAAC,SAAS,CAAC,MAAuB;QACtC,QAAO,MAAM,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,OAAO;gBACV,OAAO,IAAI,cAAc,CAAC;oBACxB,MAAM,EAAgB,MAAM,CAAC,MAAM;oBACnC,MAAM,EAAgB,MAAM,CAAC,MAAM;oBACnC,mBAAmB,EAAG,MAAM,CAAC,mBAAmB;iBACjD,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;YAC1E,KAAK,MAAM;gBACT,IAAG,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACpE,IAAG,MAAM,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACpE,MAAM,IAAI,mBAAmB,CAC3B,wCAAyC,MAA2B,CAAC,IAAI,EAAE,CAC5E,CAAC;YACJ;gBACE,MAAM,IAAI,cAAc,CACtB,2BAA4B,MAA2B,CAAC,IAAI,EAAE,EAC9D,wBAAwB,EACxB,EAAE,MAAM,EAAE,CACX,CAAC;QACN,CAAC;IACH,CAAC;CACF"}

package/dist/esm/core/aggregation/transport/http/client.js

@@ -0,0 +1,350 @@
+import { CompressedSecp256k1PublicKey } from '@did-btcr2/keypair';
+import { Identifier } from '../../../identifier.js';
+import { CONSOLE_LOGGER } from '../../logger.js';
+import { reviveFromWire, signEnvelope, verifyEnvelope } from './envelope.js';
+import { HttpTransportError } from './errors.js';
+import { DEFAULT_CLOCK_SKEW_SEC, HTTP_ROUTE, SSE_EVENT, } from './protocol.js';
+import { buildRequestAuth } from './request-auth.js';
+import { parseSseStream } from './sse-stream.js';
+/** Default exponential backoff: 1s, 2s, 4s, ..., capped at 30s, 20% jitter. */
+export function defaultReconnectBackoff(attempt) {
+    const base = Math.min(1000 * 2 ** attempt, 30_000);
+    const jitter = base * 0.2 * Math.random();
+    return Math.floor(base + jitter);
+}
+/**
+ * HTTP transport client. Implements the transport-agnostic {@link Transport}
+ * interface; the wire is fetch-based SSE for incoming events and fetch-based
+ * POST for outgoing messages. All runtime I/O goes through `fetchImpl` so
+ * tests can substitute a mock without touching the network.
+ */
+export class HttpClientTransport {
+    name = 'http';
+    #baseUrl;
+    #fetch;
+    #logger;
+    #backoff;
+    #clockSkewSec;
+    #actors = new Map();
+    #peers = new Map();
+    #started = false;
+    #broadcastAbort;
+    constructor(config) {
+        const base = typeof config.baseUrl === 'string' ? new URL(config.baseUrl) : new URL(config.baseUrl.href);
+        if (!base.pathname.endsWith('/'))
+            base.pathname += '/';
+        this.#baseUrl = base;
+        this.#logger = config.logger ?? CONSOLE_LOGGER;
+        this.#backoff = config.reconnectBackoff ?? defaultReconnectBackoff;
+        this.#clockSkewSec = config.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+        const fetchImpl = config.fetchImpl ?? globalThis.fetch;
+        if (typeof fetchImpl !== 'function') {
+            throw new HttpTransportError('No fetch implementation available. Pass config.fetchImpl explicitly.', 'NO_FETCH_IMPL');
+        }
+        this.#fetch = fetchImpl;
+    }
+    start() {
+        if (this.#started)
+            return;
+        this.#started = true;
+        this.#broadcastAbort = new AbortController();
+        this.#runBroadcastLoop(this.#broadcastAbort.signal);
+        for (const [did, entry] of this.#actors) {
+            this.#openInbox(did, entry);
+        }
+    }
+    /**
+     * Tear down all SSE subscriptions and stop reconnect loops. Not part of the
+     * {@link Transport} interface, but needed in tests and whenever a client
+     * wants to cleanly disconnect without unregistering every actor.
+     *
+     * Idempotent. Actors remain registered (re-call {@link start} to resume).
+     */
+    stop() {
+        this.#broadcastAbort?.abort();
+        this.#broadcastAbort = undefined;
+        for (const entry of this.#actors.values()) {
+            entry.inboxAbort?.abort();
+            entry.inboxAbort = undefined;
+        }
+        this.#started = false;
+    }
+    registerActor(did, keys) {
+        const existing = this.#actors.get(did);
+        if (existing?.inboxAbort)
+            existing.inboxAbort.abort();
+        const entry = { keys, handlers: new Map() };
+        this.#actors.set(did, entry);
+        if (this.#started)
+            this.#openInbox(did, entry);
+    }
+    unregisterActor(did) {
+        const entry = this.#actors.get(did);
+        if (!entry)
+            return;
+        entry.inboxAbort?.abort();
+        this.#actors.delete(did);
+        this.#peers.delete(did);
+    }
+    getActorPk(did) {
+        return this.#actors.get(did)?.keys.publicKey.compressed;
+    }
+    registerPeer(did, communicationPk) {
+        try {
+            new CompressedSecp256k1PublicKey(communicationPk);
+        }
+        catch {
+            throw new HttpTransportError(`Invalid communication public key for peer ${did}: expected a 33-byte compressed secp256k1 key.`, 'INVALID_PEER_KEY', { did, keyLength: communicationPk.length });
+        }
+        this.#peers.set(did, communicationPk);
+    }
+    getPeerPk(did) {
+        return this.#peers.get(did);
+    }
+    registerMessageHandler(actorDid, messageType, handler) {
+        const actor = this.#actors.get(actorDid);
+        if (!actor) {
+            throw new HttpTransportError(`Cannot register handler: actor ${actorDid} not registered. Call registerActor() first.`, 'UNKNOWN_ACTOR', { did: actorDid });
+        }
+        actor.handlers.set(messageType, handler);
+    }
+    unregisterMessageHandler(actorDid, messageType) {
+        this.#actors.get(actorDid)?.handlers.delete(messageType);
+    }
+    async sendMessage(message, sender, recipient) {
+        const actor = this.#actors.get(sender);
+        if (!actor) {
+            throw new HttpTransportError(`Unknown sender: ${sender}. Call registerActor() before sending messages.`, 'UNKNOWN_SENDER', { did: sender });
+        }
+        const envelope = signEnvelope(message, { did: sender, keys: actor.keys }, { to: recipient });
+        const url = this.#route(HTTP_ROUTE.MESSAGES);
+        const res = await this.#fetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(envelope),
+        });
+        if (!res.ok) {
+            const body = await safeText(res);
+            throw new HttpTransportError(`sendMessage failed: HTTP ${res.status}`, 'SEND_MESSAGE_HTTP', { status: res.status, body: body.slice(0, 256), messageType: message.type });
+        }
+    }
+    publishRepeating(message, sender, intervalMs, recipient) {
+        let stopped = false;
+        const attempt = () => {
+            if (stopped)
+                return;
+            this.sendMessage(message, sender, recipient).catch((err) => {
+                this.#logger.debug('publishRepeating send failed:', err);
+            });
+        };
+        attempt();
+        const timer = setInterval(attempt, intervalMs);
+        return () => {
+            if (stopped)
+                return;
+            stopped = true;
+            clearInterval(timer);
+        };
+    }
+    #route(template) {
+        // Strip the leading slash so `new URL(rel, base)` is resolved against the
+        // base's pathname instead of replacing it.
+        return new URL(template.replace(/^\//, ''), this.#baseUrl);
+    }
+    #openInbox(did, entry) {
+        const abort = new AbortController();
+        entry.inboxAbort = abort;
+        this.#runInboxLoop(did, entry, abort.signal);
+    }
+    async #runBroadcastLoop(signal) {
+        const url = this.#route(HTTP_ROUTE.ADVERTS);
+        let attempt = 0;
+        while (!signal.aborted) {
+            try {
+                const res = await this.#fetch(url, {
+                    method: 'GET',
+                    headers: { accept: 'text/event-stream' },
+                    signal,
+                });
+                if (!res.ok || !res.body) {
+                    this.#logger.warn(`Broadcast subscribe failed: HTTP ${res.status}`);
+                    await sleep(this.#backoff(attempt++), signal);
+                    continue;
+                }
+                attempt = 0;
+                for await (const ev of parseSseStream(res.body)) {
+                    if (signal.aborted)
+                        return;
+                    if (ev.event !== SSE_EVENT.ADVERT)
+                        continue;
+                    this.#dispatchBroadcast(ev.data);
+                }
+            }
+            catch (err) {
+                if (signal.aborted)
+                    return;
+                this.#logger.debug('Broadcast loop error:', err);
+                try {
+                    await sleep(this.#backoff(attempt++), signal);
+                }
+                catch {
+                    return; // sleep was aborted
+                }
+            }
+        }
+    }
+    async #runInboxLoop(did, entry, signal) {
+        const url = this.#route(HTTP_ROUTE.ACTOR_INBOX.replace('{did}', encodeURIComponent(did)));
+        let attempt = 0;
+        while (!signal.aborted) {
+            try {
+                const auth = buildRequestAuth(did, entry.keys, url.pathname);
+                const res = await this.#fetch(url, {
+                    method: 'GET',
+                    headers: { accept: 'text/event-stream', authorization: auth },
+                    signal,
+                });
+                if (!res.ok || !res.body) {
+                    this.#logger.warn(`Inbox subscribe failed for ${did}: HTTP ${res.status}`);
+                    await sleep(this.#backoff(attempt++), signal);
+                    continue;
+                }
+                attempt = 0;
+                for await (const ev of parseSseStream(res.body)) {
+                    if (signal.aborted)
+                        return;
+                    if (ev.event !== SSE_EVENT.MESSAGE)
+                        continue;
+                    await this.#dispatchInbox(ev.data, did, entry);
+                }
+            }
+            catch (err) {
+                if (signal.aborted)
+                    return;
+                this.#logger.debug(`Inbox loop error for ${did}:`, err);
+                try {
+                    await sleep(this.#backoff(attempt++), signal);
+                }
+                catch {
+                    return;
+                }
+            }
+        }
+    }
+    #dispatchBroadcast(dataJson) {
+        const envelope = parseEnvelope(dataJson, this.#logger);
+        if (!envelope)
+            return;
+        const senderPk = this.#resolveSenderPk(envelope.from);
+        if (!senderPk) {
+            this.#logger.debug(`Broadcast from unresolvable DID: ${envelope.from}`);
+            return;
+        }
+        try {
+            verifyEnvelope(envelope, senderPk, { clockSkewSec: this.#clockSkewSec });
+        }
+        catch (err) {
+            this.#logger.debug('Broadcast envelope verification failed:', err);
+            return;
+        }
+        const revived = reviveFromWire(envelope.message);
+        const flat = flattenMessage(revived);
+        const messageType = typeof flat.type === 'string' ? flat.type : undefined;
+        if (!messageType)
+            return;
+        for (const actor of this.#actors.values()) {
+            const handler = actor.handlers.get(messageType);
+            if (handler)
+                void Promise.resolve(handler(flat));
+        }
+    }
+    async #dispatchInbox(dataJson, actorDid, entry) {
+        const envelope = parseEnvelope(dataJson, this.#logger);
+        if (!envelope)
+            return;
+        const senderPk = this.#resolveSenderPk(envelope.from);
+        if (!senderPk) {
+            this.#logger.debug(`Inbox message from unresolvable DID: ${envelope.from}`);
+            return;
+        }
+        try {
+            verifyEnvelope(envelope, senderPk, {
+                clockSkewSec: this.#clockSkewSec,
+                expectedTo: actorDid,
+            });
+        }
+        catch (err) {
+            this.#logger.debug(`Inbox envelope verification failed for ${actorDid}:`, err);
+            return;
+        }
+        const revived = reviveFromWire(envelope.message);
+        const flat = flattenMessage(revived);
+        const messageType = typeof flat.type === 'string' ? flat.type : undefined;
+        if (!messageType)
+            return;
+        const handler = entry.handlers.get(messageType);
+        if (handler)
+            await handler(flat);
+    }
+    #resolveSenderPk(did) {
+        const peerBytes = this.#peers.get(did);
+        if (peerBytes) {
+            try {
+                return new CompressedSecp256k1PublicKey(peerBytes);
+            }
+            catch { /* fall through to DID decode */ }
+        }
+        try {
+            const components = Identifier.decode(did);
+            if (components.idType === 'KEY') {
+                return new CompressedSecp256k1PublicKey(components.genesisBytes);
+            }
+        }
+        catch {
+            // Not a decodable did:btcr2 KEY identifier.
+        }
+        return undefined;
+    }
+}
+function sleep(ms, signal) {
+    if (ms <= 0)
+        return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new Error('aborted'));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener('abort', onAbort, { once: true });
+    });
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return '';
+    }
+}
+function parseEnvelope(dataJson, logger) {
+    try {
+        return JSON.parse(dataJson);
+    }
+    catch (err) {
+        logger.debug('SSE event: failed to parse envelope JSON:', err);
+        return undefined;
+    }
+}
+function flattenMessage(msg) {
+    if (msg.body && typeof msg.body === 'object') {
+        return { ...msg, ...msg.body };
+    }
+    return msg;
+}
+//# sourceMappingURL=client.js.map

package/dist/esm/core/aggregation/transport/http/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,SAAS,GAEV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAejD,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,IAAI,GAAK,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;AACnC,CAAC;AAQD;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,MAAM,CAAC;IAEd,QAAQ,CAAW;IACnB,MAAM,CAAsB;IAC5B,OAAO,CAAe;IACtB,QAAQ,CAAmC;IAC3C,aAAa,CAAS;IAEtB,OAAO,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC/C,MAAM,GAA+B,IAAI,GAAG,EAAE,CAAC;IAExD,QAAQ,GAAG,KAAK,CAAC;IACjB,eAAe,CAAmB;IAElC,YAAY,MAAiC;QAC3C,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzG,IAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAQ,IAAI,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAS,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAQ,MAAM,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;QACxE,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;QAEnE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACvD,IAAG,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAC1B,sEAAsE,EACtE,eAAe,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,KAAK;QACH,IAAG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEpD,KAAI,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAI;QACF,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,GAAW,EAAE,IAAoB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAG,QAAQ,EAAE,UAAU;YAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAErD,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAG,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAG,CAAC,KAAK;YAAE,OAAO;QAClB,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IAC1D,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,eAA2B;QACnD,IAAI,CAAC;YACH,IAAI,4BAA4B,CAAC,eAAe,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,6CAA6C,GAAG,gDAAgD,EAChG,kBAAkB,EAClB,EAAE,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,EAAE,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,sBAAsB,CAAC,QAAgB,EAAE,WAAmB,EAAE,OAAuB;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAG,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,QAAQ,8CAA8C,EACxF,eAAe,EACf,EAAE,GAAG,EAAE,QAAQ,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,wBAAwB,CAAC,QAAgB,EAAE,WAAmB;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAoB,EAAE,MAAc,EAAE,SAAkB;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAG,CAAC,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,MAAM,iDAAiD,EAC1E,gBAAgB,EAChB,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAC3B,OAAO,EACP,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EACjC,EAAE,EAAE,EAAE,SAAS,EAAE,CAClB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACjC,MAAM,EAAI,MAAM;YAChB,OAAO,EAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAChD,IAAI,EAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SACnC,CAAC,CAAC;QAEH,IAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAC1B,4BAA4B,GAAG,CAAC,MAAM,EAAE,EACxC,mBAAmB,EACnB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB,CACd,OAAsB,EACtB,MAAiB,EACjB,UAAkB,EAClB,SAAkB;QAElB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAG,OAAO;gBAAE,OAAO;YACnB,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC/C,OAAO,GAAS,EAAE;YAChB,IAAG,OAAO;gBAAE,OAAO;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,0EAA0E;QAC1E,2CAA2C;QAC3C,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,KAAiB;QACvC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAmB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAI,KAAK;oBACf,OAAO,EAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE;oBACzC,MAAM;iBACP,CAAC,CAAC;gBACH,IAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACpE,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,OAAO,GAAG,CAAC,CAAC;gBACZ,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAG,MAAM,CAAC,OAAO;wBAAE,OAAO;oBAC1B,IAAG,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,MAAM;wBAAE,SAAS;oBAC3C,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAAC,OAAM,GAAG,EAAE,CAAC;gBACZ,IAAG,MAAM,CAAC,OAAO;oBAAE,OAAO;gBAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,oBAAoB;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,KAAiB,EAAE,MAAmB;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAI,KAAK;oBACf,OAAO,EAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,EAAE;oBAC9D,MAAM;iBACP,CAAC,CAAC;gBACH,IAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3E,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,OAAO,GAAG,CAAC,CAAC;gBACZ,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAG,MAAM,CAAC,OAAO;wBAAE,OAAO;oBAC1B,IAAG,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,OAAO;wBAAE,SAAS;oBAC5C,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,OAAM,GAAG,EAAE,CAAC;gBACZ,IAAG,MAAM,CAAC,OAAO;oBAAE,OAAO;gBAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wBAAwB,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAG,CAAC,QAAQ;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtD,IAAG,CAAC,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oCAAoC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAM,GAAG,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAA4B,CAAC;QAC5E,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAG,CAAC,WAAW;YAAE,OAAO;QAExB,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAChD,IAAG,OAAO;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAgB,EAAE,KAAiB;QACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,IAAG,CAAC,QAAQ;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtD,IAAG,CAAC,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE;gBACjC,YAAY,EAAG,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAK,QAAQ;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAM,GAAG,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0CAA0C,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAA4B,CAAC;QAC5E,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAG,CAAC,WAAW;YAAE,OAAO;QAExB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAG,OAAO;YAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB,CAAC,GAAW;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAG,SAAS,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,OAAO,IAAI,4BAA4B,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAC3D,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAG,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,IAAI,4BAA4B,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAmB;IAC5C,IAAG,EAAE,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,IAAG,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;;YACxB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,IAAI,CAAC;QAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAChC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAmB,CAAC;IAAC,CAAC;IACtD,OAAM,GAAG,EAAE,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,GAAG,EAAE,GAAI,GAAG,CAAC,IAAgC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/core/aggregation/transport/http/envelope.js

@@ -0,0 +1,126 @@
+import { canonicalHashBytes } from '@did-btcr2/common';
+import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
+import { HttpTransportError } from './errors.js';
+import { DEFAULT_CLOCK_SKEW_SEC, DEFAULT_NONCE_LEN_BYTES, HTTP_ENVELOPE_VERSION, } from './protocol.js';
+/**
+ * Build a {@link SignedEnvelope} around `message`.
+ *
+ * Pure function — no I/O beyond `randomBytes` for nonce generation (which
+ * uses the platform's cryptographic RNG: `crypto.getRandomValues` in browsers,
+ * `node:crypto` in Node). Deterministic when both `nonce` and `timestamp` are
+ * supplied via {@link SignEnvelopeOptions}.
+ */
+export function signEnvelope(message, sender, opts = {}) {
+    const timestamp = opts.timestamp ?? Math.floor(Date.now() / 1000);
+    const nonce = opts.nonce ?? bytesToHex(randomBytes(DEFAULT_NONCE_LEN_BYTES));
+    const messageJson = normalizeForWire(normalizeMessage(message));
+    const unsigned = {
+        v: HTTP_ENVELOPE_VERSION,
+        from: sender.did,
+        ...(opts.to !== undefined ? { to: opts.to } : {}),
+        timestamp,
+        nonce,
+        message: messageJson,
+    };
+    const digest = canonicalHashBytes(unsigned);
+    const sig = sender.keys.secretKey.sign(digest, { scheme: 'schnorr' });
+    return { ...unsigned, sig: bytesToHex(sig) };
+}
+/**
+ * Verify a {@link SignedEnvelope} against the sender's compressed secp256k1
+ * communication public key. Throws {@link HttpTransportError} on any failure;
+ * returns normally on success.
+ *
+ * Does NOT check nonce uniqueness — replay protection is the caller's
+ * responsibility (the server-side transport maintains an LRU cache).
+ */
+export function verifyEnvelope(envelope, senderPk, opts = {}) {
+    if (envelope.v !== HTTP_ENVELOPE_VERSION) {
+        throw new HttpTransportError(`Unsupported envelope version: ${envelope.v}`, 'ENVELOPE_VERSION_MISMATCH', { version: envelope.v, expected: HTTP_ENVELOPE_VERSION });
+    }
+    if (opts.expectedFrom !== undefined && envelope.from !== opts.expectedFrom) {
+        throw new HttpTransportError(`Envelope from mismatch: expected ${opts.expectedFrom}, got ${envelope.from}`, 'ENVELOPE_FROM_MISMATCH', { expected: opts.expectedFrom, got: envelope.from });
+    }
+    if ('expectedTo' in opts && envelope.to !== opts.expectedTo) {
+        throw new HttpTransportError(`Envelope to mismatch: expected ${opts.expectedTo ?? '<broadcast>'}, got ${envelope.to ?? '<broadcast>'}`, 'ENVELOPE_TO_MISMATCH', { expected: opts.expectedTo, got: envelope.to });
+    }
+    const skewSec = opts.clockSkewSec ?? DEFAULT_CLOCK_SKEW_SEC;
+    const nowMs = opts.now ? opts.now() : Date.now();
+    const nowSec = Math.floor(nowMs / 1000);
+    const diff = Math.abs(nowSec - envelope.timestamp);
+    if (diff > skewSec) {
+        throw new HttpTransportError(`Envelope timestamp out of skew: ${diff}s > ${skewSec}s`, 'ENVELOPE_TIMESTAMP_SKEW', { diff, skewSec, timestamp: envelope.timestamp, now: nowSec });
+    }
+    let sigBytes;
+    try {
+        sigBytes = hexToBytes(envelope.sig);
+    }
+    catch {
+        throw new HttpTransportError('Envelope signature is not valid hex', 'ENVELOPE_SIG_HEX');
+    }
+    if (sigBytes.length !== 64) {
+        throw new HttpTransportError(`Invalid signature length: ${sigBytes.length} (expected 64)`, 'ENVELOPE_SIG_LENGTH', { length: sigBytes.length });
+    }
+    const { sig: _sig, ...unsigned } = envelope;
+    const digest = canonicalHashBytes(unsigned);
+    const ok = senderPk.verify(sigBytes, digest, { scheme: 'schnorr' });
+    if (!ok) {
+        throw new HttpTransportError('Envelope signature verification failed', 'ENVELOPE_SIG_INVALID');
+    }
+}
+function normalizeMessage(message) {
+    const maybeToJSON = message.toJSON;
+    if (typeof maybeToJSON === 'function') {
+        return maybeToJSON.call(message);
+    }
+    return message;
+}
+/**
+ * Recursively replace `Uint8Array` values with `{ __bytes: hex }` sentinel
+ * objects so they survive JSON canonicalization / HTTP body serialization.
+ * Pairs with {@link reviveFromWire}.
+ *
+ * Without this, `JSON.stringify` serializes a `Uint8Array` as an index-keyed
+ * object (`{"0":1,"1":2,...}`), which `canonicalize` then re-parses into a
+ * plain object — the receiver cannot reconstruct the original bytes even
+ * though the signature still verifies.
+ */
+export function normalizeForWire(value) {
+    if (value instanceof Uint8Array) {
+        return { __bytes: bytesToHex(value) };
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => normalizeForWire(v));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = normalizeForWire(v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Recursively convert `{ __bytes: hex }` sentinels back into `Uint8Array`
+ * values. Call on `envelope.message` *after* successful verification and
+ * before handing the payload to a runner's handler.
+ */
+export function reviveFromWire(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        const rec = value;
+        const keys = Object.keys(rec);
+        if (keys.length === 1 && keys[0] === '__bytes' && typeof rec.__bytes === 'string') {
+            return hexToBytes(rec.__bytes);
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(rec))
+            out[k] = reviveFromWire(v);
+        return out;
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => reviveFromWire(v));
+    }
+    return value;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/esm/core/aggregation/transport/http/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAG1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AA2BvB;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAwB,EACxB,MAA8C,EAC9C,OAA+B,EAAE;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,MAAM,KAAK,GAAO,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAA4B,CAAC;IAE3F,MAAM,QAAQ,GAAgC;QAC5C,CAAC,EAAW,qBAAqB;QACjC,IAAI,EAAQ,MAAM,CAAC,GAAG;QACtB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,SAAS;QACT,KAAK;QACL,OAAO,EAAK,WAAW;KACxB,CAAC;IAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAwB,EACxB,QAAsC,EACtC,OAAkC,EAAE;IAEpC,IAAG,QAAQ,CAAC,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAC1B,iCAAiC,QAAQ,CAAC,CAAC,EAAE,EAC7C,2BAA2B,EAC3B,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,IAAG,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,IAAI,kBAAkB,CAC1B,oCAAoC,IAAI,CAAC,YAAY,SAAS,QAAQ,CAAC,IAAI,EAAE,EAC7E,wBAAwB,EACxB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,IAAG,YAAY,IAAI,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,IAAI,CAAC,UAAU,IAAI,aAAa,SAAS,QAAQ,CAAC,EAAE,IAAI,aAAa,EAAE,EACzG,sBAAsB,EACtB,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAC5D,MAAM,KAAK,GAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAM,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtD,IAAG,IAAI,GAAG,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,IAAI,OAAO,OAAO,GAAG,EACxD,yBAAyB,EACzB,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,qCAAqC,EACrC,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,IAAG,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,QAAQ,CAAC,MAAM,gBAAgB,EAC5D,qBAAqB,EACrB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACpE,IAAG,CAAC,EAAE,EAAE,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,EACxC,sBAAsB,CACvB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAwB;IAChD,MAAM,WAAW,GAAI,OAAsC,CAAC,MAAM,CAAC;IACnE,IAAG,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC;IAC9D,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAG,KAAK,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,IAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/core/aggregation/transport/http/errors.js

@@ -0,0 +1,11 @@
+import { TransportAdapterError } from '../error.js';
+/**
+ * Errors raised by the HTTP transport adapter. Extends {@link TransportAdapterError}
+ * so callers can catch HTTP-specific failures narrowly or transport failures broadly.
+ */
+export class HttpTransportError extends TransportAdapterError {
+    constructor(message, type = 'HttpTransportError', data) {
+        super(message, type, { adapter: 'http', ...(data ?? {}) });
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/esm/core/aggregation/transport/http/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,qBAAqB;IAC3D,YAAY,OAAe,EAAE,OAAe,oBAAoB,EAAE,IAA0B;QAC1F,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/esm/core/aggregation/transport/http/inbox-buffer.js

@@ -0,0 +1,45 @@
+/**
+ * Fixed-capacity FIFO ring buffer of SSE events for a single actor's inbox.
+ *
+ * When a subscriber (re)connects with a `Last-Event-ID` header, the server
+ * uses {@link since} to replay everything that arrived while the subscriber
+ * was disconnected. Events older than the replay window (evicted from the
+ * ring) are unrecoverable — callers should choose `capacity` based on
+ * expected message rate × acceptable reconnect window.
+ */
+export class InboxBuffer {
+    #capacity;
+    #entries = [];
+    #nextId = 1;
+    constructor(capacity = 100) {
+        if (capacity < 1)
+            throw new Error(`InboxBuffer capacity must be >= 1; got ${capacity}`);
+        this.#capacity = capacity;
+    }
+    /** Append an event. Returns the stored record (including its assigned id). */
+    append(event, data) {
+        const stored = { id: String(this.#nextId++), event, data };
+        this.#entries.push(stored);
+        if (this.#entries.length > this.#capacity)
+            this.#entries.shift();
+        return stored;
+    }
+    /**
+     * Return stored events with id strictly greater than `lastEventId`. If
+     * `lastEventId` is unset or unparseable, returns everything currently
+     * retained.
+     */
+    since(lastEventId) {
+        if (!lastEventId)
+            return this.#entries.slice();
+        const boundary = Number(lastEventId);
+        if (!Number.isFinite(boundary))
+            return this.#entries.slice();
+        return this.#entries.filter((e) => Number(e.id) > boundary);
+    }
+    /** Currently retained event count. */
+    size() {
+        return this.#entries.length;
+    }
+}
+//# sourceMappingURL=inbox-buffer.js.map

package/dist/esm/core/aggregation/transport/http/inbox-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-buffer.js","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/inbox-buffer.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACb,SAAS,CAAS;IAClB,QAAQ,GAAkB,EAAE,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC;IAEZ,YAAY,QAAQ,GAAG,GAAG;QACxB,IAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,KAAa,EAAE,IAAY;QAChC,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAoB;QACxB,IAAG,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACrC,IAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,sCAAsC;IACtC,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC9B,CAAC;CACF"}

package/dist/esm/core/aggregation/transport/http/index.js

@@ -0,0 +1,12 @@
+export * from './errors.js';
+export * from './protocol.js';
+export * from './envelope.js';
+export * from './sse-stream.js';
+export * from './sse-writer.js';
+export * from './request-auth.js';
+export * from './nonce-cache.js';
+export * from './rate-limiter.js';
+export * from './inbox-buffer.js';
+export * from './client.js';
+export * from './server.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/core/aggregation/transport/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/core/aggregation/transport/http/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}