@moltzap/identity 2026.902.0

package/dist/signed-message.js

@@ -0,0 +1,289 @@
+/** @file Canonical end-to-end signed message representation, signing, and verification. */
+import { Brand, Data, Effect, Either, Encoding, ParseResult, Schema, } from "effect";
+import { GeneralSign, generalVerify, importJWK } from "jose";
+import { AgentCardDigest, digestAgentCard, } from "./agent-card.js";
+import { AgentSigningAuthority, agentSigningPrivateKey, ed25519PublicKeyThumbprintUri, hasCanonicalEd25519SignatureEncoding, } from "./agent-key.js";
+import { decodeCanonicalJson, encodeCanonicalJson } from "./canonical-json.js";
+import { AgentId, canonicalIdentifier, } from "./identifiers.js";
+import { MOLTZAP_VERSION } from "./version.js";
+/** Sender-scoped identity of one attributed message. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas share the public domain name they decode.
+export const MessageId = canonicalIdentifier("MessageId", "msg_", 16);
+const SIGNED_MESSAGE_TYPE = "application/vnd.moltzap.signed-message+jws";
+const MAXIMUM_BODY_BYTES = 262_144;
+const MAXIMUM_RECIPIENTS = 128;
+const MAXIMUM_ENCODED_BYTES = 471_671;
+const ED25519_SIGNATURE_BYTES = 64;
+const decodeCanonicalBase64Url = (value) => Either.match(Encoding.decodeBase64Url(value), {
+    onLeft: () => undefined,
+    onRight: (bytes) => Encoding.encodeBase64Url(bytes) === value ? bytes : undefined,
+});
+const exactStruct = (fields) => Schema.Struct(fields).annotations({
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+const canonicalBase64Url = Schema.String.pipe(Schema.filter((value) => decodeCanonicalBase64Url(value) !== undefined));
+const signatureRepresentation = exactStruct({
+    protected: canonicalBase64Url,
+    signature: Schema.String.pipe(Schema.filter((value) => {
+        const bytes = decodeCanonicalBase64Url(value);
+        return (bytes?.byteLength === ED25519_SIGNATURE_BYTES &&
+            hasCanonicalEd25519SignatureEncoding(bytes));
+    })),
+});
+const generalJwsRepresentation = exactStruct({
+    payload: canonicalBase64Url,
+    signatures: Schema.Tuple(signatureRepresentation),
+});
+const protectedHeader = exactStruct({
+    alg: Schema.Literal("Ed25519"),
+    kid: Schema.String,
+    typ: Schema.Literal(SIGNED_MESSAGE_TYPE),
+});
+const compareAgentIds = (left, right) => {
+    const leftBytes = decodeCanonicalBase64Url(left.slice(4));
+    const rightBytes = decodeCanonicalBase64Url(right.slice(4));
+    if (leftBytes === undefined || rightBytes === undefined) {
+        return 0;
+    }
+    const length = Math.min(leftBytes.byteLength, rightBytes.byteLength);
+    for (let index = 0; index < length; index += 1) {
+        const leftByte = leftBytes[index];
+        const rightByte = rightBytes[index];
+        if (leftByte === undefined || rightByte === undefined) {
+            return 0;
+        }
+        const difference = leftByte - rightByte;
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+    return leftBytes.byteLength - rightBytes.byteLength;
+};
+const recipientsAreCanonical = (recipientAgentIds) => {
+    for (let index = 1; index < recipientAgentIds.length; index += 1) {
+        const previous = recipientAgentIds[index - 1];
+        const current = recipientAgentIds[index];
+        if (previous === undefined || current === undefined) {
+            return false;
+        }
+        if (compareAgentIds(previous, current) >= 0) {
+            return false;
+        }
+    }
+    return true;
+};
+const recipientAgentIds = Schema.Array(AgentId).pipe(Schema.minItems(1), Schema.maxItems(MAXIMUM_RECIPIENTS), Schema.filter(recipientsAreCanonical));
+const opaqueBody = Schema.String.pipe(Schema.filter((value) => {
+    const bytes = decodeCanonicalBase64Url(value);
+    return bytes !== undefined && bytes.byteLength <= MAXIMUM_BODY_BYTES;
+}));
+const payload = exactStruct({
+    kind: Schema.Literal("signedMessage"),
+    moltzapVersion: Schema.Literal(MOLTZAP_VERSION),
+    senderAgentId: AgentId,
+    agentCardDigest: AgentCardDigest,
+    recipientAgentIds,
+    messageId: MessageId,
+    body: opaqueBody,
+});
+const messageState = new WeakMap();
+const hasSignedMessageState = (value) => typeof value === "object" &&
+    value !== null &&
+    Object.isFrozen(value) &&
+    messageState.has(value);
+const signedMessageView = Schema.declare(hasSignedMessageState, {
+    identifier: "SignedMessageView",
+});
+const parseIssue = (ast, actual) => new ParseResult.Type(ast, actual, "Expected an exact SignedMessage");
+const decodeBase64Url = (value, ast) => {
+    const bytes = decodeCanonicalBase64Url(value);
+    return bytes === undefined
+        ? Effect.fail(parseIssue(ast, value))
+        : Effect.succeed(bytes);
+};
+const snapshotRepresentation = (representation) => Object.freeze({
+    payload: representation.payload,
+    signatures: Object.freeze([
+        Object.freeze({
+            protected: representation.signatures[0].protected,
+            signature: representation.signatures[0].signature,
+        }),
+    ]),
+});
+const makeView = (decodedPayload, body) => {
+    const recipients = Object.freeze([...decodedPayload.recipientAgentIds]);
+    const bodySnapshot = Uint8Array.from(body);
+    const view = {
+        senderAgentId: decodedPayload.senderAgentId,
+        agentCardDigest: decodedPayload.agentCardDigest,
+        recipientAgentIds: recipients,
+        messageId: decodedPayload.messageId,
+        get body() {
+            return Uint8Array.from(bodySnapshot);
+        },
+    };
+    return Object.freeze(view);
+};
+const decodeRepresentation = (representation, ast) => Effect.gen(function* () {
+    const payloadBytes = yield* decodeBase64Url(representation.payload, ast);
+    const headerBytes = yield* decodeBase64Url(representation.signatures[0].protected, ast);
+    const decodedPayload = yield* decodeCanonicalJson(payload, payloadBytes).pipe(Effect.mapError(() => parseIssue(ast, representation)));
+    const decodedHeader = yield* decodeCanonicalJson(protectedHeader, headerBytes).pipe(Effect.mapError(() => parseIssue(ast, representation)));
+    const body = yield* decodeBase64Url(decodedPayload.body, ast);
+    const retained = snapshotRepresentation(representation);
+    const encoded = yield* encodeCanonicalJson(retained).pipe(Effect.mapError(() => parseIssue(ast, representation)));
+    if (encoded.byteLength > MAXIMUM_ENCODED_BYTES) {
+        return yield* Effect.fail(parseIssue(ast, representation));
+    }
+    const view = makeView(decodedPayload, body);
+    messageState.set(view, {
+        representation: retained,
+        protectedHeader: Object.freeze({ ...decodedHeader }),
+        body: Uint8Array.from(body),
+        encodedByteLength: encoded.byteLength,
+    });
+    return view;
+});
+const encodeView = (message, ast) => {
+    const state = messageState.get(message);
+    return state === undefined
+        ? Effect.fail(parseIssue(ast, message))
+        : Effect.succeed(state.representation);
+};
+const signedMessageSchema = Schema.transformOrFail(generalJwsRepresentation, signedMessageView, {
+    strict: true,
+    decode: (representation, ...[, ast]) => decodeRepresentation(representation, ast),
+    encode: (message, ...[, ast]) => encodeView(message, ast),
+}).annotations({
+    identifier: "SignedMessage",
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+const brandVerifiedSignedMessage = Brand.nominal();
+/** A message cannot be signed under the supplied immutable identity. */
+export class SignedMessageSigningError extends Data.TaggedError("SignedMessageSigningError") {
+}
+/** A SignedMessage does not bind to the supplied verified AgentCard. */
+export class SignedMessageVerificationError extends Data.TaggedError("SignedMessageVerificationError") {
+}
+const signingFailure = () => new SignedMessageSigningError();
+const verificationFailure = () => new SignedMessageVerificationError();
+const parseSignedMessage = (representation) => Schema.decodeUnknown(signedMessageSchema)(representation, {
+    exact: true,
+    onExcessProperty: "error",
+}).pipe(Effect.mapError(signingFailure));
+const snapshotRecipients = (recipientAgentIds) => Effect.gen(function* () {
+    const recipients = yield* Effect.try({
+        try: () => Array.from(recipientAgentIds),
+        catch: signingFailure,
+    });
+    recipients.sort(compareAgentIds);
+    if (recipients.length === 0 ||
+        recipients.length > MAXIMUM_RECIPIENTS ||
+        !recipientsAreCanonical(recipients)) {
+        return yield* new SignedMessageSigningError();
+    }
+    return recipients;
+});
+const snapshotBody = (candidate) => Effect.gen(function* () {
+    const body = yield* Effect.try({
+        try: () => Uint8Array.from(candidate),
+        catch: signingFailure,
+    });
+    if (body.byteLength > MAXIMUM_BODY_BYTES) {
+        return yield* new SignedMessageSigningError();
+    }
+    return body;
+});
+const prepareSigningMaterial = (input) => Effect.gen(function* () {
+    if (AgentSigningAuthority.publicKey(input.signingAuthority).x !==
+        input.agentCard.publicKey.x) {
+        return yield* new SignedMessageSigningError();
+    }
+    const recipients = yield* snapshotRecipients(input.recipientAgentIds);
+    const body = yield* snapshotBody(input.body);
+    const agentCardDigest = yield* digestAgentCard(input.agentCard).pipe(Effect.mapError(signingFailure));
+    const kid = yield* ed25519PublicKeyThumbprintUri(input.agentCard.publicKey).pipe(Effect.mapError(signingFailure));
+    const payloadBytes = yield* encodeCanonicalJson({
+        kind: "signedMessage",
+        moltzapVersion: MOLTZAP_VERSION,
+        senderAgentId: input.agentCard.agentId,
+        agentCardDigest,
+        recipientAgentIds: recipients,
+        messageId: input.messageId,
+        body: Encoding.encodeBase64Url(body),
+    }).pipe(Effect.mapError(signingFailure));
+    return { kid, payloadBytes };
+});
+const sign = (input) => Effect.gen(function* () {
+    const { kid, payloadBytes } = yield* prepareSigningMaterial(input);
+    const representation = yield* Effect.tryPromise({
+        try: () => new GeneralSign(payloadBytes)
+            .addSignature(agentSigningPrivateKey(input.signingAuthority))
+            .setProtectedHeader({
+            alg: "Ed25519",
+            kid,
+            typ: SIGNED_MESSAGE_TYPE,
+        })
+            .sign(),
+        catch: signingFailure,
+    });
+    const signedMessage = yield* parseSignedMessage(representation);
+    return brandVerifiedSignedMessage(signedMessage);
+});
+const verify = (input) => Effect.gen(function* () {
+    const state = messageState.get(input.signedMessage);
+    if (state === undefined) {
+        return yield* new SignedMessageVerificationError();
+    }
+    const expectedDigest = yield* digestAgentCard(input.agentCard).pipe(Effect.mapError(verificationFailure));
+    const expectedKid = yield* ed25519PublicKeyThumbprintUri(input.agentCard.publicKey).pipe(Effect.mapError(verificationFailure));
+    const messageMatches = input.signedMessage.senderAgentId === input.agentCard.agentId &&
+        input.signedMessage.agentCardDigest === expectedDigest;
+    const headerMatches = state.protectedHeader.kid === expectedKid &&
+        state.protectedHeader.alg === "Ed25519" &&
+        state.protectedHeader.typ === SIGNED_MESSAGE_TYPE;
+    if (!messageMatches || !headerMatches) {
+        return yield* new SignedMessageVerificationError();
+    }
+    const key = yield* Effect.tryPromise({
+        try: () => importJWK(input.agentCard.publicKey, "Ed25519"),
+        catch: verificationFailure,
+    });
+    yield* Effect.tryPromise({
+        try: () => {
+            const signature = state.representation.signatures[0];
+            return generalVerify({
+                payload: state.representation.payload,
+                signatures: [
+                    {
+                        protected: signature.protected,
+                        signature: signature.signature,
+                    },
+                ],
+            }, key, { algorithms: ["Ed25519"] });
+        },
+        catch: verificationFailure,
+    });
+    return brandVerifiedSignedMessage(input.signedMessage);
+});
+const encodedByteLength = (signedMessage) => messageState.get(signedMessage)?.encodedByteLength ?? 0;
+/* eslint-disable @typescript-eslint/no-redeclare, @typescript-eslint/naming-convention, agent-code-guard/require-assertion-rationale --
+ * The accepted same-name Schema/type API retains the exact private General JWS AST while erasing only its encoded TypeScript type.
+ */
+/** Opaque attributed message operations and exact representation Schema. */
+export const SignedMessage = Object.assign(signedMessageSchema, {
+    sign,
+    verify,
+    encodedByteLength,
+    maximumEncodedByteLength: MAXIMUM_ENCODED_BYTES,
+});
+/* eslint-enable @typescript-eslint/no-redeclare, @typescript-eslint/naming-convention, agent-code-guard/require-assertion-rationale --
+ * The accepted same-name Schema/type API retains the exact private General JWS AST while erasing only its encoded TypeScript type.
+ */
+//# sourceMappingURL=signed-message.js.map

package/dist/signed-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-message.js","sourceRoot":"","sources":["../src/signed-message.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,EACL,KAAK,EACL,IAAI,EACJ,MAAM,EACN,MAAM,EACN,QAAQ,EACR,WAAW,EACX,MAAM,GAEP,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,EACL,eAAe,EAEf,eAAe,GAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EAErB,sBAAsB,EACtB,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EACL,OAAO,EAEP,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,wDAAwD;AACxD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAKtE,MAAM,mBAAmB,GAAG,4CAA4C,CAAC;AACzE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,MAAM,wBAAwB,GAAG,CAAC,KAAa,EAA0B,EAAE,CACzE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;CAChE,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAChC,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAEL,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CACxE,CAAC;AAEF,MAAM,uBAAuB,GAAG,WAAW,CAAC;IAC1C,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,CACL,KAAK,EAAE,UAAU,KAAK,uBAAuB;YAC7C,oCAAoC,CAAC,KAAK,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAC3C,OAAO,EAAE,kBAAkB;IAC3B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC;CAClD,CAAC,CAAC;AAIH,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC,MAAM;IAClB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,IAAkB,EAAE,KAAmB,EAAU,EAAE;IAC1E,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACrE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,iBAA0C,EACjC,EAAE;IACX,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAClD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClB,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACnC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CACtC,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACnC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AACvE,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,OAAO,GAAG,WAAW,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;IAC/C,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,eAAe;IAChC,iBAAiB;IACjB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,UAAU;CACjB,CAAC,CAAC;AAkBH,MAAM,YAAY,GAAG,IAAI,OAAO,EAA8B,CAAC;AAE/D,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAA0B,EAAE,CACvE,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;IACtB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAE1B,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE;IAC9D,UAAU,EAAE,mBAAmB;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CACjB,GAA6B,EAC7B,MAAe,EACS,EAAE,CAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,iCAAiC,CAAC,CAAC;AAEvE,MAAM,eAAe,GAAG,CACtB,KAAa,EACb,GAA6B,EACsB,EAAE;IACrD,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,cAA2C,EACd,EAAE,CAC/B,MAAM,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,CAAC,OAAO;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACjD,SAAS,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;SAClD,CAAC;KACM,CAAC;CACZ,CAAC,CAAC;AAEL,MAAM,QAAQ,GAAG,CACf,cAAmC,EACnC,IAAgB,EACD,EAAE;IACjB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAkB;QAC1B,aAAa,EAAE,cAAc,CAAC,aAAa;QAC3C,eAAe,EAAE,cAAc,CAAC,eAAe;QAC/C,iBAAiB,EAAE,UAAU;QAC7B,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,IAAI,IAAI;YACN,OAAO,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,cAA2C,EAC3C,GAA6B,EACyB,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,eAAe,CACxC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EACtC,GAAG,CACJ,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC/C,OAAO,EACP,YAAY,CACb,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC9C,eAAe,EACf,WAAW,CACZ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,IAAI,CACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CACvD,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5C,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE;QACrB,cAAc,EAAE,QAAQ;QACxB,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC;QACpD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,MAAM,UAAU,GAAG,CACjB,OAAsB,EACtB,GAA6B,EACuC,EAAE;IACtE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,MAAM,CAAC,eAAe,CAChD,wBAAwB,EACxB,iBAAiB,EACjB;IACE,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CACrC,oBAAoB,CAAC,cAAc,EAAE,GAAG,CAAC;IAC3C,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;CAC1D,CACF,CAAC,WAAW,CAAC;IACZ,UAAU,EAAE,eAAe;IAC3B,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAMH,MAAM,0BAA0B,GAAG,KAAK,CAAC,OAAO,EAAyB,CAAC;AAE1E,wEAAwE;AACxE,MAAM,OAAO,yBAA0B,SAAQ,IAAI,CAAC,WAAW,CAC7D,2BAA2B,CAC5B;CAAG;AAEJ,wEAAwE;AACxE,MAAM,OAAO,8BAA+B,SAAQ,IAAI,CAAC,WAAW,CAClE,gCAAgC,CACjC;CAAG;AAEJ,MAAM,cAAc,GAAG,GAA8B,EAAE,CACrD,IAAI,yBAAyB,EAAE,CAAC;AAElC,MAAM,mBAAmB,GAAG,GAAmC,EAAE,CAC/D,IAAI,8BAA8B,EAAE,CAAC;AAEvC,MAAM,kBAAkB,GAAG,CACzB,cAAuB,EACkC,EAAE,CAC3D,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,cAAc,EAAE;IACxD,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAO;CAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;AAU3C,MAAM,kBAAkB,GAAG,CAAC,iBAA4C,EAAE,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACnC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACxC,KAAK,EAAE,cAAc;KACtB,CAAC,CAAC;IACH,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjC,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,MAAM,GAAG,kBAAkB;QACtC,CAAC,sBAAsB,CAAC,UAAU,CAAC,EACnC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC,SAAqB,EAAE,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QACrC,KAAK,EAAE,cAAc;KACtB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAE,EAAE,CAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IACE,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAC3B,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAChC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,6BAA6B,CAC9C,KAAK,CAAC,SAAS,CAAC,SAAS,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC;QAC9C,IAAI,EAAE,eAAe;QACrB,cAAc,EAAE,eAAe;QAC/B,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO;QACtC,eAAe;QACf,iBAAiB,EAAE,UAAU;QAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACzC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,MAAM,IAAI,GAAG,CACX,KAAgB,EACiD,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QAC9C,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,WAAW,CAAC,YAAY,CAAC;aAC1B,YAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC;YAClB,GAAG,EAAE,SAAS;YACd,GAAG;YACH,GAAG,EAAE,mBAAmB;SACzB,CAAC;aACD,IAAI,EAAE;QACX,KAAK,EAAE,cAAc;KACtB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAChE,OAAO,0BAA0B,CAAC,aAAa,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAOL,MAAM,MAAM,GAAG,CACb,KAAkB,EACoD,EAAE,CACxE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,IAAI,8BAA8B,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CACjE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,6BAA6B,CACtD,KAAK,CAAC,SAAS,CAAC,SAAS,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC7C,MAAM,cAAc,GAClB,KAAK,CAAC,aAAa,CAAC,aAAa,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO;QAC7D,KAAK,CAAC,aAAa,CAAC,eAAe,KAAK,cAAc,CAAC;IACzD,MAAM,aAAa,GACjB,KAAK,CAAC,eAAe,CAAC,GAAG,KAAK,WAAW;QACzC,KAAK,CAAC,eAAe,CAAC,GAAG,KAAK,SAAS;QACvC,KAAK,CAAC,eAAe,CAAC,GAAG,KAAK,mBAAmB,CAAC;IACpD,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,IAAI,8BAA8B,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACnC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QAC1D,KAAK,EAAE,mBAAmB;KAC3B,CAAC,CAAC;IACH,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACvB,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO,aAAa,CAClB;gBACE,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,OAAO;gBACrC,UAAU,EAAE;oBACV;wBACE,SAAS,EAAE,SAAS,CAAC,SAAS;wBAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;qBAC/B;iBACF;aACF,EACD,GAAG,EACH,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,mBAAmB;KAC3B,CAAC,CAAC;IACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEL,MAAM,iBAAiB,GAAG,CAAC,aAA4B,EAAU,EAAE,CACjE,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,iBAAiB,IAAI,CAAC,CAAC;AAE1D;;GAEG;AACH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE;IAC9D,IAAI;IACJ,MAAM;IACN,iBAAiB;IACjB,wBAAwB,EAAE,qBAAqB;CAChD,CAMG,CAAC;AACL;;GAEG"}

package/dist/version.d.ts

@@ -0,0 +1,4 @@
+/** @file Sole MoltZap compatibility value for all owned network boundaries. */
+/** Sole compatibility value for MoltZap-owned network boundaries. */
+export declare const MOLTZAP_VERSION = "2026.827.1";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,qEAAqE;AACrE,eAAO,MAAM,eAAe,eAAe,CAAC"}

package/dist/version.js

@@ -0,0 +1,4 @@
+/** @file Sole MoltZap compatibility value for all owned network boundaries. */
+/** Sole compatibility value for MoltZap-owned network boundaries. */
+export const MOLTZAP_VERSION = "2026.827.1";
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,qEAAqE;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC"}

package/package.json

@@ -0,0 +1,139 @@
+{
+  "name": "@moltzap/identity",
+  "version": "2026.902.0",
+  "description": "Identity contracts and representation, AuthenticatedHttp, Registry client and PostgreSQL server",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chughtapan/moltzap.git"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "!dist/tsconfig.tsbuildinfo",
+    "bin",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./registry": {
+      "types": "./dist/registry.d.ts",
+      "import": "./dist/registry.js"
+    },
+    "./registry/server": {
+      "types": "./dist/registry/server.d.ts",
+      "import": "./dist/registry/server.js"
+    }
+  },
+  "bin": {
+    "moltzap-registry": "./bin/moltzap-registry"
+  },
+  "nx": {
+    "targets": {
+      "build": {
+        "executor": "nx:run-commands",
+        "inputs": [
+          "production",
+          "^production"
+        ],
+        "options": {
+          "cwd": "packages/identity",
+          "command": "tsc -b"
+        }
+      },
+      "typecheck": {
+        "executor": "nx:run-commands",
+        "inputs": [
+          "production",
+          "^production"
+        ],
+        "options": {
+          "cwd": "packages/identity",
+          "command": "tsc --noEmit --tsBuildInfoFile ./tsconfig.typecheck.tsbuildinfo -p tsconfig.json"
+        }
+      },
+      "typecheck:tests": {
+        "executor": "nx:run-commands",
+        "options": {
+          "cwd": "packages/identity",
+          "command": "tsc -p tsconfig.test.json"
+        }
+      },
+      "test": {
+        "executor": "nx:run-commands",
+        "dependsOn": [
+          "build",
+          "^build"
+        ],
+        "options": {
+          "cwd": "packages/identity",
+          "command": "vitest run --config vitest.config.mjs"
+        }
+      },
+      "test:integration": {
+        "executor": "nx:run-commands",
+        "dependsOn": [
+          "build",
+          "^build"
+        ],
+        "options": {
+          "cwd": "packages/identity",
+          "command": "vitest run --config vitest.integration.config.mjs"
+        }
+      },
+      "lint": {
+        "executor": "nx:run-commands",
+        "options": {
+          "cwd": "packages/identity",
+          "command": "eslint . --cache --max-warnings=0"
+        }
+      },
+      "arch:check": {
+        "executor": "nx:run-commands",
+        "options": {
+          "cwd": "packages/identity",
+          "command": "node ../../scripts/architecture/check-package.mjs ."
+        }
+      }
+    }
+  },
+  "dependencies": {
+    "@effect/experimental": "^0.61.0",
+    "@effect/platform": "^0.97.0",
+    "@effect/platform-node": "^0.108.0",
+    "@effect/rpc": "^0.76.0",
+    "@effect/sql": "^0.52.0",
+    "@effect/sql-pg": "^0.53.0",
+    "canonicalize": "3.0.0",
+    "effect": "^3.22.0",
+    "http-message-signatures": "1.0.6",
+    "jose": "6.2.5",
+    "structured-headers": "2.0.3"
+  },
+  "devDependencies": {
+    "@effect/vitest": "^0.30.0",
+    "@electric-sql/pglite": "0.4.4",
+    "@electric-sql/pglite-socket": "0.1.4",
+    "@testcontainers/postgresql": "10.28.0",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "eslint": "^9",
+    "fast-check": "3.23.2",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "3.2.4"
+  },
+  "scripts": {
+    "build": "nx run @moltzap/identity:build",
+    "typecheck": "nx run @moltzap/identity:typecheck",
+    "typecheck:tests": "nx run @moltzap/identity:typecheck:tests",
+    "test": "nx run @moltzap/identity:test",
+    "test:integration": "nx run @moltzap/identity:test:integration",
+    "lint": "nx run @moltzap/identity:lint",
+    "arch:check": "nx run @moltzap/identity:arch:check"
+  }
+}