@naylence/advanced-security 0.3.0

package/dist/types/naylence/fame/security/cert/internal-ca-service.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Certificate Authority signing service for node certificates.
+ *
+ * Provides in-process API for issuing certificates with node physical
+ * and host-like logical address information using SPIFFE-compliant identities.
+ */
+import type { CertificateIssuanceResponse, CertificateSigningRequest } from "./ca-types.js";
+import { CAService } from "./ca-types.js";
+export declare const SID_OID = "1.3.6.1.4.1.58530.1";
+export declare const LOGICALS_OID = "1.3.6.1.4.1.58530.2";
+export declare const NODE_ID_OID = "1.3.6.1.4.1.58530.4";
+/**
+ * Options for CASigningService.
+ */
+export interface CASigningServiceOptions {
+    /** Root CA certificate in PEM format */
+    rootCertPem: string;
+    /** Root CA private key in PEM format */
+    rootKeyPem: string;
+    /** Optional intermediate CA certificate in PEM format */
+    intermediateCertPem?: string;
+    /** Optional intermediate CA private key in PEM format */
+    intermediateKeyPem?: string;
+}
+/**
+ * In-process certificate signing service.
+ *
+ * Issues SPIFFE-compliant node certificates with Fame-specific extensions
+ * for physical paths and logical addresses.
+ */
+export declare class CASigningService extends CAService {
+    private readonly rootCertPem;
+    private readonly rootKeyPem;
+    private readonly intermediateCertPem?;
+    private readonly intermediateKeyPem?;
+    private rootCert?;
+    private rootKey?;
+    private signingCert?;
+    private signingKey?;
+    constructor(options: CASigningServiceOptions);
+    private ensureRootMaterials;
+    private ensureSigningMaterials;
+    private getRootCertificate;
+    private getRootKey;
+    private getSigningCertificate;
+    private getSigningKey;
+    /**
+     * Issue a certificate from a CSR.
+     *
+     * Parses the PKCS#10 CSR, extracts the public key, calculates node SID,
+     * and signs a certificate. Mirrors Python's default_ca_service.issue_certificate.
+     *
+     * @param csr - Certificate signing request
+     * @returns Certificate issuance response with the signed certificate
+     */
+    issueCertificate(csr: CertificateSigningRequest): Promise<CertificateIssuanceResponse>;
+    /**
+     * Sign a SPIFFE-compatible node certificate with SID-based identity.
+     *
+     * @param publicKeyPem - Node's public key in PEM format
+     * @param nodeId - Unique identifier for the node
+     * @param nodeSid - Node's pre-computed SID (base62-encoded)
+     * @param physicalPath - Physical path (for SID verification only)
+     * @param logicals - List of host-like logical addresses
+     * @param ttlDays - Certificate validity period in days
+     * @param spiffeTrustDomain - SPIFFE trust domain
+     * @returns PEM-encoded signed certificate
+     */
+    signNodeCert(publicKeyPem: string, nodeId: string, nodeSid: string, physicalPath: string, logicals: string[], ttlDays?: number, spiffeTrustDomain?: string): Promise<string>;
+    /**
+     * Create an intermediate CA certificate.
+     *
+     * @param publicKeyPem - Intermediate CA's public key in PEM format
+     * @param caName - Name for the intermediate CA
+     * @param permittedPaths - List of logical prefixes this CA can issue for
+     * @param ttlDays - Certificate validity period in days
+     * @returns PEM-encoded intermediate CA certificate
+     */
+    createIntermediateCA(publicKeyPem: string, caName: string, permittedPaths: string[], ttlDays?: number): Promise<string>;
+}
+/**
+ * Create a test root CA for development/testing.
+ *
+ * Generates an Ed25519 key pair and self-signed root CA certificate.
+ *
+ * @returns Tuple of [rootCertPem, rootKeyPem]
+ */
+export declare function createTestCA(): Promise<[string, string, string]>;
+/**
+ * Extract SPIFFE ID from certificate SAN.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns SPIFFE ID string or null if not found
+ */
+export declare function extractSpiffeIdFromCert(certPem: string): Promise<string | null>;
+/**
+ * Extract raw SID bytes from certificate extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns SID bytes or null if not found
+ */
+export declare function extractSidFromCert(certPem: string): Promise<Uint8Array | null>;
+/**
+ * Extract node ID from certificate extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns Node ID string or null if not found
+ */
+export declare function extractNodeIdFromCert(certPem: string): Promise<string | null>;
+/**
+ * Extract logical hosts from certificate private extension.
+ *
+ * @param certPem - Certificate in PEM format
+ * @returns List of logical host addresses, empty if none found
+ */
+export declare function extractLogicalHostsFromCert(certPem: string): Promise<string[]>;
+/**
+ * Extract the SID string from a SPIFFE ID.
+ *
+ * @param spiffeId - SPIFFE ID in format spiffe://trust-domain/nodes/<sid>
+ * @returns SID string (base62-encoded) or null if not a valid node SPIFFE ID
+ */
+export declare function extractSidFromSpiffeId(spiffeId: string): string | null;
+/**
+ * Verify that the SID in the certificate matches the expected physical path.
+ *
+ * @param certPem - Certificate in PEM format
+ * @param physicalPath - The expected physical path to verify against
+ * @returns True if SID matches computed hash of physical path, False otherwise
+ */
+export declare function verifyCertSidIntegrity(certPem: string, physicalPath: string): Promise<boolean>;
+//# sourceMappingURL=internal-ca-service.d.ts.map

package/dist/types/naylence/fame/security/cert/internal-ca-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-ca-service.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/cert/internal-ca-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwCH,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAG1C,eAAO,MAAM,OAAO,wBAAwB,CAAC;AAC7C,eAAO,MAAM,YAAY,wBAAwB,CAAC;AAClD,eAAO,MAAM,WAAW,wBAAwB,CAAC;AA2ejD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IAEpB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IAEnB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAE7C,OAAO,CAAC,QAAQ,CAAC,CAA0B;IAC3C,OAAO,CAAC,OAAO,CAAC,CAAY;IAC5B,OAAO,CAAC,WAAW,CAAC,CAA0B;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAY;gBAEnB,OAAO,EAAE,uBAAuB;YAS9B,mBAAmB;YAiBnB,sBAAsB;IAuBpC,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,aAAa;IAOrB;;;;;;;;OAQG;IACG,gBAAgB,CACpB,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,2BAA2B,CAAC;IAuCvC;;;;;;;;;;;OAWG;IACG,YAAY,CAChB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,GAAE,MAAY,EACrB,iBAAiB,GAAE,MAAwB,GAC1C,OAAO,CAAC,MAAM,CAAC;IA6DlB;;;;;;;;OAQG;IACG,oBAAoB,CACxB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,GAAE,MAAa,GACrB,OAAO,CAAC,MAAM,CAAC;CA2CnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CA8CtE;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAoB5B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CAsBnB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYtE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAqBlB"}

package/dist/types/naylence/fame/security/cert/util.d.ts

@@ -0,0 +1,35 @@
+export interface ValidateJwkX5cCertificateOptions {
+    jwk: Record<string, unknown>;
+    trustStorePem?: string | null;
+    enforceNameConstraints?: boolean;
+    strict?: boolean;
+}
+export interface ValidateJwkX5cCertificateResult {
+    isValid: boolean;
+    error?: string;
+}
+/**
+ * Temporary TypeScript port of validate_jwk_x5c_certificate.
+ *
+ * NOTE: The full certificate chain validation logic from the Python runtime
+ * is still being ported. This implementation performs lightweight structure
+ * checks and defers deep X.509 validation until the remaining modules are
+ * available.
+ */
+export declare function validateJwkX5cCertificate(options: ValidateJwkX5cCertificateOptions): ValidateJwkX5cCertificateResult;
+/**
+ * Extract public key from X.509 certificate chain.
+ *
+ * Parses the leaf certificate from an x5c array and extracts the raw public key bytes.
+ * For Ed25519 certificates, this returns the 32-byte public key.
+ *
+ * @param x5c - Array of base64-encoded DER certificates (leaf first)
+ * @param options - Validation options
+ * @returns The raw public key bytes from the leaf certificate
+ * @throws Error if certificate parsing or validation fails
+ */
+export declare function publicKeyFromX5c(x5c: string[], options?: {
+    enforceNameConstraints?: boolean;
+    trustStorePem?: string;
+}): Uint8Array;
+//# sourceMappingURL=util.d.ts.map

package/dist/types/naylence/fame/security/cert/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/cert/util.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gCAAgC,GACxC,+BAA+B,CA2CjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE;IACP,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACnB,GACL,UAAU,CA4EZ"}

package/dist/types/naylence/fame/security/encryption/channel/channel-encryption-manager-factory.d.ts

@@ -0,0 +1,29 @@
+import { EncryptionManagerFactory, type EncryptionManagerConfig } from "@naylence/runtime";
+import { type EncryptionManager, type EncryptionOptions } from "@naylence/runtime";
+export interface ChannelEncryptionManagerConfig extends EncryptionManagerConfig {
+    readonly type: "ChannelEncryptionManager";
+    readonly priority: number;
+    readonly supportedAlgorithms: readonly string[];
+    readonly encryptionType: string;
+}
+export declare const FACTORY_META: {
+    readonly base: "EncryptionManagerFactory";
+    readonly key: "ChannelEncryptionManager";
+};
+export declare class ChannelEncryptionManagerFactory extends EncryptionManagerFactory<ChannelEncryptionManagerConfig> {
+    readonly type: "ChannelEncryptionManager";
+    readonly priority: number;
+    private readonly supportedAlgorithms;
+    private readonly encryptionType;
+    constructor(config?: Partial<ChannelEncryptionManagerConfig> | null);
+    getSupportedAlgorithms(): readonly string[];
+    getEncryptionType(): string;
+    supportsOptions(opts?: EncryptionOptions | null): boolean;
+    create(_config?: ChannelEncryptionManagerConfig | Record<string, unknown> | null, ...factoryArgs: unknown[]): Promise<EncryptionManager>;
+    private resolveDependencies;
+    private resolveSecureChannelManager;
+    private resolveNodeLike;
+    private resolveTaskSpawner;
+}
+export default ChannelEncryptionManagerFactory;
+//# sourceMappingURL=channel-encryption-manager-factory.d.ts.map

package/dist/types/naylence/fame/security/encryption/channel/channel-encryption-manager-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-encryption-manager-factory.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/channel/channel-encryption-manager-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EACxB,KAAK,uBAAuB,EAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAa3B,MAAM,WAAW,8BACf,SAAQ,uBAAuB;IAC/B,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAID,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,qBAAa,+BAAgC,SAAQ,wBAAwB,CAAC,8BAA8B,CAAC;IAC3G,SAAgB,IAAI,6BAAoB;IACxC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI;IAQ5D,sBAAsB,IAAI,SAAS,MAAM,EAAE;IAI3C,iBAAiB,IAAI,MAAM;IAI3B,eAAe,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO;IAWnD,MAAM,CACjB,OAAO,CAAC,EAAE,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACzE,GAAG,WAAW,EAAE,OAAO,EAAE,GACxB,OAAO,CAAC,iBAAiB,CAAC;IAiB7B,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,kBAAkB;CA0B3B;AAED,eAAe,+BAA+B,CAAC"}

package/dist/types/naylence/fame/security/encryption/channel/channel-encryption-manager.d.ts

@@ -0,0 +1,51 @@
+import { type FameEnvelope } from "@naylence/core";
+import { EncryptionResult, type EncryptionManager, type EncryptionOptions } from "@naylence/runtime";
+import type { SecureChannelManager } from "@naylence/runtime";
+import { TaskSpawner } from "@naylence/runtime";
+import type { NodeLike } from "@naylence/runtime";
+type TaskSpawnerLike = Pick<TaskSpawner, "spawn">;
+export interface ChannelEncryptionManagerDependencies {
+    readonly secureChannelManager?: SecureChannelManager | null;
+    readonly nodeLike?: NodeLike | null;
+    readonly taskSpawner?: TaskSpawnerLike | null;
+}
+export declare class ChannelEncryptionManager implements EncryptionManager {
+    private readonly secureChannelManager?;
+    private readonly nodeLike?;
+    private readonly taskSpawner;
+    private readonly pendingEnvelopes;
+    private readonly handshakeInProgress;
+    private readonly addrChannelMap;
+    constructor({ secureChannelManager, nodeLike, taskSpawner, }?: ChannelEncryptionManagerDependencies);
+    encryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions | null): Promise<EncryptionResult>;
+    decryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions | null): Promise<FameEnvelope>;
+    notifyChannelEstablished(channelId: string): Promise<void>;
+    notifyChannelFailed(channelId: string, reason?: string): Promise<void>;
+    /**
+     * Clear cached channel mappings for a destination.
+     * This should be called when routes are removed or channels are closed
+     * to prevent using stale channel references.
+     */
+    clearChannelCacheForDestination(destination: string): void;
+    private isChannelAlgorithm;
+    private isDataFrame;
+    private findExistingChannel;
+    private queueAndInitiateHandshake;
+    private initiateChannelHandshakeAsync;
+    private sendSecureOpenFrameAsync;
+    private deliverEnvelope;
+    private encryptWithChannel;
+    private serializePayload;
+    private extractCiphertext;
+    private deserializePayload;
+    private extractDestinationFromChannelId;
+    private handleFailedEnvelope;
+    private sendDeliveryNack;
+    private getChannelState;
+    private buildSystemReplyTo;
+    private generateChannelId;
+    private runAsyncTask;
+    private decodeNonceValue;
+}
+export {};
+//# sourceMappingURL=channel-encryption-manager.d.ts.map

package/dist/types/naylence/fame/security/encryption/channel/channel-encryption-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-encryption-manager.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/channel/channel-encryption-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,YAAY,EAOlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAclD,KAAK,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAiJlD,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CAC/C;AAED,qBAAa,wBAAyB,YAAW,iBAAiB;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA8B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IACtE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;gBAEhD,EACV,oBAA2B,EAC3B,QAAe,EACf,WAAkB,GACnB,GAAE,oCAAyC;IAO/B,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,iBAAiB,GAAG,IAAW,GACpC,OAAO,CAAC,gBAAgB,CAAC;IAiDf,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,iBAAiB,GAAG,IAAW,GACpC,OAAO,CAAC,YAAY,CAAC;IA8FX,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D1D,mBAAmB,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAA2B,GAClC,OAAO,CAAC,IAAI,CAAC;IAqDhB;;;;OAIG;IACI,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAWjE,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,mBAAmB;YA0Bb,yBAAyB;YAsCzB,6BAA6B;YAyC7B,wBAAwB;YA4CxB,eAAe;IAe7B,OAAO,CAAC,kBAAkB;IAuD1B,OAAO,CAAC,gBAAgB;IA2BxB,OAAO,CAAC,iBAAiB;IA0BzB,OAAO,CAAC,kBAAkB;IAU1B,OAAO,CAAC,+BAA+B;YAQzB,oBAAoB;YAiCpB,gBAAgB;IA4C9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,YAAY;IAyBpB,OAAO,CAAC,gBAAgB;CA6CzB"}

package/dist/types/naylence/fame/security/encryption/channel/index.d.ts

@@ -0,0 +1,3 @@
+export { ChannelEncryptionManager } from "./channel-encryption-manager.js";
+export { ChannelEncryptionManagerFactory } from "./channel-encryption-manager-factory.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/encryption/channel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/channel/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/types/naylence/fame/security/encryption/composite-encryption-manager-factory.d.ts

@@ -0,0 +1,32 @@
+import { EncryptionManagerFactory, type EncryptionManagerConfig, type EncryptionManager, type EncryptionOptions } from "@naylence/runtime";
+export declare const FACTORY_META: {
+    readonly base: "EncryptionManagerFactory";
+    readonly key: "CompositeEncryptionManager";
+};
+export interface CompositeEncryptionManagerConfig extends EncryptionManagerConfig {
+    readonly type: "CompositeEncryptionManager";
+    readonly defaultAlgo?: string | null;
+    readonly supportedSealedAlgorithms?: readonly string[] | null;
+    readonly supportedChannelAlgorithms?: readonly string[] | null;
+}
+export declare class CompositeEncryptionManagerFactory extends EncryptionManagerFactory<CompositeEncryptionManagerConfig> {
+    readonly type: "CompositeEncryptionManager";
+    readonly isDefault = true;
+    readonly priority: number;
+    private readonly supportedAlgorithms;
+    private readonly encryptionType;
+    private readonly supportedSealedAlgorithms?;
+    private readonly supportedChannelAlgorithms?;
+    constructor(config?: Partial<CompositeEncryptionManagerConfig> | null);
+    getSupportedAlgorithms(): readonly string[];
+    getEncryptionType(): string;
+    supportsOptions(_opts?: EncryptionOptions | null): boolean;
+    create(config?: CompositeEncryptionManagerConfig | Record<string, unknown> | null, ...factoryArgs: unknown[]): Promise<EncryptionManager>;
+    private resolveDependencies;
+    private resolveSecureChannelManager;
+    private resolveKeyProvider;
+    private resolveCryptoProvider;
+    private resolveNodeLike;
+}
+export default CompositeEncryptionManagerFactory;
+//# sourceMappingURL=composite-encryption-manager-factory.d.ts.map

package/dist/types/naylence/fame/security/encryption/composite-encryption-manager-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite-encryption-manager-factory.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/composite-encryption-manager-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EACxB,KAAK,uBAAuB,EAE5B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAkB3B,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,MAAM,WAAW,gCACf,SAAQ,uBAAuB;IAC/B,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAChE;AASD,qBAAa,iCAAkC,SAAQ,wBAAwB,CAAC,gCAAgC,CAAC;IAC/G,SAAgB,IAAI,+BAAoB;IACxC,SAAgB,SAAS,QAAQ;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAA2B;IACtE,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAA2B;gBAE3D,MAAM,CAAC,EAAE,OAAO,CAAC,gCAAgC,CAAC,GAAG,IAAI;IAW9D,sBAAsB,IAAI,SAAS,MAAM,EAAE;IAI3C,iBAAiB,IAAI,MAAM;IAI3B,eAAe,CAAC,KAAK,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO;IAIpD,MAAM,CACjB,MAAM,CAAC,EAAE,gCAAgC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC1E,GAAG,WAAW,EAAE,OAAO,EAAE,GACxB,OAAO,CAAC,iBAAiB,CAAC;IAwC7B,OAAO,CAAC,mBAAmB;IAyB3B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,eAAe;CAWxB;AAED,eAAe,iCAAiC,CAAC"}

package/dist/types/naylence/fame/security/encryption/composite-encryption-manager.d.ts

@@ -0,0 +1,52 @@
+import type { FameEnvelope } from "@naylence/core";
+import type { SecureChannelManager, CryptoProvider, KeyProvider, NodeEventListener, NodeLike, AttachInfo } from "@naylence/runtime";
+import { EncryptionResult, type EncryptionManager, type EncryptionOptions } from "@naylence/runtime";
+export interface CompositeEncryptionManagerDependencies {
+    readonly secureChannelManager?: SecureChannelManager | null;
+    readonly keyProvider: KeyProvider;
+    readonly cryptoProvider?: CryptoProvider | null;
+    readonly nodeLike?: NodeLike | null;
+    readonly supportedSealedAlgorithms?: readonly string[] | null;
+    readonly supportedChannelAlgorithms?: readonly string[] | null;
+}
+export declare class CompositeEncryptionManager implements EncryptionManager, NodeEventListener {
+    readonly priority = 1000;
+    private secureChannelManager;
+    private readonly keyProvider;
+    private readonly cryptoProvider;
+    private nodeLike;
+    private nodeReady;
+    private lastAttachInfo;
+    private readonly supportedSealedAlgorithms;
+    private readonly supportedChannelAlgorithms;
+    private readonly factoryRegistry;
+    private readonly managerInstances;
+    constructor({ secureChannelManager, keyProvider, cryptoProvider, nodeLike, supportedSealedAlgorithms, supportedChannelAlgorithms, }: CompositeEncryptionManagerDependencies);
+    encryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions): Promise<EncryptionResult>;
+    decryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions): Promise<FameEnvelope>;
+    notifyChannelEstablished(channelId: string): Promise<void>;
+    notifyChannelFailed(channelId: string, reason?: string): Promise<void>;
+    notifyKeyAvailable(keyId: string): Promise<void>;
+    onNodeStarted(node: NodeLike): Promise<void>;
+    onNodeAttachToUpstream(node: NodeLike, attachInfo: AttachInfo): Promise<void>;
+    onNodeStopped(node: NodeLike): Promise<void>;
+    private ensureDefaultManagers;
+    private getManagerForOptions;
+    private getManagerForAlgorithm;
+    private getOrCreateManager;
+    private notifyManagers;
+    private notifyNodeListeners;
+    private applyNodeContext;
+    private resolveFactoryKey;
+    /**
+     * Clear channel cache for a destination address.
+     * Delegates to channel encryption manager instances if available.
+     */
+    clearChannelCacheForDestination(destination: string): void;
+    /**
+     * Remove all channels for a destination.
+     * Delegates to secure channel manager if available.
+     */
+    removeChannelsForDestination(destination: string): number;
+}
+//# sourceMappingURL=composite-encryption-manager.d.ts.map

package/dist/types/naylence/fame/security/encryption/composite-encryption-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite-encryption-manager.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/composite-encryption-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAGV,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAC;AAgB3B,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CAChE;AAeD,qBAAa,0BACX,YAAW,iBAAiB,EAAE,iBAAiB;IAE/C,SAAgB,QAAQ,QAAQ;IAEhC,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,cAAc,CAA2B;IACjD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAoB;IAC9D,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAoB;IAE/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyC;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwC;gBAE7D,EACV,oBAA2B,EAC3B,WAAW,EACX,cAAqB,EACrB,QAAe,EACf,yBAAqD,EACrD,0BAAuD,GACxD,EAAE,sCAAsC;IAW5B,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,gBAAgB,CAAC;IAgBf,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,YAAY,CAAC;IAsBX,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB1D,mBAAmB,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,SAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA8BH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBhD,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5C,sBAAsB,CACjC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,IAAI,CAAC;IAOH,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YAS3C,qBAAqB;YAYrB,oBAAoB;YAcpB,sBAAsB;YAYtB,kBAAkB;YA4ClB,cAAc;YAyBd,mBAAmB;YAmBnB,gBAAgB;IAwC9B,OAAO,CAAC,iBAAiB;IAIzB;;;OAGG;IACI,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAsBjE;;;OAGG;IACI,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;CAsBjE"}

package/dist/types/naylence/fame/security/encryption/default-secure-channel-manager-factory.d.ts

@@ -0,0 +1,23 @@
+import { SecureChannelManagerFactory, type SecureChannelManagerConfig } from "@naylence/runtime";
+import type { SecureChannelManager } from "@naylence/runtime";
+export interface DefaultSecureChannelManagerConfig extends SecureChannelManagerConfig {
+    readonly type: "DefaultSecureChannelManager";
+    readonly channelTtlSeconds?: number;
+    readonly channelTtl?: number;
+    readonly channel_ttl?: number;
+}
+export declare const FACTORY_META: {
+    readonly base: "SecureChannelManagerFactory";
+    readonly key: "DefaultSecureChannelManager";
+};
+export declare class DefaultSecureChannelManagerFactory extends SecureChannelManagerFactory<DefaultSecureChannelManagerConfig> {
+    readonly type = "DefaultSecureChannelManager";
+    readonly isDefault = true;
+    readonly priority = 500;
+    create(config?: DefaultSecureChannelManagerConfig | Record<string, unknown> | null): Promise<SecureChannelManager>;
+    getSupportedAlgorithms(): readonly string[];
+    private resolveChannelTtl;
+    private toPositiveNumber;
+}
+export default DefaultSecureChannelManagerFactory;
+//# sourceMappingURL=default-secure-channel-manager-factory.d.ts.map

package/dist/types/naylence/fame/security/encryption/default-secure-channel-manager-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-secure-channel-manager-factory.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/default-secure-channel-manager-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,2BAA2B,EAC3B,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,WAAW,iCACf,SAAQ,0BAA0B;IAClC,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,qBAAa,kCAAmC,SAAQ,2BAA2B,CAAC,iCAAiC,CAAC;IACpH,SAAgB,IAAI,iCAAiC;IACrD,SAAgB,SAAS,QAAQ;IACjC,SAAgB,QAAQ,OAAO;IAElB,MAAM,CACjB,MAAM,GACF,iCAAiC,GACjC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,IAAW,GACd,OAAO,CAAC,oBAAoB,CAAC;IAOzB,sBAAsB,IAAI,SAAS,MAAM,EAAE;IAIlD,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,gBAAgB;CAczB;AAED,eAAe,kCAAkC,CAAC"}

package/dist/types/naylence/fame/security/encryption/default-secure-channel-manager.d.ts

@@ -0,0 +1,37 @@
+import type { DataFrame, SecureAcceptFrame, SecureCloseFrame, SecureOpenFrame } from "@naylence/core";
+import type { SecureChannelManager, SecureChannelState } from "@naylence/runtime";
+export interface DefaultSecureChannelManagerOptions {
+    readonly channelTtlSeconds?: number;
+}
+export declare class DefaultSecureChannelManager implements SecureChannelManager {
+    private readonly channelsMap;
+    private readonly ephemeralKeys;
+    private readonly channelTtlSeconds;
+    constructor(options?: DefaultSecureChannelManagerOptions);
+    get channels(): Readonly<Record<string, SecureChannelState>>;
+    generateOpenFrame(channelId: string, algorithm?: string): SecureOpenFrame;
+    handleOpenFrame(frame: SecureOpenFrame): Promise<SecureAcceptFrame>;
+    handleAcceptFrame(frame: SecureAcceptFrame): Promise<boolean>;
+    handleCloseFrame(frame: SecureCloseFrame): void;
+    isChannelEncrypted(frame: DataFrame): boolean;
+    hasChannel(channelId: string): boolean;
+    getChannelInfo(channelId: string): Record<string, unknown> | null;
+    closeChannel(channelId: string, reason?: string): SecureCloseFrame;
+    cleanupExpiredChannels(): number;
+    addChannel(channelId: string, channelState: SecureChannelState): void;
+    removeChannel(channelId: string): boolean;
+    /**
+     * Remove all channels for a given destination by matching channel ID prefix.
+     * Channel IDs typically follow the pattern: auto-<destination>-<random>
+     * This is used to cleanup stale channels when a route is removed/rebound.
+     * @param destination The destination address (e.g., "math@fame.fabric")
+     * @returns Number of channels removed
+     */
+    removeChannelsForDestination(destination: string): number;
+    private isSupportedAlgorithm;
+    private deriveChannelKey;
+    private createChannelState;
+    private cleanupEphemeralKey;
+    private currentTimeSeconds;
+}
+//# sourceMappingURL=default-secure-channel-manager.d.ts.map

package/dist/types/naylence/fame/security/encryption/default-secure-channel-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-secure-channel-manager.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/default-secure-channel-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAqD3B,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,qBAAa,2BAA4B,YAAW,oBAAoB;IACtE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0C;IACxE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,OAAO,GAAE,kCAAuC;IAI5D,IAAW,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAElE;IAEM,iBAAiB,CACtB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAA0B,GACpC,eAAe;IAkBL,eAAe,CAC1B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,iBAAiB,CAAC;IA8DhB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+CnE,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAU/C,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAI7C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAiBjE,YAAY,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAyB,GAChC,gBAAgB;IAcZ,sBAAsB,IAAI,MAAM;IAgBhC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,kBAAkB,GAAG,IAAI;IAIrE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQhD;;;;;;OAMG;IACI,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IA0BhE,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,mBAAmB;IAQ3B,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/types/naylence/fame/security/encryption/encryption-manager-registry.d.ts

@@ -0,0 +1,34 @@
+import { type EncryptionManagerFactory } from "@naylence/runtime";
+import type { EncryptionOptions } from "@naylence/runtime";
+type EncryptionFactoryInfo = {
+    readonly totalFactories: number;
+    readonly autoDiscovered: boolean;
+    readonly algorithmMappings: Record<string, string>;
+    readonly typeMappings: Record<string, string[]>;
+};
+export declare class EncryptionManagerFactoryRegistry {
+    private readonly factories;
+    private readonly algorithmToFactory;
+    private readonly typeToFactories;
+    private readonly factorySet;
+    private readonly autoDiscoveredFactories;
+    private autoDiscovered;
+    constructor(autoDiscover?: boolean);
+    private autoDiscoverFactories;
+    registerFactory(factory: EncryptionManagerFactory, options?: {
+        autoDiscovered?: boolean;
+    }): void;
+    getFactoryForAlgorithm(algorithm: string): EncryptionManagerFactory | undefined;
+    getFactoryForOptions(opts?: EncryptionOptions | null): EncryptionManagerFactory | undefined;
+    getFactoriesByType(encryptionType: string): readonly EncryptionManagerFactory[];
+    getAllSupportedAlgorithms(): readonly string[];
+    getRegistryInfo(): EncryptionFactoryInfo;
+    forceRediscovery(): void;
+    isAutoDiscovered(): boolean;
+    ensureInitialized(): void;
+    private ensureAutoDiscovery;
+}
+export declare function getEncryptionManagerFactoryRegistry(): EncryptionManagerFactoryRegistry;
+export declare function registerEncryptionManagerFactory(factory: EncryptionManagerFactory): void;
+export {};
+//# sourceMappingURL=encryption-manager-registry.d.ts.map

package/dist/types/naylence/fame/security/encryption/encryption-manager-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-manager-registry.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/encryption-manager-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjD,CAAC;AAMF,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IACJ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CACF;IACtC,OAAO,CAAC,cAAc,CAAS;gBAEnB,YAAY,GAAE,OAAc;IAMxC,OAAO,CAAC,qBAAqB;IA4DtB,eAAe,CACpB,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GACzC,IAAI;IAsCA,sBAAsB,CAC3B,SAAS,EAAE,MAAM,GAChB,wBAAwB,GAAG,SAAS;IAKhC,oBAAoB,CACzB,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAC9B,wBAAwB,GAAG,SAAS;IAgBhC,kBAAkB,CACvB,cAAc,EAAE,MAAM,GACrB,SAAS,wBAAwB,EAAE;IAK/B,yBAAyB,IAAI,SAAS,MAAM,EAAE;IAK9C,eAAe,IAAI,qBAAqB;IAoBxC,gBAAgB,IAAI,IAAI;IAmBxB,gBAAgB,IAAI,OAAO;IAI3B,iBAAiB,IAAI,IAAI;IAIhC,OAAO,CAAC,mBAAmB;CAK5B;AAID,wBAAgB,mCAAmC,IAAI,gCAAgC,CAGtF;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,wBAAwB,GAChC,IAAI,CAEN"}

package/dist/types/naylence/fame/security/encryption/index.d.ts

@@ -0,0 +1,7 @@
+export * as sealedEncryption from "./sealed/index.js";
+export * as channelEncryption from "./channel/index.js";
+export { DefaultSecureChannelManager, type DefaultSecureChannelManagerOptions, } from "./default-secure-channel-manager.js";
+export { DefaultSecureChannelManagerFactory, type DefaultSecureChannelManagerConfig, FACTORY_META as DEFAULT_SECURE_CHANNEL_MANAGER_FACTORY_META, } from "./default-secure-channel-manager-factory.js";
+export { CompositeEncryptionManager, type CompositeEncryptionManagerDependencies, } from "./composite-encryption-manager.js";
+export { CompositeEncryptionManagerFactory, type CompositeEncryptionManagerConfig, } from "./composite-encryption-manager-factory.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,gBAAgB,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,iBAAiB,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,kCAAkC,EAClC,KAAK,iCAAiC,EACtC,YAAY,IAAI,2CAA2C,GAC5D,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iCAAiC,EACjC,KAAK,gCAAgC,GACtC,MAAM,2CAA2C,CAAC"}

package/dist/types/naylence/fame/security/encryption/sealed/index.d.ts

@@ -0,0 +1,3 @@
+export { X25519EncryptionManager } from "./x25519-encryption-manager.js";
+export { X25519EncryptionManagerFactory } from "./x25519-encryption-manager-factory.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/encryption/sealed/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/sealed/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/types/naylence/fame/security/encryption/sealed/x25519-encryption-manager-factory.d.ts

@@ -0,0 +1,28 @@
+import { EncryptionManagerFactory, type EncryptionManagerConfig } from "@naylence/runtime";
+import type { EncryptionManager, EncryptionOptions } from "@naylence/runtime";
+export interface X25519EncryptionManagerConfig extends EncryptionManagerConfig {
+    readonly type: "X25519EncryptionManager";
+    readonly priority: number;
+    readonly supportedAlgorithms: readonly string[];
+    readonly encryptionType: string;
+}
+export declare const FACTORY_META: {
+    readonly base: "EncryptionManagerFactory";
+    readonly key: "X25519EncryptionManager";
+};
+export declare class X25519EncryptionManagerFactory extends EncryptionManagerFactory<X25519EncryptionManagerConfig> {
+    readonly type: "X25519EncryptionManager";
+    readonly priority: number;
+    private readonly supportedAlgorithms;
+    private readonly encryptionType;
+    constructor(config?: Partial<X25519EncryptionManagerConfig> | null);
+    getSupportedAlgorithms(): readonly string[];
+    getEncryptionType(): string;
+    supportsOptions(opts?: EncryptionOptions | null): boolean;
+    create(_config?: X25519EncryptionManagerConfig | Record<string, unknown> | null, ...factoryArgs: unknown[]): Promise<EncryptionManager>;
+    private resolveKeyProvider;
+    private resolveCryptoProvider;
+    private resolveNodeLike;
+}
+export default X25519EncryptionManagerFactory;
+//# sourceMappingURL=x25519-encryption-manager-factory.d.ts.map

package/dist/types/naylence/fame/security/encryption/sealed/x25519-encryption-manager-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x25519-encryption-manager-factory.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/sealed/x25519-encryption-manager-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EACxB,KAAK,uBAAuB,EAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM9E,MAAM,WAAW,6BAA8B,SAAQ,uBAAuB;IAC5E,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AASD,eAAO,MAAM,YAAY;;;CAGf,CAAC;AAEX,qBAAa,8BAA+B,SAAQ,wBAAwB,CAAC,6BAA6B,CAAC;IACzG,SAAgB,IAAI,4BAAoB;IACxC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAoB;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,CAAC,EAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,IAAI;IAQ3D,sBAAsB,IAAI,SAAS,MAAM,EAAE;IAI3C,iBAAiB,IAAI,MAAM;IAI3B,eAAe,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO;IAgBnD,MAAM,CACjB,OAAO,CAAC,EAAE,6BAA6B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxE,GAAG,WAAW,EAAE,OAAO,EAAE,GACxB,OAAO,CAAC,iBAAiB,CAAC;IAqB7B,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,eAAe;CAaxB;AAED,eAAe,8BAA8B,CAAC"}

package/dist/types/naylence/fame/security/encryption/sealed/x25519-encryption-manager.d.ts

@@ -0,0 +1,43 @@
+import { type FameEnvelope } from "@naylence/core";
+import { EncryptionResult, type EncryptionManager, type EncryptionOptions } from "@naylence/runtime";
+import type { KeyProvider } from "@naylence/runtime";
+import type { CryptoProvider } from "@naylence/runtime";
+import { NodeLike } from "@naylence/runtime";
+interface X25519EncryptionManagerDependencies {
+    readonly keyProvider: KeyProvider;
+    readonly nodeLike?: NodeLike | null;
+    readonly cryptoProvider?: CryptoProvider | null;
+}
+export declare class X25519EncryptionManager implements EncryptionManager {
+    private readonly keyProvider;
+    private readonly nodeLike?;
+    private readonly cryptoProvider?;
+    private readonly pendingEnvelopes;
+    private readonly keyRequestsInProgress;
+    constructor({ keyProvider, nodeLike, cryptoProvider, }: X25519EncryptionManagerDependencies);
+    encryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions | null): Promise<EncryptionResult>;
+    decryptEnvelope(envelope: FameEnvelope, opts?: EncryptionOptions | null): Promise<FameEnvelope>;
+    notifyKeyAvailable(keyId: string): Promise<void>;
+    private encryptWithKey;
+    private resolveRecipientKey;
+    private resolvePrivateKey;
+    private queueEnvelopeForKey;
+    private lookupKeyById;
+    private safeGetKeyRecord;
+    private extractPublicKeyFromRecord;
+    private extractPrivateKeyFromRecord;
+    private decodeKeyMaterial;
+    private decodePemToRawKey;
+    private extractKeyFromOptions;
+    private toUint8Array;
+    private deriveTemporaryKeyId;
+    private extractRecipientKeyId;
+    private isDataFrameEnvelope;
+    private hasPayload;
+    private isDecryptableEnvelope;
+    private makeJsonSerializable;
+    private decodeBase64Flexible;
+    private getRecordValue;
+}
+export {};
+//# sourceMappingURL=x25519-encryption-manager.d.ts.map

package/dist/types/naylence/fame/security/encryption/sealed/x25519-encryption-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x25519-encryption-manager.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/encryption/sealed/x25519-encryption-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAOlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAM7C,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACjD;AAUD,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAwB;IACxD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqC;IACtE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;gBAE/C,EACV,WAAW,EACX,QAAe,EACf,cAAqB,GACtB,EAAE,mCAAmC;IAMzB,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,iBAAiB,GAAG,IAAW,GACpC,OAAO,CAAC,gBAAgB,CAAC;IAsCf,eAAe,CAC1B,QAAQ,EAAE,YAAY,EACtB,IAAI,GAAE,iBAAiB,GAAG,IAAW,GACpC,OAAO,CAAC,YAAY,CAAC;IAuDX,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA+C/C,cAAc;YA4Cd,mBAAmB;YAgCnB,iBAAiB;YAyFjB,mBAAmB;YAuEnB,aAAa;YAab,gBAAgB;IAkB9B,OAAO,CAAC,0BAA0B;IAqBlC,OAAO,CAAC,2BAA2B;IAmBnC,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,oBAAoB;IAmC5B,OAAO,CAAC,oBAAoB;IA2C5B,OAAO,CAAC,cAAc;CAIvB"}

package/dist/types/naylence/fame/security/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./cert/index.js";
+export * from "./encryption/index.js";
+export * from "./keys/index.js";
+export * from "./signing/eddsa-envelope-verifier.js";
+export { registerAdvancedSecurityFactories } from "./register-advanced-security-factories.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/naylence/fame/security/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sCAAsC,CAAC;AACrD,OAAO,EAAE,iCAAiC,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/types/naylence/fame/security/keys/index.d.ts

@@ -0,0 +1,3 @@
+export { X5CKeyManager, type X5CKeyManagerOptions } from "./x5c-key-manager.js";
+export { X5CKeyManagerFactory, FACTORY_META as X5C_KEY_MANAGER_FACTORY_META, type X5CKeyManagerConfig, } from "./x5c-key-manager-factory.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/naylence/fame/security/keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,oBAAoB,EACpB,YAAY,IAAI,4BAA4B,EAC5C,KAAK,mBAAmB,GACzB,MAAM,8BAA8B,CAAC"}